Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×
Privacy Your Rights Online

eBay Provides No Privacy For Sellers 470

Phanatic1a writes "Quoted in an article in The Nation, eBay's chief of security Joseph Sullivan brags up eBay's "flexible" privacy policy to LEOs, telling them "If you are a law-enforcement officer, all you have to do is send us a fax with a request for information, and ask about the person behind the seller's identity number, and we will provide you with his name, address, sales history and other details--all without having to produce a court order." The tens of millions of Paypal customers eBay has access to the financial records of might be curious to see what else Sullivan promises..."
This discussion has been archived. No new comments can be posted.

eBay Provides No Privacy For Sellers

Comments Filter:
  • by frieked ( 187664 ) * on Tuesday July 01, 2003 @12:08PM (#6340452) Homepage Journal
    we will provide you with his name, address, sales history and other details

    Other details... hmmmm, wonder if this means: Seller is super great/fast AAAA+++++++++ recommend to all A+A+A+A+A+A+
    • Re:other details (Score:5, Interesting)

      by cshark ( 673578 ) on Tuesday July 01, 2003 @12:30PM (#6340750)
      It's funny that people are still shocked by this. Ebay makes no secret that they will provide any information to ANYONE who asks for it. Really, try faxing them a request for user information, including credit card info, name, address, etc. See what happens. I think it's amazing that we don't have laws preventing this kind of decemination of information. All the more reason to use alternative auction houses. Although, I don't know how well any of them fair.
      • Re:other details (Score:3, Insightful)

        by Anonymous Coward
        I think it's amazing that we don't have laws preventing this kind of decemination of information

        So if I want to sign up to be a seller with ebay and let them give out my information the government should intervene and prevent that? Whatever happened to letting conssenting adults enter into contracts? Guess what you are looking for is a nanny state to baby you?
        • Re:other details (Score:3, Interesting)

          by cshark ( 673578 )
          I'm just saying that they don't have good enough checks and balences in place. It's lazyness on ebay's part. You must not sell on ebay. If you did, it would scare you that I could get your credit card information by simply saying I'm with a regional police department in a FAX, without even a phone call. Consenting adults should be able to enter into contracts. But privacy should be enforced a little more tightly. Or at least with some research and/or confirmation of who you're actually giving information
        • Re:other details (Score:3, Informative)

          by tashanna ( 409911 )

          You're very right. Consenting adults do have every write to enter into a contract. But eBay (and every other site I've ever seen) also tack on the bottom their right to change their mind to whatever the damn well please. Even if I enter into the agreement knowing that they won't give away my info, who knows what they'll be doing 6 months from now.

          As long as the click-through agreements can be changed at a whim by only one of the parties, I won't treat it like a binding contract

          -- Just because you're par

        • Re:other details (Score:5, Insightful)

          by klaun ( 236494 ) on Tuesday July 01, 2003 @04:35PM (#6343653)
          I think it's amazing that we don't have laws preventing this kind of decemination of information

          So if I want to sign up to be a seller with ebay and let them give out my information the government should intervene and prevent that? Whatever happened to letting conssenting adults enter into contracts? Guess what you are looking for is a nanny state to baby you?

          Who said anything about two consenting adults? It's one adult and one huge corporation. One of the parties to the contract will definitely die after at most about 120 years, can work no more than 168 hours in a week, can be imprisoned or executed, has few protections from debts that are enshrined in law, and can't sell parts of itself to raise money. The other party is physically immortal, cannot be imprisoned or executed, has no hard limitation on the man-hours available to it, has all sorts of protections from civil, criminal, and tax liability, and in general is not equal to a person.

          This inequity between the two parties means that one gets the shaft. That's because the corporation can dictate to you and you don't have any power at all to negotiate. I don't need a nanny state to baby me, I need a state that doesn't create "artificial persons" and then turn around and say "we want an unregulated marketplace."

          By creating "artificial persons" that limit the liability of an enterprise which in truth is often just one person or a very small group of people, the government has created for itself a responsibility to regulate said artificial persons.

          So take your laissez-faire politics back to the land of unicorns, dragons, and other mythical beasts.

          • Re:other details (Score:3, Interesting)

            by dekashizl ( 663505 )
            You frame the issue in a really interesting manner and raise some good points, but I feel you've only shot down the previous poster (AC who claimed that regulations == nanny state baby-sitting you) without offering a solution.

            I agree that the gap between physical man-persons and corporate "artificial persons" as you call them is significant. I also understand where the previous poster is coming from, in that I don't want all my interactions fully managed by the state.

            A good compromise here, I feel, i
      • this was reported a while ago and I cancelled my eBay account immediately with a terse note on why. Sure it sucks but such as it is; stand on principles or lie down and let them roll over you. eBay has no legal obligation to maintain my privacy. They SHOULD do so for the sake of customer care and good corporate citizenship (encouraging law enforcement to expect information about private transactions to be treated like public information is totally against what the Constitution of the U.S.A. used to be ab
    • by JonTurner ( 178845 ) on Tuesday July 01, 2003 @12:35PM (#6340825) Journal
      No, in this age of state budgets exceeding revenue, it means is that State tax collectors are going ask DoNotCall.gov for a list of email addresses from their area code. From there, the taxman will ask eBay for a list of all sales from each email address along with description of items and amount.

      Next, that information is used to demand back taxes + penalty fees, and potential criminal prosecutions for those who have not reported their eBay sales as "income."

      Remember, it's only called a conspiracy *theory* until it happens.
  • scary stuff (Score:5, Interesting)

    by zedmelon ( 583487 ) on Tuesday July 01, 2003 @12:08PM (#6340458) Homepage Journal

    I understand this from eBay's perspective to a point:

    There is also the genuine anxiety surrounding the potential consequences of not following up on a perceived terrorist threat.

    ..but this part:

    It also expands the category of information that law-enforcement figures can seek with a simple subpoena (no court review required) to include, among other things, IP addresses and credit card and bank account numbers.

    Besides buying copies of "Mein Kampf" and "The Anarchist's Cookbook," what sort of flags could be construed as putting one's transactions over the limit?

