Re: Fingerprinting annoyance

At 6:26 PM 5/13/96, Mark O. Aldrich wrote:
>On Mon, 13 May 1996, Senator Exon wrote:
>
><snip>
>> i can fill out and manipulate the card myself i just need a
>> working method.
>> is there no privacy advocate who can help me?
>>
>
>I think most privacy advocates would advise, "Refuse to submit."  It
>sounds like you're looking for more of a hack on the fingerprinting process.

And if you are working for me, and I ask for a fingerprint, and you refuse
or "smear" the results (repeatedly, as the first smearing I may just take
as your token protest and have you printed again), you'll be out the door
by the end of the day.

(Personally, I've never worked for a company which demands fingerprints,
but I've worked for companies which demanded ID badges and signatures, and
these are effectively as intrusive. And I suspect that my former employers
are now using thumbprints, and maybe full prints.)

What one "doesn't like" and considers an "invasion of privacy" varies from
person to person. Some people think having their picture taken is a
stealing of their soul. Others fear nefarious things will be done with the
DNA from their blood samples.

Trying to convince a company that photo ID badges and fingerprints are Bad
Things is perhaps admirable, just realize that in a free society that
employer is under no obligation to hire someone who refuses to go along
with the company's security policies. (This relates to the "civil rights"
thread.)


>of like a key certificate.  If you really can dork the card, have ten
>different people volunteer one print each.  There's no way that they'll
>ever be able to use that as evidence in a court or for any other purpose,
>either.

A stupid idea. As the employer, I wouldn't have to prove it a court of
law...suspicion alone that some of my employees were fucking up a security
system might be enough for me to either a. promote them to the Tiger Team,
or b. fire their asses.

(I just can't understand where this pervasive meme is coming from here on
this list, the notion that employers are severely limited in what they can
do to employees unless they can "prove it in court. Like it or not, most
employees in the United States are still employed "at will," and are not
covered by employment contracts such as some executives and the like get.)

>If you're forced to do this in person with a tech, you can continuously
>"fight" the grip they have on your hand and smudge the card.  However,

Sure. It makes it easy for the employer to simply say "Next candidate."


--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

On Mon, 13 May 1996, Timothy C. May wrote:

> At 6:26 PM 5/13/96, Mark O. Aldrich wrote:
> >On Mon, 13 May 1996, Senator Exon wrote:
> >
> ><snip>
> >> i can fill out and manipulate the card myself i just need a
> >> working method.
> >> is there no privacy advocate who can help me?
> >>
> >
> >I think most privacy advocates would advise, "Refuse to submit."  It
> >sounds like you're looking for more of a hack on the fingerprinting process.
> 
> And if you are working for me, and I ask for a fingerprint, and you refuse
> or "smear" the results (repeatedly, as the first smearing I may just take
> as your token protest and have you printed again), you'll be out the door
> by the end of the day.

On the other hand, if more subtle doctoring escapes your notice....

> (Personally, I've never worked for a company which demands fingerprints,
> but I've worked for companies which demanded ID badges and signatures, and
> these are effectively as intrusive. And I suspect that my former employers
> are now using thumbprints, and maybe full prints.)

I disagree.  ID badges and signatures are identification surely, but the
manner and process by which fingerprints are collected and used is
certainly more intrusive.  There is no, for example, national database of
signatures or corporate ID cards.
 
> Trying to convince a company that photo ID badges and fingerprints are Bad
> Things is perhaps admirable, just realize that in a free society that
> employer is under no obligation to hire someone who refuses to go along
> with the company's security policies. (This relates to the "civil rights"
> thread.)

Which is why clandestine methods are more effective.

Sure, the employer can fire you if they find you out, but they have to
find you out first.

This is why "in your face"ers like Mr. Bell and others tend to fail in
their efforts.  They take the wrecking ball approach rather than run
around the stone in the river.

> >of like a key certificate.  If you really can dork the card, have ten
> >different people volunteer one print each.  There's no way that they'll
> >ever be able to use that as evidence in a court or for any other purpose,
> >either.
> 
> A stupid idea. As the employer, I wouldn't have to prove it a court of
> law...suspicion alone that some of my employees were fucking up a security
> system might be enough for me to either a. promote them to the Tiger Team,
> or b. fire their asses.

I think the concept was that it should be done in a way so as to reduce
attention.  10 dead men's prints (provided none were fugitives) might be
an interesting way to go about it.  Certainly less obvious than smearing.

> (I just can't understand where this pervasive meme is coming from here on
> this list, the notion that employers are severely limited in what they can
> do to employees unless they can "prove it in court. Like it or not, most
> employees in the United States are still employed "at will," and are not
> covered by employment contracts such as some executives and the like get.)
> 
> >If you're forced to do this in person with a tech, you can continuously
> >"fight" the grip they have on your hand and smudge the card.  However,
> 
> Sure. It makes it easy for the employer to simply say "Next candidate."

