Internet Privacy: Overview and Legislation in the 109th Congress, 1st Session
Released: 2006-01-26T00:00:00

Introduction

Internet privacy issues encompass several concerns. One is the collection of personallyidentifiable information (PII) by website operators from visitors to government and commercialwebsites, or by software that is surreptitiously installed on a user's computer ("spyware") andtransmits the information to someone else. Another is the monitoring of electronic mail and Webusage by the government or law enforcement officials, employers, or e-mail service providers. Another issue, identity theft, is not an Internet privacy issue per se, but is often debated in the contextof whether the Internet makes identity theft more prevalent. For example, Internet-based practicescalled "phishing" and "pharming" may contribute to identity theft.

This report provides an overview of Internet privacy-related issues and related laws passedin previous Congresses, and discusses legislative activity in the first session of the 109th Congress. Background information on Internet privacy issues is available in an archived CRS Report RL30784, Internet Privacy: An Analysis of Technology and Policy Issues , by Marcia Smith(available from author); and CRS Report RL31289 , The Internet and the USA PATRIOT Act:Potential Implications for Electronic Privacy, Security, Commerce, and Government , by MarciaSmith, et al.

Internet: Commercial Website Practices

One aspect of the Internet ("online") privacy debate focuses on whether industry selfregulation or legislation is the best route to assure consumer privacy protection. In particular,consumers appear concerned about the extent to which website operators collect "personallyidentifiable information" (PII) and share that data with third parties without their knowledge. Although many in Congress and the Clinton Administration preferred industry self regulation, the105th Congress passed legislation (COPPA, see below) to protect the privacy of children under 13as they use commercial websites. Many bills have been introduced since that time regardingprotection of those not covered by COPPA, but the only legislation that has passed concerns federalgovernment, not commercial, websites.

Children's Online Privacy Protection Act (COPPA), P.L. 105-277

Congress, the Clinton Administration, and the Federal Trade Commission (FTC) initiallyfocused their attention on protecting the privacy of children under 13 as they visit commercialwebsites. Not only are there concerns about information children might divulge about themselves,but also about their parents. The result was the Children's Online Privacy Protection Act (COPPA),Title XIII of Division C of the FY1999 Omnibus Consolidated and Emergency SupplementalAppropriations Act, P.L. 105-277 . (1) The FTC's final rule implementing the law became effective April21, 2000 http://www.ftc.gov/os/1999/10/64fr59888.htm . Commercial websites and online servicesdirected to children under 13, or that knowingly collect information from them, must inform parentsof their information practices and obtain verifiable parental consent before collecting, using, ordisclosing personal information from children. The Commission adopted a "sliding scale" forcomplying with the verifiable consent requirement depending on how the data would be used. Thatis, if the information was for internal use only, the verifiable consent could be obtained from theparent by e-mail, plus an additional step to ensure the person giving consent is, in fact, the parent. If the website operator planned to disclose the information publicly or to third parties, a higherstandard was set. This sliding scale was set to expire in 2002 with the expectation that betterverification technologies would become available. However, in 2002, the FTC determined that suchtechnologies still were not available, and the sliding scale was extended to April 12, 2005. In 2005,the Commission extended it again, and is seeking public comment on how to proceed, as part of itsoverall review of the COPPA rule. (2)

The law also provides for industry groups or others to develop self-regulatory "safe harbor"guidelines that, if approved by the FTC, can be used by websites to comply with the law. The FTCapproved self-regulatory guidelines proposed by the Better Business Bureau on January 26, 2001. On June 11, 2003, then-FTC Chairman Timothy Muris stated in testimony to the Senate CommerceCommittee that the FTC had brought eight COPPA cases, and obtained agreements requiringpayment of civil penalties totaling more than $350,000. (3)

As required by COPPA, on April 21, 2005, the Commission issued a request for publiccomment on its final rule, five years after the rule's effective date. (4) Comments were requestedon the costs and benefits of the rule; whether it should be retained, eliminated, or modified; and itseffect on practices relating to the collection of information relating to children, children's ability toaccess information of their choice online, and the availability of websites directed to children.

FTC Activities and Fair Information Practices

The FTC conducted or sponsored several surveys between 1997 and 2000 to determine theextent to which commercial website operators abided by four fair information practices -- providing notice to users of their information practices before collecting personal information, allowing users choice as to whether and how personal information is used, allowing users access to data collectedand the ability to contest its accuracy, and ensuring security of the information from unauthorizeduse. Some include enforcement as a fifth fair information practice. Regarding choice, the term" opt-in " refers to a requirement that a consumer give affirmative consent to an information practice,while " opt-out " means that permission is assumed unless the consumer indicates otherwise. Seearchived CRS Report RL30784, Internet Privacy: An Analysis of Technology and Policy Issues , byMarcia Smith (available from author), for more information on the FTC surveys and fair informationpractices. The FTC's reports are available on its website http://www.ftc.gov .