    • Re:scary stuff (Score:4, Interesting)

      by WegianWarrior ( 649800 ) on Tuesday July 01, 2003 @12:21PM (#6340626) Journal

      Besides buying copies of "Mein Kampf" and "The Anarchist's Cookbook," what sort of flags could be construed as putting one's transactions over the limit?

      I guess buying GPS-systems, small jet-engines and books on aerodynamics may fool them into thinking you plan to pull a stunt like this [slashdot.org].

      In all seriousness thought, there are two things I am really curious about. Fristly; if no courtorder are needed, how do they make sure that the one asking for the information is in fact entitled to it? Secondly, will this 'service' be extended to non-US police as well (as a significant numbersellers and buyers actually hails from the rest of the world)?

      • Re:scary stuff (Score:5, Interesting)

        by gurps_npc ( 621217 ) on Tuesday July 01, 2003 @12:39PM (#6340886) Homepage
        They do not. You personally can send them a fax, claiming to be a police man, and they will send you what you ask for.

        As such, it already applies to non-US police

        It should also be noted, that a simple phone call, from an experienced socializer can easily get the same information from 80% of businesses.

        P.S. Impersonating a Police Officier is a crime. You can be arrested for doing this, so do not do it.

        • Not exactly . . . (Score:4, Informative)

          by djembe2k ( 604598 ) on Tuesday July 01, 2003 @01:52PM (#6341696)
          According to the eBay privacy policy [ebay.com] as it appears on their site:
          eBay cooperates with law enforcement inquiries, as well as other third parties to enforce laws, such as: intellectual property rights, fraud and other rights, to help protect you and the eBay community from bad actors. Therefore, in response to a
          verified request by law enforcement or other government officials relating to a criminal investigation or alleged illegal activity, we can (and you authorize us to) disclose your name, city, state, telephone number, email address, UserID history, fraud complaints, and bidding and listing history without a subpoena.
          (emphasis added)

          They say in this written policy that they will verify the request as coming from law enforcement. This is a contract. If they do not honor it, they are (presumably) subject to legal action, especially if somebody experiences a material loss as a result (maybe unlikely, but still).

          I'm not talking about what they do in the real world, or what anybody says in any particular interview. But what they say in writing does have some weight (even if they may choose to disregard it).

          IANAL, yadda.

    • by PetoskeyGuy ( 648788 ) on Tuesday July 01, 2003 @12:52PM (#6341036)
      How many people and companies out there have had their domain hijacked via Network Solutions with just a fax? Now eBay is going to have available NAME, ADDRESS, CREDIT CARDS and BANK ACCOUNTS to anyone who can forge a fax from a law-enforcment agency. Just need to find someone selling some used 72" plasma TV or some other expensive trinket - there's a good mark.

      Anyone know if this is this international, or just US?
    • Besides buying copies of "Mein Kampf" and "The Anarchist's Cookbook,"

      Since when is that an indicator of criminal behavior? Millions of each book were sold, probably only a handful of nasty people in the US were found with those books, with the exception of skinheads.

      I own both books, I bought the Anarchist Cookbook when I was 12 just because it was a regulated and semi-banned book. I didn't do anything illegal besides a few backyard experiments.

      I read Mein Kamph for two history classes, WW II history and a class on the history of the Holocaust. Should I be investigated for this?

  • so what? (Score:5, Interesting)

    by feed_me_cereal ( 452042 ) * on Tuesday July 01, 2003 @12:08PM (#6340462)
    This story is very simmilar [slashdot.org] to a very old story here. Anyway, I'm not sure what the big deal is this time. The author says "brag" as if this is a crazy notion. He's bragging because this policy keeps buyers safe. I'm a privacy advocate, but in this case, why the hell should seller information be kept private from the police? I've been ripped off several times on eBay. I'm very glad to hear that sellers aren't anonymous!!!! So, you should be allowed to stay annonymous when accepting money on the promise of delivering goods?? WTF?! Could you imagine some of the anonymous trolls on this stie selling you shit? How does this escalate directly to giving out buyers bank info? I don't think he'd be bragging to customers about that deal. It's COMPLETELY different.
    • by burgburgburg ( 574866 ) <splisken06@TOKYOemail.com minus city> on Tuesday July 01, 2003 @12:18PM (#6340594)
      I knew I read this months ago. And "The Nation" specifically says that they got the story from Ha'aretz, noting that the US news media hadn't picked up on the story. Other then some additional commentary, this is a repeat.
    • Re:so what? (Score:2, Interesting)

      by knobmaker ( 523595 )

      So what?

      According to Sullivan, "when someone uses [eBay's] site and clicks on the 'I agree' button, it is as if he agrees to let us submit all of his data to the legal authorities..."

      In other words, sellers, as they enrich ebay, agree to give up any reasonable expectation of privacy. What ebay is saying is a lot worse than you realize. If a seller rips you off, why shouldn't the same rules apply to ebay as they do in other criminal situations? As it stands, ebay doesn't require even a subpoena to re

      • Re:so what? (Score:5, Insightful)

        by sribe ( 304414 ) on Tuesday July 01, 2003 @01:19PM (#6341326)
        In other words, sellers, as they enrich ebay, agree to give up any reasonable expectation of privacy. What ebay is saying is a lot worse than you realize. If a seller rips you off, why shouldn't the same rules apply to ebay as they do in other criminal situations? As it stands, ebay doesn't require even a subpoena to release information such as your name, address, and telephone number. No involvement with the justice system is required, nobody has to talk to a judge and justify invading your privacy.

        You are aware aren't you, that there is NO legal way to set up a storefront retail operation without some form of contact info being a matter of public record? Why should a seller on eBay be any different? What person in their right mind thinks it's a good idea to have a market in which vendors are anonymous??? Do you really think it's fair as a seller to offer your buyers no reliable, verifiable way to contact you? Would you really buy anything off eBay if you thought for a minute that sellers were immune to being located except via extraordinary means?

        Think in terms of "meatworld" for a second. How would you feel if you went to a store, bought a product which turned out to be defective, went back and found the store had just disappeared? What if you then tried to track down the store's owner, and found only a fake address? Worse, what if you went to your local government to find out the info about the store's ownership, and were told that the info was "private" and that you'd need to hire a lawyer, go to court, and get an order to see it?

