Secret Service Tasks Internet Monitoring To Private British Firm

In October 2012 there was a flurry of news articles about the Secret Service's monitoring of the Internet and social media, looking for people making threats against public officials. Now we know a bit more about that program, thanks to a recently published DHS privacy impact assessment.

Federal agencies are required to publish public notices describing how any of their programs collect, retain or share personally identifiable information (PII). One of the latest DHS privacy impact assessment pertains to the Secret Service’s Cyber Awareness Program (“Cyveillance”), which is run by a private firm called QinetiQ, a multinational British war and surveillance contractor. Among the many services Cyveillance provides is an executive threat monitoring program. 

Cyveillance advertises its executive threat program as one that “monitors the Internet to provide advanced warning of company-specific threats including:

• Organized demonstrations
• Planned boycotts against products and services
• Threats against employees, corporate officers, facilities and resources
• Smear campaigns and dissemination of misinformation
• Planned activities to interrupt business operations and events
• Solicitations to conspire against the organization

Demonstrations, boycotts, threats against your officers, employees, and facilities… There’s a big price to pay in terms of compromised reputation, employee safety… and customer trust.

Today’s online threats require an intelligence-led approach to security – an approach that identifies risks early for effective prevention and mitigation. Cyveillance Corporate Security provides the people, process and technology to deliver the most advanced and reliable intelligence on company-specific activities.

Some special features of the program include a “Permanent archive of all incidents delivered” and a “Searchable index of all suspicious data discovered.”

The DHS privacy impact assessment on the Secret Service program is exceptionally short on details regarding just what kind of information the company collects on its behalf, or from where it collects this information. But the agency does disclose that the data sucked up and analyzed via the Cyveillance project includes personally identifiable information. The document also informs us that any public mention of “Secret Service” triggers the system, and that all such mentions are forwarded to government agents to look over. But that’s basically all the substance it provides.

DHS Provides A Lesson In Phoning It In

When the DHS privacy office asked the Secret Service to “identify the information the project collects, uses, disseminates, or maintains,” it got this hilariously useless response: “Cyveillance identifies content that falls within the search parameters dictated by the Agency.” But it doesn't press the agency to describe those search parameters.

Here’s another winner:

“What are the sources of the information and how is the information collected for the project?” 

Get ready to be blown away by the specificity of this response.

“Cyveillance uses technology to identify information related to the Secret Service and its missions in accordance with parameters established by the Agency.”

Wow. It uses “technology”! Who would’ve guessed.

But wait, it gets better.

“Does the project use information from commercial sources or publicly available data? If so, explain why and how this information is used.”

Answer: “Yes.” (That’s the entire answer. Apparently the second part of the question got lost in the mail.)

Since DHS won't tell us squat about how it collects information or what kind of information it collects, here’s a bit more about the Cyveillance program, culled from the contractor's public-facing website:

Real-time alerts of high priority threats provide the lead time required to address security issues before damage occurs. Your solution can also include daily summaries covering all the open source intelligence gathered. This valuable summary highlights top priority items and is delivered into the Cyveillance Intelligence Center portal. 

The Cyveillance portal provides a consolidated, real-time view of your organization’s entire online security status. This online intelligence management center gives you immediate, ongoing access to all your data collected from the Internet. Your cross functional teams can efficiently track and manage each case through easy-to-use dashboards and collaborative workflows.

You get a better grasp of what’s going on and more time to act.

Cyveillance gives its corporate and government customers a better grasp of what’s going on, but the government didn’t give we the people a very good grasp of its internet monitoring program in this typically information-starved privacy impact assessment.

Back in October 2012, the Secret Service told the LA Times, “We cast a wide net for information, and that includes law enforcement agencies, federal agencies and the general public. We’re not an intelligence agency — we’re consumers of information.”

Now we know that the agency is a consumer of information identified and collated by a British multinational surveillance contractor. We don’t know much more, but we know that.

Via: "Privacy SOS"

US Military To Fight Wars With Twitter

Students and researchers work inside a lab at the Naval Postgraduate School's Defense Analysis department. Image credit: IDG News Service/Kerry Davis


By Kerry Davis,
Courtesy Of "IT World"

Students at a U.S. military graduate school in California are mining social media with new methods that may change the way the armed forces collect intelligence overseas.

