It's Hard to Hide From Your 'Friends'

By VAUHINI VARA

January 30, 2008; Wall Street Journal

In November, users of social-networking site Facebook Inc. started seeing updates on what their friends had bought online. Last month, users of a Google Inc. news service began receiving lists of articles their friends and acquaintances had read online. And earlier this month, Sears Holdings Corp. let people type anyone's name, phone number and address on a Web site to learn about their Sears purchases.

All three examples have one thing in common: The companies allowed Web users to access personal information about other people they know -- sometimes without the knowledge of those people.

Online-privacy debates used to center on how Web sites share their users' information with the government, advertisers or complete strangers. But in recent months, a new question has emerged: How much should your friends and acquaintances really know about you?

Internet-privacy experts, and in some cases the users themselves, are demanding more controls on how information is shared with so-called friends. Web sites, in turn, are taking steps to make it easier for users to change their privacy settings and determine exactly which friends see what information.

The data-sharing issues grow as more companies take a page from popular social-networking sites like MySpace and Facebook that let their users create pages full of details like where they live and work, who they are dating, and what their weekend plans are. People can share that information with other people by adding them as "friends," a term usually taken to describe anyone they know. As that idea has caught on, Internet companies have taken it further. If people like sharing basic information, the thinking goes, they'll love sharing even more particulars -- like their shopping and reading habits.

"These companies think, 'Oh, neat, look what we can do,' but some consumers respond by saying, 'Wait, we didn't want you to do that,'" says Lillie Coney, associate director of the Washington D.C.-based Electronic Privacy Information Center.

No Easy Solution

For consumers, there is no silver bullet to solving these privacy issues because each Web site shares information differently. So right now the onus is on individuals to protect themselves by painstakingly visiting each site to change their settings.

Facebook in November introduced a marketing program called Beacon to keep their users on the site longer. In this feature, Overstock.com Inc., Fandango Inc. and dozens of other companies agreed to notify Facebook every time one of its users made a purchase on one of their sites. In turn, Facebook began notifying those users' friends of the purchases.

Rachel Hundley, a law student in Chapel Hill, N.C., experienced this firsthand. After the 24-year-old bought a dress and some shoes on online retailer Overstock, the online retailer notified Facebook of the purchase. Facebook in turn sent a message telling several of Ms. Hundley's friends about it. The next day, a friend commented on her "cute dress." Ms. Hundley says she was "disgusted" by the experience, saying she wanted more control over how her information was shared.

When she tried to fix the situation, she faced hurdles. She first checked a box on Facebook asking the site never to tell her friends about her Overstock purchases. But when she later looked over her privacy settings, she realized she also needed to check a separate box to keep the Web site from telling her friends about activities on other sites outside of Facebook.

Responding to criticism from Ms. Hundley and others, Facebook changed its privacy settings in December, making it easier to opt out of the program altogether. Still, because of the backlash, Overstock.com pulled out of the arrangement, although other retailers remain.

Jennifer King, a privacy researcher at the University of California at Berkeley, suggests several privacy-strengthening steps for people who use services like email, photo-sharing and social-networking sites that allow users to create lists of "friends." Ms. King recommends adding someone to your list of "friends" only if you really know them. She also advises considering how sharing a message, photo or personal detail online could later embarrass or harm you.

"Pretend you're sharing it with everyone at a party -- and that they're all holding video cameras," Ms. King says.

Here is a guide for some ways to take control of your information on some of these services:

On Facebook, start by clicking on the "privacy" link at the site's top right-hand corner. You can click on the links to "profile," "search" and so on to determine who can see your information. A surefire way to avoid showing information to strangers is to choose "only my friends." But if you want to hide details even from some friends, put them on what's known as a "limited profile," a bare-bones version of your profile.

To stop Facebook Beacon altogether -- as Ms. Hundley did -- click the link to the privacy page. Then click on "External Websites" and check the box labeled "Don't allow any Websites to send stories to my profile." ("Stories" are Facebook-speak for "updates about me.")

Tackling Privacy Concerns

Facebook plans to let users organize their friends into groups and choose exactly which information each group gets to see, says Chief Privacy Officer Chris Kelly. He says about 20% of Facebook users have tweaked their privacy settings in some way but declines to say what percentage has opted out of Beacon. "People have different tolerance levels, and the best way to address that is to give them more transparency about what's being shared and more control over what's being shared," he says.

