Radio telemetry tracking, triangulation from two known points using an excel spreadsheet.
Recently we’ve been involved in an asset tracking project for a client.
The assets were small enough that a GSM/GPS device was likely to be too large to be able to be hidden effectively, when the necessary battery for long-term unattended use was included. As a result, we installed small radio beacons, designed for the tracking of small animals.
To locate the tracking beacons, we use either a yagi antenna with a receiver, or a car-mounted radio-direction-finding set-up with a series of aerials mounted to a vehicle in a plane.
Tracking multiple objects over a prolonged period of time, we end up with a large amount of data in a “position, bearing" format, or more precisely, “easting, northing, bearing".
I scoured the internet in vain looking for a spreadsheet which contained the formulas necessary to turn two position/bearings into a third position - namely the location of the tracked asset. The trigonometry is not especially difficult, but nowhere was a pre-configured excel spread sheet to be found!
Sitting down to build one, I feared it would be a difficult and time-consuming process (I’m not particularly mathematically inclined) but was pleasantly surprised to have it constructed and tested within the hour.
I expect it will be of assistance to other investigators, zoologists/ecologists etc who are tracking birds, mammals or other animals, people involved in vulnerable person tracking operations, and perhaps even to the amateur radio direction finding crowd.
I include it here, as an attachment, under a Creative Commons AU 3.0 licence.
To download the file, click HERE or right-click and choose save-as.
Issues with Background Checks - Working with Children
In most Australian States and Territories, there is a legal requirement for those working with children to undergo some form of background screening prior to employment, and in some cases for volunteering.
Offences exist in most jurisdictions, both for the employee attempting to or successfully working without the requisite check having been performed, and for the employer for engaging or continuing to engage someone without the appropriate clearance.
There is no recognition of the validity of checks conducted between any Australian jurisdictions, including where the checks are ostensibly the same.
Jurisdictions which purport to monitor those who hold approvals only monitor offences within their own jurisdiction, with interstate and Commonwealth offences only checked at the point of renewal, every 2-5 years.
This means that a person could hold a valid check, commit an offence against a child in another state, and continue to hold a valid check for up to 5 more years - a gaping hole in the process.
Where an employer is registered against an approved person in order that they may be notified if that approval is suspended or withdrawn, for various reasons, in most cases the employer cannot be certain that they remain registered and will in fact be notified that the approval is withdrawn.
Prohibition Notices can be issued by the Children’s Services Regulatory Authorities under the Education and Care Services National Law Act, but these are not reported to Working with Children Screening Authorities and are not available for screening purposes, even where the purpose for the Prohibition Notice is relevant to an approval being granted or remaining valid.
Education and Care Services National Law
The Education and Care Services National Law Act (“the Act”) grants power to the Regulatory Authority of each jurisdiction to issue a Prohibition Notice to a person it considers may cause an unacceptable risk of harm to a child at an Education and Care Service.
The reasons for the issue of a Prohibition Notice may or may not fall within the scope of the Working with Children Law of any given jurisdiction; however it is reasonable to assume that at least some Prohibition Notices will be for relevant reasons, based on the underlying purpose of these Notices.
A person subject to a Prohibition Notice must not carry out any activity relating to an Education and Care Service, and must not be engaged by an Approved Provider as a staff member.
Regulatory Authorities are authorised to disclose information related Prohibition Notices to any government department, public or local authority, to the National Authority and to other Regulatory Authorities.
Although Prohibition Notices have been issued by several Regulatory Authorities, there has been limited communication of this between the relevant Regulatory Authorities and other relevant parties.
There was, at the time of writing, no method for the communication of information related to Prohibition Notices to the bodies responsible for the administration of Working with Children Laws (“Working with Children Authorities”) in each jurisdiction.
There is no practical method for an employer to ensure they do not employ, or continue to employ, a person subject to a Prohibition Notice.
Commonwealth
There is no legal requirement to perform criminal history screening for those working with Children; however, at common law the duty of care owed to children in care may lead to the inference that some form of background checking is necessary.
In November 2008, COAG agreed to develop an inter-jurisdictional exchange of ‘expanded’ criminal history information for people working with children.
This agreement was implemented by means of a Memorandum of Understanding (MOU) between the Commonwealth, States and Territories. The MOU establishes a ‘national exchange of criminal history information’ through which jurisdictions are to share expanded criminal history information held by jurisdictions’ police services. This scheme is referred to as the Exchange of Criminal History Information for People Working with Children (ECHIPWC).
This process facilitates a more comprehensive Working with Children National Criminal History Check in jurisdictions where this is undertaken.
Bodies approved to access this expanded information exist in Queensland, New South Wales, Victoria, the Northern Territory and Western Australia, but not in the ACT, Tasmania or South Australia.
