HDTenEightyP/NetNews huggingface dataset:
Date:  Wed, 7 Oct 92 17:10:57 EDT
From:  Computer Privacy List Moderator  <comp-privacy@pica.army.mil>
Newsgroups: comp.society.privacy
Subject:  Welcome to Our New Users/Status of the forum
Organization: Computer Privacy Digest
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 088, Message 1 of 12


    In the last four (4) days I have added about 50 new subscribers to
the electronic maillist portion of this forum.  Based upon their net
addresses, they are from a wide range of countries and
education/commercial/government backgrounds.  I would like to welcome
them all to the Computer Privacy Digest (CPD).
    Readership is still growing on this forum.  There are now over 400
direct subscribers to the electronic mail list including about 25
exploder lists.  According to the latest USENET traffic poll, there are
an estimated 16,000 readers of the comp.society.privacy newsgroup which
is 1.1 % of all USENET readers.
   My initial USENET distribution has been expanded from one to three
sites.  I am hoping this will improve propagation throughout
USENET.  Originally everything originated from adm.brl.mil.
    I am including the occasional policy posting in this digest for all
readers.  I actively solicit any articles that are relavant to the
charter of this news group.

   The charter of the Computer Privacy Digest:

comp.society.privacy	Effects of technology on privacy (Moderated)

   This newsgroup is to provide a forum for discussion on the effect of
   technology on privacy. All too often technology is way ahead of the
   law and society as it presents us with new devices and
   applications.  Technology can enhance and detract from privacy.
   This newsgroup will be gatewayed to an internet mailing list.

Dennis Rears (Moderator of CPD)
Date:      Fri, 09 Oct 92 14:40:56 PDT
From:      Dave Gomberg <GOMBERG%UCSFVM.BITNET@cornellc.cit.cornell.edu>
Newsgroups: comp.society.privacy
Subject:      Re: Computer Privacy Digest V1#090
Organization: Computer Privacy Digest
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 091, Message 3 of 13

On Fri, 09 Oct 92 16:06:56 EST you said:
>
>There is something I don't understand about this.  If you see an
>unauthorized inquiry on your credit file, can't you use it as evidence
>to sue the deep pocket credit bureau for invasion of privacy?  But if
>you can, why haven't millions of disgusted consumers already done so?

Anyone can look at your credit report "for any legitimate business purpose."
This does NOT require your permission.  And it is hard to imagine why some-
one would look at your account unless (1) they had a business reason (2)
they knew you.  In the latter case they are likely a friend, so why would
you sue anyone?  If there were a nasty person who was doing it JUST to
invade your privacy AND you could show the credit bureau was lax in enforcing
a CLAIM of legitimate business purpose, you might have a case against them.
Otherwise, YOU had better have deep pockets for the legal fees you will
rack up losing.    Dave

Dave Gomberg    GOMBERG@UCSFVM  Internet node UCSFVM.UCSF.EDU  (415)731-7793
Seven Gateview Court, San Francisco CA 94116-1941
Date: Tue, 13 Oct 1992 05:26:05 GMT
From: Simona Nass <simona@panix.com>
Newsgroups: comp.society.privacy
Subject: Re: What is privacy?
Organization: PANIX Public Access Unix, NYC
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 091, Message 13 of 13

I'm fascinated by the various meanings the word "privacy" has taken on. I've
seen it used to mean freedom from trespass on property, freedom from forced
disclosure or, where information is disclosed (voluntarily or not), a right to
informational self-determination (as some European countries are articulat-
ing it), etc. I agree that defining privacy is vital to understanding the
various controversies that rage and the conflict between disclosure and its
counterpart, whatever that's called. So, let's hear it for other forms of
"privacy." -S.
-- 
        Alumni of Stuyvesant HS of New York: e-mail stuy@panix.com
    if you wish to participate in compiling an alumni e-mail directory
 ---------  simona@panix.com    or    {apple,cmcl2}!panix!simona  ----------
Disclaimer: I am not an attorney, though I do have an opinion on everything.
Date: Fri, 9 Oct 92 23:59:56 GMT
From: James Davies <jrbd@craycos.com>
Newsgroups: comp.society.privacy
Subject: Re: Computer access to SSN and bank accounts: 48hrs episode
Organization: Cray Computer Corporation
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 091, Message 5 of 13

