Filed under: privacy

FBI Wants to Monitor Social Media

The FBI is looking to develop a web application that can monitor social networks, including Facebook and Twitter, in order to gain better real-time intelligence about current or potential future security threats or situations.

This plan was inadvertently revealed by the FBI’s Strategic Information and Operations Center (SOIC) in a market research request for a “Social Media Application.”

The eagle-eyed New Scientist picked up on the request, which aims to “determine the capabilities of the IT industry to provide a social media application.”

Government agencies like the FBI are usually reluctant to openly discuss how social networks are used as an intelligence tool.

In the Request for Information document, the FBI lays out the requirements for the application that it is seeking to build. In the background portion of the document, the SIOC writes:

The FBI has conducted market research and determined that a geospatial alert and analysis mapping application is the best known solution for attaining and disseminating real time open source intelligence and improving the FBI’s overall situational awareness.

We’ve embedded the six-page document below, but here are some of the highlights:

  • Provide an automated search and scrape capability of both social networking sites and open source news sites for breaking events, crisis, and threats that meet the search parameters/keywords defined by FBI SIOC.
  • Ability for user to create, define, and select parameters/key word requirements. Automated search of national news, local news, and social media networks. Examples include but are not limited to Fox News. CNN, MSNBC, Twitter, Facebook, etc.
  • Provide instant notifications of breaking events, incidents, and emerging threats that have been vetted and meet the deÔ¨Åned search parameters.
  • Ability to immediately access geospatial maps with coding in addition to providing critical infrastructural layers. Preferred maps include but are not limited to Google Maps, Google 3D maps, ESRI, and Yahoo Maps.
  • Ability to instantly search and monitor key words and strings in all “publicly available” tweets across the Twitter Site and any other “publicly available” social networking
    sites/forums (i.e. Facebook, MySpace, etc.).

The entire document is worth reading, if only to see the request for a “tweet lingo” dictionary within the app.

Monitoring social media activity isn’t limited to the FBI. Earlier this month, House subcommittee members urged the Department of Homeland Security to more closely monitor social media traffic.

While privacy advocates have bristled at the idea of social media monitoring, the government position is that if information is public, it’s fair game for scraping and monitoring.

The FBI’s RFI specifically targets “publicly available information” — rather than anything users keep private.

What do you think about how government agencies and law enforcement are using social media monitoring tools? Let us know in the comments.


Social Media Application Request for Information



Social Media Application

While Drafting SOPA, the U.S. House Harbors BitTorrent Pirates

In recent weeks we discovered BitTorrent pirates at the RIAA, Sony, Fox, Universal and even law-abiding organizations such as the Department of Homeland Security. By now it should be clear that people are using BitTorrent pretty much everywhere, and not only for lawful downloads. Today we can add the U.S. House of Representatives to that list, the place where lawmakers are drafting the much discussed “Stop Online Piracy Act” (SOPA).

houseYouHaveDownloaded is a treasure trove full of incriminating data on alleged BitTorrent pirates in organizations all across the world.

Unauthorized downloads occur even in the most unexpected of places, from the palace of the French President, via the Church of God, to the RIAA.

Although we don’t plan to go on forever trawling the archives, we felt that there was at least one place that warranted further investigation – the U.S. House of Representatives. Since it’s the birthplace of the pending SOPA bill, we wondered how many of the employees there have engaged in unauthorized copying.

The answer is yet again unambiguous – they pirate a lot.

In total we found more than 800 IP-addresses assigned to the U.S. House of Representatives from where content has been shared on BitTorrent. After a closer inspection it quickly became clear the House isn’t just using it for legitimate downloads either, quite the opposite.

Below we’ll list a few of the 800 hits we found on YouHaveDownloaded, which in turn represent just a fraction of total downloads since the site only tracks a limited percentage of total BitTorrent traffic. Again, this is real and confirmed data that is just as good as the evidence used by the RIAA when they sued tens of thousands of people for file-sharing.

Something that immediately caught our eye are the self-help books that are downloaded in the House. “Crucial Conversations- Tools for Talking When Stakes Are High,” for example, may indeed be of interest to the political elite in the United States. And “How to Answer Hard Interview Questions And Everything Else You Need to Know to Get the Job You Want” may be helpful for those who aspire to higher positions.

house

house

Books tend to be popular in the House because we found quite a few more, including “Do Not Open – An Encyclopedia of the World’s Best-Kept Secrets” and “How Things Work Encyclopedia”. But of course the people at the heart of democracy are also downloading familiar content such as Windows 7, popular TV-shows and movies.

house

house

And there was another category we ran into more than we would have wanted too. It appears that aside from self-help books, House employees are also into adult themed self-help videos. We’ll list one of the least explicit here below, but that’s just the tip of the iceberg.

house

Although the above is interesting, as the House is the place where lawmakers are currently trying to push though SOPA, this revelation might actually help their cause. If even people at the House are “stealing” content, we really need SOPA to counter it, they may say.

