Tag Archives: Privacy

FBI gives police free tool to convert photos for facial recognition – Trapwire

Posted on by
Reply

FBI gives police free tool to convert photos for facial recognition



Thinkstock

Within weeks, police nationwide should be able to obtain free software for matching photos of unidentified suspects against the FBI’s biometric database of 12 million mug shots, according to an Office of the Director of National Intelligence agency.

The FBI and Homeland Security Department are experimenting with facial recognition to determine the real names of illegal immigrants, identify persons of interest in candid photos, and fulfill other law enforcement responsibilities. To make that happen, however, law enforcement agencies at every level of government must share images with compatible technology that they can afford, former FBI officials say.

So, the bureau is offering agencies some of the equipment at no cost.

“Later this summer the FBI will deploy the Universal Face Workstation software, a free-of-charge client application that will provide users with the tools for conducting and managing facial/photo searches with a minimal resource investment,” Kshemendra Paul, program manager for the Information Sharing Environment within the Office of the Director of National Intelligence, wrote in his annual report to Congress.

The document notes the FBI database under development, the $1 billion Next-Generation Identification system, recently began testing facial recognition on images of alleged perpetrators uploaded by several state agencies. Currently, only governments with operational facial recognition technology can participate in the trial.

Those states now have access “to a national gallery of more than 12 million legally collected mug-shot photos to be searched in aid of investigations,” Paul wrote. Facial searches could one day be faster and more accurate than police lineups, advocates say.

This is not the first time the bureau has offered free biometric software to law enforcement partners.

“We provided universal latent workstations for palm prints,” Thomas E. Bush III, who helped develop NGI’s system requirements while assistant director of the FBI’s criminal justice information services division between 2005 and 2009, said earlier this summer. “And we’ll probably do the same thing for face and iris.”

The existing workstation software codes images in a standard format so that authorities can cross-check their photos against pictures in any biometric ID system “from around the neighborhood and around the state to around the nation,” note the software download Web page.

The application accepts scanned images, photos from digital cameras or pictures saved as digital files. The tool then translates each copy into a new file that can be matched against images in NGI, or deposited there for others to search.

Authorized users only need a computer and email connection to the FBI’s database, according to the product specifications.

Related Stories

  • ACLU sues for FBI GPS tracking guidelines
  • FBI is on track to book faces, scars, tattoos in 2014
  • What does your tattoo say about you? The FBI wants to know.
  • Eye on crime: The FBI is building a database of iris scans
    • via m.nextgov.com

    FBI gives police free tool to convert photos for facial recognition – Trapwire

    Posted on by
    Reply

    FBI gives police free tool to convert photos for facial recognition



    Thinkstock

    Within weeks, police nationwide should be able to obtain free software for matching photos of unidentified suspects against the FBI’s biometric database of 12 million mug shots, according to an Office of the Director of National Intelligence agency.

    The FBI and Homeland Security Department are experimenting with facial recognition to determine the real names of illegal immigrants, identify persons of interest in candid photos, and fulfill other law enforcement responsibilities. To make that happen, however, law enforcement agencies at every level of government must share images with compatible technology that they can afford, former FBI officials say.

    So, the bureau is offering agencies some of the equipment at no cost.

    “Later this summer the FBI will deploy the Universal Face Workstation software, a free-of-charge client application that will provide users with the tools for conducting and managing facial/photo searches with a minimal resource investment,” Kshemendra Paul, program manager for the Information Sharing Environment within the Office of the Director of National Intelligence, wrote in his annual report to Congress.

    The document notes the FBI database under development, the $1 billion Next-Generation Identification system, recently began testing facial recognition on images of alleged perpetrators uploaded by several state agencies. Currently, only governments with operational facial recognition technology can participate in the trial.

    Those states now have access “to a national gallery of more than 12 million legally collected mug-shot photos to be searched in aid of investigations,” Paul wrote. Facial searches could one day be faster and more accurate than police lineups, advocates say.

    This is not the first time the bureau has offered free biometric software to law enforcement partners.

    “We provided universal latent workstations for palm prints,” Thomas E. Bush III, who helped develop NGI’s system requirements while assistant director of the FBI’s criminal justice information services division between 2005 and 2009, said earlier this summer. “And we’ll probably do the same thing for face and iris.”

