Facebook Privacy Guide

Erudite tech site Ars Technica has published a short reference to Facebook privacy features:

Many users are aware that Facebook has numerous privacy controls, for example, but even the most experienced Facebook users often don't know just how much they can control who sees what. For instance, did you know that you can specify exactly who can see your status updates, down to different groups of friends (not just "friends" versus "everyone")? What about controlling which groups of people can even find you in a Facebook search to begin with?

Magstripe Bandits

Jack Dunning says the mail-order companies are really in the business of selling your personal information. Their partners in crime are credit agencies, and with the power of a card swipe they tie it all into a neat little package to be sold at a high markup:

She even gives a blueprint of how to pull off the caper. You lift the information from the magnetic strip on the back of the card, which normally includes the card holder’s name and address. Then, proceed to the third party data service -- which Experian provides -- to append the extra juicy stuff like your age, income, occupation, education, home value, and the list goes on and on. They even know if you gamble, drink, smoke and have your medical ailments and prescriptions taken.

The first rule of personal privacy: use cash. The second rule of personal privacy: USE CASH.

Defeat infrared surveillance cameras

A German arts group is publicizing a technique to defeat surveillance cameras that can see in the infrared range by overwhelming their arrays with infrared light from IR LEDs mounted on a headband or hat.

According to commenters, this technique would work best against low-light surveillance cameras with particular sensitivity in the infrared range, optimized for low-light situations.

Many cameras have sensitivity into the IR but wouldn't be so easily overwhelmed by the brighter infrared LEDs.

Security Insider claims this technique would only work intermittently against cheap CCTV cameras:

I can tell you that this may work for a second or two on cameras that have a cut filter (that's the real name for "IR sensitive" cameras), but all that is really going to happen is your face will get illuminated in between the frames that are actually "flared" out by the light. Also, you're more likely to be noticed doing this due to the motion detection alarms going off due to the large pixel change. You would be much better off with a laser, than an LED. We've been doing these type of tricks for years in the lab to try to trick the cameras. Anymore, its not the cameras you need to trick, but the intelligent video algorithms that are going to pick up on the anomaly and register it as an event. Oh, one more thing. Don't even try to attempt this during the daytime. Like another poster said, the cut filter doesn't activate until a timer either trips it (set on a schedule) or a preset low lux threshhold is met. (it gets dark). Even then many cameras these days have dynamic range circuits that will tame the bright spots and highlight the dark spots. Look up some Pelco, Panasonic, or Sony cctv specs for more info.

Outfits mine Voter Registration records

Vanity Fair reports that database broker Aristotle is amassing, cross-referencing and selling voter registration and political donation information:

“People are getting hassled by marketing firms and hassled by consultants, and much of that information comes from signing petitions or off the voting databases."

In most states, voter registration databases are public information, by law. The governments sell this information, along with driver's license data.

"One such [commercial data] supplier is Acxiom, the Arkansas-based behemoth that stores unimaginable quantities of data. In 2003, a single hacker stole Acxiom records on 20 million people, according to Washington Post reporter Robert O’Harrow’s 2005 book, No Place to Hide."

Aristotle's data gatherers might soon be taking photos in public and harvesting data-rich magstripe information from credit cards and identity cards:

"Phillips picks up one of the custom-designed pocket-P.C. scanners that go with the Aristotle 360 system. With them, canvassers working for campaigns will swipe credit cards and driver’s licenses, take pictures of voters using an embedded micro-camera, and instantaneously feed all of the resulting information into the database."

The inescapable conclusions I draw from this are that voting and making political donations are much more likely to result in an individual's inclusion in a database, whether the data mining effort is governmental, political, or for more direct monetary profit. The magnetic-strip scanners are a reminder about how electronic cards can facilitate mass surveillance of a type unintended by their issuers.

In situations when Social Security Numbers and Social Insurance Numbers can't be used as database keys or for matching individuals, mailing addresses and date-of-birth (DOB) is frequently used. Therefore, remember to keep your full name, DOB and mailing address (hopefully it's not the same as your street address!) to yourself as much as possible.

Irish Grandparent? Irish Passport

Many people who can document that one of their grandparents was an Irish citizen, can apply for Irish citzenship via entry in the Register of Foreign Births, and then apply for an Irish passport. Children of those foreign-born Irish citizens with Irish grandparents are eligible too, as long as the child was born after the parent's citizenship was recorded by an Irish Consulate.

Before applying, I investigated and verified that Ireland had no military draft law and did not tax citizens living abroad, thereby making it safe to proceed. What were the advantages beyond maintaining a link to our ancestral homeland being a conversation piece? The idea of having an EU passport that allowed me to travel and work in the, now 27, nations of the EU without having to hassle with visas and work permits that are usually required to travel, live or work in a foreign nation was appealing. Also, being familiar with the bloody history of the 20th century as well as having worked in both aviation and IT, two areas where backup systems are standard operating procedure, I felt that a costless backup citizenship might make sense for my descendants. The biggest reason was probably the potential advantages it would offer to my children and me in the global economy which, even then was the apparent trend for the future.

U.S. citizens can become dual citizens as long as the alternate citizenship is granted after their U.S. citizenship, as the U.S. citizenship process requires an applicant to renounce all other citizenships. Ireland, by contrast, does not require an applicant to renounce other citizenships.

Bermuda to track road vehicles with RFID

RFID Journal reports that the Caribbean nation of Bermuda plans to tag registered cars and trucks with RFID transponders to increase road registration compliance and revenues.

The ISO 18000-6B standardized, 915 MHz tags will be embedded in tamper-resistant windscreen stickers, and are made by 3M. The laser readers placed by the side of the road are made by Transcore.

Sabotaging the RFID tag is ineffective because the RFID interrogation is combined with an ANPR system:

If a car arrives at an intersection and no interrogation of an RFID tag can be performed, the system will take a picture of the car's license plate. Using optical character recognition software, the system will read the vehicle's plate numbers and input them into a database so a citation can be automatically issued. The same system will be employed to detect commercial vehicles operating in restricted areas during rush hour without permits.

Bermuda's Transport Control Department expects that all of the island nation's registered cars should be RFID tagged by June 2008. Motorcycles will be exempt from the RFID tagging requirement, though authorities may later decide to being them into the program.

The privacy implications of the mandated RFID transponders are profound. It is very feasible for groups unassociated with Bermuda's Transport Control Department to develop the ability to read the RFID tags and track specific automobiles by their electronic ID. In fact, an older version of this technology was used by a United States intelligence agency during the Cold War to track Soviet attaches whenever they crossed one of a handful of Washington, D.C. bridges and passed outside the 20-mile unrestricted transit limit.

The power of data mining

An exercise in finding subversives through Amazon.com wishlists illustrates the power of data mining:

It used to be you had to get a warrant to monitor a person or a group of people. Today, it is increasingly easy to monitor ideas. And then track them back to people. Most of us don't have access to the databases, software, or computing power of the NSA, FBI, and other government agencies. But an individual with access to the internet can still develop a fairly sophisticated profile of hundreds of thousands of U.S. citizens using free and publicly available resources. Here's an example.

There are many websites and databases that could be used for this project, but few things tell you as much about a person as the books he chooses to read. Isn't that why the Patriot Act specifically requires libraries to release information on who's reading what? For this reason, I chose to focus on the information contained in the popular Amazon wishlists.