marahmarie: my initials (MM) (Default)

I hope Harrison has lots of money for lawyers, 'cause he's gonna need lots of lawyers.

Breaking news in my ongoing series about Spokeo and it's unethical owner, Harrison Tang, takes a not-so-surprising turn: the night I wrote this post about how easy (or not) it is to remove your personal information from Spokeo's archives, I mentioned that I did my research based on a fictitious character named Jane Doe.

Would you believe how many Jane Does are in Spokeo's database?

Try 56.

Hazard a guess how many John Does?

215.

OK...so maybe there are that many people with anonymous names. Let's get more creative.

Let's say your name is Joe Blogger (a personal favorite of mine). There are four of you. Hat's off to you, Joe Bloggers, for changing your names to match your occupations. Everyone should be so precise.

Let's get more generic and say your name is "My Name". How many people have it? Wow...at least two?

Let's say your mom, who wore beer goggles when you were born, named you "Eye Glasses" once she sobered up. You're in! She ate her favorite meal after giving birth to her next kid, so guess what went on that birth certificate? That's right...Chicken Soup!

Six mothers have committed the sin of naming their children Chicken Soup.

7-3-2010: [personal profile] sophie points out that there's also: "...8 Your Moms, 2 Yo Mammas, and 5 US Citizens" in Spokeo's database. I'm sorry, but naming your child "Yo Mama" should be illegal.

I would get to the point faster, but I'm laughing too hard.

The point is, with data this inaccurate (including false data for the non-existent Joe Bloggers and Yo Mamas of the world), can you trust Spokeo to give out accurate information about anyone? As NetworkWorld put it:

[...]Spokeo promotes the use of its services in making employment decisions [...] but fails to disclose its data sources or to allow consumers any opportunity to dispute and correct false information. For paid subscribers, these profiles include “Credit Estimate” and “Wealth Level” ratings as well as information about mortgage values, income, investments, lifestyles, ethnicity, religion, politics, education levels, judgments about shopping, recreational habits, Google maps of home and the amenities in a residence, as well as family relationships [...].

The Center for Democracy and Technology has a problem with that. If searching for fake names brings up true facts (here's Fake Name, yet another child-naming mistake?) then what can you assume isn't completely riddled with inaccuracies in Spokeo's database?

Maybe you're thinking: "Well, if Spokeo's information is wrong in my favor, that's good, right?"

That's swell. Spokeo's information is always "wrong in my favor", if you count being misrepresented online as a 60 year old WalMart cashier as "wrong in my favor". If you met me, you'd know the picture on Spokeo and the information that accompanies it is wrong. So Spokeo's system is acting as a perfect anonymizer by giving out false information about me. Oddly enough, I suppose, I have no complaint with that.

But if a potential employer uses Spokeo to match your personality and lifestyle to a job opening, or if a credit reporting agency uses Spokeo to verify your income, and Spokeo's info is WRONG....

Then it's not so funny. It's real-life trouble. That's where The Center for Democracy and Technology draws the line, that's why they've filed a complaint on Spokeo, and that's why the FTC is getting involved [direct link to FTC PDF].

So, let's hope the FTC probe results in Spokeo's closure or drastic changes to how its search and business model works.

Because if Spokeo continues on the way it is now, it's going to ruin more lives than one might assume it already has. From NetworkWorld, again:

Despite the glaring inaccuracies, Spokeo has published detailed consumer reports about millions of consumers. The complaint to the FTC maintains, "Consumers are only given an imperfect mechanism to delete their profiles, though most of those consumers would have no reason to know about or visit Spokeo to do so. Meanwhile, employers and other decision makers may be relying on Spokeo’s credit, wealth, and lifestyle data in making adverse determinations about consumers without their awareness."

That can't be right - whether your name is Joe Blogger or not.

marahmarie: my initials (MM) (Default)

Dear Spokeo Visitor,

Your email listings have been removed. Please allow 24 hours to see this change.

Thank you and have a good day.

Sincerely,

Nancy, Customer Support Specialist

Did I believe it? Of course not. So I plugged my defunct email addresses into Spokeo's search box and got this message back for each one upon doing so:

Search results for this email address are not available.

Unfortunately, I don't think this takes care of every email address I've had. I like to experiment, so I've tried just about every email service there is. I have, or have had, accounts on GMail, Inbox.com, GPX, Yahoo, Live, Hotmail, AOL, PeoplePC, Netscape, and more besides (I can't recall them all) and some I could simply never get back into after forgetting my user name or password, while others I abandoned or closed. Damned if I can remember what half of those email addresses were, though I'm sure other people out there can and perhaps do.

