Slashdot Mirror
Netflix Sued For Privacy Invasion
We've discussed the Netflix Prize numerous times as the contest ran, including the news two years ago that the anonymity of the dataset had been broken. Now reader azoblue sends in this excerpt from Wired: "An in-the-closet lesbian mother is suing Netflix for privacy invasion, alleging the movie rental company made it possible for her to be outed when it disclosed insufficiently anonymous information about nearly half-a-million customers as part of its $1 million contest to improve its recommendation system. ... The lead attorney on the new suit, Joseph Malley, recently reached a multimillion-dollar settlement with Facebook over its failed Beacon program, which drew fire in part for sharing users’ Blockbuster rentals with their friends. ... If a data set reveals a person's ZIP code, birthdate and gender, there's an 87 percent chance that the person can be uniquely identified." The suit turns on the question of whether Netflix should have known that their dataset's anonymity could be broken, two years before researchers demonstrated that.
... this woman is a closeted lesbian. She came to the realization that, if someone hypothetical person were to come along and get into the NetFlix user data system, he could find out she's a lesbian. In order to protect herself from being potentially exposed, she decided to join a high-profile national lawsuit, charging that they had created a potential for people to find out her sexual preferences. How many days do you think it'll be before her picture is all over the web, sitting right next to the headline "formerly closeted lesbian pulled out of closet by attaching her name and face to a privacy lawsuit"?
How large an area is a zip code in the states?
Depends on how many households and businesses there are in the area. In a rural setting a zip code may cover an entire city or county. In a heavily urbanized area it may only cover a single building or city block.
The five digit zip code doesn't tell the whole story though. There's actually the nine digit zip code plus a two digit delivery point code. Every single address in the United States will have a unique nine digit zip code + delivery code. It doesn't mean much to the layman but the USPS can actually represent every single address in the United States with an 11 digit number.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
How can a legal-aged adult file as Jane Doe just because of her secret of being 'in the closet'?
I just signed up for an account. It asked for your birthday on the page with your address. However, it _was not_ mandatory.
I conveniently skipped the 'birthdate', 'gender', and 'your opinion of these genre' sections.
"The member’s movie data exposes a Netflix member’s personal interest and/or struggles with various highly personal issues, including sexuality, mental illness, recovery from alcoholism, and victimization from incest, physical abuse, domestic violence, adultery, and rape."
Isn't this a bit of a stretch. I've rented a rather broad range of films, over the past year some of the films I have watched include Apt Pupil, Lords of Dogtown, Girl Interrupted, A History of violence, A Beautiful Mind, Brokeback Mountain and Super High Me. Evidently I'm a mentally disturbed,abusive, homosexual, drug abusing, skateboarding, autistic nazi and didn't know it.
The woman who was outed wasn't outed by her movie choices but by her paranoia leading to her own disclosure.
I'm guessing they probably ask if you're renting adult material. If the mother was outed by the movies she rented, she was probably renting adult material.
Slashdot is not a game, Slashdot is not a game. Crap, I just lost points.
There is a difference between US zip code system and Canadian one.
In the US, there is zip5 + zip4 (total 9 digits). If you use both, you are talking about 2-3 houses on a street. This is equivalent to Canadian 3+3 system. But a five digit US zip code may mean anything from one business building to very large number depending on the density.
Netflix has adult material on it? Why wasn't I aware of this awesome featur^W^Wmoral outrage? ;)
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
So while before all that was available was a list of rented films which she seems to think indicates that whoever rents them can indicate that the watcher is gay (which I'm having a hard time making the leap from "if someone watches movie X, Y, and Z, that means they are gay), now the whole world knows she is gay.
"I'm not sure I like the fugnutish tone you used in your post!" -RogL (608926)-
Why are you giving Netflix your birthdate and gender in the first place? I never give those things to companies, and if I can't avoid it (forced to enter something when signing up) I give bogus information. Neither of those are any of Netflix's business.
Cory Doctorow talking about cloud computing makes as much sense as George W Bush talking about electrical engineering.
The way that I thought that it worked was that you sue in civil court when you actuall suffer damages even when the other party was doing something illegal.
In cases at law, for example tort or contract cases, you generally do. This is a case at equity, so the plaintiffs are trying to get injunctive relief (also attorneys fees, but that's considered ancillary to the injunction).
