City Council Member Vacca (seated)
The Technology Committee of the New York City Council held an oversight hearing Monday on the city’s data privacy policies and data security protocols. A broad variety of more specific topics were covered during the hearing, chaired by Council Member James Vacca, including unauthorized data usage and security breaches; risks related to the expansion of high-speed internet availability and sidewalk wi-fi kiosks; the Worker Connect program that allows New Yorkers to search and apply for public benefits; new efforts at data exchange among city agencies; and the ‘Internet of Things,’ which refers to interconnectivity of various applications, devices, and information.
As expected, a number of questions were raised at the hearing, only some of which were answered, about data privacy for New Yorkers and data security for city agencies.
“I do think we came across some needs to have more of a formalized process on how we protect people’s privacy,” Vacca said after the hearing. “There should be an agency that’s tasked with this specific issue of privacy.”
The main city agency tasked with data privacy concerns and security is the Department of Information Technology and Telecommunications, or DoITT. Commissioner Anne Roest testified Monday and told Vacca and the committee that the city is constantly experiencing hacking attacks. Since the current administration took office in January 2014, there were two instances when city data was stolen, Roest said, once from the Fire Department and once from the Administration for Children’s Services.
“We’ve had, and I don’t have a number in front of me, but hundreds in the past year, of incidents where malware got into our system, but didn’t get anything out,” Roest said, emphasizing the quality of agencies cybersecurity threat response and prevention.
A substantial part of the hearing revolved around LinkNYC, a network of interactive kiosks spread throughout the city, often where payphones used to be, providing free, fast wi-fi, access to various public services, and free phone calls anywhere in the United States. In January 2017, LinkNYC had over 1 million subscribers. Meanwhile, the latest data published on the city’s Open Data Portal indicates over 7 million sessions for the week of April 10.
While the Link network is being used and expanded, there are privacy concerns. DoITT takes pride in the latest version of the privacy policy negotiated with the franchise partner, CityBridge LLC. Roest emphasized in her opening statement that LinkNYC does not track users’ browsing history and location, and therefore does not store or sell it.
According to the privacy policy published on the LinkNYC website, the software does collect unique information about the device and browser being used, such as, for example, IP and MAC addresses, time zone settings, and other data (According to the privacy policy, this information is needed by LinkNYC to be able to provide internet connectivity). The storage period for this information varies from 60 days to a year. Each booth is also equipped with two cameras used to prevent or track vandalism, Roest said. The video is stored for seven days and then deleted.
“Many national studies indicate that lower income people are disproportionately burned by data collection and privacy violations,” said Vacca in his opening statement at the hearing. He continued: “Last month Attorney General Eric Schneiderman announced that his office received approximately 1,300 notifications regarding data breaches of non-governmental systems in 2016. That is a 60 percent increase from the previous year.”
“Privacy is not a luxury item, but a fundamental right of all people. With the recent federal repeal of the data privacy measures for internet service providers this discussion takes on added importance,” Vacca said about the decision to roll back a set of privacy regulations that obliged Internet providers to request consent from users before sharing and selling sensitive information, such as, for instance, healthcare and financial data, obtained by tracking their browsing behavior.
The city’s Chief Technology Officer, Miguel A. Gamiño Jr., added during testimony that his office is planning to conduct a legal review to investigate the city’s potential to protect the privacy of New Yorkers, given ongoing reconsideration of Obama-era FCC regulations. “Specifically, this review includes an evaluation of the authority the city may have over the privacy policies of internet service providers, how and to what extent the city is exercising this authority currently, and whether the city can expand the exercise of its available authority to achieve, at minimum, the privacy protections for internet service consumers that Congress and the President have recently repealed,” said Gamiño.
Officials identified public education as one of the key measures in preventing hacking attacks and data breaches in New York. Gamiño announced an “interagency work group on internet health and human rights” that will look for ways to educate consumers and businesses on how to protect their privacy. He also mentioned the city’s cooperation with public libraries on digital literacy materials for citizens and collaboration with Mozilla Foundation on a series of digital security workshops for organizations. Mozilla, a technology company known for its Firefox web browser, runs a nonprofit foundation that promotes open and accessible internet.
Another topic covered by several meeting participants was an interagency data exchange strategy. Better data exchange among city agencies can improve transparency, efficiency, and broader accessibility to information for New Yorkers, but necessitates establishment of security and privacy protocols.
DoITT Commissioner Roest discussed the importance of classifying collected data and applying safety protocols to the resulting categories. For instance, all data characterized as confidential cannot be stored or transferred unless it is protected by a special encryption technology.
Finally, the Council committee discussed existing guidelines and a future strategy for the ‘Internet of Things’, where New York City claims to be one of the global pioneers, and a recent launch of the Neighborhood Innovation Lab initiative, aimed to connect government, technologists, and communities in a joint effort to innovate and improve local communities.
“Data privacy is a wide-ranging issue and seemingly touches almost every aspect of our city’s services,” Vacca concluded.
***
by Natalia Erokhina for Gotham Gazette
@GothamGazette