Breaking the secrecy of the voting booth

Thanks to Glyn via the ORG list for the pointer to this YouTube video by Ron Gongrijp and co.:



After nearly 20 years of using computing machines, a TV programme just before the elections last year finally brought home the problems with evoting to the masses. The Dutch have now abandoned computer based voting, at least for the time being.

"On September 27, 2007 the Election Process Advisory Commission issued its 'Voting with confidence' report. The State Secretary for the Interior immediately announced that the 'Regulation for approval of voting machines 1997' will be withdrawn. On October 1, 2007 the District Court of Amsterdam decertified all Nedap voting computers currently in use in The Netherlands. The court order is a result of an administrative law procedure started by 'We do not trust voting computers' in March 2007. On October 21, 2007 the 'Regulation for approval of voting machines 1997' was finally withdrawn.

Elections in the Netherlands will be held using paper ballots and red pencil for a while. After that, we will likely be using 'vote printers' and separate counting machines."

Pity Bertie Ahern won't take the hint.

Data on 160,000 children lost by London hospital

I'm fairly sure these kinds of data losses are not new but in the wake of the HMRC debacle they have become temporarily newsworthy. The latest, via Ideal Government. I hope Ruth Kennedy won't mind me quoting her in full:

"That-paper-which-now-looks-really-heavyweight-in-comparison-to-all -the-freebie-showbiz-gossip-rags reports tonight that the personal details of 160,000 children have been lost at a London hospital in a fresh blunder over confidential information.

A computer disc containing the data was sent to St Leonard’s Hospital in Hackney but failed to reach the right department - even though it was signed for by hospital staff. The disc contained the names, dates of birth and addresses of 160,000 children and there were fears the information could be enough for criminals to create fake identities. The blunder occurred when the disc was sent by courier to the Hackney hospital by BT, which operates the NHS’s IT system, on 14 November. It is believed the courier company used by BT did not check that it was signed for by the correct person and the disc never reached its intended destination in the IT department.

A spokeswoman for City and Hackney Primary Care Trust, which runs St Leonard’s Hospital, said “BT couriered a fully encrypted disc containing patient information to City and Hackney PCT. “It was not received by the named recipient, and attempts by the PCT to find the disc have so far failed. All deliveries of personal information have been suspended in light of the breach.” BT today called for parents to remain calm over the latest incident. A spokesman said: “Patients should not be concerned because BT uses the highest levels of security to safeguard the data in its care.

[Er… short of making sure that it or its representatives only hands over the data to the person who is supposed to receive it?]

“All NHS data sent by disc is fully encrypted to industry standards. We apply stringent controls in managing the complex encryption pass phrases necessary for unlocking the data. In this instance the encryption pass phrase would only have been released after one of two named individuals confirmed receipt. This was not confirmed so the encryption pass phrase has not been issued.

Ah… we can relax then. (Though the Standard worries that even 256-bit encryption has recently been shown by researchers to be crackable in two weeks...)

All this attention on missing data is not unhelpful in drawing ordinary people’s attention to a) the volume and frequency of personal data transfers and b) the potential value of their personal data. That’s not a bad thing - probably more effective than a fancy public service advertising campaign. Ruth Carnall, chief executive of NHS London, has asked for an independent review of all NHS data transfer in London. WIBBI all these emergency reviews encompassed a really citizen-centric cost-benefit analysis of centralised data systems. "

When you don't like the decision, sack the decision maker

From the Independent today: You're fired! Councillor loses his job after voting against Donald Trump's golf course

MercExchange win another round v eBay

MercExchange has won the latest round in the long running, electronic button patent, dispute with eBay.

"A federal judge has approved a roughly $30 million judgment against eBay Inc. more than four years after a jury concluded the online auctioneer had infringed on the patent of a small Virginia company.

U.S. District Court Judge Jerome Friedman's certification, issued late Tuesday in Virginia, edges Great Falls, Va.-based MercExchange LLC a step closer to cashing in on its long-running battle against one of the Internet's powerhouses.

But eBay still hopes to avoid writing a check."

Much though we may like to sympathise with the underdog, and in this case MercExchange has apparently reduced its workforce from 40 to 3, it is frankly ludicrous that a patent for a "buy it now" electronic button on a website should have been awarded in the first place, let alone kept expensive lawyers and the full gamut of the US court system (including the US Supreme Court last year, where at the hearing Chief Justice Roberts confessed himself somewhat perplexed that something so obvious could be the subject of a patent dispute) gainfully employed for over four years.

