Asset Protection BLOG - Mark Nestmann

Yahoo, Verizon: Our Spy Capabilities Would Shock You

Every now and then, ordinary citizens can glimpse the breadth and depth of the surveillance infrastructure erect to monitor us. In the last few days, Americans have had such an opportunity, thanks to privacy researcher Christopher Soghoian, a doctoral student at Indiana University.

On December 1, Soghoian published an audio recording of a presentation to a law enforcement industry conference on surveillance.  The speech was from Paul Taylor, manager of Sprint's electronic surveillance team.  According to Taylor, Sprint provided law enforcement agencies with its customers' (GPS) location information over 8 million times between September 2008 and October 2009.  (Soghoian has now removed the recordings at the insistence of the conference organizers, who claimed he had violated copyright laws by posting them.)

Sprint says the 8 million represents the number of individual "pings" for specific location information, not the number of targeted customers.  According to Sprint, "Each investigation may generate thousands of individual pings to the network as the law enforcement or public safety agency attempts to track or locate an individual."

That may be the case.  But it underscores how pervasive surveillance technology has become.  And also the phenomenon of "surveillance creep:" how technology or law intended for a humanitarian purpose winds up being used to enhance surveillance capabilities.

For instance, the technology that makes possible it possible for police to track you from your cell phone arrived pursuant to the so-called E-911 initiative.  Back in 2003, the Federal Communications Commission justified E-911 as making it easier for emergency crews to respond to 911 calls.  After all, help could arrive more quickly if emergency crews knew where to find the caller, if the caller couldn't provide this information.  Thanks to E-911, you can be tracked whenever your cell phone is on, sometimes within a few feet of your actual location. But it's plain to see from the Sprint admissions how surveillance creep has occurred.

U.S. courts are divided on whether locational surveillance requires a warrant.  And it's just one type of data routinely made available to police.  The government can also obtain customer records from ISPs and telecom providers revealing telephone numbers dialed; text messages, emails and instant messages sent; web pages browsed; and the queries submitted to search engines.  Very few of these inquiries require a warrant. 

But Soghoian was just getting started.  A few months ago, he filed Freedom of Information Act requests with the Department of Justice to find out how much telecom companies and ISPs charge law enforcement agencies to conduct surveillance.  And he definitely struck a nerve.  In letters also posted December 1, the attorney representing Yahoo wrote that should this data be disclosed, it "would be used to 'shame' Yahoo and other companies" and would "shock" their customers. 

Verizon made a different argument.  It claimed that if it made public its law enforcement surveillance pricelist, it would be overrun with requests from ordinary customers to conduct surveillance on their behalf.  "Such calls would stretch limited resources, especially those that are reserved only for law enforcement emergencies” according to Verizon.

But other companies allowed the Justice Department to release at least some of the data Soghoian requested.  Cox Communications, for instance, charges the government US$2,500 to record digits dialed to or from a particular phone, and US$2,000 for each additional 60-day-interval.  Wiretaps cost more: US$3,500 for the first 30 days and $2,500 for each additional 30 days. To get a month's worth of your call detail records costs US$40.

So just how many requests for records do telecoms and ISPs receive each year from police?  Yahoo won't say, but Verizon admits it receives “tens of thousands” of requests annually for customer records and information from law enforcement agencies.  According to Soghoian, only Facebook and AOL have publicly disclosed how many requests they receive for police assistance.  Facebook acknowledges 10-20 daily requests.  AOL says it receives about 1,000 requests monthly.

So, how can you avoid this type of surveillance?  For telephones, your best bet is to use prepaid cell phones purchased anonymously, over the counter, with cash. 

For the Internet, a technology called virtual private networking acts as a middleman between your ISP and the Web sites you surf.  A VPN can also encrypt the data stream between its servers and your PC.  With these countermeasures in place, the only thing your ISP can monitor is the fact that you're online and that you're connected to a VPN. 

There are many VPN services available.  I prefer services that don’t have networks installed in the United States to avoid possible compromise under legislation such as the USA PATRIOT Act.  The service that I use is http://www.cryptohippie.com.  Its only U.S. presence is to authenticate connections to Cryptohippie servers in other countries.  None of Cryptohippie’s servers are in the United States.

Copyright © 2009 by Mark Nestmann

Stupid Facebook Tricks

It's amazing to me what people (particularly Americans) tell complete strangers.  How much money they make.  Where they keep it.  And even what criminal offenses they've committed (or are still committing). 