News Corp.'s MySpace, like Facebook, notifies its users when one of their friends has a birthday, posts new photos or adds new information about themselves to their profiles -- though it doesn't tell users what their friends do on sites outside of MySpace, as Facebook does with Beacon. MySpace has its own privacy settings, which it details in the privacy page accessible via a link in the top right-hand corner of MySpace. The company declined to comment on privacy policies.

Review Privacy Settings

Beyond these companies, there are scores of other sites that allow users to share personal information, from photo-sharing sites like Hewlett-Packard Co.'s Snapfish to Amazon, which lets people share details with others about what they've been reading. Be sure to review your personal profile and read the sites' privacy policies.

Established Web companies like Google are also adding features to let people share their online activities with others. In December, Jonathan Rawle, a 28-year-old physics researcher in Didcot, England, logged onto Google Reader, a service that lets users keep track of new articles and blog posts and read them without leaving Google's service. The service also lets users "share" items with certain friends by clicking a button.

This time, Mr. Rawle saw a list of items that someone named Roger, who he didn't know, was sharing with him. Google had recently begun guessing who its Google Reader users' friends are, by tracking their habits in Google's instant-messaging service, Google Talk, and then automatically sharing items with those people. That meant if Mr. Rawle clicked the "share" button to send a news item to his real friends, Roger might see it, too. Mr. Rawle says he now refrains from sharing items altogether.

A Google spokesman says the company is considering adding more privacy controls, but for now, the only way to avoid sharing with a specific person is to delete that person from your address book in Google Talk. The company doesn't share the data with third-party companies.

At Sears, a spokeswoman says the purchase-tracking service -- which was available at ManageMyHome.com -- "was added to provide our customers with easy access to useful information about products they have purchased from Sears." Sears took down the feature, she says, after the company received privacy complaints.

How to Protect Your Private Information

Your life is an open book online. It doesn't have to be.

January 29, 2007; WSJ
By MICHAEL TOTTY

"On the Internet," as a New Yorker cartoon famously observed, "no one knows you're a dog." Thanks to the ease of finding personal information online, that may be the only thing about you they don't know.

Indeed, for anyone who knows where to look, your address, phone number, birth date and more are only a few clicks away. Dedicated searchers can easily turn up property records, unlisted or cellphone numbers, and even more sensitive information such as Social Security, credit-card and bank-account numbers. In Broward County, Fla., a simple search through pet licenses can in fact tell whether you're a dog -- or at least whether you have one.

It's enough to make anyone feel...exposed. Do we really want our friends, our neighbors, our colleagues -- or any stranger, for that matter -- knowing so much about us? Do we want them to know even the small stuff: where we've lived, how much we paid for our house, how old we are, how they can reach us?

For many of us, the answer is no.

The semi-good news is that our lives don't have to be quite such an easily opened book. Privacy advocates and professional investigators say people can shield at least some personal information from online snoops.

"There are things individuals can do," says Charles Wood, an information-security consultant in Sausalito, Calif. "You're going to have to work on it, it's going to take some time, and we're going to have to wait for better laws. This isn't something they need to throw their arms up about."

The semi-not-so-good news is that it may not be possible to erase completely your online traces. Many details are contained in public records, like voter lists, property records and court filings that increasingly are being placed online. Trying to keep these records private could take more time or money than many people are willing to spend.

To make sure that these documents can't be used by identity thieves or stalkers, privacy advocates are promoting legislation requiring states to remove or block out especially sensitive facts, such as Social Security or bank-account numbers that might end up in bankruptcy filings, property deeds and other public documents. For instance, after it was discovered that Florida counties had put documents online containing Social Security numbers, including that of Gov. Jeb Bush, the state adopted a law requiring counties to remove those numbers before posting documents online.

But such laws may be slow in coming, if they come at all. And they go after only a small portion of our online tracks. What follows is a guide based on recommendations from privacy advocates, investigators and others for taking control of one's online information.

KNOW THYSELF

People vary in how sensitive they are about others being able to see their personal information. Just as businesses should assess their actual risks before spending time and money on security measures, individuals need to do the same before beginning to clean up their online identity.

Some people may not care if some of the personal details of their lives are online, or they figure there aren't enough details available to worry about. For others, the risk of identity theft or the desire to limit email spam and other marketing pitches are enough reason to make some effort to get a handle on their online information. Then there are those people, such as high-profile executives or celebrities, as well as victims of domestic violence and stalkers, who may want to take stronger measures to shield their private details from online snoops.

