I hate telemarketing with a burning passion almost as intense as I have for spammers.  My worst hatred, though, in terms of telemarketing, I reserve for the automated sales call.  It’s the telephonic equivalent of a drive-by.  Worse, in many cases, I can’t seem to hang up on them (i.e. I hang up and then pick up a few seconds later and they’re still droning on about whatever it is they’re trying to sell).

So it was with something between anger and disappointment that I listened to my messages yesterday to hear one from Cabela’s.  I expected better from them.  According to the Caller ID information the call was received at 10:33AM from “MOSLEY MICHELLE” at 1-404-524-1180.  The content of the message was to remind me of a $20 “gift” I could get with the card I’d received in the mail if I made a $150 purchase.

My numbers are on the National and State do-not-call list.  However, I realize that they make exceptions for “existing” business relationships.  I’ve bought from Cabela’s both online and in person at the Ft. Worth store.  Since I make it a point never to give personal information at the register, they appear to be exploiting my online personal information, which they require when placing an order.  In fairness, I decided to have a look at their privacy policy, just to be sure this wasn’t already covered before I unloaded on them with both barrels.

Down a ways was this section, which seems to imply to me that they shouldn’t be doing this:

We will request your telephone number or facsimile (FAX) number, and if you provide it, you may receive telephone or FAX contact from us with information regarding your orders or requests for information. We do not share phone or FAX numbers with third parties for marketing purposes.

If Cabela’s did not share my number with a third party for marketing purposes, then it means they’re violating federal rules by using bogus Caller ID information.  If they did share it, then they’re violating their own policy.  Regardless, though, they’re pissing me off by taking unwanted liberties.

I submitted an email “service request” with them to see if I get any kind of reasonable answer.  I’m not expecting much, though.  I may end up just having to cancel my account with them if I can’t get a satisfactory response.

Update:  Received an email reply from a CSR who stated that she had “marked” in my file that I did not want to receive phone calls and that she was forwarding my information to the appropriate department for a reply.  That’s all well and good, I suppose, except for the fact that she had to “mark” my file about phone calls.  I looked on Cabela’s website and while there were options to control whether you got email marketing messages, there were none to control how your phone number is used.  Anyhow, now I’m curious to see whether this other department (which she didn’t specify) will respond.

Checking through my referer logs this morning I came across a lot of hotlink requests for the thumbnail image of my Kimber Ultra CDP II:

I found it somewhat amusing that the hotlinks were coming from this thread on the Dyestat forums concerning a member who was contesting being banned for posting porn.  It turns out that he posted a link to a cute little kitten from a site that hates hotlinking far more than me.  Instead of just adding a watermark this site replaces the hotlinked picture with a nasty bit of porn.  One of the posters on the thread hotlinked my picture to prove the point that just because you see the original OK that it may be different when someone else views the hotlinked image (due to browser caching).

I made the mistake of clicking the link to the cute kitten, which was posted to show the *original* photo, but it appears that it’s been permanently replaced with a photo that will scar my brain for many months to come (although it’s not as bad as goatse.cx).  Still, though, my brain managed to register an “interesting” advertisement at the bottom of the page.  It listed some very adult personal ads from women supposedly in Keller, Roanoke, Hurst, and North Richland Hills and it referenced my zip code. 

I was a bit curious as to how they knew the zip code, as I didn’t think I’d done anything where my zip code would end up on an ad server’s cookie.  In the past I’d heard of geolocation services that could locate you based on your IP.  In fact, I recently added the EE IP to Nation module for comments.  However, that module only attempts to determine the nation for an IP.  From the last time I’d really looked at these services I didn’t recall them being exact enough to get to the zip code level.  It turns out that the latest services, such as IP2Location, can do a pretty good job of determining your general location:

Of course it always seems like the porn industry is the first to take advantage of and drive new web technologies.  In a previous post I noted AT&T’s cheesy and annoying system for location verification with their CallVantage VoIP service.  Perhaps AT&T should consider hiring some people from the porn industry to make the process more painless.

A long time ago (in a galaxy far, far away…) I once made the mistake of making a purchase from WorldNetDaily’s online store.  It took a while, but I was eventually able to recover from the onslaught of email they sent out, although from time to time they conveniently “forget” that I don’t want to get email.  However, their opt-out ability doesn’t excuse their either leaking or selling my email address to spammers and phishers. 

