response 94 of 118:

Sep 6 20:04 UTC 2002

That puts the responsibility on PayPal to keep the information
for as long as we need it.  I'd say no, that if we need the info,
then we should collect it and be responsible for safeguarding it.

Again, nobody has to give us any information they are uncomfortable
having us hold.  It's that easy.

response 96 of 118:

Sep 6 20:20 UTC 2002

Regarding the idea that grex needs to maintain information after a user
has let his or her membership expire; why?  They're gone; what they did on
grex is history, and if you haven't heard about it by the time they leave,
you're probably never going to hear about it.  What right does Cyberspace
Communications, Inc. have to retain that data beyond a reasonable grace
period, say 6 months?  We were talking about people who's data was still
around after a couple of years, if I understood Mark correctly.

The issue here is identity theft, more than anything.  Some folks are
trying to raise questions about grex's propriety, but I think that's a
non-issue.  It's clear that grex isn't interested in ``tracking'' people
so much as being able to tell a cop or fed, ``Joe Smith is a member;
here's a copy of his driver's license that he sent us.''  However, it's
a fact of probability theory that the longer grex retains that data, the
greater the chance that someone might be able to steal it.  It's another
fact that grex might be retaining more data than it needs; I don't see how
you need anything other than a name, address, and maybe a phone number.
A sufficient argument that more is required hasn't been made, either.

Unfortunately, identity theft is real, and a serious problem.  Ask anyone
who's ever had their social security card stolen.

I don't think that anyone is arguing gthat grex doesn't need to know
who its users *are*, but what's in question is the manner in which grex
finds that out, and then what they do with it, and when they get rid
of it.  Six months I can see.  But two years?  Come on.

ps- it's been stated that only one person has access to the ID data: the
treasurer.  However, that position turns over periodically, presumably
the data migrates along with the position, so it's not strictly true
that only one person can see it.  Rather, only one position within the
corporation is authorized to see it.

response 98 of 118:

Sep 6 21:18 UTC 2002

I agree, Mark's job should be simple and painless with little effort as
possible.  It's also the reason I'm posing questions..not to make any red
herrings, but just to see where the buck stops. ;)

response 104 of 118:

Sep 7 21:59 UTC 2002

Re #94: You can request that Paypal give you the name and verified
shipping address of the person.  That should be sufficient data for Grex
to hang on to.

response 108 of 118:

Sep 9 21:54 UTC 2002

Regarding #105; Cool, my library card just says, ``The New York Public
Library'' on it, with no other visible identification information.  Does
that count?  If so, what's the point?  And do soccer mom's really use
*library cards* for nefarious activities?  Well, I suppose that fits....

Regarding #106; Please don't feed the troll.

Regarding #99; I think the value of the data to grex is greatly
overstated.  This is empirically backed up; no one's ever asked for
it.  (Of course, that neglects the argument that no one's ever asked
for it because it exists in the first place.)

Regarding #97; Earlier you said it was important to keep the data
around to provide law enforcement with useful information should a
member use grex for some illicit activity.  Now, it's just that it's
too much of a hassle for the treasurer to destroy it.  Which is it?

response 110 of 118:

Sep 10 03:33 UTC 2002

Since there is a question about what kinds of ID are acceptable, here is th
official policy.

This is quoted from the minutes for the September 27, 1995 board meeting;
the relevant parts are sections 2 and 5.  The policy was intended for
verification of non-members to use outbound Internet services, but as I
understand it, the ID criteria also apply to verification of members.

T. Verification Policy - John Remmers passed around a verification policy
 which he had formulated. A few words were modified, but there was a long
 discussion about whether it should be possible for trusted people, such
 as staff, to relay information to the verifier. Ultimately, the wording
 in this respect was left intact.

 Here is the final wording of the motion:

 MOTION: (remmers, steve)

 (1) Anyone requesting access to Grex services for which verification
 is required shall present proof of his or her identity. Members and
 non-members will be held to the same verification criteria. In order
 to be considered verified, a person shall submit a photocopy of an
 item of acceptable identification and a signed letter requesting the
 access.

 (2) The acceptable items of identification are government-issued ID,
 school-issued ID, library-issued ID, or a personal check written to
 Cyberspace Communications Inc. by the person requesting access. To be
 accepted, the item must be currently valid (i.e. not expired), must
 identify the person by name, and must include additional identifying
 information other than a photograph (such as home address,
 passport number, or name of school).

 (3) There shall be one individual, referred to hereafter as "verifier",
 who is responsible for accepting verification requests and ID,
 notifying the appropriate staff member(s) so that access may be
 granted if the criteria of (1) and (2) are met, and notifying the
 requester if the ID is not acceptable.

 (4) The board shall solicit volunteers and appoint the verifier. The
 term of office is one year and is renewable. Any verified user is
 eligible for the post of verifier. If a volunteer for the post is not
 currently verified, then for the purpose of gaining eligibility he or
 she may present identification to the board that meets the criteria
 enumerated in (2).

 (5) In the case of personal checks submitted to the treasurer of
 Cyberspace Communications Inc., the treasurer may also verify a user,
 provided the check meets the criteria of (2) and is accompanied by a
 signed letter as required in (1).

 (6) An individual whose request for verification is denied may
 appeal the decision to the board. The board's ruling on appeals
 is final.

 PASSED: 7-0

I don't think I would accept a library card that didn't have some kind of id
number on it.

response 112 of 118:

Sep 10 12:55 UTC 2002

Yes, if it has an address preprinted on it.

response 114 of 118:

Nov 14 19:46 UTC 2002

Regarding #104; Is this, combined with a PayPal payment, sufficient for
grex?  Or do users still have to submit ID?

response 116 of 118:

Nov 14 20:04 UTC 2002

Not much at all, I'm afraid, other than what was mentioned in 104.  No
one has ever sent me money on PayPal, but I've sent money to other folks.
I do know that they're pretty thorough in validating people; your credit
card billing address really must match what you tell them, as far as I
am aware.  If they really do give address and name information to the
people who receive money, that'd be worth changing policy for, I Think.

response 118 of 118:

Apr 21 15:18 UTC 2003

If it's a 'verified' address, it means that they've checked it against
either the credit card records or the bank account records.