Databases, Half-truths and IP addresses

Today is my birthday. I feel like clearing the air. I want a better year.

Follow up:

In Abigail's blog, there is a discussion about why she left AHA. I've been writing about it too, but in vague terms. Truth be told, there were problems with AHA from the start. But I just want to talk about the so-called privacy breach that's been in the background since last October.

If you don't know what an IP address is, then google "IP address." When you login to a site like AHA, the IP that you post from is linked to your ID the site database. This database is what feeds the organization or structure of the forum and contains everything that's in the forum, posts, IDs and records of your logins. Whenever you login or post, the IP address is saved in the database. The IP address is a series of numbers identifying the network - Internet provider and location - you use to access the Internet. This is not private information. Whenever you send an email, your IP address is listed in the header of the email. So I suppose you might want to be careful when you send those nasty emails!

The IP address is valuable in detecting multiple IDs, and most site administrators check IP addresses to make sure that users don't have multiple IDs. Sites generally frown on users with multiple IDs, because people are uncomfortable around multiple personalities. However, IPs are not private information, certainly not like a credit card. IPs belong to your internet service provider and they change. And because of this they are not foolproof. Generally the first two sets of IP numbers set your location. If you are worried about being identified by the IP that you login from, there are a variety of programs that you can use that mask your IP. For example, there is something called annonymiser, or something like that.

So, here is what happened, from my point of view. Another writer died and Abigail posted a note about her at various JAFF sites. Abigail recieved a vicious email about how she was using the author's death to misrepresent another web site and promote her self. WTF?. Abigail posted the email including the header information at AHA. I think she threated to expose the identity of the person and everyone got into a snit. And the problem with this was?

To this day I don't understand. It is important to note that the email pertained to a post at a different site, but Abigail posted it at AHA because it was relevant to her work at AHA. And because the other site didn't want her to bring up the issue. BTW, the sender of this email could be prosectued under VAWA (the violence against women and children act). THe response that I observed was like, well, we're sorry that you got that email, but what can we do? Just forget it. Subtext...it must have been something you did. Again, remember that this is my perception. Total justification of someone's nasty acts. I don't think that people who harass others, especially under the cover of anonymity deserve protection.

I helped Abigail find out more about the sender of the email. We took the IP address from the email header. The email address itself was a throw away address (a yahoo address that could not be replied to). I used my administrative privleges to see if anyone at the site used a similar IP address for posting. We looked up the IP in the IP Location database (this is publically available, just google IP location). We asked around about people who came from the same area who were part of the community. A few people sent us private messages that they had received from suspected others. We compared the language used in posts made by a couple of people. Other than checking to see if anyone in the community came from the same area, all of the information that we used to establish the person's identity was available publically and/or provided with the consent of others.

I examined the database with the permission and full knowledge of the officers and other admins of the site. It is important to note that while the database contains IP addresses and emails, it does not contain real name, address, phone number. There is no identifying information in that database, unless users provide it. I searched for the IP in the database. I found that an individual had logged in from that IP on a particular day, and I was able to identify the indivdual by user ID. That would be the use of the database. But I don't consider this to be a breach of privacy. As it turns out, the majority of admins/officers didn't consider this information to be conclusive. I was being dealt with. I believe that some of the individual's privliges were curtailed, but as far as I know, no complaints were issued by the individual for being wrongly accused. But I don't really know what happened there.

One of the big problems at AHA from the start was poor communication, and this event was really an example of it, and I think we're all to blame for that.

Truth be told, I made all of the so-called breaches of privacy.

1. We had a meeting via chat to discuss roles at AHA. The meeting had been planned far in advance. Abigail and I wanted to postpone it but everyone else insisted. This was the same day that we were going back and forth about the nasty email, and everyone was upset.

At the request of the officers I set up chat transcripts for the meeting, but didn't realize that the chat transcipt captured every single private chat. At the end of the painful meeting, I checked over the chat transcript and saw a portion of the private chats. Nasty stuff. I felt terrible and apologized. But I read enough of the chat. I quit the board the next week. I should have walked away right then and there. My mistake. BTW, I turned off the chat transcript capability - it was on for that single meeting. But I don't know if it's been turned on again.

2. We had come down to two camps, more or less. There were, and are some people in the middle. By posting the email on the board, many of the mods/admins thought we were putting the site at risk. I never really understood that, and I disagreed. Maybe I should have asked for an explanation, but well, I did not. That was an error in judgement that I made. Maybe I was too emotional too. It became clear that we probably wouldn't be able to co-exist on the same server. Abigail and I proposed a splitting AI off of AHA. We received no response, no answer and the proposal was apparently rejected outright with no further communication. We had made several requests of the officers or board and most of the time they went into a black hole.

There was a lot of nastiness going on, a lot of escalating. Abigail and I worried that we would be locked out of AI, and I did something that wasn't completely ethical. I backed up the database and looked at it. And I found several messages where admins were talking about shutting us out of AI administration. I saw a lot of other stuff too, that really surprised me. Suffice it to say that it was time to leave AHA administration. So Abigail and I took our AI files (and only AI files) off the AHA server, and moved them to a safe place. It is important to note that when we did this, Abigail still held the registration of the AHA server and had not been reimbursed for her costs.

Members of sites with forums held in databases should know that if you send a PM it is saved in the database. If you want to have a private conversation, you really should not send it via PM. I didn't know this untill I saw the database, but I have heard that email addresses and private information can be harvested from site databases, so buyer beware. This is why yahoo, hotmail, gmail addresses can be useful, if you want to shield your identity.

So I've made mistakes, I admit that. I apologized where I could, but I am tired of the disinformation and lies that I continue to hear bits and pieces of. And I am tired of allegations without understanding. I am also tired of the continuing paranoia that seeps through the JAFF community, the negative things that people are saying, and the behaviors of many of the administrators of a site that I helped to build who feel it necessary to take away posting privleges because .... because....?

Do I think we'll kiss and make up? No. But I'm also not a person who considers everyone to be my friend. I don't need to think people are my friends to chat with them or to have polite conversation with them. Not everyone I work with has to be my friend, either. I do think we can agree to disagree. I also think that the disinformation has to stop. So this is why I am saying this in my own blog.

I've had a pretty rough two years. Personal illness, family illness, transatlantic move, death of a parent, and this shit which really does impact my ability to write and to work. I haven't felt like writing in a long time, it has affected my work, and I'm tired of it. But I'm also a pretty happy person, I have a good life, and I hope I will write again. Someday.

JAFF is supposed to be fun. Sometimes it's not. Sometimes it's like a nasty pit of vipers. Sometimes it reminds me of high school, which I hated. Cliques and all the girls trying to be popular. Ugh.

My blog, my view, my words. A new year, and I hope this sort of thing will stay behind in the dark old year.

Good health and happiness

e.