    The existing workstation software codes images in a standard format so that authorities can cross-check their photos against pictures in any biometric ID system “from around the neighborhood and around the state to around the nation,” note the software download Web page.

    The application accepts scanned images, photos from digital cameras or pictures saved as digital files. The tool then translates each copy into a new file that can be matched against images in NGI, or deposited there for others to search.

    Authorized users only need a computer and email connection to the FBI’s database, according to the product specifications.

    Related Stories

  • ACLU sues for FBI GPS tracking guidelines
  • FBI is on track to book faces, scars, tattoos in 2014
  • What does your tattoo say about you? The FBI wants to know.
  • Eye on crime: The FBI is building a database of iris scans
    • via m.nextgov.com

    Tracking Big Foot: Why GPS Location Requires a Warrant | Center for Democracy & Technology

    Posted on by
    Reply
    Filed under Security & Surveillance, More Issues in Security & Surveillance
    Tags:

    In a case that raises as many questions as the average sighting of Big Foot, a panel of the Sixth Circuit Court of Appeals ruled earlier this week that law enforcement officers didn’t need a warrant to obtain GPS location information generated by his cell phone.

    The court’s analysis has been roundly criticized as legally incorrect, lazy, shallow, and vague. I’d like to focus on one aspect of the case that the court missed:  the Department of Justice recommends that police obtain warrants in the scenario presented by this case, does so for good reason, and there were sufficient facts for the government to obtain the warrant that the Department of Justice recommends investigators obtain.

    In this case, U.S. v. Skinner law enforcement officers obtained an order that allowed them to monitor for 60 days the location of a pre-paid cell phone they had good cause to believe was being used by Big Foot, the nickname given trucker eventually identified as Melvin Skinner, who they alleged was transporting marijuana.  They obtained a court order under which the provider, Sprint/Nextel, acting at the behest of law enforcement, pinged the phone repeatedly so it would reveal its location over a three-day period and eventually activated the phone’s GPS functionality to locate the phone’s GPS coordinates.   (Sprint/Nextel recently developed a web portal through which law enforcement can do this automatically for the duration of the court authorization, without contacting the provider each time officers ping the phone.)

    The court found that there was “… no Fourth Amendment violation because Skinner did not have a reasonable expectation of privacy in the data given off by his voluntarily procured … cell phone.”  But, as Jennifer Grannick points out cell phones don’t normally “give off” the kind of GPS location data that law enforcement used to locate Skinner.  Unless the user is employing location services – and Skinner wasn’t – the GPS location data has to be created.  In this case, the provider, under court order, remotely activated the GPS function of Skinner’s phone so the police could track him.

    There’s a critical difference between GPS location information and cell tower location information a mobile phone creates during normal use.  The GPS data in this case is created at the request of law enforcement for tracking purposes and not through the normal use of the mobile phone. The GPS data doesn’t even exist until the provider prompts the device to deliver its GPS location to the provider so law enforcement can access it.  In contrast, providers maintain cell tower location information for business reasons.  Because providers do not normally maintain GPS location information and because it was not voluntarily conveyed to the provider, it is not a “business record” and does not fit into the third party records doctrine, which says that a person has no Fourth Amendment interest in information that is voluntarily revealed to, and held by, a third party.  While the third party doctrine should probably be re-examined, for now we have to live with it, but not for GPS data created by providers at the behest of law enforcement.  For that data, we retain our Fourth Amendment rights against warrantless GPS tracking.  

    Blind Eye to Justice

    Apparently recognizing that GPS is different, the Justice Department recommends that prosecutors obtain a warrant to get GPS location information from mobile communications service providers.  For example, in this power point presentation the Associate Director of the Justice Department Office of Enforcement Operations recommends that prosecutors use search warrants to get prospective GPS location information (referred to as “lat/long data” or latitudinal and longitudinal data) for constitutional, not statutory reasons, and because “anything less presents significant risks of suppression.”  In addition, the Justice Department Associate Deputy Attorney General, testified in April last year that when the government seeks to compel disclosure of prospective GPS coordinates generated by cell phones, it relies on a warrant.

