"Matchcode" technology sparks privacy flames.....

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

One of the main assertions made by both sides in the privacy battles 
is people must be informed when a third party is gathering "personal" 
information about them.

But what constitutes personally identifiable information, anyway? 
Where do "real" privacy concerns begin? Below is a story I wrote  
about Imgis Inc. - a little-noticed company whose cookies are among 
the most common on the Net. If you don't them now, look in your 
cookie file. Chances are you'll find several marked "imgis.com."

Imgis thought it knew what the privacy concerns were with its 
technology. Others thought otherwise. Within two days of hearing 
about impending opposition, the company apparently changed its views.

Note that the technology described is not yet in use.

from http://www.zdnet.com/zdnn/content/inwo/0919/inwo0006.html

Ad tracking technology sparks new privacy war
By Will Rodger
September 19, 1997
11:42 AM PDT
 Inter@ctive Week Online

An effort supported by two of the world's largest advertising brokers 
to tailor advertising to individual Internet users may pose the 
greatest threat yet to the protection of privacy in cyberspace, 
activists said.

Under a system due for rollout in the first half of 1998, the Web 
advertising service Imgis Inc. will begin comparing detailed 
demographic information about Internet users to its stock of Web-
ready ads, sending Net users only those ads Imgis determines are best 
matched to their interests. The company, based in Los Angeles, will 
use a system of "match codes" to identify individual users.

Match codes are unique identifiers used to pick information about 
consumers out of databases, much as banks use Social Security numbers 
to identify customers.

Under the plan, when Internet users visit Web sites carrying Imgis 
ads, participating Internet service operators would send Imgis a 
match code corresponding to a demographic database of 140 million 
consumers maintained by database marketer Metromail Corp.

Imgis would then compare users' names, addresses, estimated incomes 
and automobile ownership against an inventory of advertisements. 
Thus, a white, single 25-year-old man living in Dubuque, Iowa, could 
see an ad that differs from that seen by a 65-year-old American 
Indian woman living in Manhattan.

Yet, at the same time, the system has the ability to track the 
movements of any Internet user across participating sites, 
potentially revealing a dizzying array of confidential information, 
including users' reading habits, health concerns, political 
inclinations and religious affiliations. Imgis executives insist they 
won't do so, but the danger remains, critics said.

Shelley Pasnik, an analyst with the Washington, D.C.-based Center for 
Media Education, slammed the proposal.

"This is huge. This is the most detailed proposal I've seen and 
probably the most significant threat to privacy I've heard of," she 
said.

"This is a really big deal; this is a real step back," added Tara 
Lemmey, chief executive officer of Narrowline Inc., a San Francisco-
based Internet advertising firm and a member of the TRUSTe privacy 
consortium. "This is a case where it's really important to step back 
and say we've really crossed the line."

Imgis, which specializes in Internet advertising, will place ads sold 
by Petry Media Corp. and Katz Media Group Inc.

Exposure of the plan follows four days of hearings on cyberspace 
privacy at the U.S. Federal Trade Commission last June. Though direct 
marketers were often on the defensive over their use of surreptitious 
techniques in gathering consumer information in cyberspace, the FTC 
tentatively concluded that the industry should police itself before 
the government takes action to protect privacy on the Internet.

But the Imgis case "accentuates all the concerns we've been talking 
about," said David Medine, associate director of credit practices at 
the FTC and moderator of most of the sessions. "Up until today, I 
think that users naturally assumed that users were anonymous through 
their Internet service providers when they surfed the Web. I don't 
think that you can say that anymore. If that has changed, it 
represents a dramatic shift in the relationship between the user and 
the Internet."

Medine said the FTC would expect Imgis to disclose all aspects of its 
data gathering through participating Web sites and ISPs if it begins 
using match codes to tailor ad delivery.

In an interview Tuesday, Imgis Chief Executive Officer Chuck Berger 
told Inter@ctive Week that his company had signed two Internet 
service providers, GTE Corp. and Netcom On-Line Communication 
Services Inc., to carry the service sometime in the first half of 
1998.

