Ars editor learns feds have his old IP addresses, full credit card numbers | Hacker News Reader

Ars editor learns feds have his old IP addresses, full credit card numbers

arstechnica.com

315 pointssinak90 comments

I was taken into a special investigation room at port of entry at Ohare Airport because I happened to live with 2 muslim roommates( both of them had mohammed in their names) for a mere matter of 2 months. I was shocked to find out that they knew where I lived, with whom ( i was not even on the lease) for past 10 years , my complete travel internaries every time I flew, all my credit cards numbers and who knows what else.

I am glad general public is waking up to this finally.

What's funny is the way the government are getting all the benefits of lots of data, but the potential efficiency benefits for end users have a habit of never materialising.

A very simple and obvious example is the administration of taxation, where the government have most of the information already, and the rest is just going through the motions.

The oddest I've seen is the US/Canada air border also improved immeasurably when they laid off loads of Canadian border staff, forcing them to come up with more efficient systems for handling the same number of people with a smaller staff. It's not what you'd call good now, but it's way better.

Ultimately I'd have less objection to the governments keeping data if I saw the benefits from them doing it. As it stands it seems it's just used for their own purposes.

> A very simple and obvious example is the administration of taxation, where the government have most of the information already, and the rest is just going through the motions.

IIRC, IRS higher-ups have talked before about wanting to do this (since it would cut down on enforcement/audit costs to just tally up everything in-house and send a bill or refund), but the current laws don't allow them to implement it.

Having a pre-filled form you could look over and send back is suggested occasionally, but seems never to pass. The nefarious explanation for why is that Intuit has good lobbyists [1], but I'm not sure how true that is.

We have pre-filled taxes in Denmark and they work fine. You have a month to look over the pre-filled forms and revise them if necessary. Although the tax system is also a lot less complex (taxes are high, but also simple). I know the IRS is doing something like that, just not giving it to you, which seems silly: I've gotten a letter before pointing out that I filled out a line incorrectly, which also told me what the IRS thought the correct value should be. I'm sure that was auto-detected by comparing something I entered with the W2 or 1099 information (I forget in which context it came up). So just pre-fill it for me, then, since you obviously already know what should go there!

[1] http://www.propublica.org/article/how-the-maker-of-turbotax-...

In Denmark we have this (prefilled forms). Both for last years taxes and a preform for nexy years taxes. Income, tax, estate, interest, stock gains, and even tax exemption for commutes and similar are all filled out.

You simply login with your "easy id" and accept or edit.

Any oustanding balance in your favour is transferred to your bank account in about a week.

Any outstanding balance in the goverments favour will either be moved to next years taxes or billed automaticly dependant on the amount.

It all works out pretty good.. Even though we pay the worlds highest taxes.. (Sales tax 25%, car tax 180%, income tax 58%..)

Edit spelling

Belgium alsof had one of the highest taxes in the world... And one of the most dificult ones, we have exceptions for everything :-(

What is an "easy id"? Not heard of that before. Is that specific to your tax records, or some kind of ID for all state services?

https://en.wikipedia.org/wiki/NemID

Looks like terrible, Java-based spyware.

I believe a new version based on JavaScript and iframes (sigh) is either out now or being deployed as we speak. Of course it sucks too (just less), but for different reasons: Recent posts on various forums have indicated that it uses something like 1MiB of JavaScript for what is basically a series of forms. The use of iframes is also kind of insane these days unless it's for branding/familiary-for-casual-users. The really weird thing is that official spokespeople have claimed that the iframe thing is for security reasons, which has me worried about what kind of security they imagine they can achieve in a compromised client. Hopefully(?!) it was just a spokesperson being ill-formed about the technical details.

> Having a pre-filled form you could look over and send back is suggested occasionally, but seems never to pass.

This is the norm in New Zealand, simplified greatly by our tax code which is inifnitely less complicated.

> The nefarious explanation for why is that Intuit has good lobbyists [1], but I'm not sure how true that is.