    The Sixth Circuit missed this point entirely.  It blithely rejected Skinner’s Fourth Amendment claims and implicitly bought into the government’s argument that orders under the Stored Communications Act provision at 18 USC 2703(d) can be used to obtain prospective location information that has never been stored.  It did not consider whether the information sought was within the third party records doctrine and it cited no statutory authority for the proposition that the government can compel a provider to create the GPS information for the government to seize.  

    Perhaps most ironically, it seems pretty clear that the government had facts establishing probable cause and could have obtained a warrant if it had applied for one.  As the concurring opinion in Skinner noted, law enforcement officials were watching the drug operation for months, had recorded conversations about an upcoming drug run, learned that the courier was carrying a particular phone that they could track, and that a half ton of marijuana was in transit.  

    A warrant requirement for location information, as advocated by the Digital Due Process coalition, would still mean a drug courier like Skinner would get caught.  If followed, a statutory warrant requirement decreases the chances a criminal would elude jail because the seized evidence would not be at risk of suppression, as it is now for Big Foot if he appeals this decision. 

    For updates, follow us on Twitter at @CenDemTech.

    Issues

    Related Posts

    It Takes a Village to Defend a Network
    Defending networks from malicious hacking exploits depends in large part on the voluntary, cooperative efforts of network operators, device makers, and Internet users.Today the Broadband Internet Technical Advisory Group (BITAG) — a group of technical experts dedicated to building consensus about broadband network management — has released a series of targeted, balanced recommendations to help stifle an emerging type of network attack. That attack has been used in recent years by the hacker…

    Cybersecurity Amendments Would Modernize 25-Year-Old Privacy Law
    [Editors Note: This is one in a of series of blog posts from CDT on the Cybersecurity Act, S. 3414, a bill co-sponsored by Senators Lieberman and Collins that is slated to be considered on the Senate floor soon.]Two amendments to the Senate cybersecurity bill now being debated would require government agents to get a warrant before reading a person’s email or secretly tracking someone through their mobile phone.  The amendments, if adopted, would be a huge privacy gain and address a long-…

    What’s Wrong With the Third Party Doctrine and Einstein 3.0
    In a new book, CDT experts debate some of the most pressing issues in surveillance law today.Patriot Debates: Contemporary Issues in National Security Law features CDT’s Greg Nojeim in a debate on the third-party records doctrine and its application to criminal investigations in the digital age. The doctrine holds that law enforcement does not need a warrant to search and seize information lawfully held by third parties, such as online file hosting services like Dropbox or online email…

    Why Fibbing About Your Age Is Relevant to the Cybersecurity Bill
    [Editors Note: This is one in a of series of blog posts from CDT on the Cybersecurity Act, S. 3414, a bill co-sponsored by Senators Lieberman and Collins that is slated to be considered on the Senate floor soon.]  

    Congress is about to decide whether it is a crime to violate terms of service governing your use of Gmail, Facebook, Hulu, or any other on-line service.

    One of the amendments to the Cybersecurity Act that the Senate is likely to take up this week would substantially increase…

    Tracking Big Foot: Why GPS Location Requires a Warrant

    ‘Safe Data’ Strategies for Health Info on Mobile Devices

    Better Policies for De-Identified Health Data

    Buliding Public Trust in De-Identified Health Data

    Tracking Big Foot: Why GPS Location Requires a Warrant

    Better Policies for De-Identified Health Data

    ‘Safe Data’ Strategies for Health Info on Mobile Devices

    Buliding Public Trust in De-Identified Health Data

    Copyright © 2012 by Center for Democracy & Technology.

    via cdt.org

    https://www.cdt.org/blogs/greg-nojeim/1708tracking-big-foot-why-gps-location-…

    Tracking Big Foot: Why GPS Location Requires a Warrant | Center for Democracy & Technology

    Posted on by
    Reply
    Filed under Security & Surveillance, More Issues in Security & Surveillance
    Tags:

    In a case that raises as many questions as the average sighting of Big Foot, a panel of the Sixth Circuit Court of Appeals ruled earlier this week that law enforcement officers didn’t need a warrant to obtain GPS location information generated by his cell phone.

