Updated: 24.11.2002; 12:09:08 Uhr.
disLEXia
lies, laws, legal research, crime and the internet
        

Friday, May 11, 2001

Word file turns into two disjoint texts

The risks involved when using Microsoft Word, which merely hides text when it appears to have been deleted, have been covered before. Today, however, I encountered a extreme example which nearly fooled me. A computer company responded to my request for a quotation for disc drives by sending me an email with the quotation as a Word attachment.

As a user of Unix and Linux systems, I find Word files mildly annoying, but I can decode most of them easily using the Unix utility word2x; this works quite well except on files which contains graphics. This time, however, the resulting text file revealed a quite different letter, intended for someone at the Univerity of Strathclyde, for a completely different set of equipment. When I copied the file to a Windows box and used Word to view it, it did not show this at all, only the quotation which I had requested. So: one Word file is capable of producing two entirely disjoint texts.

The Unix "strings" utility also revealed only the Stratclyde quotation, so it appears that the deleted text is left as ASCII, while the undeleted text is encoded in some other way. How odd.

The risk: not only that you may reveal information you did not want to reveal, in some cases you may reveal nothing else.

Clive Page, Dept of Physics & Astronomy, University of Leicester [Clive Page via risks-digest Volume 21, Issue 40]
0:00 # G!

Check everyone's Vodafone voicemail

With Vodafone Australia if you want to check your voicemail from a public phone (because your battery has gone flat) you just dial your own mobile number and then interrupt the voicemail greeting by pressing * for the menu. It then asks for your security code.

What is my voicemail security code? I called Vodafone to ask. After they verified it was me (by a phone password) they told me that if I had never set it, the default password is 3333. Another girl in the office next to me just tried hers also and it did the same thing.

The risk? Need to check on your friends', your ex's, your boss', your children's voicemail? ["Andrew Goodman-Jones" via risks-digest Volume 21, Issue 40]
0:00 # G!

To drive or to avoid identity theft: mutually exclusive?

This February, my driver's license came up for renewal -- a fairly ordinary event. I expected to wait briefly at the local Department of Transportation office, take an eye test, have an unflattering photo taken, and be on my way in short order. Alas, it was not to be. When I submitted the renewal form, I was shocked and dismayed to discover that the clerk would not renew my license unless I placed my Social Security number on it. There was no Privacy Act notice on the form (as required by the 1974 Privacy Act), so I asked the clerk why she believed she could to demand my Social Security number -- and refuse me a license if I did not supply it.

What I found out was chilling. Not only does Federal Law -- thanks to the striking of a single word from a huge statute -- require that drivers submit their Social Security numbers when applying for licenses. It also requires that all of the information maintained about a driver by a state -- including that number -- be revealed to virtually all comers. Here are the details of these onerous laws, along with additional information about the laws in my particular state (which are typical of state laws throughout the country). I'll also describe the way in which one state is fighting the Federal laws that would require it to compromise its citizens' privacy and subject them to trivially easy identity theft.

Requirement for Collection

Very recently, welfare reform legislation changed Federal law to require that states collect all citizens' Social Security numbers when they apply for driver's licenses. (Earlier versions of the law only required it if one applied for a *commercial* driver's license, on the theory that one could threaten a deadbeat parent's livelihood if he or she required that license to work.) But a subtle amendment, slipped in just recently, struck the word "commercial," requiring the SSN to be collected from all applicants. The ironically numbered passage at 42 USC 666(a) (see http://www4.law.cornell.edu/uscode/42/666.html) says:

>(13) Recording of social security numbers in certain family matters. - 
>Procedures requiring that the social security number of -
>
>    (A) any applicant for a professional license, driver's
>    license, occupational license, recreational license, or
>    marriage license be recorded on the application;
>
>    (B) any individual who is subject to a divorce decree,
>    support order, or paternity determination or acknowledgment be
>    placed in the records relating to the matter; and
>
>    (C) any individual who has died be placed in the records
>    relating to the death and be recorded on the death certificate.
>    For purposes of subparagraph (A), if a State allows the use of a
>    number other than the social security number to be used on the
>    face of the document while the social security number is kept on
>    file at the agency, the State shall so advise any applicants.

Note that while a different number may be used on the "face" of some licenses, the state must still collect the Social Security number. Also note that many of the items mentioned above are public records which can be accessed by all comers (in some cases, due to open record laws such as Wyoming's).

Requirement to Disseminate

The requirement that states disseminate Social Security Numbers it has collected comes from a law misleadingly titled the "Drivers' Privacy Protection Act." This law did in fact start out as a law to protect drivers' privacy, but due to amendments promoted by monied lobbyists it has just the opposite effect. (It is said, justifiably, that the law should really be called the "Drivers' Privacy Prevention Act.")

