Internet Mapping Glitch Turned a Random Kansas Farm Into a Digital Hell (fusion.net)

An anonymous reader writes: Back in 2002, a company called MaxMind had an idea: Gather up as many unique computer or smartphone IP addresses as they can, match them to a map, and sell that data to advertisers. The problem is that MaxMind's tech has made life miserable for a handful of homes across the US -- especially one otherwise unnoteworthy northern Kansas farm. The farm's 82-year-old owner, Joyce Taylor, and her tenants have been subject to numerous FBI visits, IRS collectors, ambulances, threats, and the release of private information online. They've found people rummaging in the farm's barn and one person even left a broken toilet for some reason. People would even post her details online and encourage others to get in on the harassment, she said. The local sheriff even had to put a sign on her driveway, telling trespassers to stay away and contact him first if there are any questions. What's her mistake? MaxMind thought that if its tech couldn't tell where, exactly, in the United States, an IP address was located, it would instead return a default set of coordinates very near the geographic center of the country -- coordinates that happen to coincide with Taylor's front yard. The abuse began in 2011. A quick online search for the farm's address brings up pages of forum posts reporting the "scam farm."

Comments

"Glitch"

[Anonymous Coward]

The glitch is in your brains for geolocating anything deeper than the local ISP's router.

Re:"Glitch"

[Anonymous Coward]

What's more troubling to me is that police, the FBI, and the US Marshals are apparently using this data to get search warrants and to raid peoples' homes! Shouldn't they be subpoenaing the ISP?

No, they should be hauled into court for being so amazingly irresponsible. People have an absolutely crazy idea that geo-IP location is completely correct. It is not. I've been using MaxMind data for years and have always borne in mind what they say about their accuracy. Hint: is is *never* near 100%. They can be fairly good at putting you in the right state and even the right city, but you should take the ZIP-code information, let alone latitude and longitude, with a big grain of salt.

When a lookup into their dataset fails to return a city, that means that IT CANNOT LOCATE THE CITY and that the latitude and longitude information are worthless. If you've been using that dataset for any time, you'd know that.

Remember also that there are lots of people using VPN's, cellular networks, satellite carriers, or TOR. MaxMind's service is useful, but is far from infallable.

Here are two results. 1) law-enforcement agencies should *NEVER* use the geo-IP location data to get to a street address or exact GPS coordinates. If they need to know, they can use an AS lookup (also available as a MaxMind database) and then ask the ISP. 2) Geo-IP is not nearly reliable enough to use for collecting sales tax (the whole discussion of the nexus of a sale is a whole 'nother topic).

The fault is not MaxMind's. They advert to their accuracy: "99.8% accurate on a country level, 90% accurate on a state level, 81% accurate on a city level for the US within a 50 kilometer radius". Only eighty-one percent! The law-enforcement people who are raiding people's houses on the basis on this data should face prosecution!

What's that sound?

[Anonymous Coward]

Sounds like grounds for a lawsuit to me!

How deep are MaxMind's pockets, because Taylor just got access to them!

Magnified stupidity

[FireballX301]

Developers: If we can't resolve the IP lets just give it a default center of the US coordinate, instead of returning a 'could not resolve location'
Project Manager: Sounds good to me!

Later...
A moron sysadmin: I'm getting tons of inbound spam traffic coming from this farmhouse in the middle of Kansas that has curiously rounded coordinates! They must be the culprit, clearly this IP GIS lookup has 5 digits of precision on lat/long!

Lots of stupidity to go around here

Re:Magnified stupidity

[MightyMartian]

He's the kind of developer that turns globals on and writes everything in PHP 3, who puts in a hardcoded root password of "1234" for testing, and then forgets to take it out before the software goes production. He's the kind of developer that captures all exceptions and errors in one big exception method that pukes out "An unexpected error occurred". He's the kind of developer that still writes Flash-based scripts, insisting "They're still cutting edge, man!"

He's the kind of developer that ends up as head of his department, and will be CTO within two years.

Re:Magnified stupidity

[tlhIngan]

Even worse, they claim it's only good to the city/county level, in which case why are you returning exact GPS style coordinates?! People assume when you have exact coordinates, they're, well, exact.

At least report an uncertainty circle in your result at the very minimum. If you're not sure, make it stupidly large, like the country or the earth, or the solar system.

Though what you should do is simple - just return the zip code. You can convert zip codes to the approximate area quite easily, but they don't result in houses. Or just return it as city and state, since that's the resolution you're dealing with.

Really, a huge sigfig problem.

Re: Magnified stupidity

[Voyager529]

They should have located it at some high security base, so that people with too much time on their hands would no longer be a public nuisance

Here's the dilemma: Do we send them to Area 51, or Guantanamo Bay?

Not a "glitch"

[Anonymous Coward]

This most assuredly was not a "glitch".

It was a deliberate design decision on the part of the mapping company to portray the returned data as more accurate than it was. The reason this Kansas farm became a "digital hell" is because the company decided to use a defined point (which happened to be their front yard) to represent "USA, not otherwise specified". (Reason being that it was close to the center of the continental USA.) Similar types of approaches were taken for other entities. (IP addresses in Georgia that didn't have further county/city information got put at the geographic center of Georgia, etc.)

That's not a "glitch" - that's a bone-headed design decision. A fundamental rule of data processing is that you shouldn't represent invalid values (or values with lowered precision) with valid values -- for this very reason. If you have invalid values and valid values which can both be the same value, if you get that value back, you don't know if it's valid or invalid. Sure, pick some value to represent "Somewhere in the USA, but no further information", but make sure it can't be confused with any valid value. Make sure it's incredibly obvious that the value isn't valid just from looking at it.

If you can't do this (if all values of the variable might be valid), you have to use out-of-band information to specify things. e.g. Having an extra data field to specify the level of precision (country, state, county, city, block, etc.). "38N 97W" is much different from "38N 97W, plus or minus 1500 miles".

Re:Bullshit

[AmiMoJo]

You couldn't make this up. Their defence is "we are so dumb we didn't think of this obvious flaw or pick it up in testing, but incompetence at our core business is better than malice right?"

That really depends...

[Anubis350]

That really depends on how fast you're driving, doesn't it?