        Now, again, why should eBay sellers have some cloak of anonymity???
    • Re:so what? (Score:4, Interesting)

      by spiritraveller ( 641174 ) on Tuesday July 01, 2003 @12:35PM (#6340831)
      You must have missed page two, where they mention the FBI knocking on a "Stanford-educated" Pakistani man's door because of books that he purchased on eBay. It's a good thing he had his ducks in a row immigration-wise, and that he was "Stanford-educated" or you can bet they would have thrown him in detention with the rest of em.

      They aren't limiting this to sellers who are accused of not shipping. They are applying this to anyone that the government thinks is suspicious. And that is their own choice of words.

  • What a coincidence...as I as refreshing to see if this story was live yet, what happened to be the advertisement but a EBay ad.

    Anyway, about the story itself, how exactly is it a "privacy policy" if they themselves say thay will not stick by it.
  • by ultraexactzz ( 546422 ) on Tuesday July 01, 2003 @12:09PM (#6340479) Journal
    So, in essence, sellers on Ebay are as easy to track down as sellers in brick & mortar stores or otuer public places of business, with business licenses, vendor's licenses, or other government checks and controls... I fail to see a problem with that.

    Of course, this opens them up for identity theft, just as much as it would normal businesspeople.
    • by Isao ( 153092 ) on Tuesday July 01, 2003 @12:58PM (#6341106)
      So, in essence, sellers on Ebay are as easy to track down as sellers in brick & mortar stores or otuer public places of business, with business licenses, vendor's licenses, or other government checks and controls... I fail to see a problem with that.

      However this also covers buyers... While I can purchase a book at Borders with a credit card, would I be pleased if that then gets sent over to Law Enforcement without a warrant or writ? This is what happened with a D.C. bookstore being asked for Monica Lewinsky's purchase history.

  • by CmdrWass ( 570427 ) on Tuesday July 01, 2003 @12:10PM (#6340480) Homepage Journal
    Any takers on how long before this is misused and someone sues ebay?
    • I would think this would cause more problems for law enforcement than for ebay...just because ebay makes that a policy doesn't make it law enforcement's right to take advantage of that without a warrant. It's certainly outside the spirit of the associated amendment.
      • Which amendment is that? "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures?" These are eBay's papers, and it's in eBay's house. The government can do whatever they want so long as they get permission. It's perfectly reasonable to search someone's papers with their permission. This is a question of eBay's rights, not those of the person whose information is being requested.
  • by gazuga ( 128955 ) on Tuesday July 01, 2003 @12:10PM (#6340487) Homepage
    Seems like they are leaving the door wide open for a "law enforcement officer" to get a user's info with a faked fax.

    The policy is horrible, but I hope at the very least, they double-check before they start sending any info back.
    • That was exactly my thought. I wonder what sort of checking they do to make sure that the request came from a real law enforcement officer.

      I'm tempted to send them a fax as a "law enforcement officer" requesting my personal information, and see if they provide it no questions acted.

      Of course, I'm not sure how seriously that would be taken if they were to catch on. Would they persue a case of impersonating an officer if all I was obtaining was my own information that I already have access to?
    • Seems like they are leaving the door wide open for a "law enforcement officer" to get a user's info with a faked fax.

      Oh God no! With my name, address, and sales history, someone might be able to write me a letter!

      C'mon, this information should be public anyway. You're holding a public auction. People are entering into supposedly binding legal contracts to purchase items from you. Shouldn't people be able to know who you are?

    • by Otterley ( 29945 ) on Tuesday July 01, 2003 @12:30PM (#6340744)
      Ipersonating a peace officer is a misdemeanor in most states. In California, see Penal Code section 538d. The crime is punishable by imprisonment in county jail up to a year and/or a fine up up to $2,000.

      This might deter many people from attempting such a thing.
  • Easy to fake... (Score:5, Insightful)

    by jjh37997 ( 456473 ) on Tuesday July 01, 2003 @12:10PM (#6340492) Homepage
    I wonder how many requests they get and what kind of verification they do to make sure that the requests are legit?

    Honestly, how hard is it to photoshop up some letterhead and fax it to eBay claiming you're a member of law enforcement? This could be an easy way for crooks to get the credit info of some of eBay's powersellers, who likely have some excess cash.
    • Re:Easy to fake... (Score:4, Insightful)

      by Darth_brooks ( 180756 ) <clipper377&gmail,com> on Tuesday July 01, 2003 @12:21PM (#6340629) Homepage
      it also adds "impersonating a law enforcement officer" to the list of charges. Given that the crime would likely span over two or more states, it becomes a federal offense.

      What side should ebay err on? the side of protecting the privacy of a seller or the side of protecting a user from being bilked out of a few grand? There's privacy and there's protection, and a hard line to walk between the two.
  • by zedmelon ( 583487 ) on Tuesday July 01, 2003 @12:11PM (#6340495) Homepage Journal

    eBay itself goes further than this, employing six investigators who are charged with tracking down "suspicious people" and "suspicious behavior.

    I guess I'd better not post any more "Stable version of Windows" auctions...

    *sigh*

  • by pytheron ( 443963 ) on Tuesday July 01, 2003 @12:11PM (#6340501) Homepage
    I'm trying to think of any large business valued at over a few mill that doesn't bend over backwards to lick the collective asses of law enforcement agencies. It's alot less hassle, avoids possible court time and bad requests for info (whilst they undoubtedly happen) are rare. I guess eBay think most customers will just swallow theses Terms and Conditions and business as usual (which will be the case).
    • Verizon (Score:2, Insightful)

      by Anonymous Coward
      Well for a while they held out on those usernames.
  • by burgburgburg ( 574866 ) <splisken06@TOKYOemail.com minus city> on Tuesday July 01, 2003 @12:12PM (#6340506)
    Nobody with bad intent has ever been able to figure out how to fake a fax. I mean, law enforcement letterhead is more secure then nuclear launch codes.

