TUCoPS :: Privacy :: priv_209.txt

Privacy Digest 2.09 3/18/93

PRIVACY Forum Digest     Thursday, 18 March 1993     Volume 02 :
Issue 09

         Moderated by Lauren Weinstein (lauren@cv.vortex.com)
                Vortex Technology, Topanga, CA, U.S.A.
                     ===== PRIVACY FORUM =====

       The PRIVACY Forum digest is supported in part by the 
           ACM Committee on Computers and Public Policy.

     Should the information industry be consentual? (Bob Leone)
     Reverse directory/Sears/Radio Shack (Arthur Rubin)
     Re: Credit Card Validation (Chris Hibbert)
     Use of Medical Clearing House (Jack Decker)
     No anonymity for Canon copiers? (Brad Mears)
     Re: Cashiers and telephone numbers (Chuck Stern)

 *** Please include a RELEVANT "Subject:" line on all submissions!
            *** Submissions without them may be ignored! ***

The PRIVACY Forum is a moderated digest for the discussion and
analysis of
issues relating to the general topic of privacy (both personal and
collective) in the "information age" of the 1990's and beyond.  The
moderator will choose submissions for inclusion based on their
relevance and
content.  Submissions will not be routinely acknowledged.

ALL submissions should be addressed to "privacy@cv.vortex.com" and
must have
RELEVANT "Subject:" lines.  Submissions without appropriate and
"Subject:" lines may be ignored.  Subscriptions are by an automatic
"listserv" system; for subscription information, please send a
consisting of the word "help" (quotes not included) in the BODY of
a message
to: "privacy-request@cv.vortex.com".  Mailing list problems should
reported to "list-maint@cv.vortex.com".  All submissions included
in this
digest represent the views of the individual authors and all
will be considered to be distributable without limitations. 

The PRIVACY Forum archive, including all issues of the digest and
related materials, is available via anonymous FTP from site
in the "/privacy" directory.  Use the FTP login "ftp" or
"anonymous", and
enter your e-mail address as the password.  The typical "README"
and "INDEX"
files are available to guide you through the files available for
access.  PRIVACY Forum materials may also be obtained automatically
e-mail through the listserv system.  Please follow the instructions
for getting the listserv "help" information, which includes details
regarding the "index" and "get" listserv commands, which are used
to access
the PRIVACY Forum archive.  All PRIVACY Forum materials are also
available through the Internet Gopher system via a gopher server on
site "cv.vortex.com".

For information regarding the availability of this digest via FAX,
send an inquiry to privacy-fax@cv.vortex.com, call (310) 455-9300,
or FAX
to (310) 455-2364.


   Quote for the day:

     "I detest life-insurance agents; they always argue that
      I shall some day die, which is not so."

                            -- Stephen Leacock (1869-1944)
                            "Literary Lapses" (1910)
                             (Insurance up to Date)


Date:    Sat, 13 Mar 1993 11:29:08 -0500
From:    Bob Leone <leone@gandalf.ssw.com>
Subject: Should the information industry be consentual?

Pete Kaiser writes:
    @Experience shows that in the business of accumulating and
    databases about personal information there is a high rate of
corruption, of
    both data [1] and individuals [2].  Moreover, there are plenty
of obvious
    cases where the free flow of accurate information is unwise,
inhumane, or
    illegal [3].

Just to give some more extreme examples: if someone was allowed to
data using "employer" as the selection criteria, I'm sure you can
the results of a list of names, home addresses, and car license
numbers of
employees of

     1) Fur makers going to PETA and the Animal Liberation Front
     2) IRS going to extremist Tax Protest groups
     3) BATF going to members of the Waco, Texas "Branch Davidian"
     4) Smith & Wesson going to Handgun Control Inc
     5) Handgun Control Inc going to NRA
     6) Strikebraker employees of whatever going to union goon

I'm sure you all get the picture at this point. Just about everyone
works for someone, shops somewhere, or subscribes to some
periodical which
might make him or her the target of harassment (or worse) from some

Just because we haven't seen it yet, doesn't mean it won't start
eventually as groups become more familiar with how to get data.