At the time, Berger said he believed there were no privacy concerns 
with "anonymous match codes," since Imgis had decided not to record 
which sites users visit.

"Once we pull your ad out of our database, we're done," Berger said. 
"We're not following you around the Web."

Imgis abruptly altered its story Thursday after Inter@ctive Week 
found that privacy advocates were up in arms over the technology. 
Marisa Verson, a principal with San Francisco public relations firm 
Interactive Communications Inc., which represents Imgis, said Imgis 
never had agreements with GTE or Netcom.

"GTE is nothing," she said. "If Chuck communicated that, I don't know 
how he even thinks that. This thing isn't even in the speculative 
stage until the privacy thing is down."

GTE spokesman Bill Kula confirmed Thursday morning that "we do use 
Imgis - or plan to - related to using actual public billing files." 
But "there's not a contract between the two companies today."

Netcom officials said they spoke with Imgis more than a year ago 
about the match code proposal but had discarded the idea over privacy 
concerns.

"I have absolutely zero plans to be involved with this," said Netcom 
advertising director Terry Pittman. "Whatever we do needs to be in 
synch with some rules of the road so that people know what we do with 
their information."

Imgis officials, stung by criticism of their plan, said they are 
moving swiftly. Though Berger earlier described Netizens who worry 
about their privacy online as a "vocal minority," Imgis marketing 
director David Kopp said the company is moving to develop some way of 
disclosing how it gathers information online and what it does with 
it.

"We'll come up with a policy that makes sense," Kopp said. "These 
issues are very big issues. The main reason we haven't pursued the 
product is we're not entirely confident we have a set of standards 
that would work. Without informed consent you can't do this sort of 
thing."

Kopp said the company would soon contact TRUSTe for guidance.

TRUSTe Chairman Lori Fena said she hoped to hear from Kopp soon.

"We mandate full disclosure," she said. "We expect full disclosure at 
all the Web sites, so this would no longer be a back-door deal."

The FTC's Medine agreed.

"It's going to take enough firms getting beat up in the press to make 
people realize they have to think about this first - before they 
develop the technology," he said.

Imgis can be reached at www.imgis.com

The FTC can be reached at www.ftc.gov



-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNCQghdZgKT/Hvj9iEQLu5ACfSVkRIbX8iYE7EgKnwV2FIZK82fUAoIBl
2TyMisA624IB1nWUwhI3qx54
=08lI
-----END PGP SIGNATURE-----

At 12:14 PM -0700 9/20/97, Will Rodger wrote:

>One of the main assertions made by both sides in the privacy battles
>is people must be informed when a third party is gathering "personal"
>information about them.
>

I don't know which two sides are the "both sides" you'r describing, but "my
side" believes no such thing.


--Tim May




The Feds have shown their hand: they want a ban on domestic cryptography
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1398269     | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>I spent the weekend in West Virginia, where folks are more than 
happy to
>gossip with (and about) their neighbors. Nobody would try to shut 
them up
>through force of law. This principle does not disappear when the
>information being shared is digital.
>


That's a bold assertion, but not one that squares easily with the 
half-dozen or so privacy laws already on the books at the federal 
level.

I would like to go to those small-town folk of whom urban 
intellectuals write so eloquently and ask them what they would think 
of their neighbors posting all their gossip to a place where millions 
can read it. Something tells me they wouldn't see those two actions 
as one in the same. There is a qualitiative difference between the 
two.

That's about as far as I'm going on that one.

I'm sure Bernstein, DeFalco et al. will have clear reasons for why 
none of us should care less.




