Buyer Beware - eBay Security Chief Turns Website Into Arm of the Law

The Nation ^ | June 20, 2003 | Jonah Engle

[gaucho]

Buyer Beware
eBay Security Chief Turns Website Into Arm of the Law

by JONAH ENGLE

Speaking at a conference this winter on Internet crime, eBay.com's director of law enforcement and compliance, Joseph Sullivan, offered law-enforcement officials extensive access to personal customer information.

Founded in 1995 as a niche site for collectibles, eBay quickly grew into one of the Internet's largest websites, currently boasting 69 million daily visitors, who place an average of 7.7 million bids each day. The company, now valued at $29.6 billion, has become synonymous with online shopping, and is rapidly expanding overseas.

The talk, "Working with Law Enforcement," was delivered at the CyberCrime 2003 conference in Mashantucket, Connecticut. Sullivan, who left the Justice Department to become senior counsel for rules, trust and safety at eBay last year, told the audience of law-enforcement officials and industry executives that he didn't "know another website that has a privacy policy as flexible as eBay's," seemingly meaning that eBay acts particularly quickly to grant law enforcement extensive access to user information without regard to established legal procedures that protect individuals from civil rights abuses by the state.

Brags Sullivan, "If you are a law-enforcement officer, all you have to do is send us a fax with a request for information, and ask about the person behind the seller's identity number, and we will provide you with his name, address, sales history and other details--all without having to produce a court order." (eBay itself goes further than this, employing six investigators who are charged with tracking down "suspicious people" and "suspicious behavior.")

Seventy percent of eBay customers, as well as a significant portion of the rest of the online commercial world, make their purchases using (eBay-owned) Paypal, which provides clearing services for online financial transactions. Through Paypal, eBay has access to the financial records of tens of millions of customers. "If you contact me," said Sullivan to assembled law-enforcement authorities, "I will hook you up with the Paypal people. They will help you get the information you're looking for.... In order to give you details about credit-card transactions, I have to see a court order. I suggest that you get one, if that's what you're looking for."

Sullivan even offered to conscript eBay's employees in virtual sting operations: "Tell us what you want to ask the bad guys. We'll send them a form, signed by us, and ask them your questions. We will send their answers directly to your e-mail."

Sullivan's statements were first reported by Yuval Dror in the Tel Aviv-based daily Ha'aretz; surprisingly, they have received no coverage in the US media. And, while they may seem extreme, Sullivan's eBay policies seem to fit into a larger pattern of eroding online privacy.

In the fall of 2001 a Stanford-educated Pakistani scientist, a permanent resident of the United States, was visited at his home in the Bay Area by the FBI, who asked about several books he'd recently purchased on eBay. The man's lawyer said the FBI agent reported having been alerted by eBay. eBay denied having provided the information to the FBI, and the bureau refused to comment.

eBay avoids legal trouble with its customers by giving itself carte blanche to divulge any and all personal information. Its hard-to-find privacy policy says: "Due to the existing regulatory environment, we cannot ensure that all of your private communications and other personal information will never be disclosed in ways not otherwise described in this Privacy Policy."

Until recently, in the Internet world "cooperation with government was seen as a betrayal of the unwritten contract between the user and service provider," says Nimrod Kozlovski of the Information Society Project, a Yale-based center that studies democracy and freedom in the digital age. This understanding held that the "provider would protect the consumer from government snooping." Kozlovski believes that "September 11th changed things dramatically," much as it did for privacy and civil-liberties issues in other realms. He observes that eBay followed the trend by rebranding itself and changing its privacy and policy statements "to accommodate this new vision of the company as one which was [not only] cooperative with the government [but] actually a private law enforcement entity." eBay has also felt the sting of tough new laws: On March 28 its unit PayPal was charged by the Justice Department with violating the Patriot Act for providing money transfer services to gambling companies. eBay may be wary of turning down law-enforcement requests, and in this political climate, being pliant to law enforcement may be sound business in the sense that it can lead to better treatment from government and lower administrative costs associated with a company's security division. There is also the genuine anxiety surrounding the potential consequences of not following up on a perceived terrorist threat.

Company spokesperson Kevin Pursglove calls eBay "a pioneer when it comes to customer privacy" and denies that eBay's privacy rules are in any way influenced by increased concerns about homeland security or that eBay has been the subject of increased pressure from law enforcement.

The attack on Internet privacy, like all civil liberties, has been growing since September 11 in the form of the Patriot Act and other federal and state-based legislation. Many provisions in the new laws undermine online privacy, and are in keeping with eBay's information-sharing policies. The Patriot Act allows ISPs to voluntarily hand over all "non-content" information to law enforcement without the need for a court order or subpoena. It also expands the category of information that law-enforcement figures can seek with a simple subpoena (no court review required) to include, among other things, IP addresses and credit card and bank account numbers.