The law is reproduced on the Web at http://www.networkusa.org/fingerprint/page1b/fp-dmv-records-18-usc-123.html

Note that this law makes ALL of the information you submit to your state's DMV/DOT available to *anyone* who claims that it's needed for any business purpose. If I wanted your driving records and SSN, all I'd have to do is walk into the courthouse and claim that you owed me a dollar.

The DPPA was challenged by the Alabama Attorney General on states' rights grounds and was ruled unconstitutional by a Federal district court:

http://www.networkusa.org/fingerprint/page1b/fp-dppa-al-appeal.html

However, the US Supreme Court, in a chilling ruling that dubbed our personal information "items in interstate commerce" and therefore subject to Congressional control under the Commerce Clause, reversed the Circuit Court:

http://caselaw.lp.findlaw.com/cgi-bin/getcase.pl?court=US&navby=case&vol=000&invol=98-1464

In retrospect, challenging the law on the basis of states' rights was probably a big mistake. The Alabama AG might have had better success had he cited the right to personal privacy delineated in Griswold v. Connecticut.

State SSN Requirements And Public Records Acts

The laws of many states also mandate the collection of Social Security numbers -- and make the forms containing those numbers public records. I live in Wyoming, and this is the case in my state. (The details of the laws are instructive because they are similar to those in other states; however, if you're uninterested in the specifics, you may want to skip down to the heading "Michigan's Challenge" to learn more about a recent challenge to the Federal laws.)

Wyoming law, at W.S. 31-7-111 (b) ("W.S." = "Wyoming Statutes"), describes the information required on a driver's license application:

>(b)  The application shall include:
>
>     (i)  The full legal name and current mailing and residential 
> address of the
>          person;
>
>     (ii)  A physical description of the person including sex, height 
> and weight;
>
>     (iii)  Date of birth;
>
>     (iv)  The person's social security number or other numbers or letters
>           deemed appropriate on applications for instruction permits,
>           driver's licenses, commercial driver's licenses and
>           commercial driver instruction permits;

Note that the statute does provide for an alternative; however, the phrase "deemed appropriate" (By whom? What is the standard of propriety?) is vague. The clerk said that she, at least, deemed no other numbers or letters to be "appropriate."

The law also requires the state to keep the application on file even after it is processed. According to W.S. 31-7-120,

>31-7-120.  Records to be kept by division; exception.
>
>  (a)  The division shall maintain a readily available file of and 
> suitable indexes for:
>
>     (i)  All license applications denied with the reasons for denial 
> noted thereon;
>
>     (ii)  All applications granted;
>
>     (iii)  Every licensee whose license has been suspended or revoked 
> and the reasons
>            for the action;
>
>     (iv)  All accident reports and abstracts of court records of convictions
>           received under the laws of this state with suitable notations for
>           each licensee showing the convictions of the licensee and the 
> traffic
>           accidents in which he has been involved.

What's more, the application is, according to the state's open records law, a public record that anyone may access. According to W.S. 16-4-201(a)(v),

>(v)  "Public records" when not otherwise specified includes the original 
>and copies of any paper, correspondence, form, book, photograph, 
>photostat, film, microfilm, sound recording, map drawing or other 
>document, regardless of physical form or characteristics that have been 
>made by the state of Wyoming and any counties, municipalities and 
>political subdivisions thereof and by any agencies of the state, 
>counties, municipalities and political subdivisions thereof, or received 
>by them in connection with the transaction of public business, except 
>those privileged or confidential by law;

Needless to say, an open records law would be meaningless if a government agency were allowed to censor the records on its own initiative before revealing them! So, if the Social Security number were to be redacted, the Department of Transportation would have to be specifically authorized by law to do it. Alas, as in most states, there appears to be no Wyoming statute declaring the form -- or the information on it, including the Social Security number -- to be privileged or confidential. Worse still, any such declaration would arguably be overridden by the Federal statute.

Wyoming Violates the Privacy Act

The Wyoming Department of Transportation (WYDOT) also violates the Federal Privacy Act by failing to place a Privacy Act Notice on its driver's license applications. 5 U.S.C. § 552a note (1982) (see http://www.usdoj.gov/foia/privstat.htm), also called the Privacy Act of 1974, provides that:

>(b) Any Federal, State or local government agency which requests an
>individual to disclose his social security account number shall inform
>that individual whether that disclosure is mandatory or voluntary, by what
>statutory or other authority such number is solicited, and what uses will
>be made of it.

Without a Privacy Act notice (which does *not* appear on the current application), WYDOT is not permitted to collect Social Security numbers whether there is a Federal requirement for it to do so or not. This was affirmed in Gredinger v. Davis (see http://www.networkusa.org/fingerprint/page2/fp-ssn-davis.html). Nonetheless, the state's Department of Transportation refuses to issue the license based on an otherwise complete application.

