Go to previous post:

Go to Electrolite's front page.

Go to next post:
F Train on My Trail:

Our Admirable Sponsors

February 18, 2003

The World’s Online Informer: Ernest Miller of LawMeme quotes and discusses an address by Joseph E. Sullivan, Director of Compliance and Law Enforcement Relations for eBay. Boasts Sullivan:
EBay has probably the most generous policy of any internet company when it comes to sharing information. […]

Our policy is that if you are law enforcement agency you can fax us on your letterhead to request information: who is that beyond the seller ID, who is beyond this user ID. We give you their name, their address, their e-mail address, and we can give you their sales history without a subpoena.

We also do other things to facilitate your [law enforcement] investigation by looking around and doing some searches on our own, typically to see if there are some other user IDs associated with that thing.

Remarks Miller:
Remember when everyone got excited about the bookstore that was subpoened by Ken Starr in order to determine what books Monica Lewinsky purchased? Remember how the bookstore fought the subpoena? EBay doesn’t even require a subpoena. EBay would have turned over the info with a mere request.
A mere request, I might add, from any law enforcement agency that sends a fax on their letterhead. Or, for that matter, anyone with a fax machine, a copy of Pagemaker and a few decent-looking fonts. There’s secure authentication for you.

But never mind the quibbling. This will seem problematic or not depending on how much you trust our fine prosecutors and police. Certainly I can’t imagine any news stories in the last few years that might make me less than totally enthusiastic about expanding police power indefinitely, and if you can, it’s probably because you’re guilty of something, citizen. [04:59 PM]

Welcome to Electrolite's comments section.
Hard-Hitting Moderator: Teresa Nielsen Hayden.

Comments on The World's Online Informer::

Jon H ::: (view all by) ::: February 18, 2003, 06:42 PM:

One quibble: Ebay isn't exactly like a bookstore, since the typical bookstore is unlikely to be handling transactions of high-value stolen goods. Or shuttle debris, for that matter.

It's not inconceivable that a used bookstore might come into possession of stolen books, I can't imagine that stealing books is the first thing people think of when they want to make some money.

While EBay has a degree of commonality with bookstores, it also shares characteristics of pawn shops, flea markets, and gun shows.

Pawn shops, I think, are usually required to keep records on what they handle, in case someone pawns stolen goods. I don't know what the requirements are for law enforcement to get a hold of those records.

Vicki ::: (view all by) ::: February 18, 2003, 08:58 PM:

Still, some kind of verification is in order, I think.

As Patrick points out, any number of people could fake an appropriate letterhead and get information about, say, the person who outbid them for something. Or get the address of someone selling something valuable, and get it by burglary instead of honest purchase.

Henry Farrell ::: (view all by) ::: February 18, 2003, 09:42 PM:

Scary stuff - it used to be that people were worried about how governments might invade their privacy; then they got upset about firms using their personal data; now the big issue seems to be firms gathering your personal information and sharing it with law enforcement and state security w/o your consent. This is stuff I've been tracking as an academic - Ebay's dubious behavior is emblematic of a wider trend. And these little cooperative arrangements may be de rigueur in the future - there are some worrying proposals floating around in the international ether to (a) oblige ISPs to gather and store information on their customers' habits, and (b) then make them share it with governments.

Bill Humphries ::: (view all by) ::: February 19, 2003, 12:59 AM:

Jon, there's a 4th Amendment. And I damn well expect anyone I do business with or through to stand by it and demand at the very least a supeona. I don't care if they are selling shuttle debris or saints relics.

There's a name for people who volunteer other people's private transaction data to the police: Quisling.

Kevin Andrew Murphy ::: (view all by) ::: February 19, 2003, 01:51 AM:

The sales history is already easily gotten through the eBay interface, without having to fax anyone anything. All you need to do is look at someone's ebay store and you can find everything they've sold for the past several years.

The email address and mailing address are also fairly easily gotten as well: The first by just sending the person an email via your ebay ID, usually a question about the item (which gives you a real email address), and the second by simply buying something from someone by winning an auction.

Since detectives are allowed to lie through their teeth in the course of an investigation, if frustrated in getting contact info directly from eBay, the simplest expedient would be to forge some bogus new eBay account, win an auction, then when the payment information arrived, not send a payment and run off with the information laughing.

Likewise, sales history also includes everyone someone has sold to, and you can send them messages, posing as, say, another buyer who lost the address to send the person a payment for that Victorian silver-plated tonsil remover.

Anyone creative enough to forge stationary for their own personal police department would be creative enough to try these gambits, and since a large proportion of ebay buyers and sellers are lonely, garulous retirees, it would be pretty simple to get the information by hook if you can't get it by crook.

Not that this makes things much happier, but I'd rather not have to deal with a plague of detectives doing the fake identity game. At least this way they leave a papertrail for the defense to use.

bryan ::: (view all by) ::: February 19, 2003, 05:09 AM:

although Quisling may have turned over private data I do not believe one could say that was all that he did:


cd ::: (view all by) ::: February 19, 2003, 06:09 AM:

Bill: I'd agree with Bryan that Quisling may not be the best word. Stukach is probably more apposite.

Rich McAllister ::: (view all by) ::: February 19, 2003, 12:39 PM:

I just spent some time reading the eBay policy. The only bits law enforcement can get without a subpoena that a buyer can't get are the second phone number, fax number, "personal or business" and password. It's annoying that eBay even keeps the password in clear, and it means that lots of the other info eBay has but only turns over on subpoena can leak out by just logging in and reading the profile.

Xopher ::: (view all by) ::: February 19, 2003, 01:50 PM:

I cannot imagine why law enforcement would need a user's password. Or even why eBay would.

The fact that eBay has it in clear and will supply it to law enforcement on request means that there's a pretty clear defense to any accusation of illegal activity on eBay: "Someone else, probably an eBay staffer, did it, using my ID to try to frame me."

Any reasonable jury (both of 'em) would have reasonable doubt after that. I would, anyway.

Troy go screwed ::: (view all by) ::: June 19, 2003, 06:50 PM:

I was scammed by someone who found me because I was bidding on a Herman Miller chair - they emailed me and, since I lost the auction - I thought I could get the chair more cheaply. Like a big freakin' idiot - I wired $385 to Rome and they took my money (according to my Western Union receipt) and then turned around and emailed me back with: "Sir I don't know what to say .... I don't mean to make you lier but you must prove to me that you didn't retrieved the money....
All I know that I was at the WU and they said to me that the money had been retrieved just before I came there ...explain yourself!"

In other words -"bend over..."

I tried to contact them repeatedly after this - and well - no response.

I contacted Ebay - they said - essentially - because the fraud didn't occur as the result of a winning bid - it's outside the scope of ebay.
I then started checking around - emailing other Herman Miller chair bidders to see if they had seen any fishy activity by "sellers" - a few said they had. I researched the email addresses of these other questionable sellers and at least one of them turned out to be the same person - they have exactly the same comment history from other ebayers - has to be the same.

What the hell can I do? I filed a report w/the FBI internet fraud unit. Anyone know if they will do anything? I mean - Italy has laws too right?

Troy got screwed ::: (view all by) ::: June 19, 2003, 06:55 PM:

I forgot to ask - can a private citizen request a subpoena. I know ebay has info on these people - the email address I used to contact this person can also be researched on ebay. That is - if you do a reverse lookup using the email - you can find the person's response history from other people he/she has transacted with. In order to transact on ebay - you need a credit card, so I know ebay has their info. Can Is it possible the authorities would subpoena their records, even though this person lives in Italy?