Sept. 11: A year later, online privacy and security still weak

A year after the Sept. 11 terrorist attacks, average Americans are subject to more surveillance when they go online, and their Internet-connected PCs may not be any safer from intruders, some experts say.
On the other hand, some of the laws that opponents and privacy advocates claimed would compromise privacy were quashed. For example, Congress rejected measures restricting the distribution of encryption software and implementing federal identification cards.
And while passage of the Patriot Act has reduced privacy expectations, early reports don't indicate that the U.S. government is abusing its new powers to eavesdrop on its citizens' online conversations.
Then again, said Jennifer Granick, director of Stanford University's Center for Internet and Society, "it's too soon for horror stories."
There is little debate, even from vociferous privacy advocates, that online investigations are an important part of the war on terror. Yet there remains plenty of concern that an overzealous online hunt for al-Qaeda threatens the privacy rights of law-abiding Americans.
"The idea that the average citizen doesn't need privacy is really antithetical to the American way of life," Granick said. "One isn't really free if one is always watched."
But ordinary Americans are being watched more carefully -- in more public places, by more people -- than they were 12 months ago. In the year since the attacks on New York and the Pentagon, "there's a renewed interest in new surveillance technologies, even when it's not required," said Lee Tien, a senior staff attorney at the Electronic Frontier Foundation. For example, biometric security is drawing increased interest. But "biometrics is at the end of the security continuum that is the most damaging to privacy," Tien said, adding that he worries that the technology is "not ready for prime time in a high-security environment."
"Privacy has taken some body blows," Tien said. But data-gathering alone won't bring greater security unless investigators properly evaluate and share the information, he said.
Cybersecurity plan raises questions
Peter Swire, a law professor at Ohio State University who was chief counselor for privacy issues in the Clinton administration, has concerns about the Bush administration's proposed cybersecurity program. "There are early reports [that say] they will collect large amounts of traffic data, such as who calls whom, what's in your e-mail and where you surf," Swire said.
The Bush administration has declined to comment on the proposal until its scheduled release later this month. Congress is expected to continue work on its Cyber Security Enhancement Act, as well.
The concern isn't limited to advisers who worked for