Students and researchers at the Naval Postgraduate School have tackled two projects that could begin the shift in the way intelligence is gathered.

The first is a piece of software they wrote that harnesses the Twitter API (application programming interface) and the second is a project focusing on Syria that uses many social networks to look at U.S. policy options there, though civil liberties experts say the technology concerns them.

The software for Twitter, called the Dynamic Twitter Network Analysis (DTNA), is now being field-tested by three Defense Department units overseas to help gauge public opinion in some of the world's hot spots.

The software pulls in data from the public Twitter feed, then sorts it, live, by phrases, keywords or hashtags. The program is continuously updated, integrating a mapping feature and geo-tagged information. Intelligence officers could use DTNA to understand people's moods about a topic, or hopefully prevent or simply respond faster in any future U.S. embassy attacks.

The group's second project incorporates the DTNA software but also pulls in public information from Facebook, YouTube, Google and other sources to protect potential weapon-of-mass-destruction sites in Syria while the conflict there continues.

The methodology Lucente and researchers are using is called sentiment analysis. It's been around for about 10 years, used primarily by consumer-facing companies to pull public information on social media streams and analyze it for trends. But this is the first known use of sentiment analysis by the military.

"In the commercial world, everyone is doing it," said Bing Liu, a computer science professor who works on sentiment analysis and data mining at the University of Illinois at Chicago. "I'm not aware of work in the military. But I'm sure they're using it."

So he's designed the Syria project to harness real-time social media streams as a test for the sort of fast intelligence gathering he'd like to do. Lucente's project started out broadly by researching use of social media in Syria. He found that, rather than the Assad regime, opposition forces are most active online.

Researchers were aided by the fact that Syrian opposition forces have to rely on social media to get the word out on their activities, since they are not traditionally funded. That means there is a wealth of information on public Facebook groups and Twitter profiles, including photos and videos, all ripe for analysis.

What opposition forces have is a massive online presence, detailing their every move. The "Syrian Revolution 2011" Facebook page has more than 647,000 likes. The affiliated Twitter handle, where attacks, death tolls and sometimes troop movements are routinely broadcast, has more than 78,000 followers.

Lucente says high-ranking U.S. military officials are surprised when he points out the extreme wealth of online information available on Syria. The most stunning thing to him is a Google map, updated every 24 hours by revolution forces, which he says would take roughly 100 U.S. intelligence officers to be able to update at the same pace using traditional methods. The map is scattered with pins, many of which have videos associated with air strikes, ground movement and other details, every day. (Take a look at the map yourself, found here.)

With the Syrian opposition activities targeted for sheer wealth of information for the project, Lucente narrowed the scope of his project to ask which areas of the country are most at risk for losing nuclear, biological or chemical weapons in the event that Syria's government falls. 

He and two CORE Lab researchers focused on a city called Homs, an important location with a major highway intersection hub. Lucente says it's in a key position for controlling the rest of the country because whichever group holds Homs controls the highways. Syrian websites that track deaths, like http://syrianshuhada.com, say that the Homs Province has the highest number of casualties.

Researchers then checked the Nuclear Threat Initiative, a nonprofit group founded to address risks related to weapons of mass destruction, for how many potential weapons-of-mass-destruction sites exist in the city. They found four: one chemical production site, a fertilizer company, an oil refinery and a uranium recovery plant.

To help protect those sites, the researchers culled through Facebook posts and YouTube videos to analyze opposition forces in the area. Their research culminated in a recommendation to talk with one particular Syrian opposition group near the city. Lucente proposed asking the Farouq Battalion, a group of men who fight for the Khalid bin Walid Battalion, to consider watching those four sites in case the Syrian government should fall. 

Rob Schroeder and Gregory Freeman, both research assistants at the CORE Lab, helped map and provide data visualization for the project. The DTNA software pulls Arabic and English information, which is already a step beyond much of the available, consumer-facing software that reads public opinion. But researchers say better foreign language use could crack social media analysis wide open.

"The major ridgeline to be crossed is going to be foreign language analysis," Schroeder said.

If the Syria project and the Twitter software go on to establish models that the military deems successful, they could bring about a shift in the way U.S. military intelligence is gathered, increasing speed by focusing on publicly available social media streams.