-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNCaES9ZgKT/Hvj9iEQJ03QCeLN5sLVLPLOqxtCXSBd85lBwFeMYAoKKI
KAT20ILcFXUM7hFuBdocaomq
=rWy6
-----END PGP SIGNATURE-----

Will Rodger                                           Voice: +1 202-408-7027 
Washington Bureau Chief                        Fax: +1 202-789-2036
Inter@ctive Week                    http://www.interactiveweek.com
A Ziff-Davis Publication            
PGP 5.0: 584D FD11 3035 0EC2 B35C AB16 D660 293F C7BE 3F62
       PGP 2.6.2: D83D 0095 299C 2505 25FA 93FE DDF6 9B5F

On Mon, 22 Sep 1997, Will Rodger wrote, quoting me:

> >I spent the weekend in West Virginia, where folks are more than 
> happy to
> >gossip with (and about) their neighbors. Nobody would try to shut 
> them up
> >through force of law. This principle does not disappear when the
> >information being shared is digital.

> That's a bold assertion, but not one that squares easily with the 
> half-dozen or so privacy laws already on the books at the federal 
> level.

Which law, specifically, would gossiping with (or about) your neighbors
violate?

And yes, some of the "half-dozen or so privacy laws already on the books"
are misguided. Just as many argue laws against drugs, gambling, or
FCC rules prohibiting the broadcast of "indecent" material are also
unconstitutional -- and a waste of our police's time.

> I would like to go to those small-town folk of whom urban 
> intellectuals write so eloquently and ask them what they would think 
> of their neighbors posting all their gossip to a place where millions 
> can read it. Something tells me they wouldn't see those two actions 
> as one in the same. There is a qualitiative difference between the 
> two.

The problem is, I suspect, in drawing that line. Want to try your hand in
drawing a line outlining the scope of "obscenity" laws? Remember they
cover textual material in some states and comics in others. No? I didn't
think so. 

> That's about as far as I'm going on that one.
> 
> I'm sure Bernstein, DeFalco et al. will have clear reasons for why 
> none of us should care less.

I don't think the issue is whether or not individuals should "care" about
others talking about them behind their back. I think the question is how
to address it: through the force of law or not. I may not want to shut up
the Net-Nazis through the force of law (I would argue against it), but I
would certainly "care" what they say and speak out against it myself. 

Not all wrongs can be solved through the law.

-Declan

On Mon, 22 Sep 1997, Declan McCullagh wrote:

> On Mon, 22 Sep 1997, Will Rodger wrote, quoting me:
> 
> > >I spent the weekend in West Virginia, where folks are more than 
> > happy to
> > >gossip with (and about) their neighbors. Nobody would try to shut 
> > them up
> > >through force of law. This principle does not disappear when the
> > >information being shared is digital.
> 
> > That's a bold assertion, but not one that squares easily with the 
> > half-dozen or so privacy laws already on the books at the federal 
> > level.
> 
> Which law, specifically, would gossiping with (or about) your neighbors
> violate?

Slander.

Were I to maliciously spread a rumor, and you got fired, or suffered
economic loss because of my gossip, you could sue me.

> And yes, some of the "half-dozen or so privacy laws already on the books"
> are misguided. Just as many argue laws against drugs, gambling, or
> FCC rules prohibiting the broadcast of "indecent" material are also
> unconstitutional -- and a waste of our police's time.

True, but there is also a large body of law that is civil instead of
criminal.  While we are on social policy, police also enforce
environmental laws which take property and affirmative action which
violate all kinds of freedom of association.

I can be damaged by information - which may be either wrong or out of
context.  Should I have no right to recover or correct such things?  If no
one had the right to the information in the first place (is personal
information part of my personal property?), do I have any rights if it is
both true and damaging (e.g. a felon with an expunged conviction - they
can legally answer "no" if asked if ever convicted of a felony, but the
historical record may show something different).

When we talk about reputation capital, it becomes something that can be
vandalized or stolen.  Were any other form of capital stolen or
vandalized, I could go for damages.

> I don't think the issue is whether or not individuals should "care" about
> others talking about them behind their back. I think the question is how
> to address it: through the force of law or not. I may not want to shut up
> the Net-Nazis through the force of law (I would argue against it), but I
> would certainly "care" what they say and speak out against it myself. 
> 
> Not all wrongs can be solved through the law.

And the converse, just because there is no law (or in the VPs words: "no
controlling legal authority") does not mean it is not a wrong.

virtue destroys vice, and truth destroys error.  What there is no solution
for is ignorance and apathy, and laws will neither inform people or get
them to take action.

