I'll be Watching You

Every step you take,
I'll be watching you
-lyrics by Sting

My wife has frequently said that our next car should have "OnStar" becuase it sounds so useful and appropriate for emergency preparedness. But Wired Magazine reports something unsettling about OnStar, even if you unsubscribe and stop paying the monthly fee of $19-$29, they may still continue to track your vehicle. OnStar claims this is to make it “easier to re-enroll” in the program if you decide to come back. But more likely OnStar wants your travel history so they can make money selling it. A new privacy policy from OnStar makes it clear that they have the right to sell GPS-derived data in an anonymized format.

A spokesman for the General Motors subsidiary, said OnStar does not currently sell customer data, but it reserves that right. He said both the new and old privacy policies allow OnStar to chronicle a vehicle’s every movement and its speed. “We hear from organizations periodically requesting our information,” he said.

An example would be for the Michigan Department of Transportation “to get a feel for traffic usage on a specific section of freeway.”

Bottom Line
OnStar can be a life saver. But it should leave you alone if you cancel. Canceling customers must explicitly opt out of the continued surveillance monitoring program. If you don't trust OnStar to honor your opting out, the Consumerist recommends checking your user manual for the location of the OnStar fuse and removing it.

Privacy

"Relying on the government to protect your privacy is like asking a peeping tom to install your window blinds."
-John Perry Barlow

Many people are concerned about their privacy being violated by the Internet. Information about you is collected and sold in ways you might not be aware of. For example, if you unsubscribe to a spam email then you've just told them that the email is an active account reaching a live person. They can sell that fact to other spammers.

dailyfinance.com reports on other agencies that collect information about you in Who Is Watching You?

The IRS "knows everything about what you earn and any major transactions you make. It can access every bit of information it needs to determine how much money" you owe in taxes.

The FBI "keeps a database of over 90 million fingerprints, ... It also has an extensive database of DNA, [since 9/11] It now tracks a large portion of mail, cell phone traffic and Internet activity of people it deems suspicious.

The article also list 9 industries that collect personal information ranked by the number of people they track.

1. Credit Rating Agencies: Equifax, Experian, and TransUnion
2. Cell Phone Service Providers
3. Social Media Companies (Facebook)
4. Credit Card Companies
5. Search Engines (Google)
6. Retail Chains (Walmart)
7. Casinos
8. Large Banks (Bank of America, Chase, Citibank)
9. Life Insurance Companies

Bottom Line

Visit the full article for details on how each company is recording what you do. It's quite scary.

Who's reading your email?

“Relying on the government to protect your privacy is like asking a peeping tom to install your window blinds.”
- John Perry Barlow

When you use the Internet, you can NEVER assume any privacy. Consider email for example. Your text is moving in the clear between many servers and can be easily intercepted. It is stored on a server at the email company where police and others can request to see it with a court warrant. Any employee at the email company with access to the server could read the email (though it may violate company/corporate privacy regulations.) Don't think this could happen? There are many examples of Civil employees caught reading the DMV records or tax records of celebrities, friends and enemies.

Another technology that puts privacy at risk is Chat. It's not uncommon for employees within a company to chat with other. But if the chat is run by an outside company, then confidential conversations can compromised. At my last job, the IT department came to fear this and required that everyone only use a new Chat service that was run within the company.

One problem today is that we have little clue who owns or operates services on the Internet. Your favorite site or service could be running in China with a history of disregard for privacy. Recently one of the pioneering chat companies, ICQ, was sold to a Russian company where the Russian "secret service" is entitled by law to any information it wants.

Bottom Line

Anything you put on the Internet may be leaked or become public. Don't assume privacy. I'm often annoyed by sites where I register and then they email back a welcome letter with my password printed out in clear text.

I read yesterday of a case in Europe where a brother privately boasted of a murder on Facebook to his sister. She turned the message over to the police.

Online Privacy

“Privacy is not something that I'm merely entitled to, it's an absolute prerequisite.” - actor Marlon Brando

While I really like Facebook, you do have to be careful with the information you share and who you share it with. Some people I think go too far and lock down all information so all I have is a name and no clue if this person is my long lost friend from college or not. Other people publish everything about themselves to the world, their birthday, where they live, etc. That is too much sharing. I restrict that level of detail to just my “confirmed” friends. My public profile shows my workplace, my “town”, the colleges I attended, and a single photo carefully chosen.

Many websites (like games I play) ask for a birthday, so I’ve created a new one of January 1 with the year rounded down to the nearest decade. That won’t do on Facebook since friends want to celebrate my real birthday. So I entered a date that is near but slightly off. The town I list is the township I live in, not the smaller village jurisdiction.