The question is though, whether SOPA will be able to break the habits of millions of Americans, as there will always be alternatives available. And even if it manages to put a dent in the current piracy rates, is that really worth it considering the potential damage SOPA can do to the open Internet and legal businesses?

Mobile Carriers Claim Consumer Consent to Carrier IQ Spying

Americans consented to secretly installed software on 150 million mobile phones that logs what apps they use and what websites they visit and who they communicate with, according to mobile-phone makers and carriers.

Sprint, AT&T, HTC and Samsung told Sen. Al Franken (D-Minnesota) Thursday that their end-user licensing agreements — those pages of fine print you sign when you get a new cell phone — authorize them to use Carrier IQ software to monitor app deployment, battery life, phone CPU output and data and cell-site connectivity. The companies’ statements, released by Franken, are a good roadmap to how the companies will fight federal privacy lawsuits already brought by consumers over the secret software.

The companies have deployed the software on handsets for years now. But it had only received mainstream attention last month when a Connecticut researcher publicized its presence on YouTube. The ensuing furor over the video prompted Franken to demand answers.

Franken was none too happy with the ones he got.

“People have a fundamental right to control their private information. After reading the companies’ responses, I’m still concerned that this right is not being respected,” Franken said in a statement. “The average user of any device equipped with Carrier IQ software has no way of knowing that this software is running, what information it is getting, and who it is giving it to — and that’s a problem.”

T-Mobile, which has acknowledged using the software, and Motorola are expected to respond to Franken’s inquiry by Dec. 20. Carrier IQ, founded in Mountain View, California, six years ago, has also spoken to government officials, including the Federal Trade Commission, but maintains no official investigation has commenced.

AT&T, for example, cited its terms-of-service agreement with consumers to Franken. Among other things, the agreement says consumers consent to monitoring to “improve your network and the quality of your wireless experience.”

Samsung, which installs the software at the carriers’ request, told Franken that the carriers are responsible for notifying consumers about it. The phone maker said it does not sell phones installed with Carrier IQ “directly to consumers.”

The software runs hidden from users, who generally can’t find it or uninstall it without very sophisticated knowledge or by switching out the operating system by “rooting” their phone and flashing an alternative operating system. While legal, rooting almost always voids a phone’s warranty.

What data is sent to Carrier IQ and the carriers depends on how much data the telcos want. Some carriers might want the text-message data, for example, only when certain conditions are met, such as when a text doesn’t go through to the intended recipient.

“Sprint does not always know why a call drops or a website will not load, for example. Sprint may not always know why a get message is not delivered timely, or why service is unavailable in a particular area,” Sprint wrote. “To help it better understand these issues, Sprint uses troubleshooting software installed on customers’ devices to report diagnostic and analytics data so it can solve particular problems,” Sprint told Franken.

Sprint, which said Friday it was disabling Carrier IQ from 26 million active devices that carry it, added that its “privacy policy explains that it may use tools and analytics to collect such information.”

Verizon does not employ Carrier IQ.

Some carriers collect the the data on an anonymized basis. That provides them a roadmap to where and when calls are dropped without knowing whose phone was being used. When too many calls are dropped in a certain location, for example, that could mean extra cell towers are needed in that area. The same could be true for when the software detects similar areas of low data connectivity.

But other carriers collect data that lets them drill down to the individual phone, providing customer-service representatives with vast tools to assist complaining customers. For example, a carrier could tell a customer that battery life is poor because a certain app is hogging electricity in the background. The software can be programmed to know when a consumer changed the battery, or how many times a battery charger was used. AT&T’s and Sprint’s letters spell out what data Carrier IQ collects on their behalf.

Here’s a synopsis of what the respondents told Franken:

  • AT&T collects information about the proximate location of your Device in relations to our cell towers and the Global Positioning System (GPS). We use that information, as well as other usage and performance information also obtained from our network and your Device, to provide you with wireless voice and data services, and to maintain and improve your network and the quality of your wireless experience,” AT&T said, (.pdf) citing its terms of service.
  • “Information we collect when we provide you with Services includes when your wireless device is turned on, how your device is functioning, device signal strength, where it is located, what device you are using, what you have purchased with your device, how you are using it, and what sites you visit. And, Sprint’s privacy policy explains that it may use tools and analytics to collect such information,” Sprint wrote (.pdf) Franken, also citing its user agreement.
  • “To the best of HTC’s knowledge the wireless service providers have made their collection activities known via their privacy policies and terms of use. The Federal Trade Commission staff also recognize that consumers ‘reasonably anticipate, and are likely to accept, that an [electronic communication service provider] will monitor the transmission of data for reasons related to providing the [related service], such as to ensure that their service is not interrupted or to detect and block the transmission of computer viruses or malware.’ Accordingly, the FTC calls this type of activity a ‘commonly accepted practice,’” HTC responded. (.pdf)
  • “Because Samsung does not sell any relevant devices directly to consumers, Samsung is not in a position to determine the extent of consumer awareness regarding the nature of the relationship between the carrier and the consumer, including the carriers’ inclusion of Carrier IQ on devices operating on their networks. Samsung understands that the carriers have Terms of Service and/or Privacy Policy agreements that discuss the collection and usage of consumer data, and that those agreements may govern the carriers’ relationships,” Samsung said.

