Like many internet companies, Gliph is based in the United States and is governed by the laws of this country. Gliph respects the United States’ need to maintain national security. However, Gliph opposes CISPA as proposed because the legislation conflates cybersecurity with surveillance and information sharing. CISPA significantly erodes the privacy of internet users.

What is CISPA?
At the time of this writing, CISPA is H.R. 624, (web, pdf), the Cyber Intelligence Sharing and Protection Act. CISPA is just a bill, which is a proposed piece of legislation that has the potential to become a federal law in the United States.

CISPA’s purpose is to help the United States investigate cyber threats and ensure the security of networks against cyber attacks. The bill aims to add legal framework for the sharing of information between private companies and the United States government.

Why Oppose CISPA?
Gliph appreciates the pressing global context around cybersecurity, yet is adamant about the preservation of civil liberty and personal privacy. We are joining the Electronic Frontier Foundation and the Internet Defense League in our opposition to this bill. You can learn about the below bulleted issues and more in the EFF’s page about the bill.

Here are some of the key issues with CISPA Gliph is concerned about:

• Companies will have new rights to monitor both user behavior and personal data and then share it with the government without a warrant.
  CISPA gives companies the power to obtain “cybersecurity threat information,” which could include personal communications. The bill contains vaguely defined reasons companies may use for why they would track, store and share such information.

• CISPA grants companies broad immunity from legal liability of monitoring, acquiring and sharing personal data of their users.
  This immunity from legal liability combined with the ability to monitor and obtain personal communications has the potential to act as a loophole to privacy laws like the Wiretap Act and the Stored Communications Act.

• Users are unlikely to be informed that their private data is compromised under CISPA and will be unable to do anything about it.
  CISPA exempts the government from revealing the identities of individuals who have been tracked by companies and shared with the government from otherwise valid Freedom of Information requests. If a user’s privacy is violated by accident during information exchange, the government is not required to notify the user of the mistake.

• The recent hacks suffered by the New York Times and others were the result of attack methods that CISPA was not written to deal with.
  Although hacking has been described by the Director of National Intelligence is as a greater threat than terrorism, CISPA is not written to handle some of the most high-profile and recent attack types.

We encourage all of our users to oppose CISPA and to join Gliph, the EFF and the Internet Defense League to oppose the bill.

A variety of companies and publications have released new articles or information to mark the day. Microsoft released results of a new survey of 1,000 US adults that shows privacy is becoming more important to people, yet a sense of powerlessness pervades.

In the key findings of the report, 45% of people feel they have little or no control over personal information gathered by companies about them. Below is a graphic that shows how much control people feel they have over personal information shared online:

The circles on the graph indicate that men feel less in control over privacy than women while young people and those making incomes less than $50k a year have the strongest sense of control.

The Huffington Post has published an article marking the day and efforts to urge the US Congress into passing Electronic Privacy Reform. The Huffington Post article highlights the increasing disparity in privacy afforded to US citizens with regards to physical and virtual communication channels.

For example, email stored on web-based email services but used almost entirely from the home or mobile devices (like Gmail) may be obtained from US citizens without a warrant. Whereas a personal, physical letter sent to a home remain protected.

Individual choices around what personal data to keep private continue to focus on Facebook which encourages the open sharing and access to real personal data.

Facebook’s recent release of Graph Search has again highlighted concerns around the unexpected revelation of personal information. In the piece by The Nation, Ari Melber connects Graph Search to David Pozen’s paper (.pdf) in the Yale Law Journal describing the Mosaic Theory of intelligence gathering, where seemingly insignificant pieces of information can be assembled into a useable piece of intelligence on a person.

Unintentional sharing of personal data continues to be a problem, with the Online Trust Alliance announcement today that 242.6 million personal records were exposed in 2012. In their 2013 report on Data Protection and Data, they find that of 1478 breaches in 2012, over one-quarter were due to “internal incidents,” meaning personal data was revealed by members of the organization entrusted with personal data, rather than criminal mischief of those outside organizations.

Gliph is proud to be on the forefront of providing privacy not only around personal data, but also in building a system for communication and connection that offers real privacy.

In the Gliph company blog, we previously covered the efforts of the NTIA’s Privacy Multistakeholder Meetings that are aimed at realizing the Obama Administration’s Privacy Bill of Rights. We’ve also shared ideas for how startup companies can make privacy a strategic asset.

Some functional highlights from 2012 that added privacy to Gliph included the ability for users to securely delete Gliph messages, the release of Cloaked Email and an app access PIN to prevent casual snooping of Gliph conversations.  We have some terrific additions that add additional opportunities to maintain privacy planned for 2013 and look forward to sharing them with you.

We urge everyone to take a moment today to consider what personal data they have currently available on the interent and thoughtfully consider actions they need to take in 2013 to take control of their privacy online.

John Verdi (@johnverdi) is the Director of Privacy Initiatives at the NTIA and has been blogging about activities at the meetings. In his August 1st, 2012 post, he describes the July multi-stakeholder meeting as a step toward implementing the Consumer Privacy Bill of Rights.

This Bill of Rights is something to keep your eyes on. It was first proposed by the Obama Administration as part of a paper with the lengthy title “Consumer Data Privacy In a Networked World: A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy.” Gliph is hosting a copy you can download here [.pdf].

In the introduction, Barack Obama quotes Justice Louis Brandeis’ dissenting opinion in Olmstead v. United States which is Americans’ “right to be let alone.” Though he counters, “…privacy is about much more than just solitude or secrecy.”

The rights advanced in the paper cover the following (bulleted paragraphs are quoted from the paper):

• Individual Control – Consumers have a right to exercise control over what personal data companies collect from them and how they use it. 
• Transparency – Consumers have a right to easily understandable and accessible information about privacy and security practices.
• Respect for Context – Consumers have a right to expect that companies will collect, use, and disclose personal data in ways that are consistent with the context in which consumers provide the data.
• Security – Consumers have a right to secure and responsible handling of personal data.
• Access and Accuracy – Consumers have a right to access and correct personal data in usable formats, in a manner that is appropriate to the sensitivity of the data and the risk of adverse consequences to consumers if the data is inaccurate.
• Focused Collection – Consumers have a right to reasonable limits on the personal data that companies collect and retain.
• Accountability – Consumers have a right to have personal data handled by companies with appropriate measures in place to assure they adhere to the Consumer Privacy Bill of Rights.

The paper was released with the Consumer Privacy Bill of Rights in February of 2012, just weeks after the Path Address Book controversy. Meetings have been happening in Washington DC with participation in-person and remotely from ‘stakeholders’ from industry, consumer groups, government academia and the technical community.

The NTIA’s meetings have helped bring attention to previous efforts such as those from the Future of Privacy Forum’s guide to Transparency [.pdf]. They’ve also shed greater light on recent research around consumer privacy, including University of Pennsylvania Professor Joseph (@JoeProf) Turow’s presentation on The Non-Transparency of Key Online Words [.pdf].

In the deck, Turow makes the observation that “Marketers are using words and actions aimed at calming publics over privacy but that actually change the words’ meanings.” Also, that the targeting of online ads could possibly lead to “increasing social tensions and distrust of institutions (including government) around the issue of who is ‘target’ and who ‘waste.'”

The NTIA meetings are being held in public and are the focused effort of the NTIA’s Office of Policy Analysis and Development (OPAD). You can keep up on the schedule, meeting documents and more by watching the privacy tag on the NTIA website.