eBay Provides No Privacy For Sellers

Phanatic1a writes "Quoted in an article in The Nation, eBay's chief of security Joseph Sullivan brags up eBay's "flexible" privacy policy to LEOs, telling them "If you are a law-enforcement officer, all you have to do is send us a fax with a request for information, and ask about the person behind the seller's identity number, and we will provide you with his name, address, sales history and other details--all without having to produce a court order." The tens of millions of Paypal customers eBay has access to the financial records of might be curious to see what else Sullivan promises..."

Comments

Lack of privacy for the seller?

[ultraexactzz]

So, in essence, sellers on Ebay are as easy to track down as sellers in brick & mortar stores or otuer public places of business, with business licenses, vendor's licenses, or other government checks and controls... I fail to see a problem with that.

Of course, this opens them up for identity theft, just as much as it would normal businesspeople.

Way too easy to fake

[gazuga]

Seems like they are leaving the door wide open for a "law enforcement officer" to get a user's info with a faked fax.

The policy is horrible, but I hope at the very least, they double-check before they start sending any info back.

Easy to fake...

[jjh37997]

I wonder how many requests they get and what kind of verification they do to make sure that the requests are legit?

Honestly, how hard is it to photoshop up some letterhead and fax it to eBay claiming you're a member of law enforcement? This could be an easy way for crooks to get the credit info of some of eBay's powersellers, who likely have some excess cash.

Police only?

[Richardsonke1]

If it's so easy to get this information, how hard would it be for me to create my own police letterhead, a badge number, and have them fax the info to my local Mailboxes, etc.? I mean, say someone rips me off, this would make it soo easy to get them back. Can you say Identity theft?

Security concern

[t0ny]

My problem is not with the matter of eBay providing this information, but rather with their confirmation. For example, if I just send a fax and say Im a law enforcement officer from Asshole, IN, will they just accept my fax as confirmation of my identity?

Now of course that is illegal (misrepresenting myself as a law enforcement official), but since fraud is already illegal, what difference does throwing another shrimp on the barbie make?

The answer - Money.

[JonTurner]

No, in this age of state budgets exceeding revenue, it means is that State tax collectors are going ask DoNotCall.gov for a list of email addresses from their area code. From there, the taxman will ask eBay for a list of all sales from each email address along with description of items and amount.

Next, that information is used to demand back taxes + penalty fees, and potential criminal prosecutions for those who have not reported their eBay sales as "income."

Remember, it's only called a conspiracy *theory* until it happens.

It takes more than a fax - seller's DO get privacy

[tbase]

There are a lot of comments about this being any easy hole for the bad guys to exploit by simply forging some letterhead to get a seller's info for identity theft and the like.

First of all, I don't remember ever having given eBay my Social Security number, the Holy Grail of identity theft. Second, eBay is only going to respond to "verified requests" when they have a "good faith belief" that there is criminal activity or the threat of "imminent physical harm."

So, I would say at a minimum they're going to verify that the request comes from a real-life LEA - it only takes about 2 minutes to look up any LEA's address and phone number, and if it doesn't match, to call it any verify. They're not going to risk getting sued for millions for giving out your personal info to a stalker. Come in off the ledge folks.

From eBay's privacy policy:
Legal Requests. eBay cooperates with law enforcement inquiries, as well as other third parties to enforce laws, such as: intellectual property rights, fraud and other rights, to help protect you and the eBay community from bad actors. Therefore, in response to a verified request by law enforcement or other government officials relating to a criminal investigation or alleged illegal activity, we can (and you authorize us to) disclose your name, city, state, telephone number, email address, UserID history, fraud complaints, and bidding and listing history without a subpoena. Without limiting the above, in an effort to respect your privacy and our ability to keep the community free from bad actors, we will not otherwise disclose your personal information to law enforcement or other government officials without a subpoena, court order or substantially similar legal procedure, except when we believe in good faith that the disclosure of information is necessary to: prevent imminent physical harm or financial loss; or report suspected illegal activity. Further, we can (and you authorize us to) disclose your name, street address, city, state, zip code, country, phone number, email, and company name to eBay VeRO Program participants under confidentiality agreement, as we in our sole discretion believe necessary or appropriate in connection with an investigation of fraud, intellectual property infringement, piracy, or other unlawful activity."

I own both books does that make me a threat?

[asv108]

Besides buying copies of "Mein Kampf" and "The Anarchist's Cookbook,"

Since when is that an indicator of criminal behavior? Millions of each book were sold, probably only a handful of nasty people in the US were found with those books, with the exception of skinheads.

I own both books, I bought the Anarchist Cookbook when I was 12 just because it was a regulated and semi-banned book. I didn't do anything illegal besides a few backyard experiments.

I read Mein Kamph for two history classes, WW II history and a class on the history of the Holocaust. Should I be investigated for this?