One of the benefits of having a dedicated email address for each entity I do business with is that it makes most phishing attempts simply silly.  Such as the “PayPal account validation” scheme.  For those who may not be familiar with this scam, some POS thief will create an email appearing to be from PayPal that says that if you don’t revalidate your account that it will be suspended.  They give a link in the email that appears to take you to the PayPal site, but it’s actually their own front-end that mimics PayPal.  If you enter your information on the confirmation page, you’re screwed, because they will have a lot of sensitive data on you (see extended entry for details).

Anyhow, I just got one of these scam emails at the WorldNetDaily email address.  But just for grins, I followed the link and took a look at the site.  First, it has a form for your Paypal ID/password on the first page.  Interestingly, though, it doesn’t care if you leave it blank.  It simply takes you to the “confirmation page.”  Examining the page source for the frame, I found this tidbit:


<form method=“post” action=“account.php” name=“uhoh”>


Note the name attribute.  If you were to submit the form with correct data, “uhoh” would be an understatement.  This POS may be a thief, but he appears to have a sense of humor.  I hope it makes him many friends in the gray-bar motel.

Update:Now they’re trying to get me to update my Wells Fargo account, which would be interesting, except that a) I don’t have one, and b) the email was sent to my “blog” email (which is one of the hazards of commenting on some blogs).

(click for humongous)

(the line is where I had to scroll the screen and glue two captures together with GIMP)

It appears that there’s a member of the Texas Rangers who doesn’t much like news cameras. 

Pitcher Kenny Rogers might be facing legal action and a suspension from baseball after an altercation with two television cameramen in front of the Rangers’ dugout before Wednesday’s game with the Los Angeles Angels.

KDFW/Channel 4 cameraman Larry Rodriguez left Ameriquest Field in Arlington on a stretcher afterward and was taken to Medical Center of Arlington complaining of neck, back and leg pain.

Rangers owner Tom Hicks said Rogers is dealing with “anger-management issues” and apologized to KDFW.

Anger-management issues?  What ever gave you that idea? 

Anyhow, I don’t have much sympathy for a professional ballplayer, since it’s very obvious by now that the job comes with a certain amount of celebrity and the cameras come with that.  He should have known the job was dangerous when he took it. 

But it did get me to thinking about the news media in general and their tendency to shove a microphone and a camera into people’s faces when they’re grieving or otherwise at a low moment in their lives.  If someone is not otherwise already a celebrity, then that person gets a free pass when it comes to slugging any reporter that shoves a microphone in their face after a stressful event (like having a family member murdered).  Frankly, we don’t really need to hear the answer to “How do you feel?”  I think we can all figure it out.  It’s not newsworthy.  We can all afford to give people a bit of space until they’ve dealt with the initial shock.

It seems that legislators in the Texas house have taken time from their busy tax-raising schedule to send HB2893 out of committee.

What is HB2983? First, iIt requires the insurance companies to report all automobile insurance policy purchases, renewals, and cancellations to the state.

Sec. 601.502.  REPORTING REQUIREMENTS. (a) The motor vehicle liability insurance compliance program shall require that, on or after the effective date of this subchapter, when an insurance company authorized to write motor vehicle liability insurance in this state or its designated agent issues or renews a motor vehicle liability insurance policy that provides the minimum coverages required by this chapter to a person who is required to maintain insurance under this chapter and who is the holder of a Texas driver’s license or a Texas commercial driver’s license, or terminates or cancels such a policy, the insurance company or its designated agent shall furnish to the department or administering entity the following information:
          (1)  the insurance policy number;
          (2)  the effective date of the policy;
          (3)  the make, model, license plate number, and vehicle identification number of each vehicle covered by the policy; and
          (4)  any other information reasonably required by the department.
     (b)  The required information relating to an insurance policy that is issued or renewed shall be provided to the department or administering entity not later than the third business day after the date of issuance or renewal.
     (c)  The required information relating to an insurance policy that is terminated or canceled shall be provided to the department before the effective date of the termination or cancellation.

