NewsLinx Computergram
Tuesday, September 14, 1998

ISP told to divulge users' identities

by Rachel Chalmers, rachel@computerwire.com

An industrial-waste-recycling company has made Yahoo! Inc and Ontario ISP Weslink Datalink Corp divulge the identities of anonymous posters to a bulletin board. According to privacy advocates, the incident points up basic misconceptions about individual privacy on the part of people using the web to chat. Yahoo Finance hosts a number of company-specific forums, including the Philip Services Corp forum, which is unaffiliated with Philip itself. Users implicitly accept Yahoo's terms and conditions.

The company reserves the right to disclose communications if required to do so by law, and this is what has in fact happened. At the end of June, Philip obtained twelve court orders requiring Yahoo, Weslink, and other ISPs to divulge the names, addresses, and telephone numbers of posters to the forum, as well as the make, model, type, and registration number of the computers and modems they used to post. The granting of the court orders appears to have been a rather one-sided affair. "The motion was made ex parte, meaning Philip's lawyers were there and no one else", says David Jones, president of Electronic Frontier Canada and a computer science professor at McMaster University. "It would be nice if someone had said to the judge, 'Hey, there is another side to this issue.'" Apparently, no one did.

Both Yahoo and Weslink have handed client details to Philip. "Before this turns into the US wires bashing those wacky Canadians, I want to point out that the first people to cave in were Yahoo", Jones says, "they provided Philip with all kinds of IP addresses, which the company used to trace the ISPs. If Yahoo had stuck to their guns no names would have been revealed." What drove the waste disposal outfit to these extremes? "I'm not an expert but my impression is that Philips is fighting for its life", Jones explains. Successive scandals and accusations of incompetent management have plunged Philip shares from a 52-week high of $19.93 Canadian to $3.44. "If it costs a million dollars to shut up their critics, from the company's point of view, that could be money well spent", Jones says.

Philip itself denies that its actions were intended to suppress critics. It contends that the messages contained ethnic and sexual slurs and specific threats against employees. However it has offered no evidence in support of these claims. Though Yahoo says it has removed the offending messages, most of those specifically mentioned in the court order against WesLink were still accessible on Monday afternoon.

Occasional childish insults surface, but in general the tone is one of robust debate on the nature of the company's business practices. "The Philip scam is not hard to figure. A few carpet-baggers have skimmed millions that belong to other people into personal bank accounts", read a typical post. Even so, Mike Riley, a spokesperson for Yahoo, said the messages that had been removed violated the company's terms and conditions of use. Like Philip, he could not provide any concrete examples. So is this merely a case of a business censoring its more outspoken critics, with the willing collusion of the internet's infrastructure companies? Jones says he is sympathetic to the pragmatic nature of the ISPs' actions. "Yahoo's and Weslink's are essentially business decisions", he says, "the net community has this great devotion to freedom of expression but for ISPs, there's little profit in protecting that. If Yahoo had put up a little bit of a fight they would have won a lot of goodwill, but where do they draw that line?"

The point, he says, is that users should be aware that companies have no business interest in protecting individuals' privacy. Ignorance of the technology is no excuse. "People who thought they were anonymous didn't have any idea how easy it would be to trace their identities", he observes.

He suggests that there might be a market for a new kind of chat forum with a well-publicized policy that log files get wiped after a week. "You can get court orders all you want, but if the information just isn't there, what can you do?" he says, "I guess I have a little bit of a hope that the geeks out there can come up with a better way of protecting anonymity on the web."

Copyright © 1998 by Computergram. All Rights Reserved. Reprinted with permission.