Briefly, the first two FTC surveys (December 1997 and June 1998) created concern about theinformation practices of websites directed at children and led to the enactment of COPPA (seeabove). The FTC continued monitoring websites to determine if legislation was needed for thosenot covered by COPPA. In 1999, the FTC concluded that more legislation was not needed at thattime because of indications of progress by industry at self-regulation, including creation of "seal"programs (see below) and by two surveys conducted by Georgetown University. However, in May2000, the FTC changed its mind following another survey that found only 20% of randomly visitedwebsites and 42% of the 100 most popular websites had implemented all four fair informationpractices. The FTC voted to recommend that Congress pass legislation requiring websites to adhereto the four fair information practices, but the 3-2 vote indicated division within the Commission. On October 4, 2001, Timothy Muris, who had recently become FTC Chairman, stated that he did notsee a need for additional legislation at that time. (Mr. Muris was succeeded as FTC Chairman onAugust 16, 2004 by Deborah Platt Majoras.)

Advocates of Self Regulation

In 1998, members of the online industry formed the Online Privacy Alliance (OPA) toencourage industry self regulation. OPA developed a set of privacy guidelines, and its members arerequired to adopt and implement posted privacy policies. The Better Business Bureau (BBB),TRUSTe, and WebTrust have established "seals" for websites. To display a seal from one of thoseorganizations, a website operator must agree to abide by certain privacy principles (some of whichare based on the OPA guidelines), a complaint resolution process, and to being monitored forcompliance. Advocates of self regulation argue that these seal programs demonstrate industry'sability to police itself.

Technological solutions also are being offered. P3P (Platform for Privacy Preferences) is onesuch technology. It essentially creates machine-readable privacy policies through which users canmatch their privacy preferences with the privacy policies of the websites they visit. One concern isthat P3P requires companies to produce shortened versions of their privacy policies, which couldraise issues of whether the shortened policies are legally binding, since they may omit nuances and"sacrifice accuracy for brevity." (5) For more information on P3P, see http://www.w3.org/P3P/ .

Advocates of Legislation

Consumer, privacy rights and other interest groups believe self regulation is insufficient. They argue that the seal programs do not carry the weight of law, and that while a site may discloseits privacy policy, that does not necessarily equate to having a policy that protects privacy. TheCenter for Democracy and Technology (CDT, at http://www.cdt.org ) and the Electronic PrivacyInformation Center (EPIC, at http://www.epic.org ) each released reports on this topic. EPIC's mostrecent report, Privacy Self Regulation: A Decade of Disappointment , argues that the National DoNot Call list, which restricts telemarketing phone calls, demonstrates that government regulation canbe more effective than industry self regulation. Calling telemarketing a 20th century problem, thereport concludes that the FTC has given self regulation a decade to work in the Internet privacyarena, and it is time for the agency "to apply the lessons from telemarketing and other efforts toaddress the 21st century [sic] problem of Internet privacy." (6)

Some privacy interest groups, such as EPIC, also feel that P3P is insufficient, arguing thatit is too complex and confusing and fails to address many privacy issues. An EPIC report from June2000 further explains its findings http://www.epic.org/reports/prettypoorprivacy.html .

Privacy advocates have been particularly concerned about online profiling, where companiescollect data about what websites are visited by a particular user and develop profiles of that user'spreferences and interests for targeted advertising. Following a one-day workshop on onlineprofiling, FTC issued a two-part report in the summer of 2000 that also heralded the announcementby a group of companies that collect such data, the Network Advertising Initiative (NAI), ofself-regulatory principles. At that time, the FTC nonetheless called on Congress to enact legislationto ensure consumer privacy vis a vis online profiling because of concern that "bad actors" and othersmight not follow the self-regulatory guidelines.

Congressional Action

Many Internet privacy bills were considered by the 107th and 108th Congresses. Other thanextending an existing prohibition regarding federal websites (see next section), none clearedCongress. Several bills were introduced in the first session of the 109th Congress (see table at endof report).

Internet: Federal Government Website Information Practices

Under a May 1998 directive from President Clinton and a June 1999 Office of Managementand Budget (OMB) memorandum, federal agencies must ensure that their information practicesadhere to the 1974 Privacy Act. In June 2000, however, the Clinton White House revealed thatcontractors for the Office of National Drug Control Policy (ONDCP) had been using "cookies"(small text files placed on users' computers when they access a particular website) to collectinformation about those using an ONDCP site during an anti-drug campaign. ONDCP was directedto cease using cookies, and OMB issued another memorandum reminding agencies to post andcomply with privacy policies, and detailing the limited circumstances under which agencies shouldcollect personal information. A September 5, 2000 letter from OMB to the Department ofCommerce further clarified that "persistent"cookies, which remain on a user's computer for varyinglengths of time (from hours to years), are not allowed unless four specific conditions are met. "Session" cookies, which expire when the user exits the browser, are permitted.

