Report Reveals Wider Tracking of Mail in U.S | Hacker News Reader

Report Reveals Wider Tracking of Mail in U.S

nytimes.com

141 pointsghosh49 comments

This is a great example of growing executive power at the expense of a company's (in this case the USPS's) credibility. Across most industries, technology and tracking are used to make businesses run more efficiently and provide better services. That's great and definitely adds value.

However, law enforcement seems to think that now that companies are collecting all this data, they should have access to it, too, without restriction. The problem is that once these sorts of programs become common knowledge, the companies start being viewed as just an arm of law enforcement. Do you trust the local police? FBI? NSA?

No? Then don't trust these companies.

The solution to this is not to stop the mail tracking (tracking numbers are an awesome feature), but to curtail the reach and powers of the executive. Law enforcement shouldn't be able to request whatever they want from these company datasets.

So how do you fix it?

First, the business records laws on which these data requests rely are incredibly antiquated and not meant for huge networks of communications. So a solution is to update these laws to better protect user tracking data when it is in the hands of a company. However, Congress doesn't seem to want to do anything, so the legislative branch is losing power more and more.

Second, the judicial branch could step in and rule that these searches are protected under the Fourth Amendment. However, the executive has been claiming privileged on most of these cases, which means they get dragged on for years and years. Kudos to the EFF and ACLU for sticking it out, but the judicial branch is simply not keeping up with executive power grabs.

Third, users of the companies can start fuzzing or encrypting their data. In this article, a solution could be for someone to offer an aggregated address to which people can send letters. It's basically a manual VPN or onion-routing technique. Unfortunately, this tactic is very difficult to hide all metadata, so I'd prefer the first two options over asking users to fuzz their data.

Disclosure: I volunteer for Restore the Fourth, which is a 501(c)(4) organization advocating for greater barriers to warrantless or broad surveillance. We are currently focusing on getting local cities to pass privacy policies that limit what data local law enforcement can gather and share.

EDIT: I realize that the USPS is a part of the government, but it is not an arm of law enforcement. It should still require a warrant to obtain user tracking data from the USPS just like any other business.

Not that it invalidates your point, but USPS is not a company - it's an agency of the federal government, with weird financial implications. There are a lot of things wrong with how the USPS is run, IMO - and this is just one more reason I do not use them for anything other than sending in my ballots or taxes.

Isn't it an independent agency of the government? Maybe there's no difference, but it seems that the definition of "independent" means "exist outside of the federal executive departments ... agencies that, while constitutionally part of the executive branch, are independent of presidential control"

Or is the USPS a special case?

It is and it isn't a separate company. It's a GSE - Government Sponsored Enterprise. Think of it as a perpetual charter to engage in a specific business on behalf of the government.

Sounds very similar to Crown Corporations here in Canada; they're not private enterprises, but not government agencies either. Kind like a private corporation who's owners are the government - with corporate fiduciary responsibility legally binding owners and management from stepping on each other's toes.

They are also granted a monopoly on delivery of mail to your house mailbox.

UPS & FedEx can't deliver to private mailboxes in the US? What about private newspaper delivery?

That's correct.

The flip side is, UPS and FedEx can refuse to deliver to certain addresses. The USPS can't.

The flip side of that is, you can't refuse the USPS. Everything I care about comes to me electronically or through a parcel service, I only need USPS a couple of times a year (USG stuff like DL renewal). Even so, I need to collect my junk mail at least twice a week - because if I don't the box will fill up, they'll leave a threatening note about returning future mail to sender, and I'll have to pick up the stack at the local post office. I've done that a few times now. Its always funny how when I get there to pickup the volume of mail that was too large to fit in the mailbox - there are only a couple of official looking envelopes that turn out to be junk mail. The workers obviously recognize the fact that I don't want three copies of "The Penny Saver", and they don't want to waste space in the PO warehousing it. The incentives are way off in this system. They get paid to move junk mail and I am forced to accept it.

tldr; I hate junk mail and will scream into the void about it.

I get junk mail from the USPS about how to send junk mail via the USPS. ("We'll deliver to every mailbox in the zip code, you don't have to even address the junk!")

I guess they have to make money somehow.

USPS and FedEx are nice, but are more expensive than the USPS. And there's that whole rain, snow, sleet, or hail thing.

A couple of years ago, I was an operations analyst - my employer used USPS to deliver millions of DVDs... USPS completely depends on bulk shipping and they'll happily provide product packaging at all scales - down to the carrier route level. Urban areas get hit pretty bad, due to population density - bulk shippers get more bang for the buck. Ideally, from the postal customer's perspective, shipping costs would rise for shippers who can only address shipments to "Current resident of:" or "Our friend at:". Proof of work, like hashcash. But of course the incentive system is the direct opposite, the recipients are not the customer.

