Anonymizing service employees rat out extortionist

[Bill Stewart]

At 08:16 AM 3/26/2004, Eric Tully wrote to the Cypherpunks list
> > From The Register:
> > > "To download the online picture, he used the anonymising Surfola service
 > > (and not Anonymiser.com as > we mistakenly wrote in our initial report -
 > > apologies to all concerned - Ed), believing the company's privacy 
policy would protect him."

> > So now I don't know what to believe.  Either Anonymizer was never 
> involved...
> > or they don't want it known that they sold out so they asked for a 
> retraction.

Duhhh..  www.Surfola.com is a competing service, run by different people.
You don't "ask for a retraction" that names somebody else
unless it was somebody else who did it, or at least you don't do so
with the expectation that you'll _get_ the retraction
as opposed to getting flamed in public.

Surfola's privacy policy does say that they won't ever, at any time,
for any reason, give your name, residence address, or email address
to any third party.  I guess we know how much to trust that,
though strictly speaking, it doesn't say they won't give out IP addresses,
and at least one of the articles said that the Feebs could track him down
because he didn't have the sense to use an internet cafe
instead of connecting from home.  (On the other hand,
it said he paid for the anonymization service using Paypal and
giving his own email address, so it's possible that Surfola _did_
rat him out in ways that contradict their privacy policy.)
Also, the original anonymous posting said "no subpoena involved",
but didn't indicate that they knew this was true.
It sounded like it might have been correct, but might not.

Now, this kind of application of Blacknet is the sort of thing
that gives privacy protection a bad name - the guy certainly
deserved to be caught and busted, as well as deserved to have
Darwin remind him that he wasn't as bright as he thought he was....

But Surfola's privacy policy shouldn't be making promises that
it can't keep, or that it doesn't intend to keep.
It appears to be based on a BellSouth DSL line in/near Jacksonville, FL,
which means that Kris is subject not only to warrants,
but also subpoenas, FISA Secret Court Gag-Ordered Subpoenas,
Patriot Act secret gag-ordered requests for assistance from Homeland Security,
legal or illegal wiretaps on anything unencrypted,
and any fishing trips that the local police want to take
(at least if he's not running encrypted disk partitions.)
Its privacy policy ought to reflect that,
even if such things aren't particularly enforceable.

                 Bill Stewart