Blown To Bits

Archive for the ‘Privacy’ Category

Tracking Your Car in Massachusetts

Tuesday, February 10th, 2009 by Harry Lewis
Because buying cialis online pulsatile tinnitus can have vascular causes that require treatment, it buy generic asacol prescription is important that people seek a diagnosis from a doctor. buy cheap dexamethasone online A doctor may also refer a person to an otolaryngologist pharmacy cialis (a doctor specializing in the ear, nose, throat, neck, and pharmacy glucophage head). SLPs can help autistic people write cover letters, prepare atenolol from canada for an interview, advocate for themselves, and learn how to zofran overnight delivery communicate with their colleagues. While it found no advantages of cialis medicine gabapentin for inpatient (or hospital) treatment, it found benefits associated buy cialis in us with it for outpatient treatment. In addition to treatment, there buy aldactone online are ways to manage osteoarthritis to decrease pain and improve buy free dexamethasone best price jelly quality of life. It is important that a doctor rules discount mirapex out other possible causes of the symptoms, such as myasthenia viagra cheap drug gravis. However, in some cases, they may result from an underlying.

Buried in a story about Governor Patrick’s plans about the Massachusetts gas tax is an interesting detail:

Patrick is also considering a new system that would charge drivers based on the miles they travel. Those trips would be measured by a chip installed in a vehicle inspection sticker.

No more information is provided, and I couldn’t find anything on the Commonwealth’s web site. It sounds vaguely like the Oregon proposal about which I previously blogged, which didn’t make a lot of sense as it was described — a GPS monitor used only to log miles traveled, which would be uploaded at gas stations when you refilled your car. This sounds different, but I don’t even understand the theory here. For a “chip” (an RFID presumably) to be embedded in a “sticker,” it would have to be a passive device, no battery, and could be read only from a distance of a few inches or at most a foot or two — not the active RFIDs like the ones in toll booth transponders. How would such a “chip” be used to track how many miles you’ve driven?

The 90,000 Sex Offenders Booted Off Myspace

Saturday, February 7th, 2009 by Harry Lewis

I’ve been waiting until I read something intelligent about it before commenting further on the widely publicized story that 90,000 registered sex offenders had been removed from Myspace, mentioned last week on this blog. The Connecticut Attorney General took this big number as proof of what he’s been claiming all along, that social networking sites are a new form of danger to children and need to be regulated and controlled to keep bad people away from unsuspecting, innocent children. The AG’s enthusiasm for trumpeting this statistic is part of a vicious and anti-scientific campaign to discredit the Internet Safety Technical Task Force report (see here and here and here for my earlier comments about this task force and its report). He doesn’t like the facts, so responds by denying them and then erecting a distracting sideshow.

Now danah boyd has done the math and made a few other important observations too. On the math front first: given the number of Myspace members, the density of sex offenders on Myspace is not high; in fact, it’s significantly lower than it is in the general public.

An observation that will surely excite an “even one is too many” response from Blumenthal and his fellow AGs, as though every registered sex offender is pedophile with a record of raping children. Hardly; you can wind up on the sex offender registry for all kinds of reasons, including plea deals in he-said-she-said rape cases involving two college students. (See Chapter 7 of Excellence Without a Soul for the long, sad story of one such case.)

But the most important observation is that mental model of danger is all wrong. It would do far more good to focus on vulnerable children and their Internet behavior than to try to purge the Internet of possible predators. There is a pretty good profile of what kinds of kids get into trouble, and it’s not the sexually innocent 11-year-old children of vigilant parents in suburban America. It’s older and sexually aware kids, kids with troubles, often family troubles, kids who crave affection and attention and explore liaisons in search of something that’s missing in their lives. The sad thing about the AGs’ ranting about Myspace pedophiles is that it distracts attention from the place where child endangerment could actually be addressed — with the children.

Not Watching, but Weird Anyway

Saturday, January 31st, 2009 by Harry Lewis

I went to the local Stop and Shop to buy groceries this morning, passing on the opportunity to use the hand-held scanner about which I’ve blogged already. Preserving my privacy, remember? When I got to the checkout I was happy to find an open line with both a cashier and a bagger. As I always do, I asked the cashier to use his card — in Massachusetts, supermarkets are required to give you the “loyalty card” price if you ask for it. He acknowledged my request and scanned the groceries. I paid my $57.17 by credit card. As I was starting to wheel my cart away, I checked the register tape and discover that nothing had been discounted. (Why is it that they make you verify the total and complete the transaction BEFORE showing you their account of what you’re buying?)

I complained, and the cashier was surprised and apologetic — plainly he’d just neglected to do it. (When I made my request, though he did hear it, he was in the middle of a conversation with the bagger about whether McDonald’s might have been the source of his indigestion.) By now he’d already started scanning the next customer’s order.

