{"id":6338,"date":"2011-12-01T09:09:05","date_gmt":"2011-12-01T09:07:17","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"2011-12-01T09:07:17","slug":"en-US","status":"publish","type":"post","link":"http:\/\/fourthamendment.com\/?p=6338","title":{"rendered":"Wired.com: “The Pest Who Shames Companies Into Fixing Security Flaws”"},"content":{"rendered":"

Wired.com: The Pest Who Shames Companies Into Fixing Security Flaws<\/a> by Mike Kessler:<\/p>\n

Every Christopher Soghoian production follows a similar pattern, a series of orchestrated events that lead to the public shaming of a large entity\u2014Google, Facebook, the federal government\u2014over transgressions that the 30-year-old technologist sees as unacceptable violations of privacy. Sometimes he discovers these security flaws by accident, other times because someone has pissed him off, but mostly because he\u2019s parked at his computer all day looking for security flaws.<\/p>\n

When he finds one, Soghoian, a PhD candidate in computer science at Indiana University Bloomington, learns everything he can about it and devises what he sees as a viable solution. Then he alerts the offending party and gives them a chance to fix things, explaining that if they don\u2019t, he\u2019ll go public with his discovery. (OK, sometimes he skips the give-them-a-chance step.) When the inevitable wave of media coverage starts breaking, Soghoian is often the first expert that reporters turn to for sound bites\u2014about stories he has effectively handed them. In the end, the security holes get patched, and Soghoian gets more notoriety and more work. He\u2019s vertically integrated.<\/p>\n

. . .<\/p>\n

Soghoian managed to record a Sprint Nextel executive boasting that the company had provided user location data to law enforcement agencies some 8 million times. Naturally, Soghoian made the tape public. Stephen Colbert\u2014among others\u2014picked up the story, which was later cited by the Ninth Circuit Court of Appeals in a case concerning police surveillance tactics.<\/p><\/blockquote>\n

The case is United States v. Pineda-Moreno<\/a>, 617 F.3d 1120, 1125 (9th Cir. 2010) (Kozinski, J., dissenting from denial of rehearing en banc):<\/p>\n

If you have a cell phone in your pocket, then the government can watch you. Michael Isikoff, The Snitch in Your Pocket, Newsweek, Mar. 1, 2010, available at http:\/\/ www.newsweek.com\/id\/233916. At the government’s request, the phone company will send out a signal to any cell phone connected to its network, and give the police its location. Last year, law enforcement agents pinged users of just one service provider–Sprint–over eight million times. See Christopher Soghoian, 8 Million Reasons for Real Surveillance Oversight, Slight Paranoia (Dec. 1, 2009) http:\/\/paranoia\/dubfire.net\/2009\/12\/8-million-reasons-for-real-surveillance.html. The volume of requests grew so large that the 110-member electronic surveillance team couldn’t keep up, so Sprint automated the process by developing a web interface that gives agents direct access to users’ location data. Id. Other cell phone service providers are not as forthcoming about this practice, so we can only guess how many millions of their customers get pinged by the police every year. See Justin Scheck, Stalkers Exploit Cellphone GPS, Wall St. J., Aug. 5, 2010, at A1, A14 (identifying AT&T and Verizon as providing “law-enforcement[ ] easy access to such data”).<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

b2evALnk.b2WPAutP Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"","ping_status":"pingsdone","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-6338","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"http:\/\/fourthamendment.com\/index.php?rest_route=\/wp\/v2\/posts\/6338","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/fourthamendment.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/fourthamendment.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/fourthamendment.com\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"http:\/\/fourthamendment.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6338"}],"version-history":[{"count":0,"href":"http:\/\/fourthamendment.com\/index.php?rest_route=\/wp\/v2\/posts\/6338\/revisions"}],"wp:attachment":[{"href":"http:\/\/fourthamendment.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/fourthamendment.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6338"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/fourthamendment.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}