    The court’s analysis has been roundly criticized as legally incorrect, lazy, shallow, and vague. I’d like to focus on one aspect of the case that the court missed:  the Department of Justice recommends that police obtain warrants in the scenario presented by this case, does so for good reason, and there were sufficient facts for the government to obtain the warrant that the Department of Justice recommends investigators obtain.

    In this case, U.S. v. Skinner law enforcement officers obtained an order that allowed them to monitor for 60 days the location of a pre-paid cell phone they had good cause to believe was being used by Big Foot, the nickname given trucker eventually identified as Melvin Skinner, who they alleged was transporting marijuana.  They obtained a court order under which the provider, Sprint/Nextel, acting at the behest of law enforcement, pinged the phone repeatedly so it would reveal its location over a three-day period and eventually activated the phone’s GPS functionality to locate the phone’s GPS coordinates.   (Sprint/Nextel recently developed a web portal through which law enforcement can do this automatically for the duration of the court authorization, without contacting the provider each time officers ping the phone.)

    The court found that there was “… no Fourth Amendment violation because Skinner did not have a reasonable expectation of privacy in the data given off by his voluntarily procured … cell phone.”  But, as Jennifer Grannick points out cell phones don’t normally “give off” the kind of GPS location data that law enforcement used to locate Skinner.  Unless the user is employing location services – and Skinner wasn’t – the GPS location data has to be created.  In this case, the provider, under court order, remotely activated the GPS function of Skinner’s phone so the police could track him.

    There’s a critical difference between GPS location information and cell tower location information a mobile phone creates during normal use.  The GPS data in this case is created at the request of law enforcement for tracking purposes and not through the normal use of the mobile phone. The GPS data doesn’t even exist until the provider prompts the device to deliver its GPS location to the provider so law enforcement can access it.  In contrast, providers maintain cell tower location information for business reasons.  Because providers do not normally maintain GPS location information and because it was not voluntarily conveyed to the provider, it is not a “business record” and does not fit into the third party records doctrine, which says that a person has no Fourth Amendment interest in information that is voluntarily revealed to, and held by, a third party.  While the third party doctrine should probably be re-examined, for now we have to live with it, but not for GPS data created by providers at the behest of law enforcement.  For that data, we retain our Fourth Amendment rights against warrantless GPS tracking.  

    Blind Eye to Justice

    Apparently recognizing that GPS is different, the Justice Department recommends that prosecutors obtain a warrant to get GPS location information from mobile communications service providers.  For example, in this power point presentation the Associate Director of the Justice Department Office of Enforcement Operations recommends that prosecutors use search warrants to get prospective GPS location information (referred to as “lat/long data” or latitudinal and longitudinal data) for constitutional, not statutory reasons, and because “anything less presents significant risks of suppression.”  In addition, the Justice Department Associate Deputy Attorney General, testified in April last year that when the government seeks to compel disclosure of prospective GPS coordinates generated by cell phones, it relies on a warrant.

    The Sixth Circuit missed this point entirely.  It blithely rejected Skinner’s Fourth Amendment claims and implicitly bought into the government’s argument that orders under the Stored Communications Act provision at 18 USC 2703(d) can be used to obtain prospective location information that has never been stored.  It did not consider whether the information sought was within the third party records doctrine and it cited no statutory authority for the proposition that the government can compel a provider to create the GPS information for the government to seize.  

    Perhaps most ironically, it seems pretty clear that the government had facts establishing probable cause and could have obtained a warrant if it had applied for one.  As the concurring opinion in Skinner noted, law enforcement officials were watching the drug operation for months, had recorded conversations about an upcoming drug run, learned that the courier was carrying a particular phone that they could track, and that a half ton of marijuana was in transit.  

    A warrant requirement for location information, as advocated by the Digital Due Process coalition, would still mean a drug courier like Skinner would get caught.  If followed, a statutory warrant requirement decreases the chances a criminal would elude jail because the seized evidence would not be at risk of suppression, as it is now for Big Foot if he appeals this decision. 

    For updates, follow us on Twitter at @CenDemTech.