He directed me to the service desk, staffed by two teenagers. I explained my problem, and one of them took the register tape, tore something off the bottom, and gave me back the rest. He then scanned or punched something into his computer and handed me $4.41 in cash. It took only a few seconds.

Now what strikes me about this is that the entire record of my purchase was accessible at the service desk. There are many good reasons for retaining those records — to prevent me from “returning” the same purchase multiple times, for example, the record can be updated to show when an item is returned. And of course a great deal of the analytical value of the data doesn’t depend on knowing my identity. But the instant rebate of exactly $4.41 reminds me how disaggregated the scanner data remains — probably forever.

And by the way — in the realm of really, truly watching you in stores — some of those video displays that show ads now have tiny, hidden cameras and enough processing smarts to tell whether you’re black or white, male or female — and to adjust the ads you are shown accordingly!

Privacy Pressure through Shareholder Resolutions

Wednesday, January 28th, 2009 by Harry Lewis

A group called the Open Media and Information Companies Initiative is advocating free speech and information privacy through a novel strategy: they are trying to get shareholder resolutions endorsing such principles, and disclosing corporate practices in these areas, put on the docket for shareholder meetings of major communication and media companies. It’s far from clear that this approach will be particularly effective, but it can create public relations pressure for companies to be more open about what they are doing. I wish them luck!

What the Web Knows About You

Tuesday, January 27th, 2009 by Harry Lewis

That’s the title of a terrific piece from ComputerWorld documenting what the journalist found out about himself on the Web and how he found it.¬†Here’s the list:

TITLE: National Correspondent
COMPANY: Computerworld
INFORMATION DISCOVERED ONLINE:

  • Full legal name
  • Date of birth
  • Social Security number
  • Current property addresses
  • Personal phone numbers
  • Business phone numbers
  • Previous addresses and phone numbers dating back to 1975 (except for cell phone numbers)
  • Real estate property deed descriptions and addresses
  • Property tax record from 2004
  • Assessed value of home from 1997
  • Identifying photographs
  • Digital image of signature
  • Mortgage documents (current and previous) and a legal agreement
  • Computerworld affiliation, stories and blog posts
  • Employment history
  • Resume with educational background going back to high school
  • Sex offender status (negative)
  • Affiliations with several nonprofits
  • Editorial award
  • Spouse’s name, age and Social Security number
  • Names of friends and coworkers
  • Names, addresses, phone numbers and first six digits of Social Security numbers for neighbors past and present
  • Parents’ names, address, phone and first five digits of Social Security number
A crucial piece of the search was to find the Social Security Number. Turns out the state of New Hampshire (like many other states) has undertaken to scan in mortgage documents, which have technically been public all along, and make them accessible via the Web. These documents include SSNs. Good grief! There are many handy tools mentioned in this article to speed your snooping. And some tips about how scammers can get more.

Net Circumvention Tools are Selling User Data

Monday, January 12th, 2009 by Harry Lewis

Several commercial products make it possible to avoid leaving footprints and fingerprints as you browse the Web. These products are especially valuable in China, where Internet browsing is tracked and many requests are blocked by the “great firewall of China.” FirePhoenix, for example, displays these promises on its home page:

Protect Your Online Activities

FirePhoenix (FP) is a software to protect your privacy and identity when you surf the Internet. It effectively encrypts all your Internet traffic and anonymizes your IP address. In addition, it provides you with unrestricted access to Internet when your Internet connection is filtered, monitored or blocked by your company, your institution, your ISP or your country.

In a remarkable and frightening blog post this morning, Hal Roberts reports that FirePhoenix and two other major circumvention tool companies are selling data on users’ browsing histories. As the example of the release of AOL searches (chapter 2 of Blown to Bits) showed, search histories can often identify the users — and in this case, the users are likely dissidents living under repressive regimes with a history of imprisoning dissidents. Here is the sort of offer Hal points out:

Q: I am interested in more detailed and in-depth visit data. Are they available?
A: Yes, we can generate custom reports that cover different levels of details for your purposes, based on a fee. But data that can be used to identify a specific user are considered confidential and not shared with third parties unless you pass our strict screening test. Please contact us if you have such a need.

Now there is a protocol vulnerable to mistakes in human judgment with potentially tragic consequences.

What Homeland Security Has On You

Thursday, January 8th, 2009 by Harry Lewis

Travel writer Sean O’Neill went to the trouble of getting his Department of Homeland Security file, with records of information collected as a result of his international files. His report is here, and if you click on the image of a page, you can see what his record looks like. DHS redacted some of its internal annotations, and O’Neill has redacted his passport number and the like, but you can see a few interesting details — for example, that the airlines retain, and then pass on to the Feds for inclusion in their database, the IP address from which the reservation was made. Perhaps some help after the fact in tracing his movements and movements of funds if O’Neill does something evil, but a bit creepy for those of us who wonder how useful these dossiers are for preventing anything.

