New state law provides more oversight for sex offenders

UPDATE 7-4: A great reader reminds us they dropped the "password" requirement before passage. see #17

7-3: Unfortunately there is no known advocate in TN fighting nonsensical laws. Lawmakers failed to do their research, in Georgia lawmakers also tried to force registrants to provide passwords, but federal court issued an injunction which stopped the state from requiring passwords. see White v Baker. Also in Utah the "password" issue -along with several others- was taken to court; the case ultimately ended in the U.S. Supreme court. However, the legislature REMOVED the password requirement along the way so that issue did not goto the high court but other issues did. See Doe v Shurtleff. Apparently lawmakers have little respect for rights of registrants! Makes one wonder how they got elected.

7-3-5 Tennessee:

ACKSON, Tenn. -- A new state law grants greater oversight on registered sex offenders who use social media.

Previously, sexual offenders had to provide the Tennessee Bureau of Investigation with their email addresses and screen names.

Now the law requires all registered offenders to provide email addresses plus usernames and passwords to all Internet accounts.

Local law enforcement said they hope the changes will increase safety for everyone.

"It's serious, and we talk about it all the time," said Madison County Sheriff John Mehr. "Children will get on the computer, they will chat with people when they think it's their age and in fact the person is 40 years old."

The sheriff also said this is a small step in the social media requirements for registered sex offenders. More changes are expected in the future. ..Source.. by WBBJ 7 Eyewitness News Staff

Read More of Article...

Article Summary only...

Maryland to Employers: Stop Asking for Facebook Passwords

See also: Maryland passes electronic privacy bill for further details.

4-11-2012 Maryland:

Maryland's General Assembly passed the first bill of its kind prohibiting employers from asking for the personal online information and was inspired by the controversy surrounding Maryland Corrections Officer Robert Collins, whose employers demanded his Facebook password as a condition of future employment. Collins took his case to the American Civil Liberties Union, which filed suit, bringing the issue to Congress.

Maryland ACLU legislative director Melissa Goemann said the ban "trail-blazed a new frontier in protecting freedom of expression in the digital age, and has created a model for other states to follow."

Additional legislation in other states and even a federal level may be next, as lawmakers all over the U.S. are turning their attention to this issue. Illinois and Michigan are gearing up on similar bills, while Sen. Richard Blumenthal (D., Conn.) announced his intention to sponsor a federal bill banning employers from asking for passwords or requiring candidates to "friend" them on Facebook.

The campaign to legislate this issue is increasingly partisan, with the Republican-controlled House of Representatives shooting down a "Mind Your Own Business On Passwords" provision, which attempted to outline the practice on a different bill earlier this year.


The need for guidelines is growing, shown by U.K. business psychology firm OPP's study finding over half of employers look at their prospects' Facebook information as part of the hiring process, so these new regulations could have a major effect on the employment process.

The Maryland bill sends a message to employers to stop snooping and adds a new wrinkle to the partisan fighting over privacy regulations. Companies and organizations may be reluctant to ease up on Facebook investigations, but more laws are likely in the pipeline to stop the practice. ..Source.. by Kate Knibbs

Read More of Article...

Article Summary only...

MT- Want A Job? Hand Over Your E-Mail Login

Sure, right, Bozeman here's my answer!
6-19-2009 Montana:

Bozeman, Montana Tells Applicants To Provide Facebook, Google "Usernames And Passwords," Which Some Find A Bit Too Invasive

(CBS) If you're planning to apply for a job with the city of Bozeman, Montana, be prepared to hand over much more than your references and résumé.

The Rocky Mountain city instructs all job applicants to divulge their usernames and passwords for "any Internet-based chat rooms, social clubs or forums, to include, but not limited to: Facebook, Google, Yahoo, YouTube.com, MySpace, etc."

"Before we offer people employment in a public trust position we have a responsibility to do a thorough background check," Chuck Winn, Bozeman's assistant city manager, told CBSNews.com in an interview on Thursday. "This is just a component of a thorough background check."