In article <comp-privacy1.90.3@pica.army.mil> erc@netcom.com (Eric Smith) writes:
>
>There is something I don't understand about this.  If you see an
>unauthorized inquiry on your credit file, can't you use it as evidence
>to sue the deep pocket credit bureau for invasion of privacy?  But if
>you can, why haven't millions of disgusted consumers already done so?
>Surely the deep pockets of the credit bureaus and/or their client
>corporations such as banks etc. are enough money to motivate consumers
>to sue, especially considering that this is already a litigation prone
>society.  But in that case the credit bureaus would have gone broke
>from all the judgements already.  So I guess I'm confused, there must
>be some factor I'm not considering that resolves this contradiction.

Probably that "invasion of privacy" isn't illegal in the U.S., except
for specific circumstances (such as peering into a window of a house).
Date: Sun, 4 Oct 1992 7:38:55 -0400 (EDT)
From: "Dave Niebuhr, BNL CCD, 516-282-3093" <NIEBUHR@bnlcl6.bnl.gov>
Newsgroups: comp.society.privacy
Subject: Re: Address required on checks
Organization: Computer Privacy Digest
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 088, Message 5 of 12

Khan <tmkk@uiuc.edu> writes:

>In article <comp-privacy1.86.8@pica.army.mil> Wm Randolph Franklin <wrf@ecse.rpi.edu> writes:
>>
>>1. Service Merchandise, a local catalog store gets quite unfriendly when
>>I pay in cash.  They've told me they must have a name.  (So I give them
>>'Mario Cuomo').
>>
>>2. Then there's Radio Shack.
>
>This usually isn't the direct fault of SM or RS. Rather, it's the
>personal insecurity of the clerk who, when faced with a rejection to
>his/her request for marketing information, becomes defensive and
>sometimes even hostile.
>

I'm not about Service Merchandise but the clerks in Radio Shack are
required by company policy to attempt to get a telephone number so that
a database entry can be made and flyers sent to the purchasers.

Dave
Dave Niebuhr      Internet: niebuhr@bnl.gov / Bitnet: niebuhr@bnl
Brookhaven National Laboratory Upton, NY 11973  (516)-282-3093
Date: Sat, 10 Oct 1992 11:40:25 EDT
From: gulino@ouvaxa.ucls.ohiou.edu
Newsgroups: comp.society.privacy
Subject: Posting grades by SSN
Organization: Computer Privacy Digest
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 091, Message 8 of 13


   I'd like to chime in here briefly about posting course grades.  I teach
at the college level, and the courses I teach generally contain 30-50
students.  At the end of the term, I calculate the final grades and
post them, in random order, by the last four digits of the SSN.  I
think it is very important that the students get an independent
accounting of their grade and not simply wait for their grade report to
arrive in the mail.  This is because there is always the possibility of
a mistake in the process of transmitting the grade from my grade book
through the registrar to the student.

    I know of one story where a student had done well in a course, or so he
thought, but received a final grade of C.  Later the next term, when he
saw the course professor, he casually remarked "I guess I really blew
the final, huh?"  The professor was surprised and said, "No, you
received the highest in the class on the final exam."  To which the
student replied, "then why did I get a C in the course?"  To which the
professor replied, "you didn't, I gave you an A!"  They looked into it
and discovered that the registrar's office had made a mistake in
transcribing the grade from the professor's grade report form into the
computer.  If this student had not casually mentioned to the professor
about his grade of C, he might never have known about the mistake, and
his GPA, etc., would have been forever incorrect.

