How Google might know what you did last summer -- even if you forgot.

Google Latitude is a service that allows users to see and share their location on a Google map live and in real-time. The service runs on most smart-phones, regardless of service provider, including Apple's iPhone, Windows Mobile, the Palm Pre, and, of course, Google's Android. Latitude relies on a combination of GPS, cellular tower triangulation, and wi-fi triangulation. Having brushed-up on the service for a recent National Public Radio (NPR) Interview, I have since considered Latitude one-part creepy, and two-parts cool. However, the creepy / cool ratio may be shifting.

This week Google introduced a new and improved Google Latitude -- with enhanced features like "Location History".  With Location History Latitude users can go back in time retrace their footsteps, and even see where they stayed-put, and for how long. Kind of cool...yet, very creepy. But practical?

Imagine, for example, you're the owner of a Palm Pre on Sprint's 3G Now Network , having trouble remembering where your were when you told your spouse you were somewhere else? Now, there's a map for that!

But wait -- there's more! How about "Location Alerts"? Certainly, a application that would alert you when a particular individual, say a family member, has left work or school, would be very practical. After a while of being alerted every time someone is, or has arrived, exactly where you would expect them to be, however, could get old. So, Google's geniuses stepped it up a notch. According to Google, Latitude will learn user's patterns and behavior so that alerts can be issued when a person has strayed from their routine -- left at a different time, or arrived at a different place.

For example, if you decide to  staycation with your mistress, you can receive a handy alert when your spouse leaves the office earlier than usual. Or, if traffic is particularly light, Latitude will let you know when it's time for a quick window-exit.

Best of all, when the jig is up, no one has to know, because -- for now -- Google is making all these free services available to you, and no one else... at least, without subpoena powers.

This is deception... on the Now Network.

Recently, I had a wonderful opportunity to play a game of hi-tech "phone tag" on the streets of San Francisco with Reporter Martin Kaste from NPR's "All Things Considered". Late last Summer I was  asked if I would be willing to sit down for an interview for a story he was researching about location privacy. But, instead of agreeing to meet Kaste, I told him he had to find me.

With the aid of his GPS-equipped smart-phone, some software, a little patience, and a good pair of walking shoes, he was able to "tag" me sipping a latte outside a coffee shop on Market St. Of course, with my own GPS, and software-equipped smart-phone, I was able to see him coming. What follows are the fruits of that encounter:

Digital Bread Crumbs: Following Your Cell Phone Trail

Jeff Fischbach is a little bit like those guys in The Matrix — when he puts on his shades and looks at the world, he sees data.

Walking down the street in San Francisco, he points out all the devices that record people's comings and goings: digital parking meters, apartment intercom systems, digital security cameras...

Audio and transcript: http://www.npr.org/templates/story/story.php?storyId=114241860&ft=1&f=1019

It's rare that I clap for [watch] TV commercials. But Verizon just took AT&T to the mat -- er, map.

Technically, this is off-topic, but I think I can apply a little broad discretion when it comes to bad data -- That is, the data that every U.S. cell phone company uses to claim to be the best.

I know I spend a lot of time picking on Apple -- especially the the iPhone. But when something falls just short of great, it leaves room for criticism. That, however, doesn't describe Apple's choice of service partner. Verizon customers love their coverage. T-Mobile customers love their customer service. Sprint customers love their features (and free 3G roaming to Verizon). AT&T customers love their iPhones, and tolerate their service. Now Verizon is taking them to the map.

Watch and see what I mean.

What do you call the sacrifice of one person's privacy in an attempt to save the privacy of over 1300? If you're a bank, you call it collateral damage.

When I was a kid I earned my first paycheck passing out fliers for a neighbor who was starting a pool cleaning business. With my first $13 in hand, my grandfather took me to the a bank in walking distance to my home, got me a tour of the vault from the branch manager, a neat pouch to hold all my coin, a full explanation of the principals of savings and loans, and helped me open my very first savings account. Believe it or not, back then, all my account information was stored on a double-sided index card behind the teller.