Social networking sites like Facebook make it even easier to boast about your crimes, or whether you've perjured yourself.  For instance, a few months ago, a woman sued the driver of a vehicle who caused an accident for damages for pain, suffering and loss of enjoyment, along with the driver's insurance company.  In response, the defendants presented photos from the woman's Facebook profile showing her engaged in vigorous outdoor activities, after the accident.  Not surprisingly, the judge threw the case out.

But the stupidest Facebook trick I've heard of came from a 26-year-old fugitive named Maxi Sopo.  A native of Cameroon, Maxi moved to Seattle in 2003.  When selling flowers to bar patrons wouldn't finance his desired lifestyle, he turned to bank fraud.  Federal prosecutors accuse him of obtaining more than US$200,000 in credit from banks and credit unions under false pretenses.

Once Maxi learned the feds were after him, he moved to Cancun, Mexico.  He apparently was having a great time, because according to one Facebook post, he was "JUST HERE TO HAVE FUN PARTEEEEEEE."  Then, Maxi added a former Justice Department official to his list of friends.  The "friend" learned where Maxi lived and passed that information to Mexican police.  In September, police in Cancun arrested Maxi.  Last I heard, he was awaiting extradition back to the United States.

I don't have an account on Facebook or any other social networking service.  I see no reason to build a network of hundreds of even thousands of "friends" that I hardly know.  But I also have no desire to share details of my personal life with anyone online.  And while police can obtain a warrant to examine your Facebook profile, more typically, they simply create a false profile and then invite you to become a friend.  A prospective employer or private investigator can do the same thing to learn more about you.

If you use Facebook or other social networking sites, at the very least take some basic precautions to protect yourself.  Don't post anything even remotely incriminating, and set the privacy levels at the highest settings possible to restrict information sharing.  In addition, follow the suggestions I made a few months ago in an earlier blog posting here.

The bottom line: before you hit the "post" button, be absolutely certain that whatever you're about to send onto a social networking site belongs there.

Copyright © 2009 by Mark Nestmann

The Garage Sale Police are Coming!

Do you anticipate that your next garage sale will bring in at least US$100,000?  If you don't think your children's old toys and collection of obsolete electronics is worth at least that amount, you might want to take these items to a toxic waste dump instead of selling them. 

Our friends at the Consumer Product Safety Commission (CFTC) recently informed thrift stores that it's now illegal to sell used products that have been recalled or don't otherwise comply with government safety standards.  The penalty is up to US$100,000 per violation and up to $15 million for a related series of infractions.  But the CFTC regulations don't just apply to retail stores.  They also apply to anyone selling used goods—flea markets, charities, even garage sales. 

To find out if your next garage sale might result in a US$100,000 fine, the CFTC has helpfully published a "Handbook for Resale Stores and Product Resellers." After reading the long list of banned products, you might want to reconsider that garage sale.  But, if you're still determined to have it, you'll want to begin by disassembling every item you want to sell and testing each part for the various hazardous chemicals that the CFTC rules ban in resold goods. 

For instance, here's what the CFTC says you'll need to test for "phthalates," a class of now-prohibited chemicals.  Many types of plastic toys contain phthalates.

1. Tetrahydrofuran (C₄H₈O, THF), GC grade or higher
2. Hexane (C₆H₁₂), GC grade or higher
3. Cyclohexane (C₆H₁₂), GC grade or higher
4. Sealable glass vials with PTFE or silicone liner. Size 20 ml or larger
5. Cryogenic-mill (or suitable alternative to grind samples to powder)
6. 0.45 μm PTFE filters
7. Gas Chromatograph-Mass Spectrometer (GC-MS) with an auto-sampler, split/splitless inlet, programmable GC oven, and capable of selective ion monitoring
8. CRMs containing phthalates (such as NIST SRM 3074)
9. Benzyl Benzoate (C₁₄H₁₂O₂, BB), Analytical grade
10. Dibutyl Phthalate (C₁₆H₂₂O₄, DBP), CAS No. 84-74-2. Analytical grade
11. Di-(2-ethylhexyl) phthalate (C₂₄H₃₈O₄ , DEHP), CAS No. 117-81-7. Analytical grade or higher

Got that?  I don't know about you, but I've got several Gas Chromatograph-Mass Spectrometers (GC-MSs) lying around the house.  Not to mention a cryogenic mill or two.  Guess I just have to fire them up next time I want to have a garage sale.