Bob Leone


Date:    Mon, 15 Mar 93 07:33:36 PST 
From:    a_rubin@dsg4.dse.beckman.com (arthur rubin)
Subject: reverse directory/Sears/Radio Shack

In PRIVACY Forum Digest 02:08, joep@jaguar.informix.com (Joseph
Pearl) writes:

>I was at Sears with my wife, returning something, when the cashier
>asked what our phone number was.  Without thinking, my wife told
>cashier (one of those rough days where the brain shuts down after
>6pm).  The cashier then recited our name and address and asked if
>was correct.

Radio Shack (used to) "require" a phone number for any purchase. 
If you
told the clerk that you didn't want to give a phone number, the
manager would (usually) allow a cash purchase to complete.  (From
my own
personal experience and reports on comp.dcom.telecom, before this
list was

The moderator comments:

       A comment: I would suggest that it is never a good idea
       to use a fictitious phone number in response to a clerk's
       query.  Doing so simply risks dragging some other person,
       who might have that number, into the situation.  If the
       insists on a number, and you don't want to give it, ask
       for the manager, or consider doing business elsewhere. 

You might give the 900 number you got on your last "you have won a
prize" postcard. :-)  More promising, you might give your work
number, the
number of the local Attorney General's office (it is illegal to ask
for a
phone number under many circumstances here in California), or some
approriate number which you don't mind publishing.


Date:    Mon, 15 Mar 93 10:10:36 -0800
From:    Chris Hibbert <hibbert@memex.com>
Subject: Re: Credit Card Validation

Brint Cooper <abc@BRL.MIL> is worried because Citibank is asking
him to
supply extra information, which they say they will use to verify
identity if he tries to call them on the phone.  He isn't sure
they'll protect the info, or if it might leak into other uses.

The list they ask for includes:

     Acccount #
     Date of Birth
     Social Security Number (you were surprised, maybe?)
     Mother's Maiden Name (My hospital asks for this one, too.)
     Business and home phones
     Other Diner's accounts to which this info applies.

My response to this would be to give them a set of information that
would be
useless to them, but which you can reproduce when they ask, even if
lost your wallet.  They ask for Mother's Maiden name because they
that's such an item.  There would be no purpose in cross-matching
that with
another database, and I always treat such requests as a request for
password, realizing that they'll prompt for the password by asking
for your
Mother's Maiden name.  They don't care at all what answer you give
as long
as you can reproduce it.  I might give them my favorite color, or
the name
of one of my hobbies.  If their db has lots of room, I might even
ask them
to store e.g. "color: blue" in the field so I could ask for the
first word
as a prompt to remind me which category I'd used with them.

Similarly, I would treat it as a wonderful opportunity if my credit
company asked for an SSN and said (as Citibank seems to have) that
they were
only going to use it to identify me if I called on the phone.  They
have no
reason to report the number to anyone else, so I would give them
one of the
many numbers I know that don't seem to be in use by anyone.  (I
give one in
my SSN FAQ, but I have a collection of others that have appeared in
books (as part of a student prank that involved registering a pet
dog as a
student at the university) or in movies (as visual evidence that a
had created several false personas).  What an opportunity!



Date: Wed, 10 Mar 93 09:30:43 EST
From: ac388@freenet.hsc.colorado.edu (Jack Decker)
Subject: Use of Medical Clearing House

The following message first appeared in a Fidonet conference called
ADAJOBS (I got it via the EMPLOYMENT conference on BIZynet, a
Fidonet-technology business-oriented network).  The risks of the
use of
such a database as the one described below should be obvious (how
does one
know if they were denied employment because of information
contained in
this database?  For that matter, how does one even know if the
contained in the database is accurate?).  Any replies should
probably go
to the original author (Herbert Mansmann at Fidonet address
which is herbert.mansmann@f201.n273.z1.fidonet.org in Internet

