Ars editor learns feds have his old IP addresses, full credit card numbers

http://arstechnica.com/tech-policy/2014/07/ars-editor-learns-feds-have-his-old-ip-addresses-full-credit-card-numbers

by sinak • 12 years ago

315 90 12 years ago

dm23• 12 years ago

Does submitting a FOIA request make any of that information public?

Would I have to submit a FOIA request to all agencies to get a comprehensive list of my information?

I personally think that this should be required for private businesses as well. I would like to see all information Google, Amazon, Facebook, LinkedIn, etc has about me, I think I should have the right to know that information too.

greenyoda2• 12 years ago

I seem to remember that companies may be required to show you their data about you under European privacy laws (which are much stricter than in the US). There was a story a while ago of someone submitting such a request to Facebook and getting back a PDF file containing hundreds of pages.

dm23• 12 years ago

VERY interesting...

http://nakedsecurity.sophos.com/2011/11/17/facebook-clenches...

http://bits.blogs.nytimes.com/2013/11/12/in-europe-thousands...

http://www.zdnet.com/blog/facebook/reddit-users-overwhelm-fa...

http://www.geek.com/news/facebook-stores-up-to-800-pages-of-...

We need more of this. People have the right to know. I'm sure much of this data comes from them purchasing it from other sources (companies that go out of business, LexisNexis, other "partners"). Actually I think people should also have the right to request that companies delete this data permanently, but good luck getting that bill passed.

I wonder what if the percentage of people who closed their Facebook account spiked after receiving this information.

I've built data-mining / warehousing systems for companies before, if I didn't do it they would fire me and someone else would build it. Consumer protection and privacy laws are important and lacking, just my opinion of course.

cordite• 12 years ago

I submitted a request and got absolutely nothing, as if a black hole.

I never followed up after 1 or 2 months.

greenyoda2• 12 years ago

Duplicate of: https://news.ycombinator.com/item?id=8057315

josephlord• 12 years ago

Yeah I guess my title or my timing was off, this version got much more interest.

dominotw• 12 years ago

I was taken into a special investigation room at port of entry at Ohare Airport because I happened to live with 2 muslim roommates( both of them had mohammed in their names) for a mere matter of 2 months. I was shocked to find out that they knew where I lived, with whom ( i was not even on the lease) for past 10 years , my complete travel internaries every time I flew, all my credit cards numbers and who knows what else.

I am glad general public is waking up to this finally.

fidotron• 12 years ago

What's funny is the way the government are getting all the benefits of lots of data, but the potential efficiency benefits for end users have a habit of never materialising.

A very simple and obvious example is the administration of taxation, where the government have most of the information already, and the rest is just going through the motions.

The oddest I've seen is the US/Canada air border also improved immeasurably when they laid off loads of Canadian border staff, forcing them to come up with more efficient systems for handling the same number of people with a smaller staff. It's not what you'd call good now, but it's way better.

Ultimately I'd have less objection to the governments keeping data if I saw the benefits from them doing it. As it stands it seems it's just used for their own purposes.

zyxley• 12 years ago

A very simple and obvious example is the administration of taxation, where the government have most of the information already, and the rest is just going through the motions.

IIRC, IRS higher-ups have talked before about wanting to do this (since it would cut down on enforcement/audit costs to just tally up everything in-house and send a bill or refund), but the current laws don't allow them to implement it.

mahranch• 12 years ago

"because I happened to live with 2 muslim roommates"

I just want to play devil's advocate for a moment; You say this nonchalantly, but that's the most important bit of your statement. If one of those two roommates were under investigation or were on some watch-list (for a valid reason or not), you should fully expect the FBI to keep tabs on those who they were living with. That would include you. Now whether they were watching your ex-roommates for a good reason is neither here nor there, but the fact remains that the FBI wouldn't be doing their jobs if they didn't keep tabs on you, someone whom they were living with.

marcusestes• 12 years ago

Yes, but friend: it matters much whether the state's deployment of ethics in the selection of potential suspects are good and just. An individual's ethnic heritage and choice of religion cannot in a free society suffice for just cause in being warrantlessly surveilled. That's what warrant means.

x1798DE• 12 years ago

Now whether they were watching your ex-roommates for a good reason is neither here nor there, but the fact remains that the FBI wouldn't be doing their jobs if they didn't keep tabs on you, someone whom they were living with.