I've seen the topic come up on left-leaning US sites like Metafilter and it seems that in the US even nominal lefties who approve of big government are paranoid they'll miss out on their tax dodges if the IRS prepare the form for them as a first step.

Vested interests like tax preparers always lobby against the notion and talk about how it's a bad idea because they might overcharge you or whatever.

Not only that. Even the people who want to cut taxes all the time like Grover Norquist are against it. They want to make tax paying as painful as possible.

There are good reasons to want the general public to see their tax bills and be aware of the precise costs and the reasons for them.

But I can't see why we shouldn't let the government do the paperwork first and then send it to us to sanity check.

You can just decline to report the complicated parts of your income (but report the majority, so you don't look like a cheater), and IRS will fill in the parts you skipped (reported by others, banks, etc) and a and you a bill for the difference with a bit of interest added on.

It would work well for some people, but there are easily 5-7% who would get screwed due to errors, special circumstances or other things.

Even a 1% error affects over 3M people.

People already make mistakes on their own taxes. It should at least be available as an opt-in.

The problem is there's an assumption that the government data is right, and disproving their data as a taxpayer would be tough. (Fighting city hall is tough)

In the current voluntary compliance regime, a very small number of returns receive audit treatment of any kind.

A few years back I miscalculated my self-employment tax. Didn't get audited, just got a letter saying "You miscalculated and overpaid", followed by a check for the $100 or so.

The government can disagree with your return based on their data without auditing. A couple of years ago, the government told me they thought I'd under-reported my taxable income from a couple of years earlier (I had, because a place I'd worked had failed to give me a 1099). I wasn't required to undergo an audit; they just said they thought I owed this much money and I should either pay it or explain why I didn't actually owe it.

It's not required to receive an audit to get billed for more taxes than your return states. This has happened to me.

The government data is already in play, this just means that you would see what they think you owe up front.

Minor quibble, there are around 140 million tax filers in the US. 1% = 1.4 million.

Your point still stands though.

well the UK system seems to work well I got one rather complex tax situation sorted out with a single phone call.

Previous employer went bust the hard way so I had a couple of tax years where my income was up and down - I rang up got though quickly the operator on the other said ok yes your owed xxxx we can change your taxcode for most of it and for this tax year you will get a refund after the tax year end.

I was expecting to have to take lots of calls and take several months to sort out.

The more information you have the better. You could still dispute the numbers the IRS. I fail to see any downside in such a system (other than for TurboTax and CPAs)

There are millions of Muslims living in the US. If CBP detains citizens merely for living with Muslims, why aren't we flooded with stories like this?

I'm a million percent sure you shouldn't have been detained. I have zero confidence in CBP and even less in our "transportation security" regime. I'm just questioning the specific causality you've invoked.

We don't know other details about the commenter's file with CBP that could cause them to think he's suspicious.

They have limited resources, so it is well possible that only few random people will be hit and willing to talk about it. My understanding is that muslims are watched very closely.

Your understanding is that millions and millions of Americans are "watched very closely"? There are a lot of Muslim citizens.

Maybe he was living with an actual (or suspect) terrorist member?

"because I happened to live with 2 muslim roommates"

I just want to play devil's advocate for a moment; You say this nonchalantly, but that's the most important bit of your statement. If one of those two roommates were under investigation or were on some watch-list (for a valid reason or not), you should fully expect the FBI to keep tabs on those who they were living with. That would include you. Now whether they were watching your ex-roommates for a good reason is neither here nor there, but the fact remains that the FBI wouldn't be doing their jobs if they didn't keep tabs on you, someone whom they were living with.

>Now whether they were watching your ex-roommates for a good reason is neither here nor there, but the fact remains that the FBI wouldn't be doing their jobs if they didn't keep tabs on you, someone whom they were living with.

This is patently untrue surveillance state propaganda. The job of law enforcement is not to prevent any crime from ever happening by following around potential criminals or associates of possible criminals. The fact that we're even OK with there being a watchlist at all is a bit disturbing to me.