People "really need to be clear about what they want to achieve, and the rest will be a function of that," says Mr. Wood, the security consultant.

KNOW WHAT'S OUT THERE

Privacy advocates advise those worried about identity theft to monitor their credit reports regularly. The same is true about one's online identity.

Beth Givens, the director of Privacy Rights Clearinghouse, a San Diego-based advocacy group, says most of the consumer complaints her group receives come from people who have suddenly found details about themselves during a routine online search. "People are just really shocked that anyone can sit down at a computer" and find personal information, Ms. Givens says.

Indeed, an "ego search" for one's own name on any of the popular search engines can be an eye-popping experience for most people, turning up newspaper articles, postings to Internet discussion groups, professional licenses or a passing mention in a friend's blog.

Of course, any simple search will turn up a lot of other people with the same names, especially for those with common names. Given how widespread it has become to "Google" prospective dates, the parents of children's playmates or new neighbors, it's just as worthwhile to uncover such cases of mistaken identity.

For instance, a recent Google search for my own name, "Michael Totty," mostly returned the kind of results expected for a journalist -- reprints of published articles.

But it also contained an Amazon.com profile and "wish list," which I had created for people who know me, not for the world to see. And it turned up the owner of a private airport in northern Arkansas, an English worker who was seriously injured during the construction of the Channel Tunnel and an appeals-court ruling from Tennessee concerning the case of a Michael David Totty who was convicted of theft and burglary. Will people who look me up, I wonder, think I am the Michael Totty convicted of theft? Sometimes, a mistaken identity can be as problematic as a stolen identity.

But a basic search is only a start. The Web features dozens of sites where you can hunt for personal information about people -- from addresses and phone numbers to a full background check that covers criminal and sex-offender records, bankruptcies, liens, and relatives and associates. Most of these "people search" sites charge fees for a detailed background check, but a surprising amount of personal information can be uncovered at no charge.

One of the most widely used is two-year-old ZabaSearch, a free, advertising-supported site from Zaba Inc. Type a name into its simple Google-like search box, narrow the search by state, and the site comes back with a list of names and addresses -- and in many cases phone numbers and year of birth. The site also contains paid links to services that provide more-detailed background searches for a fee.

For instance, an all-state query for "Michael Totty" turned up 50 listings, including my current and previous two addresses and phone numbers and the correct birth year. Some of the listings weren't about me, but the site found quite a bit of personal information about me that was accurate.

The spread of blogs and social-networking sites such as MySpace.com provides a treasure trove of information for snoops, and a nightmare for the privacy-conscious. Cynthia Hetherington, managing director of the corporate strategic intelligence unit of Aon Corp.'s consulting practice, advises high-profile executives on managing their online identities. She tells of a job candidate for a Wall Street investment group who was rejected after recruiters discovered comments on his wife's blog about allegations of sexual harassment at his previous employer.

COVER YOUR TRACKS

It is possible to clean up many of these online traces, but it can be a difficult and time-consuming task. And, privacy experts warn, there's no assurance that everything will be removed.

Many sites make it possible to have one's name removed from their search results, though it usually isn't easy. Intelius Inc., Bellevue, Wash., will let anyone "opt out" of the company's online people-search results by mailing or faxing a letter with the person's name and address as it appears on the site. But Intelius cautions that the request doesn't remove the person's information from its public-records database, so the person's information might reappear when Intelius refreshes its listing with new records -- requiring another request for removal.

"If you're going to ask us to suppress this information, we have to make sure you're who you say you are," says Ed Petersen, Intelius's executive vice president of sales and marketing. To that end, Intelius requires anyone requesting removal to verify his or her identity -- for instance, by faxing a copy (with the photo blacked out) of a driver's license or other government identification.

US Search, a unit of First Advantage Corp. in St. Petersburg, Fla., says on its Web site it will make "good faith efforts" to remove personal information when requested, but requires that you mail a signed letter complete with full name, email and mailing address, Social Security number and other personal details. (The Privacy Rights Clearinghouse Web site contains a comprehensive list of data brokers and their opt-out policies.)

While repeatedly removing your name from these sites can become tedious -- after all, it may involve dozens of sites -- it eventually will pay off. "This is a short-term fix, but when monitored every few months becomes effective in keeping your name out of their search engines," says Ms. Hetherington. "Getting to this point is a big win for the [person] who wishes to preserve a little privacy and avoid old college chums they'd sooner forget."