At the time, Congress was considering whether commercial websites should be required toabide by FTC's four fair information practices. The incident sparked interest in whether federalwebsites should adhere to the same requirements. In the FY2001 Transportation Appropriations Act( P.L. 106-346 ), Congress prohibited funds in the FY2001 Treasury-Postal Appropriations Act frombeing used to collect, review, or create aggregate lists that include PII about an individual's accessto or use of a federal website or enter into agreements with third parties to do so, with exceptions. Similar language has been included in subsequent appropriations bills. For FY2006, it is Section832 of the Transportation-Treasury Appropriations Act ( P.L. 109-115 ).

Nonetheless, in December 2005, the Associated Press (AP) reported that a privacy advocate,Daniel Brandt, had discovered that the National Security Agency (NSA) was using permanentcookies on its website. (7) The AP quoted an NSA spokesman as saying that it resulted from a recent software upgrade and theagency was not aware that permanent cookies were being set. C|NET News.Com reported a weeklater that, based on its own investigation, "dozens" of agencies were setting permanent cookies or"web bugs." (8) The articleidentified the White House, the Air Force, and the Treasury Department as examples, and reportedthat some of the agencies changed their practices after being contacted, and many seemed to haveno idea that their software was setting cookies.

Section 646 of the FY2001 Treasury-Postal Appropriations Act ( P.L. 106-554 ) requiredInspectors General (IGs) to report to Congress on activities by those agencies or departments relatingto their own collection of PII, or entering into agreements with third parties to obtain PII about useof websites. Then-Senator Fred Thompson released two reports in April and June 2001 based onthe findings of agency IGs who discovered unauthorized persistent cookies and other violations ofgovernment privacy guidelines on several agency websites. An April 2001 GAO report(GAO-01-424) concluded that most of the 65 sites it reviewed were following OMB's guidance.

The E-Government Act ( P.L. 107-347 ) sets requirements on government agencies regardinghow they assure the privacy of personal information in government information systems andestablish guidelines for privacy policies for federal websites. The law requires federal websites toinclude a privacy notice that addresses what information is to be collected, why, its intended use,what notice or opportunities for consent are available to individuals regarding what is collected andhow it is shared, how the information will be secured, and the rights of individuals under the 1974Privacy Act and other relevant laws. It also requires federal agencies to translate their websiteprivacy policies into a standardized machine-readable format, enabling P3P to work (see abovediscussion of P3P), for example.

Monitoring of E-mail and Web Usage

By Government and Law Enforcement Officials

Another concern is the extent to which electronic mail (e-mail) exchanges or visits towebsites may be monitored by law enforcement agencies or employers. In the wake of theSeptember 11 terrorist attacks, the debate over law enforcement monitoring has intensified. Previously, the issue had focused on the extent to which the Federal Bureau of Investigation (FBI),with legal authorization, used a software program, called Carnivore (later renamed DCS 1000), tointercept e-mail and monitor Web activities of certain suspects. The FBI would install the softwareon the equipment of Internet Service Providers (ISPs). Privacy advocates were concerned aboutwhether Carnivore-like systems can differentiate between e-mail and Internet usage by a subject ofan investigation and similar usage by other people. Technical details of the system were not publiclyavailable, meaning that privacy groups were unable to independently determine exactly what thesystem could or could not do, leading to their concerns. Section 305 of the 21st Century Departmentof Justice Appropriations Authorization Act ( P.L. 107-273 ) required the Justice Department to reportto Congress at the end of FY2002 and FY2003 on its use of Carnivore/DCS 1000 or any similarsystem. EPIC obtained the reports in January 2005 under the Freedom of Information Act and placedthem on its website. (9) Thereports indicate that the Justice Department no longer uses Carnivore/DCS 1000, using commerciallyavailable software instead. The Justice Department reported that it used commercial software toconduct court-ordered electronic surveillance five times in FY2002 and eight times in FY2003.

The USA PATRIOT Act. Following the terroristattacks, Congress passed the Uniting and Strengthening America by Providing Appropriate Toolsto Intercept and Obstruct Terrorism (USA PATRIOT) Act, P.L. 107-56 , which expands lawenforcement's ability to monitor Internet activities. Inter alia , the law modifies the definitions of"pen registers" and "trap and trace devices" to include devices that monitor addressing and routinginformation for Internet communications. Carnivore-like programs may now fit within the newdefinitions. The Internet privacy-related provisions of the USA PATRIOT Act, included as part ofTitle II, are as follows:

Section 210, which expands the scope of subpoenas for records of electroniccommunications to include records commonly associated with Internet usage, such as session timesand duration.

Section 212, which allows ISPs to divulge records or other information (butnot the contents of communications) pertaining to a subscriber if they believe there is immediatedanger of death or serious physical injury or as otherwise authorized, and requires them to divulgesuch records or information (excluding contents of communications) to a governmental entity undercertain conditions. It also allows an ISP to divulge the contents of communications to a lawenforcement agency if it reasonably believes that an emergency involving immediate danger of deathor serious physical injury requires disclosure of the information without delay. This section wasamended by the Cyber Security Enhancement Act -- see below .

