How Cartographers For the US Military Inadvertently Created a House of Horrors in South Africa (gizmodo.com)

Kashmir Hill, reporting at Gizmodo: The visitors started coming in 2013. The first one who came and refused to leave until he was let inside was a private investigator named Roderick. He was looking for an abducted girl, and he was convinced she was in the house. John S. and his mother Ann live in the house, which is in Pretoria, the administrative capital of South Africa and next to Johannesburg. They had not abducted anyone, so they called the police and asked for an officer to come over. Roderick and the officer went through the home room by room, looking into cupboards and under beds for the missing girl. Roderick claimed to have used a "professional" tracking device "that could not be wrong," but the girl wasn't there. This was not an unusual occurrence. John, 39, and Ann, 73, were accustomed to strangers turning up at their door accusing them of crimes; the visitors would usually pull up maps on their smartphones that pointed at John and Ann's backyard as a hotbed of criminal activity.

[...] The outline of this story might sound familiar to you if you've heard about this home in Atlanta, or read about this farm in Kansas, and it is, in fact, similar: John and Ann, too, are victims of bad digital mapping. There is a crucial difference though: This time it happened on a global scale, and the U.S. government played a key role. [...] Technologist Dhruv Mehrotra crawled MaxMind's free database for me and plotted the locations that showed up most frequently. Unfortunately, John and Ann's house must have just missed MaxMind's cut-off for remediation. Theirs was the 104th most popular location in the database, with over a million IP addresses mapped to it.

Comments

Re:Continentia..

[Archtech]

"Roderick claimed to have used a "professional" tracking device "that could not be wrong,"

Isn't it strange how many people nowadays know things like that, with absolute certainty. How could he possibly know that it "could not be wrong"? Because he paid a lot of money for it? Or because some shyster salesman sold him a bill of goods?

Disable SSID on your routers

[Dan East]

According to TFA, this was caused by stolen devices being in areas without a cell signal, and falling back on WiFi access point geolocation. Further, the area in question has very few access points, so phones can potentially pick up these residential access points from thousands of feet away. Then they are geolocated to the exact position of the access point.

A solution is to disable SSID on your home router(s) so that these data-grabbing sniffers won't see it and try to geolocate off of it.

Re:Disable SSID on your routers

[Thelasko]

According to TFA, this was caused by stolen devices being in areas without a cell signal, and falling back on WiFi access point geolocation.

You read the wrong article. That's the case for the home in Atlanta.

TFA is actually the result of someone at the NGA deciding this guy's house was the geographical center of Pretoria. As is the case with the farm in Nebraska, any unknown location in Pretoria defaults to the geographical center. They emailed the NGA (who would have thought?) and the issue has been corrected. The default location is now Church Square in the NGA database.

Re:Disable SSID on your routers

[tlhIngan]

According to TFA, this was caused by stolen devices being in areas without a cell signal, and falling back on WiFi access point geolocation. Further, the area in question has very few access points, so phones can potentially pick up these residential access points from thousands of feet away. Then they are geolocated to the exact position of the access point.

A solution is to disable SSID on your home router(s) so that these data-grabbing sniffers won't see it and try to geolocate off of it.

No, this was the result of bad IP geolocation information. Basically the guy's house happened to be where they said "South Africa" was because that's the best area they could get for an IP.

Anyhow, WiFi geolocation (more accurate than GPS, actually) doesn't care about SSID. It only uses MAC addresses that are transmitted in the beacon packets. All any device has to do is switch channels and listen to capture the AP MAC addresses and signal strength. Send that information to Google and you'll get back a pretty good location. Same goes for cell towers - the modem will scan for available cell towers, note their IDs (this includes all cell towers in all bands it can receive, including ones that you don't have service for) and do the same thing.

The problem is the devices last pinged some tracker from an IP and that was last that device was heard of, and that IP had only country level resolution.

(The US database of countries contains latitudes and longitudes that are often returned when you look up a country to get a specific location, and a lot of these IP geolocation companies use it without realizing the radius of uncertainty is "country" and not "city block").

