Creating privacy crises: Society hacking

In the composition of my last message, I was thinking in the back of
 my mind about how we could foment an information privacy crisis.  This
 could very well be a Good Thing, a societal hack to serve as a wake-
 up call.

At the HOPE conference, there was someone selling CD-ROMs of the DMV
 records for Oregon for $125.  The same folks promise to add more states
 soon: next in line is Texas.

Perhaps one could generate a privacy crisis by collecting that information
 and conducting a mass mailing to every person in the database: "we have
 this information on you.  So could anybody with $125.  Call your congress
 critter and complain."

Some people don't consider their DMV records critical -- so perhaps a
 mailing from a company of their credit history would open their eyes
 (More effort than the $125 + postage, but probably a better yield).

It's just a thought and it would require some amount of time & money,
 but it's a doable hack with finite resources.

Thoughts?  Is this totally off the wall, or do y'all think that somebody
 with a small but not tiny amount of money would be into doing this?
-- 
L. Todd Masco  | "Large prime numbers imply arrest."  - Previously meaningless
cactus@bb.com  |   grammatically correct sentence.  Now...

> In the composition of my last message, I was thinking in the back of
>  my mind about how we could foment an information privacy crisis.  This
>  could very well be a Good Thing, a societal hack to serve as a wake-
>  up call.

    Extremely.  Speaking as someone who derives particular joy from 
culture jamming in all of its forms, it sounds like a great thing to do 
if it is done appropriately.

> At the HOPE conference, there was someone selling CD-ROMs of the DMV
>  records for Oregon for $125.  The same folks promise to add more states
>  soon: next in line is Texas.

    It's a good idea; especially since the information is public record 
an is available from the state government on tape for a reasonable fee.  
Unfortunately, from what I've heard from people who actually have the 
database (for Florida), it works out to be several gigabytes of data, 
which is unfortunately too large to fit on a CD-ROM unless severely 
compressed.
  
> Perhaps one could generate a privacy crisis by collecting that information
>  and conducting a mass mailing to every person in the database: "we have
>  this information on you.  So could anybody with $125.  Call your congress
>  critter and complain."

    Perhaps - but it is extremely likely that the local government would 
take a rather dim view of it.  The DMV record data is probably restricted 
by some clause or other to non-marketing purposes.  Before trying 
something like that I would suggest speaking to a lawyer or being willing 
to have large legal problems.

> Some people don't consider their DMV records critical -- so perhaps a
>  mailing from a company of their credit history would open their eyes
>  (More effort than the $125 + postage, but probably a better yield).

    This would definately get you thrown in jail and your CBI account 
killed.  It's a violation of CBI's use agreement and also against the 
fair credit reporting act.
 
> It's just a thought and it would require some amount of time & money,
>  but it's a doable hack with finite resources.

    I think there's a happy medium where you can shake people up without 
going to jail in the process.  :)

> Thoughts?  Is this totally off the wall, or do y'all think that somebody
>  with a small but not tiny amount of money would be into doing this?

    Yes.  It's doable, but once again, I would seriously suggest a 
different approach.

-jon
( THEY CAN STOP THE PARTY, BUT THEY CAN'T STOP THE FUTURE )
( --------------------[ entropy@intnet.net ]------------- )

-----BEGIN PGP SIGNED MESSAGE-----


> Perhaps one could generate a privacy crisis by collecting that information
>  and conducting a mass mailing to every person in the database: "we have
>  this information on you.  So could anybody with $125.  Call your congress
>  critter and complain."

[...]

> It's just a thought and it would require some amount of time & money,
>  but it's a doable hack with finite resources.

Probably more than any of us want to pony up. My 1990 almanac lists a
1987 estimate of Oregon's population at 2.7 million people, 20 % of whom
were below the age of 15. Let's triple that and assume that 60% of the
population doesn't have a driver's license (overgenerous, I think) - 
and let's assume that you form a nonprofit (to get cheap postal
rates), and you pre-sort your mailing, and you use cheap stationary,
such that each piece costs you only $.20 - you're still talking about
a $216,000 mailing. 

It's a good idea, though; I for one am sympathetic to the cause, if
not this particular implementation. Actually, there's no reason that
the Oregon Privacy Institute (which I just made up on the spot :) 
couldn't hold a press conference in a room with stacks & stacks of
flats of envelopes, and announce that the mailing will take place
soon .. :)

Thanks for inspiring me (an Oregon resident) to get off my butt and
write to my state representative. For what it's worth, it is possible
to ask the Oregon DMV not to release your records - I've done so,
but don't know if I'm on the CD or not.