Section 216, which adds routing and addressing information (used in Internetcommunications) to dialing information, expanding what information a government agency maycapture using pen registers and trap and trace devices as authorized by a court order, while excludingthe content of any wire or electronic communications. The section also requires law enforcementofficials to keep certain records when they use their own pen registers or trap and trace devices andto provide those records to the court that issued the order within 30 days of expiration of the order.To the extent that Carnivore-like systems fall with the new definition of pen registers or trap andtrace devices provided in the act, that language would increase judicial oversight of the use of suchsystems.

Section 217, which allows a person acting under color of law to intercept thewire or electronic communications of a computer trespasser transmitted to, through, or from aprotected computer under certain circumstances, and

Section 224, which sets a four-year sunset period for many of the Title IIprovisions. Sections 210 and 216 are excluded from the sunset. Sections 212 and 217 are not, andtherefore will expire on December 31, 2005. As discussed below, Congress is consideringlegislation that would amend this sunset clause, making either more or fewer sections subject toit.

The Cyber Security Enhancement Act, section 225 of the 2002 Homeland Security Act ( P.L.107-296 ), amends section 212 of the USA PATRIOT Act. It lowers the threshold for when ISPsmay voluntarily divulge the content of communications. Now ISPs need only a "good faith" (insteadof a "reasonable") belief that there is an emergency involving danger (instead of "immediate"danger) of death or serious physical injury. The contents can be disclosed to "a Federal, state, or localgovernmental entity" (instead of a "law enforcement agency").

Privacy advocates are especially concerned about the language added by the Cyber SecurityEnhancement Act. EPIC notes, for example, that allowing the contents of Internet communicationsto be disclosed voluntarily to any governmental entity not only poses increased risk to personalprivacy, but also is a poor security strategy. Another concern is that the law does not provide forjudicial oversight of the use of these procedures. (10) A Senate Judiciary Committee hearing on September 23, 2004explored some of these concerns.

Several House and Senate committees held hearings in the first session of the 109th Congresson various provisions of the USA PATRIOT Act, and more are expected in the second session, asCongress debates whether to extend the "sunset date," or expiration date, of several provisions of thatact. Under Section 224, a number of sections would have expired on December 31, 2005, includingSection 212 and 217. Section 210 and Section 216 are not subject to the sunset clause (i.e., they arepermanent).

Several bills were introduced to modify the sunset clause by making temporary provisionspermanent, by making permanent provisions temporary, or by modifying reporting requirements orotherwise enhancing oversight of how the provisions are implemented. As December 31, 2005approached, the issue became very contentious. The House passed a permanent extension (i.e., itrepealed the sunset clause) in H.R. 3199 . The Senate, however, passed only asix-month extension ( S. 2167 ) to allow time for further consideration of concerns bysome Senators that more civil liberties protections are needed. The House did not agree with theSenate action, and amended S. 2167 so that the extension was only for five weeks (throughFebruary 3, 2006) to ensure that the Congress dealt with the issue early in the second session. Debate may be influenced by revelations in December 2005 that President George W. Bush directedthe National Security Agency to monitor phone calls and e-mails in the United States withoutwarrants. (For further information on the debate over warrantless searches, see the CRS generaldistribution memorandum at this CRS website: http://www.crs.gov/products/browse/documents/WD00002.pdf .

The 9/11 Commission Report, and Creation of the Privacy andCivil Liberties Oversight Board. On July 22, 2004, the "9/11 Commission" releasedits report on the terrorist attacks. (11) The Commission concluded (pp. 394-395) that many of the USAPATRIOT Act provisions appear beneficial, but that "Because of concerns regarding the shiftingbalance of power to the government, we think that a full and informed debate on the Patriot Actwould be healthy." The Commission recommended that "The burden of proof for retaining aparticular governmental power should be on the executive, to explain (a) that the power actuallymaterially enhances security and (b) that there is adequate supervision of the executive's use of thepowers to ensure protection of civil liberties. If the power is granted, there must be adequateguidelines and oversight to properly confine its use." The Commission also called for creation ofa board within the executive branch "to oversee adherence to the guidelines we recommend and thecommitment the government makes to defend our civil liberties." The commissioners went on tosay that "We must find ways of reconciling security with liberty, since the success of one helpsprotect the other. The choice between security and liberty is a false choice, as nothing is more likelyto endanger America's liberties than the success of a terrorist attack at home. Our history has shownus that insecurity threatens liberty. Yet, if our liberties are curtailed, we lose the values that we arestruggling to defend."