    Issues

    Related Posts

    It Takes a Village to Defend a Network
    Defending networks from malicious hacking exploits depends in large part on the voluntary, cooperative efforts of network operators, device makers, and Internet users.Today the Broadband Internet Technical Advisory Group (BITAG) — a group of technical experts dedicated to building consensus about broadband network management — has released a series of targeted, balanced recommendations to help stifle an emerging type of network attack. That attack has been used in recent years by the hacker…

    Cybersecurity Amendments Would Modernize 25-Year-Old Privacy Law
    [Editors Note: This is one in a of series of blog posts from CDT on the Cybersecurity Act, S. 3414, a bill co-sponsored by Senators Lieberman and Collins that is slated to be considered on the Senate floor soon.]Two amendments to the Senate cybersecurity bill now being debated would require government agents to get a warrant before reading a person’s email or secretly tracking someone through their mobile phone.  The amendments, if adopted, would be a huge privacy gain and address a long-…

    What’s Wrong With the Third Party Doctrine and Einstein 3.0
    In a new book, CDT experts debate some of the most pressing issues in surveillance law today.Patriot Debates: Contemporary Issues in National Security Law features CDT’s Greg Nojeim in a debate on the third-party records doctrine and its application to criminal investigations in the digital age. The doctrine holds that law enforcement does not need a warrant to search and seize information lawfully held by third parties, such as online file hosting services like Dropbox or online email…

    Why Fibbing About Your Age Is Relevant to the Cybersecurity Bill
    [Editors Note: This is one in a of series of blog posts from CDT on the Cybersecurity Act, S. 3414, a bill co-sponsored by Senators Lieberman and Collins that is slated to be considered on the Senate floor soon.]  

    Congress is about to decide whether it is a crime to violate terms of service governing your use of Gmail, Facebook, Hulu, or any other on-line service.

    One of the amendments to the Cybersecurity Act that the Senate is likely to take up this week would substantially increase…

    Tracking Big Foot: Why GPS Location Requires a Warrant

    ‘Safe Data’ Strategies for Health Info on Mobile Devices

    Better Policies for De-Identified Health Data

    Buliding Public Trust in De-Identified Health Data

    Tracking Big Foot: Why GPS Location Requires a Warrant

    Better Policies for De-Identified Health Data

    ‘Safe Data’ Strategies for Health Info on Mobile Devices

    Buliding Public Trust in De-Identified Health Data

    Copyright © 2012 by Center for Democracy & Technology.

    via cdt.org

    https://www.cdt.org/blogs/greg-nojeim/1708tracking-big-foot-why-gps-location-…

    Oversight of Government Privacy, Security Rules for Health Data Questioned | Center for Democracy & Technology

    Posted on by
    Reply
    Filed under Health Privacy, HITECH/ARRA Implementation
    Tags:

    Oversight and accountability for following federal privacy and security rules is critical if the public is going to trust that the next generation of electronic health care providers, insurers, and billing services can protect the privacy of their medical information.  A recent report by the Government Accountability Office questions whether sufficient work is being done to build that public trust.

    The GAO report says the Department of Health and Human Services has failed to issue new rules for protecting personal health information and lacks a long-term plan for ensuring that those new rules are being followed.  The HHS Office for Civil Rights (OCR), which is responsible for overseeing these efforts, acknowledged these concerns but noted that rules are winding their way through government channels and that they have “taken the necessary first steps towards establishing a sustainable” oversight program.   

    The report’s two main concerns are: (1) the urgent need for guidance on de-identification methods, and (2) lack of a long-term plan for auditing covered entities and business associates for compliance with federal privacy and security rules (specifically, HIPAA and HITECH).

    De-Identification Guidance

    De-identification is a tool that enables health data to be used for a broad range of purposes while minimizing the risks to individual privacy.  Under HIPAA, there are two methods that can be used to de-identify health data. The first is the safe harbor method, which merely requires the removal of 18 specific categories of identifiers, such as name, address, dates of birth or health care services, and other unique identifiers.  The second is the expert determination method that certifies that the data, in the hands of the intended recipient, raises a very small risk of re-identification. The safe harbor method is static and presumes that the removal of the 18 categories of identifiers translates into very low risk of re-identification in all circumstances.

    In HITECH, Congress directed HHS to complete a study of the HIPAA de-identification standard by February 2010.  Though covered entities rely more on the safe harbor method because it is easier to understand and more accessible, OCR aimed to produce guidance that would “clarify guidelines for conducting the expert determination method of de-identification to reduce entities reliance on the Safe Harbor method,” according to the report.  Two years later and notwithstanding its good intentions, OCR has not released this guidance.  

