Why I published Venmo users’ “drug” deals on Twitter
blog.usejournal.com
blog.usejournal.com
I do think people view online privacy through that same lens... We have community bubbles, that are technically public, but we feel confident speaking within them for whatever reason.
Yes people need to be more conscious of where communication take place, but it does not excuse unethical, legal, abuse of privacy.
Internet communities are not a model of real life. They're not "technically" public, they are public. If somebody walked up behind you too close you'll know and you'll know whom. There is no such thing on the internet.
So let's not pretend they are similar and instead make people always aware that they are being blasted in public. That way they will not be mistaken, or take the moral hazard of security by obscurity, and instead seek out truly secure solutions.
I think the parent is right: if we tried instead to foster a culture that respects privacy as an ethical issue first it would greatly improve everyone's experience online. Privacy should be a bedrock principle, not something that exists only as far as the strength of the personal digital fortress you can erect.
I am not blaming the victim nor tasking them with sole responsibility for privacy breaches. Instead, I'm proposing an explicit contact with what is already reality, that is, the lack of any privacy. This will do several things, one, strip away the illusion that there is privacy and the delusion that it can be protected when there are no barriers except in some people's minds; two, shift the cost-reward curve immediately (rather than through incremental or hidden breaches) toward taking action rather than not for producing the capabilities and structures that move towards your goal.
If I tell a joke, people will chuckle and it'll be on their mind for 10 seconds, and then it's gone. All I need to do to make sure no one is overhearing it is to do a quick look over my shoulder. And if someone does leak it, I'll know which 6 people it might be and I can confront them.
If I write that same joke down online, it's there forever, anyone can grab the joke any amount of time later, strip out all surrounding context, report me and have me fired from my director gig.
Our social systems were developed with the understanding that communications would persist for a minute at most. This does not translate well to online systems.
There's no stopping this fact, and with daily zero day fire drills, the defense of claiming an insecure, hacked smartphone is at fault, is essentially plausible. But it gets worse, because hacking isn't a even required step. One sketchy app installed on a phone with zero defects is enough to plausibly deny a sceenshot of a private conversation escaping into the wild. People breeze past those permissions authorizations all the time. But of course installing promiscuous app isn't even a required step, because some phones have stock apps installed at the factory, and are insecure out of the box. Or, hey, maybe they bought their phone second-hand, because phones can cost $1000 now, so knocking a hundred bucks off the sticker price isn't even unconscionable, and less technical users are clueless as ever, so they wouldn't even consider the risks.
So, no matter what, at the consumer level, truly no one is in control of how things leak, even if you choose your friends wisely. An Apple engineer can't even let his daughter look at a prototype over lunch without her accidentally instagramming the world in a moment of irrevocable error.
So, chilling effects? I mean, without question, when being deaf and mute to the point that one may as well be bound and gagged is the only cure, calling that "chilling effects" is quite the understatement.
We are moving rapidly toward a society that only thinks "happy" thoughts, for fear of the consequences oherwise. Is such a fear healthy?
And realistically, while IT crowd knows about hacks, most people dont, because such hacks are in fact rare.
However, I don't totally get the point of the public feed. The only thing I can think is that it showed new/light users that Venmo had a lot of activity and ideas for when to use Venmo (ie, if you saw a message from strangers "Payback for lunch" it would plant the seed to use Venmo for such).
- American drug laws carry some of the harshest penalties in the developed world. Civil forfeiture allows police to seize your car and home, without trial, for drug charges. 3 strikes laws can and have put many people in prison for sentences as long as 20 years, for less than an ounce of Marijuana
- once released from prison, many American ex-cons are required to pay restitution for their incarceration and can be legally discriminated against for housing, employment, and even public benefits in some states. reformed convicts cannot vote in most american states, and must file legal petition for restoration of their right to vote.
- parole terms can be extended well beyond a prisoners sentence and require years of monitoring and testing services the former convict must pay for, or be sent back to jail.
simple convictions like marijuana can result in the loss of your children, the loss of your job, and complete financial ruin.
Source: I have been incarcerated in the United States in the past.
But boy do they love watching people get locked up. What a bad approach for treating the ills of society. Let's lock people up at the drop of the hat, make it the most miserable thing possible, and then expect them to come out well adjusted and fully functional. People went to jail because they were neither of those things before hand.
But I guess as long as the prison system gets to turn a couple of bucks it makes it all worth it, right?