The 108th Congress passed legislation implementing many of the Commission'srecommendations. Called the Intelligence Reform and Terrorism Prevention Act ( S. 2845 , P.L. 108-458 ), Section 1061 creates a Privacy and Civil Liberties Oversight Board as part ofthe Executive Office of the President. According to the bill's sponsor, Senator Collins, the Board'spurpose is to "ensure that privacy and civil liberties concerns are appropriately considered in theimplementation of all laws, regulations, and policies that are related to efforts to protect the Nationagainst terrorism." (12) It must report to Congress annually on an unclassified basis to the greatest extent possible. It willbe composed of five members, two of which (the chairman and vice-chairman) must be confirmedby the Senate. All must come from outside the government to help ensure their independence.

National Journal reported on January 13, 2006 that although the five members of the Boardhave been appointed, the chairman and vice chairman have not yet been confirmed by theSenate. (13) An August2005 Reuters report cited critics (including a former 9/11 Commissioner, Members of the House andSenate, and others) as concluding that the panel is a "toothless, underfunded shell with inadequatesupport" from the President. (14)

H.R. 1310 (Maloney) was introduced in the first session of the 109th Congressto make a number of changes, including establishing the Board as an independent agency in theexecutive branch, instead of part of the Executive Office of the President; setting out certainqualifications for Board members; and requiring that all of the Board members be confirmed by theSenate, not just the chairman and vice-chairman. There was no legislative action on the bill duringthe first session. As with debate over the USA PATRIOT Act, this discussion may be influencedby the controversy over warrantless searches (see above).

Government Access to Search Engine Data (e.g.Google). In January 2006, Internet search engine company Google indicated thatit was resisting a Justice Department subpoena requiring the company to provide the governmentwith data on searches made by users. (15) The Justice Department reportedly is seeking the data to helpit in a court case to uphold the Child Online Protection Act (COPA), which was enacted to protectchildren using the Internet from objectionable material such as pornography. (16) According to variousmedia reports, other search engine companies, including Yahoo!, MSN, and America Online, didcomply with the government's request. Although much of the publicity focused on the extent towhich the privacy of Internet users would be undermined if the government could access such data,some observers pointed out that the data are anonymous, and Google's response might be stimulatedmore by business concerns (e.g., revealing proprietary information) than privacy concerns. (17) Nevertheless, publicresponse suggests that some consumers now worry about what search terms they use, lest thegovernment track their activities and draw erroneous conclusions. (18)

By Employers

There also is concern about the extent to which employers monitor the e-mail and othercomputer activities of employees. The public policy concern appears to be not whether companiesshould be able to monitor activity, but whether they should notify their employees of that monitoring. A 2005 survey of 526 companies by the American Management Association and the ePolicy Institutefound that 76% monitor Web usage, and 55% retain and review e-mail messages. (19) The survey found that26% of the companies had fired employees for misusing the Internet, and 25% had fired workers fore-mail misuse. Regarding notice, the survey reported that 80% of the companies inform workers thatthey are monitoring content, keystrokes, and time spent at the keyboard; 82% inform workers thatcomputer files are stored and reviewed; 86% inform workers that e-mail is monitored; and 89%inform workers that Web usage is tracked. One criticism is that top level employees may not besubject to the same monitoring as rank and file workers. (20)

By E-Mail Service Providers: The "Councilman Case"

In what is widely-regarded as a landmark ruling concerning Internet privacy, the U.S. Courtof Appeals for the First Circuit in Massachusetts ruled (2-1) on June 29, 2004 that an e-mail serviceprovider did not violate federal wiretapping statutes when it intercepted and read subscribers' e-mailsto obtain a competitive business advantage. The ruling upheld the decision of a lower court todismiss the case.

The case involved an e-mail service provider, Interloc, Inc., that sold out-of-print books. According to press accounts (21) and the text of the court's ruling, (22) Interloc used softwarecode to intercept and copy e-mail messages sent to its subscribers (who were dealers looking forbuyers of rare and out-of-print books) by competitor Amazon.com. The e-mail was intercepted andcopied prior to its delivery to the recipient so that Interloc officials could read the e-mails and obtaina competitive advantage over Amazon.com. Interloc Vice President Bradford Councilman wascharged with violating the Wiretap Act. (23) The court's majority opinion noted that the parties stipulated that,at all times that the Interloc software was performing operations on the e-mails, they existed in therandom access memory or in hard drives within Interloc's computer system.

The case turned on the distinction between the e-mail being in transit, or in storage (andtherefore governed by a different law (24) ). The government argued that the e-mails were copiedcontemporaneously with their transmission, and therefore were intercepted under the meaning of theWiretap Act. Judges Torruella and Cyr concluded, however, that they were in temporary storagein Interloc's computer system, and therefore were not subject to the provisions of the Wiretap Act. They further stated that "We believe that the language of the statute makes clear that Congress meantto give lesser protection to electronic communications than wire and oral communication. Moreover,at this juncture, much of the protection may have been eviscerated by the realities of moderntechnology.... However, it is not the province of this court to graft meaning onto the statute whereCongress has spoken plainly." (p. 14-15). In his dissent, Judge Lipez stated, conversely, that he didnot believe Congress intended for e-mail that is temporarily stored as part of the transmission processto have less privacy than messages as they are in transit. He agreed with the government'scontention that an "intercept" occurs between the time the author hits the "send" button and themessage arrives in the recipient's in-box. He concluded that "Councilman's approach to the WiretapAct would undo decades of practice and precedent ... and would essentially render the actirrelevant.... Since I find it inconceivable that Congress could have intended such a result merelyby omitting the term 'electronic storage' from its definition of 'electronic communication,' Irespectfully dissent." (25)