You might be wondering how these regulations came into being.  As usual, you can blame Congress.  In 2008, Congress enacted the Consumer Product Safety Improvement Act of 2008 (CPSIA).  You may remember the brouhaha that erupted in 2007 over imported toys—primarily from China—that contained lead and other toxic substances.  The CPSIA was the congressional reaction.  Thanks, guys!  Nothing like overkill.

The CFTC, in a rare display of candor, states in its "Handbook" that. "The implementation of the CPSIA will have dramatic changes for the marketplace."  You can say that again!

To enforce the law, I suggest that the next Wall Street bailout package Congress enacts include a provision to send every family in the United States a GC-MS, just in case they don't have one sitting on the dining room table.  Of course, since you need to be conversant in chemistry to use one, the bailout should include a voucher for a chemistry class at a local community college. 

A cheap GC-MS costs about US$50,000, but since the government will be making a bulk purchase, it should be possible to get the costs down to, say, US$30,000 each, including the cost of a chemistry class. Total cost for 100 million households?  About US$3 trillion.

Now, before you criticize the cost, consider that if this initiative saves just one child's life, it will be worth every penny.  Plus, it will stimulate the economy, not to mention keeping garage sales CFTC compliant.  And, the money won't be going to fat-cat executives on Wall Street. Sure, there might be small safety problems--Tetrahydrofuran tends to explode, for instance--but hey, the CFTC can just issue some more rules, right?

That's a win-win situation all around.  Congress, are you listening?

Copyright © 2009 by Mark Nestmann

Warrantless Laptop Searches at U.S. Borders to Continue

Nearly three years ago, I warned you about the possible consequences of carrying a laptop computer across a U.S. border.  Basically, U.S. courts have said that Customs can confiscate your laptop, make an "image" of the hard disk and all the data on it, and use that data against you in a criminal proceeding—all without probable cause that you've done anything wrong.  (The situation, incidentally, appears to be the same when entering or leaving an increasing number of other countries, including the United Kingdom.)

This authority is deeply controversial, and civil libertarians had hoped that the Obama administration would revise the policy.  However, last week, the U.S. Department of Homeland Security (DHS) re-confirmed the Bush era policy that customs officials can seize and search any electronic device you carry across a U.S. border.  That includes laptops, cell phones, MP3 players, USB sticks, etc.  No warrant is necessary: "gimme" is sufficient.

The good news, if there is any, is that the Obamites have streamlined the inspection process.  In most cases, says the DHS, you'll have your laptop or other electronic device(s) back in 30 days or less.  Presumably, they'll copy whatever you've stored on these devices, and then mail it back to you when they're done, presumably they don't find anything suspicious (e.g., child porn, bomb-making instructions, etc.).  Any files copied may be stored "indefinitely."

Fortunately, these warrantless searches don't occur often.  Over the last 10 months, customs officials have conducted only 46 in-depth laptop searches.  They've examined another 1,000 or so without conducting an exhaustive search. 

One way to protect yourself from this type of intrusion is to encrypt all the data on your laptop, including the hard disk itself, using a program like PGP Whole Disk Encryption (http://www.pgp.com) or True-Crypt (http://www.truecrypt.org).

Unfortunately, this isn't a complete solution, because customs officials may demand that you decrypt any encrypted files before they allow you to proceed.  If you refuse, you might be detained until you agree to decrypt the laptop for inspection.  In that event, though, True-Crypt lets you type in a special access code that provides access only to part of your hard drive.  The remainder of your data remains protected in a hidden hard disk partition.

Another issue if customs officials detain your laptop is access to your data.  One way to deal with this issue is to create an encrypted zip file (again using a program like PGP Whole Disk Encryption).  Then, upload it to a secure location using a program such as Filezilla (http://filezilla-project.org).

If you have a Web site with sufficient free space, you could upload it to that location.  Many Internet Service Providers also provide an online backup service.  If you have only a few megabytes of data to protect, you could even send the encrypted file to a friend, with instructions to send it back at your request.  When you're done, securely "wipe" any confidential information off your hard drive, along with the "free space," again using a program like PGP Desktop. 