Seems to me that the issue here is not getting fired, but what the
collected identification information will be used for in future.  I
consider spoofing prints and other biometric type information legitimate
if the motive is to avoid later identification for purposes not related to
the employment for which identification was required.

All this "suck it up and get printed" talk has me somewhat disconcerted
with the list.  Have many here not consistantly indicated that privacy is
something that must be self assured?

Isn't this the list that is so paranoid about what might be done with
escrowed keys?  Who might bribe the keepers into releasing such
information?  What might it be used for?  What about corporations selling
information about employees?

How are fingerprints any easier?

One can thing of countless examples in history (carefully avoiding
Godwin's Law in the process) where once legitimate record keeping and
registration was perverted for illicit, even evil use.

I think that unless proper means are taken to safeguard information,
social security number, license plates, and fingerprint records included,
that the individual is perfectly within rights to take his or her own
safeguarding initiatives.

Where those methods are not intended to simply evade prosecution, but
rather to foil extreme recordkeeping, I believe them legitimate.

> --Tim May

---
My preferred and soon to be permanent e-mail address:unicorn@schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell@pacifier.com

On Mon, 13 May 1996, Timothy C. May wrote:

> At 6:26 PM 5/13/96, Mark O. Aldrich wrote:
> >On Mon, 13 May 1996, Senator Exon wrote:
> ><snip>
> >> i can fill out and manipulate the card myself i just need a
> >> working method.
<snip>
> 
> >of like a key certificate.  If you really can dork the card, have ten
> >different people volunteer one print each.  There's no way that they'll
> >ever be able to use that as evidence in a court or for any other purpose,
> >either.
> 
> A stupid idea. As the employer, I wouldn't have to prove it a court of
> law...suspicion alone that some of my employees were fucking up a security
> system might be enough for me to either a. promote them to the Tiger Team,
> or b. fire their asses.

I think the assertion that Tim is making in regard to an "employer" in the
traditional work-at-will sense is correct, but it's not the one I was
addressing.  If an employer seeks prints and you don't want to give them,
then don't work there.  If, however, the point of gathering the prints is
to record them in the FBI's database, and Senator Exon is worried about
later committing a crime and having print records used to identify him, 
then using the prints of ten different people will muck up such a 
process. 

Senator Exon did not fully explain the situation as to whether or not the 
certification sought will result in fingerprints simply being _checked_, 
or if they will be _recorded_ for later use, nor did he specify to which 
outcome he objects, if not both.

> 
> (I just can't understand where this pervasive meme is coming from here on
> this list, the notion that employers are severely limited in what they can
> do to employees unless they can "prove it in court. Like it or not, most
> employees in the United States are still employed "at will," and are not
> covered by employment contracts such as some executives and the like get.)

I think it comes from some of the statutes being placed on employers.  
The citizens have repeatedly used the legal machine to force employers to 
have to compete is less than a pure, capitalistic environment.  
Monitoring employees is one area that's caused some states to pass laws 
regulating this notion - they have rejected the "if you don't like it, 
don't take the job" premise you've stated here.  Likewise, the minimum 
wage is a similar legislative action we've taken to stop employers from 
using a "if you won't work under these conditions, you don't have a job" 
requisite.  The "pure" capitalistic approach would be "if you won't 
work for $1.00 per hour, take a hike up the street."  We've said that 
this is illegal (at least in most cases), and we force employers to pay 
every employee at least some arbitrary sum greater than than amount.  
Thus, the meme may be the simple extrapolation of these ideals into areas 
over which they do not yet have legal impact.

> 
> >If you're forced to do this in person with a tech, you can continuously
> >"fight" the grip they have on your hand and smudge the card.  However,
> 
> Sure. It makes it easy for the employer to simply say "Next candidate."

Unless they want you badly enough.  I've been able to avoid a number of 
situations because it was not cost effective for them to secure the 
services of someone less qualified.  Policy is great until it gets in the 
way of people making money - almost anything can be "waived" if they want 
you to help them make money, and their greed outweighs their sense of duty 
to comply with a given so-called "security" policy.

------------------------------------------------------------------------- 
|      Liberty is truly dead              |Mark Aldrich                 | 
|    when the slaves are willing          |GRCI INFOSEC Engineering     | 
|     to forge their own chains.          |maldrich@grci.com            | 
|        STOP THE CDA NOW!                |MAldrich@dockmaster.ncsc.mil | 
|_______________________________________________________________________| 
|The author is PGP Empowered.  Public key at:  finger maldrich@grci.com |
|    The opinions expressed herein are strictly those of the author     | 
|         and my employer gets no credit for them whatsoever.           | 
-------------------------------------------------------------------------