That's what's freaky about how Spokeo aggregates information on you without your knowledge or consent. You didn't ask them to collect it, nor do you offer it to them. How they can take an email address tied to an online persona who normally claims she's from Beverly Hills CA (which I'm not) and tell the world that I'm from some town in FL (which I am, even if it's not the same town they indicate) is beyond me; I'm thinking they must have databases containing nothing but IPs for email servers, so they can determine your location based on that. And if that's not a complete privacy-killer, nothing is.

So they take information, like email addresses, which you might put out there in a very limited, private fashion and attempt to connect it to who and where you are in real life. I cannot fathom how they have the cajones or the legal right to do that. That's why I hate Spokeo. That's why one of my more recent posts asked Harrision Tang, the owner of Spokeo, to make his information aggregation business "opt-in, not opt-out", though I know if he did that it would ruin his entire business model - making money off of people who pay for the "right" to see even more personal information, accurate or not, that Spokeo has somehow tied to our real-life or our separate online identities.

That "business model" makes me sick.

marahmarie: my initials (MM) (Default)

So I just got done using Spokeo's Contact Form to request removal of older, now-defunct email addresses. As you may recall, I wrote about what it was like to remove my information from Spokeo the other night (not as bad as I thought it might be), but after I published that post, I realized all of my defunct email addresses were on file with Spokeo. That would be at least eight of them, but I was only able to remove six.

My Spokeo email address removal request - click to expand

The problem is, Spokeo's opt-out form needs three pieces of information: the URL of the Spokeo page you want removed, your email address, and a captcha. Providing the first and third bits of information is not an issue, but the second bit is: the email address you plug into the opt-out form must match the address you're trying to remove from Spokeo. I can't use those email addresses, since they no longer exist, so I can't use the form to remove two pages of information about me on Spokeo.

So I sent the site admins a request to do so about 20 minutes ago. I'll update if I hear back from them.

marahmarie: my initials (MM) (Default)

I mean for Christ's sake, it's about time. I've only been bitching for four years about 1) Spokeo's look, feel, performance, and purpose, and been bitching at Harrison on and off for maybe three years to do something about the (obvious, inexcusable) privacy issues.

Harrison probably doesn't know or care what I had to say (several emails that did get answered and a few more, as the years went on, that didn't have been sent), so it got to the point that I figured it would never change - I got resigned to it.

But as I was reading our utterly substandard newspaper a few days ago, I saw a columnist start off his normal weekly spew by rehashing Spokeo's privacy issues. And I said to myself, "Hot damn, I thought I was the only person in this two-bit town who'd ever heard of Spokeo."

He concluded with: "But you can use the opt-out to make Spokeo stop publishing your information." And I almost said out loud, "Whoa, dude, you must be trippin'." The last time I tried that - maybe a year ago - I forget what was involved...your first-born child sent UPS Overnight after signing your name in blood on a snail-mail opt-out form, or something like that.

That was mid-week, while I was still half-dead, so I filed the information away for later use - which was today.

Since I don't do anything (or look up anybody) without running it or them through Google, I began today's search by typing [spokeo opt-out] into my search box. The fourth result down was an article by Spokeo's partner, Reputation Defender, on how to opt-out of several intelligence-gathering sites - not just Spokeo. Interesting stuff.

Method One: Manual

  • Step One
    Find all the sites you care about. For example, you might be concerned about sites like Spokeo, Pipl, Intelius, Rapleaf, and others. You will need to find each site that lists your personal information, which could be hundreds of sites.
  • Step Two
    Find the opt-out procedure used by each site. Each site’s privacy policy is different. For example, Spokeo’s opt-out form is here and it can be completed online. ZabaSearch’s opt-out policy is here, and it requires verification by mail. Intelius’s opt-out policy is here, and it requires faxing a copy of your driver’s license.
  • Step Three
    Verify that each site correctly processed your opt-out request. Some sites might have multiple copies of your current address as well as mis-spellings, typos, and other errors. You may need to repeat the process several times to get complete coverage.

According to Reputation Defender, Spokeo not only has an opt-out, it has the easiest one of all! I've followed Spokeo's progress for years, so I know better than to believe their partner in crime, don't I?

Certain this was a waste of time (I've never been wrong - not when it comes to Spokeo) I visited the opt-out page and picked the one email address out of the six I own least likely to ever be connected to my online persona and got to work finding and copying my unique Spokeo URL into the opt-out form.

It's not as easy as it sounds...

