Blown To Bits

Archive for the ‘Surveillance’ Category

The 90,000 Sex Offenders Booted Off Myspace

Saturday, February 7th, 2009 by Harry Lewis
According order generic cream prescription and alcohol to the American College of Obstetricians and Gynecologists (ACOG), OS cheap celexa from uk can reduce the risk of developing ovarian cancer but does buy cialis overnight delivery not entirely eliminate it. This means it uses a specific buy cheap petcam (metacam) oral suspension online part of the flu virus, such as the antigen, to generic cipro generate an immune response. Cancer Research UK suggests that a buy generic atarax cost oral person might also work with an obstetrician, pathologist, and nurse cialis for order specialist. Conjunctivitis is the inflammation of tissue that covers the order colchicine no prescription required front of the eye and the inside of the eyelid. azor online stores They may also order lab tests, such as blood tests, order zoloft to confirm whether a person has uric acid crystals in norvasc without prescription their affected joint. Research suggests that having either condition may buy cheap tetracycline online place a person at higher risk of developing the other buy free estrace prescription condition. People with global aphasia are unable to repeat words buy cialis cheap or sentences and mostly use automatic phrases such as "thank clonidine professional you" and "excuse me." The American Cancer Society (ACS) does not.

I’ve been waiting until I read something intelligent about it before commenting further on the widely publicized story that 90,000 registered sex offenders had been removed from Myspace, mentioned last week on this blog. The Connecticut Attorney General took this big number as proof of what he’s been claiming all along, that social networking sites are a new form of danger to children and need to be regulated and controlled to keep bad people away from unsuspecting, innocent children. The AG’s enthusiasm for trumpeting this statistic is part of a vicious and anti-scientific campaign to discredit the Internet Safety Technical Task Force report (see here and here and here for my earlier comments about this task force and its report). He doesn’t like the facts, so responds by denying them and then erecting a distracting sideshow.

Now danah boyd has done the math and made a few other important observations too. On the math front first: given the number of Myspace members, the density of sex offenders on Myspace is not high; in fact, it’s significantly lower than it is in the general public.

An observation that will surely excite an “even one is too many” response from Blumenthal and his fellow AGs, as though every registered sex offender is pedophile with a record of raping children. Hardly; you can wind up on the sex offender registry for all kinds of reasons, including plea deals in he-said-she-said rape cases involving two college students. (See Chapter 7 of Excellence Without a Soul for the long, sad story of one such case.)

But the most important observation is that mental model of danger is all wrong. It would do far more good to focus on vulnerable children and their Internet behavior than to try to purge the Internet of possible predators. There is a pretty good profile of what kinds of kids get into trouble, and it’s not the sexually innocent 11-year-old children of vigilant parents in suburban America. It’s older and sexually aware kids, kids with troubles, often family troubles, kids who crave affection and attention and explore liaisons in search of something that’s missing in their lives. The sad thing about the AGs’ ranting about Myspace pedophiles is that it distracts attention from the place where child endangerment could actually be addressed — with the children.

Pedophiles on the Internet

Wednesday, February 4th, 2009 by Harry Lewis

Myspace is described as having purged 90,000 registered sex offenders from its site. (Apparently there are 700,000 registered sex offenders nationally.) This has stirred up the controversy surrounding the recent report of the Internet Safety Technical Task Force, which documented that sexual predation, while a real problem, does not generally fit the pattern of an adult stranger pedophile vs. an innocent child. Richard Blumenthal, Connecticut AG, who dismissed the ISTTF report when it was issued, blasted that the MySpace purge “provides compelling proof that social networking sites remain rife with sexual predators.”

For a more nuanced and candid discussion of the ISTTF report, watch the video of the presentation at the Berkman Center yesterday by danah boyd, John Palfrey, Dean Sacco, and Laura DeBonis, who worked on the report. The Q+A with a sympathetic child safety advocate is quite interesting. For whatever reason, American society wants to identify the child safety problem with the scary stuff that is shown on Dateline; it’s actually much closer to home.

Not Watching, but Weird Anyway

Saturday, January 31st, 2009 by Harry Lewis

I went to the local Stop and Shop to buy groceries this morning, passing on the opportunity to use the hand-held scanner about which I’ve blogged already. Preserving my privacy, remember? When I got to the checkout I was happy to find an open line with both a cashier and a bagger. As I always do, I asked the cashier to use his card — in Massachusetts, supermarkets are required to give you the “loyalty card” price if you ask for it. He acknowledged my request and scanned the groceries. I paid my $57.17 by credit card. As I was starting to wheel my cart away, I checked the register tape and discover that nothing had been discounted. (Why is it that they make you verify the total and complete the transaction BEFORE showing you their account of what you’re buying?)

I complained, and the cashier was surprised and apologetic — plainly he’d just neglected to do it. (When I made my request, though he did hear it, he was in the middle of a conversation with the bagger about whether McDonald’s might have been the source of his indigestion.) By now he’d already started scanning the next customer’s order.

