Think anonymity is an issue of little interest to you because you have nothing to hide? Think again. Almost anyone, given a little thought, can imagine a scenario where absolute anonymity would be necessary to avoid harm.
Think about ethnic Albanians being rooted out of Kosovo. Anonymity helps victims of ethnic cleansing and associated atrocities document their plight with some measure of safety.
Think about an abusive working environment or relationship and being able to register a complaint, anonymously, with the appropriate agency.
Even the Justice Department, no friend of secure communications of any kind, recognizes the inherent value of anonymity: “Anonymity has incontestable value in a huge number of situations, and it is constitutionally protected,” Philip Reitinger, a Justice Department prosecutor, told attendees of the mid-April 1999 Computers, Freedom, and Privacy conference in Washington, DC. Maybe it was a mistake because Reitinger told the next session that “if you’re serious about prosecuting crime on the global communications infrastructure, you have to have traceability.”
For most of us, anonymity is useful on the Internet for avoiding spam and keeping our true identities cloaked to avoid becoming targets for marketers and other kooks. Services and tools like Anonymizer and Zero Knowledge Systems’ Freedom allow users to create persistent pseudonyms that are difficult (but not impossible) to trace.
Users of Internet anonymity services should be aware that security leaks—including IP address traceability—have been discovered in most of the popular services. Most of the services work by using techniques to strip or mask any identifying information—such as domain name, username, email address, and IP address—from messages originating with the service subscriber. This is accomplished by acting as a sort of intermediary or “proxy” for information being sent to and received from a service subscriber. Information is sent through the intermediary proxy rather than directly to the user.
Unfortunately it is a relatively trivial task to include a small piece of JavaScript or ActiveX code in a Web page that queries the user’s IP address. The IP address can easily be converted to a specific computer’s complete domain name (or subnet in the case of dynamic IP addresses used by many dial-up services). From that information, geographic location, telephone number, and sometimes even a true name can be ascertained with little work.
Without question, the Internet has become a crucible for privacy issues simply because the Net’s technologies are so powerful: while it’s remarkably easy to remain relatively anonymous on the Net, it’s just as easy for individual behavior to be tracked and personal privacy to be violated.
Privacy advocates and civil libertarians argue that Internet anonymity tools help extend freedom of the press and personal privacy to the realms of cyberspace. Law enforcement agents, on the other hand, maintain that anonymity helps criminals avoid prosecution.
It has become ridiculously easy for governments and corporations to compile extensive digital dossiers on us as individuals, as we traverse the Net. To many, guaranteed anonymity and strong cryptography have become the only way to protect personal privacy.
In early March 1999, Wade Cook Financial Corporation filed a slander lawsuit against ten anonymous Yahoo users. The Seattle-based investment advice corporation claimed the Internet offers users too much privacy and hoped to stem the spread of rumors about its operations, saying it may subpoena Yahoo to obtain the true names of users. Interestingly, Yahoo was not initially named as a defendant in the lawsuit.
“These John Does are using the anonymity afforded by the Internet to damage the reputation and undermine the business of a legitimate company,” Wade Cook attorney Paul Anderson said in a statement.
Wade Cook is no stranger to controversy. Reports from wire services, including Reuters, indicate that he has drawn sharp criticism from the investment community and has been the subject of investigations by the Securities and Exchange Commission and several state agencies.
About a month later, in mid-April 1999, Gary Dale Hoke was arrested after conjuring a false story—under the cloak of anonymity—that the corporation he worked for, PairGain Technologies, was being acquired. The fabricated account was forged to look like a Bloomberg News story, and was taken seriously by the investment community, subsequently leading to a significant rise in the company’s stock price.
Hoke was tracked by his computer’s IP address which was disclosed by Yahoo under a court order.
Since Hoke’s arrest, an almost epidemic level of similar subpoenas seeking the identities of anonymous Internet users have gone unchallenged. Net companies such as Lycos, America Online, and Yahoo report that subpoenas are arriving almost regularly. Most Net companies respond to a subpoena by simply disclosing whatever information is requested. Many companies do so in contradiction to their posted privacy policies. (America Online gives subpoena targets fourteen days to contest the order in civil cases, but does not even notify subpoena targets in criminal cases.) The result is that individuals are being forced to disclose their identities before being found guilty of any wrongdoing, and usually before they even know their identities are being researched.
In America, there is no specific legal protection for anonymity, and no standard procedure for representing the interests of the anonymous, although some privacy advocates argue that one’s identity is protected by the First Amendment.
In most cases, formal charges are not filed after the subpoenas have been used to obtain the true names of the alleged offenders of corporate sensibilities. Privacy advocates and civil libertarians say this is a new use of the subpoena, intended to reveal identities rather than to bring civil or criminal charges.
In physical space we are afforded anonymity and can refuse to disclose our identities in most lawful situations. It’s high time this right is recognized in cyberspace.
No comments