But once the state has its grubby paws on the data, they plan to do far more with it than just check vehicles at registration renewal.  The bill would also add RFID tags to inspection stickers, such that these tags could be read by existing toll-tag readers as well as any other readers that our “friends” in Austin decide to set up.

Sec. 601.507.  SPECIAL INSPECTION CERTIFICATES. (a) Commencing not later than January 1, 2006, the department shall issue or contract for the issuance of special inspection certificates to be affixed to motor vehicles that are inspected and found to be in proper and safe condition under Chapter 548.
     (b)  An inspection certificate under this section must contain a tamper-resistant transponder, and at a minimum, be capable of storing:
          (1)  the transponder’s unique identification number; and
          (2)  the make, model, and vehicle identification number of the vehicle to which the certificate is affixed.
     (c)  In addition, the transponder must be compatible with:
          (1)  the automated vehicle registration and certificate of title system established by the Texas Department of Transportation; and
          (2)  interoperability standards established by the Texas Department of Transportation and other entities for use of the system of toll roads and toll facilities in this state.

By the way, the next section of the bill establishes that if a vehicle is spotted via tag reader that doesn’t have current insurance, the system automatically mails a $250 ticket to the registered owner of the vehicle.

Here’s the full text (PDF) for those who may be interested.

The bill calls for “tamper-resistant” transponders.  Would it be tampering to hit it with an EM pulse?  After all, you didn’t actually touch the device.  Of course, the downside is that a strong EM pulse is difficult to generate and would also fry your car’s electronics.

Maybe a clear metal-film layer applied over the glass instead?

As a rule I never give out my address or phone number when making a retail purchase.  However, the ZIP code is another story.  It’s not personally identifiable (unless you are the only person living in that zipcode), but it’s still annoying.  It’s yet another little irksome thing that retailers have piled on to the whole retail experience. 

I suggest that when asked for a ZIP code that everyone use 75755.  It sounds vaguely plausible at first, since it’s not (yet) a popular and recognizable ZIP code.  Of course, when Best Buy or World Market (the offender that set me off last night) decides that they’re seeing a spike of traffic from this ZIP code and decides to investigate the area, they’ll realize they’ve been faked. 

Even if you don’t use 75755, then at least always give some kind of fake ZIP code.  If we make the data gathered useless, perhaps they’ll stop bothering us at checkout when all we want is just to be done with the sale and go home.

I see from her latest entry that Rachel Lucas is thinking of setting up another, anonymous website to vent.  Given that she’s using her real name, it makes it easy for stalkers to find her. 

The first and biggest obstacle to online privacy is that ICANN requires valid contact information in domain registration records.  If it is found that you put false information in the registration record, they can cancel your ownership of the domain.  In fact, I recall in one instance where a company attempted to hijack a domain from its rightful owner and ICANN sided with the hijacker because the owner used false registration information.  While having your contact information in the registration database is bad from a spam/junk mail perspective, it also makes your address public knowledge to anyone who knows how to do a WhoIs lookup.

Some people have taken the approach of using a P.O. Box (or one of those PMBs you can get at the UPS Store).  The solution that I use is a service from a company called Domains By Proxy.  If anyone does a WhoIs lookup on my domains, all they will get is the address of Domains By Proxy.  If someone needs to contact me about the domain, Domains By Proxy maintains an anonymous email redirector (with spam blockers).  If someone wanted to find out my real address they’d have to get a subpoena before Domains By Proxy will release that information.  They are affiliated with Go Daddy, so you have to use them as your registrar.  The service is $9.00/year, which is less than a P.O. Box.  I haven’t had any problems with either Go Daddy or Domains By Proxy, although Go Daddy is a bit pushy during the registration/transfer process in trying to get you to buy other services from them.  If I recall correctly, you have to decline three separate pages of “special offers” before you can finish the checkout process. 

Name Secure is another, similar product ($9.00/year), but I don’t have any experience with them, so I can’t say how good their service is.

As long as you use a real name, people can find you using other methods.  However, a good pseudonym and a service like Domains By Proxy can make it harder for stalkers and enraged Michael Moore fans to find you.