3 strikes and you're terminated

From Michael at ORG:

"Last week’s Social Market Foundation event - ‘Intellectual Property Rights and Consumer Rights’ - despite the title’s implied concern for balance, showed disregard for consumers and promoted rights holders’ interests. The minister responsible for UK-IPO spoke of the need for balance in reforming Britain intellectual property regulation but Government’s actions do not yet evidence this commitment. The BPI’s trail for a UK version of France’s ‘3 strikes’ approach to p2p infringement also gave cause for concern.

The Parliamentary Under-Secretary for the Department for Innovation, Universities and Skills’, Lord Triesman, broad-ranging speech (link to PDF download) took in the usual policy concerns of technological developments, new business models, traffic in infringing content and consumer awareness of IPR. However, a year on from the Gowers Review recommendations for flexible copyright regulation, including a ‘format-shifting’ exception to legalise the near-universal practice of transferring CD recordings to mp3 players, seem no closer despite the rapid allocation of funding to ‘anti-piracy’ enforcement. Ian Brown, billed as the event’s agent provocateur, slammed the speech for its anti-competition and anti-consumer stance. For a more balanced approach to these issues, Ian’s slides are available for download.

In the panel discussion that followed, Richard Mollett flagged moves towards a voluntary agreement between the BPI and ISPs to reduce copyright-infringing traffic, similar to France’s ‘3 strikes’ model. He expects an initial warning from the ISP that infringing traffic is associated with a particular account will halt 75% of infringers. If suspicious activity continues then account suspension is the next step, before the final sanction of account termination. Even assuming there will be adequate appeal procedures, although no assurances were given, this mechanism will harm consumer interests unless systems for identifying protected content operate perfectly. Regardless, and fortunately this point was recognised by all parties to the discussion, cutting off internet access is very much the ‘nuclear option’. The proportionality of this approach still requires broader public discussion given internet access may soon become a basic need, comparable to utilities like water and electricity."

Yale's open courses

Yale now have an open content project, Open Yale Courses. Yaaay(l). (Sorry - couldn't resist it). At the moment they cover astronomy, english, philosophy, physics, political science (I wish they wouldn't call it that - politics is not science), psychology and religious studies.

David Holtzman is on top form again warning of the perils of DRM.

"Wake up consumers and smell the DRMs before it's too late. The big media companies and their toadies are very clearly broadcasting their intentions and it's our own fault if they get away with it. Yesterday, Dan Glickman, the head of the MPAA, discussed the vicious idea of ISP filtering. The idea behind this concept is that the Internet Service Providers would have to use software to spot and expunge copyrighted material that is passing through their network. In other words, the company that you pay for your email and web access would watch everything that you send across the network and if it thought something infringed, remove it before you saw it coming in or sent it going out. And charge you for it. And slow down your bandwidth because of it.

What a good deal for consumers.

Of course, there're plenty of ways around this anyway, such as encrypting streams, hiding the pictures or video inside larger files, etc. So what will the ISPs be made to do then--ban encryption for their customers? This isn't as far-fetched as it might sound, I expect that the day is coming when use of personal encryption will be a crime.

Whenever draconian measures such as this are imposed on the public in an attempt to shore up a dilapidated and depressed institutional structure, it is a social inequity and more importantly, it never works."

Patent Troll Tracker stats for 2007

The Patent Troll Tracker has been adding up the number of patent troll cases seen in the US between January and November 2007.

"Here are the cumulative statistics for the first 11 months of 2007, comparing the various districts. Note that I got an email from someone who had numbers run independently, and I am told I have undercounted the number of cases by X and the number of defendants in EDTX by Y. As I said above, this is really a judgment call. I may not have counted all of the bifurcated Judge Clark cases while someone else may have. Either way, even if my numbers are low, they are astoundingly high compared to history:

ED Texas: 343 patent cases, 1,320 defendants sued (140 troll cases)
CD California: 251 patent cases, 647 defendants sued (17 troll cases)
D New Jersey: 176 patent cases, 329 defendants sued (13 troll cases)
D Delaware: 128 patent cases, 310 defendants sued (16 troll cases)
ND California: 127 patent cases, 240 defendants sued (19 troll cases)
ND Illinois: 125 patent cases, 231 defendants sued (23 troll cases)
SD New York: 95 patent cases, 244 defendants sued (13 troll cases)

Peter Zura has an interesting post here, where he notes that Justia's stats show 2,577 cases for 2007 through the end of November - probably trending to be flat for the year, in terms of number of cases (ECF has 2,741 cases, 248 in November -- which has to have you wondering whether to trust Justia on this). But Zura wonders whether, if you track by the number of defendants, 2007 is in fact busier than previous years.