Australia Capital Territory
New Working with Vulnerable People legislation came into effect in November 2012. This new system requires people working with vulnerable people, including children, to ‘register’ themselves with the Office of Regulatory Services (ORS), in the Department of Justice and Community Safety (ACT).
The process includes a Working with Children National Criminal History Check, and provides for ongoing monitoring of those registered. During the initial application for registration, an employer may be listed. This employer will be notified of the outcome of the application for registration.
Subsequently, no notification will be made to any employer if they are registered or deregistered as a person’s employer, and employer(s) will not be notified if a registration is suspended or withdrawn.
Ongoing monitoring of registered persons will be limited to actions within the jurisdiction, namely the ACT. Offences or other actions in NSW will have no effect on a person’s registration.
New South Wales
Current process
The Working with Children Check conducted by the Commission for Children and Young People (CCYP) is a point-in-time check which includes no ongoing monitoring of criminal or other behaviour and cannot be repeated during a person’s period of employment.
Subsequent checking must be by a National Criminal History Check. Where this is undertaken, it is a point-in-time check, and includes no ongoing monitoring. The efficacy of National Criminal History Check is limited. Enquiries to CrimTrac by an individual (through their jurisdiction’s Police Service or a private provider) are limited to a class of check referred to as “Vulnerable Persons”. This is a lower standard of checking than that referred to as “Working with Children”, which can only be undertaken by recognised Working with Children Unit applying the Working with Children Law of that jurisdiction.
Prohibition Notices issued by the Regulatory Authority under the Education and Care Services National Law Act are not reported to the CCYP. The ability for a Prohibition Notice to be taken into account as part of a Working with Children Check relies on self-disclosure by an applicant when consenting to a Working with Children Check. The consent form used for this purpose does not refer to Prohibition Notice under the Education and Care National Law Act, instead referring to Prohibition Notices under both the Child Protection (Offenders Registration) Act 2000 and the Commission for Children and Young People Act 1998. Self-disclosure of Prohibition Notices under the Education and Care Services National Law Act are neither requested nor facilitated on the consent form.
New process
A new Working with Children Check process was anticipated to be implemented late in 2012 or as early in 2013, but this has still not started. This will include a Working with Children National Criminal History Check, and checking of reported relevant employment proceedings.
For staff already employed, implementation of the new process is expected to be phased-in by sector, starting in 2013 and moving from one sector to the next over several years. There is uncertainty as to when the process will be applicable to Outside School Hours Care employees.
Holders of the new WWCC will be subject to ongoing monitoring. This monitoring will be limited to events which occur within NSW. Offences in other jurisdictions including the Commonwealth will not be monitored, and will only be taken into account at the time of renewal, once every 5 years.
Prohibition Notices issued by the Regulatory Authority under the Education and Care Services National Law Act will not be reported to the CCYP.
A registration or ID card will not be issued under the system. Instead, those applying will be given an ID number, which they will provide to employers and other interested organisations.
Employers register their interest in the WWCC holder using an online system, into which they login and enter the ID number, and be provided with confirmation that the number is valid, who is associate with it, and when it expires. A record of this check must be kept in a register by the organisation.
The act of checking the WWCC connects the employer to the WWCC holder and facilitates later notification if the WWCC is suspended or withdrawn. The WWCC holder cannot remove the interested party. This connection is broken only at renewal, after which the employer must repeat the online checking process.
This is the only process of any Australian jurisdiction, current or proposed, which ensures an employer is notified if a WWCC is withdrawn or cancelled.
Northern Territory
The Working with Children Screening Authority issues an “Ochre Card” to applicants following a Working with Children National Criminal History Check.
Ongoing monitoring is limited to events which occur within the NT. Offences in other jurisdictions including the Commonwealth will not be monitored, and will only be taken into account at the time of renewal, once every 2 years.
Prohibition Notices issued by the Regulatory Authority under the Education and Care Services National Law Act are not reported to the Screening Authority.
Registered employers are notified if a clearance is suspended or cancelled, but there is no notification to the employer if or when they are registered or deregistered; the employer cannot know whether or not they are registered against a particular cleared person, to be certain they will be notified if that clearance is revoked.
Queensland
The Commission for Children and Young People and Child Guardian issues a Blue Card to applicants subject to Working with Children National Criminal History Check.
Ongoing monitoring is limited to events which occur within Qld. Offences in other jurisdictions including the Commonwealth will not be monitored, and will only be taken into account at the time of renewal, once every 3 years.
Registered employers are notified if a clearance is suspended or cancelled, but there is no notification to the employer if or when they are registered or deregistered; without constantly checking by manually sending employee lists to the Authority, the employer cannot know whether or not they are registered against a particular cleared person, to be certain they will be notified if a clearance is revoked.