Today, things are much more complicated. Gone are the index cards and passbooks, most of the employees, tellers and branches, a good deal of the service, interest-bearing accounts with only $13 in them, and a lot of the customers' money. Today, it's all computerized, and most banks even attach various penalties to discourage human contact.

I know an awful lot about electronic data systems, but I don't pretend to fully understand how the modern banking system works. Sometimes, I think I do--from a mechanical (as opposed to financial) perspective. But then something convinces me that I don't. For instance, you know how every so often your bank emails its customers' names, addresses, Social Security numbers, and loan information to Gmail?

To be completely honest, I didn't know they did that either, until I found out recently that The Rocky Mountain Bank in Wyoming had sent 1,325 such records to the wrong Gmail account. (Mind you, most would have trouble imagining who could possibly be the right recipient.) Once the error was noticed, the bank attempted to contact the recipient to request immediate destruction of the email and its attachment. When the bank received no response, a request was made to Google for the recipient's identity. Citing its privacy policy, Google refused to provide the information requested, and the bank filed suit.

According to court documents:

"On August 12, 2009, Plaintiff received a request from one of its customers for Plaintiff to send certain loan statements to a third-party representative of that customer. That same day, an employee of Plaintiff attempted to send the requested information to the customer’s representative via email. The next day, Plaintiff discovered that its employee had inadvertently sent the email to the wrong Gmail email address. In addition, Plaintiff discovered that attached to the email was a file containing confidential customer information for 1,325 individual and business customer accounts for customers other than just the customer who requested information. The confidential information includes names, addresses, tax identification numbers, and loan information for each of the 1,325 customer accounts.

After learning of its inadvertent disclosure of confidential customer information, Plaintiff tried to recall the email without success. It then sent another email to the Gmail address, instructing the recipient to immediately delete the prior email and the attached file in its entirety without opening or reviewing it. Plaintiff also requested that the recipient contact Plaintiff to discuss his or her actions. The recipient has not responded to Plaintiff’s email."

Ironically, in a case that pits the privacy interests of innocent parties against each other, the protagonists of this story had some privacy concerns of their own. The Bank's lawyers attempted to file their suit under seal -- which was denied by the U.S. District Court. Though not mentioned in the court's ruling on this issue, most states have security breach notification laws that require disclosure of any records that may have gotten into the hands of unauthorized individuals. Wyoming does, indeed, have such a law (40-12-502. "Computer security breach; notice to affected persons"). It states:

"(a) An individual or commercial entity that conducts business in Wyoming and that owns or licenses computerized data that includes personal identifying information about a resident of Wyoming shall, when it becomes aware of a breach of the security of the system, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal identifying information has been or will be misused. If the investigation determines that the misuse of personal identifying information about a Wyoming resident has occurred or is reasonably likely to occur, the individual or the commercial entity shall give notice as soon as possible to the affected Wyoming resident."

While the bank was compounding errors by ignoring its obligations to its customers and state law, their case against Google was being reviewed by another judge who ordered Google to disable the account, and disclose the recipient's identity.

The Rocky Mountain Bank maintains that it contacted the recipient more than once and requested that the individual respond to requests to "discuss his or her actions". The implication is that, had the recipient responded, this whole matter could have been handled amicably and honorably -- among gentlemen, as it were. I wonder if, from the perspective of the bank, its customers, or even the email recipient, a "discussion" would have really sufficed. I know, as a bank customer, John Doe's word that he had deleted all my personal information from his Gmail account wouldn't satisfy me at all. If I were in charge of bank security, I don't think I'd be very satisfied either. In either case, I suppose I would be demanding proof that had been deleted, never copied, forwarded, or printed, and probably some kind of connotative memory-wipe.

Years ago, I was consulted by a judge after a District Attorney's office "accidentally" obtained access to a defense lawyer's hard drive (quotes inserted to cite the provided explanation, not my personal feelings about the explanation). The negotiated remedy and order was an extensive forensic search of the DA's hard drives, and a complete wipe of their contents -- even when the search turned up no conclusive evidence that the DA had ever examined any privileged materials. But I doubt any accidental recipient would agree to that -- especially a civilian. And why should they?

