AT&T rewrites rules: Your data isn't yours

AT&T, the nation's largest telephone company, has updated its privacy policy, saying on June 21 that personal account information is owned by the company –not customers–and may be shared to investigate "potential threats." "While your account information may be personal to you, these records constitute business records that are owned by AT&T," states the policy. "As such, AT&T may disclose such records" to "investigate, prevent or take action regarding illegal activities, suspected fraud" and "situations involving potential threats to the physical safety of any person" as required or permitted by law. AT&T updated its policy, as the company and other phone operators face lawsuits claiming they are aiding a government domestic spying program by inappropriately handing over millions of call records. Privacy advocates slammed AT&T for declaring that it owned its internet and video customers' account information and could hand the data over to law enforcement. "My understanding is that they will be monitoring television viewing habits, and that it's a condition of service that customers can't opt out of," said Paul Stephens, policy analyst at Privacy Rights Clearinghouse. "It's frightening." In the policy update, which applies to AT&T's more than seven million internet and video customers, the company says it could collect usage information from subscribers, including the web pages they view, the programs they record and the games they play. Customers must agree to the terms before using AT&T's services. AT&T's previous policy guidelines did not explicitly say the company owned customer data. AT&T, Verizon, BellSouth Corp. and Comcast Corp. have been named by media reports as having shared customer information with the National Security Agency (NSA) in violation of Fourth Amendment protections requiring a warrant. AT&T said it began to review its privacy policy six months ago, and the update was aimed at clarifying its practice and did not change how it treats customer information. But the American Civil Liberties Union (ACLU) said AT&T was trying to give itself license to do what it wants with client data. "By secretly providing customer data to the government outside of any legal channel, AT&T has violated the privacy expectations of Americans–not just the terms of some legalistic privacy policy, but their basic expectations for how private communications will be treated in America," said Barry Steinhardt, director of the ACLU's Technology and Liberty Project. The policy indicates that AT&T will track the viewing habits of customers of its new video service–something that cable and satellite providers are prohibited from doing. The Cable Communications Policy Act of 1984 stipulates that cable and satellite companies can't collect or disclose information about customers' viewing habits. The law is silent on video services offered by phone companies via the internet, basically because legislators never anticipated such technology would be available. On the day the new policy took effect, the Bush administration made strident moves to block one of the lawsuits accusing AT&T of illegally collaborating in government electronic surveillance. Assistant Attorney General Peter Keisler argued in a San Francisco courtroom that if allowed to proceed, the suit would help terrorists communicate "more securely and more efficiently" unless it is promptly dismissed. If the case is allowed to proceed, AT&T will have to admit or deny that it gave the NSA access to its telephone and email networks and database so the government could eavesdrop on US citizens, Keisler said. An admission either way by AT&T would betray "a state secret of the highest order," he said. When Chief US District Judge Vaughn Walker pointed out that the alleged cooperation of AT&T and other telecommunications companies has been widely reported in the press, Keisler said public confirmation or denial would allow terrorists to replace suspicion with certainty. A "reasonable terrorist" deciding how to contact cohorts weighs the risk that communications on a commercial network will be intercepted against the difficulties of finding other channels, Keisler said. By clarifying AT&T's status, he said, "you are enabling them to communicate more securely and more efficiently." Also, he said, a confirmation of AT&T's role in the program would "immediately heighten the risk that the company and its facilities would be subject to attack." The suit, the first of more than 30 now pending against major phone companies, was filed in January by the Electronic Frontier Foundation on behalf of AT&T customers. It alleges that the company has allowed the National Security Agency to intercept the phone calls and emails of tens of millions of customers for use in its program to monitor contacts with suspected foreign terrorists. The suit seeks damages, potentially into the billions of dollars, and a ban on AT&T's participation in the program. President Bush acknowledged in December that the federal agency has eavesdropped on communications between US citizens and alleged terrorists abroad without the court warrants required by a 1978 federal law. His claim that he has the constitutional power to authorize the surveillance is being challenged in another lawsuit in Michigan. Walker, who also heard arguments by AT&T to dismiss the suit, did not issue a ruling and gave no clear indication of which way he was leaning during the three hour hearing. But he seemed skeptical of the government's broadest claim: that the entire subject of the lawsuit is a state secret, requiring dismissal without further inquiry. "The state secrets privilege is not unlimited," the judge told Keisler. Electronic Frontier Foundation lawyer Kevin Bankston argued that the plaintiffs don't have to show that the federal agency monitored individual calls, because they have evidence that AT&T, in cooperation with the government, engaged in "wholesale surveillance of its customers." That evidence, he said, consists of company documents and a statement by Mark Klein, a former AT&T technician, describing the installation in 2003 of equipment at the company's building on Folsom Street in San Francisco that allowed internet traffic to be routed to the government.