In the US only items bearing USPS postage may be placed in mailboxes. Many pre-built mailboxes have a separate open receptacle for newspapers etc. FedEx and UPS generally deliver to the doorstep, even for envelopes.

There are actually laws written to prevent anyone but the government delivering "letters or packets" under penalty of fine or seizure: http://www.law.cornell.edu/uscode/text/18/1696. I don't know recall details or the outcome, but I recall a few years ago it was up in the air whether you could send documents legally with private services, or if there were fundamental differences between USPS and "courier" services.

In my area, some people have a separate "mailbox" for newspaper delivery, clearly marked.

Also known as Quangos in the British system (Quasi-NGO).

Yeah it's a weird relationship and I don't understand the nuances, but my point is that using USPS for surveillance is a very different dynamic than using FedEx or UPS for surveillance.

The USPS has been tracking mail in this way for well over a hundred years. Why should we see this as a problem to be fixed now, as opposed to 100 years ago?

Why haven't we seen any benefits from this hundred years of dragnet surveillance? I get all kinds of creepy junk mail, obviously sketchy load offers, someone who very carefully offers to remind me to renew my domain name for a sumptuous fee, stuff like that. Why doesn't the TLA in charge of this data shut stuff down? The FBI might have been able to avert the 2008 financial crisis by intercepting subprime mortgage offers, and prosecuting the hell out of the shady mortgage vendors. Terrorism can't hold a candle to the damage that the 2008 financial crisis did to the USA.

You raise an interesting question. I would love to be able to refuse delivery of postal spam (as you can in the Netherlands, where almost everyone has a sticker on their mail box saying whether or not they accept unsolicited commercial communications addressed to a generic 'resident', and commercial communications addressed to them personally).

It turns out that you do have a right to prevent delivery of junk mail, thanks to a 1970 court case called Rowan c. Post Office Department (http://scholar.google.com/scholar_case?case=3558098989148411...). In fact, you can download a form 1500 from the US postal service toput this into effect....but you have to do it for each sender of mail, and the form requires you to affirm that you find the amterial 'erotically arousing or sexually provocative,' even though the holding in Rowan is not limited to such cases. Right now the Postal Service redirects consumers to the FTC for help with getting off mailing lists - presumably because a) it does not want the additional hassle and expense of presorting and not delivering junk mail and b) because the Postal Service is famously under financial pressure and the delivery of bulk mail provides a huge chunk of its revenue - bulk mail makes up roughly half of all mail delivered and about 1/3 of USPS revenues (as of 2011 - http://stateimpact.npr.org/new-hampshire/2011/09/27/how-junk...).

I can think of a strategy for forcing the USPS to let consumers opt out of receiving junk mail, but it would involve some expensive and protracted litigation and would likely drive the price of first-class mail up to $1 if implemented, so it would generate a great deal of political opposition. I have not done in-depth research on the legality of the USPS dumping this problem into the lap of the FTC, so my impression that the USPS could be compelled not to deliver junk mail in the first place may be incorrect.

A while back on HN, there was an article about private mail filtering services. You would have your ground mail sent to them, they would get rid of the junk mail and send you only the "good stuff" that you specified.

(Anecdotal) Well, these guys had a meeting with Postal Inspector who didn't think much of what they were doing. When informed that it was a voluntary service, he pretty bluntly informed them that it would upset the 400 or so of his (the Postal Inspector's) largest customers.

Upshot, the Postal Service has a vested interested in you receiving junk mail because they are paid to deliver it, and woe betide anyone who interrupts that.

Agreed, hence my comments about it requiring expensive litigation.

I'm not really that concerned about junk mail per se: a lot of it is just stupid ads. I'm concerned that the US government has had the capability of dealing with predatory companies for a while (100 years?!?) and hasn't done anything about predatory lending or other obviously fraudulent postal mail schemes. It's like funding the NSA's all-phone-traffic dragnet and still having to suffer through obviously illegal "Rachel From Cardholder Services" calls. A monumental waste of taxpayer money.

I'd like a much more muscular FTC/CFPB but then I'm a paternalist statist Euro.

perhaps because if it was the only data they had 100 years ago, it could not be called privacy invasion... but when combined with everything else...

And who builds the sorting systems for the USPS? The largest defense contractor, Lockheed Martin: http://www.washingtonpost.com/wp-dyn/content/article/2006/08...

Dun dun dun...

Someone should figure out what law enforcers are and aren't allowed to do as part of their investigations. They should figure out what people's rights are.

Then, they should write it down on a piece of velum. Maybe some more people could sign it.

50000 requests for "mail metadata", no warrant required? You'd like to know just what dangerous crimes were solved with those pieces of data.

Pmg Donahoe says systems don't store address info long term (>30 days) and are not linked nationwide

They ask us how to monitize last mile or get new revenue. I suggested giving patrons data on what pieces went through sorters. Have a table view where you see letters processed that day. You could know what will be in your mailbox. You could see history of when stuff gets mailed to you. So many possibilities.

USPS really has no profit thinking mindset whatsoever. Coming from telecom it's polar opposite.

If bed bath & beyond mails a $5 coupon, ad space on the patrons table view could be sold to linens n things or Wally (like my online bank transactions). This is just the beginning

We know (without any help from electrons) who gets arrested, where they work, car they drive, marital status, divorced or about to be, kids, age, political involvement, Prime customer, when they are home and when they are not, animal lover, catalogue orderer/receiver, has parents at home, previous city, tax bill, Cable/telco/direct tv, lawn service/snow removal, ultra rich and ultra poor. We see changes first too, often before they even tell other family members.

Imagine a good analyst having at it with just the to/from addresses / names.

The USPS has no clue, not even a crumb of a clue, how valuable letters, flats and parcels are to a company who wants to acquire new customers.

Ahh.. oh well..

By the way, the USPS takes no taxpayer money...

every piece of mail in the United States is tracked. Every package, every envelope.

And photographed.

http://www.nytimes.com/2013/08/03/us/postal-service-confirms...

Of course, they have to detect your address with a computer.

We be living in the Soviet Union now.

I tweeted this link and mentioned "uptown" and @HackerNews. thank you for this link, upvote.

But you can still drop a letter into a public mailbox, with no return address. Then only the recipient is tracked.

This will be a distant memory once the USPS declares that it's only going to accept eStamps from registered accounts. There will be a cross-platform app, though, so this change will be proclaimed by all media outlets to clearly be superior to all legacy solutions, and a sign of agile, efficient government.

Just assume that everything you do in the U.S., anywhere, is being watched or tracked in some way.

It would be patriotic to turn ourselves in for pre-thought-crime, or rather just continue to vote with the status quo and keep our heads down.

This article might be a good rebuttal to claims that totally insecure writing on some paper might somehow be more secure than encryption.

Given recent NSA revelations, could good old fashioned sealed envelopes might be more secure than encryption? I wonder if they have a smart, undetectable way of getting into the mail contents itself.

Before the electronic age, the FBI, CIA and their predecessors would regularly do that. The skills needed to do so without detection might be rare these days (as people retire).

Just wait until some terrorists use only mail to prepare an attack. Then probably every piece of mail will be read to protect us.

Like the anthrax that was sent through the mail starting about a week after 9/11? The attacks killed five people in the US.

http://en.wikipedia.org/wiki/2001_anthrax_attacks

Reading those letters wouldn't have prevented the attacks. I am talking about people avoiding E-mail or phone and exclusively using mail to coordinate attacks.

Reading those letters would have killed some postal workers instead of the intended targets.

Kettle or bamboo splint. You use the kettle to steam open the letter. You use the split bamboo splint to roll up the contents of the letter and then pull the rolled up contents through the gap above the place the glue starts. I suspect that pressure sensitive glue is making the kettle technique less popular. Not to worry; envelopes with pressure sensitive glue tend to have wide gaps.

If you mess up then you very carefully copy the writing on the old envelope onto a new envelope and recreate any postmarks (if required). Even if you do a terrible job it is unlikely that anyone will notice.

If you somehow make it really obvious that the contents have been tampered with then you simply keep the letter or make it look like the sorting machines destroyed it. Then the post office gets blamed for the wrong thing.

steam it, open the seal gently, and reseal it?

open it destructively and make a new envelope? this is probably the easiest option for a 3-letter agency.

soak it in a liquid that doesn't dissolve the ink, photograph the layers of text, and decipher it later?

shine a really bright light on it, using a color that isn't well absorbed by the paper but is absorbed by the ink?

If there's a way to harden paper mail against even a moderately prepared adversary I'm totally interested in learning about it...

Something like this maybe:

http://www.wired.com/2013/12/better-data-security-nail-polis...

Or mail a postcard with a message encrypted by one-time-pad.

It's called a "tracking number" for a reason.

There is a difference between the USPS tracking mail to ensure it does not get lost and the USPS giving that information to the FBI or other law enforcement agencies.

I wonder if the mail tracking data is sold to credit reporting agencies. Oh look he got an old fashioned paper bill from his water utility, and then he replied with a letter (payment) from the mailbox across the street exactly 3 days later. How fascinating and presumably useful as a metric, somehow.

Marketing agencies would likely be interested. Oh look he's exchanging correspondence with a known estate lawyer, someone must have died, how can we profit off that?

I suppose interesting environmental studies could be possible, since at least 90% of my incoming paper mail is garbage.

Big Brother doesn't throw away things very often, all CYA you know. I bet a century from now looking at the social network of old fashioned paper Christmas Cards would be interesting genealogy research. (edited to add: Mothers day cards!)

Reply on news.ycombinator.com