At least one service has sprung up to assist people who want to remove their names from these people-finder sites. MyPublicInfo Inc. in May began offering its IdentitySweep service, which for $4.95 a month will comb about 50 different directory sites for personal information. At the consumer's request, the Arlington, Va., company will then fill out all the required opt-out forms and will monitor the sites to make sure the information stays removed.

Chris Mueller, a marketing consultant in Northern California, signed up for the IdentitySweep service because she was worried about identity theft. Since starting the service this spring, she has used it to remove her name from a handful of online directories. "It's one of those 'sleep a little better at night' things," Ms. Mueller says.

In some cases, it pays to go directly to sites to ask that they remove personal or otherwise embarrassing information. One of Ms. Hetherington's clients, a rising investment banker who previously had been a beauty-pageant winner, found her swimsuit-competition photos in a Google search. The client sent several requests to the Web site that hosted the photos, asking to have them removed. She succeeded only after promising the site's Webmaster an autographed picture -- in an evening gown.

Removing personal information from public records can be more difficult, but states are becoming more cognizant of the easy availability of sensitive information in electronic documents. In Florida, where counties have been required for years to make official records available online, people can request to have sensitive details blacked out in posted documents. This system was in place before the law requiring counties to remove the details took effect.

GUARD YOUR INFORMATION

Most privacy advocates say the best way to shield your online identity is to avoid giving out personal information in the first place.

"Once it's out, it's impossible to rein in," says Chris Hoofnagle, senior fellow at the University of California's Berkeley Center for Law and Technology. "It can be recontextualized and used for purposes not anticipated by the individual."

This can be as simple as not signing up for supermarket loyalty cards, mailing in those ubiquitous warranty cards that come with new purchases (the information is frequently sold to marketers and ends up in online databases) or entering sweepstakes. Be especially careful about disclosing personal information in discussion groups, chat rooms or blogs. Limit exposure to spammers by not including your email address on Web sites. If you do include it, try to present it as a button or some other graphical element -- regular text can be read by automated programs ("bots") that scour the Internet looking for information.

Getting an unlisted phone number can partly shield it from prying eyes, but not completely. Unlisted numbers can still end up in online databases because marketers and investigative firms can buy unlisted numbers from outfits such as toll-free services and pizza-delivery companies. Mr. Hoofnagle also recommends that privacy-conscious consumers request that wireless and land-line phone companies not resell their calling information.

Protecting Social Security numbers is probably most important, since identity thieves can use the data to get credit under victims' names. Privacy advocates advise job hunters not to include the numbers when posting résumés online.

Mr. Hoofnagle and other privacy advocates recommend that consumers give out the numbers only for tax, credit and unemployment purposes. "There are four things you should ask when someone asks for a Social Security number," says Diane Stubbs, a private investigator in Scottsdale, Ariz. "How will you use it, how will you protect it, is it really necessary for this transaction, and what if I don't give it to you?"

Since much information comes from such common sources as property records and utility-service requests, security consultants advise those who are really serious about protecting their privacy -- high-profile businesspeople or victims of stalking or domestic abuse -- to take more-aggressive measures.

For instance, many executives and celebrities set up special land trusts that enable them to buy property and start utility service anonymously. Although typically used to shield landlords and other property owners from litigation, Ms. Hetherington and others advise clients to use land and other trusts to keep names and addresses out of public databases.

START YESTERDAY

Unfortunately, all these efforts take time to bear fruit, while information already online remains available to anyone with time, a computer and an Internet connection.

"If someone wanted to limit this kind of information," says Ms. Stubbs, the private investigator, "they should have started years ago."

AT ISSUE: SMART PHONES

Handheld devices are a security risk

Workers' remote wireless access to documents lets hackers grab data

January 6, 2008

By WAILIN WONG
CHICAGO TRIBUNE

Smart phones are poised to become the next major security challenge for businesses.

For now, a good rule of thumb for on-the-go workers is: "If you don't need to do it, don't do it," said Aaron Cohen, chief executive of the Hacker Academy, a Chicago-based firm that provides security training for companies and government agencies. Cohen warned against idly checking e-mail or opening sensitive documents on a handheld device unless it's absolutely necessary.