Researcher Trevor Eckhart Outs Creepy, Hidden App Installed On Smartphones (VIDEO)

A security researcher has posted a video detailing hidden software installed on smart phones that logs numerous details about users' activities.

In a 17-minute video posted Monday on YouTube, Trevor Eckhart shows how the software – known as Carrier IQ – logs every text message, Google search and phone number typed on a wide variety of smart phones - including HTC, Blackberry, Nokia and others - and reports them to the mobile phone carrier.

The application, which is labeled on Eckhart’s HTC smartphone as "HTC IQ Agent," also logs the URL of websites searched on the phone, even if the user intends to encrypt that data using a URL that begins with "HTTPS," Eckhart said.

The software always runs when Android operating system is running and users are unable to stop it, Eckhart said in the video.

"Why is this not opt-in and why is it so hard to fully remove?" Eckhart wrote at the end of the video.

In a post about Carrier IQ on his website, Eckhart called the software a "rootkit," a security term for software that runs in the background without a user's knowledge and is commonly used in malicious software.

Eckhart's video is the latest in a series of attacks between him and the company. Earlier this month, Carrier IQ sent a cease and desist letter to Eckhart claiming he violated copyright law by publishing Carrier IQ training manuals online. But after the Electronic Frontier Foundation, a digital rights group, came to Eckhart’s defense, the company backed off its legal threats.

The Electronic Frontier Foundation said the software that Eckhart has publicized "raises substantial privacy concerns" about software that "many consumers don’t know about."

Carrier IQ could not immediately be reached for comment. But the company told Wired.com that its software is used for “gathering information off the handset to understand the mobile-user experience, where phone calls are dropped, where signal quality is poor, why applications crash and battery life.”

On its website, Carrier IQ, founded in 2005, describes itself as "the world's leading provider of Mobile Service Intelligence solutions."

Watch video of Eckhart explaining his findings:

Hackers Leak Facebook Law Enforcement Guidelines

A group of hackers claiming to represent Anonymous’s Antisec movement hijacked two Gmail accounts belonging to a retired California Department of Justice cybercrimes investigator, now a private investigator, and on November 18 published 38,000 private emails and identifying contact information online.

Among the data published by the hackers in a torrent file were two versions of what appears to be Facebook’s guidelines for law enforcement agencies, according to Public Intelligence, a collaborative research website dedicated to the freedom of information.

Specifically, the documents posted by the hackers and made available on the Public Intelligence website are two different versions of instructions on how agencies should submit subpoenas and requests for user data from the world’s largest social network, one of them dated 2010 and the other, shorter document dated November 2006.

Sources close to Facebook told TPM that the newly revealed guideline documents are “outdated,” and that an updated set of law enforcement guidelines is scheduled be made publicly available to all users on Facebook’s Help Center late Wednesday.

The 2006 document notes that Facebook will not provide any user data without “a valid subpoena or warrant,” while the 2010 document states that the social network requires “a valid subpoena or a legal document with equivalent authority issued through your local court system.”

Federal warrant rulings permitting law enforcement agencies to obtain Facebook data have surged in recent years, Reuters reported, with federal judges granting over 24 warrants since 2008.

The newly revealed 2010 document expressly discourages law enforcement officers from creating phony accounts, even for undercover investigations: “We encourage you to report false accounts to Facebook, and discourage any use of false accounts by law enforcement,” the document states.

Both the 2010 and 2006 documents explain how agencies need to first locate a Facebook user’s or group’s unique ID number, which is easily seen in the URL after the letters “id” or “gid.”

The documents state that a law enforcement agency must submit this information to Facebook in order to retrieve information about the account in question. According to the documents, Facebook can then provide agencies with “basic subscription information (BSI)” which includes a user’s email address, mobile phone number (if provided by the user in their Facebook account), the date and time their account was created, and the most recent login times.

The 2006 document states that Facebook can provide a user’s “Neoprint,” which is described as an “expanded view” of a profile, including “all wall postings and messages to and from the user that have not been deleted by the user.” Facebook can, according to the document, also provide “a compilation” of all of a user’s photos and all of a user’s contact information that’s been uploaded, even if it doesn’t appear in their publicly viewable profile.

As far as Facebook Groups, the social network can provide a list of all users in the group, contact information and the current status of the group page, the 2006 document states.

Importantly, though, Facebook points out in the 2006 document that it cannot provide any user data that has already been deleted by the user before the time of the request. That’s seemingly at odds with the deleted data that Facebook turned over to an Austrian user upon request, who later filed a list of complaints with the Irish Data Commissioner, which is now auditing the social network. The 2010 document contains no mention of deleted data.