Looks likes this is mostly in Ohio? Apparently in the 1990's, almost all Ohio counties rolled this out. It's been being rolled back ever since. As of a few years ago, only 40 jails in the state charge these fees. Of these, the most expensive six jails charge between $50-$60 per night, 5 charge between $20-48, Some charge $1-$2 per night. $17 Ohio jails charge a booking fee only, usually $10 but up to $40.
Some California cities have a pay-for-a-nicer prison scheme, but that's not really the same thing.
https://www.prisonlegalnews.org/news/2017/may/5/missouri-pri...
(As to firing LEO's, I think the research shows that there is a pretty clear correlation between more officers and less crime. So I'm not with you on that one.)
Incidentally, if you're looking at violent crime at the state level to convince yourself that overpolicing is not a problem, you're missing out on the fact that St. Louis has the highest murder rate in the nation, and #13 in the world.
(Also: this is work of a random dude that whipped up a Python script in 2 hours, after finding the API link on Twitter. Were the police to care about those tweets, wouldn't they care about those payments before?).
I'm not sure if there is any other reasonable way of handling such problems. If I found this API link and saw this data, I should be able to report it to a government agency, and within a week, Venmo should be under threat of losing shit ton of money if they don't fix it (they should lose some over this anyway). Is there an official process that works like this? Why not?
Two things. First, you're seriously overestimating the technical acumen of "the police," on average. Second, there are all sorts of crimes that the police basically don't give a damn about but are more or less obligated to investigate if they're brought to the police's attention. You can see how zillions of people trolling one another's purchases online could lead to some tips to the police, etc. etc.
I'll counter you with anecdata: the Seattle Police Department and cannabis before it was legal in WA. They came right out and said, "it's at the bottom of our priority list." Oh, sure, they're probably still "obligated" to investigate, but writing parking tickets took priority that day, sorry.
Just like the cops are in no real hurry to investigate my missing car stereo. They might be "obligated", but that doesn't mean other things aren't ahead in the queue.
> I didn’t want to actually contribute to the problem of lack of privacy.
This reads more like "I had a funny feeling this could be wrong, but I did it anyways for internet points." How could anything on the internet possibly go viral? I couldn't take what the author said very seriously after this.
I think the fact they wrote that at all means it crossed their mind. Did they reach out to Venmo before publishing the article? I didn't see that mentioned anywhere.
> I wanted to do something creative with this to demonstrate the lack of privacy in Venmo’s default settings.
What was the goal of this? Maybe someone from Venmo would stumble across this, and start some meaningful dialogue around how...
> to get a few laughs from my friends and colleagues
Ah, right. And of course, posting this publicly on Twitter was the only way to do that?
To me, this just shows contempt for users who may not even know that Venmo defaults to public, or even understand what that means. They became fodder for a cannon the author wanted to point at Venmo. Did the author contact all those users to inform them of the implications, both of their public transactions and the little piece of performance art they created?
As an American, you are under educated about how the justice system works.
You can't be charged with crimes they can't prove. It's why comedians and public figures can openly admit to smoking weed.
Putting a weed or needle emoji in your Venmo transaction isn't going to have the DEA breaking down your door in the next hour. These people are 100% completely safe.
With all of that said, if someone is convicted due to this, they were already screwed and being actively monitored.
Also the author said he removed PII.
You certainly can be charged with any crime with or without evidence. And the way they make it stick is to offer a plea deal to avoid trial.
Can you be charged on weak evidence, or even in some cases fabricated evidence? Yes, but that's a different matter.
we have a real one. It's an easy mistake for programmers to make. We work in a world of provable absolutes that behave exactly as written.
Of course you can. All that's required is someone allege there is evidence establishing probable cause. Perhaps that so-called evidence has a perfectly innocent explanation that the person making the allegations is unaware of or choses to ignore. Perhaps the person making the allegations is mistaken. Perhaps they are even lying.
And sure, lack of evidence is grounds for getting cases thrown out. However, you need to make that case first. That requires time, representation and usually the services of a private investigator. The judge is not going to make that case for you.
Even if you get baseless charges thrown out, prosecutors are very rarely sanctioned.
The "compromise" that prosecutors arrived at was to threaten him with a massive prison sentence, and mislead him about what an Alford plea is. "We're not asking you to plead guilty, and you wont spend any time in jail! Just sign this!" My father avoided jail time but was branded a felon.