    CDT has met with industry and consumer stakeholders about how to improve federal policy regarding de-identified health data since 2009. CDT also recently published an article in JAMIA proposing a number of policies to strengthen HIPAA de-identification standards and ensure accountability for unauthorized re-identification.  

    The OCR should issue the required guidance on de-identification without further delay and continue seeking public feedback on how to build trust in uses of de-identified data.  Foot dragging on this issue risks impeding progress on the ability to monitor the public’s health in ways that go far beyond mere notification and routine reporting of symptoms, diagnoses, etc.  With these new capabilities in place, public health officials can move beyond traditional detection and response to outbreaks, enabling earlier disease detection, allowing public health officials to take a more active role monitoring health issues from cancer screening to adult immunizations to HIV.

    Ensuring Compliance

    Routine audits help ensure that covered entities and business associates comply with HIPAA and HITECH regulations.  Audits also provide OCR with important information about how entities covered by HIPAA and HITECH are implementing critically important privacy and security protections, and potentially surface issues needing further regulatory guidance and helping OCR better determine when penalties for noncompliance are warranted.  

    HITECH directed HHS to audit entities covered by HIPAA for compliance with HIPAA and new HITECH requirements; OCR officials began those audits earlier this year. The report states that OCR has no plan to sustain these audits beyond 2012; the report also notes that HHS does not have a defined plan for including HIPAA business associates in its audits. HHS responded that OCR plans to review the pilot audit program at the end of this year and move forward with an audit program after that step is complete.

    If the public is to trust that the privacy of their health information is well protected, it must know where that information is going and how it’s being used. The report highlights the importance of audits as an effective mechanism for accountability. CDT is encouraged by the progress OCR has made to date in its pilot audit program, and we are pleased to see HHS commit to learning from the pilots to developing and implementing a sustained plan for auditing compliance with federal privacy and security regulations. 

    For updates, follow us on Twitter at @CenDemTech.
    via cdt.org

    https://www.cdt.org/blogs/suchismita-pahi/1607oversight-government-privacy-se…

    Oversight of Government Privacy, Security Rules for Health Data Questioned | Center for Democracy & Technology

    Posted on by
    Reply
    Filed under Health Privacy, HITECH/ARRA Implementation
    Tags:

    Oversight and accountability for following federal privacy and security rules is critical if the public is going to trust that the next generation of electronic health care providers, insurers, and billing services can protect the privacy of their medical information.  A recent report by the Government Accountability Office questions whether sufficient work is being done to build that public trust.

    The GAO report says the Department of Health and Human Services has failed to issue new rules for protecting personal health information and lacks a long-term plan for ensuring that those new rules are being followed.  The HHS Office for Civil Rights (OCR), which is responsible for overseeing these efforts, acknowledged these concerns but noted that rules are winding their way through government channels and that they have “taken the necessary first steps towards establishing a sustainable” oversight program.   

    The report’s two main concerns are: (1) the urgent need for guidance on de-identification methods, and (2) lack of a long-term plan for auditing covered entities and business associates for compliance with federal privacy and security rules (specifically, HIPAA and HITECH).

    De-Identification Guidance

    De-identification is a tool that enables health data to be used for a broad range of purposes while minimizing the risks to individual privacy.  Under HIPAA, there are two methods that can be used to de-identify health data. The first is the safe harbor method, which merely requires the removal of 18 specific categories of identifiers, such as name, address, dates of birth or health care services, and other unique identifiers.  The second is the expert determination method that certifies that the data, in the hands of the intended recipient, raises a very small risk of re-identification. The safe harbor method is static and presumes that the removal of the 18 categories of identifiers translates into very low risk of re-identification in all circumstances.

    In HITECH, Congress directed HHS to complete a study of the HIPAA de-identification standard by February 2010.  Though covered entities rely more on the safe harbor method because it is easier to understand and more accessible, OCR aimed to produce guidance that would “clarify guidelines for conducting the expert determination method of de-identification to reduce entities reliance on the Safe Harbor method,” according to the report.  Two years later and notwithstanding its good intentions, OCR has not released this guidance.  