    I'm sleeping easier now.

  • by f97tosc ( 578893 ) on Tuesday July 01, 2003 @12:13PM (#6340518)
    one were police could get names and addresses of sellers and one not, where would you buy and sell?

    I think I would settle for the one where they could. It seems like some protection against fraud - and I don't really mind if they get a hold of my name and address, or that I sold some used computer book.

    Tor
  • Police only? (Score:5, Insightful)

    by Richardsonke1 ( 612224 ) * on Tuesday July 01, 2003 @12:13PM (#6340519)
    If it's so easy to get this information, how hard would it be for me to create my own police letterhead, a badge number, and have them fax the info to my local Mailboxes, etc.? I mean, say someone rips me off, this would make it soo easy to get them back. Can you say Identity theft?
    • Many illegal things are easy to do. Breaking into a home, killing someone, shoplifting. People don't for two reasons: Respect for the law, fear of the law.
  • Not unusual (Score:5, Interesting)

    by Anonymous Coward on Tuesday July 01, 2003 @12:14PM (#6340542)
    I work with a relatively large community site, and we work the same way. I'm a bit of a libertarian, so it galls me a bit, but it really does make sense for the most part.

    Now, if law enforcement wanted the personal data froms someone who wrote an anti-Bush post, I'd argue for making them produce a court order.

    But when law enforcement wants data about someone who we can see has sent hundreds of threatening emails to another user, who has posted in our message boards about how they're going to kill their ex- , or who we've had to ban from chat or message boards for repeated abuse... sure, we'll hand it over, no court order needed. And our privacy policy says so.

    And you know what? Of the maybe 100 times law enforcement has asked us for someone's personal data, every single time that I can recall involved a user where we just *knew* the request was coming. In many cases, we had advised someone to *call* law enforcement after they contacted our support group with believable threatening emails originating from our system.

    I believe in the hotly debated "right to privacy," but I don't think that that's incompatible with helping law enforcement in some cases.

    In the eBay case, clearly it's in their interest to reduce fraud on their system, so anyone with half a brain would expect them to cooperate with law enforcement. What, do folks have a "right" to defraud folks on eBay? Or is eBay somehow obligated to make investigation of that fraud as difficult as possible?

    Cheers
    -b
  • Cash Only (Score:5, Interesting)

    by nurb432 ( 527695 ) on Tuesday July 01, 2003 @12:15PM (#6340551) Homepage Journal
    This is why I normally only use cash. True my bank knows I took out money, but they don't know where it went.

    And I refuse to give any personal info when purchasing.. its cash. .they don't need to know anything about me. Its bad enough I'm on camera, they can even track what car you get into, then trace your plate number.

    What ever happened to the concept of privacy? And if you tell me its 'for my safety', you deserve to be kicked in the teeth.
    • by Anonymous Coward
      Actually, your life is boring enough that we've mostly stopped watching you. Althoug when we get bored, we occasionally play a conspiracy geek version of "license plate bingo". The goal is to figure out which Robert Ludlum book you figured out a particular move from.

      Also, try talking to that girl at the bar next time instead of spitting your drink all over her when she smiles at you.

      Sincerely,
      Your friends at the gummint.
    • Re:Cash Only (Score:5, Insightful)

      by NetDanzr ( 619387 ) on Tuesday July 01, 2003 @01:26PM (#6341417)
      I found that using cash can cause more privacy problems than it solves. I, for example, use my ATM card only for groceries. I don't care whether the government or anybody else knows which cereals I like and whether I drink 2% or whole milk. I always use the self-checkout lines, and using cash there is a little complicated.

      However, elsewhere I use only cash, and I ran into some serious problems already. Examples:

      • Buying a TV and VCR at BestBuy, total value slightly over $1000. The store does not accept so much cash; I had to buy the two on two separate trips.
      • Buying a laptop at CompUSA for $1400. Same problem; since it was a single item I could not buy it at all with cash.
      • Buying some furniture of total value of slightly over $2000 (I also came with my own truck to drive it home). The clerk wanted my name, address and copy of my driver's license. The manager confirmed those requirements I left and bought it elsewhere.
      I'm wondering when cash transactions over a certain value would be outlawed altogether.
      • The store does not accept so much cash; I had to buy the two on two separate trips.

        Is this legal? On the $20 note in my billfold it states, "This note is legal tender for all debts, public and private." Given this, how can a store refuse cash? Perhaps some exceptions can be made if you can't give change or are ordering through the mail/online so cash can't be processed, but other than that I can't see a reason for a store being able to refuse cash for a purchase. I mean, if I wanted to buy a $1400

      • Not to mention a lot of places are wary of big amounts of cash, and it's trouble for the cashier, who has to check each bill for authenticity.

        I paid for my iPod in cash because, you know, I thought it'd be cool to whip out $538.92. Perfect change makes a perfect person and all. But it was just a hassle. Guy had to go looking for a cash pen, had to get his manager to accept it. Everybody was staring at me with this huge wad of bills in my hand. At least three people in the register over from mine got t
  • by wwest4 ( 183559 )
    > eBay's chief of security Joseph Sullivan brags
    > up eBay's "flexible" privacy policy to LEOs,

    If this means he intends to use recent amateur rocket technology to launch the policies into Low Earth Orbits, then I concur wholeheartedly.

    Too bad ebay didn't buy ecash instead of fscking paypal. Oh well... see you in alt.anonymous.messages!

  • Until someone's daughter gets murdered by a sociopath who got her address from EBay by posing as a LEO (Law enforcement officer)...

    Honestly, though, it seems like our privacy is all but gone. What about those people who have a legitimate need for privacy, such as estranged wives, and those victimized by cults? I guess they don't matter to EBay...

    "Find your next victim with EBay - takes only a fax and a few minutes..."

  • Security concern (Score:5, Insightful)

    by t0ny ( 590331 ) on Tuesday July 01, 2003 @12:17PM (#6340582)
    My problem is not with the matter of eBay providing this information, but rather with their confirmation. For example, if I just send a fax and say Im a law enforcement officer from Asshole, IN, will they just accept my fax as confirmation of my identity?

