The Washington Post has more on the story of the Maryland State Police admitting they labeled 53 nonviolent activists as terrorists and added their names to state and federal databases. The Post reports:

Maryland State Police labeled members of a Montgomery County environmental group as terrorists and extremists days after they held a nonviolent protest at an appearance by then-Gov. Robert L. Ehrlich Jr. at a Bethesda high school.

Police files released to the activists reveal that the governor’s security detail alerted the state police’s Homeland Security and Intelligence Division to what troopers guarding Ehrlich described as “aggressive protesting” by the Chesapeake Climate Action Network in 2005. Read more »

Last year, I was co-counsel on an amicus curiae brief (pdf) in IMS Health v. Ayotte, a case about a New Hampshire state law that banned the sale of prescriber-identifiable prescription drug data for marketing purposes. This week, the US Court of Appeals for the First Circuit upheld (pdf) the New Hampshire law. This decision overturns the ruling (pdf) of the lower court, which held that the New Hampshire law violated the free speech rights of data mining companies. 

The First Circuit rejected the free speech argument and based their decision on two points. First:

Second:

Even if the Prescription Information Law amounts to a regulation of protected speech — a proposition with which we disagree — it passes constitutional muster. In combating this novel threat to the cost-effective delivery of health care, New Hampshire has acted with as much forethought and precision as Constitution demands. Read more »

Disclosure: I am currently a Visiting Scholar at the ACLU.

Ars Technica has an interesting story concerning documents released under the Freedom of Information Act to the ACLU and EFF.

Courts in recent years have been raising the evidentiary bar law enforcement agents must meet in order to obtain historical cell phone records that reveal information about a target’s location. But documents obtained by civil liberties groups under a Freedom of Information Act request suggest that “triggerfish” technology can be used to pinpoint cell phones without involving cell phone providers at all.

Triggerfish, also known as cell-site simulators or digital analyzers, are nothing new: the technology was used in the 1990s to hunt down renowned hacker Kevin Mitnick. By posing as a cell tower, triggerfish trick nearby cell phones into transmitting their serial numbers, phone numbers, and other data to law enforcement. Most previous descriptions of the technology, however, suggested that because of range limitations, triggerfish were only useful for zeroing in on a phone’s precise location once cooperative cell providers had given a general location. Read more »

The New York Times has an interesting story on some privacy and civil liberty questions surrounding the National Security Agency’s warrantless wiretapping program that the Obama administration will face early on.

The Justice Department will be asked to respond to motions in legal challenges to the National Security Agency’s wiretapping program, and must decide whether to continue the tactics used by the Bush administration — which has used broad claims of national security and “state secrets” to try to derail the challenges — or instead agree to disclose publicly more information about how the program was run.

When he takes office, Mr. Obama will inherit greater power in domestic spying power than any other new president in more than 30 years, but he may find himself in an awkward position as he weighs how to wield it. As a presidential candidate, he condemned the N.S.A. operation as illegal, and threatened to filibuster a bill that would grant the government expanded surveillance powers and provide immunity to phone companies that helped in the Bush administration’s program of wiretapping without warrants. But Mr. Obama switched positions and ultimately supported the measure in the Senate, angering liberal supporters who accused him of bowing to pressure from the right. Read more »

News sources are reporting that AT&T is funding a group to focus on standards for commercial use of consumer data. According to the Washington Post:

The group, the Future of Privacy Forum, will be led by Jules Polonetsky, who until this month was in charge of AOL’s privacy policy, and Chris Wolf, a privacy lawyer for law firm Proskauer Rose. They say the organization, which is sponsored by AT&T, aims to develop ways to give consumers more control over how personal information is used for behavioral-targeted advertising.

The San Francisco Chronicle reports:

The group also is seeking funding from other companies and has a 23-member advisory board that includes people from Facebook, LexisNexis and advocacy groups such as the Center for Democracy and Technology. A professor and privacy adviser to former President Bill Clinton, Peter Swire, who also is advising President-elect Barack Obama, is on the board as well. Read more »

The Privacy Commissioner of Canada and the New York Consumer Protection Board have both issued privacy guides for businesses.

The New York Consumer Protection Board’s “Business Privacy Guide” (pdf) explains “how to handle personal identifiable information and limit the prospects of identity theft.” The guide notes that, “After California, New York leads the nation in the number of data breach incidents each year. And, New York is 6th per-capita in identity theft complaints.” The guide also explains how identity theft affects businesses’ bottom lines.

In 2007, identity theft alone cost businesses over 40 billion. The average data breach today will cost your business $192 per-incident. According to a Ponemon Institute study, almost 33% of customers surveyed stated that they would cut ties with a company that had a data breach. It is not only good business sense for your organization to safeguard personal information, but it should be a core value to promote and retain business. A business plan might not stop data breach and identity theft, but good privacy practice will help to limit its adverse effects and to protect your business from potential liability.

The board also released the “Identity Theft Red Flag Rules Business Alert” (pdf), “a fact sheet for business covering promulgated rules to safeguard data and help banks and financial institutions protect customers against identity theft.” What are red flag rules? Read more »