December 14, 2015

Privacy Nightmare: Own a Drone? FAA Wants Your Credit Card Number

Oh goodie. The FAA has announced its ultra-rushed plan for a drone registry -- they desperately wanted to get this on the books before Christmas. It's worse than even the most vocal critics had anticipated:

Over the next 60 days, the FAA is requiring that anyone who flies drones outside (other than very small toy drones) must register on a web site (in theory paper-based filing is possible, but the FAA obviously anticipates most registrations to be over the web).

The FAA is also demanding your credit card number before you fly. In fact, they demand $5 via credit card every three years. Forever.

Even though the signup fee is waived for the first 30 days after Dec. 21 this year, the government still requires your credit card number for "verification" purposes. And because, hey, government agencies can never have enough credit card numbers on file.

No need to worry though, right? All that required personal information -- name, physical/mailing address, credit card data, email address, etc. will be in the warm embrace of a "third party contractor" who no doubt will take really good care of it to meet the abysmal security and privacy practices of the federal government.

The black hat hackers are already salivating over this one. Home addresses! Credit cards! "Hey comrade, do they ship Porsches to Moscow?"

Speaking of privacy, the FAA discussion of the privacy practices for this massive new database of personal information can best be described as exceedingly vague. Clearly it will be searchable on demand by various entities. Who exactly? For what purposes? What can they then do with the information obtained? Who the hell knows?

My guess is that illicit credentials for accessing aspects of this database will be floating around the Net faster than you can say "Danger, Will Robinson!"

The FAA admits that "bad actors" -- you know, the "drone terrorists" we keep being warned about or irresponsible drone pilots -- aren't likely to accurately register or to register at all. But hey, $5 and a bundle of personal info from all the honest drone owners every three years is a pretty good haul anyway. And it makes the government look like it's doing something about drone safety when in reality their plan isn't likely to prevent a single drone accident (or attack).

This is government operating in its maximal disingenuous mode -- creating massive new problems instead of presenting realistic proposals for solving genuine existing problems.

But we expected no less.

Oh, there is some good news. The FAA says you don't have to register your Frisbee.

Now isn't that nice?

Be seeing you.

I have consulted to Google, but I am not currently doing so.
My opinions expressed here are mine alone.

Posted by Lauren at December 14, 2015 10:17 AM | Permalink
Twitter: @laurenweinstein
Google+: Lauren Weinstein