    Now of course that is illegal (misrepresenting myself as a law enforcement official), but since fraud is already illegal, what difference does throwing another shrimp on the barbie make?

    • "Now of course that is illegal (misrepresenting myself as a law enforcement official), but since fraud is already illegal, what difference does throwing another shrimp on the barbie make?"
      Well, i was a criminal justice major, and worked as a sherriff for a few summers, and never once came across anyone impersonating a police officer. I get the feeling its highly frowned upon(read this as getting your ass kicked)
    • I think they're counting on after-the-fact enforcement more than any strong authentication. Impersonating a police officer is a more serious offence than fraud, and if anything else, it's enforced more strictly since police don't take kindly to challenges to their authority.
  • by arf_barf ( 639612 ) on Tuesday July 01, 2003 @12:18PM (#6340583)
    I have worked with various 'law enforcment' agencies on various IT projects (Databases) and trust me these guys dont give a damn about privacy policies or information sharing laws.

    Most of the time it goes like this: hey do you have any information about such and such? Ok, give it to me.

    The only reason there are no 'global law enforcement' databases about all of us is the sheer incompetence and beaurocracy of the public/government institutions...
  • by Rogerborg ( 306625 ) on Tuesday July 01, 2003 @12:20PM (#6340614) Homepage

    If citizens of the United States are allowed privacy, a presumption of innocence, or the protection of due process, then the terrorists have already won.

    Wait... that doesn't sound right. Which of us is smoking crack?

  • by SharpFang ( 651121 ) on Tuesday July 01, 2003 @12:20PM (#6340615) Homepage Journal
    New E-bay Privacy Policy:

    You have the right to remain silent and refuse to answer questions.

    Anything you do say may be used against you in a court of law.

    You have the right to consult an attorney before speaking to the police and to have an attorney present during questioning now or in the future.

    If you cannot afford an attorney, one will be appointed for you before any questioning if you wish.

    If you decide to answer questions now without an attorney present you will still have the right to stop answering at any time until you talk to an attorney.

    Knowing and understanding your rights as I have explained them to you, are you willing to answer my questions without an attorney present?
  • by f97tosc ( 578893 ) on Tuesday July 01, 2003 @12:23PM (#6340646)
    1 Buyers prefer that the order can be traced -> higher demand where this is possible

    2 Some sellers may prefer that it can't

    3 Thus if there are several possible sales portals, sellers have to chose between higher demand and prices, or the feature that they cannot be traced

    4 Positive feedback: what kind of sellers prefer intracability over more money?

    I think this is here to stay.

    Tor
  • I don't see how this is a bad thing. Yes, eBay is a bad place to sell illegal drugs. So what?
  • Any officers out there willing to poke around some congressional rep's eBay purchases or PayPal transactions?
    • No, because I would get in serious trouble.

      Misuse of police authority is not taken lightly. Some violations, such as illegal wiretapping (e.g. phone monitoring, sniffing networks, etc) can carry civil penalities for the law enforcement officer personally. (See 18 USC 2520 [cornell.edu] for more details. Civil penalities of up to $10,000 per offense.)

      I'm not sure about the specifics of gathering information like credit card data, but I suspect that I would get at least fired and probably hit with a civil suit.

      Just not
  • by tbase ( 666607 ) on Tuesday July 01, 2003 @12:28PM (#6340715)
    Those comments were made last winter, so those of you (like me) feeling a sense of Deja Vu - there's a reason.

    According to PayPal's privacy policy [paypal.com], your banking info and everything else is safe unless the request is backed by a warrant or court order. It is interesting to note that they do reserve the right to give some of your info to your victims if they find that you've committed a fraud.

    Here's the (IMO) relevent passages from the section outlining exceptions to the rule that they don't share your info:

    "We disclose information that we in good faith believe is appropriate to cooperate in investigations of fraud or other illegal activity, or to conduct investigations of violations of our User Agreement. Specifically, this means that if we conduct a fraud investigation and conclude that one side has engaged in deceptive practices, we can give that person or entity's contact information (but not bank account or credit card information) to victims who request it.
    We disclose information in response to a subpoena, warrant, court order, levy, attachment, order of a court-appointed receiver or other comparable legal process, including subpoenas from private parties in a civil action. "
  • NBC Weapons (Score:5, Funny)

    by hadesan ( 664029 ) on Tuesday July 01, 2003 @12:30PM (#6340756)
    I guess this kills the auction for all those terrorists buying and selling nuclear, chemical, biological weapons online...
  • ...tell me how to get my 55 year old mother to care and this might matter to me.

    Ebay is so mainstream, I really doubt they'll see much backlash at all with their policies. Most people simply don't think it will effect them, and don't care if it effects others.
  • They might as well go the extra mile and turn this PR-bug into a PR-feature. Instead of just offering it to LEOs to catch "terrorists", offer it to everyone to help deal with fraud.
  • Oh yeah? [intervideo.com]

    Do codecs not count?

    Don't worry, WINE will get what we want, but we mostly prefer our own stuff.
  • by HotNeedleOfInquiry ( 598897 ) on Tuesday July 01, 2003 @12:35PM (#6340820)
    Is if you have a disgruntled cop as a buyer. What's to stop him from using his superuser privilege to get your personal information and make your life miserable?


    It's not like it hasn't happened before.

  • by asscroft ( 610290 ) on Tuesday July 01, 2003 @12:35PM (#6340822)
    It all comes down to how easy it is to pretend to be a LEO.
    Oh, and how much you trust the LEOs.
    Here's what some have done with their access to the License Plate Database: [freep.com]
    • Check up on X GFs.
    • Run a Plate for a Date.
    • Look up a car for a friend who got cut off in traffic.
    • Intimidate an enemy.

    Personally, I trust the gov and the cops...but only as far as citizen oversight allows.

  • by The Angry Mick ( 632931 ) on Tuesday July 01, 2003 @12:36PM (#6340842) Homepage

    Again, here we see a case of an individual unwilling to even make an attempt at a thorough and thoughtful analysis of the issues surrounding what is most definitely a very complex subject. While I fully see the need for a certain level of cooperation with the authorities, I see far more problems with allowing them carte blanche acces to my entire life. When any agency has that much power, there is no point at pretending a democracy exists anymore. Ebay, and Sullivan in particular are taking a cheap and easiy way out simply to avoid dealing with an unpleasant issue.