Privacy advocates expressed deep concern about the ruling. Electronic Frontier Foundation(EFF) attorney Kevin Bankston stated that the court had "effectively given Internet communicationsproviders free rein to invade the privacy of their users for any reason and at any time." (26) The five major ISPs(AOL, Earthlink, Microsoft, Comcast, and Yahoo) all reportedly have policies governing their termsof service that state that they do not read subscribers' e-mail or disclose personal information unlessrequired to do so by law enforcement agencies. (27) The U.S. Department of Justice appealed the court's decision;and several civil liberties filed a "friend of the court" brief in support of the government's appeal. In August 2005, the First Circuit Court of Appeals overturned the lower court's decision 5-2. (28)

Two bills were introduced in the 108th Congress that would have affected this debate byamending either the Wiretap Act or the Stored Communications Act. There was no action on eitherbill.

In the first session of the 109th Congress, H.R. 3503 / S. 936 wereintroduced to amend the Wiretap Act to clarify that it applies "contemporaneous with transit, or onan ongoing basis during transit, through the use of any electronic, mechanical, or other device orprocess, notwithstanding that the communication may simultaneously be in electronic storage." There was no action on the bills in 2005.

Spyware

Spyware is discussed in more detail in CRS Report RL32706 , Spyware: Background andPolicy Issues for Congress , by Marcia Smith. The term "spyware" is not well defined. Oneexample of spyware is software products that include, as part of the software itself, a method bywhich information is collected about the use of the computer on which the software is installed. Some products may collect personally identifiable information (PII). When the computer isconnected to the Internet, the software periodically relays the information back to the softwaremanufacturer or a marketing company. Some software traces a user's Web activity and causesadvertisements to suddenly appear on the user's monitor -- called "pop-up" ads -- in response. Suchsoftware is called "adware," and one aspect of the spyware debate is whether adware should beincluded in the definition of spyware. Software programs that include spyware can be sold orprovided for free, on a disk (or other media) or downloaded from the Internet. Typically, users haveno knowledge that spyware is on their computers.

A central point of the debate is whether new laws are needed, or if industry self-regulation,coupled with enforcement actions under existing laws such as the Federal Trade Commission Act,is sufficient. The lack of a precise definition for spyware is cited as a fundamental problem inattempting to write new laws. FTC representatives and others caution that new legislation couldhave unintended consequences, barring current or future technologies that might, in fact, havebeneficial uses. They further insist that, if legal action is necessary, existing laws provide sufficientauthority. Consumer concern about control of their computers being taken over by spyware leadsothers to conclude that legislative action is needed.

Utah and California have passed spyware laws, but there is no specific federal law regardingspyware. In the 108th Congress, the House passed two bills ( H.R. 2929 and H.R. 4661 ) and the Senate Commerce Committee reported S. 2145 . Therewas no further action.

Two bills passed the House in the first session of the 109th Congress : H.R. 29 (Bono) and H.R. 744 (Goodlatte). Two bills specific to spyware were introduced in theSenate: S. 687 (Burns-Wyden), and S. 1004 (Allen). A Senate CommerceCommittee hearing on S. 687 was held on May 11, 2005. On November 17, 2005, thecommittee ordered reported S. 687, and defeated S. 1004, with committeeChairman Stevens reportedly saying that he hoped a compromise could be reached before the issuewas debated on the floor. (29) Meanwhile, the FTC endorsed a different bill, S. 1608 , at a hearing before a Senate Commerce subcommittee on October 5, 2005. That bill deals notonly with spyware, but with other Internet-related fraud, including spam. Its focus is enhancing theFTC's ability to investigate and prosecute perpetrators who are located abroad or who use foreignintermediaries. For more information, see CRS Report RL32706 , Spyware: Background and PolicyIssues for Congress , by Marcia Smith.

Identity Theft (Including Phishing and Pharming)

Identity theft is not an Internet privacy issue, but the perception that the Internet makesidentity theft easier means that it is often discussed in the Internet privacy context. The concern isthat the widespread use of computers for storing and transmitting information is contributing to therising rate of identity theft over the past several years, where one individual assumes the identity ofanother using personal information such as credit card and Social Security numbers (SSNs). TheFTC has a toll free number (877-ID-THEFT) to help victims. (30)

The extent to which the Internet is responsible for the increase in cases is debatable. Someattribute the rise instead to carelessness by businesses in handling personally identifiableinformation, and by credit issuers that grant credit without proper checks. More traditional methodsof acquiring someone's personal information -- from lost or stolen wallets, or "dumpster diving" --also are used by identity thieves. Three high profile incidents that became public in early 2005where the security of consumer PII was compromised reinforced existing fears about identity theft. The companies involved are ChoicePoint, Bank of America, and LexisNexis. These incidents aredescribed in CRS Report RS22082 , Identity Theft: The Internet Connection , by Marcia Smith.