Every couple of years since I was little I'd see him spend a few thousand dollars on attorneys trying to rewrite history or fix a new fire resulting from that plea. It took the whole family 30 years, unspeakable amounts of money and a really empathetic journalist but we managed to convince the governor of Missouri to pardon him a few years ago.
A regular person who doesn't have the inhuman qualities my father does would have been ground up and destroyed. He managed to work 35 years at the same company even though a population of "vigilantes" wanted to find any reason they could to get him fired or just make him miserable.
Every once in a while he'd let a story leak about how someone had rubbed grease on his work steering wheel or we'd have to go to the DMV to get new license plates because someone managed to get past his locking screws. My dad responded to this shit in a dispassionate way that still impresses me to reflect on. Someone might break into his locker and cut up his boots. If he said anything about it, it would be like "I should have known better than to use my locker." Then he'd treat going to the shoe store like going to the post office. It's just part of the chores one deals with.
If I were in his shoes I wouldn't have made it.
What an arrogant and ignorant comment. You can absolutely have your probation or parole revoked for something like this. No conviction necessary.
Also you're wrong about PII being removed, unless you think that your photo and first name don't constitute PII (in which case, I hope you are never tasked with handling PII at your job).
Then maybe you shouldn't be PUBLICLY posting about things like this in Venmo. Good grief people - this twitter bot did nothing to expose people that a cop/PO couldn't already do using Venmo.
If you're already on parole, how about not buying drugs? I agree drug laws are ridiculous and draconian, but maybe let the people who are not on parole poke that particular hornet's nest.
Or at least, if you absolutely must buy drugs while on parole, how about not publicly announcing it on social media? You don't have to put anything in the Venmo comment field, let alone a needle emoji.
On paper it works as you described. In reality only celebrities, the well connected and those able to afford good lawyers get the full benefit of the doubt in our legal system. You or I could not do what OJ did and get away with it.
>Putting a weed or needle emoji in your Venmo transaction isn't going to have the DEA breaking down your door in the next hour. These people are 100% completely safe.
That's false equivalence. No, the DEA isn't going to do anything for a minor possession charge. What does happen is that companies bundle and sell this sort of data as "open source intelligence" and it's used all the time (as are many other things) to dig up dirt on low level people in order to make them snitch on higher level people.
>With all of that said, if someone is convicted due to this, they were already screwed and being actively monitored.
This kind of data is what makes a minor charge sticky and harder to bargain down to something that's actually reasonable (assuming the accursed has a useful lawyer at all). Nobody is getting convicted on this alone but it could be the difference between getting the prosecution to drop all drug charges or not.
>Also the author said he removed PII.
He did a piss poor job as others have mentioned. It would be easy to de-anonymyze this data set.
I am skeptical that Americans of color will not be charged for drug crimes that cannot be proven by any reasonable standard, and I am also very much afraid that if someone is brought to the police's attention like this, they will be at risk of a wrongful prosecution, or worse.
Just bringing a person of color’s name to the attention of their local law enforcement’s attention can create a risk of death in a traffic stop or no-knock search coupled with an itchy trigger finger.
It shouldn’t be like this, but as long as it is, outing drug users to the police in any way contributes to the injustice in the American “justice” system.
As an American, and one who grew up among the poor, and criminal elements of society in the "racist" deep south, I do believe you read a bit too much sensationalized news leading you to a wrong conclusion.
However, you're right, there is a dual system. A system for the rich and a system for the poor.
I believe I once read something that makes me believe that we should indeed believe there is racial disparity but I can’t find it now. Pity.
Well, logically speaking, you can't draw that conclusion.
Still testable, and I believe rejectable that race has no impact on sentencing.
As an aside: I'm a tall 30-something white male. I'm safe I'm not going to have the cops called on me with "$Action while black", and the assumption is that if I'm somewhere, I'm supposed to be there.
Which is exactly why OJ is in prison for murder.
This is far more about social class ($$$) than color. I'm not saying there aren't racial injustices at play, but I promise you that whites (and anyone else) without means are treated similarly when they get busted. Don't completely buy into the picture painted by the media.
Compound that with people disingenuousy promoting this narrative for their own political reasons, such as wanting to promote the idea that the inhumanly high incarceration rates are evidence of an inherent criminality, laziness, or both on the part of people of colour, and you get an oft-repeated explanation that should not be accepted without evidence.