    However, Sullivan may be missing the point that privacy is always a two way street. Customers, like it or not, expect a certain amount - take it away and you drive them off. Advertise that you don't respect your customer's privacy, and you see a flurry of discussion and anger similar to that on display on this page. Sullivan seems to think that bending over for "the man" will make his dealing with law enforcement more pleasant, but he's missing the point that it doesn't grant blanket immunity from personal, or corporate liability, should "the man" make a mistake. God have mercy on the soul of any corporate bigwig who accidentally gets a customer persecuted/prosecuted under false pretenses.

  • I only have one problem with this policy: that it isn't extended to anyone one. Why should law enforcement have this right, but I - an eBay buyer - not have this right?

    I don't see that someone who is selling things should have a right to hide their identity, background on transactions, etc., from others. Transparency, and the accountability that it fosters, is key to commerece and trust.

    Too many people out in the /. world believe that absolute privacy is a right. Well, it isn't. When you enter into certain situations, you set aside your rights, in order to embrace other rights. One of these situations is the area of commerce. If you have business and I am about to enter into a trans action with you, I have the right to perform a background check on you. To determine if you are a con person or rip-off artist.

  • by A55M0NKEY ( 554964 ) on Tuesday July 01, 2003 @12:39PM (#6340880) Homepage Journal
    Look, ebay can do what it wants privacy-wise as long as they let their users know. If someone doesn't want to give their info to someone who will let the police view it then they don't have to use ebay to sell their item.

    What reasons might the police have to request ebay info? Think about it - probably 98% is fraud related. Being hornswaggled is the most worrisome thing about using ebay. It makes me feel safer to know that the sellers info is easily available to law enforcement. I want dishonest sellers to know they may be being monitored by the police. If you are an honest seller, you are more likely to make a sale if the buyers know that the police can get your info. It makes them feel safer. This is a good thing from the honest seller's perspective.

    The other 2% may be odds and ends like possible terrorist sales and child porn and the like. I don't want that crap on any site I go on either. I just wanna buy my used VCR so I can illegally copy rented DVDS ;-).

    I would feel differently if ebay was so willing to disclose buyer information. Buying is something everyone must do, and there should be some privacy protections. What you buy is a window into your personal life. Too much can be deduced, and wrongly assumed from that data for it to be a good idea for law enforcement to have it. What you sell is another matter. The only info it reveals is how you made your money. There is not much chance that law enforcement will start persecuting hot dog vendors just because they are hot dog vendors.

  • by tbase ( 666607 ) on Tuesday July 01, 2003 @12:40PM (#6340892)
    There are a lot of comments about this being any easy hole for the bad guys to exploit by simply forging some letterhead to get a seller's info for identity theft and the like.

    First of all, I don't remember ever having given eBay my Social Security number, the Holy Grail of identity theft. Second, eBay is only going to respond to "verified requests" when they have a "good faith belief" that there is criminal activity or the threat of "imminent physical harm."

    So, I would say at a minimum they're going to verify that the request comes from a real-life LEA - it only takes about 2 minutes to look up any LEA's address and phone number, and if it doesn't match, to call it any verify. They're not going to risk getting sued for millions for giving out your personal info to a stalker. Come in off the ledge folks.

    From eBay's privacy policy [ebay.com]:
    Legal Requests. eBay cooperates with law enforcement inquiries, as well as other third parties to enforce laws, such as: intellectual property rights, fraud and other rights, to help protect you and the eBay community from bad actors. Therefore, in response to a verified request by law enforcement or other government officials relating to a criminal investigation or alleged illegal activity, we can (and you authorize us to) disclose your name, city, state, telephone number, email address, UserID history, fraud complaints, and bidding and listing history without a subpoena. Without limiting the above, in an effort to respect your privacy and our ability to keep the community free from bad actors, we will not otherwise disclose your personal information to law enforcement or other government officials without a subpoena, court order or substantially similar legal procedure, except when we believe in good faith that the disclosure of information is necessary to: prevent imminent physical harm or financial loss; or report suspected illegal activity. Further, we can (and you authorize us to) disclose your name, street address, city, state, zip code, country, phone number, email, and company name to eBay VeRO Program participants under confidentiality agreement, as we in our sole discretion believe necessary or appropriate in connection with an investigation of fraud, intellectual property infringement, piracy, or other unlawful activity."
  • by saskboy ( 600063 ) on Tuesday July 01, 2003 @12:43PM (#6340934) Homepage Journal
    On many occasions people report scam artist's auctions, often on hijacked IDs, and eBay does nothing for days. Shill bidding [bidding on your own items] is strictly forbidden, but if you present eBay with the evidence, they often don't suspend all of the accounts involved.

    Remember a few months ago when the chat boards were comprimised because Live World who runs the boards left an admin tool open to users on the Internet? Dozens of people's account information, and snitch information was made available to hackers that just needed to modify an address in Internet Explorer.

    http://pages.ebay.ca/help/community/png-user.htm l user agreement

    http://pages.ebay.ca/help/policies/privacy-polic y. html privacy policy

    The "six investigators" bit is a joke. eBay would be even more ripe with fraud if hundreds of users didn't make reports to the "support" staff.
    Read what a joke the support is like:
    http://forums.ebay.ca/thread.jsp?forum=7&th read=36 270&start=0&msRange=189
  • by Embedded Geek ( 532893 ) on Tuesday July 01, 2003 @12:49PM (#6341005) Homepage
    I took so long to type this that it's probably redundant by now, but...

