It appears that a company is now selling a tool that will allow high resolution tracking of the motion of customers through stores and malls by triangulating on their cell phones. The technique involves tracking the phone through its globally unique IMEI number. The company claims that this is anonymous because only the phone company knows the correspondence between the IMEI and the customer’s real name.I have very little faith in that protection. There are simply too many ways one might extract that kind of information, which could then become widely available. One could even connect the location information and IMEI data to checkout records. After a couple of trips, it would be fairly unambiguous. This is certainly clever, but disturbing. There is no opt-in or opt-out, and the tracking takes place passively with no ability for the user to detect that it is going on.Shops track customers via mobile phone – Times Online

Fledgling Rebellion on Facebook Is Struck Down by Force in Egypt – washingtonpost.com  For a short time Facebook became the center of a fledgling activist movement in Egypt. Over 74,000 people registered on a Facebook page devoted to this issue. It became the primary communications path for this group, and enabled its explosive growth. It also contained the seeds of its rapid unwinding and the arrest and beating of the creator of that page.To me this is yet another example of the “On the Internet nobody knows you’re a dog” syndrome. People feel so comfortable in front of their computers, they will say and do things they would fear to do in public or face to face. Facebook is in no way anonymous, nor does it claim to be. While there are many tools that could have enabled these people to operate and organize anonymously, there is no evidence that they used any of them.The Internet is very powerful, but it is also very public. People wishing to use it in repressive countries need to take special care to protect themselves and their visitors. 

I encourage everyone to read this article by Declan McCullagh: Q&A with Charter VP: Your Web activity, logged and loadedThe gist is that Charter Communications, the third largest cable operator in the US, is testing a system to capture the URLs you visit when you browse the web, then provide that information to advertising networks through a third party company, NebuAd. They claim this information is “anonymized”, but I can’t really see how that is possible. If a company wants to target car ads at people who visit many car websites, then the advertiser must know that you have done so when you are shown the ad. Since they have your IP address, they know who you are (or at least have personally identifiable information).While the advertiser may not get the actual web logs, this is a huge amount of information, and I am sure more could be gathered by a clever and systematic set of advertising targets. For each narrow target, capture information on which users match the target criteria when there is an opportunity to show them an ad.The obvious solution is to prevent the ISP from gathering this information in the first place. Any kind of encrypted tunnel, like those provided by the various Anonymizer solutions, will prevent this kind of commercial espionage on their users.

This article discusses the risk from “deep packet inspection” by ISPs. The article states that at least 100,000 people in the US are being tracked with this technology right now. If true, the impact of this could be huge. Whereas a website can only track you when you are actually visiting that site, your ISP can see all of your activity on any website or other service you use. The idea is that the information collected could be sold to advertisers to better target marketing messages to you. If you had been looking at car sites, you might see more car ads next time you visit an advertising supported website like CNN.com.This is certainly not the realm of science fiction. The Chinese government is already using this technology on a massive scale as part of their national censorship infrastructure. They use it to detect forbidden words and phrases, “Tibet” being at the top of that list right now.Most of us assume that the bad guys are “out there” on the net, and assume that our ISPs are basically just passing our traffic along without looking at it. If they start this kind of inspection, it opens all kinds of additional risks. Once the equipment is there, a rogue sysadmin could tune it to watch for passwords, personal information, bank information, etc. It opens a whole new set of vulnerabilities.Anonymizer’s Total Net Shield, and Private Surfing (with full time SSL enabled) provide significant protection against this threat. Both allow you to tunnel your traffic to Anonymizer without the ISP being able to inspect it, other than to see that it is going to Anonymizer.It is shocking to me that this kind of thing should be possible without explicit user consent. Maybe we need a “truth in labeling” law for Internet service providers.  A bottle of Napa Merlot can not be so labeled unless it is from Napa and made from merlot grapes. Similarly, it should not be called an “Internet Connection” if you can’t go everywhere (some ISPs are restricting certain perfectly legal protocols). If the ISP is going to spy on you, it should be in big red letters. Maybe I am OK with that, but I certainly have a right to know in advance.

Security guide to customs-proofing your laptop | The Iconoclast – politics, law, and technology – CNET News.comDeclan writes a witty and informative piece on securing a laptop against legals searches without cause at border crossings. 

Yahoo and MSN helping to root out Tibetan rioters | The ObserversYahoo China posted pictures of “most wanted” Tibetan protestors on Yahoo! China’s home page. Cooperation with lawful process in a repressive country is bad enough, here they are actively collaborating. Yahoo!’s claim that this was done by Yahoo! China, not by the Yahoo! mother-ship, seems disingenuous at best.Active support of censorship and oppression is clearly unethical. If this is not clearly on the wrong side of the line, then what in the world is?

David Brin Rebuts Schneier In Defense of a Transparent Society Here is David’s own rebuttal to the Schneier article on the Transparent Society I blogged about earlier.

VoIP: Who Might Be Spying on Your Communications? (Hint — It’s Not Just the NSA) – VoIP NewsThis somewhat simplistic article makes the case that one should not consider VoIP to be a secure replacement for land line phones. It too is vulnerable to a number of governmental and criminal interception attacks.

Bruce Schneier’s Security Matters: The Myth of the ‘Transparent Society’This is a nice little article arguing against the idea of Brin’s Transparent Society as a solution to the privacy problem. I suspect David Brin would object to the characterization of his work as presenting it as a panacea, but many do so argue.Bruce argues that the relative power disparity makes for un-equal results in the two direction of observation. From my perspective, the idea of enabling the public to watch the government surveillance apparatus is completely unrealistic. It would enable our enemies (and as a nation the US does have real enemies) to reverse engineer and avoid our surveillance. The best one can realistically hope for is very rigorous oversight (which has also seemed unrealistic of late).At the same time the spread of cameras, facial recognition, RFID, etc., is rapidly increasing the level of surveillance of the general population. The only place where observation and recording by the people seems to be really effective is in issues of corruption or abuse of power. Rodney King being an obvious (and ambiguous) example. 

What Our Top Spy Doesn’t Get: Security and Privacy Aren’t OppositesWow, I don’t know how I missed this one back last month! I wish I had written this essay. The key point is that privacy is not the antithesis of security. Most of the privacy invading “security” solutions we see are what I call “placebo security” and Bruce calls “security theatre” . Things like the “don’t fly list” which appears to catch orders of magnitude more innocents than terrorists, and the national ID card when all the terrorists had legally issued valid ID already.In fact, many measures seriously damage security, like putting personal information in the clear on drivers licenses, including Social Security Numbers in many cases! It is an axiom of security that valuable information will leak and people with access will abuse that access. The more control a government demands, the more  oversight is required. That was my real problem with warrantless wiretapping. Not the wiretapping, but the warrantless. Surveillance of anyone at any time for any reason is the hallmark of a police state. The key is independent oversight. The debate on how that should be done must be open an honest.The security vs. privacy debate seems to me to be built on dishonest assumptions. It tends to be rhetoric and political point scoring on both sides with little discussion of whether the proposed solutions or changes actually improve security, what the real trade off is, and whether that trade is worth while.We are currently being asked to sacrifice enormous amounts of privacy and freedom to confront a threat that is miniscule compared to smoking or drunk driving, threats about which few would make such arguments.