Justice Ministry Warns Over Publishing ID Numbers on Websites

New guidelines forbid unnecessary collection of personal ID numbers after attacks by anti-Israel hackers.

The Justice Ministry on Sunday released guidelines forbidding unnecessary collection of personal national identification numbers. The Law, Information and Technology Authority, a subsidiary of the Justice Ministry, decided to release the stricter guidelines as a result of attacks by a Saudi hacker and other anti-Israeli hackers. The document was posted on the Justice Ministry website to enable public feedback.

There have been numerous recent attacks against Israeli websites. As a result of these attacks, hackers posted credit card numbers, ID numbers and many other details of Israeli citizens on the Internet. In addition, other websites were crashed by hackers, including the websites for the Tel Aviv Stock Exchange, El Al, Ynet and Haaretz. In response, Israeli hackers attacked websites based in Arab countries and Iran, and exposed details of citizens of those nations.

"These incidents occurred because database owners collected personal ID numbers, apparently without need, creating a danger of exposure and damage to consumer privacy," read the Justice Ministry statement.

The new guidelines require that database owners inform those using their services whether they are legally obligated to reveal their ID number. They will now be required to explain to users what exactly requires the use of an ID number. Also, it will now be necessary to inform users as to who exactly will receive their personal information, and for what purposes. The Justice Ministry suggests that databases begin to use appropriate substitutes such as "customer ID numbers."

The guidelines emphasize that "a database has no right to use the information for any purpose other than the needs of the person in question, and in accordance with any agreements made."

The guidelines focus on requirements for safeguarding the information held within databases. Also, according to the new procedures, any database unnecessarily holding ID numbers will be required to convert them to "customer ID numbers."