Prohibition Notices issued by the Regulatory Authority under the Education and Care Services National Law Act are not reported to the Screening Authority.
South Australia
A National Criminal History Check is required by legislation. This is a point-in-time check, and includes no ongoing monitoring.
The efficacy of National Criminal History Check is limited. Enquiries to CrimTrac by an individual (through their jurisdiction’s Police Service or a private provider) are limited to a class of check referred to as “Vulnerable Persons”. This is a lower standard of checking than that referred to as “Working with Children”, which can only be undertaken by recognised Working with Children Unit applying the Working with Children Law of that jurisdiction.
Prohibition Notices issued by the Regulatory Authority under the Education and Care Services National Law Act are not reported to CrimTrac, so they will not be visible on a National Criminal History Check.
The Department for Communities and Social Inclusion has set up a “Screening Unit” to provide “a consistent and confidential approach to the screening and independent assessment of background information”. The use of this “Screening Unit” is not mandatory.
It should be noted that this “Unit” is not a Working with Children Check Unit comparable to those in other jurisdictions. It is not able to conduct a Working with Children Criminal History Check, and is limited to providing a Vulnerable People Check equivalent to that which could be obtained by any individual. It provides no registration or ongoing monitoring, and is not able to access expanded criminal history information under the Exchange of Criminal History Information for People Working with Children (ECHIPWC) information.
Tasmania
Ongoing monitoring is limited to events which occur within Tasmania. Offences in other jurisdictions including the Commonwealth will not be monitored, and will only be taken into account at the time of renewal, once every 3 years.
Criminal history information is used broadly, even where a offences are not clearly specifically to the safety of children but are instead related to the duties involved in position for which the check is sought. For example, driving history is taken into account if the applicant is to be the driver of a school bus. There is no requirement for re-checking or notification to the screening authority within the 3 year expiry period when a person’s position or duties change.
Registered employers are notified if a clearance is suspended or cancelled, but there is no notification to the employer if or when they are registered or deregistered; without repeatedly manually sending employee lists to the Authority, the employer cannot know whether or not they are registered against a particular cleared person, to be certain they will be notified if a clearance is revoked.
Prohibition Notices issued by the Regulatory Authority under the Education and Care Services National Law Act are not reported to the Screening Authority.
In Tasmania, where the Conduct and Investigations Unit of Department of Education conducts Screening, the Exchange of Criminal History Information for People Working with Children (ECHIPWC) is not available, as no Tasmanian bodies are Prescribed for this purpose.
Victoria
The Department of Justice issues a Working with Children Check Card, which includes a photograph of the applicant, subject to a Working with Children National Criminal History Check
Ongoing monitoring is limited to events which occur within Victoria. Offences in other jurisdictions including the Commonwealth will not be monitored, and will only be taken into account at the time of renewal, once every 5 years.
Registered employers are notified if a clearance is suspended or cancelled, but there is no notification to the employer if or when they deregistered. An employer cannot know whether or not they are registered against a particular cleared person, to be certain they will be notified if a clearance is revoked.
Prohibition Notices issued by the Regulatory Authority under the Education and Care Services National Law Act are not reported to the Screening Authority.
Western Australia
The Department of Justice issues a Working with Children Check Card, which includes a photograph of the applicant, subject to a Working with Children National Criminal History Check. This check cannot be
Ongoing monitoring is limited to events which occur within Victoria. Offences in other jurisdictions including the Commonwealth will not be monitored, and will only be taken into account at the time of renewal, once every 3 years.
Registered employers are notified if a clearance is suspended or cancelled, but there is no notification to the employer if or when they registered or deregistered. Without repeatedly manually sending employee lists to the Department for checking, an employer cannot know whether or not they are registered against a particular cleared person, to be certain they will be notified if a clearance is revoked.
Prohibition Notices issued by the Regulatory Authority under the Education and Care Services National Law Act are not reported to the Department.
What can you do?
It is unfortunate that the 'normal' checking processes required in each state and territory are inadequate to protect children, but this is how things currently stand.
There are, however, methods to increase the effectiveness of employment background checking to protect the safety of children and other vulnerable groups.
Applying our Legal and Human Resource backgrounds to this problem, we have structured Recruitment and Human Resource practices for a number of our clients which together form a tight 'safety net', ensuring every possible action is undertaken to maximise the accuracy and ongoing validity of background checks for their employees.
If your organisation is responsible for children, this is something you should not be without.
Contact Privatei.com.au for more information on these services.