--- reply to tzeruch - at - ceddec - dot - com ---

At 14:02 -0400 9/23/97, nospam-seesignature@ceddec.com wrote:
>> Which law, specifically, would gossiping with (or about) your neighbors
>> violate?
>
>Slander.
>
>Were I to maliciously spread a rumor, and you got fired, or suffered
>economic loss because of my gossip, you could sue me.

Not quite. Truth is an absolute defense against slander and libel. If the
gossip is true, which was my hypothetical, what's the cause of action?

>I can be damaged by information - which may be either wrong or out of
>context.  Should I have no right to recover or correct such things?  If no\

No, you should have no right to "recover" what I know about you. This is a
common beginner's misunderstanding. What you seem to be arguing for is
property rights in information. But that is misguided. To grant you such a
right would be to let you muzzle others who say truthful things, violating
their free speech rights.

That is why many "privacy laws" are censorship in disguise.

-Declan


-------------------------
Declan McCullagh
Time Inc.
The Netly News Network
Washington Correspondent
http://netlynews.com/

At 11:26 -0400 9/24/97, nospam-seesignature@ceddec.com wrote:
>Truth was not mentioned specifically.  Gossip is rarely true after the
>first few iterations.  You are correct that if the gossip can be proven
>true that the position is defensible (but I would have to check some legal
>references if it is absolute).

Not all lies are libelous, nor should they be. "I love you," no?

>Technically, I am arguing for property rights in reputation.  Patent and
>copyright are already recognized property rights in information.

And these are divisive issues in the circles I travel in.

But no, technically you are arguing for property rights in //personal
information//. This is not a new concept. Brandeis and Warren first laid
the groundwork for this in their landmark (and misguided) 1890 law review
article. That article was written before the advent of modern First
Amendment jurisprudence and does not take free speech rights into
consideration.

Your scheme -- which is hardly novel -- is worthy of the same contempt.

-Declan



-------------------------
Declan McCullagh
Time Inc.
The Netly News Network
Washington Correspondent
http://netlynews.com/

On Tue, 23 Sep 1997, Declan McCullagh wrote:

> 
> At 14:02 -0400 9/23/97, nospam-seesignature@ceddec.com wrote:
> >> Which law, specifically, would gossiping with (or about) your neighbors
> >> violate?
> >
> >Slander.
> >
> >Were I to maliciously spread a rumor, and you got fired, or suffered
> >economic loss because of my gossip, you could sue me.
> 
> Not quite. Truth is an absolute defense against slander and libel. If the
> gossip is true, which was my hypothetical, what's the cause of action?

Truth was not mentioned specifically.  Gossip is rarely true after the
first few iterations.  You are correct that if the gossip can be proven
true that the position is defensible (but I would have to check some legal
references if it is absolute).

> >I can be damaged by information - which may be either wrong or out of
> >context.  Should I have no right to recover or correct such things?  If no\
> 
> No, you should have no right to "recover" what I know about you. This is a
> common beginner's misunderstanding. What you seem to be arguing for is
> property rights in information. But that is misguided. To grant you such a
> right would be to let you muzzle others who say truthful things, violating
> their free speech rights.

Technically, I am arguing for property rights in reputation.  Patent and
copyright are already recognized property rights in information.

As far as recovering information, I may have no right, but if I contract
with my doctor or lawyer, he has a duty to protect my records.  Perhaps I
could not sue you, but I could sue the people who released the information
to you, and those who had a duty to protect those records.

The "raw" FBI files Livingstone got are an example - they contain lots of
unverified rumor and gossip and could be used to damage the people they
are about.  Did Livingstone do anything wrong, and would there be a
problem posting such information on the internet?

How about personal information such as credit card or social security
numbers or even tax records - you are saying if I can get them, I should
be able to publish them. 

And who determines "truthful"?  This gets back into the ratings scheme.
Movie critics would be in trouble if you leave this caveat in.

> That is why many "privacy laws" are censorship in disguise.