I think the answer is a resounding yes. The numbers I have collected and the ones others have sent me indicate that even though the number of cases filed nationwide is trending to be flat from 2006 to 2007, or perhaps up slightly - like 5% - the number of defendants sued is way way up. In EDTX alone, there were around 1,000 defendants sued in 2006, give or take. Well, already through the end of November, there are over 1,300 sued, a 30% increase. I am projecting around a 30% increase nationwide from 2006 to 2007, and perhaps even higher. That's about 1,800-2,000 more defendants sued for patent infringement in 2007 vs. 2006."

The obsession with improving voter turnout is dangerous

Daniel Finkelstein at the Times really doesn't care if you vote.

Apparently a government quango, the Councillor's Commission, has decided that councils be allowed to offer people a material incentive, like a free lottery ticket, to encourage people to vote, thereby improving voter turnout in local elections.

" All this stuff about turnout would hardly be worth going on about if it was just a matter of preventing some councillors luring people to the polling station with the offer of a free tombola. Unfortunately the drive to increase turnout has a serious consequence. It leads politicians (particularly, at the moment, Labour ones, who fear it is their voters staying at home) to feel that it is more important to make voting easier than it is to ensure that the voting system is secure...

The Electoral Commission, the body policing the system, has been working hard to ensure voting and politics has integrity. And it has repeatedly argued that we need individual-signed voter registration. Tomorrow it will press its case again. But it is being resisted by MPs. Why? Because it is feared that such registration will reduce turnout.

This obsession with turnout isn't simply pointless. It's dangerous."

'Digital Decision Making: Back to the Future' a "must read"

In a bout of shameless self promotion, I just wanted to say many thanks to Kim Cameron for describing my book, Digital Decision Making: Back to the Future, as "a must read". Coming from one of the smartest digital identity architects of our time, I consider that a huge compliment.

The Canadian Facebook Copyright Activists

Michael Geist set up a Facebook page at the beginning of December to protest against the Canadian government's plans to introduce their own version of the DMCA and EUCD. As of today it has 17,732 members (5 of whom have signed up in time it took me to write this post). Michael has been articulating the problems with the proposed legislation on his blog for some time. Other highly respected bloggers like Cory Doctorow and Howard Knopf have also been railing against the proposals and there have been various real world protests, all of which, superficially at least, seem to have led the minister driving the proposals to stop (scroll to top to see Geist's commentary) and consider whether he is doing the right thing.

The Facebook page is labelled 'Fair copyright for Canada.'

"The Canadian government is about to introduce new copyright legislation that will be a complete sell-out to U.S. government and lobbyist demands. The new Canadian legislation will likely mirror the U.S. Digital Millennium Copyright Act with strong anti-circumvention legislation that goes far beyond what is needed to comply with the World Intellectual Property Organization's Internet treaties. Moreover, it will not address the issues that concern millions of Canadians. For example, the Conservatives' promise to eliminate the private copying levy will likely be abandoned. There will be no flexible fair dealing. No parody exception. No time shifting exception. No device shifting exception. No expanded backup provision. Nothing that focuses on the issues of the ordinary Canadian.

Instead, the government will choose locks over learning, property over privacy, enforcement over education, (law)suits over security, lobbyists over librarians, and U.S. policy over a "Canadian-made" solution.

This group will help ensure that the government hears from concerned Canadians. It will feature news about the bill, tips on making the public voice heard, and updates on local events. With regular postings and links to other content, it will also provide a central spot for people to learn more about Canadian copyright reform."

Craig Venter and the synthetic genomes patents

The ETC Group have been getting exorcised over Craig Venter's latest genome patent land grab.

"Six months ago ETC Group exposed the Venter Institute’s controversial patent applications on the world’s first human-made living organism built entirely from synthetic DNA (dubbed “Synthia” by ETC Group). Newly published patent claims reveal an even bigger grab for ownership of synthetic life.