    It's been pointed out [slashdot.org] that identity theives could simply use a forged letterhead to get private information, but I'm concerned about other possible misuses:

    • Abusive spouses - Someone running from a batterer would likely change bank accounts, etc. but I doubt they'd wipe an eBay account. Likely just change the old one to match those new accounts. Viloa - the S.O.B has an address.
    • Scammers might use personal info and a little human engineering ("No, I just forgot my password. Here's my some info as proof of ID...") to hijack an account, then run their scams through it.
    • A seller who feels he's being undercut by another might somehow trash their rival (although, I admit, you'd have to be disturbingly obsessed about eBay to even think to pull this one off).
    • Stalkers, stalkers, stalkers!
    The list goes on and on. I think I'll stick with garage sales, thanks.
  • by tgibbs ( 83782 ) on Tuesday July 01, 2003 @12:50PM (#6341015)
    ...is that they are beginning to be perceived as a hotbed of seller fraud. I'm not surprised that they are bending over backwards to cultivate good relationships with law enforcement.
  • by DrSkwid ( 118965 ) on Tuesday July 01, 2003 @12:53PM (#6341053) Journal
    Because auctions are part of the stolen property loop of old.

    In the days before UV pens etc. it was nigh on impossible for anyone to know if an item they were being offered was stolen or not. This was a problem if your business was buying and selling used goods. And if you were a police force with a lot of recovered property for whom you have no identified owner. And if you wanted to buy something, it's a bit risky if your goods could turn out to be stolen because the goods are returned to the owner and you become out of pocket.

    What was devised was the public auction with public viewing. It was your responsibility to visit auctions and see if any your stolen property was there and then discuss it with the auction house and from there a resolution could be reached.

    Once purchased from an auction stolen property is deemed clean. It was the previous owners fault for not turning up at the publicly announced public auction.

    Under this situation the privacy of the seller is not an issue, indeed, disclosure of the identity of the seller is of prime importance, only the privacy of the buyer is assured.

  • by TheSolomon ( 247633 ) on Tuesday July 01, 2003 @12:54PM (#6341068) Homepage
    What is more worrisome is what this implies for *buyers*! If eBay can and will, at the drop of a fax, give a seller's sales transaction history for any reason, what prevents them supplying a buyer's purchase history?

    All merchants give up a lot of privacy in order to business in any arena. None of this is surprising or scary.

    However, what scares the hell out of me is the thought law enforcement officials could see I was the winning bidder on some blacklisted book, movie, object and request my bidding history from eBay.

    The potential loss of privacy for buyers is what *everyone* should be screaming about.
  • by nmg196 ( 184961 ) on Tuesday July 01, 2003 @12:55PM (#6341076)
    This is the absolute least of the problems with eBay!

    Unless eBay can sort out the massive amount of fraud [msnbc.com] that's going on right now then I'm never using it again.

    There seems to be an absolutely massive problem at the moment with people hijacking eBay accounts and their associated e-mail addresses and eBay don't seem to want to anything about it.

    Anyone who uses eBay and has a weak password on their e-mail account (or an obvious answer to their secret question) is vulnerable to having their eBay account taken over (complete with e-mail account and credit card details) and used by a Western Union scammer.

    What's a Western Union scammer? Someone who asks to be paid though Western Union (who offer zero buyer protection or tracking of funds) and then simply never ships the item. Western Union seem happy to dish out funds to anyone so the fact that the account is in the wrong name doesn't seem to cause any problems.

    eBay should make it so it's impossible to take over an account by changing the password/and/or e-mail address unless you know lots of personal information (D.O.B., mothers maiden name, etc etc).

    I'm finding it very difficult to get eBay to reply or for any news agencies to give this any publicity.

    Over the weekend I saw about 30 Sony plasma screens advertised (usually "pre-approved bidders only") - almost none of which were legitiate. When you contact the seller - you get a similar message every time - "The item will be shipped from and I would like you to pay though Western Union". They remove them eventually if you complain, but the point is, the fact that more are appearing means that they're still finding it very easy to hijack your account.

    Nick...
  • by The Subliminal Kid ( 647767 ) on Tuesday July 01, 2003 @01:00PM (#6341120)

    When I choose who I'm going to do business with I make a number of choices and at every stage it is a trade off.

    I choose my ISP, connectivity providers, on-line shops and many more on the basis of how I feel about the company ethical and morally. This leads me directly to not having anything to do with ebay or paypal what so ever

    It is not as if they are lying (something I have serious problems with) it is laid out in black and white in the EULA.

    If you happen to use eBay and never read the click through bits you can get to them here Ebay's EULA [ebay.com].

    One request don't wine about it afterwards, it is after all your responsibility to know what contracts you entered into even if as I suspect the click thru EULA will be shown to be indefenceable in the courts.

  • by kaltkalt ( 620110 ) on Tuesday July 01, 2003 @01:00PM (#6341122)
    Should ebay have an affirmative duty to set up a system to monitor what users bid on, and if so, what should the extent of that duty be? If a user named Mohammed keeps bidding on books about bombs, terrorism, and how america is evil, should eBay have a duty to notice that and report it? I personally say no, but that's just MHO. Watching out for this stuff should be the job of the government, not individuals.

    There are 3 different levels of duty that are possible:
    1) Ebay has a duty to actively monitor/find it and to report it;
    2) Ebay has a duty to report it if it happens to notice it, but no affirmative duty to be on the lookout;
    3) No duty to either monitor or report suspicious behavior.

    I think the duty has to be legally established before ebay decides it will just hand out info.
  • by inteller ( 599544 ) on Tuesday July 01, 2003 @01:09PM (#6341211)
    ....ebay can't even guarantee that your ID and information is completely deleted from their system if you terminate your account with them....either willingly or forcibly. so in theory even though you think you have no relationship with them anymore. They could have all of your personal info somewhere either on a backup or in some active database....scary!
  • by David Hume ( 200499 ) on Tuesday July 01, 2003 @01:14PM (#6341266) Homepage

    Sullivan even offered to conscript eBay's employees in virtual sting operations: "Tell us what you want to ask the bad guys. We'll send them a form, signed by us, and ask them your questions. We will send their answers directly to your e-mail."


    Per the above, it appears that eBay is also offering to help law enforcement agencies avoid giving Miranda warnings [cjis20.org]. However, this could backfire [latimes.com].

