Slashdot Mirror
How Cartographers For the US Military Inadvertently Created a House of Horrors in South Africa (gizmodo.com)
Kashmir Hill, reporting at Gizmodo: The visitors started coming in 2013. The first one who came and refused to leave until he was let inside was a private investigator named Roderick. He was looking for an abducted girl, and he was convinced she was in the house. John S. and his mother Ann live in the house, which is in Pretoria, the administrative capital of South Africa and next to Johannesburg. They had not abducted anyone, so they called the police and asked for an officer to come over. Roderick and the officer went through the home room by room, looking into cupboards and under beds for the missing girl. Roderick claimed to have used a "professional" tracking device "that could not be wrong," but the girl wasn't there. This was not an unusual occurrence. John, 39, and Ann, 73, were accustomed to strangers turning up at their door accusing them of crimes; the visitors would usually pull up maps on their smartphones that pointed at John and Ann's backyard as a hotbed of criminal activity.
[...] The outline of this story might sound familiar to you if you've heard about this home in Atlanta, or read about this farm in Kansas, and it is, in fact, similar: John and Ann, too, are victims of bad digital mapping. There is a crucial difference though: This time it happened on a global scale, and the U.S. government played a key role. [...] Technologist Dhruv Mehrotra crawled MaxMind's free database for me and plotted the locations that showed up most frequently. Unfortunately, John and Ann's house must have just missed MaxMind's cut-off for remediation. Theirs was the 104th most popular location in the database, with over a million IP addresses mapped to it.
[...] The outline of this story might sound familiar to you if you've heard about this home in Atlanta, or read about this farm in Kansas, and it is, in fact, similar: John and Ann, too, are victims of bad digital mapping. There is a crucial difference though: This time it happened on a global scale, and the U.S. government played a key role. [...] Technologist Dhruv Mehrotra crawled MaxMind's free database for me and plotted the locations that showed up most frequently. Unfortunately, John and Ann's house must have just missed MaxMind's cut-off for remediation. Theirs was the 104th most popular location in the database, with over a million IP addresses mapped to it.
"Roderick claimed to have used a "professional" tracking device "that could not be wrong," - I am compelled to imagine this said with an extweme whotacism.
Just take the US government to court, and the next time an aircraft carrier stops in Capetown, have it impounded to collect on your line.
I heard China will pay premium over scrap.
According to TFA, this was caused by stolen devices being in areas without a cell signal, and falling back on WiFi access point geolocation. Further, the area in question has very few access points, so phones can potentially pick up these residential access points from thousands of feet away. Then they are geolocated to the exact position of the access point.
A solution is to disable SSID on your home router(s) so that these data-grabbing sniffers won't see it and try to geolocate off of it.
Better known as 318230.
Wow, sounds like a doctor that blindly follows a radiologists opinion of what he saw on a screen full of static from an MRI machine....
Nothing we make, use, or do is 100% infallible.
Medicine is the blind leading the deaf, and whatever this "PI" did is the same error.
1. Cartographers for a U.S. intelligence agency published coordinates for the center of the populated area of Pretoria, South Africa.
2. An IP location service provided those coordinates, along with an uncertainty radius, for Pretoria IP addresses.
3. Other IP location services threw away the uncertainty radius.
4. South African government officials, bounty hunters, etc. used the IP location services that threw away the uncertainty radius.
5. The U.S. intelligence agency changed the coordinates to the center of the town square after being apprised of the issue.
That seems like fairly thin gruel for Slashdot's "U.S. sux" article du jour.
Problem solved.
I had this same issue because I live in Rural America, and my house is within 100 yards of where most mapping software pins my zip code, and within a mile of the nearest Interstate. To cover my entire property, I have an outdoor AP with an omni antenna on top of my 90 foot ham radio tower, so my Wifi network is visible from that Interstate.
Once I disabled SSID broadcasting, people stopped showing up. I suspect that people were driving by on the Interstate, where there is poor cell coverage because it's rural, on their way to the city. At some point they would lose their phone and do a "find my phone" on their way home (along the same stretch of poorly-covered highway) and it would turn up with a pin in my back yard. Hence, unsolicited trespassers banging on my door drunk at 3 in the morning.