A suite of patent applications lodged by J. Craig Venter and his colleagues claims exclusive monopoly on a wide swath of synthetic biology and demonstrate a not-so-subtle move to position Venter’s company, Synthetic Genomics, Inc., as the ‘microbesoft’ of synthetic life. Find out about “The Men & Money Behind Synthia.”

This time, Venter’s shop isn’t claiming a single microbe (Synthia) made from synthetic DNA – the new claims are broadly framed to seek exclusive monopoly on ALL synthetic genomes. Venter’s latest bid for extreme monopoly has drawn strong condemnation – but not much surprise – from civil society and from scientists in the field of synthetic biology."

EU Online Copyright Bill Coming

IPWatch worry the publishing industry have got too cosy with EU information Society Commissioner, Viviane Reding.

"European publishers and copyright holders have a friend in European Information Society Commissioner Viviane Reding, which she reinforced last week in describing efforts to push through a new bill on digital publishing copyrights. At the same event, publishers and cutting-edge US technology company SecondLife debated IP issues such as the problems of digital rights management for protecting copyrights.

“Copyright is a cornerstone of the information and knowledge-based society,” Reding told the 6 December European Publishers’ Forum. “This is why I introduced in the new framework an appropriate balance between ownership and access.”

“This is a concrete legal endorsement of the role of copyright and I hope it will send a signal across the whole industry at a critical time,” she said."

A watched society leads to active conformity

Lynne Duke at the Washington Post has been thinking about our growing surveillance society and the degree to which awareness of that surveillance leads people to actively conform to expected behaviour norms.

Thanks to Suw via ORG for the link.

Race.Net Neutrality

Jerry Kang has a fascinating paper on net neutrality pending publication in a forthcoming Journal on Telecommunications and High Technology Law. It's available at SSRN: http://ssrn.com/abstract=1000042 He essentially uses the history of race discrimination to shine a light on net discrimination. This kind of cross disciplinary analysis has long been advocated by my colleagues in the systems department at the Open University.

Abstract:

"The “net neutrality” debate is undergoing a theoretical transition. Since the late 1990s, we have moved from “open access,” to “end to end,” to “net neutrality,” and by 2007, the question seems to have transformed into “anti‐discrimination.” To the extent that net discrimination frames the question, our history and experience with race discrimination should be cognitively salient. Although patently different subjects, these two forms of discrimination share some similarities which have been noted by various commentators but never systematically explored. This Essay begins that study, with the goal of gleaning lessons for telecommunications policy.

A comparison and contrast between race discrimination and net discrimination teaches us, first, to particularize the discrimination at issue, and to be wary of what I call normative carve‐outs in defining discrimination. Second, the comparison sensitizes us to the clash between welfarist and deontological concerns that have not been adequately distinguished within the net neutrality debate. Third, it urges us to be cautious about facile assurances that individual, firm, or market rationality will ensure the public interest. I conclude with a provocative question: do the arguments against net neutrality regulation apply equally well against common carriage obligations for traditional telephony?"

Thanks to various Cyberprofs for the pointer.

Free speech QED

Ruthie at Ruthie's Law has been giving her very own paint by numbers lesson on the value of free speech.

"It is clear that free speech is a requirement in any society which aspires to democracy - a system described by Winnie as the worst form of government, except for all the others. Thus, free speech must be defended. If that means anything at all, it means that free speech must be granted to those whose views are despicable, disgraceful and disgusting (dear Diary, Tucker says that alliteration is admirable).

But what is this free speech? I suggest that it is a right to speak. It is not a right to be heard. It is not a right to speak anywhere one likes. It is a right not to be locked up or persecuted by the State for expressing an unpopular (as opposed to a criminal) point of view. But it is not a right to be given an audience. For some reason it is a matter of principle for some that David “Auschwitz is a lie an exaggeration” Irvine should be able to peddle his turd-speak wherever he likes, on the basis that he describes himself as an historian: so that’s alright then.

If Irwhinge wanted to say that black people were intrinsically inferior to white people it is difficult to see the same approach being adopted. Thus, I conclude that this debate is not really about free speech at all. It is about what people are comfortable hearing. Part of the reason that this country is comfortable about holocaust denial or minimisation is that (unlike Germany) it still congratulates itself for not being on the wrong side. Dear Diary, it is entitled to such congratulation. Yet, alas, it has learned the wrong lesson. The lesson is not that traditional British tolerance will ensure that it does not happen here - even though that may be true. The lesson is that people like Irwhinge and Grithick mean what they say. We tend to find that thought so incomprehensible that we shy away from it, and thus fail to learn the lesson of history.

