Year in Review: Privacy and surveillance

Privacy goes nowhere

This year, politicians talked a lot about privacy and surveillance but failed to do much of anything about it.

After news broke in September of Hewlett-Packard's investigation of journalists, including three CNET News.com reporters, following a boardroom media leak, politicians vowed to completely ban the practice of fraudulently obtaining telephone records through what is known as "pretexting."

But the final version of legislation that the U.S. Congress sent to President Bush explicitly said law enforcement and intelligence agencies--some of the most aggressive users of pretexting--could continue to peruse records of Americans' phone calls without additional oversight.

Republicans mounted a last-minute push to rewrite surveillance laws while they still enjoyed control of the Congress. Their proposal effectively would have legalized the National Security Agency's electronic surveillance program.

Yet even with the president's enthusiastic support, politicians left town for the year without enacting the legislation.

This pattern is familiar. The Bush administration quietly proposed in mid-2005 that Internet service providers be required to keep track of what their customers do online, a concept called data retention.

This year, that stealthy political push became a public one. Attorney General Alberto Gonzales said in a major speech in April that data retention "must be addressed," a sentiment echoed by FBI Director Robert Mueller and other Bush administration officials.

After Gonzales' speech, Rep. F. James Sensenbrenner, the Republican chairman of the House Judiciary Committee, began drafting legislation. But nothing ever happened.

Passports with implanted RFID, or radio frequency ID, chips were proven to be insecure. Researchers said such passports can be remotely identified as belonging to Americans and the supposedly secure RFID tags can be copied with a few hundred dollars worth of computer gear.

Despite lingering security and privacy concerns, the U.S. government continued to push other nations to implant RFID tags in their passports as part of a visa waiver program. Americans began receiving them in August from the Colorado Passport Agency, with a nationwide rollout expected in about six months.

The concept of notifying people if their data is affected in a security breach met with a brief flurry of promises from politicians to enact a law this year. So did a plan to restrict the use of Social Security numbers. But even though there are at least 15 proposals in Congress dealing with those topics, they remain bottled up in committees.

One exception was an overwhelming vote to renew the Patriot Act. Portions of the original bill enacted in October 2001 were set to expire three years later. But the revised version enacted in March made nearly all of those sections permanent.

It's unclear what's going to happen in 2007. A Democrat-controlled Congress could prove more willing to probe Bush's NSA surveillance program, and a key Democratic senator said this month that he wanted to put privacy legislation on his committee's agenda. But any bill to scale back the NSA program would need to overcome the threat of a presidential veto.

--Declan McCullagh

2006 Highlights