Before you cross the border, be certain to "sanitize" your laptop of records of Web sites you've visited, incompletely deleted files, and other detritus that may be incriminating.  A good program to use for this purpose is Window Washer (http://www.webroot.com). 

Finally, don't forget to take the same precautions for other electronic media you carry across international borders.  For instance, if you've downloaded music to your MP3 player in violation of copyright laws, this could potentially cause problems.  Leave your MP3 player at home if there's any doubt.

You can protect your "smartphone" by backing up your data as I've already described, and then encrypting it using a product such as PGP Mobile.  If your cell phone doesn't connect to the Internet, there's less potentially incriminating data on it, but the safest strategy is to delete any photos or text messages you feel to be even remotely controversial, and then reset it to factory settings.  You can find instructions for doing so at http://www.master-reset.com.

DHS officials seem to think these rules will help fight terrorism, but I'm not so sure.  After all, if you were really a terrorist, you'd never bring a laptop with you into another country.  You'd simply e-mail yourself the plans to blow up, poison, or incinerate whatever you wish to target.  As with most anti-terrorism initiatives, this one does little or nothing to fight terrorists.  It merely inconveniences law-abiding travelers. 

Copyright © 2009 by Mark Nestmann

U.K. Prepares to Imprison Encryption Passphrase Refuseniks

Encryption is a powerful privacy and security tool.  It is absolutely essential to our modern way of life.

Every time you use your credit card, the merchant that accepts it transmits the data on its magnetic strip in encrypted form to a processing center for approval.  A similar process occurs when you log on to your online bank or securities account.  Indeed, without encryption, hackers and identity thieves would shut down the Internet and the banking system within a matter of hours.

However, governments have a love-hate relationship with encryption.  This is particularly true with encryption technologies that permit individuals—as opposed to governments, banks, and businesses—to take back a smidgen of the privacy rights they've been systematically stripped up in recent decades.  

For instance, I've long recommended encrypting all confidential files on your PC.  This converts plain-text files on your PC into unreadable gibberish.  Programs like PGP Desktop (http://www.pgp.com) that automatically encrypt your entire hard disk are even better. 

It's no accident, though, that the inventor of PGP—a programmer named Phil Zimmermann—almost went to jail in the 1990s for the "crime" of distributing software empowering individuals to protect their privacy.  And ever since, governments worldwide have been doing their best to "control" personal encryption technologies.

A U.K. law called the Regulation of Investigatory Powers Act (RIPA) is a case in point.  A section of the RIPA that came into force in 2007 allows U.K. police to demand encryption keys or provide a clear text transcript of encrypted text.  Failure to comply can result in up to two years imprisonment for cases not involving national security, or five years for terrorism offenses and the like.  Police can order you to turn over data months or even years old.

Surely, police have reserved this draconian sanction for known associates of Osama bin Laden, or in investigations of similarly severe threats.  But that's not how it's been used.  Instead, as I described in an earlier blog post, the first known use of this authority came against an animal rights activist.

Now, the U.K.'s "Chief Surveillance Commissioner" (how's that for an Orwellian job title?) has disclosed that two defendants--apparently not including the animal rights activist--have been convicted for failing to hand over their encryption keys.  Both are now awaiting sentencing by the courts.  The cases of five other defendants accused of the same "crime" apparently remain before the courts. 

I suspect that officials in other countries—especially the United States—are nodding in approval of this process.  Under U.S. law, the Fifth Amendment to the Constitution protects individuals from being forced to incriminate themselves.  However, in a few cases, U.S. courts have already ordered individuals suspected of possession of child pornography to release their encryption passphrases.

What will you do when jackbooted thugs arrive at your home or business, seize your encrypted computer files, and demand that you give them unrestricted access to all of them?  Are you prepared to go to jail to protect your privacy?

I don't have a good answer to these questions.  But you can bet I'm thinking of them. 

If you have any ideas, I invite you to share them—my blog is now open to comments.

Copyright © 2009 by Mark Nestmann

It's Official: Your Internet Address Isn't Private

If you're reading this posting, you're probably sitting in front of your computer without anyone gazing over your shoulder.  It's therefore easy to believe that what you do on the Internet—browsing, chatting, e-mailing, or whatever—is private. 