    CDT has met with industry and consumer stakeholders about how to improve federal policy regarding de-identified health data since 2009. CDT also recently published an article in JAMIA proposing a number of policies to strengthen HIPAA de-identification standards and ensure accountability for unauthorized re-identification.  

    The OCR should issue the required guidance on de-identification without further delay and continue seeking public feedback on how to build trust in uses of de-identified data.  Foot dragging on this issue risks impeding progress on the ability to monitor the public’s health in ways that go far beyond mere notification and routine reporting of symptoms, diagnoses, etc.  With these new capabilities in place, public health officials can move beyond traditional detection and response to outbreaks, enabling earlier disease detection, allowing public health officials to take a more active role monitoring health issues from cancer screening to adult immunizations to HIV.

    Ensuring Compliance

    Routine audits help ensure that covered entities and business associates comply with HIPAA and HITECH regulations.  Audits also provide OCR with important information about how entities covered by HIPAA and HITECH are implementing critically important privacy and security protections, and potentially surface issues needing further regulatory guidance and helping OCR better determine when penalties for noncompliance are warranted.  

    HITECH directed HHS to audit entities covered by HIPAA for compliance with HIPAA and new HITECH requirements; OCR officials began those audits earlier this year. The report states that OCR has no plan to sustain these audits beyond 2012; the report also notes that HHS does not have a defined plan for including HIPAA business associates in its audits. HHS responded that OCR plans to review the pilot audit program at the end of this year and move forward with an audit program after that step is complete.

    If the public is to trust that the privacy of their health information is well protected, it must know where that information is going and how it’s being used. The report highlights the importance of audits as an effective mechanism for accountability. CDT is encouraged by the progress OCR has made to date in its pilot audit program, and we are pleased to see HHS commit to learning from the pilots to developing and implementing a sustained plan for auditing compliance with federal privacy and security regulations. 

    For updates, follow us on Twitter at @CenDemTech.
    via cdt.org

    https://www.cdt.org/blogs/suchismita-pahi/1607oversight-government-privacy-se…

    ‘Safe Data’ Strategies for Health Info on Mobile Devices | Center for Democracy & Technology

    Posted on by
    Reply
    iled under Health Privacy, Personal Health Records
    Tags:

    Consumer use of mobile technologies to stay healthy or manage a chronic health condition is increasing; likewise, an increasing number are using these technologies as a digital link to their doctors.  Yet, unlike health care providers who must follow federal privacy and security rules when using mobile technologies to share a patient’s health information, no such rules apply to consumers or their devices.

    Building and maintaining consumer and patient trust in the use of mobile devices is key to delivering on the promise that these mobile tools can bring to improving patient care.  And a key to cultivating that trust is building basic security safeguards into those devices.
     
    CDT teamed up with the law firm of Manatt, Phelps & Phillips LLP to develop “Strategies for Safeguarding Patient-Generated Health Information Created or Shared Through Mobile Devices.”1 The paper comes from CDT and Manatt’s work with the Robert Wood Johnson Foundation’s Project HealthDesign, which is exploring patients’ use of personal health applications to promote better health decision-making by both patients and providers.

    The paper discusses what factors should be considered when protecting patient-generated health information created on or shared through mobile devices, including:

    •    The complexity and cost of the security measure;
    •    The ability (or willingness) of the patient or consumer to deploy the security measure;
    •    The effect the security measure will have on the health or health care management; and
    •    The probability of potential risks to the information, and the potential consequences of a breach of information.

    The paper also recommends specific strategies for securing information on patient mobile devices; such strategies include providing patients with clear information on privacy and security risks and providing them with technical tools to help them manage those risks.

    1. 1. The article was originally published in the Journal of Health Information Management (JHIM), vol. 26, no. 3, by the Health Information Management Systems Society.
    For updates, follow us on Twitter at @CenDemTech.
    via cdt.org

    https://www.cdt.org/blogs/deven-mcgraw/1608safe-data-strategies-health-info-m…

    ‘Safe Data’ Strategies for Health Info on Mobile Devices | Center for Democracy & Technology

    Posted on by
    Reply
    iled under Health Privacy, Personal Health Records
    Tags:

    Consumer use of mobile technologies to stay healthy or manage a chronic health condition is increasing; likewise, an increasing number are using these technologies as a digital link to their doctors.  Yet, unlike health care providers who must follow federal privacy and security rules when using mobile technologies to share a patient’s health information, no such rules apply to consumers or their devices.