"Shame on us if there was information out there available about a person who applied for a job who was a child molester or had some sort of information out there on the Internet that kind of showed those propensities and we didn't look for it, we didn't ask, and we hired that person," Winn said. "In many ways we would have let the public down."

After CBS affiliate KBZK highlighted the requirement on Wednesday, a firestorm of sorts has erupted online: irate e-mail messages have jammed mailboxes in City Hall, snarky Twitter.com comments have poked fun at a place once awarded the sobriquet of "All-America City," and a poll indicates 98 percent of respondents believe the city's policy amounts to an "invasion of privacy."

In addition to the usual requests for a home address and Social Security number, Bozeman's one-page background check form asks for the account information for "current personal or business Web sites, Web pages or memberships." It assures applicants that any information received "is confidential."

Winn said applicants are not required to divulge their social networking log-ins, but warned that there could be repercussions if they lie. "If you say 'I have no driving violation,' and then we run your driving record and it turns out you do, and through further questioning we find out you've been deceitful about it, than that would be cause (for firing)," he said. "That tells us a lot about that particular person. They lied to us and were deceitful."

Under the policy, which the city says has been in place for a few years, a police officer logs into and reviews the social networking sites of people applying for public safety (that is, police and fire) jobs. For other jobs, the city's human resources department will perform the investigation.

An attorney for the Electronic Frontier Foundation, a digital rights group based in San Francisco, questioned Bozeman's choice to ask for usernames and passwords.

"I think its indefensibly invasive and likely illegal as a violation of
the First Amendment rights of job applicants," said Kevin Bankston, an EFF attorney. "Essentially they're conditioning your application for employment on your waiving your First Amendment rights ... and risking the security of your information by requiring you to share your password with them... Where does it stop? How about a photocopy of your diary?"

One potential privacy concern is that accounts for Facebook and Google, among other sites, are used for more than just displaying photos, videos, and messages. They're also used for e-mail, meaning that a Bozeman investigator could review years of personal messages.

"I don't think the government can condition your application for employment on your giving up your First Amendment rights and your Fourth Amendment rights," Bankston said.

Another possible hitch: Some social networking sites flatly prohibit disclosure of passwords, so a job seeker who complied with Bozeman's request could lose his account. Facebook's terms of service, for instance, say: "You will not share your password (or) let anyone else access your account."

Bozeman's Winn said the city does not want to be the "taste police" and is focused on looking for evidence of illegal activity. "They can log in themselves," he said. "If not, they can show us what's on their face page. 'Yes, I have a face page but I don't want to show it to you.' That's a fine answer. We'll use other resources out there to do a through background check. We owe it to the public." ..Source.. by Declan McCullagh

Read More of Article...

Article Summary only...

GA- Decoding stupid law

1-14-2009 Georgia:

IT’S A NEW YEAR so of course Georgia has put onto its books another new law that won’t work. And, once again, it has to do with sex offenders. Legislators have a real fetish about such folks.

There’s nothing wrong with the intention, of course. Indeed, the state’s version only seeks to implement an act of Congress approved by entirely different politicians of higher rank who similarly know too little about the computer age.

The 2006 federal law simply requires authorities to keep track of the Internet addresses of sex offenders. Georgia one-upped this by requiring them to hand over all their passwords along with screen names and addresses. The only other state to have gone this far is Utah, where one portion of the law has already been overturned by the courts.

The perceived purpose of such laws is entirely valid as regards predatory sex offenders. It’s no secret that the Internet has become the happy hunting grounds for them, particularly as regards children.

THE PROBLEM, in Georgia, is once again the state’s overly broad definition of sex offender — basically anybody ever caught with their pants down in the wrong place at the wrong time. They’re also put on the sex-offender registry for life, even if the offense was premarital sex with the woman, then a teen, who is now their wife.

Making Internet prowling difficult for true perverts that prey on children is entirely worthwhile although, as often mentioned in this space before, if authorities really believe such now-released ex-convicts are still this much of a danger why did they let them go in the first place? Why didn’t they commit them to a secure mental-health facility for treatment until cured (or chemically castrated)?