Don't believe it.  Your Internet Service Provider (ISP) can monitor every e-mail message you send, every Web page to which you surf, and every chat session you initiate.   If police demand this information, your ISP must turn over a record of everything you’ve done online.  And now, thanks to a ruling by U.S. District Court Judge Richard Jones in Seattle, you have no right to keep your "Internet identity" anonymous.  That opens the door to even greater privacy invasion.

Jones issued the ruling in dismissing a class-action lawsuit against Microsoft stemming from the company's practice of collecting the "Internet Protocol addresses" (IP addresses) of consumers who download automatic updates from the company.  Your IP address is a unique number that represents your publicly visible identity on the Internet.  But because the address identifies your computer—and not you personally—according to Jones, you have no "expectation of privacy" in the address.  That means any Web site can legally collect your IP address, unless they've promised not to do so. 

Moreover, it's relatively easy for Web sites, police, or anyone else to combine your IP address with other information to determine your identity.  That means if you don't want details of what you do on your computer divulged to the highest bidder, or anyone armed with a subpoena, you need to take precautions to anonymize it.

The easiest way to do this is to use a "virtual private network" (VPN).  Essentially, the VPN acts as an intermediary (called a proxy) between your PC and the Web site to which you're connecting.  That Web site records the IP address of the proxy, not of your PC.  This lets you use the Internet virtually anonymously.  And all your ISP sees is that you've signed on to the VPN—it can't track your Web surfing, either.

The only way anyone could recover your IP address would be by comparing the logs from the VPN and the logs from the Web site in question.  That’s a little like looking for a needle in a haystack.  What’s more, a well-designed VPN will be configured so that it’s impossible to retrieve a meaningful log to connect to individual subscribers.

There are many VPN services available.  I prefer services that don’t have networks installed in the United States to avoid possible compromise under legislation such as the USA PATRIOT Act.  The service that I use is http://www.cryptohippie.com.  Its only U.S. presence is to authenticate connections to Cryptohippie servers in other countries.  None of Cryptohippie’s servers are in the United States.

If you already have a VPN that you’re satisfied with, keep using it.  But if not, and you value your online privacy, give the “Road Warrior” VPN a try.

Copyright © 2009 by Mark Nestmann

Britain Imposes Direct Rule on Turks & Caicos

While it's not well known, the British Empire isn't dead.  It's only in hibernation.  Occasionally, Britain awakens from somulence and exercises long-forgotten "retained powers" that give it essentially dictatorial powers over the remnants of its colonial empire.

This legacy of colonial rule re-emerged earlier this month when Britain's Foreign and Commonwealth Office (FCO) took the first steps toward imposing "direct rule" over the Turks & Caicos Islands (TCI).  All this happened in a very British way: before the government imposes direct rule, committees of experts prepare detailed reports detailing the problems in a particular colony or colonies (now reborn as "overseas territories").  The reports recommend a solution to the problems found, which inevitably involve a loss of privacy or autonomy in the territory in question.  Then the FCO or other government office issues a thinly veiled warning to the territory about the consequences of neglecting the recommendations. 

This was the pattern in the TCI, and in its case, the problems are very real.  Several months ago, former Lord Justice Sir Robin Auld's Commission of Inquiry issued a still-unpublished report into "possible corruption or other serious dishonesty in relation to past and present elected members of the Legislature in recent years."  Among other conclusions, the report found:

• There were "clear signs of political amorality and immaturity and of general administrative incompetence"
• The TCI government is "at a near standstill" with its "financial position so bad that the Government cannot pay many of its bills as they fall due"

The Auld Commission recommended that the TCI's governor (naturally appointed in London) suspend the constitution "for an indeterminate period."   In place of elected representatives, Auld recommended replacing the local government with direct rule from London.  Finally, Auld recommended the U.K. government aggressively prosecute alleged wrongdoers, in some cases without a jury trial. All these initiatives are perfectly legal under the "Westminster Constitutions" governing U.K. overseas territories.

This process is now underway, although in slow motion.  A team of British investigators, lawyers and administrators is ready at a moment's notice to travel from London to the TCI to replace the elected Parliament.  A British naval frigate is on patrol in the Caribbean to provide military support if recalcitrant TCI politicians don't fall into line. 

And fall into line they have, at least in part.  The elected government now says it will push forward with at least some of the reforms in the Auld Commission report.  But if they fail to do so, the British government, backed by military force, is ready to do so.