I'm glad I don't have to put up with that anymore. It's just a little inconvenient to set up new wireless clients without SSID broadcasting turned on.
Seriously, any company that causes so much distress and harm deserves to be put out of business. Unless it has enough money to pay appropriate damages to all of its victims - whether they complain or not - and to fix its utterly insane software decisions.
The CEO actually didn't know what to do about IP addresses that couldn't be located more precisely than "the USA"? I can do that one instantly. Tell the user that the IP address can't be located more precisely than "the USA". I know it rankles to big business, but when all else fails you can always try telling the truth.
I am sure that there are many other solipsists out there.
Many mapping systems give specific latitude and longitude coordinates and an accuracy radius for an IP address. When the accuracy radius is inaccurately large (like searching for a city, or a country) the coordinates arrow points in the middle, which can be someone's house. Someone using location services (like "Find My Lost Phone", and even police) often get these coordinates without understanding the accuracy sucks.
This particular case in South Africa happened because of a mapping service created by "National Geospatial-Intelligence Agency", which is part of the US Dept of Defense.
I'm not sure why useful information like this wasn't in the summary, but... I guess it made me read the article, so the jokes on me.
My favorite quote was from a guy that lives in this house. Right after the article says, "a team of police commandos stormed the property, pointing a huge gun through the door at Ann, who was sitting on the couch in her living room eating dinner", a few sentences later he says, "The Apple customers seem to be the worst."
MaxMind can be a boon to test geolocation.
Now, believe it pinpoint to exact locations in some cases can be quite far fetched.
I was once tracking someone that was harassing me via skype; managed to get his IP however the location was to...an hairdresser....and on the other side of the street of the ISP that person was using.
I already new the provider from whois data, so MaxMind did not allow me to narrow it more than the city.
As usual, tools can be quite useful, but part of the craft is knowing until which point you are able to trust the data they spew out.
Dunno what South Africa gun laws are like, but in America, these people would be greeted with a gun to their face.
Because his ego couldn't let him admit that his device (and by extension, he) could be wrong.
Many years ago a very smart auditor told me that I could outsource my work, but not my responsibilities.
When you screw up your job, you can not blame your tools. Law enforcement has many tools at their disposal, but ultimately it is their job to verify what their tools are telling them.
The vast majority of IP addresses can be traced to either a relatively small space - a dot on map surrounded by an uncertainty radius - or a fixed "shape" such as a country or ISP service area, perhaps surrounded by its own "radius of uncertainty" around that area if the IP address is mobile.
MaxMind, one of the companies in the story, already takes the first approach.
Adding links to computer-readable map data of political entities and ISP service areas along with a "boundary of uncertainty" and providing these instead of an actual latitude and longitude is a good next step.
For IP addresses that are known to be proxy addresses - think companies that funnel all outbound web searches through their corporate firewall on one hand and consumer VPN, TOR exit nodes, and related services on the other - explicitly flag them as such so people know that any geolocation efforts are unreliable.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
"professional" tracking device "that could not be wrong,"
Really? Either they are in a state of denial, incredibly naive and believe the status quo and the powers to be (or anything labeled "professional") could never be wrong, or plain stupid. I'm going to say the last two with maybe a hint of the first.
And it's "useful idiots" like these that ensure that we will be battling fascism now and likely 'till the end of time.
If you look at the past 20 years the few times our ships have been attacked they've successfully shrugged off multiple hits that should have sunk them in 1 (first gulf war) and in the case of the yemanese lobbing missiles at our ships we successfully employed countermeasures. I forget the ship and the missiles but they're simulated at something like an 80% chance of hitting the ship. All of our planning assumes that the first one to get off their missiles will be the victor but we've seen from our few real life data points that in actuality for whatever reason us warships still seem to have a massive advantage.
Just a typical intimidation tactic used by police and detectives, really. They figure if people really were hiding an abducted kid there, they could rattle them a bit by acting 100% confident.
I'm assuming the only evidence they had was an IP address it was last connected to. With that they were able to secure a warrant to search a house half way around the world. That seems to be the bigger problem. Someone needs to tell them that an IP address does not directly relate to physical address; it also does not directly relate to a single person/computer.