No, that is actually the job of law enforcement. That is what Bruce Schneier means when he talks about good intelligence work and good law enforcement work as protection against terrorism, as opposed to security theatre.

Or, put another way: planning to commit a crime (criminal conspiracy) is itself a crime. Being a suspect of a crime is a valid reason for law enforcement to watch someone. Associating closely with someone who's part of a conspiracy could very reasonably put you under suspicion for being part of the conspiracy (although it's not evidence against you, of course).

Of course, the lines between when people are reasonably suspected of crimes has been moved far and fast in the wrong direction and needs to be pushed back.

Yes, but friend: it matters much whether the state's deployment of ethics in the selection of potential suspects are good and just. An individual's ethnic heritage and choice of religion cannot in a free society suffice for just cause in being warrantlessly surveilled. That's what warrant means.

How do you know that the roommates did not have reasonable suspicion and warrants on them.

We don't.

But the odds are good - based on hard evidence - that the absence of warrants and reasonable suspicions makes no difference whatsoever.

makes no difference to what - your not making sense here

You can just assume that most muslims in the US are on special watch lists.

This is the comment I wrote almost a year ago: https://news.ycombinator.com/item?id=6870933

I was not aware the USA has so many information about every single travel. According to this [1] they record everything.

- amtrack

- trains in the EU (including sit numbers)

- bus travel in the EU

- plane travel in the EU on a carrier that doesn't fly to the US

- hotel reservations

- pedestrian border crossing

Everything.

[1] http://hasbrouck.org/articles/Hasbrouck-Cato-2APR2013.pdf

Thanks for the link. That's a fascinating read. Being a Muslim man, I've been stopped and questioned by CBP numerous times when entering the US. It's interesting how they they always seem to ask the same types of questions, in a seemingly friendly manner, but always glancing at the screen in front of them and carefully cross checking everything being said. Would be interesting to get a copy of my own file and see all the notes they've written about the minutiae of my life gleaned during these inquisitions.

Thanks for the link. He presents solid evidence. The inspection notes from his border crossings on the final pages are particularly chilling.

I can't find the actual inspection notes - can you tell me where to find them?

Check the last three pages of the linked PDF... pretty chilling stuff

gotta fill those exabytes somehow

http://en.wikipedia.org/wiki/Utah_Data_Center

I've been told it's so that Jack Bauer from CTU Los Angeles can protect us. But you'll have to routinely let him brake all protocols so he can do his job - it's all for own good.

Man, this last season of 24 was awful IMO. The ending was just so incredibly anticlimactic. My favorite part about it was Belchek - what a badass. All he did was blow up stuff, shoot people, kidnap the president, and make Madonna references. They even let him have the last line of the season!

The article makes it sound like OTAs and airlines are to blame for what goes into a PNR. Note that for decades the PNR was the only record of your requests to buy a ticket, change seats, meals etc. Basically think of it as a database record (in a flat database sort of way). Even in a modern environment the data in SABRE and Amadeus and Travelport (the companies that provide the massive databases for most all airlines in the world) still isn't much better than a PNR. These systems date back to the 60's. What is disturbing that the US Government apparently demanded the entire PNR before the trip. For decades PNR's were routinely deleted soon after the trip happened unless manually extended (to provide for refunds). Apparently HS insisted that the entire PNR be given to them without allowing any kind of scrubbing first. This is what is ridiculous. But people who regard your data as their personal fiefdom could care less about your security or privacy.

No, I think he has a legitimate claim that the airlines are putting too much information into the database. His credit card number should not be in the clear in the PNR database. That's just ridiculous.

This is just depressing, honestly. It is pretty clear they just want to collect all of the data "just in case" you might one day become a suspect. :/

Sadly, unless you can convince the electorate to keep kicking people out until things change...nothing will change.