The real predators are a very small minority of the 16,000 Georgians currently on the registry, some of whom are there for offenses pretty much ignored nowadays, such as voluntary oral sex.

Until Georgia changes its definitions and zeroes in only on true predators for intensive scrutiny, and further ceases to release them until treated and cured, all this constant attack by the General Assembly on this front is utter nonsense and, as the courts regularly agree, unconstitutional to boot.

PERHAPS EVEN worse, in this instance, is pretending this can do any good whatsoever and keep predators off the electronic hunting ground. Maybe they can catch the really, really dumb offenders with this but those would trip themselves up anyway. It’s the clever ones that are truly dangerous, and particularly if they are even modestly computer savvy.

First of all, it is child’s play to open a new account with e-mail, a different name and a different password every day. Heck, every minute if so inclined ... and all for free.

Plus, there are also such things as anonymous surfing through servers located overseas that are immune from Georgia (or U.S.) snooping and encryption programs of such a level that only the CIA — maybe — can decode them.

Sound-good, feel-good laws that don’t work are dangerous to a public that largely is deluded into believing it is somehow protected by them. The best way to protect our children from Internet predators remains strong parental/adult super-vision of computer usage.

While defenders of such laws are often heard arguing that “sex offenders have no rights” the reality is that they do, and particularly so if not in a cell and “having paid their debt to society.” They’ve got mostly the same rights as everyone else, particularly if they behave themselves.

SURRENDER THEIR passwords in an era when computer users are warned to protect their Social Security numbers at all costs?

Surrender access to bank accounts and credit cards managed online?

Surrender privacy in making political comments or in communicating with one’s minister?

The rest of us would tell the General Assembly to go to hell if asked to do this. Why should released sex offenders, most of whom are trying to become ordinary people once again, feel any different?

It is appallingly easy to predict that this new Georgia law will be struck down by the courts, assuming any sex offender is actually ignorant enough of it and computers to be caught.

Indeed, one looks forward to the case where a sex offender if found not to have revealed his account and password on his church-operated server and is threatened with being sent back to prison for making contributions to his denomination’s mission fund “in secret.”

The risk that the General Assembly seeks to address is real, although far more limited than its overly sweeping law. It also won’t work, which makes it a fraud.

SO LONG as the legislators aren’t willing to pay for identifying true predators and keeping them confined, and giving them medical treatment, it remains their political stagecraft that poses the largest danger to the state’s children. ..News Source.. by Rome-News Tribune.com

Read More of Article...

Article Summary only...

Child porn defendant locked up after ZIP file encryption broken

1-16-2008 Texas

Government investigators were able to easily break the ZIP file encryption that a Texas man allegedly used to conceal illegal images, a recent court case shows.

The investigation of John Craig Zimmerman began when his employer, the Brownsville Fire Department, received an anonymous voice message in February 2007 alleging that Zimmerman was a pedophile and had child pornography on his department-owned work computer. A city programmer named Albert Castillo searched Zimmerman's computer and found adult pornography (technically a violation of department policy but not a crime) on an external hard drive.

What Castillo also found were some password-protected ZIP files titled "Cindy 5." Castillo apparently used a program called Zipkey 5.5 to brute-force at least some of the password-protected files and find images of a partly naked minor.

Homeland Security's Immigration and Customs Enforcement agents were called in, and volunteered that they had information from a previous investigation showing that Zimmerman previously bought a membership on a child porn Web site. (Left unanswered is why, if that was in fact the case, ICE never did anything about it.)

What happened next: Zimmermann's home was raided with a search warrant, additional images he allegedly took himself were found, he was indicted on counts of receiving and possessing child pornography, and he pleaded no contest except to say that the images had nothing to do with interstate commerce. In an opinion dated December 20, U.S. District Judge Andrew Hanen said there was a "rational basis" to assume that child pornography transmissions related to interstate commerce.