US Military: ‘Social Network’ Use Is A Sign Of Radicalism

By Spencer Ackerman,

... according to the U.S. military. You’ve recently changed your “choices in entertainment.” You have “peculiar discussions.” You “complain about bias,” you’re “socially withdrawn” and you’re frustrated with “mainstream ideologies.” Your “Risk Factors for Radicalization” include “Social Networks” and “Youth.”

These are some other signs that one of your co-workers has become a terrorist, according to the U.S. military. He “shows a sudden shift from radical to ‘normal’ behavior to conceal radical behavior.” He “inquires about weapons of mass effects.” He “stores or collects mass weapons or hazardous materials.”

That was the assessment of a terrorism advisory organization inside the U.S. Army called the Asymmetric Warfare Group in 2011, acquired by Danger Room. Its concern about the warning signs of internal radicalization reflects how urgent the Army considers that threat after Maj. Nidal Malik Hasan shot and killed 13 people at Ford Hood in 2009. But its “indicators” of radicalization are vague enough to include both benign behaviors that lots of people safely exhibit and, on the other end of the spectrum, signs that someone is so obviously a terrorist they shouldn’t need to be pointed out. It’s hard to tell if the group is being politically correct or euphemistic.

American behavior is easier for Americans to understand, but the Asymmetric Warfare Group’s list of red flags from American troops is also problematic outside context. Someone who “takes suspicious or unreported travel (inside or outside the United States)” could be linking up with a terrorist group. Or he could be hooking up with a lover, or a going on a road trip with friends, or anything else. Yet that’s an example of “Actions conducted by the subject that would indicate violent or terroristic planning activities that warrant investigation.” The unreported aspect of the travel might be its most blatantly problematic feature.

Similarly, some of the “Risk Factors for Radicalization” identified here apply equally to Normal Soldier and Ticking Time Bomb. Among them: “Youth,” which might be a difficult thing to mitigate against, unless the military wants to take former Pentagon official Rosa Brooks’ unorthodox recruitment advice. “Social Networks” is another, and it’s probably alarmingly coterminous with Youth. Still others: “Emotional Vulnerability,” “Personal Connection to a Grievance” and “Conflict at Work or at Home.”

Via: "Wired Danger Room"

A Message About Facebook

From Founder Mark Zuckerberg

Posted by "CavalierZee"

MENLO PARK, CA (The Borowitz Report) – The following letter to Facebook users was issued today by Facebook founder and CEO, Mark Zuckerberg:

Dear Facebook User,

Hi, it’s Mark.

As you may have heard, our IPO last week didn’t go quite as well as expected. How badly did it go, exactly? If you live in a major city, you’ve probably seen homeless guys huddled around bonfires of Facebook stock. More ominously, I just received a call from my attorney telling me that I probably didn’t need a prenup after all.

If you’re a Facebook investor, you already know what this means: it sucks to be you. But what if you’re one of the billion Facebook users in the world? Well, it also sucks to be you, because I am writing to you now to ask for your financial support to help save Facebook.

It’s only fair. Since its founding in 2004, Facebook has totally revolutionized the way you waste your life. Without it, you would find yourself in the unpleasant and awkward position of having to speak to your family. And so, to keep Facebook alive, I am instituting the following new usage charges:

– $1 per poke

– $5 for every ex you crop out of a profile picture

– $10 for every time you stalk someone from high school, college, or job you were fired from because of that HR “incident”

– $15 for every “friend” you have never met (no charge for friends you know, if any)

– $20 for every sheep, bird, or the Scrabble letters Z, X or Q

With your financial help, Facebook should be around for many years to come, providing you with hours upon hours of pointless and isolating activity. Without your help? I’ve just got one word for you: Friendster.

Help me,

Mark

Via: "The Borowitz Report"

From Tracking Al-Qaeda To Tracking Us

By Dana Milbank,
Published: April 3
Courtesy Of "The Washington Post"


You can find just about anything at the annual homeland security expo: X-ray machines, infrared cameras, a police cruiser with heat-sensing capability, a hovering “gyroplane” — and a GPS device that can spy on your spouse.

The salesman for Blackline GPS Corp., maker of “professional grade covert tracking” equipment, explained that his devices, in the shape of a legal envelope ($700) or an electric razor ($300), can be tucked behind seat cushions, under floor mats or into backpacks.