Michigan's Challenge

The Michigan Secretary of State is challenging the Federal laws that, together, require collection and disclosure of Social Security numbers. The two press releases at

http://www.sos.state.mi.us/pressrel/active/010227-1n.html

and

http://www.sos.state.mi.us/pressrel/active/010104-1n.html

describe the progress of the case.

When the Federal law was modified to encompass all drivers' licenses, it was claimed by overzealous legislators that the change was necessary to collect drivers' Social Security numbers to pursue deadbeat parents. The Michigan Secretary of State, however, says that it would actually make their system LESS effective, not more, because of the actual logistics of tracking deadbeat parents. In the second press release cited above, her office wrote:

>Secretary Miller argued in her exemption requests that the collection of 
>Social Security numbers would violate the strong interest her department 
>has in protecting customer privacy.  The process would be expensive and 
>counterproductive to measures already in place by the state to track 
>those owing child support.  It was also noted that in addition to being 
>an unfunded federal mandate, the law raises questions about its ability 
>to protect the welfare of Michigan children.
>
>This federal law applies only to citizens with driver licenses, which 
>severely limits the ability to locate deadbeat parents. Consequently in 
>Michigan, more than four million people would be overlooked because the 
>databases containing records of suspended drivers, state identification 
>card holders and those on the Qualified Voter File would be excluded 
>from any search.
>
>Currently, the Michigan Family Independence Agency (FIA) conducts 
>searches of all Secretary of State databases for deadbeat parents using 
>a name, or even part of a name.  It is successful in obtaining 
>identification 90 percent of the time, according to figures from FIA and 
>the Secretary of State. The Secretary of State estimates that the 
>success rate would drop to about 60 percent under the federal law 
>primarily because searches would be limited to only residents with 
>driver licenses. Other problems with the federal law identified by 
>Secretary Miller include:
>
>* States would not be required to verify the Social Security numbers 
>collected by their Department of Motor Vehicles or Secretary of State 
>offices are correct.
>
>* The law represents a significant duplication of effort because both 
>the Internal Revenue Service and Michigan Department of Treasury already 
>have databases of Social Security numbers.
>
>* The law places the majority at risk for possible misuse of their 
>Social Security numbers and identity fraud in attempts to target a 
>minority guilty of delinquent child support payments.

Unfortunately, because the suit is being brought in only one Federal district, a ruling in favor of the Michigan Secretary of State would not be binding in the rest of the country.

My Status

Deb Ornelas, an administrator at the Wyoming Department of Transportation, insists that I submit my Social Security number in order to keep my license. She says that she believes that her hands are tied by both state and Federal law. Indeed, due to a lack of vigilance by legislators and citizens, they may well be unless the law is challenged and that challenge is successful. Thus, I may need to decide between the risk of trivially easy identity theft or loss of my right to drive.

Suggestions regarding how to proceed, and help in starting an initiative to have the Federal laws changed, would be greatly appreciated.

[Brett Glass via risks-digest Volume 21, Issue 39]
0:00 # G!

Cops say teen concocted radio calls

*Rocky Mountain News*, 11 May 2001 (excerpt) http://rockymountainnews.com/drmn/local/article/0,1299,DRMN_15_455095,00.html

"A 16-year-old boy using a handheld radio and a computer allegedly sent Denver police cruisers and a helicopter to fake emergencies and called officers off legitimate 911 calls for more than a month before getting caught.

Police said Thursday that the teen managed to hack into the department's computer-controlled radio system, program his radio to transmit on the department's frequency from his Southwest Denver home and then took on the alias of Jerry Martinez, a fictitious Denver police officer."

The teen enjoyed chatting with police helicopters flying overhead as well as reporting non-existent emergencies and accidents.

Eventually, police dispatchers caught on. When he called requesting license-plate information, they kept him talking for an hour and a half while the FCC physically located him using "special equipment". The final straw came a couple days later when an informant talked him into modifying another radio to transmit on police frequencies. The teen was charged with a dozen misdemeanors and a dozen felonies.

The best part of the story is near the end:

"Police have not determined how the teen allegedly hacked into their radio system. The police department's emergency radio system uses two sets of security identification codes and a computer to prevent unauthorized access."

Considering all the possible risks here is a scary proposition, especially if used judiciously by someone with a bit more restraint.

-Steve Hutto [Steve Hutto via risks-digest Volume 21, Issue 39]
0:00 # G!


Maximillian Dornseif, 2002.
 
May 2001
Sun Mon Tue Wed Thu Fri Sat
    1 2 3 4 5
6 7 8 9 10 11 12
13 14 15 16 17 18 19
20 21 22 23 24 25 26
27 28 29 30 31    
Apr   Jun

Search


Subsections of this WebLog


Subscribe to "disLEXia" in Radio UserLand.

Click to see the XML version of this web page.

Click here to send an email to the editor of this weblog.