While Sullivan's statements are the most extreme examples of the blurring between law enforcement and private corporations, eBay is not the only large online companies to have diluted its customer-privacy provisions. Traditionally, it was standard practice not to reveal customer information to third parties; now, however, Internet companies are making exceptions for the government. And massive online vendors from Travelocity to Amazon are using vague language to give themselves virtually complete discretion as to what customer information they will turn over to law-enforcement officials. Whether there will be a consumer backlash against these relaxed privacy policies remains to be seen.

If so, then companies like eBay may have to question their current willingness to become quasi-private law-enforcement agencies themselves. In liberal democracies it is assumed that criminal investigation and law enforcement are the sole domain of government. But the trend in the United States, as evidenced by eBay, among many companies, now sees huge private-sector commercial entities becoming, in effect, agents of law enforcement. It's an arrangement between government and the private sector, which Kozlovski calls the "invisible handshake"--Internet companies promise to open their files to law enforcement, while law enforcement insures that citizens stay in the dark. This new relationship raises crucial questions regarding civic life in the United States, and our rights as citizens and consumers. According to Sullivan, "when someone uses [eBay's] site and clicks on the 'I agree' button, it is as if he agrees to let us submit all of his data to the legal authorities..." Is this more than we bid for?

[gaucho]

Remind me not to use eBay any more...

[lizma]

Caveat venditor.

[GovernmentShrinker]

I can't get worked up about this. E-bay is a wonderful resource, but is also inherently prone to being abused for fraud and trafficking in stolen goods. A very strict privacy policy would quickly turn it into Disneyland for criminals. E-bay's management is eager to help catch the criminals, in order to protect us honest people, and keep the site a safe place to shop. Has anyone produced any evidence of E-Bay handing over information inappropriately? And any company will turn over credit card transaction info with a court order -- how do you think they found those two kidnapped children in Florida yesterday?

[Arkinsaw]

Science fiction writers predicted private corporate law enforcement a long time ago. We are heading toward a weird world.

[Oberon]

Ping for later reading.

[vbmoneyspender]

It would have been nice if the Nation would have asked Ebay about whether Sullivan made the comments he was alleged to have made and, if Ebay acknowledged he did make these comments, whether Ebay stood behind what Sullivan had said.

[Billy_bob_bob]

...says Nimrod Kozlovski of the Information Society Project...

Man oh man, that guy has had a hard life. Imagine going through life with a name like Nimrod Kozlovski.

[gaucho]

And any company will turn over credit card transaction info with a court order -- how do you think they found those two kidnapped children in Florida yesterday?

That's the key phrase - with a court order. EBay will gladly provide this information to ANY LEO who simply faxes the request to them without a court order. If they did this with a court order I would have no problem with it.

[gaucho]

It would have been nice if the Nation would have asked Ebay about whether Sullivan made the comments he was alleged to have made and, if Ebay acknowledged he did make these comments, whether Ebay stood behind what Sullivan had said.

From eBay Privacy Policy
http://pages.ebay.com/help/index_popup.html?policies=privacy-policy.html

Legal Requests.

eBay cooperates with law enforcement inquiries, as well as other third parties to enforce laws, such as: intellectual property rights, fraud and other rights, to help protect you and the eBay community from bad actors. Therefore, in response to a verified request by law enforcement or other government officials relating to a criminal investigation or alleged illegal activity, we can (and you authorize us to) disclose your name, city, state, telephone number, email address, UserID history, fraud complaints, and bidding and listing history without a subpoena. Without limiting the above, in an effort to respect your privacy and our ability to keep the community free from bad actors, we will not otherwise disclose your personal information to law enforcement or other government officials without a subpoena, court order or substantially similar legal procedure, except when we believe in good faith that the disclosure of information is necessary to: prevent imminent physical harm or financial loss; or report suspected illegal activity. Further, we can (and you authorize us to) disclose your name, street address, city, state, zip code, country, phone number, email, and company name to eBay VeRO Program participants under confidentiality agreement, as we in our sole discretion believe necessary or appropriate in connection with an investigation of fraud, intellectual property infringement, piracy, or other unlawful activity.

[longtermmemmory]

I agree. Disclosure should always be with a court order. Otherwise this is wide open to real abuse. What about an officer getting a divorce. (men AND women can go nuts during divorce discovery, not to mention "setup" purchases. saw a case where the wife was caught subsribing to objectionable magazines for her husband to make him look bad.)

A court order creates a paper trail to minimize the potential and the APPEARANCE of potential abuse. A court order means order signed by the judge, none of this clerk of court wishy washy pseudo prodection.

[MattAMiller]

What exactly are you afraid is going to happen? Ebay is a marketplace, I wouldn't expect any anonimity there. In fact I wouldn't use a similar service that guarenteed anonimity, too open to fraud.

[July 4th]

Ebay's starting to suck as much as Paypal.