Then on the same basis, are copyright laws.  If I can get a copy of MS
Office, should I be able to publish that?  Copyright does not directly
prevent me from obtaining the information, but it does prevent others from
publishing the information without my permission.  Even cracking a copy
protection scheme does not entitle me to publish the now unprotected
information freely.

I would simply argue that some personal information is functionally
copyrighted by that person without going through the formality (if I
remember right the Berne convention says something is still protected even
if no formal steps have been taken).  Some personal information can be
made public domain - who I appear in public with, what I wear in public,
what I post here, etc. but lots cannot be obtained without commiting some
form of trespass or theft.  You are effectively saying that if you get
something that was stolen, you still should be able to own it (and if you
publish it, have a copyright and own that same information).

If you are arguing that there should be no legal protection for
information of any sort (including patent or copyright) I think you have a
point.  We then would have an equal opportunity for information piracy.

Tom Zerucha writes:
> On Tue, 23 Sep 1997, Declan McCullagh wrote:
> 
> Technically, I am arguing for property rights in reputation.  Patent
> and copyright are already recognized property rights in information.

And this is a good thing?

> The "raw" FBI files Livingstone got are an example - they contain lots of
> unverified rumor and gossip and could be used to damage the people they
> are about.  Did Livingstone do anything wrong, and would there be a
> problem posting such information on the internet?

It would be a real boon for privacy if they were posted to the
internet.  The fall-out ought to reduce government reporting demands.

> How about personal information such as credit card or social security
> numbers or even tax records - you are saying if I can get them, I should
> be able to publish them. 

Bingo!  What you don't want published don't publish.

Don't like it?  Don't reveal information you don't want published.
Argue for chaumian credentials.

btw. your "you are saying if I can get them, I should be able to
publish them." is almost a tautology -- clearly if you get information
you _can_ publish it anonymously.  Therefore anything that is
obtainable is not private.  

Laws claiming to regulate what you can _know_ (data protection laws)
are dumber yet, as it is legislating that you must forget something.
And it is unenforceable -- who knows what you have on your database.

> > That is why many "privacy laws" are censorship in disguise.
> 
> Then on the same basis, are copyright laws.  If I can get a copy of MS
> Office, should I be able to publish that?  Copyright does not directly
> prevent me from obtaining the information, but it does prevent others from
> publishing the information without my permission.  

Copyright doesn't prevent squat.  It just sets up a procedure for your
local force monopoly to harass you if you don't follow the procedure.

> (if I remember right the Berne convention says something is still
> protected even if no formal steps have been taken).

More laws against gravity.

> If you are arguing that there should be no legal protection for
> information of any sort (including patent or copyright) I think you have a
> point.  We then would have an equal opportunity for information piracy. 

Scrap patents and copyright.  Disband WIPO police.

Adam
-- 
Now officially an EAR violation...
Have *you* violated EAR today? --> http://www.dcs.ex.ac.uk/~aba/rsa/

print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

Sorry for the delay, but I have been working massive overtime.

On Wed, 24 Sep 1997, Adam Back wrote:

> Tom Zerucha writes:
> > On Tue, 23 Sep 1997, Declan McCullagh wrote:
> > 
> > Technically, I am arguing for property rights in reputation.  Patent
> > and copyright are already recognized property rights in information.
> 
> And this is a good thing?

Possibly, possibly not.  Declan was arguing that information cannot be
protected.  I was simply pointing out that some is.

> > How about personal information such as credit card or social security
> > numbers or even tax records - you are saying if I can get them, I should
> > be able to publish them. 
> 
> Bingo!  What you don't want published don't publish.
> 
> Don't like it?  Don't reveal information you don't want published.
> Argue for chaumian credentials.

I don't think our tax authority will accept them.  I am compelled to
publish all kinds of information about myself (unless I had a few million
dollars to go to court on each individual issue, e.g. here it is illegal
to drive without insurance, but insurers will not underwrite you unless
you give them lots of information).

I can argue for chaumian credentials all I want, but I will be thrown in
jail because people with guns don't accept them.