Security experts say that, in general, business-oriented smart phones come from the manufacturer with decent built-in safeguards, such as encryption and firewalls.

But consumer-oriented mobile phones, which have far fewer safety features, are increasingly taking on such PC-like characteristics as Wi-Fi connectivity, making them attractive to people who want to use them for work.

In a Computing Technology Industry Association survey conducted this year of 1,070 small businesses in North America, 60% of firms said they've seen an increase in the past year in security issues related to the use of handheld computing devices.

Chris Nickerson, a Denver-based security specialist at Alternative Technology, said the concern for businesses is whether these phones "will cause so much of a risk that they will eventually ... just be banned from corporate environments."

Laptops, smart phones and PDAs give employees the ability to work from home or travel far from the office, all while transporting the information they need on their mobile devices. But the increasing ease of working remotely is creating a growing set of security concerns for companies.

Workers on the go "still want access to the same data applications that they have if they're sitting at their desk in their office," said Steven Ostrowski, spokesman for the Computing Technology Industry Association. "Mobility is a great thing ..." but "every one of those individuals that's accessing the network remotely is a security risk."

So far, there haven't been any high-profile epidemics of mobile viruses like the "I love you" worm for PCs that spread rapidly around the world in 2000. But developers have demonstrated the destructive potential of such worms.

The "Cabir" virus, which first appeared in 2004, used Bluetooth technology to jump from phone to phone. Another virus, known as "Commwarrior.A," replicated itself by sending a picture or text message to people in the infected device's contacts list.

Theft is a bigger issue now.

Nickerson said he walked through an airport carrying a suitcase that contained a device that sucked up hundreds of megabytes of contact information and other personal data through unprotected Bluetooth connections.

Nickerson has used the same machine in the offices of his corporate clients. The gadget searches for Bluetooth devices for which users haven't changed the manufacturer-provided default passwords. The machine enters the default password and accesses information through the open Bluetooth connection.

"You'll be amazed," said Nickerson, who is featured in a cable TV program that follows his team as it infiltrates corporate security systems. "You'll look at this hard drive when you're done, and you'll see everything from pictures of people's families to user names and passwords and financial data."

Someone using a company laptop to send data from a nonsecure Wi-Fi hotspot could unwittingly have that information monitored. Neglecting to set new passwords on phones and other devices leaves them vulnerable. Companies also face the headache of theft or misplacement of phones, external hard drives and pen-size flash drives.

While hacking once was about bragging rights or cyber vandalism, security industry officials say profit now largely drives attacks, as the kind of information traveling over wireless networks grows in volume and value.

Terry Kurzynski, CEO at Chicago-based Halock Security Labs, said a stolen credit card with an accompanying security code can fetch at least $9, compared with $1.50 for just the number and its expiration date.

Ostrowski, of the CompTIA, said a greater emphasis on training will help companies communicate to their employees that there's a trade-off between convenience and security risks.

"Security has to come out of the IT department," Ostrowski said. "It can't be relegated to the geeks anymore. It has to be part of the corporate culture."

Passport Technology Draws Security, Privacy Concerns

ASSOCIATED PRESS
January 2, 2008

WASHINGTON -- Passport cards for Americans who travel to Canada, Mexico, Bermuda and the Caribbean will be equipped with technology that allows information on the card to be read from a distance.

The technology was approved Monday by the State Department, and privacy advocates were quick to criticize the department for not doing more to protect information on the card, which can be used by U.S. citizens instead of a passport when traveling to other countries in the Western Hemisphere.

The technology would allow the cards to be read from up to 20 feet away. This process only takes one or two seconds, said Ann Barrett, deputy assistant secretary for passport services at the State Department. The card wouldn't have to be physically swiped through a reader, as is the current process with passports.

The technology is "inherently insecure and poses threats to personal privacy, including identity theft," Ari Schwartz, of the Center for Democracy and Technology, said in a statement. Mr. Schwartz said this specific technology, called "vicinity read," is better suited for tracking inventory, not people.

The State Department said privacy protections will be built into the card. The chip on the card won't contain biographical information, Ms. Barrett said.

The card vendor -- which has yet to be decided -- will also provide sleeves for the cards that will prevent them from being read from afar, she said.

A 2004 law to strengthen border security called for a passport card that frequent border crossers could use that would be smaller and more convenient than the traditional passport. Currently, officials must swipe travelers' passports through an electronic reader at entry points.