Identity Theft Statistics

In a 2003 survey for the FTC, Synovate found that 51% of victims knew how their personalinformation was obtained by the thief: 14% said their information was obtained from lost or stolenwallets, checkbooks, or credit cards; 13% said the personal information was obtained during atransaction; 4% cited stolen mail; and 14% said the thief used "other" means (e.g. the informationwas misused by someone who had access to it such as a family member or workplaceassociate). (31)

Another survey, conducted by the Council of Better Business Bureaus and Javelin Strategy& Research, was released in January 2005. (32) The 2005 Identity Fraud Survey is based on data collected in2004 by Synovate using questions that closely mirrored those used in the 2003 FTC survey, plusseveral new questions. The survey found that computer crime accounted for 11.6% of identity theftcases in 2004, compared with 68% from paper sources. It further found that the average loss foronline identity theft was $551 compared to $4,543 from paper sources. In cases where theperpetrator could be identified, family members were responsible for 32% of cases; completestrangers outside the workplace for 24%; friends, neighbors, and in-home employees for 18%;someone at a company with access to personal information for 13%; someone at the victim'sworkplace for 4%; or "someone else" for 8%. The study concluded that, contrary to popularperception, identity theft is not getting worse. For example, it reported that the number of victimsdeclined from 10.1 million in 2003 to 9.3 million in 2004, and the annual dollar volume, adjustedfor inflation, is "highly similar" ($52.6 billion) in the 2003 survey and this survey.

On January 25, 2006, the FTC released its most recent data about the top ten consumer fraudcomplaints. (33) Identitytheft represented 37% of the 686,683 complaints filed with the FTC in 2005. Although the totalnumber of ID theft complaints was higher than in the two previous years (255,565 in 2005 comparedwith 246,847 in 2004 and 215,177 in 2004), as a percentage of complaints filed with the FTC, the2005 figure was less (37% in 2005 compared with 38% in 2004 and 40% in 2003). Credit cardfraud was identified as the most common form of identity theft (26%), compared with phone orutilities fraud (18%), bank fraud (17%), employment fraud (12%), government documents/benefitsfraud (9%), and loan fraud (5%).

"Phishing" and "Pharming"

One method used to obtain PII is called "phishing." It refers to an Internet-based practicein which someone misrepresents their identity or authority in order to induce another person toprovide PII. Some common phishing scams involve e-mails that purport to be from financialinstitutions or ISPs claiming that a person's record has been lost. The e-mail directs the person toa website that mimics the legitimate business' website and asks the person to enter a credit cardnumber and other PII so the record can be restored. In fact, the e-mail or website is controlled bya third party who is attempting to extract information that will be used in identity theft or othercrimes. The FTC issued a consumer alert on phishing in June 2004. (34) An "Anti-PhishingWorking Group" industry association has been established to collectively work on solutions tophishing http://www.antiphishing.org/ .

A version of phishing, dubbed "pharming," involves fraudulent use of domain names. (35) In pharming, hackershijack a legitimate website's domain name, and redirect traffic intended for that website to their own. The computer user sees the intended website's address in the browser's address line, but instead, heor she is connected to the hacker's site and may unknowingly provide PII to the hacker. (36)

Existing Laws

The FTC enforces three federal laws that restrict disclosure of consumer information andrequire companies to ensure the security and integrity of the data in certain contexts -- Section 5 ofthe Federal Trade Commission Act, the Fair Credit Reporting Act (FCRA), and Title V of theGramm-Leach-Bliley Act. FTC Chairwoman Deborah Platt Majoras summarized these laws as theypertain to identity theft at a March 10, 2005 hearing before the Senate Committee on Banking,Housing, and Urban Affairs. (37) She identified two other laws that are not enforced by the FTC,but which also restrict the disclosure of certain types of information: the Driver's Privacy ProtectionAct, and the Health Insurance Portability and Accountability Act.

Congress also has passed laws specifically regarding identity theft: the 1998 Identity Theftand Assumption Deterrence Act; the 2003 Fair and Accurate Credit Transactions (FACT) Act; andthe 2004 Identity Theft Penalty Enhancement Act. Those laws are summarized in CRS Report RL31919 , Remedies Available to Victims of Identity Theft , by Angie Welborn. Briefly, the IdentityTheft and Assumption Deterrence Act ( P.L.105-318 ) directed the FTC to establish a centralrepository for identity theft complaints, and provide victim assistance and consumer education.