If you really believe this, you can engage in your own acts of civil
disobedience in your country and see if they will accept your argument.

> btw. your "you are saying if I can get them, I should be able to
> publish them." is almost a tautology -- clearly if you get information
> you _can_ publish it anonymously.  Therefore anything that is
> obtainable is not private.  

This is like saying that if you keep one million pounds sterling in a
locked safe in your house on your property, and I can break in and get it,
that it is not stealing - anything not nailed down is unclaimed property?
I am entitled to the contents of your wallet if I can get it?

But extend that now if there was a law banning safes (the authorities
don't like them), and that your assets could not be hidden, so should be
kept someplace visible from the outside, and not otherwise protected.
Under this condition should laws against theft be enforced?

> Laws claiming to regulate what you can _know_ (data protection laws)
> are dumber yet, as it is legislating that you must forget something.
> And it is unenforceable -- who knows what you have on your database.

True, but laws can force you to pay damages.  A law attempting to force
restitution for vandalism is equally impossible (you can destroy something
you cannot recreate), but that does not mean vandalism is not a crime, nor
should it be discouraged or go unpunished.

> Copyright doesn't prevent squat.  It just sets up a procedure for your
> local force monopoly to harass you if you don't follow the procedure.
> 
> > (if I remember right the Berne convention says something is still
> > protected even if no formal steps have been taken).
> 
> More laws against gravity.

Laws against theft, rape, robbery and murder do not prevent said acts, but
only tend to discourage them.

> > If you are arguing that there should be no legal protection for
> > information of any sort (including patent or copyright) I think you have a
> > point.  We then would have an equal opportunity for information piracy. 
> 
> Scrap patents and copyright.  Disband WIPO police.

Agreed, but after my state scraps its demand for insurance and information
before I can legally drive, and when the federal government stops
demanding to see all my personal data (now including medical records).

Also, things might simply go to copy-protection using strong digital
signatures and licensing terms making you responsible for any piracy of
your copy (I know, scrap contract law, common law, etc. and then the
license will simply state that we will send thugs to kill you - since
there is no government - if we see this anywhere it isn't in our opinion
supposed to be - replace government force monopoly with private enforcers
sort of like Chicago in the 1920's).  It is not that things like copyright
and patent won't be enforced, but it might be in a more chaotic and not
necessarily better matter than what the government does.  Or work
technologically restricting the information to an even greater degree (a
DVD will only play to a TV if it sees a anti-piracy DS cert).

My argument is while government can compel me to publish information I do
not want to (i.e. violates my rights), it should simultaneously compel
third parties not to forward such information (limiting the potential
damage from that violation).  Scrap both or neither.

Only arguing for repeal of laws that constrain tyrants as much as citizens
is not arguing for liberty.  In the context of a libertarian society, or
even an anarchical society your arguments make a great deal of sense.  In
the current semi-socialism/faschism prevalent now, the effect is to only
penalize me for any attempt to protect myself.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

At 03:46 PM 9/22/97 +0000, Declan McCullagh wrote, regarding the 
right of people to say almost anything anywhere under any 
circumstance:
 This principle does not disappear when the
>> >information being shared is digital.

To which I suggested that simple gossip is qualitatively different 
from posting confidential information about others to, say, a 
newsgroup or Web page. Thus: 

>> That's a bold assertion, but not one that squares easily with the 
>> half-dozen or so privacy laws already on the books at the federal 
>> level.
>
(stuff snipped)

Declan responded:
 
>And yes, some of the "half-dozen or so privacy laws already on the 
books"
>are misguided. Just as many argue laws against drugs, gambling, or
>FCC rules prohibiting the broadcast of "indecent" material are also
>unconstitutional -- and a waste of our police's time.

That's a great response, but I still see little chance that this 
argument will go away on constitutional grounds. Until then, I'm 
reporting on what happens. It's shocking and intellectually 
indefensible, I know, but hey, my money's on reality.;-).