Of course, no one knows, at this point, if the recipient ever saw the message. Many reading this web site would likely have dismissed it, and any subsequent messages from the bank as a phishing scam. The Rocky Mountain Bank even has a link to an oddly nondescript PDF addressing the subject of phishing scams.

There's really no reason to believe that the bank ever considered litigation to be an entirely avoidable option, no matter how cooperative the recipient might have been. Nor am I convinced that the court's decision has provided any comfort to the individual's who's privacy has been sacrificed -- including the one who's email account has been disabled, and personal information shared with a bank that's already demonstrated that they can't be trusted with the information.

So, if suing Google won't assure its customers' privacy and financial security, what should the bank have done? That's an easy one. Ask any programmer. They'll tell you: The only way to fix a 1D10T error is to upgrade your wetware and reboot.

How Twitter says they'll hide your location from twits with subpoenas.

Recently, Twitter announced that they would be adding geolocation features to their service, allowing users to embed their physical location in their Twitter feed. As not to alarm: Twitter has always maintained that this would be an opt-in feature. But, frankly, any web site you visit is privy to some information about your physical location by virtue of the IP address assigned to your computer by your Internet Service Provider (ISP) from a group of IP addresses reserved for your neighborhood. The logs kept by a web server, combined with a subpoena to the appropriate ISP, usually yield a street address for the subscriber assigned that IP address.

SmarterWare's Gina Trapani (formerly of Lifehacker.com) is attending the Twitter Conference in LA. She's posted updates explaining how Twitter plans to deploy this service and how they intend to protect its Twitter geolocation users from subpoenas. According to Gina, "Twitter will scrub geo-data stored in tweets more than 14 days old to avoid getting subpoena’d about a user’s location in the past. They will outright delete the location information from their database, not just anonymize."

She also reports that while,

"Twitter usually encourages developers and applications to cache data, in the case of geo, they recommend dropping historical location data so that application developers don’t become a subpoena target, either. They also recommend 'fuzzing' location and time data, so that instead of knowing that Joe Smith was at 8th avenue and 15th street at 2:11PM Eastern time on March 7, 2008, you only show that Joe was in Brooklyn on that day. The geodata-scrubbing isn’t a permanent solution. They are looking into ways to store this data in a 'safe' (anonymized?) way in the future, so they won’t always scrub +14 day old data, just at first."

Purging data that isn't mission critical, but likely to be subpoenaed makes a lot of sense. After all, no one writes "Satisfy search warrants in a timely, efficient, and effective manner" into their corporate mission statement.

While I'm convinced that Twitter's motivation is for the sanctity of the corporation, rather than its user-base, it is a step in the right direction. In fact, the direction is so right that one has to wonder why all personally identifiable user data isn't "scrubbed" every 14 days from most online services. Of course, Twitter's raison d'être, is -- among other things -- to give it's user's messages some life and legacy. It's likely that most of those users would also like to take credit for their various flashes of 140 character brilliance.

Not so, however, every time an individual fires off an instant message (IM), or searches Google. Most instant messaging services, for instance, don't store messages after they are sent, but they do store the sender and recipient's IP addresses, with their account information, and the time they logged in. While Google relies on demographic data, such as geography, income, and search interests, in order to sell ads, it doesn't need to be personally attributable to me. Companies like Google, Yahoo!, Facebook, MySpace and AOL are not in the subpoena response business. But, all of these companies employ subpoena compliance personnel, who add to the cost of doing business, but contribute nothing to the bottom-line. Worse yet, where nearly every individual in these companies, in some way, does something, either directly or indirectly, to add to the end-user experience, subpoena compliance often works in direct opposition to that objective.

As many companies learn when they're sued, subpoena compliance is often so expensive that it's cheaper to settle. A company can't be forced to produce what they don't have. And, with some significant exceptions, a company can't be forced to archive what they don't need.

By the way, I'm not just an end-user of all the services listed above, I'm also one of the twits writing the subpoenas.

