Who's been using "pretexting" to get your phone records?

Back on January 8, I wrote a posting titled “Cell phone call records available online." In that post, I wrote about sites on the Internet where you can pay a fee and get the calling records for cell phones and long distance call records for land lines. The companies providing these services are typically private investigators who use “pretexting”–pretending to be the legitimate owner of the phone–in order to con phone companies into turning over the data. Some also used social engineering or exploited server security flaws to gain access to phone provider online web portals. Subsequent to the publicity around that story, there was a brief attempt to pass a law making “pretexting” illegal for telephone records as it already is for financial records. Frankly, I think unauthorized use of someone’s phone provider web portal account should already be illegal under most state computer crime statutes, and obtaining phone records through misrepresentation should constitute theft by deception or violation of identity theft statutes, but I am not a lawyer. Now, we are learning who some of the major users of these services are: various offices of the Department of Homeland Security and the Department of Justice, including the FBI; police departments in California, Colorado, Florida, Georgia, and Utah, and most likely hundreds of other police departments. These agencies are bypassing legal processes to obtain private phone records without warrants from private companies engaged in highly unethical if not illegal activity. Hat tip: Ed Brayton at Dispatches from the Culture Wars.

June 21, 2006 · 2 min

Update on Cox blocking of Craigslist

The original claim of a Cox “blacklist” originated from a statement by Tom Foremski at Silicon Valley Watcher. Foremski originally wrote: Back on February 23rd Authentium acknowledged that their software is blocking Craigslist but it still hasn’t fixed the problem, more than three months later. That’s a heck of long time to delete some text from their blacklist.Now, he says (quoted by George Ou at ZDNet): I assumed there was a blacklist - I have no idea how Craigslist is being blockedIn fact, we know now that it’s a combination of a bug in a firewall driver produced by Authentium software and unusual (but not incorrect) behavior by the Craigslist webserver setting the initial TCP window size to 0. The facts of the problem came out (at least between Craigslist, Cox, and Authentium) at the time the problem was first reported, was fixed in a beta release within weeks, and has only affected Cox customers who use Authentium’s security suite. BTW, I disagree with Richard Bennett and George Ou’s remarks which attribute the problem entirely or largely to Craigslist–the behavior of the server is not contrary to the RFC. The initial SYN packet from the client to Craigslist is responded to by Craigslist with a SYN-ACK packet with window size of zero, which means don’t send me any data, only an ACK. The client then sends an ACK (completing the three-way TCP handshake), at which point Craigslist sends an ACK packet with a larger window size which the pre-fix version of the Authentium software fails to process. The initial response of the Authentium software to slow down is a reasonable and apparently desired response by Craigslist–they want new clients to hold off transmitting data (an HTTP request) until they give the OK. Authentium took full responsibility for the problem, and they were right to do so. The story from Foremski was uncritically repeated by Matt Stoller at MyDD, Timothy Karr at Save the Internet (and a couple of other blogs), and now in a Wall Street Journal op-ed piece by Sen. Ron Wyden (D-OR), in a lapse from his normally good judgment about Internet-related matters (e.g., the Cox/Wyden Internet Freedom Act of 1995 and the Cox/Wyden Internet Tax Freedom Act of 1998). Stoller and Karr went on to repeat the “blacklist” claim even after having the full story, and I don’t believe either of them has retracted the claim that this issue is relevant to the network neutrality debate. Craig Newmark complains that he didn’t get good responsiveness from Authentium, which Authentium disputes, but he has indicated satisfaction with Cox. The story has been picked up by George Ou at ZDNet (here and here) and by Glenn Harlan Reynolds at Instapundit (here, here, and here). This issue was a user software application issue that had no more to do with network neutrality than a browser incompatibility issue, a webserver disk failure, or a fiber cut. Each of these things can prevent a user from reaching some specific content, but none is imposed by the network provider or remedied by act of Congress or the FCC. Those who continue to treat it otherwise even after knowing the details are demonstrating questionable judgment and integrity. UPDATE: Craig Newmark has now stated that there was no deliberate blocking here and the Authentium explanation is correct. I’ve exchanged a few emails with him asking whether the behavior of the Craigslist.org webserver is specifically intended to regulate the rate of new HTTP connections (and whether the behavior is coming from something like an application-layer switch negotiating the TCP handshake); he said he’s passed that on to his technical team and I’ll report here if I get confirmation or refutation on that point. One puzzling paragraph of his latest blog post is this one: One good outcome of this is that we flushed out a swiftboater (in the generic sense), and this helps me understand the way disinformation gangs operate. Unfortunately, in some blogs, a good guy has been linked with the swiftboater, which isn’t fair, and hopefully, we can do something about that.I’m not sure who he’s calling a swiftboater, who he’s calling a good guy, and who he’s calling a disinformation gang. So far as I can see, the disinformation gang in this incident has been the “Save the Internet” crowd, who still have yet to admit the clear facts of the matter. I asked for clarification, but Craig declined to identify who he’s referring to (except that he’s not referring to Matt Stoller or Timothy Karr). UPDATE: July 12, 2006: The Craigslist.org webserver has changed its behavior and no longer sends a SYN-ACK packet with a window size of 0; it now gives a window size of 4380. This change by Craigslist.org works as a fix to the Authentium issue. I wonder why they only made the change now. ...