>> I would like to go to those small-town folk of whom urban 
>> intellectuals write so eloquently and ask them what they would 
think 
>> of their neighbors posting all their gossip to a place where 
millions 
>> can read it. Something tells me they wouldn't see those two 
actions 
>> as one in the same. There is a qualitiative difference between the 

>> two.
>
>The problem is, I suspect, in drawing that line. Want to try your 
hand in
>drawing a line outlining the scope of "obscenity" laws? Remember 
they
>cover textual material in some states and comics in others. No? I 
didn't
>think so. 

Actually, I'd be more than happy to "draw the line" if I did such 
things for a living - but I don't. In any case, I'd address the topic 
of privacy on its own without referring to hot button issues like 
obscenity. I invite everyone else to decide if the two issues are a 
fair parallel or not.

I now invite Solveig, Julie and everyone else to comment. Me, I'm 
just betting on the horses....

Will

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNCb73tZgKT/Hvj9iEQLCiACghlPBpeIaUHheWN4Bp9JJXlEFp2IAoLB6
OVSFs2pSDjjRqidKHmy9uT6H
=DRrn
-----END PGP SIGNATURE-----

Tim May wrote:

> At 12:14 PM -0700 9/20/97, Will Rodger wrote:
> 
> >One of the main assertions made by both sides in the privacy battles
> >is people must be informed when a third party is gathering "personal"
> >information about them.
> >
> 
> I don't know which two sides are the "both sides" you'r describing, but "my
> side" believes no such thing.


We do, we just like to phrase it differently.  Such as "if you aren't using
remailers, they're gathering information about you."


> The Feds have shown their hand: they want a ban on domestic cryptography
> ---------:---------:---------:---------:---------:---------:---------:----
> Timothy C. May              | Crypto Anarchy: encryption, digital money,
> ComSec 3DES:   408-728-0152 | anonymous networks, digital pseudonyms, zero
> W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
> Higher Power: 2^1398269     | black markets, collapse of governments.
> "National borders aren't even speed bumps on the information superhighway."

Consider yourself informed that a third party has gathered the above
information about you.

There is, I'm told by reliable sources, a forthcoming Cato Institute report
on electronic privacy that will help put this in perspective -- and
buttress my and Tim's position. Someone from the Competitive Enterprise
Institute, too, took this stance during a bunch of panels at the FTC June
privacy hearings that Will and I attended.

Simply put, you do not have any right to know when people are talking about
you behind their back. It happens all the time and, even though people may
not like it, it is a staple of society.

I spent the weekend in West Virginia, where folks are more than happy to
gossip with (and about) their neighbors. Nobody would try to shut them up
through force of law. This principle does not disappear when the
information being shared is digital.

-Declan


At 00:48 -0700 9/22/97, Tim May wrote:
>At 12:14 PM -0700 9/20/97, Will Rodger wrote:
>
>>One of the main assertions made by both sides in the privacy battles
>>is people must be informed when a third party is gathering "personal"
>>information about them.
>>
>
>I don't know which two sides are the "both sides" you'r describing, but "my
>side" believes no such thing.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

At 07:48 AM 9/22/97 +0000, Tim May wrote:
>At 12:14 PM -0700 9/20/97, Will Rodger wrote:
>
>>One of the main assertions made by both sides in the privacy 
battles
>>is people must be informed when a third party is gathering 
"personal"
>>information about them.
>>
>
>I don't know which two sides are the "both sides" you'r describing, 
but "my
>side" believes no such thing.

Both sides, in this case, is pretty much everyone at the FTC 
roundtable last June. 

The one exception I recall is the position taken by the Competitive 
Enterprise Institute. The CEI took the position that no regulation at 
all was needed and that marketplace forces would police the Net. 
Their view, for better or worse, is not very visible elsewhere.