One body. One suspect. Two theories. A laptop. A birdcage. A bloody crime scene. Two trials. Two hung juries. No convictions. One unsolved mystery.

From Investigation Discovery:

"When a beloved music professor -- David Stagg -- discovers the dead body of his long-time partner, Bill Jennings, he claims he's walked into the aftermath of a tragic suicide. But as investigators descend on the scene, they immediately realize that this reported suicide is clearly a homicide. Is it possible the professor is behind this vicious crime, or has he been falsely accused? The forensic experts on each side battle it out. Which side will you agree with?" (60 min. - First aired 9/14/2009 on Investigation Discovery / Discovery ID's "Forensics: You Decide)

Suicide letter, or coverup?

Friends from the couple's active social group were in total disbelief. Few could imagine David Stagg involved in the murder of his long-time partner. Forensic evidence was inconclusive. Though blood evidence was found throughout the crime scene, no blood or defensive wounds could be found on David Stagg. An unknown set of fingerprints were found at the scene. Computer evidence from Jennings' laptop showed--at least from Jennings' perspective--a tumultuous relationship. But, enough to justify a motive for murder?

There were also a series of suicidal emails and typed letters left by Jennings that charted a history of both love for Stagg, and deep emotional turmoil. And, one final letter--typed on April 24, 2004, the night of the murder--would become one of the most contested pieces of evidence that two juries would have to consider.

On one thing, both sides agreed: Bill Jennings did not take his own life.

The embedded four-minute clip above is edited from the one-hour Investigation Discovery episode dedicated to the Bill Jennings murder, investigations, and trials.

I have worked for both attorneys, Tom Bath and Scott Toth, had many encounters with the Johnson County Crime Lab and the Heart of America's Regional Computer Forensics Laboratory (HARCFL), and kept in contact with other experts from both sides. This case demonstrates that, even when some of the best experts from the most highly technical fields agree on the evidence, it still may not be enough to tell a jury who's responsible.

My entire interview was shot early in the morning on February 28, 2009 in Las Vegas, NV. I was scheduled to meet the crew in Los Angeles the day after I finished a trial in Vegas. The trial ran so long that I missed my return flight and needed to come back to court first thing the next morning. I purchased a razor and a toothbrush on the way to my hotel, and steamed my suit in my shower at the Golden Nugget. The crew from Siren's Media was, coincidentally, in Las Vegas on the 27th interviewing someone else, and seemed overjoyed to stay a little longer.

The B-roll was "reenacted" in the wee hours of the morning before the court opened, in the server room of a client's law office, across the street from the Clark County Regional Justice Center. (No, that is not actual work product in the background.) The interview was shot first--in a quiet space about the size of a walk-in closet. My client--who asked to remain nameless--was kind enough to send someone to let us in before office hours.

In the "credit where credit is due" department: The video was captured to a thumb-drive from live television using a $99 stand-alone Pinnacle Video Capture device. It was edited using Avidemux a free open-source video editing program that I highly recommend. The entire process took about an hour and a half in a coffee shop, from raw MP4 video to YouTube upload.

You've been punked!!!

How German filmmakers hijacked part of California, stole its identity, and used it to scam an entire country.

I think I've finally figured out the origin of the expression, "If you believe that, I've got a bridge to sell you": Bluewater, California.

The "bridge" to which I refer crosses the Colorado River, and connects Bluewater, California with its sister-city, Bluewater, Arizona. According to the city's web site, downtown Bluewater offers a range of bars and restaurants where you can dine on seafood fished from local waters, get locally-grown produce from the Farmer's Market every Wednesday and Saturday, and enjoy summer poetry in the park.

Imagine the shock when KVPK7, Bluewater's own local news channel reported that the tiny city had become the target of an attempted suicide bombing by a German rap group known as “Berlin Boys”? Who on earth could conceive of such an event hitting a small town in America?  Only Hollywood. Or, in this case, a group promoting the German film, "Short Cut to Hollywood."