In addition, Facebook can reportedly provide law enforcement agencies with a user’s Internet Protocol (IP) logs, including the user’s unique IP address, the Facebook usernames associated with that IP address, and the most recent times that IP address viewed Facebook. The 2006 document states that Facebook “generally” retains IP logs for the past 30 days.

Finally, the documents state that the “Facebook Security Team,” may respond to “special requests” for information not contained in the above provisions, as well as provide “emergency disclosures.”

The 2010 document contains a notice that Facebook will immediately disable all user accounts that have been accused of illegal activity, although law enforcement agencies can stop the network from doing this in their request, at least temporarily, by writing “DO NOT DISABLE UNTIL [DATE],” and filling out a corresponding date. This provision is to allow agencies the freedom to continue pursuing an investigation that would otherwise be hindered by shuttering the Facebook account(s).

As Public Intelligence notes, these are actually just the fifth and sixth versions of documents purporting to be the “Facebook Law Enforcement Guidelines” going back to 2007.

Facebook declined to confirm authenticity of any of the prior versions of the documents to Reuters, but the documents contain valid Facebook email and mailing addresses, and the 2010 document contains a Facebook copyright notice.

In addition, the Electronic Frontier Foundation, an advocacy group dedicated to protecting users’ digital rights, obtained several copies of the Facebook guidelines from the Justice Department. The EFF commended Facebook for taking a zero-tolerance approach to enforcing its “no fake accounts” policy, even against law enforcement.

That said, the EFF has also pointed out how a November 10 court ruling ordering Twitter to hand over user information to the Justice Department without a warrant or subpoena could also apply to Facebook.

And the Obama Administration was this year supposed to submit to lawmakers a bill that would allow federal law enforcement agencies the ability to use “back doors” to observe all online communications under wiretap orders, even encrypted communications, according to a New York Times report in October 2010. That legislation has yet to be introduced.

OnStar Spying On Customers’ GPS Location For Profit

by Jonathan Zdziarski

I canceled the OnStar subscription on my new GMC vehicle today after receiving an email from the company about their new terms and conditions. While most people, I imagine, would hit the delete button when receiving something as exciting as new terms and conditions, being the nerd sort, I decided to have a personal drooling session and read it instead. I’m glad I did. OnStar’s latest T&C has some very unsettling updates to it, which include the ability to sell your personal GPS location information, speed, safety belt usage, and other information to third parties, including law enforcement. To add insult to a slap in the face, the company insists they will continue collecting and selling this personal information even after you cancel your service, unless you specifically shut down the data connection to the vehicle after canceling.

 

The complete update can be found here. Not surprisingly, I even had to scrub the link as it included my vehicle’s VIN number, to tell OnStar just what customers were actually reading the new terms and conditions.

The first section explains the information that’s collected from the vehicle. No big deal. Sounds rather innocuous and boring. I imagine most people probably drool out and close the window by the time they get this far. Your contact information, billing information, etc. is collected. Nobody cares about tire pressure and crash information being collected – after all, that’s what OnStar is there for. Toward the end, you’ll read about how GPS data is collected, including vehicle speed and seat belt status. Again, in an emergency, this is very useful and most customers want an emergency services business to collect this information - when necessary. And the old 2010 terms and conditions only allowed OnStar to collect this information for legitimate purposes, such as recovering a stolen vehicle, or when needed to provide other OnStar services to customers on demand. As you scroll down the list of information collected, you see that once you get past important emergency services(what we pay OnStar for), OnStar now has given themselves the right to also use this information to stuff their pockets. OnStar has granted themselves the right to collect this information “for any purpose, at any time, provided that following collection of such location and speed information identifiable to your Vehicle, it is shared only on an anonymized basis.” – This provides carte blanche authority for OnStar to now track and collect information about your current GPS position and speed any time and anywhere, instead of only in the rare, limited circumstances the old contract outlined.

Anonymized GPS data? There’s no such thing! We’ve all seen this before – anonymized searches, for example, that were not-so-quite anonymized. But in this case, it’s impossible to anonymize GPS data! If your vehicle is consistently parked at your home, driving down your driveway, or taking a left or right turn onto your street, its pretty obvious that this is where you live! It’s like trying to say that someone’s Google Map lookup from their home is “anonymized” because it doesn’t have their name on it. It still shows where they live! What’s unique even more-so to OnStar is that the data they claim they sell as part of their business model is useless unless it’s specific; that is, not diluted to the nearest 10 mile radius, etc. This combination of analytics, and their prospective customers (law enforcement, marketers, etc) requires the data be disturbingly precise. Anyone armed with Google can easily do a phone book or public records search to find the name and address that resides at any given GPS coordinate.