Also how hard would it be to run a query to group common gps coordinates and order them by instances. Then looking at the highest instances first, check if the data was based on a town location. If it was then change that coordinate to the local police station. You would kill two birds with one stone. People would show up at the police station looking for kidnapped people or lost devices. Plus warrants would be issued to local law enforcement to search their own building.
And if that doesn't work, we switch them to the nearest local elected representative.
The company claims that about half the time, it is accurate to within 50 Km.
https://www.maxmind.com/en/geo...
This is like that house in the geographical centre of the USA that got all the wrong attention from the authorities!
Here's the first link I found on Google:
https://splinternews.com/how-an-internet-mapping-glitch-turned-a-random-kansas-f-1793856052
The article goes to great lengths to say that this went on for years. Why didn't they ask the first guy to show up the simple question, "Why did you think you would find your phone here?" They would say, "Because I used this free IP Adress locating website." Contact the website, and you're off to the races. It might not have gotten resolved until the second or third visit from SWAT, but they'd at least KNOW why it was happening. Having to hire a lawyer and then contact a university professor? Why didn't they just ask the people showing up?
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
That wasn't your ISP.
And now you get to pay for the scammer's internet too, because to a billing department name + account number + phone number = identity.
The cited Gizmodo article at https://gizmodo.com/how-cartog... clearly indicates that geolocation from IP addresses is not accurate. The article contained a link to a Web page at What Is My IP Address that does geolocation for the IP address of whoever visits that Web page. While What Is My IP Address did get my correct IP address and correctly placed me in California, it also placed me in the wrong county with the wrong ZIP code about 4 miles away from my true location.
I tried three other Web-based geolocation services. GeoIP first placed me in Missiouri; when I reloaded the Web page, it then placed me in New Jersey. Reloading justmyip placed me in Harrisburg, Pennsylvania; Tokyo, Japan; and La Roda, Spain. Both GeoIP and justmyip repeatedly got my IP address wrong. IP2Location placed me in California with the correct IP address but about 7 miles from my true location, in the same county as reported by What Is My IP Address but an even different ZIP code.
I work in the GIS (Geographic Information Systems, electronic maps basically) field and I can tell you that even if you have someone sitting right across from you and you're spelling out the limitations of the datasets straight to their face too many people let confirmation bias get the better of them. I mostly deal with datasets on the "local" level (never leave my little ~700 square mile area) so "property lines" are one of the big dataset focuses. It's good for its intended purpose but the lines can be accurate down to a few inches (very rare) all the way to a shot in the dark (a little less rare) but most are probably in the "within 5-10' " region for our dataset. You can tell people this repeatedly and they will still try to pick out which side of the polygon line a random shrub is from an aerial photo that has each pixel being about 6-10" in size. If they perceive that the line is in a location advantageous to them they'll exclaim "you've proven what I knew all along and I can now go build a fence/tell off my neighbor". If it's in a location that is disadvantageous to them their response is generally "this stuff is useless/meaningless crap". Either way it should be "that gives me some useful information, if I need to do anything serious or have any issues I'll delve more deeply into getting it confirmed" (a title search and a survey generally). All map data has a finite scale AKA accuracy (both digital and paper based), the larger your dataset coverage is the more likely it is to have significant accuracy issues when viewed close in. To stick with the "property lines" example a survey of a specific parcel is likely to be accurate to within a few inches, a random parcel out of +30k polygons in a local GIS dataset is probably going accurate to around a dozen feet, an entry in a statewide database is probably only going to be accurate on average to within a country block (1 mile square). If you're going to a global dataset, be thankful if it's in the right county/geographical region. Of course in time as the technology improves and more information is fed into the system overall accuracy will improve, but it will take time. In the interim, and likely even after it reaches such a stage, information should always be considered at least somewhat suspect without further verification.
If you want a simplified explanation use this.... If you blindly followed a car GPS instructions to drive your vehicle into a lake you'd rightly be called an idiot. So why should you be thought of any differently if you blindly trust some IP geolocator to show you where a criminal/property/computer is?