* Forwarded by Chris Gunn (1:202/1008)
* Area : ADAJOBS (ADAnet - Job Hunting When Disabled)
* From : Herbert Mansmann, 1:273/201 (08 Mar 93 10:55)
* To   : All
I have been told by several personnel recruiters that something
known as
the Medical Clearing House exists for companies or other employers
to check
on person's medical expenses before hiring them, similar to a
credit check.
This information is kept in regional databases and is accessible
over the
phone to high level employee relations personnel at major
only. Supposedly it is illegal to release this information to
users, but it is being done routinely for high medical expense
since the penalties are few, the savings can be substantial, and
enforcement of the laws against this are lax.  Our daughter has
Fibrosis which has very high medical costs associated over many
years.  We
believe this information and information about other medical
that do not interfere with someone's ability to work is being sold
to avoid
medical costs.  Since over two thirds of the employers now
instead of utilizing a real insurance company, they are motivated
eliminate these costs.  If you have any information about this
please respond on E-mail or anonymously to Herbert Mansmann, 224
Rd., Malvern, PA 19355.  It is important to get this subject out in
open and to include it in healthcare reform. Thanks. Feel free to

--- TMail v1.31.3
 * Origin: U.S. Telematics, Yardley PA (215)493-5242 (1:273/201)

Jack Decker | Internet: ac388@freenet.hsc.colorado.edu
Fidonet: 1:154/8 or jack.decker@f8.n154.z1.fidonet.org
Note: Mail to the Fidonet address has been known to bounce. :-(


Date: Tue, 16 Mar 1993 14:17:53 -0600 (CST)
From: bmears@gothamcity.jsc.nasa.gov (Brad Mears [I-Net])
Subject: No anonymity for Canon copiers?

The most recent issue of Popular Science had a small sidebar
concerning new
copier technologies that are being used to combat counterfeiting. 
to Canon, their new color copiers include two mechanisms to prevent
from copying currency.

The first is rather innocuous - the copier can recognize many
currencies and will print a blank image rather than a fake bill. 
No obvious
risks here.

The second mechanism is a bit more threatening.  According to the
which I quote without permission -

    "Each copier embeds a code into the copied image, which is
     impossible to see.  A special scanner extracts the code and
     a computer program then furnishes the copier's serial number,
     allowing identification of the registered purchaser of the

As a means to combat counterfeiters this may be very useful. 
it is also useful for tracking down people who report government
publishers of underground newsletters, and others who may have a
need to remain anonymous.  Plus, it seems a bit too much like the
Eastern bloc
countries who used to require registration of typewriters.

Brad Mears  bmears@gothamcity.jsc.nasa.gov

     [ This item was reposted from the RISKS Digest -- MODERATOR ]


Date:    Thu, 18 Mar 1993 15:42:05 -0500
From:    cstern@novus.com (Chuck Stern)
Subject: Re: Cashiers and telephone numbers

>    [ ...
>      Keep in mind that in most cases you're simply dealing with
>      a clerk who has a specific set of information he has
>      been instructed to get and may not realize that not everyone
>      is willing to provide a number.  However, in almost all
>      when faced with a choice of not getting the number or losing
>      the sale, the clerk will opt for the former. -- MODERATOR ]

This is not strictly true, oh Esteemed Moderator.  A clerk in a
Radio Shack
store here in the Boston area refused to make a credit card sale to
me when
I refused to give my telephone number and address.  The sale, by
the way, 
was to be for $23.50 or some such price.  One angry (collect) call
to Tandy
corporate headquarters got the matter straightened out - they were
violating Commonwealth of Mass. laws by even asking - but I haven't
darkened the doors of another Radio Shack since, nor will I ever

More anecdotal evidence from...

       [ Well, as I said, in *almost* all cases a salesperson will
opt for
      the sale... but there's always the exception.  Typically
      dealing with an overzealous employee, not company policy in
      situation such as you describe.  It's interesting to note
that the
      changes in the laws (in some states) making it illegal to ask
for a
      phone number as a requirement for credit card purchases are
      relatively recent in most cases.  In the past some credit
      companies strongly suggested that a phone number be obtained
      all orders and written on the charge slips.  Not everyone in
      affected areas has gotten the word about changes, apparently.

      As for anecdotes, in my own experience, I've never had a
      salesperson refuse me a purchase, regardless of whether or
not I
      provided a phone number when asked.  Of course, my
      clothing motif probably doesn't hurt in such situations!

                                   -- MODERATOR ]


End of PRIVACY Forum Digest 02.09

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH