<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Amen. Anyone who trusts this administration more than the last one isn't paying attention. <br><br>Sunil<br><br><hr>Date: Thu, 30 Oct 2014 15:10:27 -0700<br>From: paul.rumelhart@gmail.com<br>To: thansen@moscow.com<br>CC: vision2020@moscow.com; kmmos1@frontier.com<br>Subject: Re: [Vision2020] Somebody’s Already Using Verizon’s ID to Track Users<br><br><div dir=ltr><div>Yes, let's criticize our government for invasion of privacy, for searches without warrants, for assassination-by-drone campaigns and for having kill lists with the weakest sort of pseudo due process I've ever seen. Let's criticize them for leaving Gitmo open, too, while we are at it. They need to be criticized for all of that and more.<br><br></div>I agree with you about the ebola and ISIS panic. I'm tired of our government trying to rule us through fear.<br><br>Paul<br></div><div class=ecxgmail_extra><br><div class=ecxgmail_quote>On Thu, Oct 30, 2014 at 2:44 PM, Tom Hansen <span dir=ltr><<a href="mailto:thansen@moscow.com" target=_blank>thansen@moscow.com</a>></span> wrote:<br><blockquote class=ecxgmail_quote style="border-left:1px #ccc solid;padding-left:1ex;"><div dir=auto><div>But, BY ALL MEANS . . . Let's criticize our government for invasion of privacy . . . as the conservative political machine fills our heads with ISIS and Ebola paranoia . . .</div><div><br></div><div>And Lawerence Denney (GOP candidate for Idaho's Secretary of State) wants to enact laws requiring the people to register their fingerprints before exercising their right to vote.</div><div><br></div><div>Seeya ay the next gun show.</div><div><br></div><div><div><span style="background-color:rgba(255,255,255,0);">Seeya 'round town, Moscow, because . . .</span></div><div><span style="background-color:rgba(255,255,255,0);"><br></span></div><div><span style="background-color:rgba(255,255,255,0);">"Moscow Cares" (the most fun you can have with your pants on)</span></div><div><a href="http://www.moscowcares.com/" style="background-color:rgba(255,255,255,0);" target=_blank><font color="#000000">http://www.MoscowCares.com</font></a></div><div><span style="background-color:rgba(255,255,255,0);"> </span></div><div><div><span style="background-color:rgba(255,255,255,0);">Tom Hansen</span></div><div><span style="background-color:rgba(255,255,255,0);">Moscow, Idaho</span></div></div><div><span style="background-color:rgba(255,255,255,0);"><br></span></div><div><span style="background-color:rgba(255,255,255,0);">"There's room at the top they are telling you still.</span></div><div><span style="background-color:rgba(255,255,255,0);">But first you must learn how to smile as you kill,</span></div><div><span style="background-color:rgba(255,255,255,0);">If you want to be like the folks on the hill."</span></div><div><span style="background-color:rgba(255,255,255,0);"><br></span></div><div><span style="background-color:rgba(255,255,255,0);">- John Lennon</span></div><div><span style="background-color:rgba(255,255,255,0);"> </span></div></div><div><div class=h5><div><br>On Oct 30, 2014, at 2:22 PM, Kenneth Marcy <<a href="mailto:kmmos1@frontier.com" target=_blank>kmmos1@frontier.com</a>> wrote:<br><br></div><blockquote><div>
Somebody’s Already Using Verizon’s ID to Track Users<br>
<br>
Twitter is using a newly discovered hidden code that the telecom
carriers are adding to every page you visit – and it’s very hard to
opt out. <br>
<br>
<a href="http://www.propublica.org/article/somebodys-already-using-verizons-id-to-track-users" target=_blank>http://www.propublica.org/article/somebodys-already-using-verizons-id-to-track-users</a>
<br>
<br>
Twitter's mobile advertising arm enables its clients to use a
hidden, undeletable tracking number created by Verizon to track user
behavior on smartphones and tablets.<br>
<br>
<a href="http://www.wired.com/2014/10/verizons-perma-cookie/" target=_blank>Wired</a>
and <a href="http://www.forbes.com/sites/kashmirhill/2014/10/29/the-privacy-lowdown-on-verizon-and-atts-permacookies/" target=_blank>Forbes</a>
reported earlier this week that the two largest cellphone carriers
in the United States, Verizon and AT&T, are adding the tracking
number to their subscribers' Internet activity, even when users opt
out.<br>
The data can be used by any site – even those with no
relationship to the telecoms -- to build a dossier about a
person's behavior on mobile devices – including which apps they
use, what sites they visit and for how long.<BR>
MoPub, acquired by Twitter in 2013, bills itself as the "world's
largest mobile ad exchange." It uses Verizon's tag to track and
target cellphone users for ads, according to <a href="https://dev.twitter.com/mopub-demand/overview/openrtb" target=_blank>instructions
for software developers</a> posted on its website.<BR>
Twitter declined to comment.<BR>
AT&T said that its actions are part of a test. Verizon says
it doesn't sell information about the demographics of people who
have opted out.<BR>
This controversial type of tracking, known in industry jargon as
<a href="http://www.juniper.net/techpubs/en_US/junos-mobility12.1/topics/concept/httphe-mobility-overview.html" target=_blank>header
enrichment</a>, is the latest step in the mobile industry's
quest to track users on their devices. Google has proposed a new
standard for Internet services that, among other things, would
prevent header enrichment.<BR>
People using apps on tablets and smartphones present a challenge
for companies that want to track behavior so they can target ads.
Unlike on desktop computers, where users tend to connect to sites
using a single Web browser that can be easily tracked by
"cookies," users on smartphones and tablets use many different
apps that do not share information with each other. <BR>
For a while, ad trackers solved this problem by using a number
that was build into each smartphone by Apple and Google. But under
pressure from privacy critics, both companies took steps to secure
these Device IDs, and began allowing their users to delete them,
in the same way they could delete cookies in their desktop Web
browser.<BR>
So the search for a better way to track mobile users continued.
In 2010, two European telecom engineers <a href="http://tools.ietf.org/id/draft-uri-acr-extension-00.txt" target=_blank>proposed
an Internet standard</a> for telecom companies to track their
users with a new kind of unique identifier. The proposal was
eventually adopted as a <a href="http://technical.openmobilealliance.org/Technical/technical-information/release-program/current-releases/rest-netapi-acr-v1-0" target=_blank>standard</a>
by an industry group called the Open Mobile Alliance.<BR>
Telecoms began racing to find ways to use the new identifier.
Telecom equipment makers such as <a href="http://www.cisco.com/en/US/prod/collateral/wireless/ps11035/ps11047/ps11072/solution_overview_c22-606224_ns973_Networking_Solution_Solution_Overview.html" target=_blank>Cisco</a>
and <a href="http://www.juniper.net/techpubs/en_US/junos-mobility12.1/topics/concept/httphe-mobility-overview.html" target=_blank>Juniper</a>
began offering systems that allow the identifiers to be injected
into mobile traffic.<BR>
In the spring of 2012, AT&T <a href="https://www.google.com/patents/US20130273886" target=_blank>applied for
a patent</a> for a method of inserting a "shortlived subscriber
identifier" into Web traffic of its mobile subscribers and Verizon
<a href="https://www.google.com/patents/US8763101" target=_blank>applied for a
patent</a> for inserting a "unique identification header" into
its subscriber's traffic. The Verizon patent claims this header
is specifically meant to "provide content that is targeted to a
subscriber."<BR>
Inserting the identifiers requires the telecom carrier to modify
the information that flows out of a user's phone. AT&T's
patent acknowledges that it would be impossible to insert the
identifier into web traffic if it were encrypted using HTTPS, but
offers an easy solution – to instruct web servers to force phones
to use an unencrypted connection.<BR>
In the fall of 2012, Verizon <a href="https://www.verizonwireless.com/news/article/2012/10/verizon-wireless-privacy-policy.html" target=_blank>notified
users</a> that it would begin selling "aggregating customer data
that has already been de-identified" -- such as Web-browsing
history and location -- and offered users an opt-out. In 2013, <a href="http://www.att.com/gen/press-room?pid=24216&cdvn=news&newsarticleid=36458" target=_blank>AT&T
launched</a> its version -- a plan to offer "anonymous AT&T
data" to allow advertiser to "deliver the most relevant messages
to consumers." The company also <a href="http://www.attpublicpolicy.com/privacy/our-updated-privacy-policy-2/" target=_blank>updated
its privacy policy</a> to offer an opt-out.<BR>
AT&T's program eventually shut down. Company spokesman Mark
Siegel said that AT&T is currently inserting the identifiers
as part of a "test" for a possible future "relevant advertising"
service. "We are considering such a program, and any program we
would offer would maintain our fundamental commitment to customer
privacy," he said. He added that the identifier changes every 24
hours.<BR>
It's not clear how much of a hurdle changing the identifier would
present to a targeting company that was assembling a dossier of a
user's behavior.<BR>
Meanwhile, Verizon's service – Precision Market Insights – has
become popular among ad tracking companies that specialize in
building profiles' of user behavior and creating customized ads
for those users. Companies that buy the Verizon service can ask
Verizon for additional information about the people whose unique
identifiers they observe.<BR>
"What we're excited about is the carrier level ID, a higher-level
recognition point that lets us track with certainty when a user,
who is connected to a given carrier, moves from an app to a mobile
Web landing page," an executive from an ad tracking company Run <a href="http://www.adexchanger.com/mobile/run-ceo-on-using-verizons-precisionid-for-deterministic-mobile-solution/" target=_blank>told
an industry trade publication</a>.<BR>