So, in sum

[SlaveToTheGrind]

1. Cartographers for a U.S. intelligence agency published coordinates for the center of the populated area of Pretoria, South Africa.
2. An IP location service provided those coordinates, along with an uncertainty radius, for Pretoria IP addresses.
3. Other IP location services threw away the uncertainty radius.
4. South African government officials, bounty hunters, etc. used the IP location services that threw away the uncertainty radius.
5. The U.S. intelligence agency changed the coordinates to the center of the town square after being apprised of the issue.

That seems like fairly thin gruel for Slashdot's "U.S. sux" article du jour.

Re:So, in sum

[Anonymous Coward]

That seems like fairly thin gruel for Slashdot's "U.S. sux" article du jour.

Where did this last sentence come from?

Everything you listed happened. It's affecting people, and it's newsworthy.
The /. post doesn't say anything about blame; the /. title notes that it was inadvertent.

Are you such a weak snowflake that you are offended by anything which isn't pure "U.S.A." cheerleading?

Re:So, in sum

[PPH]

That seems like fairly thin gruel for Slashdot's "U.S. sux" article du jour.

You seem to have ignored the broad distribution of blame for this situation and homed in on what appears to be the apparent centroid of the problem.

Re:So, in sum

[flink]

2 & 3 are why I like grid systems like MGRS. The precision is inherent in the coordinate data, and there is no illusion that the coordinates represent a precise point.

Re:So, in sum

[amicusNYCL]

That seems like fairly thin gruel for Slashdot's "U.S. sux" article du jour.

You just have to dig a little deeper for the meat.

"It's almost with religious zeal that these people come, thinking their goodies are in my yard," John told me. "The Apple customers seem to be the worst."

ah HA! You thought was "U.S. sux", but is "Apple sux" instead! Bamboozled again.

Clearly this homeowner is just an Android zealot, because those are the only people who ever criticize Apple users. I've learned this fact right here on Slashdot.

Why has no one sued MaxMind into bankruptcy?

[Archtech]

Seriously, any company that causes so much distress and harm deserves to be put out of business. Unless it has enough money to pay appropriate damages to all of its victims - whether they complain or not - and to fix its utterly insane software decisions.

The CEO actually didn't know what to do about IP addresses that couldn't be located more precisely than "the USA"? I can do that one instantly. Tell the user that the IP address can't be located more precisely than "the USA". I know it rankles to big business, but when all else fails you can always try telling the truth.

Re:Why has no one sued MaxMind into bankruptcy?

[SlaveToTheGrind]

The CEO actually didn't know what to do about IP addresses that couldn't be located more precisely than "the USA"? I can do that one instantly. Tell the user that the IP address can't be located more precisely than "the USA".

If you read the fine article, that's exactly what they did:

But computer systems don’t deal well with abstract concepts like “city,” “state,” and “country,” so MaxMind offers up a specific latitude and longitude for every IP address in its databases (including its free, widely-used, open-source database). Along with the IP address and its coordinates is another entry called the “accuracy radius.”

The accuracy radius does what you might expect. It says how accurate the coordinates are; it indicates the 5-mile, or 100-mile, or 3,000-mile area included with “a point” on a map. Unfortunately, it is ignored by many geo-mapping sites such as IPlocation.net, which gets its data from IPInfo and EurekAPI, two more IP geolocation databases that use MaxMind as a source.

The issue is users / other services ignoring the accuracy radius. The question from the CEO was about the best approach to try to dumb down the system for people who were not using the information as intended/provided.

Re: Why has no one sued MaxMind into bankruptcy?

[c6gunner]

The CEO actually didn't know what to do about IP addresses that couldn't be located more precisely than "the USA"? I can do that one instantly. Tell the user that the IP address can't be located more precisely than "the USA".

That's what they did. "The IP address is located somewhere within this massive circle". It's not their fault that idiots interpreted that as "at the centre of this massive circle".

I agree that changing the coordinates of the centre of the circle to an unpopulated area makes sense given that the world is full of idiots, but not doing it by default isn't malicious and certainly shouldn't be grounds for a lawsuit in any sane legal system.

Re:Why has no one sued MaxMind into bankruptcy?