-----BEGIN PGP SIGNATURE-----
Version: 2.5

iQCVAgUBLlf+P33YhjZY3fMNAQGaXgP8DVealDg09ypFtnshBq8GvtjnmpA5Bpa/
VChXJE6R2ttylGNIbYjdXdLO+0AZR62f8e8R0ab4eccddMra14jradsrSpQJHqeL
lOahiZGzFYXD/0S260B6gXQMT4K0BzwjX2AUCeCfS4zbya6JoTG5jAB0B8J6iS6e
U1CQl6JxHXI=
=Ya0c
-----END PGP SIGNATURE-----

L. Todd Masco:
> Perhaps one could generate a privacy crisis by collecting that information
> and conducting a mass mailing to every person in the database: "we have
> this information on you.  So could anybody with $125.  Call your congress
> critter and complain."

I love the first part of this idea, and hate the second part.

As other posters have noted, putting the information that we
are unconsciously giving away to strangers, back in front of our
faces, is worth any million screeds about  how our privacy is
being eroded.  The fact is, we can't see that our privacy is
being eroded.  It happens silently and invisibly.  That feedback
loop needs to be completed to our guts, for there to be enough 
awareness to motivate most people.

But just what are we supposed to tell our Congressmen
to do?  We have way too much "write your Congressman to solve all 
our problems" bullshit in the privacy advocacy area.  It's almost all
hallucination.  I defy you to suggest anything that has a snowball's
chance in hell of passing that will _in fact_ have a major impact
on improving our privacy instead of just satisfying the needs of 
special interests who want to keep their monopoly on consumer 
information and keep consumers effectively ignorant of what they 
are collecting.  

The most likely outcome of the above tactic are weak laws saying
that DMVs can only sell their data to a few select federal agencies
and credit reporting companies.   What a blow for privacy.

What we need is privacy as a _business_ movement.  We need to
offer services that are alternatives to to the current dossier
system.  People have to take action on their own, not go whining
to their purported leaders and comforting themselves that that 
they have done something to solve the problem.

Political action does have a niche in the activist ecology, but
it is a much smaller niche than is reflected by the dominance
of politics over more important consideraions in the privacy
movemement.  The proper niche of political action is as
completementary supplement to personal action and business
activity.  Political action that purports to be the main solution 
to the problem is, in all likelihood, part of the problem.

Political activism in favor of legal cryptography is
a supplement, a support for our personal decisions to use
cryptography to empower people to improve their own privacy.
It is not a replacment for deploying and using cryptography,
it is only a support activity.  Most of the decisions will
be made in the marketplace, in this case the marketplace
of aliased and out of state driver's licenses, with
with politcs being only one of a wide variety of considerations.

Jim Hart
hart@chaos.bsu.edu

In article <199408220237.VAA17153@chaos.bsu.edu>,
Jim Hart <hart@chaos.bsu.edu> wrote:
>
>L. Todd Masco:
>>"we have
>> this information on you.  So could anybody with $125.  Call your congress
>> critter and complain."

>I love the first part of this idea, and hate the second part.
...
>But just what are we supposed to tell our Congressmen
>to do?

Fair enough. ^Call your congress critter and complain^Support anonymous
 transactions with digital cash from (company_name).  I agree with
 the anonymous poster who said that such a move should be put off
 until we have a real solution.  So, whatever company wants to kick
 this off could use this to generate political protection.

To put my comment in the right context, I was worried (when thinking
 about this) about anonymous digital cash being made illegal.  The
 intent would be to kill opposition to anonymous digital cash.

Eric mentioned in his talk at the SEA that companies exist that sell
 mailing lists of people of a particular ethnicity based upon spending
 patterns: the example he gave was a company marketing to jewish people
 bought a list of "believed jews" for the purpose of marketing (and Eric
 mentioned the irony).

Another variation of my suggestion would be to get such lists and
 to mail to people a statement saying "You are registered as an
 (ethnicity) in mailing lists."  Even a 50% hit rate would drive
 the issue home to people with enormous efficiency.

The intent isn't to get the government to Do Something, but to make
 people en mass aware that privacy is a real issue that affects them.
-- 
L. Todd Masco  | "Large prime numbers imply arrest."  - Previously meaningless
cactus@bb.com  |   grammatically correct sentence.  Now...

Greg Broiles writes:
 > Probably more than any of us want to pony up. [...]
 > you're still talking about a $216,000 mailing. 

Yup.  I wasn't thinking of some individual doing this: $216K is relatively
 small change for a reasonably sized organization, though.  On the
 other hand: remember, we live in an age when people like Perot live.

Another consideration is that you could probably interleave: send only
 1 in 5 people one of the letters, and you may very well have a similar
 impact for "only" $44K.

With 250 million people in the US, guess that half of them have DMV
 records, and take a fifth of them: that's $1 million dollars at
 $.20/mailing.  How much do lobbying organizations spend?  Political
 parties?  (Hmmm.  Maybe we could get the House post office to send
 'em).

Another approach might be to try to find small groups of people in
 each county in the US to handle the mailings.  

Of course, the details aren't important: the level of awareness generated
 is.  I also agree with the anonymous poster who suggests that we
 wait until there's a real alternative.
--
L. Todd Masco  | "Cowboy politicians sucking up to the aristocracy, not
cactus@bb.com  |  even sure if they like democracy..."  - TR-I