So the GPS location of your vehicle and your vehicle’s speed are likely going to be collected by OnStar and sold to third parties. What kind of companies are interested in this data? OnStar would have you believe that respectable agencies, like departments of transportation and  various law enforcement agencies (for purposes of “public safety or traffic services” – A.K.A ticket writing). I can imagine this data COULD be used for good, to create traffic based analytics to improve future road construction or even emergency response. But given that those types of decisions are only made once a decade in most cities, OnStar isn’t likely to benefit much financially from “respectable” companies.

What is more profitable to OnStar that your personal GPS data could be used for? Hmm, well how about the obvious – tracking you and your vehicle. It would be extremely profitable to be able to identify all vehicles within OnStar’s network that frequently speed, and provide law enforcement “traffic services” the ability to trace them back to their homes or businesses, as well as tell them where to set up speed traps. Or perhaps insurance companies who want to check and make sure you’re wearing your seat belt, or automatically give you rate increases if you speed, even if you’re never in an accident? How about identifying all individuals who shop at certain stores, and using that to determine whose back yard to put the next God-awful Wal-Mart store? How about employers who purchase these records from these third parties to see where their employees (or prospective employees) travel to (and how fast), sleaze bag lawyers who want to subpoena these records to use against you if you’re ever sued, government agencies who want to monitor you, marketing firms who want to spam you, and a long list of other not-so-squeaky-clean people who use (and abuse) existing online, credit card, financial, credit, and other analytics to destroy our privacy?

Add to this OnStar’s use policy of your personal information – the stuff that does identify who you are and ties it to your GPS records. While I have no problem using my personal information in events of an emergency, OnStar also uses my information to “allow us, and our affiliates, your Vehicle Maker, and Vehicle dealers, to offer you new or additional products or services; and for other purposes“. So not only is OnStar going to sell my vehicle’s GPS location data to a number of third parties, but they’re also going to use it and my personal information for marketing purposes. Imagine your personal data being sold to any number of their “affiliates”, and a few months later, you start to receive targeted, location-specific advertising based on where you’ve traveled. Go to Weight Watchers every week? Expect an increase in the amount of weight loss advertising phone calls. Go to the bar frequently? Anticipate a number of sleazy liquor ads to show up in your mailbox. Sneak out to Victoria Secret for something special for your lover? You might soon be inundated with adult advertising in your mailbox.

OnStar’s new T&C continues, explaining that part of the company may at some point be sold, and all of your information with it. It sounds as though OnStar is poising part of their analytics department to be purchased by a large data warehousing company, such as a Google, or perhaps even an Apple. Do you trust such companies with unfettered access to the entire GPS history of your vehicle?

This is too shady, especially for a company that you’re supposed to trust your family to. My vehicle’s location is my life, it’s where I go on a daily basis. It’s private. It’s mine. I shouldn’t have to have a company like OnStar steal my personal and private life just to purchase an emergency response service. Taking my private life and selling it to third party advertisers, law enforcement, and God knows who else is morally inept. Shame on you, OnStar. You disgust me.

To make matters even more insulting, it was difficult to ensure the data connection was shut down after canceling. I still have no guarantee OnStar did what they were supposed to. I had to request the data connection be shut down repeatedly, after the OnStar rep attempted to leave it on and ignore my requests.

When will our congress pass legislation that stops the American people’s privacy from being raped by large data warehousing interests? Companies like OnStar, Google, Apple, and the other large abusive data warehousing companies desperately need to be investigated.

These terms don’t go into effect until December 2011, and it takes up to 10 days to have the account fully cancel, and another 14 days for the data connection to be shut down… so if you want to get out of these new terms and conditions, you’ll need to do it soon.

 

Update:

Since writing this article, OnStar has reportedly told a few individuals that the contract requires them to obtain the customer’s consent in order to provide this information to anyone. Not true. In fact, the only mention of the word consent in their updated T&C is below:

We will comply with all laws regarding notifying you and obtaining your consent before we collect, use or share information about you or your Vehicle in any other way than has been described in this privacy statement. 

Two points to make: first, this clause only applies to collecting and sharing information in any way that is not described in the privacy statement. All of the nefarious uses for your personal data are, quite clearly, described in the privacy statement, and so no consent would be required. Secondly, this paragraph makes it clear that they will only comply with all laws requiring consent, not that they will actually obtain your consent. I’m not a lawyer, but as far as I know, there are no such laws on the books in most (if not all) states that protect the consumer from having their private information shared or sold to third parties, especially when such sharing is disclosed in a contract. In other words, the above paragraph seems to do nothing to require OnStar to obtain your consent to do any of this – and it’s my firm belief that OnStar’s only real interest is in OnStar. If you doubt this, the older version of the terms and conditions had two more consent clauses that are no longer part of the new terms and conditions.

Old Consent Clauses – Now Removed:

In General, we do not share your personal information with third-party marketers, unless we have asked for and obtained your explicit consent.

Of course, we will notify you, and where required, ask for your prior consent if our collection, use, or disclosure of your personal information materially changes.