And in a <a href="http://precisionmarketinsights.com/agenicespartnersbrands/" target=_blank>promotional
video</a> for Verizon's service, ad executive Chris Smith at
Turn, touted "the accuracy of the data," that the company receives
from Verizon.<BR>
But advertisers who don't pay Verizon for additional information
still receive the identifier. A Verizon spokeswoman said, "We do
not provide any data related to the [unique identifier] without
customer consent and we change the [unique identifier] on a
regular basis to prevent third parties from building profiles
against it." She declined to say how often Verizon changes the
identifier. <BR>
The use of carrier-level identifiers appears to be becoming
standard. Vodafone, a British telecom, says it inserts a similar
identifier into some mobile traffic. A Vodafone spokesman said
"Header enrichment is not our default operation and we do not
routinely share information with the websites our customers
visit."<BR>
However, ProPublica found a handful of Vodafone identifiers in
its logs of website visitors. That review also showed more than
two thirds of AT&T and Verizon visitors to ProPublica's
website contained mobile identifiers.<BR>
And there appears to be no way to opt out. Last week, security
engineer Kenn White noticed an <a href="http://adage.com/article/digital/verizon-target-mobile-subscribers-ads/293356/" target=_blank>Ad
Age news article</a> about Verizon's mobile marketing program
and set up a test server to see if he was being tracked. He had
opted out years ago, but he noticed a strange identifier in the
web traffic from his phone.<BR>
His <a href="https://twitter.com/kennwhite/status/525110471733817344" target=_blank>tweets</a>
sparked a flurry of <a href="https://news.ycombinator.com/item?id=8500131" target=_blank>discussion</a>
of Verizon's actions on the Hacker News discussion board, and
articles in the <a href="http://arstechnica.com/security/2014/10/verizon-wireless-injects-identifiers-link-its-users-to-web-requests/" target=_blank>technology</a>
<a href="http://www.wired.com/2014/10/verizons-perma-cookie/" target=_blank>press</a>.<BR>
Software engineer Dan Schmads, an AT&T user, also tried to
opt out. He found that he needed to visit four different webpages
to opt out, including one web page not even on AT&T's domain:
<a href="http://205.234.28.93/mobileoptout/" target=_blank>http://205.234.28.93/mobileoptout/</a>.
But he continues to see the AT&T identifier in his mobile
traffic.<BR>
AT&T's Siegel told ProPublica that he appreciated the
feedback on the difficulty of opting out and that the company
plans to streamline the process before launching its service.<BR>
"Before we do any new program, we'll give customers the
opportunity to reset their mobile ID at any time," he said. "It
would be like clearing cookies."<BR>
Google has proposed a <a href="https://tools.ietf.org/html/draft-ietf-httpbis-http2-15" target=_blank>new
Internet protocol</a> called SPDY that would prevent these types
of header injections – much to the dismay of many telecom
companies who are <a href="http://www.atis.org/openweballiance/index.asp" target=_blank>lobbying
against it</a>. In May, a Verizon executive <a href="http://www.atis.org/openweballiance/docs/OWAKickoffSlides051414.pdf" target=_blank>made
a presentation</a> describing how Google's proposal could "limit
value-add services that are based on access to header"
information.<br>
<BR>
<br>
<br>
<BR>
Ken<br>
<br>
</div></blockquote></div></div><blockquote><div><span>=======================================================</span><br><span> List services made available by First Step Internet,</span><br><span> serving the communities of the Palouse since 1994.</span><br><span> <a href="http://www.fsr.net" target=_blank>http://www.fsr.net</a></span><br><span> <a href="mailto:Vision2020@moscow.com" target=_blank>mailto:Vision2020@moscow.com</a></span><br><span>=======================================================</span></div></blockquote></div><br>=======================================================<br>
List services made available by First Step Internet,<br>
serving the communities of the Palouse since 1994.<br>
<a href="http://www.fsr.net" target=_blank>http://www.fsr.net</a><br>
mailto:<a href="mailto:Vision2020@moscow.com">Vision2020@moscow.com</a><br>
=======================================================<br></blockquote></div><br></div>
<br>=======================================================
List services made available by First Step Internet,
serving the communities of the Palouse since 1994.
http://www.fsr.net
mailto:Vision2020@moscow.com
======================================================= </div></body>
</html>