“We’re getting more requests from husbands and wives,” he explained. “I’ve seen guys throw it in their wives’ car and cover it with a hat. It keeps honest people honest.”

That, in one convenient package, is what has become of the homeland security effort. What began as a well-intentioned campaign to harden targets and protect the nation from terrorists has metastasized into a sprawling and diffuse enterprise that has little to do with terrorists and a lot to do with government and employers spying on the citizenry — and citizens spying on each other.

The GovSec expo this week at Washington’s convention center reflects the shift. Billed as “the premier government security event,” it began after the 9/11 attacks, its organizers told me, with vendors hawking security barriers, razor wire and the like. Now the 2,500 conventioneers can visit the booth of a vendor called ECM Universe, which specializes in monitoring Twitter.

Its “social media surveillance” package helps universities monitor online activity for evidence of bullying, among other things, ECM’s Scott Raimist told me Tuesday. Two weeks ago, the company helped authorities in Fort Lupton, Colo., identify a man who was tweeting such menacing things as “kill people” and “burn [expletive] school.” Said Raimist: “He fit the profile of a pyromaniac.”

So is the man behind bars? Well, no, Raimist admitted. “He’s outside their jurisdiction. He’s still tweeting.” In fact, the man hasn’t been accused of a crime — but that didn’t matter: His full name was projected on a display screen at the GovSec expo as an example of how technology can catch bad guys.

Federal homeland security spending tripled in the years after Sept. 11, and recent cuts have been modest compared with reductions to other parts of the budget. States and private industry, too, have spent billions of dollars. But that money is going further and further afield.

Government agencies and corporations are, for example, buying “Pocket Hound” cellphone detectors, which indicate who is carrying a mobile phone (among the suggested uses: schools and airports). A competitor, Cellbusters, can locate where a cellphone is inside a building or whether someone in your conference room is violating a company’s no-cellphone policy.

Catch many terrorists with this technology? “Not so much,” Cellbusters’ Derek Forde admitted.

Neither is Fulcrum Biometrics likely to apprehend al-Qaeda operatives with its ID system using fingerprint, face, iris, palm and voice identification. Recommended uses include voter registration and “civil ID,” said Fulcrum’s Kathleen Erickson. Also, gym memberships: “You can use it in guest management, like a loyalty program.” One product enables employers to require construction workers and others at remote sites to clock in with their fingerprints.

“Can I scan you?” Erickson asked me. She waved a scanner at my convention badge, and with a “boing” sound my registration information was transferred to her.

There are, of course, legitimate uses for all such gizmos, as there are for gun vaults, portable bunkers and military gear. But Big Brother’s display space at the expo is expanding.

Emergency Vehicles Inc. can convert a Honda Odyssey minivan into a “covert surveillance platform” with heat-detecting cameras. “They can focus in on a person and follow that person wherever they go,” explained salesman Michael Cox.

A company called Telmate sells a kiosk that records and photographs prison inmates during conversation, games or religious services. Hunt Engineeringenables agencies and businesses to scan driver’s licenses or passports and run background checks before admitting visitors. Gamber Johnson is offering a GPS-enabled laptop dock that allows a company to map an employee’s travel for a month.

Nearby, International Surveillance Technology is selling hidden cameras and audio recorders in alarm clocks, iPod docks, water coolers and suitcases. Among government security agencies, “there’s nobody who isn’t buying this,” said chief executive Donald DiFrisco. “Imagine: hookers in a hotel room with a clock radio.”

That’s the homeland security mission creep: from Osama bin Laden to hookers in hotels.

7 Signs We're Living In The Post-Privacy Era

By Helen A.S. Popkin 
January 3, 2012 
Courtesy Of "MSNBC"

Whether by corporate subterfuge, government decree, hacker invasion and our own ambivalence, our digital rights have never faced more peril than they will in 2012. Here's a look at the most egregious losses in privacy — the ways in which the stage was set — during this past year.

Facebook's meaningless settlement with the FTCEverything about Facebook is designed to make it easy for people to reveal things about themselves. Nothing about Facebook's FTC settlement in November — and a spin-heavy mea culpa from CEO Mark Zuckerberg and/or his media consultant — changes that.