What You Need to Know About the Web’s Latest Tracking Device

Recently, online properties like Hulu, MSN and Flixster have been caught using a tougher version of the common cookie. These “supercookies” (aka “Flash cookies” and “zombie cookies”) serve the same purpose as regular cookies by tracking user preferences and browsing histories. Unlike their popular cousins, however, this breed is difficult to detect and subsequently remove. These cookies secretly collect user data beyond the limitations of common industry practice, and thus raise serious privacy concerns.

Supercookies are similar to the standard browser cookies most folks are familiar with, but are stored in different locations on a user’s machine, for example, in a file used by a plug-in (Flash is the most common). This makes them harder to find and delete, especially since a browser’s built-in cookie detection process won’t remove them either. Furthermore, some supercookies have additional capabilities, like regenerating regular cookies to prevent their removal by the user.

To make matters worse, removing master supercookies is much more difficult. It requires the user to dig through the file system and delete them manually, an inconvenient task even for advanced users. The novice, on the other hand, likely won’t even realize supercookies exist, let alone be able to find them.

 

 

 

The kind of data supercookies track isn’t typical cookie material. A browser limits the typical cookie to be written, read and ultimately removed by the site that created it. The supercookie, on the other hand, operates outside of established safeguards. It can track and record user behavior across multiple sites. While it’s easy to understand that a site would want to track a user’s activity while she navigates its turf, it’s ethically questionable that site operators are able to record a user’s actions beyond site parameters.

In several cases, a company’s supercookie is the result its partnership with a digital marketing firm that places a high value on user behavior. In response to FTC pressure, the Internet ad and marketing industry responded by publishing “self-regulatory” policies, although it restricts itself from little else than a user’s medical records.

To the majority of the public, this type Internet tracking is outside of the bounds of acceptable conduct. While the “right to track” may be written into a terms of use or user agreement contract, it is often not fully disclosed or within the realm of industry standards, rendering its legal defense moot. Furthermore, tracking provokes a breach of trust between user and site — and consumers have historically exhibited intolerance to brand betrayal.

While many companies that had been challenged on their use of supercookies were quick to cease, some choose to continue the practice. Many web marketing firms, advertisers and less-than-scrupulous websites still refuse to follow industry best practices — they continue to practice knowingly. And many more sites don’t even realize they’re utilizing supercookies in the first place.

Whether it has decided to cease web tracking or not, the company at risk needs to beware of losing control of already collected data. A data breach would result in catastrophic — and perhaps incurable — brand distrust. A user’s discovery of a company’s surreptitious data collection and the subsequent vulnerability of that data could easily spell the end of a brand’s reputation.

Companies that care about reputation and user trust should audit their sites and properties to ensure that data collection and the use of supercookies parallel user expectations. This analysis applies to the site, its advertisers and any third party tools or plug-ins. Companies need to ensure that all data collection has been thoroughly disclosed in order to avoid legal liability.

Companies should not wait for a problem to arise before initiating a comprehensive data security overview. A regular screening of all user data and its safeguards is good practice. The cost a company suffers for securing its data and customer trust is small compared to the business and public relations fallouts that would result from a security breach.

A successful company will always make a comprehensive attempt at transparency by handling data responsibly. The use of data tracking tools like supercookies does not rank highly in consumer acceptance, whether its application is technically “legal” or not. Regardless of the manner in which information is collected, know that negligent data handling will not be excused by claims that a company was in the dark about its collection practices. In the eyes of the consumer, the more data collected, the more of an obligation that company has to keep it safe.

via:mashable

How U.S. Spies Will Find You Through Your Pics

Iarpa, the intelligence community's way-out research shop, wants to know where you took that vacation picture over the Fourth of July. It wants to know where you took that snapshot with your friends when you were at that New Year's Eve party. Oh yeah, and if you happen to be a terrorist and you took a photo with some of your buddies while prepping for a raid, the agency definitely wants to know where you took that picture - and it's looking for ideas to help figure it out.

In an announcement for its new "Finder" program, the agency says that it is looking for ways to geolocate (a fancy word for "locate" that implies having coordinates for a place) images by extracting data from the images themselves and using this to make guesses about where they were taken.

More and more digital cameras today don't just take pictures but also capture what is called metadata - often referred to as data about data - that can include everything from when the picture was taken to what kind of camera was used to where the it was taken. This metadata, often stored in a format called EXIF, can be used by different programs to understand different aspects of the image - and also by intelligence analysts to understand different aspects of the user who took it, and the people who are in it. Like who they are, what they are doing, and where and when they did it.

Sounds great! But there are a few small problems.

First, not all images are digital. Those old pictures of your parents that you scanned? No metadata. Also, not all digital image formats support metadata. That BMP file you've got from 1996? No metadata there, either. Next, even if the image format supports metadata, not all digital images are captured with it. Or they are, but they aren't captured with a full set. That picture from your old-model Flip phone? No metadata there, or not enough metadata. Also, many popular websites - for example Facebook - strip EXIF tags. So it's not possible to get the metadata unless you can somehow get access to the source file - which means hacking.