Once one grants that the people who speak freely mean what they say, the debate sharpens up considerably. If we entirely prevent them speaking then, apart from driving their views underground (a tactical debate which I do not address here), we must trust the state to get it absolutely right when determining who can and cannot speak out. Most of us do not have that level of trust in the state and, in a democracy, most politicians do not have that level of trust in themselves. Good...

As dear old Voltaire should have said: “I do not agree with what you say, but I will defend to the death your right to mumble it to the other addle-pates whilst not being prosecuted for doing it. However, the minute you begin not to mumble you are liable to arrest if your words result in actions against those about whom you speak, of which there is a clear risk to an objective observer.” That dear Diary, is the issue of criminalising hate-based conduct. Whether we have the balance right is another question. That there is a balance should be plain. Ultimately we all have a choice about what we hear. How we exercise that choice is something that impacts on everyone and is thus a moral decision. Our fear of that decision must not prevent us denying the essential reality that we are responsible for what we do and that millions of individual decisions matter. If one feels too insignificant to make a difference that is sad. But it is not an excuse for denying the obvious in a self-indulgent attempt to stay in the nursery."

Read it in full and the comments. Great stuff.

Here we go again...

Data of 60,000 on stolen computer

"A laptop computer containing personal details of up to 60,000 people has been stolen from the Citizens Advice Bureau in Belfast."

Wikipedia in the Nazi speech firing line

From News.com: Politician files charge over Nazi symbols on Wikipedia

"A left-wing German politician has filed charges against online encyclopedia Wikipedia for promoting the use of banned Nazi symbols in Germany.

Katina Schubert, a deputy leader of the Left party, said she had filed the charge with Berlin police on the grounds that Wikipedia's German language site contained too much Nazi symbolism, particularly an article on the Hitler Youth movement."

ContactPoint Early Day Motion

Via Terri Dowty:

" You might want to ask your MP to sign up to this Early Day Motion

CONTACTPOINT
29.11.2007

Brooke, Annette

That this House notes the announcement by the Parliamentary Under-Secretary of State for Children, Schools and Families of the deferral of the implementation of ContactPoint to allow for an independent assessment of its security procedures by Deloitte and to address the changes to ContactPoint that potential system users have suggested, but regrets that this review will not extend to the design and content of ContactPoint; expresses concern over the safety implications of such a vast database containing potentially sensitive information in the light of security breaches at HM Revenue and Customs; further expresses concerns about the projected costs of ContactPoint; notes the conclusion of the House of Lords Select Committee on Merits of Statutory Instruments that the Government has not conclusively demonstrated that a universal database is a proportionate response to the problem being addressed; and therefore calls upon the Government to reconsider its decision to proceed."

Good for her. Meanwhile some people have been writing to the Guardian on the same subject.

"The planned database containing the details of all 11 million children in England should be suspended because it is insecure and will put children's safety at risk, an alliance of independent school heads and privacy campaigners warns today.

In a letter to the Guardian, influential groups representing private schools, together with the human rights campaign Liberty, say it is "ludicrous" that the government intends to push on with the controversial ContactPoint database project while awaiting the outcome of a new security analysis of the system."

Demos report: the new politics of personal information

I heard on the BBC radio news this morning that Demos has published a new report today: We no longer control what others know about us, but we don’t yet understand the consequences... The new politics of personal information compiled by Peter Bradwell and Niamh Gallagher.

"Aims of the study

This report has three aims:

1 to connect the value people gain from an information rich society with the challenges that arise from giving away personal information

2 to raise awareness of the consequences of the increasing reliance on personal information by institutions in the public and private sector

3 to provide a framework within which policy-makers, businesses and individuals can address these challenges in the long term.

This report is intended to push the debate on personal information
beyond the legal and technical language associated with data
protection and identity management. The debate must move towards
something that people – through day-to-day experiences in their own
lives – have a stake in. New trends of communication, customer
services, personalisation, and issues of social inclusion and privacy
are helping to create a new framework for the discussion of personal
information.