He directed me to the service desk, staffed by two teenagers. I explained my problem, and one of them took the register tape, tore something off the bottom, and gave me back the rest. He then scanned or punched something into his computer and handed me $4.41 in cash. It took only a few seconds.

Now what strikes me about this is that the entire record of my purchase was accessible at the service desk. There are many good reasons for retaining those records — to prevent me from “returning” the same purchase multiple times, for example, the record can be updated to show when an item is returned. And of course a great deal of the analytical value of the data doesn’t depend on knowing my identity. But the instant rebate of exactly $4.41 reminds me how disaggregated the scanner data remains — probably forever.

And by the way — in the realm of really, truly watching you in stores — some of those video displays that show ads now have tiny, hidden cameras and enough processing smarts to tell whether you’re black or white, male or female — and to adjust the ads you are shown accordingly!

Net Circumvention Tools are Selling User Data

Monday, January 12th, 2009 by Harry Lewis

Several commercial products make it possible to avoid leaving footprints and fingerprints as you browse the Web. These products are especially valuable in China, where Internet browsing is tracked and many requests are blocked by the “great firewall of China.” FirePhoenix, for example, displays these promises on its home page:

Protect Your Online Activities

FirePhoenix (FP) is a software to protect your privacy and identity when you surf the Internet. It effectively encrypts all your Internet traffic and anonymizes your IP address. In addition, it provides you with unrestricted access to Internet when your Internet connection is filtered, monitored or blocked by your company, your institution, your ISP or your country.

In a remarkable and frightening blog post this morning, Hal Roberts reports that FirePhoenix and two other major circumvention tool companies are selling data on users’ browsing histories. As the example of the release of AOL searches (chapter 2 of Blown to Bits) showed, search histories can often identify the users — and in this case, the users are likely dissidents living under repressive regimes with a history of imprisoning dissidents. Here is the sort of offer Hal points out:

Q: I am interested in more detailed and in-depth visit data. Are they available?
A: Yes, we can generate custom reports that cover different levels of details for your purposes, based on a fee. But data that can be used to identify a specific user are considered confidential and not shared with third parties unless you pass our strict screening test. Please contact us if you have such a need.

Now there is a protocol vulnerable to mistakes in human judgment with potentially tragic consequences.

What Homeland Security Has On You

Thursday, January 8th, 2009 by Harry Lewis

Travel writer Sean O’Neill went to the trouble of getting his Department of Homeland Security file, with records of information collected as a result of his international files. His report is here, and if you click on the image of a page, you can see what his record looks like. DHS redacted some of its internal annotations, and O’Neill has redacted his passport number and the like, but you can see a few interesting details — for example, that the airlines retain, and then pass on to the Feds for inclusion in their database, the IP address from which the reservation was made. Perhaps some help after the fact in tracing his movements and movements of funds if O’Neill does something evil, but a bit creepy for those of us who wonder how useful these dossiers are for preventing anything.

As Bruce Schneier emphasizes in the book I blogged about recently, bad guys almost never get caught at the airport as the result of security screenings. They get identified ahead of time by old-fashioned police work. Whatever is in the dossier that got O’Neill pulled aside for questioning — as has happened to him — the dossier doesn’t reveal it.

The article gives very precise instructions for getting a copy of your own file. Not sure I really want to know what’s in it, but I should!

IPhoto Sports Facial Recognition

Tuesday, January 6th, 2009 by Harry Lewis

I have been saying recently that my nightmare scenario is free, web-based facial recognition software. It would mean that someone could say “this is Harry” (tagging a single photo of me) and then “Please go to Flickr and find other photos in which Harry appears.” Those would include both other photos taken and uploaded by members of my family, and also completely unrelated photos taken by people I don’t even know, who were photographing something else and happened to catch me in the background. Say, someone snapping his own family at a restaurant in San Juan, while I just happened to be dining with my Puerto Rican girlfriend at the next table, when I told my wife I was going to New York on business. Oops!

Well, the new release of Apple’s IPhoto is getting awfully close to making this a reality. It will do tagging in your own album anyway based on face recognition. My nightmare scenario can’t be far behind.

When Should the State Have Your Passwords?

Friday, January 2nd, 2009 by Harry Lewis

A new law in Georgia requires that registered sexual offenders give their usernames and passwords to the state so that authorities can read their email. The objective is to protect children. Is this reasonable?

Perhaps anyone convicted of a sexual crime can be considered to have sacrificed his right to privacy. But the category is actually fairly squishy. Recall the way UK censors labeled a ’70s LP album cover as “child pornography,” and the fact that until yesterday a woman could be arrested in Massachusetts for indecent exposure or lewd conduct — with a requirement that she register as a sexual offender — if she breast-fed her baby in public.

And if sexual offenders are a real risk of using email to harm children, surely corrupt stockbrokers are a risk of using email to scam customers, etc., etc. Why not make a general rule that if anyone is convicted of a crime, the state gets to monitor all their communications?