All that means that there are a lot of images out there with no metadata and/or with metadata that you can't get to very easily. But these images might still have visual information within the image, or other clues, that could enable a system - either completely automated or using automated and human processes together - to make a guess about where the image was taken. The best case for intelligence analysts would be a fully automated system. This way they could suck in images from a terrorist website, download them off of captured cameras or cell phones, or scan them from hard copy, and feed all this through the system and get locations of where the images were taken. With more and more images being created in our world every day this automated approach is going to be crucial.

You can already see a little bit of this happening with the new Google Image Search. The new Google Image Search has a "reverse image search" capability that enables you to search for other instances of the same image on the web. In most cases, this is limited to the exact same image. For example, open up Google Image Search into a second browser window and drag in this image:

 

No matches. So is this helicopter flying over Khost Province in Afghanistan or flying over the back side of the Hollywood sign? Hard to tell from the image itself. And if you test out typing both "Khost Province" and "Hollywood" into the search bar, you'll get results that point in both directions. Even for a trained human analyst, this might prove too hard to crack (although the lack of rocket pods on this helicopter makes a good case for this not being an MH-6 Little Bird, which points to Hollywood over Khost).

But for some places that have been photographed over and over again, Google can guess where the image was taken. Drag this into Image Search:

 

If you didn't guess already, or if you're still figuring out Image Search, or if you're impatient, or if you're just lazy, here's a hint: It's the Grand Canyon. Not too hard for Google to guess because so many people have shot it. When it works like this, Google Image Search is almost like a biometrics program for places.

There is also a middle ground where there will probably still be a place for the human, probably with the images that also have some text data associated with them, where skills of not just pattern matching but intuition will be useful.

The caption for this image reads "An Mi-17 helicopter flies to Kabul, coming back from a humanitarian assistance mission in Baharak, Badakhshan province, Afghanistan." If you didn't know it was Afghanistan you might think you were looking at the Sierras, but once you know it's Afghanistan, and Badakshan province, and near Baharak, and taken on a flight from Baharak to Kabul, and you take a look at the big peak in the background and the distinctive runoff pattern in the foothill at the bottom of the frame, a trained analyst might be able to poke around in a 3D visualization program like GoogleEarth and say that the picture was taken around here:

Iarpa will probably look for combinations of both of these approaches, but on an industrial scale. It's a hard problem, but even now we are starting to see the beginnings of the solution even in the commercial world. And you better believe that it's not just spooks who want to know where images were taken. Google, Facebook, Apple and all the other internet and social media giants are probably looking to do the same thing so that they can better understand where their users are and what they are doing there.

So before long your Facebook or Google+ account will be automatically tagging who is in your pictures and where they were taken…

…and spooks might be, too.

 

 

via gizmodo.com

 

HOW TO: Remove yourself from ALL background check websites.

Thanks to LawyerCT for bringing this topic up on /r/technology. She also provided a list of the top sites online that hold data on you.

I decided to go ahead and use this list to collect removal procedures from ALL of these websites and provide direct links or instructions to do so.

The following list was provided as being the "big boys", so if you remove your name from these ones then all the smaller "sites" should fall afterwards.

  • Intelius.com
  • Acxiom.com
  • MyLife.com
  • ZabaSearch.com
  • Spoke.com
  • BeenVerified.com
  • PeekYou.com
  • USSearch.com
  • PeopleFinders.com
  • PeopleLookup.com
  • PeopleSmart.com
  • PrivateEye.com
  • WhitePages.com
  • USA-People-Search.com
  • Spokeo.com
  • PublicRecordsNow.com
  • DOBSearch.com
  • Radaris.com

How to remove yourself from each of these have been listed below. I would recommend that you scan some form of ID such as a state issued ID like a drivers license. Black out your picture and drivers number. Leaving your name, address and DOB visible. Any sites that requires such a thing will have an * after the address.


Intelius.com* - Opt-out

Acxiom.com - Opt-out

MyLife.com - To request that a Member Profile or Public Profile be deleted, please contact Customer Care at 1-888-704-1900 or contact us by email at privacy@mylife.com. Upon receipt of these requests, and confirmation that you are requesting that your own profile be removed, please allow MyLife 10 business days to complete this removal. It may be necessary to contact you to validate that you are the profile owner requesting the removal. This is to ensure the correct identity and profile ownership before completing these requests, and is for the protection of our users and their privacy.