Generally the mail I receive with an automatically generated address label (such as from Netflix) includes the -XXXX
Just a note, but the reasoning for that is that bulk mailings have a series of steps they can perform to get postage discounts. CASS certification of the address is one of those. It requires lots of things be done to addresses - St. in a city name for example must be spelled out as "Saint" since St is used as the abbreviation for "street". you also have to consistently abbreviate the street names. You can't write out "Street" in the street name unless it's part of the actual name (ie, "Market Street Rd" would be fine, but not "Market Street"). Among the restrictions though is also a requirement that you use the full Zip+4 zip code.
I can't remember the exact discount but IIRC it's around $0.08 per letter. Not a lot, but where I'm at for example we do several large mailings per year that end up between 70,000 and 90,000 letters in volume. With postage bills for those things being tens of thousands for dollars, that $0.08 per letter adds up fast.
"People who think they know everything are very annoying to those of us who do."-Mark Twain
Speaking as a gay guy with a lot of gay and lesbian friends, I can tell you that some people get really worked up over being "in the closet". They can start to worry about really stupid things that are outside of the bounds of possibility, and work themselves into all kinds of trouble.
Case in point: a friend of mine got herself fired over this. She knew that her supervisor didn't like gay people and so she was in the closet, as far as work was concerned. She got called up for jury duty. The court case didn't last long at all, but in the meantime, one of our mutual friends' father passed away. So, my friend was invited to the funeral which happened to fall on the day after her jury duty ended. She was so worked up over the idea that her boss would figure out that she's a lesbian if she took a personal day to go to her gay friend's dad's funeral that she lied and told her boss that she was still on jury duty for the day of the funeral. Well, the boss didn't like her and he called the court clerk to confirm that she was still on jury duty - and then fired her for lying about it.
Had she just took a personal day and said "I'm going to the funeral of a friend's dad" nothing would have happened. As far as I know, there's no mechanism by which you can figure out if the relatives of a dead person (whose name you don't have) are gay or not.
Maybe this lawsuit lady should read up on the Streisand Effect (you know her name's going to come out eventually), stop worrying so much about what other people think about her sexual orientation, and concentrate on living her life. Can she truly be deluded enough to think that anyone in her life (work, social, government or otherwise) is going to trawl netflix's database to figure out if she's a lesbian and then use that information against her?
Seriously, this is like when my boss didn't want to have his pay directly deposited because he thought the payroll company could snoop in his bank account. It's just not grounded in reality.
Putting moderation advice in your
And the crux of the lawsuit is the presumption that straight people are not allowed to like these movies...wait...I liked Milk quite a bit, and Angels in America was one of the most incredible things I've ever seen. Damnit, my girlfriend is gonna kill me when I tell her I found out I was gay...via Slashdot no less.
Was it necessary to release the birth date of the users? As if the day of the month you were born in would matter in which movies you liked? No more than month and year should have been included, probably no more than the year.
The problem is most people don't think, and those that do, don't think about what they're doing from a security standpoint. "Will this work?" or "Will this be safe?" is vastly different from "Can this be abused?" or even "Is all of this really necessary?"
Just because you're paranoid, it doesn't mean that they're not out to get you.
The suit turns on the question of whether Netflix should have known that their dataset's anonymity could be broken, two years before researchers demonstrated that.
This is called a "state-of-the-art" defense, and generally doesn't work.
State of the art defense is the defense that permits a manufacturer to avoid liability in a design defect case if at the time of manufacture there was no safer design available, or in a failure to warn case if at the time of manufacture there was no way the manufacturer could have known of the danger he/she failed to warn against.
Lets say I was making Asbestos oven mitts, no one knew it was dangerous. The state of the oven mitt industry and materials science (the art) was that Asbestos was fine. Then, 50 years later we find out it's dangerous. The lawsuits will probably prevail because the "state of the art" defense doesn't stand up to strict liability.
On the upside, she'll probably make some new friends in PTA. And who doesn't love hot buttered soccer moms?
THL phish sticks
I've done enough work for companies in my years to know that zipcodes can be used to uniquely identify individuals. Since there are still parts of this country in which a person may own a very large piece of land and Zipcodes use the +4 to determine specific blocks within a zip code range, then all one needs is a name or the other info mentioned above to uniquely identify a person. This has been known by banks and the post office for as long as the +4 has been around. Banks have strict guidelines around uniquely identified people and what they must do if they are identified when dealing with offers of credit.
Netflix works with the post office for mass mailing, they would be aware of the ways to uniquely identify people.
Life takes interesting turns, but the most interest is when you're off the beaten path.