June 20, 2006 · 4 min

Matt Stoller lies about site blocking

Matt Stoller has a post up at MyDD dated June 14 titled (with ironic accuracy) “Please lie to me about Net Neutrality” in which he gives the following as an example of unwarranted site blocking that shows the need for net neutrality regulations: There’s a pervasive myth that there has been no discrimination on the internet against content companies. That is simply untrue. For one, Craigslist has been blocked for three months from Cox customers because of security software malfunctions. ...

June 18, 2006 · 5 min

Andrew Kantor changes his mind on net neutrality

USA Today technology columnist Andrew Kantor has changed his mind, and no longer supports net neutrality regulations: Not too long ago, I was very much on their side. “Imagine you make a phone call to a friend,” I wrote then, “but instead of hearing it ring, you get a recording: We’re sorry, but the person you are calling has not paid Verizon to carry his or her conversations. But I was wrong. ...

June 16, 2006 · 2 min

Demonization of adversaries is wrong, Matt Stoller

Ed Brayton’s Dispatches from the Culture Wars has an excerpt from an article in Christianity Today by Yale Law School Professor Stephen Carter, a well-known black Christian conservative who authored the book Confessions of an Affirmative Action Baby. In the article, Carter is arguing against the common demonization of the ACLU by Christians, pointing out that while he disagrees with the ACLU on the establishment clause, they are also a big defender of the free exercise clause and have consistently supported Christians in free exercise court cases: More to the point, the ACLU is often right about the First Amendment’s free exercise clause, taking on fights that others refuse. It might surprise some critics that the ACLU defends the free speech and free exercise rights of, well, Christians.The larger point of the article, however, is to condemn the mode of argument that characterizes those who disagree as irrational, dishonest, or evil simply in virtue of that disagreement: I am more concerned about a habit of mind that seems to be growing among my fellow Christians, both political liberals and conservatives. That is, we seem to mimic the secular world’s conflation of disagreement with wickedness, as if not sharing my worldview places my critic outside the realm of rational discourse…I’ve seen similar habits expressed by people on both sides of the net neutrality debate. For example, in Matt Stoller’s presentation at the YearlyKos convention, he admits that he doesn’t understand the relevant technical issues (and proceeds to demonstrate it by suggesting that “non-neutrality” will cause dropped calls, when in fact it’s non-neutral QoS that will prevent them). He asserts that it is fun to beat up on “these bad people” and that it is very important that Mike McCurry be personally vilified. That’s explicit endorsement of irrationality, of emotional demogoguery over fact and reason, and should be condemned by everyone in this debate. Ed Brayton concludes: But rational people, people who care about truth and accuracy, must fight this tendency. We must try and evaluate every claim using the same criteria. Does the evidence support it? Are the conclusions drawn from the evidence logical? Any claim that fails to meet those criteria should be rejected, regardless of whether it supports our agenda or not. Likewise, any claim that withstands that scrutiny should be accepted as valid, regardless of whether it supports our agenda or not. None of us will ever be Mr. Spock, but we should strive to evaluate all arguments as though we have no stake in the outcome. Some, like the STACLU crowd, make no attempt at all to do so; we should not emulate them.I agree.