  • What's the fuss? (Score:3, Insightful)

    by Spazmania ( 174582 ) on Tuesday July 01, 2003 @01:22PM (#6341364) Homepage
    Not sure what all the fuss is about. eBay has never promised any sort of anonymity for sellers. Quite the contrary, they've made it clear all along that as a party to a transacion, you have a right to any contact information they possess. You need only ask for it. Extending this to law enforcement as well is not exactly big news.

    Frankly, if I were in eBay's shoes, I'd do the same thing. If someone else wants to create an anonymous marketplace, let them. I'd want to cater to the folks who are above-board... If for no other reason than sellers who aren't scamming someone else are less likely to try to scam me.
  • by Abm0raz ( 668337 ) on Tuesday July 01, 2003 @01:29PM (#6341463) Journal
    This is a good thing. I refuse to buy stuff on Ebay cause I've gotten screwed twice. If I get screwed at WalMart(c), I can goto the store manager. If I get Screwed at "Mom and Pop's Local 5&Dime and Cow Manure Emporium", I can contact the Better Business Bureau [bbb.org] or my local law enforcement officials. But when I get screwed on Ebay, I'm screwed.

    Ebay ignores everything except the most extreme of cases, at worst cancelling the seller's account and leaving the fleeced buyer up a creek without a paddle. This allows for some culpability on the sellers part. When I go into a store, I can see the business license on the wall (ask, they are required to post it for all potential customers to see, even if that is often in the management offices) and know who is ultimately responsible.

    Now, I admit, I would PREFER to see Ebay require by default, Sellers to list verified contact info, but that's a pipe dream cause it would cost too much. I would also PREFER that a warrant or subpeona be required to release information such as credit card numbers, bank accounts, and transactions, even to law enforcement officials.

    Anonymity and privacy are great things, but they only extend as far as you are willing to stay private. When you enter a public domain, your expectaion of privacy is highly deminished. Ebay is very much a public area where people freely go (no different than a department store). At a department store, the store is never private, but the customers can choose to be by purchasing in cash, or they can wave that privacy and use traceable credit/debit cards or checks.

    -Ab

  • Terrorism... (Score:3, Interesting)

    by suwain_2 ( 260792 ) on Tuesday July 01, 2003 @01:39PM (#6341562) Journal
    Is anyone sick of the whole terrorism 'cliche' being applied to the most ludicrous things? You can't bring big bags into the local ramshackle movie theater because of 'terrorism'. Now, to prevent 'terrorism,' eBay will give your information out to anyone who wants it. Might I ask those who insist that this prevents terrorism... exactly HOW it does so? Are people trading bombs and illicit firearms on eBay and I'm just overlooking the "Terrorist" category?
  • Stupid Execs? (Score:3, Insightful)

    by suwain_2 ( 260792 ) on Tuesday July 01, 2003 @01:42PM (#6341600) Journal
    I think it was Sony that started bragging about all the cool ways they could cripple technology through DRM. Now eBay goes and starts spouting off about how it is eager and willing to divulge personal information to anyone pretending to be a police officer. Do they simply not grasp what it is that consumers want? Like being able to listen to their CDs, and having their private information kept private? Appologies if I sound like a troll, but this is just absurd. I had intended to sign up for an eBay account and sell off a bunch of old junk this summer, but I'm now terrified to give them my information. Not that I have anything to hide, but I do rather enjoy my personal information being kept private.
  • by saskboy ( 600063 ) on Tuesday July 01, 2003 @01:53PM (#6341714) Homepage Journal
    A few months ago I witnessed an "incident" on an eBay discussion board. A user's auction was posted for people to look at, which is a violation of the board posting rules. The user who's auction was being criticized by some was tipped off by an annonymous coward that they were being talked about and people were "trying to ruin him". This user stormed into the board and accused everyone there of a crime and said he had called the FBI.com to take care of us all. The problem was that the police really did become involved because he started harrassing people, mailbombing them, and making threatening phone calls after bidding on people's auctions so that he could obtain their address and phone number. He was suspended the next day, and then his 2nd ID. His main ID is now registered again last I checked, but his 2nd ID was still suspended.

    It is a rule violation to use one eBay ID while owning another that is suspended.
  • by call -151 ( 230520 ) on Tuesday July 01, 2003 @01:56PM (#6341756) Homepage
    Hey, doesn't anyone watch "Law and Order?"


    Currently, credit card companies and phone companies happily send info with calling and billing records to law enforcement without a warrant. This eBay policy is a naturally parallel to that and to my mind, no big deal.


    Like most privacy questions, you trade convenience and/or discount for privacy. If you don't want there to be a record of your transaction, use cash in a place that charges more but which employs particularly forgetful help and doesn't have videocams. If you want the cheapest price or things delivered to you in your pajamas, expect there to be some record of your purchase.

  • Non-US perspective (Score:3, Insightful)

    by heikkile ( 111814 ) on Tuesday July 01, 2003 @02:00PM (#6341807)
    Will Ebay be as happy to answer to the French police about who is selling Nazi stuff? How about MPIAA's questions about some Norweigian selling something that sounds like DVD and Linux? Or the Papal Office querying about someone selling contraceptives in South America? Or some Sicilian Don's questions about who is selling pictures of a shotgun wedding? Or Iranian Religious Police about who is selling Salman Rushdie's collected works? Slippery slope, they are on. Where will they draw the line?
  • by stankulp ( 69949 ) on Tuesday July 01, 2003 @03:01PM (#6342461) Homepage
    My company recently had a Linux server with an open port that was used to spoof email from an eBay seller. We know because we were contacted by the FBI. Needless to say, the server is no longer open.

    Here's what the Serbian hackers were/are up to.

    They place an ad on eBay for an item at a very attractive price. When they make a sale, they choose a valid credit card number from their list whose owner lives within 100 miles of the buyer. They place an order for the item using the purloined credit card number and have it drop-shipped to the buyer. The purchase meets with the buyer's approval, and he makes payment by PayPal.

    A few weeks later the cops arrest the buyer for using a stolen credit card. It takes a while for them to figure out what is going on before the buyer is cleared.

    That's what eBay is trying to stop.

Hackers are just a migratory lifeform with a tropism for computers.

Working...