PRIVACY BEAT: Web Stalking in the Real World

FOR ONE NEW YORK WOMAN it began in 1996 with hundreds of email messages, followed by dozens of phone calls a day from strangers wanting to share their sexual fantasies. One caller explained that he was answering an ad he saw on the Internet. The victim was able to trace the ad to a local Internet service provider, and believes that she was targeted by a former employer whom she had turned in for shady business practices.

It's the latest crime and it can happen anywhere, from upscale Manhattan to the frontiers of Alaska. It's a disturbing new variation on a nasty theme, the vindictive and persistent stalking of a terrified victim using the Internet. 

The stories keep adding up. A 31-year-old woman in Pennsylvania was terrorized via email by an Alaska man she met in an Internet chat room. Police and social service agencies told her there was nothing they could do.

A California man, upset at a woman who rejected his romantic advances, impersonated her in various Internet chat rooms, posted her address, and sent messages that she fantasized about being raped. Men showed up at the woman's door at least six times, sometimes in the middle of the night, saying that they were there to rape her.

And in perhaps the most shocking case of cyberstalking to date, a New Hampshire woman was shot and killed in 1999 by an acquaintance who had mapped out his obsession with her for two years on the Internet.

Liam Youens, 21, maintained a Web site that detailed his infatuation with 20-year- old Amy Boyer, whom he knew from high school. One day Youens wrote that his love for Boyer had died, and so must she. He obtained her social security number for $45 from an on-line service and used it to find out where she worked. For the next two weeks, Youens stalked Boyer in the real world, learned her routine, and then boasted on his Web site that he had planned her murder. Three days later, Youens shot Amy Boyer in the head 15 times as she left work before killing himself.

Cyber-stalking seems to be on the rise
According to a recent study by the Department of Justice, the ability to hide behind a computer screen may encourage angry individuals to become harassers. "Whereas a potential stalker may be unwilling or unable to confront a victim in person or on the telephone, he or she may have little hesitation sending harassing or threatening electronic communications," the study states.

Law enforcement officials and Internet watchdog groups believe that cyberstalking is on the rise. The Manhattan District Attorney's Office estimates that about 20 percent of its sex crimes involve cyber stalking. Los Angeles law enforcement officials believe email and the Internet are involved in about 20 percent of the stalking crimes they handle.

Connecticut, Massachusetts, New Hampshire and Maine have cyberstalking laws on the books, as do California, Illinois, New York and Maryland. But law enforcement officials are often not equipped to control this modern crime that uses the powerful, affordable, and often anonymous tools of the Internet to target and terrorize its victims.

Take preventative steps now
Cyber criminals build their campaign of harassment by invading your privacy. The first line of defense against these attacks is to be aware at all times of possible invasions to your privacy, and to take steps to protect it. Here are a few tips. For more information on what you can do to protect yourself and your family, go to perfectlyprivate.com, the first-ever Web community for Internet users concerned about their privacy.

• Avoid sharing personal information in any online public spaces

• Avoid using your real name or nickname as your screen name or user ID  

• Choose names that don't give away your gender or age

• Log off immediately if an online situation becomes hostile  

• Notify your Internet service provider about abusive or harassing email  

• Save offending emails, chat room logs, or other electronic files. They could be used to track the cyberstalker  

• Even if the author of the offending emails is someone you know, reply only once and tell them to stop. They could be encouraged by repeated replies.  

• If the email is from a stranger, do not reply at all - replying verifies your email address to the sender  

• If the emails persist or are accompanied by phone calls, postal mail, or other threats, contact the police

Hackers and 'cyber-thieves' have proven their ability to abuse even the most secure sites
A recent study by the Computer Security Institute found that 70 percent of Fortune 500 companies had their security invaded in 1999. Those companies and others like them maintain personal information about their clients. When their security is breached, so is yours.

Yet a greater threat to your privacy comes not from these well-publicized cases but from a seemingly safe activity, surfing the Web. According to a May 2000 Federal Trade Commission (FTC) study, during one month of surfing the most popular web sites there is a 99 percent chance that your personal information will be captured, usually without your knowledge.

How are some of these sites using your information? Consider this example:

You participate in an online survey while registering for a healthcare newsletter, and check that you once suffered from hypertension. A few weeks later a brochure from a hypertension clinic shows up at your work address. Your boss sees it and you get turned down for that high stress promotion. All because the company you thought was anonymously collecting your information sold it to the highest bidder.

Legal protection of online privacy is still being debated
If this happened to you, you would want the offender to be punished. But what laws exist to punish privacy pirates? Like most Internet standards, legal protection of online privacy is still being debated.

Congress has considered two significant pieces of legislation to protect online privacy. The Child Online Privacy Protection Act of 1998 (COPPA) and the recently introduced Medical Financial Privacy Protection Act both strike at areas that most agree deserve protection, the young and the sick.

COPPA requires all Web sites to get a parent’s consent before they can collect, use, or disclose personal information from children under 13, and to post clear policies about how that information is used. The Medical Financial Privacy Protection Act would bar financial institutions from sharing customers’ medical financial records without their consent, and would prohibit financial institutions from considering medical information when making credit decisions.

Though both of these pieces of legislation seem reasonable, industry leaders argue that regulation hinders commerce and places an unfair burden on online companies. Free speech advocates such as the American Civil Liberties Union also oppose regulation, fearing that it could lead to censorship and even further invasion of privacy.

The private sector has made progress on it's own
According to the FTC, the number of top sites posting a privacy policy has significantly increased since 1998. In addition, 45 percent of the most visited sites have some form of privacy certification seal such as TRUSTe or BBBOnLine. IBM, Microsoft, America Online and others recently released guidelines that they believe should be used to allow self-regulation of eCommerce.

A big motivation behind these guidelines and the use of privacy seals is to keep government, and legal enforcement against privacy invasion, off the Internet. Under self-regulation, if your privacy is violated you can’t go to the police. Instead you must work through an arbitration process set up by the company.

Although there has been a dramatic increase in the number of sites posting privacy policies, the level of protection they provide varies. Just because a company posts a privacy policy it doesn’t necessarily mean they are respecting your privacy. They may simply be telling you that they're collecting your personal information and what they plan to do with it. In short, some companies can post policies to tell you they are sharing information. This protects them if you later discover your data has been sold or distributed.

Privacy watchdogs such as the Electronic Privacy Information Center (EPIC) and Junkbusters are lobbying Congress to enact laws to protect online privacy. EPIC has also sued the federal government to challenge the pace of privacy abuse investigation, as well as the potential misuse of data collected by the government.

How do you protect yourself
Protection of online privacy will continue to be hashed out in the courts, in the Congress, and in the corporate world. In the meantime, how can you protect yourself from cybercrime?

• If you receive threatening email, contact your local law enforcement agency and report it to the Cyber Tipline at (800) 843-5678

• If a company shares your information in a way that you have not authorized, contact the Better Business Bureau

• Request periodic checks of your credit. These will reveal any misuse of your name or financial information

• Carefully review a web site’s privacy policy before intentionally sharing personal information or completing a financial transaction.

• Check the security status of sites that you frequent. PerfectlyPrivate.com conducts independent appraisals of the busiest sites to see how they are living up to their privacy claims.