[Nick Danger]

I would like to alert the many fans of my highly collectable Elvis plates that I will no longer be conducting my sales on eBay.

I figured none of you people out there would ever be able to find out who took your money, but now I find out that eBay will tell the damned cops who I am!

I'm a big believer in privacy, especially for people selling things sight-unseen over a web site. When I put my ads up there offering my guaranteed, absolutely genuine Elvis plates, the last thing I want is for somebody to be able to find me afterwards. It's all about the Constitution and freedom. Yeah John Adams! Yeah Thomas Jefferson! And phooey on eBay. Thank you. Thank you verra much.

[Sunnyvale CA Eng.]

I can't get worked up about this. E-bay is a wonderful resource, but is also inherently prone to being abused for fraud and trafficking in stolen goods. A very strict privacy policy would quickly turn it into Disneyland for criminals. E-bay's management is eager to help catch the criminals, in order to protect us honest people, and keep the site a safe place to shop. Has anyone produced any evidence of E-Bay handing over information inappropriately?

I have often felt that Ebay had or could become the international stolen goods fencing operation for many people. I wonder if Ebay would turn over sales info to the IRS if the IRS wanted to troll for people running a tax free business. I would not be surprised.

I had a cop at my house a few months ago (after we had a break-in) who told us that one of our neighbors had been busted with a house full of stolen goods that he was fencing on Ebay.

[CurlyDave]

eBay's business depends on minimizing fraud. Co-operation with law enforcement is part of that.

Freedom means freedom to cooperate with law enforcement just as much as it means freedfom to confront LE.

In some ways this is like small businesses that give freebies to cops. Not because the cops shake them down, but because increased police presence means fewer holdups and less crime in general.

As a rule, one should assume that any purchase made with a credit card can easily be known to law enforcement. Same for any purchase made on line.

[gaucho]

eBay's business depends on minimizing fraud. Co-operation with law enforcement is part of that.

Let's put this in a different context since the first line of their Legal Requests policy also states that they cooperate with anyone, not just LEO's

eBay cooperates with law enforcement inquiries, as well as other third parties to enforce laws, such as: intellectual property rights, fraud and other rights,

Now, let's assume (hypothetically, I've never sold anything on eBay) that I have a few CD's that I have purchased and over time sold on eBay and the RIAA considers that to be depriving them of their rights to collect royalties on used CD sales (something they are actively trying to persue).

The RIAA decides that they are going to Fax eBay to get a full history on all my transactions claiming that I'm stealing their intellectual property. They now have a listing of the 50 CD's that I have sold on eBay for the past 2 years and decide that they are going to sue me for IP theft. They never had a court order to obtain this information, but because they are the RIAA eBay willingly complied. I never did anything wrong, I only sold some CD's that I purchased at one time or another and those CD's where my property to sell. The RIAA doesn't think so and they sue hoping that I will settle out of court with them (their new tactic). Is this fair? Seems to me like this policy is wide open for abuse.

[CurlyDave]

The ones doing the abusing in your hypothetical example are the RIAA.

As much as I agree that the RIAA is a major pain in the fanny, they are the problem, not eBay. The RIAA could just as easily get the same info by tracking your sales of used CDs.

[gaucho]

The ones doing the abusing in your hypothetical example are the RIAA.

Exactly -- It's not eBay doing the abuse, it's the one's they so freely provide information too. In my example eBay facilitates that abuse. The RIAA would not be able to collect a full history of my past sales otherwise since they wouldn't have been monitoring it.

[Nick Danger]

I think that you are going to have to face the fact that all arguments based on the privacy, convenience, or rights of the seller are going to fall on deaf ears.

eBay is about buyers. So long as eBay has buyers coming to its site, sellers will grin and bear whatever it takes to have access to them.

The biggest threat to buyers, and hence to eBay's continued existence, is con artists and fraudsters hiding amongst the legitimate sellers. It is the nature of the medium that they are going to be vulnerable to that. eBay not only has to weed these people out, it has to make a big show of the fact that it is weeding them out. It has to put up big signs that say "ATTENTION CROOKS: Not here. Don't even think about it." Part of that is to ward off the crooks, but reassuring buyers is every bit as important.

As a practical matter you cannot win this. The customer is always right. The customer is the guy with the money... the buyer. The buyer wants to know that this faceless entity offering goods for sale on a web site is not some crook.

Imagine fBay, the competing site that assures buyers, "All our sellers are guaranteed complete anonymity. You may buy from them with complete assurance that no law enforcement officer will ever be able to find out who they are." C'mon, you wouldn't buy anything there yourself.

By the way, the RIAA has the legal right to do what you described. eBay would have no choice. Thank your CongressCritter for the Digital Millenium Copyright Act, which allows copyright owners to hunt you down without a court order.

[MattAMiller]

Why is someone sitting in their home and selling used CDs entitled to more protection than the guy who opens up a used CD store?