Am I being paranoid? Perhaps not. There is a new company at http://www.spokeo.com/ that uses Facebook and other online data to build individual profiles. The amount of information they had on me was disturbing – my actual village, my house value, my age and birthday month, married, number of kids, etc. And this was the “free” display. If I paid I could have seen even more details (or so they claim).

Type in your name and see what comes up about yourself. If you have a common name, try [name], [city], [state].

Bottom Line

The good news is that Spokeo supports privacy requests. Go to www.spokeo.com/privacy and put in the URL of “your” page on their site. Then give them an email address (you could create a temporary email for this). Within seconds I had an email, clicked the response and immediately my name disappeared from their search results.

Background Check

"We're getting an increasing amount of questions about background checks, almost as many as identity fraud. There are too many problems with inaccurate information being recorded."-Tena Friery, Privacy Rights Clearinghouse

In today's economy employers can afford to be choosy and selective in whom they hire. To that end more are now running background checks on the best candidates. What will they find out about you? The Consumerist put together the list below of agencies you can contact to check your record. Most offer one free report a year and provide a means to request corrections if you see any errors.

Employment History Reports
The Work Number
ChoicePoint (866) 312-8075
Acxiom
Abso

Tenant History Reports
ChoicePoint (877) 448-5732
First Advantage SafeRent (888) 333-2413
Tenant Data Services
RentBureauUD Registry (818) 785-3905

Auto & Home Insurance Claim Reports
ChoicePoint
Insurance Services Office (ISO) (800) 627-3487

Credit Bureaus Reports
Equifax
Experian
Transunion
Innovis
Payment Reporting Builds Credit (PRBC)

Full File Disclosure/Personal Information Reports
ChoicePoint
LexisNexis

Check Writing History Reports
ChexSystems (800) 428-9623
TeleCheck (800) 835-3243.
Shared Check Authorization Network (800) 262-7771

Health History Reports
Medical Information
Bureau (MIB) (866) 692-6901

Prescription Drug Purchase History Reports
Ingenix MedPoint
Milliman IntelliScript

Social Security Statement
Social Security Administration

Purchase Returns History Reports
Retail Equation

Gaming Patron's Credit History and Transaction Data
Central Credit

Other Reports
TeleTrack

Utilities & Telecommunications Reports
National Consumer Telecom and Utilities Exchange, Inc (NCTUE)
Call 1-888-201-5643 for reports

Don't Share Personal Information

“Money isn't everything - there's also credit cards, money orders, and travelers' checks”

A few nights about I called my credit card companies and each one required that I answer the official security questions. What is your zip code? What is your card number? What is the mother’s maiden name for the primary cardholder? This last one is kind of tricky since I can never remember if the primary cardholder is me or my wife.

Sadly as security goes, the official questions are quite lame. Any store employee can steal your card number. Zip codes can be found via Google with person lookups. Mother’s maiden name could be found on ancestry.com or through a friend of the family.

What can your do?

1. Ask for different security questions. Some sites let you choose your question or write your own like, “You’re first pet’s name”, or “Your first friend”.
   
2. Make up an imaginary maiden name. You do not have to use your real mother’s name but you do have to remember the alternative you give.

Bottom Line

When teens, children (even adults) surf the Internet they should be taught that there is some information that is never shared on facebook, blogs, etc.

• credit card number


• social security number


• mother's maiden name


• debit card number and PIN


• bank passwords and logins


• internet account passwords

The end of my post Espionage has details on creating strong passwords.

911 Pranks

“I have left orders to be awakened at any time in case of national emergency, even if I'm in a cabinet meeting.” - Ronald Reagan quotes

The 911 service not prepared for new generation of pranksters with access to VoIP.

“After paying a small fee to one of the readily available caller ID spoofing services available on the Web, a prank caller with a grudge or a serious psychological problem can call 911 and tell the operator just about any story he or she wants. Since the 911 system wasn't built with VoIP in mind, these calls appear to originate from anywhere, and said hooligans take full advantage of the opportunity. The practice has been dubbed "swatting," typically because the spoofed emergency stories that these troubled individuals make up are horrible enough to send police and even SWAT teams to unsuspecting victims on the other side of town or the continent.

Here is an example of a California family raided by police with helicopters based on a prank call.

Bottom Line
Technology is rarely pure good or evil. VOIP is great for calling my sister in Canada cheaply. But what about ID spoofing? It is easy to say "ban it" based on the story above but it can play a role in protecting privacy from unwarranted government inspection. Do we have a right (or need) to be anonymous?