Our argument

Personal information has become central to how we live – from
banking online and supermarket shopping, to travelling, social
networking and accessing public services. The visible result of this is a
trend towards personal, tailored services, and with this comes a
society dominated by different forms of information gathering. This
is not just something people are subjected to. They are more and
more willing to give away information in exchange for the
conveniences and benefits they get in return, and are often keen for
the recognition and sense of self it affords.

But there is a tension here. By sharing personal information we
surrender control in the longer term by leaving ourselves open to
judgement by different groups in different ways. The drive to
personalise or tailor services, which is shaped by those judgements,
can lead to differences between what people experience and have
access to. This can mean a narrowing of experience, can lead to social
exclusion, and has significant implications for how we live together as
a society. We argue that these problems can only be resolved by a
more open understanding of and better democratic debate about the
boundaries, rights and responsibilities that regulate the use of
personal information. That debate should focus on developing the
collective rules that determine individuals’ ability to negotiate how
personal information is used...

Recommendations

People themselves must be put at the centre of information flows.
Our findings suggested a number of measures that government, the
private sector and individuals could follow to improve the relationship
between people, personal information and the institutions that
use that information.

For individuals, we recommend:


The first step is for individuals to take measures to protect
their personal information – for example, by securing
wireless networks. Second, they must recognise the
connections between the benefits of sharing information,
and the often less tangible costs and dangers that can
result. A better understanding of this relationship is the
necessary step towards bottom-up policy driven by
collectively negotiated norms and rules, rather than policy
driven by the narrower needs and interests of government
or business. However, this does need considerable support
from government and the private sector to start the
process.

For government, we recommend:


The government should develop a more coherent strategy
around personal information use. This strategy should
clarify the links between how government will use
personal information, in specific contexts, and what the
potential benefits or costs might be for individuals. Each
government department using personal information must
say how they are accessing personal information, for what
purpose, and how it affects people. They should also
employ ‘cash-handling’ disciplines for dealing with
people’s personal information.


The government should begin long-term research and
thinking into increasing levels of information about
individuals, coupled with personalising services and
experiences. Segmentation and increasing knowledge of
individuals will create markets that exclude in ways that
current uses of information do not. That will have a
significant impact on what is meant by equality. For
example, will a new frontier of the welfare state be
providing life insurance for certain types of people who
are deemed bad investments by private insurance
providers?

The Information Commissioner’s Office (ICO) needs
greater capacity to cope with the range of demands of an
information society, which continue to extend away from
just security of data towards data use and the nature of
information sharing. For example, that could include the
ability for the ICO to audit organisations’ use of personal
information without needing their consent.

‘Privacy impact assessments’ should be used for major
projects across public and private sectors to assess the use
of personal information early in development, led by the
ICO.


There needs to be a serious, renewed debate about the
identity card scheme, with the kind of engagement that
should have happened at the start of the process.
Otherwise, the scheme should be dropped. There needs to
be more open consideration of what kind of information
the cards would hold, why, and in what circumstances
they will be used.Meaningful engagement with the
public about how the technology should work must be
foremost in shaping what the cards do, if they are to go
ahead.

For business and the private sector, we recommend:


The rights of access individuals have to information held
about them in the private sector should be extended,
including the right to know what groups people have been
‘segmented’ into, and allow greater ability for individuals
to challenge and change existing information about themselves
that they believe to be invalid, incorrect or unfair.


Information holders should engage in an open debate
about where responsibility for personal information lies,
with a view to clarifying the rights and responsibilities of
businesses and individuals.


There should be a common sense test for privacy
statements and personal information policy. The private
sector must provide simple, accessible explanations of
why personal information is gathered. It is too easy
currently to adapt and rely on established legalistic
policies. A move away from jargon is needed. This means,
for example, requiring businesses to follow the legal
concept of the ‘reasonable person’ when drawing up
policy statements on personal information.

Banks should consider a ‘no claims bonus’ for customers
who successfully protect their personal information.

Technical distinctions used by business – between
authenticators and identifiers, for example – should be
binned. As for government, private sector involvement in
digital identity should be grounded in the ways that
people use and value their digital identities. That should
imply a move away from using information people are
likely to divulge – such as family maiden names, dates of
birth – as ‘authenticators’ instead.


As a bridge between people, policy-makers and
technologists, a body such as the ICO should be given the
remit and resources to lead open discussions and debate
to help build more secure, effective and appropriate
technology for personal information."