    Moral of story:  The student's need to be informed of their course
grade independently of the normal grade reporting process so they can
verify the accuracy of what they receive.  In a class of 5 or 10
students, this can generally be done fairly easily on a personal basis,
and posting the grades is generally not necessary.  But when the class
is large, this is not practical.  The school where I teach, Ohio
University, uses the SSN as identification for everything.  This is
probably not a good idea, but it's what they do.  I believe that by
posting my grades in the way that I do (use only the last four digits
of the SSN and randomize the order on the list), I am satisfactorily
insuring anonymity, and the potential harm to the student by possibly
releasing part of their SSN is greatly offset by the advantage to the
student of assuring that their final course grades are accurate.

   Of course, if the registrar makes an error THE OTHER WAY (i.e., the
student gets an A when he should have received a C), you can be sure
the student will keep his mouth shut and I'll certainly never hear
about it. :)  But this would happen even if I didn't post the grades.

    Dan Gulino Department of Chemical Engineering Ohio University
Date: Mon, 5 Oct 1992 08:25 EDT
From: JSMITH@guvax.acc.georgetown.edu
Newsgroups: comp.society.privacy
Subject: Address required on checks
Organization: Computer Privacy Digest
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 088, Message 7 of 12

Regarding Radio Shack's request for customer information:

About fifteen years ago, a good friend of mine managed a
Radio Shack store.  At the time, one of Radio Shack's measurements for 
store managers was the percentage of sales slips on which the name and 
address were filled in.  Salespeople were allowed to write "Cash" for 
those situations in which customers absolutely refused to divulge any 
information, but these were counted against the store manager in 
end-of-month calculations.  So, my friend made a deal with me:  when 
customers refused to supply the information, he would initially write "Cash" 
on their slip.  After they left the store, he would then enter the 
name "Brownie Smith" and my home address on the store copy (Brownie 
was my dog at the time).  Brownie received Radio Shack catalogs for 
many years but was eventually purged...once my friend left Radio Shack 
for a more lucrative career as a stock broker, Brownie apparently 
ceased to make purchases.

In another situation with similar characteristics, Shell Oil 
distributed a coupon in several cities' newspapers last summer (I saw 
it in _The Washington Post_ and _The New York Times_).  The coupon 
offered $1 off any gasoline fillup (8 gallons or more).  At the bottom 
of the coupon was a space for name and address with the heading 
"Consumer:  Please complete."  I tried to redeem the coupon at my 
local Shell station without completing the name and address section, 
but the attendant refused it.  When I argued that the information was 
clearly optional and that the offer of $1 was an unconditional one, he 
replied "I don't see nothing about optional on the coupon."  So, I 
wrote to Shell's president in Houston, Texas.  I received a very 
apologetic letter and a check for $5.  But I'm sure they considered me 
a privacy zealot and crackpot.


Jeff Smith
Assistant Professor
School of Business Administration
Georgetown University
Washington, DC  20057

[Moderator's Note:  I would like to kill the thread on Radio Shack
wanting names, addresses, and phone numbers.  The general consensus is
that it is a marketing ploy and a forceful no is all that is required to
avoid giving out this information. ._dennis]
Date: 9 Oct 92 21:13:34 GMT
From: John Boyd <johnboyd@ocdis01.oc.aflc.af.mil>
Newsgroups: comp.society.privacy
Subject: Re: SSN in login ids / posting grades
Organization: Tinker Air Force Base, Oklahoma
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 091, Message 2 of 13


In article <comp-privacy1.88.4@pica.army.mil> allan@cs.cornell.edu (James Allan) writes:
>Cornell does not allow student grades to be posted by SSN or by the
>students' Cornell ID number.  In the classes I teach, I get a 6 or so

At the university I attend, the grade sheet is printed out in alphabetical
order, with the SSN last, but the strip that is posted only contains the
last four digits of your SSN/ID, and then your grade is hand-written in a
space after that.  The previously mentioned alphabetical fault is
acknowledged.
Date: Thu, 8 Oct 1992 11:25:58 GMT
From: Eric Smith <erc@netcom.com>
Newsgroups: comp.society.privacy
Subject: Re: Computer access to SSN and bank accounts: 48hrs episode
Organization: Netcom - Online Communication Services (408 241-9760 guest)
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 090, Message 3 of 7