The FACT Act ( P.L. 108-159 ) contains perhaps the most comprehensive identity theftprovisions in federal law. Implementation of that act is discussed in CRS Report RL32535 , Implementation of the Fair and Accurate Credit Transactions (FACT) Act , by Angie Welborn. Among its identity theft-related provisions, the law:

requires consumer reporting agencies (CRAs) to follow certain proceduresconcerning when to place, and what to do in response to, fraud alerts on consumers' creditfiles;

allows consumers one free copy of their consumer report each year fromnationwide CRAs as long as the consumer requests it through a centralized source under rules to beestablished by the FTC; (38)

allows consumers one free copy of their consumer report each year fromnationwide specialty CRAs (medical records or payments, residential or tenant history, check writinghistory, employment history, and insurance claims) upon request pursuant to regulations to beestablished by the FTC;

requires credit card issuers to follow certain procedures if additional cards arerequested within 30 days of a change of address notification for the sameaccount;

requires the truncation of credit card numbers on electronically printedreceipts;

requires business entities to provide records evidencing transactions allegedto be the result of identity theft to the victim and to law enforcement agencies authorized by thevictim to take receipt of the records in question;

requires CRAs to block the reporting of information in a consumer's file thatresulted from identity theft and to notify the furnisher of the information in question that it may bethe result of identity theft;

requires federal banking agencies, the FTC, and the National Credit UnionAdministration to jointly develop guidelines for use by financial institutions, creditors and otherusers of consumer reports regarding identity theft; and

extends the statute of limitations for when identity theft cases can bebrought.

The Identity Theft Penalty Enhancement Act ( P.L. 108-275 ) makes aggravated identity theftin conjunction with felonies a crime, and establishes mandatory sentences -- two additional yearsbeyond the penalty for the underlying crime, or five additional years for those who steal identitiesin conjunction with a terrorist act. (39)

At the March 10, 2005 Senate Banking Committee hearing, (40) FTC Chairwoman Majorasdiscussed the"complicated maze" of laws that governs consumer data, noting whether particular legalprovisions apply depends on the type of company or institution involved, the type of data collectedor sold, and the purpose for which it will be used. She conceded that it is not clear if data brokerslike ChoicePoint come under the FTC's jurisdiction, and concluded that additional legislation maybe necessary, particularly regarding notice and security. A witness from the Secret Service alsotestified about his agency's jurisdiction over identity theft crimes.

Legislation in the 109th Congress, 1st Session

Congress continues to consider ways to reduce the incidence of identity theft. Legislativeapproaches include strengthening penalties for identity theft or for the misuse of SSNs; (41) increasing regulation ofdata brokers, such as by requiring them to notify individuals whose PII has been breached, or toobtain a consumer's consent before selling PII; limiting the use of SSNs or allowing individuals tochoose an identifier other than their SSN for Medicare purposes, for example; or making phishingunlawful.

Despite the widespread attention to these issues, and the introduction of many bills, nolegislation to further address identity theft or to regulate data brokers passed during the first sessionof the 109th Congress. Four bills were acted upon in committee or subcommittee, however( H.R. 4127 , S. 1326 , S. 1408 , and S. 1789 ). According to the Wall Street Journal , legislative action stalled because of differing views among thevarious stakeholders in the debate.

Consumer groups are pushing for credit protections that financial institutions oppose. Small banks are arguing with larger ones about who picks up the 'reissuing costs'when credit or debit cards must be replaced. And everyone with a stake in the issueis debating the 'notification trigger,' specifying what breaches require alteringcustomers. (42)

The markup of H.R. 4127 (Stearns) by the House Energy and Commerce Subcommitteeon Commerce, Trade, and Consumer Protection was spirited, and the vote split on party lines. (43) The Senate JudiciaryCommittee reported S. 1326 (Sessions) without amendment and without written reporton October 20, 2005. By contrast, the markup of S. 1789 (Specter) by the samecommittee on October 27, 2005 involved considerable debate. (44) The Senate Commerce,Science, and Transportation Committee reported S. 1408 (Smith), amended, onDecember 8, 2005. See Table 1 for brief descriptions of the bills and associated report numbers.

For more on legislative action, see CRS Report RL31919 , Remedies Available to Victimsof Identity Theft , by Angie Welborn.

Summary of Internet Privacy-Related Legislation in the 109th Congress, 1st Session

The following table provides summary information on Internet privacy-related legislationintroduced in the first session of the 109th Congress. It should be noted that although some bills havesimilar titles or intents, the details may vary. For example, some bills seek to protect "personalinformation," while others protect "personally identifiable information" (PII). Some concern "data,"while others concern "electronic data." Definitions may vary, or, in some cases, the FTC is directedto determine a definition.

Table 1. Bills Introduced in the 109th Congress, 1stSession

Source: Prepared by CRS.

Note: PII = Personally Identifiable Information; SSN = Social Security Number.

* Although H.R. 1069 , S. 115 , and S. 751 have the same title,each is different.

Appendix A. Internet Privacy-Related Legislation Passed by the 108th Congress

Appendix B. Internet Privacy-Related Legislation Passed by the 107th Congress