In fact, once I plugged my name into Spokeo's search box, I got so confused I almost gave up. Here's why:

Say your name is Jane Doe, and you live in Ohio. So you type [jane doe] into Spokeo's search box, then you click on the link to the 55 Jane Does who live in Ohio [this link]. Now you'll see perhaps 22 approximate locations, not actual addresses, for Jane Doe, all in Ohio.

The idea is to find the one Jane Doe in the two towns that most closely intersect your own (or in the one town per listing that is your own) and click that link to view your information.

Once you click the one that belongs to you, nothing happens. The page doesn't redirect, so it looks like the URL never changes. That's the trick. A frame opens in the same window that keeps you from realizing the page address changed. Here's a real-life (well, I'm making this up, so it's not geographically correct, but otherwise, it's perfect) example:

Once you've narrowed it down to the Jane Does who live between two geographically parallel cities, your Spokeo URL should look like this:

http://www.spokeo.com/search?q=jane doe#Dayton-Cleveland

On that page, you'll see you've narrowed your search down to 11 Jane Does who live between Dayton and Cleveland, so you'll go down the list and when you spy your street address, you'll click on it. The page will not reload; instead, a new frame will open with your personal information on what seems like the same page.

This is where I got hung up: if the page loads your personal information but doesn't refresh, then there's no personalized URL to paste into the opt-out form - just the one listed above - so the Spokeo opt-out is a scam, right?

But hey, it can be done.

Finally I cut the URL from the address bar and pasted it into Notepad. Sure enough, without me noticing, since the page never refreshed, the URL had changed to:

http://www.spokeo.com/search?q=jane doe#Dayton-Cleveland:123456789

The part of the URL that starts with a colon and ends in a nine-digit number is your personal identifier. That part of the URL tells Spokeo, "This is Jane Doe at 123456789 Any Old St, in Dayton, Ohio". At that point I realized it all seemed legit.

Alrighty, then...

Satisfied that I grasped the technology, I finished the opt-out form. A confirmation at the bottom of the page asked me to: Please check your email for further instructions. "OK", I thought, "Here's the part where Harrison wants my first-born child by UPS Overnight or whatever." Within seconds there was a message, asking me to click a link to confirm removal from Spokeo.

Stunned at how easy it was, I clicked the link and was immediately redirected to the message: No first-born child? We're not done yet, Marah! Your personal information has been removed from Spokeo. So I refreshed my personal Jane Doe page but it just redirected me to other Jane Does in my area.

That was a good sign, but not good enough, so I tried three variations of my name (like Janey Doe, Jane S. Doe, and so on) but my info was gone. Still not convinced, I checked my unique URL again but the page immediately redirected to the other 22 Jane Does in the area.

At that point I sighed a huge a sigh of relief. It's nice not having to worry about Spokeo storing (mostly incorrect) information about me anymore.

But Harrison? As I've been saying for years - and you came to me for my opinion years ago, not the other way around, so I feel obliged to say so:

Opt-in (and of course no one will) not opt-out. Come on, already. Or does the word "unethical" still mean nothing to you?

marahmarie: my initials (MM) (Default)

I remember Harrison Tang back when he had a LiveJournal. It was the summer of 2007 and he had nothing online to boast of except a simple blue and white page with links to sites like LiveJournal that he tentatively called "Spokeo". I met Harrison the same way you meet most people online when you have a blog: he dropped in one night and left me a comment.

Before I replied to him I checked out his LiveJournal the same way I'd check out anyone's. It had just been created and was devoid of both content and design. His Profile showed he had no friends and his comments struck me as the loneliest-looking words on Earth, from a young man so desperate for someone to look at his site (my actual "job", per his request, was to critique it for him) that he would contact anyone - anyone - even me - for attention.

In the beginning...

My critique of Spokeo was so blunt and acidic that I emailed it to him to avoid any public embarrassment. In that email I apologized for my harsh words but I need not have bothered: His vision of his new and improved (and as yet, completely unheard of) "social network" was so strongly mixed up with his idea of himself that nothing could shake it, least of all me.

At the time that Harrison and I exchanged emails Spokeo was nothing more than that blue and white page. Once you passed your email address and password to it, it returned an RSS feed barely spiffed up with CSS that supposedly showed the magical world of what your friends were up to. This selling point was deceptive on two fronts:

  1. The email addresses I use on my LJs and for some of my personal email do not connect to my real-life "friends". My friends aren't stupid enough (or smart enough; it depends on your outlook, I suppose) to waste time where I waste it online.
  2. These magical things you learn about your "friends"? Not so magical: Co-worker1 just uploaded pictures to Photobucket! ChewyFood updated his blog! Please knock me out cold, Spokeo, before I dare continue on this underwhelming journey from one ugly blue and white page to another with almost nothing that I give two shakes about.