Let me be very clear.  For more than a decade, I've heard numerous reports of systemic corruption and cronyism in the TCI.  For this reason, I've avoided recommending it (although its captive insurance laws and infrastructure are reasonably good).  It also seems very likely that the only way corruption can be brought under control is with outside intervention.

However, it's important to realize that several other British overseas territories with significant offshore sectors have precisely the same—or a very similar— constitutional status as the TCI.  These jurisdictions include Anguilla, Bermuda, the British Virgin Islands, the Cayman Islands, and Gibraltar.  In all of these territories, the British government can—and on occasion has—imposed legislation on the inhabitants over the head of the elected legislature. 

For instance, in recent years, Britain has "encouraged" its overseas territories to sign Tax Information Exchange Agreements with high-tax countries.  These agreements require the territories to release financial information on clients of banks and trust companies upon request to tax officials in the signatory countries.  Britain is now "encouraging" those same territories to comply with the information-exchange provisions of the European Savings Tax Directive, which essentially eliminates financial privacy in nearly every European Union country. 

For many investors—myself included—there's a certain comfort knowing that Britain stands behind its overseas territories.  Yet this comfort comes at a terrible price to democratic rule and financial privacy.  Before you invest or do business in any of these jurisdictions, be aware of what you're dealing with. 

Copyright © 2009 by Mark Nestmann

The Internet Never Forgets

Web-savvy employers and universities are increasingly employing a new tactic to screen applicants: conducting online research to unearth photos, blog entries, or other "digital dirt" you might prefer to keep private. 

Indeed, companies are springing up to dig up Internet postings that might be of interest to employers, government agencies, or whoever else might be interested.  For instance, you can view Web pages that were modified months or even years ago through the Internet Archive, also known as the Wayback Machine, at http://www.archive.org. 

But that doesn't mean you can't obscure your digital trail.  While I normally suggest that anyone interested in privacy avoid posting information to the Internet about themselves, if data you don't want others to see is already there, here are a few suggestions on how to cope:

Delete, delete, delete.  Start by deleting any photo, personal profile, or personal description on any social networking or dating Web site that is even mildly embarrassing.  For instance, I suspect Sergey Brin, the co-founder of Google founders, might prefer not to have this photo of him in drag immortalized.  While Sergey may be wealthy enough not to care, you may not be. 

Unfortunately, most social networking sites create archives in which your photos may reside permanently, even if you delete them from your profile.  Someone with a link to the original photo—or using the Internet Archive—might be able to find it. 

Do a search of yourself on Google.  Look for any links back to potentially incriminating or embarrassing posts or photos.  Unfortunately, Google won't remove content itself, but merely will refer you to the Webmaster posting the content.  If you can't figure out who's in charge of a Web site, search for the owner at www.whois.net.  Contact the owner of the site and ask that comments by or about you be deleted. In most cases the owner has no obligation to remove the content, but it may do so if you persist or threaten legal action.

Set up a Google alert for yourself.  You'll receive a daily e-mail update of the latest updates of whatever topic—yourself in this case—that you choose.  This is a great way to monitor what others are saying about you online.

Create favorable content about yourself.  You can do this in many ways.  For instance, create a professional Web site and/or professional blog.  For blogs, Wordpress, LiveJournal and TypePad all have high Google page ranks. You can also create a Wikipedia entry for yourself.  To further insure these sites are at the top of any Google search of your name, use title tags and headers to highlight information about you that you want people to see.  Don't forget to create a Google profile that contains the information about yourself you wish to highlight.  You can also leave comments on blogs and Web sites you respect under your own name. 

Use social networking sites intelligently.  It's almost impossible to permanently eliminate content you post to social networking sites, even if you unsubscribe.  However, you can also use these sites to your advantage, especially if you're setting up a profile for the first time.  Web sites like Facebook, MySpace, LinkedIn, Flickr, and Twitter are a good place to begin.  You don't even need to use these sites.  Just create a profile and add the content you want people to see.   Web sites that let you create a unique link with your name in it are especially useful (e.g., LinkedIn).  Those pages will show up ahead of most other sites that might contain content you don't want others to view.

Use protection.  There's no such thing as an Internet condom, but you can hire companies that will contact sites that have published material pertinent to your character.  One that has good reviews—although I haven't used it personally—is http://www.trackur.com.

Just don't forget that once you've posted something on the Internet, it's very difficult to permanently delete it.  So before you hit the "post" button, be absolutely certain that whatever you're about to send into cyberspace belongs there.