I mention this case not to show that there's something remarkable about decrypting one of the older ZIP archives: the symmetric encryption algorithm used has long been known to be anything but secure. Newer WinZip archives, starting with WinZip 9.0, use more secure 128- and 256-bit key AES encryption.

The reason I'm mentioning this case is to argue that as encryption becomes more widespread--it's part of OS X and Vista, after all--police will encounter it more frequently, and not just in cases involving illegal images. And not all encrypted files will be as easy to brute-force. Which means that the outcome of the Boucher case becomes more important than ever. ..more.. by Declan McCullagh

Read More of Article...

Article Summary only...

Pretty Good Privacy Causes Legal Problems for a Vermont Court

1-16-2008 Vermont:

Pretty Good Privacy is an encryption software used to protect computer files. One Canadian man, Sebastian Boucher, uses the PGP program to protect certain files, and those certain password protection files are the focus of the US District Court in Vermont.

The 30 year old drywall installer is a Canadian citizen with legal residency in Vermont. On December 17, 2006 Boucher was driving to Vermont from Canada when he was stopped by a US Customs & Border Protection investigator. After searching the car, Boucher‘s laptop was discovered.

Suspecting the computer contained child porn, after reading the title of a file named, Two-year-old being raped during diaper change, the investigator asked Boucher to show him the folder his downloaded files. The investigator saw a file of a preteen undressing and performing acts. Boucher was then arrested and charged with transportation of child pornography in interstate or foreign commerce.

The laptop was seized, however, authorities were not able to gain access onto the computer’s Z drive since it was password protected by Pretty Good Privacy. So begins the court room dilemma.

Boucher is being asked to provide the password to open the Z drive, however Magistrate Judge Jerome J. Niedermeier says “If Boucher does know the password, he would be faced with the forbidden trilemma: incriminate himself, lie under oath, or find himself in contempt of court.”

It’s a tricky case. A privacy and technology expert, Mark D. Rasch, says that ruling will be a “dangerous” one for law enforcement. “If it stands, it means that if you encrypt your documents, the government cannot force you to decrypt them…So you're going to see drug dealers and pedophiles encrypting their documents, secure in the knowledge that the police can't get at them." ..more.. by TransWorldNews

To read the court decision: CLICK


Court may demand porn suspect's computer password
1-16-2008 Vermont:

The federal government is asking a U.S. District Court in Vermont to order a man to type a password to unlock files on his computer, despite his claim that doing so would constitute self-incrimination.

The case, believed to be the first of its kind to reach this level, raises a digital-age issue about how to balance privacy and civil liberties against the government's responsibility to protect the public.

The case, which involves suspected possession of child pornography, comes as more Americans turn to encryption to protect the privacy and security of files on their laptops and thumb drives. FBI and Justice Department officials have said that encryption is allowing terrorists and criminals to communicate covertly.

On Nov. 29, Magistrate Judge Jerome Niedermeier ruled that compelling Sebastien Boucher, a 30- year-old drywall installer who lives in Vermont, to enter his password into his laptop would violate his Fifth Amendment right against self-incrimination.

Boucher had been stopped at the Canadian border, where a customs agent observed that files on his computer had titles that implied child pornography. The laptop was seized, but the encrypted files could not be opened.

The government has appealed, and the case is under grand jury investigation, said Boucher's attorney, James Boudreau of Boston.

The ruling is already prompting controversy.

"The consequence of this decision being upheld is that the government would have to find other methods to get this information," said Marc Rotenberg, executive director of the Electronic Privacy Information Center. "But that's . . . what the Fifth Amendment is intended to protect."

But Mark Rasch, a privacy and technology expert with FTI Consulting and a former federal prosecutor, said the ruling was "dangerous" for law enforcement.

"You're going to see drug dealers and pedophiles encrypting their documents, secure in the knowledge that the police can't get at them," he said. ..more.. by Ellen Nakashima, The Washington Post

Read More of Article...

Article Summary only...