Another solution, of course, is a techno-arms race solution to 
privacy. That works for readers of this list, but that's not who the 
FTC worries about. Libertarians will, of course, shudder at the 
notion that they should.
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNCaCENZgKT/Hvj9iEQKHVACfaDOopCNdjgRn+GbF+JieznWQ+1UAoI+r
BHcfSL4Ns1bl9hAO2KOPYV+a
=G/I3
-----END PGP SIGNATURE-----

Will Rodger                                           Voice: +1 202-408-7027 
Washington Bureau Chief                        Fax: +1 202-789-2036
Inter@ctive Week                    http://www.interactiveweek.com
A Ziff-Davis Publication            
PGP 5.0: 584D FD11 3035 0EC2 B35C AB16 D660 293F C7BE 3F62
       PGP 2.6.2: D83D 0095 299C 2505 25FA 93FE DDF6 9B5F

Will Rodger blathered:

> Ad tracking technology sparks new privacy war
> By Will Rodger
> September 19, 1997
> 11:42 AM PDT
>  Inter@ctive Week Online
> 
> An effort supported by two of the world's largest advertising brokers
> to tailor advertising to individual Internet users may pose the
> greatest threat yet to the protection of privacy in cyberspace,
> activists said.
...
> Yet, at the same time, the system has the ability to track the
> movements of any Internet user across participating sites,
> potentially revealing a dizzying array of confidential information,
> including users' reading habits, health concerns, political
> inclinations and religious affiliations. Imgis executives insist they
> won't do so, but the danger remains, critics said.

Imgis Inc. would like to point out that these libelous accusations
are being made by a sick, twisted individual who has visited over
3,000 pornography sites in the last six months. (68 of them on
Mother's Day!)
Will Rodgers is well known to Imgis Inc. to be a perverted leftist
loser who spends the time he is not busy slandering honest, decent
people such as ourselves, cruising the InterNet in search of 
underage teenage sluts who like long walks in the park, holding
hands under the full moon, AND CROWBARS SHOVED UP THEIR ASS DURING
STRANGE SEXUAL ACTIVITIES WITH FARMYARD BEASTS!
He has AIDS, cancer, and will soon have his health insurance canceled
by one of our biggest clients. He worships the *wrong* God and votes
for the *wrong* political candidates.

Our future projections, based on his past activities, indicate that
he will soon become a drug dealing pornographer and a terrorist
pedophile.
So ask yourself, "Is this the kind of person I want to have shaping
my views about Imgis Inc.'s public service software?"
If your answer is "Yes.", then perhaps we should reveal what we know
about YOU!

Sincerely,
A. Hoir
Janitor,
Imgis Inc.

What Tim and Declan said.

Historically, I think, third-party (3P) "notice" reflects concern about the
accuracy of files held by others and their accountability.  Much '74-era
privacy talk was about 3Ps like credit issuers making decisions about you
based on incorrect information.  Notice would help you see and correct the
files on you.  Look at the report done on personal privacy in the
information society commissioned for the Privacy Act.

These weren't then and aren't now idle concerns, but a means to an end --
"notice" -- may be being confused with an end.  I'd rather stop
"womb-to-tomb" dossiers than assure their accuracy.

IMHO "notice" of 3P info gathering misses the point.  The problems start
with first and second parties.  Remember, this is about notice for
*gathering* information, not publishing it.  That means notice even if you
never publish or use it.

If we're concerned about the gathering of personal information from public
records, for instance, why was that information collected in the first
place?

If because the gov't is regulating a transaction or relation, is that gov't
regulation necessary?  How much of the information is really needed?  How
much information does DMV need to issue a drivers' license?

Also, requiring third parties to give notice to first parties would raise
massive first amendment issues -- much of what we and the press do is
gather personal information.  What of the address books we all keep?

The constitutional problems would not exist, IMHO, if the gov't had to
notify us when it discloses our personal information.  The gov't is a major
information trafficker, both by extracting information directly, and by
requiring us to report information to 3Ps like banks, etc.

Lee

PS.  BTW, I am not a libertarian.


At 11:48 PM -0800 9/21/97, Tim May wrote:
>At 12:14 PM -0700 9/20/97, Will Rodger wrote:
>
>>One of the main assertions made by both sides in the privacy battles
>>is people must be informed when a third party is gathering "personal"
>>information about them.
>>
>
>I don't know which two sides are the "both sides" you'r describing, but "my
>side" believes no such thing.
>
>
>--Tim May