This issue is bigger than just voting in new politicians. It's on the order of slavery, women's suffrage, the "trail of tears", prohibition, civil rights in the South, etc. In other words, to reign in surveillance will take enormous will on the part of the people to change deeply rooted systems of government and power that reach far beyond any single politician.

Unfortunately I don't think the people have the will to change this currently because the harm being done is so well hidden, even after Snowden's revelations.

It's hard to generate that kind of willpower in most people when you have groups like JTRIG spreading the "anybody that mentions the NSA doing something bad must be a tinfoil-hat-wearing crazy" meme and other methods[1] of breaking up "unrest".

This is why we have freedom of assembly. It is hard to get people to stand up alone in defense of an idea, but when they can see firsthand that there are other people that also want to stand up in defense a lot more people will join in.

I suspect that the primary threat we face is not about arresting unpopular groups or even information based blackmail; the threat we face is one where organization any opposition is next to impossible. You can try and conduct things offline and remind everybody that "loose lips sink ships!", but the predictive power we have discovered in data mining could make any organized opposition fall at the first tiny mistake

[1] https://firstlook.org/theintercept/2014/02/24/jtrig-manipula...

> This issue is bigger than just voting in new politicians.

If you kick out enough politicians in a Democracy, you get a completely new majority government. We need to kick out about 55% of Congress.

But aside from that you have corporations profiting from surveillance, numerous gov't employees and contractors involved, judges receiving perks and legal bribes, existing surveillance legislation and court precedent, state and local employees/contractors (from traffic cops to fusion center workers) whose work is based on surveillance data, foreign governments who do much of the same the US does, a media that has been bought off and consolidated.

Yes. And with the right laws you can reduce that to reasonable levels.

A number of those laws already exist, but are ignored or have exploitable loopholes. How do you know define reasonable assumption for getting a warrant to search someones home? If you need tangible evidence for that, then the warrant is basically pointless because you ahve what you need already.

PCI compliance for instace is clearly being violated here, as are numerous data protection acts; the issue is that nobody is accountable for it

> A number of those laws already exist, but are ignored or have exploitable loopholes.

You need to replace Congress to close loopholes. You need to replace the President & Congress to replace the Supreme Court & enforce the laws.

Seems all politics to me.

And what to do with the executive? And what do you with the legislative? Only the supreme court can be replaced by politicians.

There's no other way out than start telling people the truth. Which might start with independent media and education. But US people are already even more indoctrinated than in the 30ies with Goebbels.

Seems all press and misinformation to me.

> And what to do with the executive? And what do you with the legislative? Only the supreme court can be replaced by politicians.

Read up. :/ I already said that.

> Which might start with independent media and education. But US people are already even more indoctrinated than in the 30ies with Goebbels.

That's ridiculous.

You'll have to start by convincing the electorate that collecting all the data "just in case" is a bad thing. "If you have nothing to hide, you have nothing to fear" is a belief people actually hold about aggregation of private data.

I just wish I knew how to do that.

Unfortunately the best way may be through spreading FUD: Get people to believe that government employees are perving over pictures of their children, and attitudes will change very quickly.

Ummm, it looks like they already are, sort of:

http://www.forbes.com/sites/kashmirhill/2014/07/17/nsa-respo...

The NSA's response is basically a non-response.

> "just in case" you might one day become a suspect. :/

And as the definition of suspect continues to shift, slowly, you're becoming a target.

Well, yes. That is kind of the point.

Clearly this is not a valid system that we can tolerate.

I think that the internet is key to making the most dominant systems irrelevant which will make way for more compositional, less hierarchical, and more open, structures and systems. Theoretically those dominant systems have already demonstrated their irrelevance, we just need to make that a practical reality.

We need alternative internets in order to do that.

A more diverse information infrastructure may be key to providing not only personal privacy but also security.

> I think that the internet is key to making the most dominant systems irrelevant

That has been the rhetoric, but the practical application seems to be centralizing to one or two dominant players in a given market. From an economic perspective the frictionless nature of the internet and the limited attention span of the humans that use it seems to result in one platform outperforming all others and leads in customer acquisition fading slowly if at all.