Is that the direction we want to go in the name of protecting ourselves?

Electronic Gossip

Monday, December 29th, 2008 by Harry Lewis

Bella English has a good piece in the Globe today about JuicyCampus, the gossip site for all manner of cruel and mean-spirited postings about college students. She’s got the story pretty much right — what JuicyCampus is doing is appalling and, under CDA section 230, legal. An interesting detail she notes is that two states’ Attorneys General are investigating JuicyCampus for not enforcing its own rules against fraud. In the aftermath of the Lori Drew conviction, such charges may not be over-reaching.

As the article notes, there are mechanisms for at least trying to identify who posts a message if it’s truly defamatory (which requires showing actual damage, not mere cruelty). It’s onerous to bring a libel charge (thanks to the First Amendment), but I’m a bit surprised it hasn’t been attempted — the article, at least, mentions the possibility but not any actual cases where it’s been done. (Though JuicyCampus has turned over IP addresses in other cases where violent crimes seemed to be in the offing.)

Closure For Jeffrey Berman

Thursday, November 27th, 2008 by Harry Lewis

In Blown to Bits we discuss not just the case of Lori Drew, but the case of Jeffrey Berman, who allegedly groped a girl on public transportation near Boston. Another teenager snapped his picture with a cell phone, it was on the evening news, and he was arrested the next day. I used this case as an example of the good side of digital little-brotherism.

Berman has now copped a plea to keep out of jail, if he behaves himself. (Three years, if he doesn’t.) The Boston Herald reports this story under the wonderful headline, Girl’s pluck, pic put pusillanimous perv in his place.

I have a weird relationship to this case. Ever wonder what happened to that red-headed kid you were in Mrs. Dowd’s kindergarten class with? In my case, he turned into the groper on the T. I hadn’t seen or heard of him in at least 50 years, until I read the original Herald story about the incident and noticed that the Jeffrey Berman who was arrested was exactly my age ‚Ķ. Sounds like a pretty sad situation, and I’m glad he was apprehended.

The Frightening Prosecution of Lori Drew

Monday, November 24th, 2008 by Harry Lewis

Lori Drew is the Missouri woman implicated in the death of Megan Meier, who committed suicide after being jilted on MySpace by the fictitious boy allegedly created by Drew and a teenage accomplice. When we finished Blown to Bits, Drew had not been charged with any crime, because no statute seemed to cover what she had done, horrible though it was. We wondered in the book if she might simply have done something evil but lawful.

Drew is now being tried in California, not Missouri, on federal charges, of violating the Computer Fraud and Abuse Act. Interpreting this law to cover what Drew did is an overreach with scary implications. Let’s look at the language under which she is being charged, section a(2)(c):

whoever … intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains …  information from any protected computer if the conduct involved an interstate or foreign communication …

The government’s position is that by creating a hoax MySpace account, Drew violated this section because MySpace’s computers were in California, across state lines, and she obtained from that computer information about Megan Meier.

Now this is not what Congress had in mind when it wrote this language, and it is not the way it has ever been applied. This is a clause about computer break-ins (“hacking”). The “information” the law is talking about is information stored in the computer. It’s not a law about getting someone to tell you something using email or instant messaging. And the “unauthorized access” is also about breaking in to systems that are protected by passwords, for example, not about violating the terms of service of a service provider such as MySpace by misrepresenting who you are.

I understand the temptation to stretch to find a tool to throw at Lori Drew, but think of how many other situations would be covered if this clause were read that broadly. Fib about your age on a dating site? Jail time. Use Google or set up a Gmail account when you are only 17 years old? Jail time (2.3 of the TOS reads, “You may not use the Services and may not accept the Terms if you are not of legal age to form a binding contract with Google.”) Use different middle initials on different accounts so you can see who’s leaking your name to direct mailers? Jail time.

Would the Feds go after anyone for such minor offenses? If Lori Drew is convicted under this law, they will have carte blanche to do exactly that. That is precisely the point — they don’t really care if Lori Drew created a hoax MySpace account, they want to get her for causing Megan Meier’s death. But they can’t think of a way to do that, so they are turning MySpace hoaxing into a federal crime.

By that standard, if they can’t get you for what you’ve really done, they may settle for jailing you for failing to update your Facebook profile when you change jobs. After all, you agreed to do that when you signed up:

[Y]ou agree to ‚Ķ provide accurate, current and complete information about¬†you as may be prompted by any registration forms on the Site (“Registration¬†Data”) ‚Ķ [and] maintain and promptly update the Registration Data, and any¬†other information you provide to Company, to keep it accurate, current and¬†complete.

(Thanks to the amicus brief by Phil Malone of the Berkman Center, among others, for these hair-raising examples.)

I hope Lori Drew burns in hell, if there is one. But the federal government should not take us all down with her in its zeal to get her punished on earth as well.

: