The Ultimate Surveillance Team: Microsoft + Police

April 8, 2005 7:55 AM

Microsoft collaborates with the Department of Homeland Security, Interpol, and the Canadian Mounties to produce the ultimate people-tracking database, mining email aliases, "chat room" logs, and arrest records. This open-source software developed by MS Canada will be given away free to police departments, says the company. "The initiative was the result of a January 2003 e-mail sent to Microsoft Chairman Bill Gates from a member of the Toronto Police Service sex-crimes unit, asking for help in battling child pornography," reports the Seattle Times. "The billionaire, known for his philanthropy in the area of AIDS research and education, called on Microsoft Canada to develop software that would aid police officials." Buried in the enthusiastic accounts of how the Child Exploitation Tracking System (CETS) will nail "child sex fiends" is any consideration of how such a system could -- and will undoubtedly someday -- be used against such lesser offenses as drug use, sharing illegal music files, or discussion of political beliefs that could be construed as supporting "terrorism."
posted by digaman (36 comments total)

Also buried is the fact that, while no one disputes that the Internet has contributed to the spread of images that exploit children -- just as it has contributed to the spread of any other kind of information that can be proliferated digitally -- there is no solid evidence that child abuse itself has increased because of the Net. In 2001, the director of the Crimes Against Children Research Center, funded by the Department of Justice, told me, "There is no evidence that the Internet is fueling an explosion of child sexual abuse." He added that "pornography is not one of the major causal factors" in the abuse of kids. [Sorry for the self-link, but it's an important quote -- scroll down or search for "Finkelhor."]
posted by digaman at 8:05 AM on April 8, 2005

Unless you're really sloppy or stupid, this won't make it easier to find you. Most free web services (google, yahoo, hotmail et al.) don't ask for ID. If you do anything that can be considered unseemly, invent a new web identity for it and don't ever use your real name with it. If you're being really naughty, the authorities will probably get you via your IP address anyway.

To simplify-- if you're worth noticing, this database won't do anything except maybe make it easier to tack on additional charges.
posted by Mayor Curley at 8:13 AM on April 8, 2005

Mayor Curley, you should really read the Wired link I posted to avoid over-simplifying. When the crime is possession of child porn, a single glance at an illegal image -- even if you never downloaded it and cleaned your cache immediately -- is enough to make you "worth noticing" by law enforcement, to the tune of years in jail. As an FBI agent emeritus put it succinctly in that article: "One click, you're guilty."

But the much more important point, and the reason I posted, is that surveillance mechanisms and protocols, once deployed, are inevitably subject to "mission creep," enabled by a credulous media hyping the porn angle. "The software programme has been exclusively designed to police the Internet where millions of sexually explicit pictures of children are posted on a daily basis," writes Harish Dugh of the Financial Express. Yes, CETS will only be used to "exclusively" police that part of the Internet, I'm sure. And not even the FBI would claim that "millions" of new exploitative images are posted every day, but when the subject is porn, factchecking goes out the window.
posted by digaman at 8:33 AM on April 8, 2005

1. Invent a "big brother" database to monitor all net traffic (including email, although it's probably denied)
2. Claim it exists to catch child molesters
3. Profit!

Trust me, the group most enthusiastic about this creepy database is the DEA...
posted by clevershark at 8:36 AM on April 8, 2005

A Slashdot member makes another interesting point: "Think about the uses to which you can put that underlying code, which is now all open source. now imagine what will happen when someone takes this open source code and perverts it into a complete ID theft tool. what will the M$ press release look like then?"
posted by digaman at 8:55 AM on April 8, 2005

Mayor Curley, you should really read the Wired link I posted to avoid over-simplifying. When the crime is possession of child porn, a single glance at an illegal image -- even if you never downloaded it and cleaned your cache immediately -- is enough to make you "worth noticing" by law enforcement, to the tune of years in jail.

I'm not for a second suggesting that "one click and you're guilty" isn't draconian and wrong. I'm just arguing that these folks could have been caught without the database that is the crux of your post. From the Wired article that you pointed me to:

Many joined the group with standard-issue webmail addresses that contained their names, dates of birth, or clues to their location — such as the "rsa" in Vaughn's address, which stood for Redstone Arsenal. These netsurfers may have comprised the largest "international ring of predators and pedophiles" ever discovered, but they were also among the least cautious. They practically emailed themselves to prison.

If Vaughn has signed up for fresh email account before joining the group and wasn't candid about his personal info, he wouldn't have been so accessible-- catching him would have required that Yahoo! disclose the IP address from whence he accessed their servers, and then Vaughn's ISP disclosing to whom the IP number was assigned at the time it was used for illegal purposes. So the database would have been useless if he hadn't been so careless.

This isn't to suggest that I have any sympathy for the guy-- he's revolting for joining a kid porn community. I just don't think the database makes the Internet any more threatening for anyone who makes an effort.
posted by Mayor Curley at 8:59 AM on April 8, 2005

The answer is simple and obvious: buy a Mac.
posted by Rothko at 9:08 AM on April 8, 2005

the answer is simple and obvious: buy a mac.

Oh no! This is going to end badly.
--Mac OS 9 user
posted by a_day_late at 9:26 AM on April 8, 2005

Mayor Curley, Yahoo did disclose the IP addresses, and then an FBI agent testified in court that IP addresses "are like Social Security numbers" -- i.e., traceable to single individuals. That trial ended in the conviction of two teenagers for possession of illegal images, with no hint of other misconduct or offenses against minors, and they are currently serving long sentences in Texas prisons. And the free Yahoo group that Vaughn joined didn't say anything about porn on its front door, as I pointed out in the article. All it said was, "This is a site for people who love kids." Creepy, yes -- IF you knew, via telepathy, what was behind the door.

But I do not want to participate in a debate about Vaughn, or even about porn, though feel free of course. I'm interested in how prosecution of porn-traders is used as a battering ram to push through levels of surveillance that the public would never accept otherwise.
posted by digaman at 9:30 AM on April 8, 2005

this is a dumb sensationalist post. it states the software "tracks" people and "mines" email aliases, chatroom logs and police reports but the articles say NO SUCH THING. basically this sounds to me like a centralized database of investigative data which police agencies can use to correlate and look for links between data reported by other agencies. ho hum. can you say NCIC? shoddy microsoft PR and techno-worshiping blather by computer-ignorant cops. what crap.
posted by quonsar at 9:30 AM on April 8, 2005

And here all along I thought Interpol just made records that sounded too much like Joy Division... Wow! Those guys are busy!
posted by aether1 at 9:40 AM on April 8, 2005

You're skimming again, quonsar, but I understand -- it's a busy world.

"Other shared details include credit-card information, e-mail 'buddy' lists and aliases... As well, CETS contains an in-house resource library of case law, court proceedings, search warrants and such data as emerging trends."

"track down child porn traffickers by enabling authorities for the first time to link information such as credit card purchases, Internet chat room messages and arrest records..."

etc.
posted by digaman at 9:44 AM on April 8, 2005

I'm interested in how prosecution of porn-traders is used as a battering ram to push through levels of surveillance that the public would never accept otherwise.

Digaman, there's not much sympathy for people who consume child porn, and Americans would be happy to give away their freedoms to track down said folks.

Further, Congress happily adds riders to bills on the sly, every day, which whittle away our freedoms, one degree at a time, under the name of "reasonable" intrusions. Profitable collusion between big business and government to this end is nothing new; Oracle was happily pushing a federal ID database after 9/11, and military and security contractors stock rose on news of "pressing needs" to lock down the homeland. It is no secret why DHS chose Microsoft as a software vendor when the two work together tightly to open up access to private, individual data.

Your better long-term bet would be to focus on the egregious abuses of the PATRIOT Act, to name one example, that intrude on the lives of those who have nothing to do with terrorism. Or the TSA, which has done nothing to improve transportation security despite the many abuses it allows (unreasonable search and seizure, physical molestation, theft, etc.). Even the recent Best Buy story highlights the kind of abuse perpetrated in the name of 9/11 that most reasonable people would agree is shameful.
posted by Rothko at 10:03 AM on April 8, 2005

I like how every software used to help find criminals will "undoubtedly someday" be used to find FILE SHARERS and DEMOCRATS. Way to be a sensationalist.
posted by jbeaumont at 10:06 AM on April 8, 2005

I have less problems with the police trying to enforce these laws, and a hell of a lot more problems with Canada's government doing ANYTHING in partnership with the hell-spawn that is USA's "homeland security". Uggh...
posted by shepd at 10:12 AM on April 8, 2005

I like how every software used to help find criminals will "undoubtedly someday" be used to find FILE SHARERS and DEMOCRATS. Way to be a sensationalist.

Just wait until they come for you, when the security cameras show you're not hanging the American flag outside your house at the right angle, or your voting records show you failed to select the correct right-wing candidate. When your government stays up late to pass abusive legislation on the sly, or attaches riders to bills in the name of catching child molesters or other bugbears of a decent Judeo-Christian society, you may not even know you're breaking these laws until it is too late.
posted by Rothko at 10:16 AM on April 8, 2005

jbeaumont, I'll let your equation of Democrats and "terrorists" speak for itself, but federal judge Denny Chin was highly aware of the danger of law-enforcement overreaching when he later threw out one of the warrants in the investigation I covered in my article saying, "Thousands of individuals would be subject to search, their homes invaded and their property seized, in one fell swoop, even though their only activity consisted of entering an e-mail address into a Web site from a computer located in the confines of their own home," and criticizing the FBI for "reckless disregard for the truth" by including statements known to be false in hundreds of search warrants. [PDF link to Chin's decision.]
posted by digaman at 10:21 AM on April 8, 2005

How is this open source? Nowhere does Microsoft call it open source - neither in their information page or their press release. The only people calling it open source are the Seattle Times...
posted by LukeyBoy at 10:33 AM on April 8, 2005

How is this open source?

Dude, I saw it on Sourceforge. But they're calling it "VirtualDubya" now.
posted by Mayor Curley at 10:38 AM on April 8, 2005

And Wired News, and a bunch of other news organizations.
posted by digaman at 10:38 AM on April 8, 2005

Wait, so let me get this straight: MicroSoft is able to follow people's email trail and Bill Gates is giving out checks to people who forward a certain email to as many people as they know? Awesome!
posted by papercake at 10:51 AM on April 8, 2005

The big question is: what's the defense?
If the cops wanted to frame you by say planting marijuana on you you could ask for a blood or other chemical test, etc. bring forward character witnesses, and so forth and have a chance of proving you don't use it. (Obviously many times marijana users are framed this way so even though they weren't holding it at the time...)

But in this case there is no way to disprove you are a threat or pervert , etc. The police have only to take your machine, plant an image there, and say they found it there.
Even a casual 'netsurfers logs over the years would be vast. You would have to sort through them to show you had not talked to anyone trading porn or visited sites, etc.

(In the future we'll all be pedophiles or terrorists in the govts. eyes)

I see no problem with nailing the bastards who make money off this filth, but where is the line drawn?
So you send Gramma a couple photos of her grandkids in the tub - bang! 40 years in jail.
Fetish fantasy? Not any more pal, now it's a criminal act to pretend your seducing a cheerleader (who happens to be your wife at work).
What if its CGI? What if it's a hand drawing? What if it's written material?
What about extradition? What if China doesn't like some guy chatting with one of their folks? And vice versa? Do we start sending American citizens off to be tortured by some third world....oh,wait, we already do that.
Seriously though, from what I understand from certain folks who attack sites like those, credit card companies opposed this for years. And that seems to be the only worthwhile way to fight this. At least the net part of it. Most of the perverts abuse someone close to them so it needs to be destigmatized in the reporting much as rape was. Rape statistics seemed to go up for a while, but it was only the reports that increased because services and understanding increased.
Same thing needs to happen here. Focusing on policing the 'net for this is like focusing on solving only the violent crimes committed by left handed men using .22 caliber pistols. It's the environment that has to change, not the policing methods.
posted by Smedleyman at 12:11 PM on April 8, 2005

BTW - spellcheck doesn't work here with the MAC I'm using.
posted by Smedleyman at 12:11 PM on April 8, 2005

I wonder if there is any surveillance/spy/bigbro technology that wouldn't be heartily welcomed by most as long as some authority figure claimed that it was to be used to catch "child pornographers".
posted by telstar at 12:20 PM on April 8, 2005

I like how every software used to help find criminals will "undoubtedly someday" be used to find FILE SHARERS and DEMOCRATS. Way to be a sensationalist.

What's to prevent the software from being used, for example, to hunt down pro-democracy people in China?

the US isn't the only country in the world.
posted by delmoi at 12:28 PM on April 8, 2005

You're skimming again, quonsar

you're sensationalising digiman.

"Other shared details include credit-card information, e-mail 'buddy' lists and aliases... As well, CETS contains an in-house resource library of case law, court proceedings, search warrants and such data as emerging trends."

"track down child porn traffickers by enabling authorities for the first time to link information such as credit card purchases, Internet chat room messages and arrest records..."

shared details. a common feature of centralized databases. nowhere in your quotes does it say what you said in the post - or what is repeatedly implied in the breathless articles - that the software "tracks" or "mines" - giving the impression that the code somehow goes out onto the net and combs logs pulling discrete data together in some new and wondrous manner, practically delivering child pronographers into the hands of the police with the push of a button. no. it's a database. cops from all over the place are going to feed it what they know. this enables links and commonalities to become apparent. yawn. cops have to know something first before they feed it. it doesn't find things out for the cops beyond links in their own data. its a fairly common use of computers. i fail to see how it threatens me anymore than the fingerprint/DNA database, or NCIC, or the IRS, etc etc etc.
posted by quonsar at 12:31 PM on April 8, 2005

Smedleyman, you're quite right. And the good news is, when I interviewed David Finkelhor, he told me that rates of abuse against children had gone down in the previous ten years, which he attributed to better education, better support systems for teen parents, and more aggressive prosecution of actual abusers.

Note: This flies in the face of a million news stories and public pronouncements by officials who declare with confidence that the increase of exploitative images of the Web has triggered a tsunami of abuse.

What has happened in the last decade or so -- virtually unnoticed by the media -- is that law-enforcement efforts have shifted from targeting the producers of these images to prosecuting end-users, most of whom are small potatoes indeed compared to the monsters who actually encourage impoverished parents in Eastern European countries to "lend" them their kids for an afternoon photo shoot.

Those producers are harder to find and prosecute than the infamous chat-room "predators" who have populated the popular imagination for the last decade. But going after websurfers delivers another desirable result in the eyes of people like former attorney general John Ashcroft: an endless stream of headlines praising efforts like Microsoft's for "stemming the tide" of abuse, while the social programs that actually do reduce abuse against children are slashed from federal budgets.
posted by digaman at 12:33 PM on April 8, 2005

after another skim, perhaps i'm being to picky. i may have read things into your post. cops can indeed put the listed items in, if they already have them. and mining is a common term for querying data. never mind. /rosannadanna
posted by quonsar at 12:37 PM on April 8, 2005

thanks, q.
posted by digaman at 3:14 PM on April 8, 2005

I love these "Jane you ignorant slut" threads. They never cease to entertain.
posted by ZachsMind at 3:22 PM on April 8, 2005

Uh, isn't Echelon a bigger invasion of privacy than this could ever be? No one seems to care about it though. Hell, even slashdot geeks rarely mention it. No link, because no one cares. echelonwatch.org doesn't even work anymore.
posted by [expletive deleted] at 3:40 PM on April 8, 2005

quonsar writes "it's a database. cops from all over the place are going to feed it what they know. this enables links and commonalities to become apparent. yawn. cops have to know something first before they feed it. it doesn't find things out for the cops beyond links in their own data. its a fairly common use of computers. i fail to see how it threatens me anymore than the fingerprint/DNA database, or NCIC, or the IRS, etc etc etc."


Ho hum. Cops "have to know something first before they feed" the database. Cops would never misuse "their own data".

In many cases, [police] turned a valuable crime-fighting tool into a personal search engine for home addresses, for driving records and for criminal files of love interests, colleagues, bosses or rivals.
. . . .
Part-time Memphis police officer Scott Woods.... [used the database] to find out personal information about a woman he met on the Internet....
. . . .
Woods later told the woman he had followed her home the night before, according to police records. He called her by her middle name, which she had not told him. He described her height and weight. And he went on to call her at home and work up to three times a day, according to police and sheriff's records.

So maybe a few local cops misuse databases. There are laws in place to prevent these abuses.

[Orange County, Florida, Sheriff Kevin] Beary was so upset by [a critical Letter to the Editor] that he had his staff look up [the letter writer's] address using driver's license records and fired off a letter to her.

"I never in any way sent that letter to you with the intent of intimidating you. Please know that I am confident I was within the purview of the Florida Public Records Law when I obtained your mailing address. I sincerely regret the fact that my letter upset you," Beary wrote.

Violators of the driver’s privacy act can be sued in U.S. District Court for damages of at least $2,500, punitive damages, attorney’s fees and all other relief the court determines to be appropriate.

But sheriff’s officials said that it was legal to look up Gawronski’s address on the driver’s database. Sheriff’s spokesman Jim Solomons said responding to a resident’s concern is well within Beary’s official duties.

Ok, so maybe those laws have loopholes. But all he did was send her an intimidating letter. Cops would never use databases to do worse.

Prosecutor's Office Uses Database to Smear Prosecutor's Political Opponent,
Police Lieutenant Charged With Abusing Database to Influence Elections
Cop Uses Database to Find Woman's Unlisted Phone Number -- Gives It to Woman's Ex

A few bad apples. It's not like the databases would be used to frame political opponents.

[A U.S. Federal Court jury] concluded that the FBI and the Police had framed the two activists in an effort to stifle Earth First! and stop participation in 'Redwood Summer', a planned campaign of non-violent direct action against the destruction of old-growth forest.

Oh please, we all know that those Earth Firsters are, essentially, terrorists. Why should terrorists be protected by laws? It's not like the FBI frames peaceful protesters!

More ominously, the FBI suggested that "legal" efforts to deal with [Martin Luther] King [Jr.] might not be enough. "It may be unrealistic," the memorandum went on, to limit ourselves as we have been doing to legalistic proofs or definitely conclusive evidence that would stand up in testimony in court or before Congressional Committees...
. . . .
[FBI officials] agreed to use "all available investigative techniques" to develop information for use "to discredit" King. Proposals discussed included using ministers, "disgruntled" acquaintances, "aggressive" newsmen, "colored" agents, Dr. King's housekeeper, and even Dr. King's wife or "placing a good looking female plant in King's office" to develop discrediting information and to take action that would lead to his disgrace.

Ok, but it's still ridiculous to say that "Democrats" or any other political group would be targeted.

The FBI has collected extensive information on the tactics, training and organization of antiwar demonstrators and has advised local law enforcement officials to report any suspicious activity at protests to its counterterrorism squads....
. . . .
FBI officials said in interviews that the intelligence-gathering effort [was not aimed at] monitoring the political speech of law-abiding protesters.
. . . .
The memorandum analyzed lawful activities such as recruiting demonstrators, ....

Oh, you're being sensationalistic. Those are illegal demonstrators. Law-abiding people have nothing to fear.

Most of the 110,000 persons removed [to internment camps] for reasons of 'national security' were school-age children, infants and young adults not yet of voting age.

jbeaumont writes "I like how every software used to help find criminals will 'undoubtedly someday' be used to find FILE SHARERS and DEMOCRATS. Way to be a sensationalist."

Yeah, why do you cop-hating sensationalistic lib'ruls hate America(n surveliience)?
posted by orthogonality at 4:12 PM on April 8, 2005

Well, I have a friend in town who shares a house with a couple, the female partner of which is currently involved with a custody battle with an ex.

The ex calls the police and they raid the house, grabbing every machine they can apparently recognize, including those of my friend, who's machines were captured as being networked with the others.

It's now been three months and the machines have been investigated by the local computer forensics expert, as well as experts from both INS and the FBI.

Findings? Nothing.

Results? Despite the admission nothing was found, law enforcement still holds all the machines, stating that they need further time for continued inspection.

They have been going back and forth with a lawyer, trying to get the case dropped and their property returned. No success yet.

All because of one unfounded verbal accusation.

Look at credit reports and the inaccuracies they hold. They expect a mining project of this size to be any better? And this is potentially people's lives here. In a lot of places, an accusation is as bad as a conviction.
posted by Samizdata at 4:15 PM on April 8, 2005

Great post, orthogonality.
posted by digaman at 5:30 PM on April 8, 2005

Uh, isn't Echelon a bigger invasion of privacy than this could ever be?
Yep. But the people doing the looking are further removed from the people they're watching.
So they could watch 'me', but what is it they're going to watch 'me' do? 'I'm' small potatoes to the guys running Echelon.
If the black maria does show up for me in the night it'll be at random, which is pretty much what the Rooskies had under Stalin.
Bush could crush me like an egg if he wanted to (well, it'd be a glorious firefight and probably a triple digit body count, but I am getting older and there's always someone with more training and drive) - but why would Bush do that? I'm beneath his notice.

On the other hand officer friendly could kick down 'my' door any time he wanted scream pedophile and no one would squawk...because 'I'm' a pedophile right? It's not like 'I' deserve rights. And it could be for any number of reasons the less powerful have.
It's sort of like the feudalization of spytech. peasants have no reason to fear the king, but their local lords are a different story.

echelonwatch.org doesn't even work anymore
I wonder what that indicates.
posted by Smedleyman at 6:21 PM on April 8, 2005

echelonwatch.org doesn't even work anymore.

There's the root of a good conspiracy theory there.

Samizdata that kind of stuff happens all the time. Probably the most famous case is the illegal raid on Steve Jackson Games by the SS.

My only hope is porn once again leads the way in adopting tech and we finally see a massive uptake in email encryption.
posted by Mitheral at 2:48 PM on April 9, 2005