In article <comp-privacy1.88.11@pica.army.mil> Steve Forrette <stevef@wrq.com> writes:
>Several people wrote to say how easy it is to get a dialup account with a
>credit bureau to get people's credit profiles.  But, isn't each inquiry logged
>in the computer?  I, from time to time, will get a copy of my credit profile
>in order to check its accuracy.   It also lists each inquiry that has been
>made within the last year (2 years?).  If there were an inquiry from an
>organization that I did not recognize or authorize, I would definately look
>into it. 
>
>Steve Forrette, stevef@wrq.com
>



There is something I don't understand about this.  If you see an
unauthorized inquiry on your credit file, can't you use it as evidence
to sue the deep pocket credit bureau for invasion of privacy?  But if
you can, why haven't millions of disgusted consumers already done so?
Surely the deep pockets of the credit bureaus and/or their client
corporations such as banks etc. are enough money to motivate consumers
to sue, especially considering that this is already a litigation prone
society.  But in that case the credit bureaus would have gone broke
from all the judgements already.  So I guess I'm confused, there must
be some factor I'm not considering that resolves this contradiction.

I also have a question about resolving mistakes in a credit file.  If
you see an account that isn't yours, put in the wrong file by mistake,
you can tell the credit bureau it isn't yours, and they have to contact
the creditor for verification.  But wouldn't most creditors just verify
the account automatically regardless of who it belongs to?  Does the
creditor have to send some kind of proof to the credit bureau and/or
the consumer?  Or do they just have to say yes or no, it is or isn't
a valid account?  And what if it's hard for them to tell whether it
belongs to the consumer who complained?  For example, what if someone
used fraud to open an account using someone else's name and credit
information, such that the creditor thinks the consumer who complained
is really the person who opened the account?  In that case does the
consumer have any recourse at all?
Date: 8 Oct 92 13:05:58 GMT
From: Hap Haas <hh2@prism.gatech.edu>
Newsgroups: comp.society.privacy
Subject: Check or PO only - No cash accepted.
Organization: Georgia Institute of Technology
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 090, Message 4 of 7


Following up on the check-cash-address thread, here's an interesting thing
that happened to me:

I ordered something overnight, COD from Federal Express.  When it arrived,
the delivery person would not accept my cash payment.  She said they 
required a check or PO number.  I asked what the heck she thought COD
stands for . . and she was quite insistent that THEY define COD as Charge
On Delivery.  It caused a big problem for me - I wasted about 30 minutes to
an hour resolving the payment problem.

She claims they reason is that not all their drivers are bonded, which
makes sense.  Nontheless, when I order "COD", I use the commonly accepted
definition of Cash On Delivery and expect to pay with Legal USA Tender:
CASH!  Oh well . . 

hh
--
Harry Haas  GTRI/RIDL/SB    |    Georgia Tech Research Institute
Research Engineer II        |    225 North Ave.
hh2@prism.gatech.edu        |    Atlanta Georgia, 30332
"I know engineers . . . . they *love* to change things"  - Bones
Date: Wed, 7 Oct 1992 04:26:57 GMT
From: Steve Barber <sbarber@panix.com>
Newsgroups: comp.society.privacy
Subject: Re: Address required on checks
Organization: PANIX Public Access Unix, NYC
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 088, Message 9 of 12

Of course, any merchant may refuse to accept a money order as
payment as easily as it can refuse to accept a check, if it
wishes.  Cash is it, at least according the Article 3 of the
Uniform Commercial Code.  Though of course more places will
take an anonymous money order than will take a check with no
address.


-- 
Steve Barber                                             sbarber@panix.com
"The direct deed is the most meaningful reflection." - Bill Evans
Nothing I say is legal advice.  It can't be.  I don't know anything.
Date: Sun, 4 Oct 1992 01:24:49 GMT
From: James Allan <allan@cs.cornell.edu>
Newsgroups: comp.society.privacy
Subject: Re: SSN in login ids / posting grades
Organization: Cornell Univ. CS Dept, Ithaca NY 14853
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 088, Message 4 of 12

Tom Wicklund <wicklund@intellistor.com> writes:
>Any system of publicly posting grades is going to voilate privacy.
>Whether a student ID is a social security number or a unique within
>the university ID, it can be misused.  And most of the time grades
>posted by student ID are still listed in alphabetical order (making it
>easy to find people near the start or end of the alphabet).