Copyright © 2009 by Mark Nestmann

Feds Claim Right to Search Your Home Day or Night, without a Warrant

If you live in the United States, you might have the naïve idea that police can’t enter your home without a search warrant.  That’s generally true, but the federal agency responsible for regulating electronic communications claims that it can.  If you own any electronic device that emits radio frequency (RF) energy, the Federal Communications Commission says it can enter your home any time to inspect it. 

Most of us, of course, own multiple RF devices.  Your cell phone, your wireless Internet connection, and even your garage door opener all transmit signals through the air.  All are fair game for warrantless inspection, the FCC says.

The FCC claims it is only interested in RF devices that use “unlicensed” frequencies.  For instance, if you operate a radio station out of your home, and didn’t bother to obtain a broadcasting license for it, the FCC may come calling.  That’s particular true if the signal is powerful enough to interfere with the signal from a licensed station.

However, the FCC says that it can also inspect equipment using “licensed” frequencies.  And that includes every household in the United States, with the possible exception of groups like the Amish, who eschew modern electronic devices. 

The FCC doesn’t have the right to seize anything—only to inspect any broadcasting RF devices.  However, if agents see anything in your home that’s “suspicious,” they can notify police, who may then be able to obtain a warrant for a more thorough search.

According to the FCC, its authority to search private homes comes from a 75-year old law authorizing warrantless administrative searches of radio transmitters.  Back in 1934, of course, there were no wireless routers, cell phones, or RF-activated garage door openers. Today, almost everyone does, yet the FCC still claims the same powers.

The saving grace to this policy is that the FCC won’t simply barge into your home if it wants to inspect any of the RF devices you own.  Instead, it will leave a note on your door announcing its intention to inspect whatever unlicensed (or licensed) RF devices in your home. 

If such a notice appears on your door, don’t call the FCC to schedule an inspection.  Call your lawyer.  You have a right for your lawyer to be present for any warrantless inspection of your home. 

Copyright © 2009 by Mark Nestmann

Scalia: You Can Invade My Privacy—but I Don't Have to Like It

U.S. Supreme Court Justice Antonin Scalia doesn't think you have a right to privacy in most aspects of your life.  But he doesn't care to have his own privacy invaded—although he admits it's perfectly legal.

Back in January, Scalia spoke at a privacy conference organized by the Institute of American and Talmudic Law.  While his speech wasn't recorded (apparently at his own insistence), one of his remarks was a statement to the effect:

"Every single datum about my life is private? That's silly."  Some information should remain private, "but it doesn't include what groceries I buy."

Scalia also said he wasn't bothered by anyone tracking him on the Internet.  "I don't find that particularly offensive…I don't find it a secret what I buy, unless it's shameful."

Taking a cue from Scalia's remarks, Fordham Law Professor Joel Reidenberg decided to give the students in his Information Privacy Law class a special assignment: find everything they could about  Scalia on the Internet, and compile a dossier on him.  Among other findings, students discovered Scalia's home address and home phone number, his wife's personal e-mail address, and his food and entertainment preferences.

Scalia's reaction wasn't surprising.  He didn't like having this information published.  Said Scalia:

It is not a rare phenomenon that what is legal may also be quite irresponsible. That appears in the First Amendment context all the time. What can be said often should not be said. Prof. Reidenberg's exercise is an example of perfectly legal, abominably poor judgment. Since he was not teaching a course in judgment, I presume he felt no responsibility to display any.

Well, well.  Nothing like being dressed down by a Supreme Court justice! 

But perhaps Justice Scalia should give the matter some more consideration.  Not everything that should remain private, for instance, is shameful.  Your bank account transaction data may not be shameful (well, perhaps it is…), but that doesn't mean anyone should be able to view it.  Nor is your Social Security number shameful—but it's not a good idea to broadcast it to potential identity thieves.

Still, the most revealing portraits come from not just one or two data points, but the aggregation of volumes of data, all freely available to anyone who cares to gather it.  Taken together, this information paints a remarkably detailed portrait of "you."  And it's perfectly legal to compile, even if, as the good Justice Scalia reminds us, the person gathering it, or using it, may be exercising "bad judgment." 

Copyright © 2009 by Mark Nestmann

Click here to learn 109 ways you can begin to use today to protect what's left of your privacy