Re:so what?

[sribe]

In other words, sellers, as they enrich ebay, agree to give up any reasonable expectation of privacy. What ebay is saying is a lot worse than you realize. If a seller rips you off, why shouldn't the same rules apply to ebay as they do in other criminal situations? As it stands, ebay doesn't require even a subpoena to release information such as your name, address, and telephone number. No involvement with the justice system is required, nobody has to talk to a judge and justify invading your privacy.

You are aware aren't you, that there is NO legal way to set up a storefront retail operation without some form of contact info being a matter of public record? Why should a seller on eBay be any different? What person in their right mind thinks it's a good idea to have a market in which vendors are anonymous??? Do you really think it's fair as a seller to offer your buyers no reliable, verifiable way to contact you? Would you really buy anything off eBay if you thought for a minute that sellers were immune to being located except via extraordinary means?

Think in terms of "meatworld" for a second. How would you feel if you went to a store, bought a product which turned out to be defective, went back and found the store had just disappeared? What if you then tried to track down the store's owner, and found only a fake address? Worse, what if you went to your local government to find out the info about the store's ownership, and were told that the info was "private" and that you'd need to hire a lawyer, go to court, and get an order to see it?

Now, again, why should eBay sellers have some cloak of anonymity???

Re:Cash Only

[NetDanzr]

I found that using cash can cause more privacy problems than it solves. I, for example, use my ATM card only for groceries. I don't care whether the government or anybody else knows which cereals I like and whether I drink 2% or whole milk. I always use the self-checkout lines, and using cash there is a little complicated.

However, elsewhere I use only cash, and I ran into some serious problems already. Examples:

• Buying a TV and VCR at BestBuy, total value slightly over $1000. The store does not accept so much cash; I had to buy the two on two separate trips.
• Buying a laptop at CompUSA for $1400. Same problem; since it was a single item I could not buy it at all with cash.
• Buying some furniture of total value of slightly over $2000 (I also came with my own truck to drive it home). The clerk wanted my name, address and copy of my driver's license. The manager confirmed those requirements I left and bought it elsewhere.

I'm wondering when cash transactions over a certain value would be outlawed altogether.

There is very little of a privacy issue here

[Abm0raz]

This is a good thing. I refuse to buy stuff on Ebay cause I've gotten screwed twice. If I get screwed at WalMart(c), I can goto the store manager. If I get Screwed at "Mom and Pop's Local 5&Dime and Cow Manure Emporium", I can contact the Better Business Bureau or my local law enforcement officials. But when I get screwed on Ebay, I'm screwed.

Ebay ignores everything except the most extreme of cases, at worst cancelling the seller's account and leaving the fleeced buyer up a creek without a paddle. This allows for some culpability on the sellers part. When I go into a store, I can see the business license on the wall (ask, they are required to post it for all potential customers to see, even if that is often in the management offices) and know who is ultimately responsible.

Now, I admit, I would PREFER to see Ebay require by default, Sellers to list verified contact info, but that's a pipe dream cause it would cost too much. I would also PREFER that a warrant or subpeona be required to release information such as credit card numbers, bank accounts, and transactions, even to law enforcement officials.

Anonymity and privacy are great things, but they only extend as far as you are willing to stay private. When you enter a public domain, your expectaion of privacy is highly deminished. Ebay is very much a public area where people freely go (no different than a department store). At a department store, the store is never private, but the customers can choose to be by purchasing in cash, or they can wave that privacy and use traceable credit/debit cards or checks.

-Ab

Re:other details

[klaun]

I think it's amazing that we don't have laws preventing this kind of decemination of information

So if I want to sign up to be a seller with ebay and let them give out my information the government should intervene and prevent that? Whatever happened to letting conssenting adults enter into contracts? Guess what you are looking for is a nanny state to baby you?

Who said anything about two consenting adults? It's one adult and one huge corporation. One of the parties to the contract will definitely die after at most about 120 years, can work no more than 168 hours in a week, can be imprisoned or executed, has few protections from debts that are enshrined in law, and can't sell parts of itself to raise money. The other party is physically immortal, cannot be imprisoned or executed, has no hard limitation on the man-hours available to it, has all sorts of protections from civil, criminal, and tax liability, and in general is not equal to a person.

This inequity between the two parties means that one gets the shaft. That's because the corporation can dictate to you and you don't have any power at all to negotiate. I don't need a nanny state to baby me, I need a state that doesn't create "artificial persons" and then turn around and say "we want an unregulated marketplace."

By creating "artificial persons" that limit the liability of an enterprise which in truth is often just one person or a very small group of people, the government has created for itself a responsibility to regulate said artificial persons.

So take your laissez-faire politics back to the land of unicorns, dragons, and other mythical beasts.