[gtwrek]

My read is actually the MaxMind CEO is acting fairly reasonably in working towards a solution. His firm had no malintent and worked reasonably in trying to solve both the problems in the US, and now the one in this article.

The first pass attempt at a fix in the US - moving the geographical center of the US to the middle of a lake (which I think is a great idea, BTW) resulted in a further lawsuit from the property owners of the lake. Which was settled. I think this was all a reasonable solution by all parties.

We should encourage this sort of response by companies, not demonize them. As opposed to the often relied on solution by companies when exposed to these sorts of problems - a shoulder shrug perhaps, if the problem is even acknowledged at all.

Put away the pitchforks.

Re: Why has no one sued MaxMind into bankruptcy?

[Dragonslicer]

A point is one dimension, an ares is two.

One dimension would be a line, not a point. Ares, being a god, is in an entirely different dimension.

Re:Why has no one sued MaxMind into bankruptcy?

[mejustme]

Is the database populated with falsely precise coordinates?

No. The locations are the center of a circle. The size of the radius -- which is yet another field in the database -- then determines the precision. But some users (some web sites, some apps, etc) look at the center of the circle, place a pin at that location, and then forget to indicate that the radius is hundreds or thousands of km.

Here is an example from the MaxMind database when I look up a Google address, 65.44.217.6:

{ "city" : { "names" : { "en" : "Fresno" } },
      "continent" : { "code" : "NA", "names" : { "en" : "North America" } },
      "country" : { "iso_code" : "US", "names" : { "en" : "United States" } },
      "location" : { "accuracy_radius" : 200,
                                      "latitude" : 36.6055,
                                      "longitude" : -119.752,
                                      "time_zone" : "America/Los_Angeles" },
      "postal" : { "code" : "93725" },
      "subdivisions" : [ { "iso_code" : "CA", "names" : { "en" : "California" } } ]
}

Note the "accuracy_radius" field, which is in km. But if you ignore that field and only look at latitude and longitude, you have a single pin on a map, incorrectly making it look like an IP address maps to a specific house or business, while it should map to a large circle with a 200 km (124 miles) radius.

Actual summary

[psnyder]

Many mapping systems give specific latitude and longitude coordinates and an accuracy radius for an IP address. When the accuracy radius is inaccurately large (like searching for a city, or a country) the coordinates arrow points in the middle, which can be someone's house. Someone using location services (like "Find My Lost Phone", and even police) often get these coordinates without understanding the accuracy sucks.

This particular case in South Africa happened because of a mapping service created by "National Geospatial-Intelligence Agency", which is part of the US Dept of Defense.

I'm not sure why useful information like this wasn't in the summary, but... I guess it made me read the article, so the jokes on me.

My favorite quote was from a guy that lives in this house. Right after the article says, "a team of police commandos stormed the property, pointing a huge gun through the door at Ann, who was sitting on the couch in her living room eating dinner", a few sentences later he says, "The Apple customers seem to be the worst."

He knew he could be wrong, all along.

[King_TJ]

Just a typical intimidation tactic used by police and detectives, really. They figure if people really were hiding an abducted kid there, they could rattle them a bit by acting 100% confident.

Re:Continentia..

[lactose99]

How could he possibly know that it "could not be wrong"? Because he paid a lot of money for it? Or because some shyster salesman sold him a bill of goods?

This is very often the same thing.

Re:Continentia..

[grep -v '.*' *]

How could he possibly know that it "could not be wrong"?

Because it's been printed with a computer. Here, let me show you my green-bar printout.

People have been that way for decades (plural), it's nothing new.

I suspect some people are too pedantic, but that's also part of some people's stress now-a-days: things are so complicated and interwoven that they want SOME simple, absolute stuff, whether it be locations, facts, or even ideologies.

There's weird noises in an abandoned house after dark? It couldn't be animals or rot or heat expansion, it's got to be GHOSTS or GNOMES, one of the two. And you know that garden gnomes keep going missing, don't you? They're gathering for something.

Don't Blink.

Company claims 50Km accuracy half the time

[raymorris]

The company claims that about half the time, it is accurate to within 50 Km.
https://www.maxmind.com/en/geo...