Bill Ryan's Other Blog

Bruce Schneier covers a Wired story detailing Sprint’s alleged complicity in something that should make your skin crawl.  It’s nothing new, Luna was warning of this stuff since the first draft of How To Be Invisible and several times thereafter.  It may seem that I’m being a tad hypocritical when I say this is a bad thing, after all I find cell phone based snoopware not only cool, but very useful for many folks. Cell phone snoopware is extremely powerful, effective and easily available (and yes, in some cases, legally questionable) so to some extent, it’s silly getting all upset about stuff like this. On the other hand, I don’t have to worry about civillians abusing their power to try to settle  a score with me or make my life miserable.  Without breaking the law, there’s nothing a civillian could do with this sort of stuff to really hurt me [and for the record, I'm using 'me' in the abstract sense here].  Depending on how you spend your free time, someone could ostensibly cause you some embarassment, but there’s plenty of remedies for that sort of thing.

Employees of the various government agencies however, could cause all sorts of problems for people.  For me to effectively make use of snoopware, I’d need to access the phone in most cases and owners would be fully in their power to check for and remove any such snoopware added to their phones.  The same isn’t the case in situations such as the one alleged with Sprint.  If someone bugged my phone and I caught it, I’m entitled to pursue several different legal remedies depending on the circumstances.  If the Sprint story is accurate, the targets weren’t aware of being tracked, couldn’t do anything to detect it and couldn’t do anything to prevent or stop it.

The response from law enforcement types of course is that this is all paranoid nonsense.  If you don’t have anything to hide, you don’t have anything to worry about they’ll typically argue.  And if they never abused their positions and were perfectly honest, that’d be a plausible defense.  Personally, I think most govt agents are decent enough folks and not prone to abusing their positions, but there’s no disputing there are bad apples.  And just one of those bad apples could cause you a bunch of problems.  Whatever you think of the guy otherwise, look at the example of Joe the Plumber. He got on the bad side of some people with access to his personal information and look what happened.  Had those same people been employees of a private corporation, he’d be sitting on quite a lucrative law suit. (And yes, I know Judicial Watch either offered to or actually filed a suit on his behalf – but had it been a private company, he wouldn’t need a high powered advocacy firm to help him out).

Quoting Chris Soghoian, I can’t imagine how this situation will get addressed without government action and well, it’s probably wise to be the under on that one:

Sprint Nextel provided law enforcement agencies with its customers’ (GPS) location information over 8 million times between September 2008 and October 2009. This massive disclosure of sensitive customer information was made possible due to the roll-out by Sprint of a new, special web portal for law enforcement officers.The evidence documenting this surveillance program comes in the form of an audio recording of Sprint’s Manager of Electronic Surveillance, who described it during a panel discussion at a wiretapping and interception industry conference, held in Washington DC in October of 2009.

It is unclear if Federal law enforcement agencies’ extensive collection of geolocation data should have been disclosed to Congress pursuant to a 1999 law that requires the publication of certain surveillance statistics — since the Department of Justice simply ignores the law, and has not provided the legally mandated reports to Congress since 2004.

One thing is for sure, if a private citizen was caught pulling this exact same thing on members of law enforcement or Congress, Congress’ attitude would be just a weee bit less apathetic about responding. 

The other argument I typically hear is a reference to Evan Ratliff.  If you’re unfamiliar with him, here’s the rest of the story in a nutshell. He’s a free-lance writer and blogger.  He took a gig for Wired magazine that entailed disapparing for a month.  He was to try to hide out and anyone that found him would simply need to say the magic word, and they’d be privvy to a $5,000.00 prize. Ratliff gave it a great go, but before long he was caught. 

Following the story, there’s little doubt that people used inside connections in an attept to follow him.  The extent of that is hard to know for sure, but there’s little doubt that people used friends and contacts at various companies to locate him. Those friends almost certainly did things that, well, were out of the bounds of the companies’ rules.  Does anyone really think that you magically become some ethical angel just b/c you work for the government?  Private sector folks bend the rules so you can rest assured govt folks do it too.

Law Enforcement claims this sort of stuff is necessary.  Law and Order types will claim it’s necessary to fight terrorism and similar bad guys.  Seems to me then, that the solution would be kind of simple.  An evidence rule that gave people immunity from anything not specifically relevant to the prosecution of terrorism in the form of throwing out the evidence, would go a long way to mitigate the damage that could be done by rule benders.  Providing EASY to retrieve records for anyone not currently the target of a terrorism investigation would be another.  Creating a ‘paper trail’ of anyone that looked at a person’s information is not hard and not difficult. Granted that doing anything with govt software is infinitely more difficult than it needs to be, implementing such tracking wouldn’t be cheap.  But that line of argument is essentially advocating the rewarding of incompetence.  And even considering the additional expense, there’s certainly at least one or two unnecessary govt programs we could cut to pay for it. (Defunding NPR for instance would work for me). 

If this sort of stuff is really needed for a specific case to prevent some huge atrocity, fair enough. But some fed using this stuff to hassle some guy banging his ex-girlfriend should never be allowed to happen.  I don’t see how anyone can say such a scenario is unlikely.  So if it did happen, the victim should be able to know about it and sue the hell (and have the person fired, not put on some BS administrative leave) out of the person.  

Another possible remedy would be to allow cell phone proivders to offer “opt out” service. (One might argue that this would be extortion, but I don’t see it any different than paying extra for an unlisted telephone #). I missed the official memo when all cell phones became tracking beacons, but it’s something that could be done without.  So say, for $10.00.00 extra a month, T-Mobile (the best cell phone company on Earth) could offer “Secure” service that meant you couldn’t be tracked.  I know all sorts of people, concerned for my safety should I ever find myself stranded a ditch , would have a fit over such a service, but I’m an adult and I’m willing to live with that risk.  After all, I’ve yet to lose a family member or friend (or even know of someone who has) b/c they weren’t able to be tracked by their cell phone.  But I have come across people who’ve gotten on the bad side of a cop (for matters completely unrelated to the law) and been seriously harassed as a result of it.

We’re not able to stop technology from eroding our privacy and even if we were, we wouldn’t want to.  Moreover, this trend isn’t going anywhere but up.  So the solution seems to be minimizing the incentives for abuses.    To Quote Mr Luna – “Governments hide secrets from their citizens, why shouldn’t citizens be able to hide secrets from governments?”

[tags]Digital Privacy, Sprint, Invasion of Privacy, Snooping[/tags]