As Bruce Schneier emphasizes in the book I blogged about recently, bad guys almost never get caught at the airport as the result of security screenings. They get identified ahead of time by old-fashioned police work. Whatever is in the dossier that got O’Neill pulled aside for questioning — as has happened to him — the dossier doesn’t reveal it.

The article gives very precise instructions for getting a copy of your own file. Not sure I really want to know what’s in it, but I should!

Handheld Supermarket Scanners

Saturday, January 3rd, 2009 by Harry Lewis

A few months ago, my local Stop and Shop added three more self-service checkout lines, thereby reducing the number of lines that had supermarket employees doing the scanning and bagging for you. I was annoyed, because I don’t like the self-service lines — not because I need to have someone else do the work for me, but because only in the staffed lines can I avoid the privacy tax without disclosing my identity. In Massachusetts, if you say to the clerk, “Please use your card,” they’ll give you the loyalty card discount. No way to do that at the self-checkout counters.

It wasn’t so bad, because the lines weren’t that bad, and there always seemed to be enough people in the self-service line who didn’t know English words such as “avocado” that they tended to slow down those lines anyway. And those lines have terrible interfaces, because the technology is cobbled together: the monitor for the scanner (where you have to punch in the item numbers for un-bar-coded items such as avocados) is separate from the credit card interface, which is separate from the signature pad, which is separate from the place where the receipt gets printed.

When I went in on New Year’s Day, there was a further innovation: hand-held scanners. You get one by — guess what — scanning your loyalty card and agreeing to several screensful of unreadable terms (which basically say you won’t steal the scanner and you understand that your purchases may be checked before you leave). You grab a supply of bags if you didn’t bring your own. Then you wander the aisles, scanning purchases as you bag them. You can cancel an item if you change your mind.

You can check prices, so if you are alert, you are less likely to be overcharged by mistake. Every so often, a cash register ring tone alerts you to the fact that the handheld scanner is displaying a discount coupon for another item in the neighborhood of one you recently selected.

Of course there is no reason to worry about those loyalty card discounts — you couldn’t have gotten the scanner in the first place without scanning your card, so you get the discount automatically. At the cashier (in either kind of line), you scan a bar code at the console, return the scanner, and pay the bill.

Now they seem to have closed more of the staffed lines, and the few remaining staffed lines seem to be really long. Gentle pressure to stop fighting for my privacy. And, of course, if the Stop and Shop can get me to do the work they used to have to hire people to do, they save money. I had gotten to know one of the baggers, a developmentally challenged woman in her 30s. I didn’t see her on my last trip to the store; I wonder if she now has employment challenges as well.

When Should the State Have Your Passwords?

Friday, January 2nd, 2009 by Harry Lewis

A new law in Georgia requires that registered sexual offenders give their usernames and passwords to the state so that authorities can read their email. The objective is to protect children. Is this reasonable?

Perhaps anyone convicted of a sexual crime can be considered to have sacrificed his right to privacy. But the category is actually fairly squishy. Recall the way UK censors labeled a ’70s LP album cover as “child pornography,” and the fact that until yesterday a woman could be arrested in Massachusetts for indecent exposure or lewd conduct — with a requirement that she register as a sexual offender — if she breast-fed her baby in public.

And if sexual offenders are a real risk of using email to harm children, surely corrupt stockbrokers are a risk of using email to scam customers, etc., etc. Why not make a general rule that if anyone is convicted of a crime, the state gets to monitor all their communications?

Is that the direction we want to go in the name of protecting ourselves?

Oregon Contemplates a Mileage Tax (GPS-enabled)

Tuesday, December 30th, 2008 by Harry Lewis

The Governor of Oregon says his state needs to wake up to the downside of high-efficiency automobile engines. With cars getting more MPG, they won’t use as much gas. You thought that was a good thing? Not if you rely on gas taxes to pay the bills.

So instead the idea is to go to a mileage tax. As explained in a Corvallis newspaper, the system would work like this. Cars would have global positioning systems, which would be used not to track their locations but to log their mileage. At the gas station, the mileage would get uploaded and (during the transition period) you’d get a rebate on the gas tax.¬†Eventually the system would become universal, and automakers would build the GPS into the car.

Supposedly this kludge protects privacy, but of course it doesn’t — the state would know the exact dates, times, and locations of every fill-up. And how long do you think it would take before law enforcement, the insurance industry, or Homeland Security would find it “essential” to collect and upload just a bit more information about vehicular movements?

In any case, why not just have motor vehicle inspection stations report the odometer reading when cars are inspected? In Massachusetts that happens annually, and the odometer reading is one of the data that is taken down. This plan sounds very fishy to me.