The group, according to Wired, set up fake web sites for the "city" (actually, an unincorporated, and largely uninhabited, part of San Bernardino County, CA), the news station, and even a Wikipedia page further authenticating the fictitious news station. They simulated news footage, and even posted local Skype phone numbers on the fictitious web sites. After receiving a tip, journalists in Germany found the fake city web site, and used the phone numbers listed to confirm the tip and interview city officials. Those numbers, of course, went right back to the pranksters in Germany. From there, the story spread through the German press.

The hoax might have lasted longer had news agencies, hungry for additional information, not called the superseding county, San Bernardino, for comment.

Think it couldn't happen here? Well, it practically did. If a handful of German artists who know how to write web pages can fool the entire German press, it certainly doesn't bode well for the common folk who rely on them. And, if part of  California can have its identity stolen, that doesn't bode well for the rest of us either. Just imagine what could have happened if the state still had its credit rating.

By the way, anyone know the German translation for "Punk'd"?

Source: PoeticPixel.info

Twitter's co-founder says your tweets belong to you. Now read the fine print.

For as long as there's been a World Wide Web, there has been debate surrounding the question, "Who owns what users post online?"

Adding fuel to the fire, popular sites like Facebook have written (and withdrawn,) controversial statements into their Terms of Service (ToS) that seemed to suggest that they were asserting ownership over users' content, including photographs, and it's users' "likeness and image". After a massive user outcry, and even some backlash, Facebook was forced to rewrite its TOS, and even allowed users to vote between two versions.

Now, in an apparent attempt to get in front of this kind of momentum, Twitter co-founder Biz Stone announced in a blog post that new changes to the company's ToS would assure that -- though Twitter is allowed to "use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute" its user's Tweets -- "they are your tweets and they belong to you".

While basking in the warm and fuzzy feelings, I decided to give it a read. Thanks to some very helpful tips placed strategically throughout the document, it wasn't hard to find the right section. The specific paragraph to which Mr. Stone refers can be found below the heading, "Your Rights", and just above the sentence:

The paragraph in Twitter's current ToS reads:

"You retain your rights to any Content you submit, post or display on or through the Services. By submitting, posting or displaying Content on or through the Services, you grant us a worldwide, non-exclusive, royalty-free license (with the right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such Content in any and all media or distribution methods (now known or later developed)."

While "ownership" typically presumes a form of exclusive right or control, nowhere in the paragraph above does it even imply that "what's yours is yours", or that "you own your content". Instead, this paragraph grants, not only license to Twitter, but the right to sublicense.

The statements above are followed by a single paragraph, apparently discussing the rebroadcasting of Tweets via Twitter's Application Programming Interface (API), and then the following paragraph:

"...additional uses by Twitter, or other companies, organizations or individuals who partner with Twitter, may be made with no compensation paid to you with respect to the Content that you submit, post, transmit or otherwise make available through the Services.

Which, both explicitly and implicitly, could entitle Twitter to an,

"...irrevocable, perpetual, non-exclusive, transferable, fully paid, worldwide license (with the right to sublicense) to use the Share Service in order to link to, use, copy, publish, stream, publicly perform, publicly display, reformat, translate, excerpt (in whole or in part), summarize, and distribute the content...". (Language removed from Facebook ToS.)

Ironically, when defending this language and in response to the uproar, Facebook CEO Mark Zuckerberg posted the following statement on his blog:

"Our philosophy is that people own their information and control who they share it with."

Just a day after Zukerberg's blog post, PCWorld summarized their reaction to the statement in the following sentence:

"Something doesn't quite add up."

Yet, this morning PCWorld posted the following headline on their web site:

"Twitter: Your 'Tweets' Belong to You"

Followed by the statement,

"Twitter has modified the terms of service that govern the proper user of the microblogging and social-networking site to state unequivocally that messages posted belong to their authors and not to the company."

I wonder if PCWorld's author has ever actually read Twitter's ToS. I am well aware that, in order to provide the services that social networks provide, they need to have the right to distribute their users' content. (Though, perhaps not in perpetuity.) The issue that I have is not with Twitter, or even Facebook. It's with the tech media.