According to the FTC complaint, Facebook "deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public."

As we reported on the FTC settlement, Facebook is now barred "from making any further deceptive privacy claims." It also requires "that the company get consumer's approval before it changes the way it sharestheir data, and requires that it obtain periodic assessments of its privacy practices by independent, third-party auditors for the next 20 years."

The settlement does not require that Facebook restore the privacy settings it rolled back in 2009, which led to the FTC investigation. Much of your information is still widely available to the public — as well as to Facebook's business partners — by default. If you want more privacy, you need to "opt out," otherwise your info is out there for anyone to see.

Meanwhile, the much celebrated Facebook Timeline — which rolled out to most users in December — may prove to be the ultimate Trojan horse,  soliciting users to add personal information and life details that occured before Facebook even existed. All the better for direct marketers to sell you stuff, my dear.

Now, the Electronic Privacy Information Center questions whether the rollout of the much celebrated Facebook Timeline conforms to the FTC settlement, sending a letter to the FTC, stating that, "with Timeline, Facebook has once again taken control over the user's data from the user and has now made information that was essentially archived and inaccessible widely available without the consent of the user."

SOPA vs. your right to Internet accessThe obsessive concern among free speech activists and the technorati over the Stop Online Piracy Act and similar Internet blackball bills went mainstream following the recent "Dump Go Daddy" campaign.

The anti-piracy bill, which the U.S. House Judiciary Committee is set to review next year, makes the streaming of unauthorized content a felony. Which is all well and good, but as the EFF warns, the bill's "vague language would create devastating new tools for silencing legitimate speech all around the Web."

"Netizens angered by the initial support of Web hosting giant Go Daddy for a controversial online piracy bill voted with their 'domain' — moving tens of thousands of website names to other Internet domain registrars in a coordinated day of online protest," msnbc.com's Miranda Leitsinger recently reported in Technolog. Go Daddy stopped its havering, making a solid statement opposing SOPA, and in doing so, joining other anti-SOPA corporations such as Google, Facebook and Wikipedia.

"All of the sudden there really is a lot of mainstream attention … we're seeing a lot of people waking up to these issues and taking a firm stance," Parker Higgins, an EFF activist, told Technolog. "It is an important issue and it's one that really affects the future of the Internet."

Why such a strong anti-SOPA turnout? Despite its authority in the U.S., SOPA has international ramifications. Websites that run afoul could be de-indexed by search engines, blocked by Internet service providers, and blackballed by payment processors such as Visa or PayPal as court-ordered by the U.S. Attorney General.

Here's a worst-case scenario free speech supporters say is entirely possible: Proxy servers such as those that aided Arab Spring by allowing protesters to share information on social media are also used to stream pirated content such as movies and music. Shut down the proxy server for a SOPA violation — such as aiding copyright violations — and the voices of protest could be muffled as well.

Given the success of the Go Daddy boycott, odds are SOPA won't pass — sooner or later however, a similar bill will. What we're seeing here is the first, clumsy attempt at inevitable regulation. Call that cynicism if you will, but as the history of radio and TV reveal, such is the fate of all new forms of major media.

Yeah, your cellphone is pretty much stalking you"Locationgate" — the kerfuffle following researchers' discovery that Apple iPhones send user locations back to Apple via unencrypted files — seems like small potatoes compared to a discovery made later in the year, but it was a harbinger of the many phone-related privacy threats ahead.

In April, Steve Jobs hotly denied during Locationgate that Apple tracked anyone, but in an email declared that Google's Android sure did. Google countered with an official statement that "location sharing on Android is opt-in by the user. We provide users with notice and control over the collection."

Apple's passive collection of user data was eventually declared to be "a bug," and it was revealed that the company never shared any of the info anyway.

Congress invited both companies to explain themselves, but as msnbc.com'sBob Sullivan pointed out in Red Tape Chronicles:

If you sensed from Apple — and Apple sympathizers — a bit of, "everyone does this, why is this such a big deal?” that's because they're right. It's true that location information greatly helps their network function. Anyone who's ever turned on a GPS and waited five minutes for the gadget to get a "fix" can appreciate the enhancement Apple was implementing. Plenty of other companies do collect and use detailed location information about us. Many will tell you they “anonymize” the information, they have strict policies about how it is used and stored, that they always get users’ permission before collecting it, that  they secure it, yadda, yadda, yadda. The Apple incident shows that location information is toxic, and the consequences of its collection can be very hard to control.