It might feel like it ought to be true, but it’s not.
This burden of proof does not apply for parole violations, or civil asset forfeiture as mentioned in the OP.
Yes, you can, or no one ever would be acquitted, since that is exactly having been charged with a crime that the prosecutor then tried to, but could not, prove.
> It's why comedians and public figures can openly admit to smoking weed.
No, the reason why they can do that is a combination of statutes of limitations, decriminalization, and lack of priority for prosecution.
> Putting a weed or needle emoji in your Venmo transaction isn't going to have the DEA breaking down your door in the next hour.
True.
> These people are 100% completely safe.
Less true.
> With all of that said, if someone is convicted due to this, they were already screwed and being actively monitored.
Being actively monitored doesn't mean you are screwed, but, yes, something like pre-existing suspicion and this being a connecting piece of evidence and not the whole case is the main legal threat.
> Also the author said he removed PII.
Unless the author is ab expert in the area, there's generally a pretty big gap between deleting what seems to be PII and effective deidentification.
I think you have to much faith in the justice system. They don't have to "prove" anything. Once they arrest you, they can easily intimidate you into taking a plea and the overworked public defender won't be of much help.
Shaming Venmo into protecting their users or just raising public awareness about their policies is a great start.
I'm entirely sober, always have been. I still think this one-person campaign may have ruined innocent lives. Just because people may not understand the seriousness of a repercussion doesn't mean they should fall victim to those which are unfairly onerous; most people can't process risk the way we can.
[1] https://qz.com/376634/the-euphemisms-people-use-to-pay-their...
That's why I mentioned "many" and not "all"
But the final nail in the coffin is that simply put, 99% of the posts are from people who know it's public, don't care, and intentionally fill the description with stupidity. I can't count the number of times I've gotten venmo payments sent to me with salacious descriptions.
If you're actually breaking the law you are probably fine because far more people are just screwing around and you'll blend right in. And also, if you are breaking the law and think it's a good idea to admit that repeatedly via internet payments, maybe you aren't the brightest.
Even fake salacious descriptions stop being fun when the IRS shows up for an audit.
These tweets can't be used to convict you, but they could be used to secure a warrant and send a SWAT team into your house. Maybe they find drugs, maybe they shoot some people or pets, maybe they just scare everyone and damage your property.
> 99% of the posts are from people who know it's public, don't care, and intentionally fill the description with stupidity
How do you know that? My assumption was that payment details would not be publicly broadcast when I send money to a friend. Do you really think this assumption puts me in the bottom 1%?
Nobody is going to send a SWAT team to someone's house over a $25 Venmo transaction marked as "drugs". Not only is it not even close to nearly enough evidence for a warrant, but a SWAT team isn't going to get sent for drug possession in any case.
Being swatted is a thing, but it's not going to happen over a $25 Venmo transaction titled as "drugs". Or even one titled as "weapons". There needs to be actual intent to harm someone immediately declared. Last year's swatting was because the person claimed he "had fatally shot his father, and was holding family members at gunpoint."
Law enforcement is different than SWAT, so I won't even entertain your second anecdote except for saying in order for Interpol to get involved, they needed far more evidence than a Paypal transaction with that description.
What about do-gooders? Someone sees a transaction marked "for drugs" and they call the police because they think they are helping. This already happens to a lot of people holding cookouts, selling lemonade, cutting grass, and more.
Hardly "nobody".
Yes, by lying and saying there is a dangerous situation like a hostage. In the swatting incident from last year, they were called because the person said he "had fatally shot his father, and was holding family members at gunpoint."
SWAT gets sent out, sure. But SWAT does not get sent out for minor drug charges. They're called special weapons and tactics for a reason.
"SPOKANE, Wash. - SWAT raided a Spokane home on heroin warrant. It happened just before 11 am Friday morning at a duplex home on the corner of 4th and Altamont. Details were not immediately known but authorities on scene say they were serving a warrant related to heroin."
http://www.khq.com/story/21437261/swat-situation
How do police obtaining a warrant? In part by establishing probable cause. How is probable cause determined in the US:
"Probable cause can be based on either direct observation by the police officer, or on hearsay information provided by others."
However, I don't believe you are sincerely trying to understand my point: If probably cause can be established by, "hearsay information provided by others", Then the Venmo transaction information could result in someone being SWATed by a well intending citizen or a malicious person.