    Building and maintaining consumer and patient trust in the use of mobile devices is key to delivering on the promise that these mobile tools can bring to improving patient care.  And a key to cultivating that trust is building basic security safeguards into those devices.
     
    CDT teamed up with the law firm of Manatt, Phelps & Phillips LLP to develop “Strategies for Safeguarding Patient-Generated Health Information Created or Shared Through Mobile Devices.”1 The paper comes from CDT and Manatt’s work with the Robert Wood Johnson Foundation’s Project HealthDesign, which is exploring patients’ use of personal health applications to promote better health decision-making by both patients and providers.

    The paper discusses what factors should be considered when protecting patient-generated health information created on or shared through mobile devices, including:

    •    The complexity and cost of the security measure;
    •    The ability (or willingness) of the patient or consumer to deploy the security measure;
    •    The effect the security measure will have on the health or health care management; and
    •    The probability of potential risks to the information, and the potential consequences of a breach of information.

    The paper also recommends specific strategies for securing information on patient mobile devices; such strategies include providing patients with clear information on privacy and security risks and providing them with technical tools to help them manage those risks.

    1. 1. The article was originally published in the Journal of Health Information Management (JHIM), vol. 26, no. 3, by the Health Information Management Systems Society.
    For updates, follow us on Twitter at @CenDemTech.
    via cdt.org

    https://www.cdt.org/blogs/deven-mcgraw/1608safe-data-strategies-health-info-m…

    Man jailed for putting Tony Blair’s address book online

    Posted on by
    Reply

    Man jailed for putting Tony Blair’s address book online

    Scotland Yard

    Scotland Yard said it was making investigating other activities of computer hacking group Team Poison

    Related Stories

    A hacker from Birmingham has been jailed for six months after publishing the address book of former Prime Minister Tony Blair on the internet.

    Junaid Hussain, 18, admitted putting details online in June 2011 and making hoax calls to a counter-terror hotline.

    He was a leader of Team Poison, a computer hacking group which has claimed responsibility for more than 1,400 illegal activities.

    He was given a three month sentence for each offence at Southwark Crown Court.

    The jail terms will run consecutively.

    Team Poison – which identifies itself as “TeaMp0isoN” online – has previously claimed responsibility for computer hacking attacks involving foreign politicians, major international businesses, an international humanitarian agency and foreign law enforcement.

    Hussain admitted making the hoax calls to the Metropolitan Police anti-terrorist hotline between January 1 2010 and April 14 2012, which prevented legitimate callers getting through.

    A further offence was left to lie on file.

    Scotland Yard said further investigations are ongoing into the activities of other members of TeamPoison.

    via bbc.co.uk

    Team poison.

    Man jailed for putting Tony Blair’s address book online

    Posted on by
    Reply

    Man jailed for putting Tony Blair’s address book online

    Scotland Yard

    Scotland Yard said it was making investigating other activities of computer hacking group Team Poison

    Related Stories

    A hacker from Birmingham has been jailed for six months after publishing the address book of former Prime Minister Tony Blair on the internet.

    Junaid Hussain, 18, admitted putting details online in June 2011 and making hoax calls to a counter-terror hotline.

    He was a leader of Team Poison, a computer hacking group which has claimed responsibility for more than 1,400 illegal activities.

    He was given a three month sentence for each offence at Southwark Crown Court.

    The jail terms will run consecutively.

    Team Poison – which identifies itself as “TeaMp0isoN” online – has previously claimed responsibility for computer hacking attacks involving foreign politicians, major international businesses, an international humanitarian agency and foreign law enforcement.

    Hussain admitted making the hoax calls to the Metropolitan Police anti-terrorist hotline between January 1 2010 and April 14 2012, which prevented legitimate callers getting through.

    A further offence was left to lie on file.

    Scotland Yard said further investigations are ongoing into the activities of other members of TeamPoison.

    via bbc.co.uk

    Team poison.