The bigger privacy scare came in November. Researcher Trevor Eckhart announced that he'd discovered that Carrier IQ — a cell phone diagnostics software company — didn't just track user location, but keystrokes as well (including, yes, passwords). As the case made headlines, it was revealed that Carrier IQ is, or may be, installed in handsets sold by AT&T, Sprint and T-Mobile, from brands including Apple, HTC and Samsung. Verizon Wireless is the only company that says it never installed the software.

The organization also reverse engineered the software to find out just what was going on. ExtremeTech's Sebastian Anthony broke down the process:

There are three parts to a Carrier IQ installation on your phone: The program itself, which captures your keystrokes and other "metrics"; a configuration file, which varies from handset to handset and carrier to carrier; and a database that stores your actions until it can be transmitted to the carrier. Now, the Carrier IQ program is a binary application and fairly hard to reverse engineer, and the database sounds like it's stored in RAM and thus hard to obtain — but the configuration profile … well, it turns out that that is very easy to crack.

On Dec. 1, Sen. Al Franken (D-Minn.) — who earlier this year launched the Location Privacy Protection Act — requested that Carrier IQ "explain exactly what the software records, whether it is transmitted to Carrier IQ or any third party, and whether the data is protected against security threats that could risk the safety and privacy of American consumers."

For all the sneaky stuff our smartphones do, we increasingly have the opportunity to be complicit in our own e-stalking, aptly noted by Gawker's Ryan Tate.

The predicted Facebook phone, Google Wallet and the fact that Apple recently obtained a number of patents, "including one that would turnthe device into a key to your home," present more ways we will voluntarily allow three major tech companies to track or locations, our financial info, our correspondences, our contacts and even open our front door. At the same time.

Some judges are cool with cops accessing your cell phone"In January 2011, the California Supreme Court ruled in People v. Diaz (PDF), that the police were authorized to search any person's cellphone, without a warrant, after they had been arrested under the narrow 'search incident to arrest' exception to the Fourth Amendment, that permits a brief search in the area immediately around a person for the purposes of officer safety and protection of evidence from immediate destruction," the EFF reports.

Since the beginning of the year, we've seen a disturbing trend throughout the United States in which police officers apprehend the telephones of bystanders.

"A high-school student who used her cellphone to take video of police on a city bus was arrested by police and taken into custody after she refused to turn her cellphone off," Technolog reported of a Newark, N.J. incident in May. "Police later released her, but not before they erased the video on the teen's phone."

It was followed by this more alarming story in June from Miami Beach:

A police shooting of a man in Miami Beach on Memorial Day was terrifying, but when it was over, officers turned their attention to a man filming the violent scene with his cellphone. They demanded the device, smashed it and probably thought that was that; no video anymore. It was not: Narces Benoit had had the presence of mind to pull the phone's memory card with the video on it from his cellphone and put the card in his mouth.

"Now, people are carrying years of email correspondence, text and instant messages, bank and financial records, personal photos, calendars, websites they've visited, places they've visited, even the books they read," the EFF points out. "So, with all the mobile computing smartphones are capable of, it comes as no surprise that law enforcement wants to get their hands on the digital goodies. And unfortunately, in 2011 courts gave them the ammunition to do so."

Oh yeah, and the Feds want to know what you're up to, tooIn December, a Carrier IQ senior executive said that the FBI approached the company about using its technology but was rebuffed, Associated Press reported. "The disclosure came one day after FBI Director Robert Mueller assured Congress that agents 'neither sought nor obtained any information from the company, Carrier IQ."

Meanwhile, "several court decisions in recent months have sent mixed messages about the legality of GPS and cellphone tracking by the government, and the issue has just landed in the U.S. Supreme Court," Security News Daily reported in November.

In August, a federal judge in New York ruled that police would need a warrant to track an individual using cellular-tower triangulation. In early October, a different federal judge, this one in Washington, D.C., ruled that police did not need a warrant to use same method to track the cellphone of an armed-robbery suspect in an ongoing case. And just last week, a third federal judge,  this one in Houston, ruled that a warrant was necessary.