Jump ahead 2 years...

Harrison is a big deal now. Like Jason Calacanis he's so relentlessly self-promotional (and therefore, annoying) he was sure to get somewhere with his creepy little site even though it must break every privacy law known to man and offers little in return except for the ability to stalk people who you barely know from a tea leaf. Too bad Harrison is a good listener, because one of the things I chided him for was how it looked. In his obnoxiously cheerful way he promised better things to come, and I cannot fault him for how it's turned out: the site is well-designed. Now.

The other thing I took him to task for was his site's database: it crawled. I've seen faster page loads on AOL dial-up, yet I was visiting his site on a big, fat broadband pipe. He seems to have addressed that problem, too.

But there's one thing he forgot.

I emailed Harrison one more time to point out that users of many websites, including LiveJournal, InsaneJournal, and Xanga, were terrified of Spokeo. I gave him links to everything negative written about Spokeo and explained in my own words what everyone was flipping out over but I guess he didn't want to hear it. I've never seen him publicly respond to allegations that users with friends-only journals lose their privacy once their email addresses are searched for on Spokeo or that showing our "email networks" to everyone is a huge privacy violation regardless of whether you have a friends-only or public journal.

The last straw for me was...

I remembered I forgot about Harrison while I was surfing the Web tonight for news on AOL (I'm a junkie) and the Userplane deal came up (Userplane might've been closed down by AOL; news at 11). Spokeo was linked to in almost every Userplane story - it was almost maddening. Finally I clicked through to read one Spokeo/Harrison review (bloggers: Harrison is not all that, so calm down already - I know the Second Coming when I see one), then, out of curiosity (which ruins my life in more ways than any of you know) I decided to pay Spokeo a long-overdue visit. Am I sorry.

Right off the bat I had no way to log in. The email address I used on Spokeo in 2007 has since been purged, which was more or less confirmed when I couldn't recover my password. While I was scratching around for a way to not give Harrison another email address to add to his already bulging database I read the messages splashed across Spokeo's fancy new front page and my blood slowly turned to Freon: Yes, I could suddenly cool my entire living room just by getting mad.

What was in front of me?

"Uncover personal photos, videos, and secrets....GUARANTEED!"

Now he's using the very criticism of the site that almost destroyed it to promote it! Why not just say, "Stalk anyone on Spokeo - sign up now!"

It gets worse:

"Want to see something juicy? Spokeo searches deep within 42 major social networks to find truly mouth-watering news about friends and coworkers."

Outed?

The worst part was what happened when I finally logged in. To preserve a scintilla of privacy, I used an email address not associated with my blogs or my online persona to re-sign-up for Harrison's bullshit. I came to regret it: for some reason my Photobucket for Anti-AOL is tied to that address, even though I switched it years ago to whatever address I currently use on that blog (it changes, but it is not the address Spokeo found). My Spokeo contacts list can see that I own that Photobucket, so they can easily figure out that I own Anti-AOL, too. I'm sure that will be perfectly delightful news for 30 people who up until now had no fucking idea. So much for keeping anything a secret.

After I saw my blog's Photobucket show up in my Spokeo "profile" I logged into Photobucket and sure enough the email address in question was listed as "defunct". I'm assuming it's either a glitch on PB's part or I really screwed something up, but I thought I had changed the email address with them quite a few years ago.

Who's fault it is that my email address was still associated with that Photobucket doesn't matter: what matters is Harrison's creepy little "spy network". It's the stuff of nightmares. Now there will be real-world questions that I'll have to either answer or blow off. I don't know how to handle it, since if I hadn't created another Spokeo account, none of this would have happened.

Not gonna mention names, but...

In a way I'm lucky because it's not really 30 people I have to deal with: more like 1 or 2. Even more luckily, I'm pretty sure that one of them wouldn't know a Spokeo from a spoke in a tire. Right now it just feels like 30 people, and I feel like taking Spokeo offline by any means possible just to make myself feel better. But there is one person on my contact list who I haven't emailed from that address in maybe a little over a year, and just seeing his name was horrible. I'd almost forgotten, and I wanted to keep on forgetting, and now, once again (damn me), I can't.

Guess what? He created a new profile on Spokeo tonight, too. So did Co-worker1. So did ChewyFood.

I just want to crawl out of my skin.