The endless posting and re-posting of particular events on social networks by the "citizen media" has, frankly, given many stories an undeserved and false sense of elevated, or "popularized" significance. But, I would hope that -- so long as they're employed -- those who do work for professional media services would make an effort to, at least, follow their own links before mindlessly re-posting corporate PR.

Of course, if you are a "citizen journalist" (or even if you aren't), please feel free to mindlessly re-post the heck out of this article.

Twitter: Your 'Tweets' Belong to You

You probably won't find much sympathy for Elane Cioni. A mistress scorned, she's been convicted of hacking into the email account of her former-boss, the man with whom she was having an affair, and then his wife, his other girlfriends, and even his kids. (I suppose, that doesn't engender much sympathy for her main-target either.) But, you might be surprised to find out Cioni's not a very good hacker.

You might also be surprised to learn that there's a market for professional hacking and, similar to many legitimate professions, the jobs are going offshore. When it comes to password hacking, those who can, do. Those who can't, outsource. When Cioni wanted back into her boyfriend's life she turned to one of an increasing number of web sites with offers like this:

"Need to monitor your Child? Your Spouse? Your Boyfriend/Girlfriend? We Hack Passwords for $100 USD. We Crack all major web based emails. This include Hotmail, Yahoo! AOL and Gmail. We Provide Proofs Before payment."

Passwords for $100

One particular web site even states: "This unique service is 100% legal".

The Washington Post conducted an interview with the FBI to find out why these services remain online. "The FBI is aware of these illegal services," spokesman Paul Bresson said, "and we have been successful in the past in identifying criminal activity and working with prosecutors to bring indictments. Users of these services should know that just because a product is marketed on the Internet doesn't mean it's legal."

While Cioni had an agenda, the same password could have granted her access to her victims' bank accounts, insurance policies--access to practically any service that allows individuals to "log in". Once access has been gained, she could have reassigned passwords, and even rerouted email communications, effectively allowing her to assume the individual's identities. Fortunately, that wasn't her agenda. But, it's unknown how many of the nation's tens-of-millions of identity theft victims had their passwords purchased.

Making a case against Cioni wasn't very difficult. Of course, it helped that she mentioned things to her boyfriend that only someone who would have read his email would have known.  And, she used her own PayPal account to pay for the password hacking service. In case that wasn't enough, IP address records were subpoenaed from her Internet Service Provider (ISP), and her computer was searched to find fragments of her targets' email cached to her hard drive.

Then again, Elane Cioni is not a very good hacker.

You can listen to below an NPR interview on this topic, and hear more about this story:

Washington Post (http://www.washingtonpost.com/wp-dyn/content/article/2009/09/06/AR2009090602238.html)

Source: Wikipedia

In a match between Bird-brain vs. broadband, you might be surprised to see who wins.

An old friend of mine pointed out what sounded like an interesting story out of South Africa. Tired of slow download speeds, a South African call center pitted a racing pigeon against Telkom South Africa Ltd.’s ADSL data service to see which could move a 4GB file faster. In total it took just under three hours for the bird to fly approximately 50 miles--about 30 times faster than the ADSL service, which had only downloaded 4% of the file in the same time.

I'm afraid we're not really comparing apapane to apapane, or even apapane to ostriches. I doubt, for instance, that the pigeon would fair quite as well over, say, a 500 or 5000 mile "data run".

The experiment, however, raises what is perhaps a more relevant conclusion: You probably couldn't find a more secure method for moving data than via carrier pigeon. While all Internet traffic is subject to both warranted, and illicit intercept and monitoring at multiple gateways, routers, interconnection points, and hosts, one would be hard pressed to serve a warrant on--or even physically intercept--a carrier pigeon. Not to mention, even if they occasionally drop a "packet", it's hard to argue with their wireless range.

It's certainly something to think about.

Thanks Ron!

More at:

Bloomberg (http://www.bloomberg.com/apps/news?pid=20601116&sid=aB5JSWQt0XYY)

News.com.au (http://www.news.com.au/technology/story/0,28348,26053119-5014239,00.html)