Therefore, the availability of this information on Venmo can be a contributing factor to someone having the police called on them (and the police responding). I am not sure where the hole in this logic is?
Sure they get called out for minor drug raids. For "practice." Especially in smaller locales where SWAT is needed infrequently. It's probably a bad idea, but it is what it is.
1) this information is already public - in fact he removed some of the identfying details (last name for example) 2) the twitter bot assumes the descriptions are jokes 3) none of this could be used to convict someone of a crime
Unless you have some evidence that making public information like this public in a different format, calling someone sadistic for it is something should really be apologizing for. Your past incarceration does not give you any moral authority to be making personal attacks like calling someone sadistic...
People who are using and selling drugs are criminals like any other type of criminal.
Civil forfeiture is fucked, sure, but the rest of the consequences sound pretty fair. Break the law, you pay the price. If you rob a small bank instead of Deutsche, should you get a smaller penalty? Just because it's a small quantity of drugs doesn't mean anything, it's still the same crime.
Nah, these people used blatant keywords in their public transactions. Even if you argue that they thought their transactions were private, these users chose to tag their payments with drug related keywords. If they really cared they would have encoded or obfuscated the payment descriptions.
Your ire should be directed at Venmo.
As an American, your comment is embarrassing.
Coming from cash, and finding that the world has apparently settled on venmo, has me supremely disappointed. What the hell were they thinking? Payments is not a social network. I hope venmo feels blowback for this, but I know they won't.
Can any venmo engineers comment on their ridiculous system? Do any users actually find value in sharing their drug deals (and other transactions) with the public?
My New York circles are on Apple Pay and Zelle. I just refuse to accept Venmo, by virtue of them being a PayPal company.
IMHO it's better and faster than Venmo, PayPal, or any other ones I've tried. Having the money on a virtual debit card you can spend anywhere tha accepts Apple Pay is really nice, and the bank transfers are very quick.
i.e. If you thought this or other comments I have made on Hacker News were useful, please fund my new yacht, sorry, my 'startup business' via https://paypal.me/Jaruze1 :)
Correction: the world is not limited to the USA.
I know Vemmo is an extreme example, but it's not like they don't still have that data accessible for interested parties to access. People here like to say "We're never going to give customer data over blah blah blah," but time changes everything. The information is there, and you don't know what the laws or social forces will bring tomorrow.
Either way, a good spotlight on the issues that need to be discussed.
https://www.cryptoglobe.com/latest/2018/03/mit-finds-monero-...
1. By the very nature, blockchain is public. If the wallet can verify a transaction goes from one user to another, it's not private. You can obscure all you want, but you from the way I understand it, if the system can verify itself then nothing is private.
2. Blockchains are centralized in that there is once source of information. Our current payments system is more decentralized in that Bank #1 -> Mastercard -> Stripe -> Bank #2 -> Bank #3. There are multiple parties that need to work together, and theoretically have different information collection requirements. If you need to trace money from Bank #1 to Bank #3, in theory you need multiple warrants.
Privacy requires some form of black box and trust in that black box. I'm not sure how you can remove that black box without reducing the privacy.
Yes the data is publicly available, but there are less reckless ways to raise awareness.
I assumed that the available information was first name, avatar picture and the "drug deal". From the sample tweets it looks like first name and the first letter of the last name were given, but no avatars.
It also has many, many false positives, e.g. "pills" are legitimate means of taking medication. And "Drank"? Is it likely this many people are mixing together cold syrup and grape juice or is it the past-tense of drink. Also notice that "beer" and "wine" aren't flagged (unless appearing along other flags).
This is absolutely emblematic of why we need our 4th amendment in the U.S. to prevent fishing expeditions. If governments were allowed to do this, they could ping things on many people who don't deserve it.
Still don't understand why people ever use the Public setting on Venmo, but that's another story. It's practically the opposite of Instagram, instead of looking like some rich socialite to your crew you look like someone who doesn't carry enough money for takeout.
Until one of them that went to jail or lost their lively-hood and/or family decides to ask you, "what did I owe you, that you did that to me."
Personally, I wouldn't do that for ethical and for the above mentioned reason...catching "drug users" is not my job.
This makes me gag. Don't lump this behavior in with being a software engineer.
That behavior.
> I actually don’t care for the term “bot” because it implies some sort of AI
A bot is just a regular user account dedicated to and controlled by a non-human. Script, AI, IFTTT, whatever. It's a bot.