Having alternate internets might increase the friction enough to encourage diversity; but the end users desire to use the "best" solution for their problems will probably result in these alternate internets being knit together.

In sum. There are forces at work that your solution does not address.

What forces and how do you address them?

The stubborn refusal of humans to act as though they were identical frictionless spherical humanoids of uniform density and heat transfer characteristics. And their stubborn insistence on acting like self-interested jerks who put their own comfort, well-being and survival well ahead of the interests of any of their con-specifics; much less any other animals sentient or otherwise.

"People don't like to be meddled with. We tell them what to do, what to think, don't run, don't walk. We're in their homes and in their heads and we haven't the right. We're meddlesome." -- River Tam

Does submitting a FOIA request make any of that information public?

Would I have to submit a FOIA request to all agencies to get a comprehensive list of my information?

I personally think that this should be required for private businesses as well. I would like to see all information Google, Amazon, Facebook, LinkedIn, etc has about me, I think I should have the right to know that information too.

I seem to remember that companies may be required to show you their data about you under European privacy laws (which are much stricter than in the US). There was a story a while ago of someone submitting such a request to Facebook and getting back a PDF file containing hundreds of pages.

VERY interesting...

http://nakedsecurity.sophos.com/2011/11/17/facebook-clenches...

http://bits.blogs.nytimes.com/2013/11/12/in-europe-thousands...

http://www.zdnet.com/blog/facebook/reddit-users-overwhelm-fa...

http://www.geek.com/news/facebook-stores-up-to-800-pages-of-...

We need more of this. People have the right to know. I'm sure much of this data comes from them purchasing it from other sources (companies that go out of business, LexisNexis, other "partners"). Actually I think people should also have the right to request that companies delete this data permanently, but good luck getting that bill passed.

I wonder what if the percentage of people who closed their Facebook account spiked after receiving this information.

I've built data-mining / warehousing systems for companies before, if I didn't do it they would fire me and someone else would build it. Consumer protection and privacy laws are important and lacking, just my opinion of course.

I wonder if they have a file on me, even though I don't use facebook and a lot of blocking tools. Anyone tried? Not even sure how to request the data, when you have no account .

Probably.

Friends and family install Facebook mobile app, all of their contacts are sent to facebook which includes your phone number and email addresses. More data is gathered from other random sources online. Possibly even pictures from your college or mugshots.

Just imagine the data that was taken from the people who installed that LinkedIn "send all of your email through us" app.

I've heard that Facebook create ghost profiles based on things like known contacts (contact sync by a user) of users, so probably. What they'd use that for is less clear, although I assume their legitimate reason is for making better recommendations to new users and maximising early engagement (I seem to recall they have research papers on that topic).

I submitted a request and got absolutely nothing, as if a black hole.

I never followed up after 1 or 2 months.

I wonder if the government can be fined for violation of PCI. Or perhaps the airline companies for providing it to the gov't in the first place.

As I understand it, you will only be fined contractually as part of a card acceptance agreement, so the government can't be charged.

But since the government accepts electronic payment cards ...

I'm pretty sure there's a scope to those agreements.

The airline companies will be immune to such. That's always part of the racket.

The alternative is slightly higher risk of some sort of incident? I think I'd prefer that =my= government not spy on me.

Duplicate of: https://news.ycombinator.com/item?id=8057315

Yeah I guess my title or my timing was off, this version got much more interest.

Is this not against PCI at all?

PCI isn't a law.

PCI might not be a law, but you will get large fines from who you process with, sometimes monthly!

http://www.pcistandard.com/pci-standard/card-association-fin...

Unless edited, did not suggest it was a law. It's a contractual term.

Feds not feds. Lower case is a totally different and real word. So sloppy.

Does it matter? Given the context, 99.9% of people will infer the correct meaning regardless of the capitalization.

It's so lazy and presumes all readers are speaking english as their first language.

Reply on news.ycombinator.com