It looks like RFID tags may make it onto store shelves sooner than we had been led to believe.  The industry had been trying to say that this could be as much as ten years away and that their current efforts were geared towards case and palette tracking.  However, Wal-Mart is already running a trial with HP printers in the Dallas area.  Additionally, a major national clothing retailer appears ready to bring this out as early as next year on all of their retail clothing items.

As I’ve mentioned before, I have serious privacy concerns about the use of RFID tags on individual items that we purchase.  If it’s just on the packaging, and we throw away the packaging, that would probably be OK (which is what Wal-Mart claims is the case with the HP printers; Hmm…  I still have my packaging from the last HP printer I bought, just in case I need to send it back, although I bought it at Fry’s).  It’s when the RFID tag is embedded in the item and can’t be removed that things get nasty.

The problem with RFID tags is that they don’t just identify what something is (i.e. a particular brand/size of a known brand item), they also give a unique identifier for that instance of the object (a serial number).  If you can read the tag to get the serial number and cross-reference that with sales data you can tell a lot about a person. 

The RFID industry is desperate to debunk these “concerns” as not realistic or to reassure us that any purchase databases will be protected.  Let’s examine the potential problems.

Privacy activists worry that consumers could leave stores broadcasting all kinds of information about their belongings. They fear that, with the right tools, anyone—including thieves—could detect what’s in your purse or pockets. Another concern is that people’s things would leave an electronic trail of their whereabouts and shopping habits for law enforcement officials, investigators, lawyers or marketers to collect.

RFID defenders say such concerns are overblown—a common theme at this conference. One argument is that the only information companies are interested in storing on RFID tags are serial numbers, which are meaningless without access to the database where all the information about the item lives. Only the privileged eyes of certain employees would have access to that database, executives say. Another argument is that RFID tags only submit signals only when prompted by a reader within close range, generally a few feet at most.

Concerning this database of serial numbers, I simply don’t trust these companies to run such a thing without the potential for privacy leaks.  Further, even if they do manage to put in place a decent and effective privacy policy today, there’s nothing to stop them from changing the terms later on, after they’ve amassed a tremendous database (“I am altering the terms of our deal.  Pray I do not alter them further.”).  If you think I’m paranoid, you may want to revisit the original debates on the establishment of Social Security Numbers.  People who were concerned about this were given assurances that the SSN would never be used for any purpose other than providing Social Security.  Heck, it’s even in the law that the SSN is not to be used for identification purposes.  That really did a lot of good, didn’t it?

As noted above, the RFID industry claims that these tags can only be read from a few feet away.  Even that’s not sufficient if you can get people to pass through some kind of chokepoint where they pass a few feet from a reader.  Ever notice those vertical “dividers” placed between doors in most retail stores these days?  Those are magnetic readers for current loss-prevention systems.  That kind of chokepoint could be readily adapted for RFID purposes. 

But even given that these devices are limited to short ranges today, how can we definitely say that there will never be technology capable of activating and reading the tag at greater ranges?  I wouldn’t take that bet.  I wonder if the original inventors of the CRT ever thought about van Eck Phreaking?

So, to sum it up, I don’t trust the companies to guard my privacy in the future with regard to the serial numbers of products I’ve purchased, and I don’t trust that technology won’t be found that allows reading the tags at longer ranges.  However, there is a simple solution to my concerns.  Simply kill the tags at the time of purchase. 

Of course, the RFID industry is quick to resist this solution.  They give a variety of reasons, but my suspicion is that they ultimately do want to be able to track everything at some point in the future (even if they won’t admit it to themselves). 

Here’s their current set of excuses:

Retailers and consumer-goods companies are hesitant to agree to removing tags from items at the time of purchase for several reasons. One reason is that RFID tags could help with returns by exposing people trying to get a refund for a product they never really bought, or one they purchased from another store. In the future, technology proponents envision medicine cabinets and home appliances equipped with RFID readers, alerting people to expired drugs and automatically selecting the gentle cycle on the washing machine for delicate clothing.

Frankly, I don’t give a damn about these problems.  I’m willing to pay the slightly higher prices that refund scams generate in exchange for privacy.  Frankly, there are non-RFID methods for dealing with fraud, though, so I find this an unpersuasive point.  As far as these “smart home” concepts, the industry’s own research shows that people don’t care about these things (although they keep hammering on this; in my more cynical moments I think they hope it will be the sugar that helps people to swallow RFIDs).