This is patently untrue surveillance state propaganda. The job of law enforcement is not to prevent any crime from ever happening by following around potential criminals or associates of possible criminals. The fact that we're even OK with there being a watchlist at all is a bit disturbing to me.

DominikR• 12 years ago

You can just assume that most muslims in the US are on special watch lists.

tptacek2• 12 years ago

There are millions of Muslims living in the US. If CBP detains citizens merely for living with Muslims, why aren't we flooded with stories like this?

I'm a million percent sure you shouldn't have been detained. I have zero confidence in CBP and even less in our "transportation security" regime. I'm just questioning the specific causality you've invoked.

kevinchen• 12 years ago

We don't know other details about the commenter's file with CBP that could cause them to think he's suspicious.

watwut• 12 years ago

They have limited resources, so it is well possible that only few random people will be hit and willing to talk about it. My understanding is that muslims are watched very closely.

csomar• 12 years ago

Maybe he was living with an actual (or suspect) terrorist member?

ilaksh2• 12 years ago

Clearly this is not a valid system that we can tolerate.

I think that the internet is key to making the most dominant systems irrelevant which will make way for more compositional, less hierarchical, and more open, structures and systems. Theoretically those dominant systems have already demonstrated their irrelevance, we just need to make that a practical reality.

We need alternative internets in order to do that.

A more diverse information infrastructure may be key to providing not only personal privacy but also security.

olefoo2• 12 years ago

I think that the internet is key to making the most dominant systems irrelevant

That has been the rhetoric, but the practical application seems to be centralizing to one or two dominant players in a given market. From an economic perspective the frictionless nature of the internet and the limited attention span of the humans that use it seems to result in one platform outperforming all others and leads in customer acquisition fading slowly if at all.

Having alternate internets might increase the friction enough to encourage diversity; but the end users desire to use the "best" solution for their problems will probably result in these alternate internets being knit together.

In sum. There are forces at work that your solution does not address.

ilaksh2• 12 years ago

What forces and how do you address them?

opendais8• 12 years ago

This is just depressing, honestly. It is pretty clear they just want to collect all of the data "just in case" you might one day become a suspect. :/

Sadly, unless you can convince the electorate to keep kicking people out until things change...nothing will change.

logn2• 12 years ago

This issue is bigger than just voting in new politicians. It's on the order of slavery, women's suffrage, the "trail of tears", prohibition, civil rights in the South, etc. In other words, to reign in surveillance will take enormous will on the part of the people to change deeply rooted systems of government and power that reach far beyond any single politician.

Unfortunately I don't think the people have the will to change this currently because the harm being done is so well hidden, even after Snowden's revelations.

opendais8• 12 years ago

This issue is bigger than just voting in new politicians.

If you kick out enough politicians in a Democracy, you get a completely new majority government. We need to kick out about 55% of Congress.

pdkl95• 12 years ago

It's hard to generate that kind of willpower in most people when you have groups like JTRIG spreading the "anybody that mentions the NSA doing something bad must be a tinfoil-hat-wearing crazy" meme and other methods[1] of breaking up "unrest".

This is why we have freedom of assembly. It is hard to get people to stand up alone in defense of an idea, but when they can see firsthand that there are other people that also want to stand up in defense a lot more people will join in.

I suspect that the primary threat we face is not about arresting unpopular groups or even information based blackmail; the threat we face is one where organization any opposition is next to impossible. You can try and conduct things offline and remind everybody that "loose lips sink ships!", but the predictive power we have discovered in data mining could make any organized opposition fall at the first tiny mistake

[1] https://firstlook.org/theintercept/2014/02/24/jtrig-manipula...

fixermark• 12 years ago

You'll have to start by convincing the electorate that collecting all the data "just in case" is a bad thing. "If you have nothing to hide, you have nothing to fear" is a belief people actually hold about aggregation of private data.

opendais8• 12 years ago

I just wish I knew how to do that.

thibauts• 12 years ago

"just in case" you might one day become a suspect. :/

And as the definition of suspect continues to shift, slowly, you're becoming a target.

opendais8• 12 years ago

Well, yes. That is kind of the point.

ewang1• 12 years ago

I wonder if the government can be fined for violation of PCI. Or perhaps the airline companies for providing it to the gov't in the first place.

adventured• 12 years ago

The airline companies will be immune to such. That's always part of the racket.

iancarroll4• 12 years ago

As I understand it, you will only be fined contractually as part of a card acceptance agreement, so the government can't be charged.

