response 27 of 184:

Sep 4 13:32 UTC 2002

I believe most of the acts quoted in #15 (certainly EPCA) mainly deal
with unauthorized disclosure of information to 3rd parties.  Most of
these acts do not pertain to the legitimate use of information within
one organization (some contain specific language to authorize this), and
certain other kinds of disclosure are also authorized (for instance,
EPCA specifically authorizes (but does not require) disclosure of a
crime that is discovered doing some unrelated business activity, such as
repairing filesystem damage.)  I know of little within these acts that
restricts a companies ability to to either be incredibly nosey, or to
save those facts -- and there are a *lot* of companies in corporate
america that do amazingly gacky things.  I don't think grex is doing
anything particular gacky or unreasonable.  Possibly we could fix many
of these problems by making members sign some sort of membership
agreement, though I can't say I'm all that fond of creating more
paperwork, and personally find membership agreements in themselves kinda
gacky.

response 29 of 184:

Sep 4 13:58 UTC 2002

re #25: I'm not denying the legitimacy of the point.  I acknowledged it 
earlier.  I'm mostly responding to tod's posting and jp2's typically 
hysterical behavior.  

Hmm.  Jamie, if you refuse to become a member, how do you ever expect to 
be elected to the board?

response 31 of 184:

Sep 4 14:49 UTC 2002

I mostly just feel strongly that retaining credit card information is a bad
idea -- it exposes Grex to liability if that information is stolen.  I
realize that's no longer a major concern, since we don't accept credit cards
anymore, but any remaining numbers should probably be stored offline -- on
paper or on removable media.  I'm less concerned about things like names and
addresses, since those are essentially public information anyway.

response 33 of 184:

Sep 4 15:03 UTC 2002

Thats a point i was going to bring up. What about SSN information on the
licenses?

response 35 of 184:

Sep 4 16:01 UTC 2002

Mark, I had thought you received ID information from users just to 
verify they're real people, in order to prevent one person using 
multiple votes.  If that were the case, you could confirm the person 
exists, then destroy the information you'd received other than the 
person's real name, and Grex's requirements would be satisfied.

It turns out Grex has more requirements than I had realized.  Would it 
make sense to just keep verification information for those who want to 
use Grex's Internet services and not for the rest?  You don't need my 
verification information, for example, since I never use Grex's 
outbound Internet services.  I'm just using me as an example.  I don't 
care if you keep any verification information you have about me.

I'm not concerned about this issue at all, other than to make sure the 
treasurer and Grex are not exposed to lawsuits or other repercussions 
if someone gets some personal information they shouldn't.

response 37 of 184:

Sep 4 17:45 UTC 2002

I agree my suggestion complicates things.

response 39 of 184:

Sep 4 18:12 UTC 2002

I tend to agree with Colleen, though as I said before, I will do whatever
the board and the membership direct me to do.  John's suggestion is
implementable, but it would take some work.  Among other things, it would
require people to declare, when they become members, whether they want to
use internet access, which in turn requires that they be confronted with
the technical explanation of what that means (i.e., which protocols anyone
can use and which are reserved for members only).  I'm not inclined toward
things which make it harder to become a member than it already is,
especially when our membership is down from where we'd like it to be.

It would be simpler for me to just store all ID information on paper.  I'd
rather not do that, just because I think it's not very efficient.  A less
drastic action would be to encrypt all ID information on my computer.  I
could probably find a way to do that which wouldn't be too difficult to
deal with, though I would welcome suggestions from people who know more
about security that I for what a good, efficient system would be.

response 43 of 184:

Sep 4 20:45 UTC 2002

No, 'fraid not.  They don't give you a personality transplant when someone
steals your identity.  

response 47 of 184:

Sep 4 21:58 UTC 2002

I think that shifting a smallish amount of the burden to the member is
acceptable; dropping a photocopy of a driver's license or other ID with
an address on it isn't terribly difficult; one is often required to do
so when, e.g., moving and getting a utility turned on (ie, a phone or
similar).  Yeah, one detracts *slightly* from Mark's 3rd ideal, but in
practice, not much.  Grex's treasurer then just has the job of saying,
``yup, this is the address they told me.  Let me copy it down and destroy
my photocopy.''  I think that might increase (perhaps not the best word,
bear with me) Ideal 2, and certainly will enhance Ideal 1.

response 49 of 184:

Sep 5 00:26 UTC 2002

(I think Dan's suggestion as presented in resp:47 is reasonable.  plus, if
it's really necessary to hang on to the specific ID information in its
"original" [to Grex] form, I can't see a reason [aside from Mark's
suggestion of making it easier for expired members to renew] to hang on to
that information once the membership [and grace period] expires.)