>If one wants grade privacy, then professors should be encouraged not
>to post grades.  Ideally the university will have a reliable way to
>inform students of grades in a timely fashion.

Posting grades removes some administrative burden, makes it reasonably
easy for the students to doublecheck that grades were recorded
accurately, and makes it easier for the students to have a feeling for
"where the stand" (something which many students are obsessed with).
The problem is not posted grades; the problem is the ID number.

Cornell does not allow student grades to be posted by SSN or by the
students' Cornell ID number.  In the classes I teach, I get a 6 or so
character "grading code" from the student and use that to post the
grades (sorted by grading code, not by name).  Some students choose to
use their ID's, some use a combination of their initials and numbers,
some use OTHER people's initials (a friend, I suspect), and some use
nonsense phrases like "iamcool".  There's essentially no way to guess
which grade is for whom (modulo the case of a "star" student who is an
order of magnitude above everyone else).

I think student-chosen grading codes are a good solution to the
problem.  I admit that, unfortunately, many professors here seem to
sidestep or ignore the no-SSN no-ID# routines.
Date: Thu, 8 Oct 92 18:25:31 EDT
From: Nigel.Allen@lambada.oit.unc.edu
Newsgroups: comp.society.privacy
Subject: Re: SSN in login ids / posting grades
Organization: Computer Privacy Digest
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 090, Message 6 of 7

The University of Toronto uses a student number system which has nothing
to do with the Social Insurance Number (SIN), the Canadian equivalent of the
U.S. Social Security Number. For most students who originally registered as
full-time undergraduates in arts and science, the student number is the
nine-digit number that appeared on the pre-numbered application form that
they used to apply to the university in the first place. The first two 
digits are the last two digits of the year the student first registered.
I have also seen student numbers beginning with a leading zero and then two
digits corresponding to the initial year of registration.

Faculty and staff are identified on their library and identification cards
by a six-digit payroll number. This number, not the Social Insurance Number,
is used when dealing with the university's dental and prescription drug
plans. (For government medical insurance, individuals are identified by
an Ontario Health Card number, which is not connected to the 
Social Insurance Number. The Ontario Health Card is relatively new;
previously health insurance worked on a one-number-per-family basis,
rather than the present one-number-per-person basis.) Other provinces
once used the Social Insurance Number as the basis of their medical
insurance plans, but I believe all have now abandoned the SIN.

You normally have to give a bank your SIN when you open an account so that
interest earnings can be reported to the tax department. However, no
Canadian university is likely to use the SIN as a log-in ID. 

In short, Canada is a utopia, and you should all move up north. :-)
Date:  Wed, 7 Oct 92 23:17:57 EDT
From:  Brinton Cooper <abc@brl.mil>
Newsgroups: comp.society.privacy
Subject:  [Mike Brokowski: Re: Address required on checks]
Organization:  The US Army Research Laboratory
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 090, Message 2 of 7


 Mike Brokowski <brokow@casbah.acns.nwu.edu> writes, in part

>>3. You must give id when spending over $10K with one merchant in, I
>>believe, one year, or the merchant can get in serious trouble.
 .
 .
>>-- 
>>Wm. Randolph Franklin,  wrf@ecse.rpi.edu, (518) 276-6077;  Fax: -6261
>>ECSE Dept., 6026 JEC, Rensselaer Polytechnic Inst, Troy NY, 12180 USA
>>
>
>I am curious about 3) and the money orders.  Does anyone know the rules
>for requiring id depending on the amount of yearly purchase?  It seems

I believe this is a misstatement.  IRS has a rule regarding the handling
of large sums of money at a bank.  If you withdraw a sufficiently large
sum ($10K?), they must file something like a 1099 with IRS.  This is to
enable "cash flow analysis" by the IRS in order to detect tax evasion
and is the means, and only means, by which Al Capone was ever convicted
of anything.

_Brint