I think there should be some requirement that data be taggable to meet privacy requirements. We just went through this a few months ago. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)