All the industry needs to do is make sure the tags are killable and that people are fully informed about how to make sure they’re dead before leaving the store.  That one thing would mollify me.  As long as they resist this, I will regard them with a high level of suspicion.  Resisting what seems to me to be such a reasonable request makes me very wary of their ultimate motives.

Some previous items I’ve written on the subject of RFID tags:
The basic problem.
RFID and cameras.
Implanting RFID chips.

Not only does the state want to hear everything you say, it doesn’t want to pay for the privilege.

Hoping to contain “skyrocketing” costs, New York Attorney General Eliot Spitzer has asked the Federal Communications Commission to limit how much U.S. cell phone service providers charge law enforcement to wiretap calls.

After a period of spiking prices, Spitzer’s office now spends a budget-busting $400,000 to $500,000 annually on wiretaps, while some smaller law enforcement agencies aren’t using the basic crime-fighting tactic at all, according to a document Spitzer filed Monday with the FCC.

“Such a cost-recovery scheme (makes) intercepts prohibitively expensive for virtually all law enforcement agencies, and result in depriving law enforcement of an essential crime-fighting and anti-terror tool,” he added.

Cell phone service providers have warned for more than a decade that wiretapping would be an expensive proposition, much more so than traditional phone networks. Furthermore, there are mechanisms in place that allow law enforcement agencies to dispute any wiretapping costs if they feel they are being overcharged, a representative for the Cellular Telecommunications & Internet Association (CTIA), a cell phone industry trade group, said in response to Spitzer’s request to the FCC.

According to Spitzer, a yearlong wiretap costs between $5,000 to $26,400, depending on which U.S. cell phone service provider is doing the setup and maintenance. The CTIA representative did not comment on figures Spitzer’s office provided.

Poor big brother… can’t afford to listen as much as he wants…  <Screaming Baby>Waaaaaaa</Screaming Baby>

Can you tell that I’m not entirely sympathetic to Mr Spitzer?

Whenever I do business online I tend to create a new email address for each company I do business with.  Late last week I received a spam email at the address I used when signing up for the online account access feature that Cingular offers.  I rechecked all the account settings as well as their privacy policy and determined that their policy is not to share email addresses with any outside agencies.  Further, I know that the email address that I used has not ever been used for any other purpose (i.e. I’ve never sent anything using it, since I’d have to reconfigure my email client to do so).

The spam was for some kind of cruise website and came from local-newswire.com, which isn’t affiliated with Cingular in any way.  This is actually more alarming than if they’d just sold the email, since it could indicate a breach in their security.  It’s possible that they sold my address, but it seems unlikely since that specifically violates their stated privacy policy.  It’s not that I have that much trust in Cingular, it’s that from what I’ve seen they seem to handle everything in-house when it comes to email advertising.  I also confirmed this when I called customer service to complain to them about the spam. 

If they didn’t sell my address, then it means that either someone explicitly broke into one of their systems and stole the addresses or that one of their systems was otherwise compromised and the addresses were harvested (i.e. through a worm).  The worm scenario is more likely than you might think, given that most of the worms we’ve seen lately have been created by spammers to send spam.  It doesn’t seem like that much of a leap for them to use the worms to harvest emails.  Alternately, it could just be that a mass-mailing worm harvested addresses from an infected system at Cingular and sent out emails to a spammer who took the addresses from them.

Regardless, I know that I never initiated any action that would have resulted in receiving this email.  I know that I opted out of all marketing emails when signing up for the Cingular account.  I know that the email address that I used is not subject to being easily guessable (i.e. it wasn’t a common name, it wasn’t just the company’s name, and it contained an underscore).  I know that none of my systems has been infected by a worm (I run weekly virus scans, use LiveUpdate, have the feature enabled to scan each email that is received, and don’t use any of the Microsoft email clients).  Somehow, either intentionally or though negligence, my email address was leaked by Cingular and picked up by the spamming bastards at local-newswire.com. 

The Cingular customer service rep opened a ticket with their IT support to report the problem, and he said he’d let me know the outcome.  I guess I’ll just wait and see if they turn up anything, although I don’t expect much.  If Cingular was compromised, it would not be in their interest to admit it.