Zabasearch.com* - Opt-out

Spokeo.com - Opt-out

BeenVerified.com - LawyerCT's guide

Peekyou.com - Opt-Out

USSearch.com* - Opt-Out

PeopleFinders.com - Opt-Out: Annoying form you have to mail in

PeopleLookup.com* - In order for PeopleLookup to suppress or opt out your personal information from appearing on our Website, we need to verify your identity. To do this, we require faxed proof of identity. Proof of identity can be a state issued ID card or driver's license. If you are faxing a copy of your driver's license, we require that you cross out the photo and the driver's license number. We only need to see the name, address and date of birth. We will only use this information to process your opt out request. Please fax to 425-974-6194 and allow 4 to 6 weeks to process your request.

PeopleSmart.com - Opt-Out

PrivateEye.com - Opt-Out

Whitepages.com - Opt-Out

USA-People-Search.com - Opt-Out: Yet another form to mail in

Spoke.com - Scroll Down to Access and Correction Section for more info

PublicRecordsNow.com - Still determining how to remove...

DOBSearch.com* - In order for us to “opt out” your public information from being viewable on the public DOBsearch People Finder search results, we need to verify your identity and require faxed proof of identity. Proof of identity can be a state issued ID card or driver's license, or notarized letter. If you are faxing a copy of your driver's license, you may cross out the photo and the driver's license number. We only need to see the name, address and date of birth. Please fax to 516-717-3017 and allow 4 to 6 weeks to completely process your request. It is your responsibility to ensure legibility of your document

Radaris.com - Opt-Out; Thanks to those who figured it out.


Those are all the major sites. Of course, you could go to the topic mentioned in the beginning of this post and find LawyerCT's business in the comments on having a team of professionals remove these for you at a fee.

Does privacy exist in a world of social networks and sharing?


We are the connected generation. Thanks to our ever-present mobile devices we are always ‘on’ and connected. This allows us to capture a record of all the great things we do, and share our experiences, our recommendations and our memorable moments with friends, colleagues and the world at large, through the medium of popular social networks like Facebook, Twitter, and Yelp. We broadcast these moments out to the rest of the world. We let others share in our passions and see the details of our daily lives. We have become the lifeblood of information for our friends and followers, and they have taken on the role of gatekeepers as we filter and pump information from network to network.

As the opportunities to share information have become more ubiquitous, there has been an increasingly hyped-up debate and concern around the topic of privacy. But is privacy really the issue? As Jeff Jarvis rightly points out, the reason for using social services is for sharing, not hiding. Twitter and Instagram are prime examples of this, where the user is forced to choose between sharing everything or limiting their sharing to a personally selected group who apply for the privilege. Nonetheless, the fact is that although many of us want to share, we want to be able to fine-tune our audience. This challenges services like Facebook where you determine sharing settings in advance of your broadcast.

Has the notion of a ‘friend’ become too diluted by the many different definitions of ‘contact’ across social media networks? Path is trying to redefine this by limiting the number of friends you can add to 50, encouraging you to only share with your “real friends.” But then the question is whether this really solves the issue? Do we only want to share with our close social circle, or do we (as I would argue) have things we want to share with other groups of contacts we would not classify as “friends”?

The problem is that there is currently no universal standard for privacy settings. Each social network has implemented their own interpretation as it applies to types of content shared on their platform. As social networks open up their APIs, allowing users to give third parties access to their content, their social media content can become spread across multiple services. Every network defines their privacy and sharing settings differently, so there is significant ambiguity around how these settings translate when transferring content among services. If you try to inherit privacy settings from multiple services the level of complexity that results is enormously challenging both from a development and a user perspective.

No one has solved this problem yet, and it is a highly relevant and important issue that needs to be addressed. We need a platform where you can manage and arrange all your connections into one simple structure, allowing you to easily define the privacy layers for how, and with whom, you share your content online. And this platform needs to integrate all the social networks.

Facebook Connect was a good first attempt at this, but sadly they quickly closed down their API that allowed you to invite your Facebook Friends to join third-party services. Now you can only view and add friends who are already signed up to that service. The continuation of Facebook Connect in its original form would have made Facebook the major organ of social media sharing, pumping content between networks and controlling the flow to new arteries of social circulation. For users, this would have allowed them greater control and continuity of how their content was shared beyond the confines of Facebook’s network.

Until we create a unified theory of sharing across social networks, there will continue to be great concern around the conflicting definitions of individual privacy. Regulators, in their efforts to protect internet users, are already discussing how to create barriers to protect the individual and simultaneously stifle social sharing. What we need is not greater personal protection through legal limitations, but consistency and standards that are recognized across social networks.

This past week the Google+ platform was revealed, ushering in a promising new chapter in the movement towards a universal standard of privacy. Google+’s ‘circles’ interface allows users to easily organize their network of contacts into spheres of association. Their organizational model for privacy takes what Facebook has developed one step further by allowing the user to easily visualize their different spheres of contacts, and determine which group they want to share updates with as the final step in broadcasting content. Wouldn’t it be great if I could link that structure to all of my other social networks? Let’s hope that Google+ hurdles past the point where Facebook Connect retreated from and becomes the new heart of social network sharing.

Posterous theme by Cory Watilo