June 16, 2006 · 3 min

Douglas Ross's Network Neutrality Index

For those looking for a series of arguments in favor of network neutrality, blogger Douglas Ross has put together an index like mine of his postings on the subject. I’ve not read all of them, and have disagreed with most of the ones I have read (e.g., Ross thinks it’s OK to ban QoS because it can’t possibly work, even though it does work and is in use in major Internet backbones like Global Crossing’s; we had an extended exchange in response to my list of Phoenix-area broadband options). So check out his writings, and think critically. If you think he’s got some good arguments for imposing net neutrality regulations, let me know.

June 16, 2006 · 1 min

The New Republic supports net neutrality, based on error

The New Republic’s editors have come out in favor of net neutrality. As is all-too-common, their reasoning is based, at least in part, on a factual error: Under the original rules put in place in 1934, telecommunications companies can’t give preferential treatment to one set of outgoing calls over another by, say, offering static-free calling to one company’s telemarketers but not another’s. The same rules initially applied to the Internet. Telecom companies couldn’t charge website proprietors to have their content sent to consumers more expeditiously. But, last August, George W. Bush’s Federal Communications Commission (FCC) exempted telecoms that provide Internet connections from these restrictions, dealing a blow to both entrepreneurship and political discourse.I’ve italicized the false statement. TNR has, like many others, wrongly inferred that rules which applied solely to telco telephony and last-mile networks have also applied to the Internet and Internet Service Providers, when in fact ISPs and backbone providers have been under no such constraints. If net neutrality proposals were limited to maintaining Title II requirements for unbundling and interconnection for common carriers (which is part of the REFORM proposal advocated by Global Crossing, which includes other points which are far more important than net neutrality for fostering competition in telecommunications), or even adding cable providers into that category, I might support them. UPDATE: I should point out that some Internet backbones have been or are owned by entities which are common carriers in virtue of the fact that they have owned and operated long-distance telephone networks. This includes MCI, Sprint, and Global Crossing (more accurately, Global Crossing Telecommunications, Inc.). However, the FCC has always held that common carriage requirements do not apply to Internet interconnection. Eli M. Noam’s 1994 paper, “Beyond Liberalization II: The Impending Doom of Common Carriage," appears to have been rather prescient. He argues that common carriage is not sustainable in a competitive environment, and looks at possible hybrid approaches that mix common carriage and contract carriage (I kind of like his “common carrier rights of way” approach, which advocates of open source will find similar to the GPL). He regretfully concludes that common carriage will go away and that the hybrid approaches are not sustainable.

June 15, 2006 · 2 min

"Hands Off the Internet" writes about me, then thinks better of it

On June 9, the Hands Off the Internet blog posted an entry (http://handsoff.org/tiered-service/turf-battle/) about one of my posts, but it was deleted by June 10. I wonder if they noticed my Creative Commons license, considered their use to be commercial, and decided not to risk a violation? In my opinion, their excerpt would be fine under fair use. Here’s the post, from Google cache. Turf Battle June 9, 2006 at 9:21 am - Tiered Service, Net Neutrality, Debate, Internet Legislation, Consumer Benefit ...

June 15, 2006 · 3 min

CBS protests $3.3 million FCC fine against "Without a Trace"

The FCC levied a record-breaking $3.3 million fine against 103 CBS affiliates for airing a repeat episode of “Without a Trace” on December 31, 2004, before 10 p.m. which involved “a simulated group sex scene at a high school party.” CBS has protested on the grounds that all 4,211 complaints were submitted via the Parents Television Council and American Family Affiliation websites, and only two complaints referred to actually seeing the offending scene. (Remember, the FCC is the organization net neutrality advocates want to give the power to regulate content. The power to mandate content will no doubt bring along the power to prohibit content.)

June 15, 2006 · 1 min

Bennett on Free Press net neutrality "facts"

Richard Bennett at the Original Blog has criticized Free Press’s list of network neutrality facts, arguing that most of them are fictions, e.g.: PSEUDO-FACT #1: Network Neutrality protections have existed for the entire history of the Internet. REAL FACT: Actually, there is no legal precedent at all for the anti-QoS provision of the Neutrality regulations, and many commercial Internet customers use QoS today. Even the Internet2 Abilene network tried to use it. ...

June 13, 2006 · 3 min
Mastodon Verification