When it comes to location, there's also the matter of the feds attaching GPS devices directly to your car. "Cases of surprised citizens finding government GPS units on their car aren't everyday occurrences, but they are happening,Technolog reported in November.

"In March, an Egyptian-American college student filed suit against the FBI for secretly putting a GPS tracking device on his car. Yasir Afifi, a California native who said he had and has nothing to hide, said a mechanic doing an oil change on his car found the device between his car's right rear wheel and exhaust."

In November, Wired's Threat Level reported a "Hispanic American who lives in San Jose at the home of his girlfriend’s parents," found not one, but twohidden GPS devices on his Volvo.

And if you're not being tracked directly on your vehicle, perhaps it's from above. The New York Times reported in December:

The American Civil Liberties Union on Thursday warned of the prospect of "routine aerial surveillance of American life" and called for new regulations to govern the use of unmanned aerial systems, or drones, over American skies.

Know what else the ACLU ain't happy about? That National Defense Authorization Act (NDAA) President Barack Obama signed on Dec. 31 — the one that allows the indefinite military detention without trial of American citizens. "The statute is particularly dangerous because it has no temporal or geographic limitations, and can be used by this and future presidents to militarily detain people captured far from any battlefield,"  Anthony D. Romero, ACLU executive director, said in a statement.

Even if you don't leave your house, there's always the Internet. As we mentioned earlier, a quick review of the EFF's growing gallery of evidencerevealing social media monitoring by various U.S. government agencies only goes to show: There are no secrets among "friends."

Don't forget the hackers! While the Matrix-like intrigue of Operation AntiSec  —  the distributed denial of service attacks (DDoS) against banks, corporations and the government — made for a more exciting read, individuals still have more to fear from far more malicious cybercrime.

In April, a company called Epsilon released a statement reporting an unauthorized entry in its clients' customer database. Though nobody had really heard of this company, it turns out, most Internet-active Americans were affected one way or another. See, Epsilon is an electronic direct marketing outfit that sends 40 billion emails annually and counts over 2,500 clients, including 7 of the Fortune 10, as well as the New York Times.

For the most part, only emails were exposed — no passwords or other personal information.

That was a mild relief, yet not a breach to be taken lightly, as Technolog noted at the time. Following the breach, customers of any of Epsilon's clients needed to be wary of spam, that could take the form of fake emails that appear to be from a trusted company, tempting you to click.

Scammers use hijacked email addresses to create email based on your interests or email that appears to be from your bank or other company you know and trust. Clicking the malicious link within an email can hijack your computer and turn it into a spam bot without your knowledge or worse, install malware that can record your passwords and credit card info.

During the past year or so, similar user or employee database hackings were reported on Gawker Media's blog network, Sony's PlayStation Network (and other related services), the Citigroup bank, defense contractor Lockheed Martin, military consulting firm Booz Allen Hamilton — even the Hershey chocolate company, among others.

Also, we're jerksIn November, an inexcusable number of media outlets found it super awesome that Andy Boyle, a newsroom web developer for the Boston Globe, live-tweeted the ugly details of a young couple's argument in Burger King.

As David Pell pointed out best, "The fight was loud enough for Boyle and other patrons to overhear. The fighting couple was certainly aware of that. They chose to argue in public. They, in effect, gave up their right to privacy among those at the restaurant. But should they have assumed their fight would be broadcast on Twitter and eventually featured on ABC News?"

But in an act similar to say — a journalist emailing crime scene photos to friends for giggles with no thought to the victims — Boyle also tweeted a photo of the couple. Mainstream media outlets ran the photo as well.

Pell, one of the shamefully few to call shenanigans on this incident, goes on to write:

In that Burger King, Andy Boyle thought he was listening to the disintegration of a couple's marriage. He was really hearing the crumbling of his own ethics and self-restraint. We can't stand by and let an alliance between technology and poor judgment disintegrate all decency, and turn every human exchange into another tawdry and destructive episode on a never-ending social media highlight reel.

If our disgust with this kind of secondhand sharing is widespread enough, maybe there's still a chance such invasions of privacy will be the exception and not the rule. But I wouldn't bet on it.

As 2012 moves forward, we may not have much control over our own privacy, but we can at least control what we do with the privacy of others.