SilasX• 12 years ago

But since the government accepts electronic payment cards ...

majke• 12 years ago

This is the comment I wrote almost a year ago: https://news.ycombinator.com/item?id=6870933

I was not aware the USA has so many information about every single travel. According to this [1] they record everything.

- amtrack

- trains in the EU (including sit numbers)

- bus travel in the EU

- plane travel in the EU on a carrier that doesn't fly to the US

- hotel reservations

- pedestrian border crossing

Everything.

[1] http://hasbrouck.org/articles/Hasbrouck-Cato-2APR2013.pdf

qnaal• 12 years ago

gotta fill those exabytes somehow

http://en.wikipedia.org/wiki/Utah_Data_Center

dan_bk• 12 years ago

I've been told it's so that Jack Bauer from CTU Los Angeles can protect us. But you'll have to routinely let him brake all protocols so he can do his job - it's all for own good.

shitlord• 12 years ago

Man, this last season of 24 was awful IMO. The ending was just so incredibly anticlimactic. My favorite part about it was Belchek - what a badass. All he did was blow up stuff, shoot people, kidnap the president, and make Madonna references. They even let him have the last line of the season!

morsch• 12 years ago

Thanks for the link. He presents solid evidence. The inspection notes from his border crossings on the final pages are particularly chilling.

late2part• 12 years ago

I can't find the actual inspection notes - can you tell me where to find them?

meraku• 12 years ago

Thanks for the link. That's a fascinating read. Being a Muslim man, I've been stopped and questioned by CBP numerous times when entering the US. It's interesting how they they always seem to ask the same types of questions, in a seemingly friendly manner, but always glancing at the screen in front of them and carefully cross checking everything being said. Would be interesting to get a copy of my own file and see all the notes they've written about the minutiae of my life gleaned during these inquisitions.

staunch• 12 years ago

"People don't like to be meddled with. We tell them what to do, what to think, don't run, don't walk. We're in their homes and in their heads and we haven't the right. We're meddlesome." -- River Tam

coldcode• 12 years ago

The article makes it sound like OTAs and airlines are to blame for what goes into a PNR. Note that for decades the PNR was the only record of your requests to buy a ticket, change seats, meals etc. Basically think of it as a database record (in a flat database sort of way). Even in a modern environment the data in SABRE and Amadeus and Travelport (the companies that provide the massive databases for most all airlines in the world) still isn't much better than a PNR. These systems date back to the 60's. What is disturbing that the US Government apparently demanded the entire PNR before the trip. For decades PNR's were routinely deleted soon after the trip happened unless manually extended (to provide for refunds). Apparently HS insisted that the entire PNR be given to them without allowing any kind of scrubbing first. This is what is ridiculous. But people who regard your data as their personal fiefdom could care less about your security or privacy.

vitd• 12 years ago

No, I think he has a legitimate claim that the airlines are putting too much information into the database. His credit card number should not be in the clear in the PNR database. That's just ridiculous.

iancarroll4• 12 years ago

Is this not against PCI at all?

wefarrell• 12 years ago

PCI isn't a law.

iancarroll4• 12 years ago

PCI might not be a law, but you will get large fines from who you process with, sometimes monthly!

http://www.pcistandard.com/pci-standard/card-association-fin...

pbreit2• 12 years ago

Unless edited, did not suggest it was a law. It's a contractual term.

jusben13692• 12 years ago

Feds not feds. Lower case is a totally different and real word. So sloppy.

bequanna• 12 years ago

Does it matter? Given the context, 99.9% of people will infer the correct meaning regardless of the capitalization.

jusben13692• 12 years ago

It's so lazy and presumes all readers are speaking english as their first language.

pbreit2• 12 years ago

The alternative is slightly higher risk of some sort of incident? I think I'd prefer that =my= government not spy on me.

Ars editor learns feds have his old IP addresses, full credit card numbers

Related Stories