Increasingly, concerns are being expressed in various media that Drones, or Unmanned Autonomous Vehicles (UAVs) could be the end of us all. Foreign drones, terrorist drones, and home made drones are some of the next things for us all to fear – apparently. For less than $500, it’s entirely possible to build a self-guided drone which will fly 100km along a predetermined route and crash itself into a selected target. I should add at this point that this is not a service we offer!
What we do offer is services which include the application of Drones we have built here at Privatei.com.au including both fixed-wing and multi-copter surveillance drones with ranges of up to 30km.
In a recent case, we sent one of our drones on a GPS-guided journey to photograph a remote camp site in the South Australian desert. Our drone took off, flew over 10km and then collected video and photographic evidence confirming the nature of the activities going on there and identifying those participating, all without the knowledge of those present, and all entirely lawfully. It then automatically returned to our camp site and landed, following its pre-programmed instructions, without our intervention.
This is not the kind of service which other Private Investigators are able to offer, and is another example of why you should chose Privatei.com.au.
Network security is something big businesses spend big money on. It’s something you hear about on the news, read about in the paper, and it’s something your workplace worries about, but not something you need to worry about as an individual, right?
On Passwords…
What makes a good password? Firstly, it shouldn’t be a word at all. When someone tries to crack a password, one of the standard methods is a ‘dictionary’ attack, which basically fires every word in the dictionary at a system to see which one works. If your password is a word, and it’s in the dictionary, then you’ll be hacked - it’s that simple. A random set of letters, numbers and symbols is the best password, and the longer it is, the better it will work. 200 or more characters arranged bit like like this is ideal; sMkms!Psw2uU3$zaaTAQa^rApnt_). For most people, however, a password like that is unusable. You’d have to write it down, save it in a file, or have an incredible memory to use it on a day-to-day basis. Writing it down or saving it defeats the whole purpose of it being so strong, so you might as well use something you can remember.
A usable alternative is to create a pass-phrase which has multiple words stitched together. Ideally you’d throw in a number or two and some punctuation as well. For example, something like browN.doG-bluE.birD is going to be difficult to crack, but not too hard to remember. The first letter or two of each word of a sentence can also be a good option. For example, “One Flew Over The Cookoo’s Nest” could become onflovthcone. Bare in mind that now that I’ve given these as examples, they will probably show up in the larger password dictionaries available for download and used by hackers all over the world, so don’t use the examples I’ve given, be sure to invent your own.
Save This Password?
How many passwords have you used today? A moderate user might enter a dozen passwords into various websites in an hour or two of internet use.
Accessing secure sites such as online email, paid subscription services, social networking and financial sites, most browsers (eg. Internet Explorer, FireFox, Chrome and Safari) will offer to save your passwords for you. This is certainly more convenient than entering the username and password every time, especially if you have different details for different services and have trouble keeping track of them all. The downside is that anyone who has access to your computer has these passwords in their hands. For the novice intruder, surfing their way to the target site using your machine may be enough to get them access to your information. When your browser is helpfully remembering your username and password for you, logging out is of limited value. For the better organised intruder, 15 seconds on your computer is plenty of time to strip out every username and password that you have conveniently stored and save them for later use.
The Same Password
It’s not unusual for people to come up with a good secure passphrase, and then use it everywhere. You might have it on your email, use it at work to login to your computer, use it for facebook, and use it to encrypt an important document. Let’s say one of these locations is compromised. For example, your work network is hacked and your password is discovered. The issue you now face is that the offender who hacked your work network can now also access every other account you have, and not only do they have a head start, but can probably also do it faster than you can.
It may not be feasible to use a different passphrase everywhere, but there are half-solutions I’d recommend. Using several different passphrases for different purposes can be a workable method. For example, you might have a long, highly secure passphrase you use for internet banking and only in a few other places, then a second-tier passphrase, perhaps shorter and quicker to type, which you use for work purposes, and a third passphrase you use at home, on facebook, and for your personal email. If you need to create an account on a message board or some other site where you’re worried might not be very secure, you could have another password you only use on things that really don’t matter very much. I always recommend you keep home and work separate; don’t use the same password for your email at work as you do on facebook or on your personal email.
Can I borrow your computer for a minute?
Sounds harmless enough - would could he do in a minute? The answer, unfortunately, could be anything and everything. It takes seconds to harvest all your saved passwords, or to install a keylogger or a back-door into your system. The process can appear completely benign; a well crafted piece of software might look exactly like a word processor or an email client, but in the background could be doing 10 different things you don’t want it to!
Your Wireless Network Most people have a wireless (‘WiFi’) network at their home and/or workplace. Wifi offers a simple and cheap way to share internet access, printers and files within a fairly short distance.
There are a couple of open wireless networks near my office, though fewer than there once were. With the rise of the smartphone, and the common-enough feature where the phone helpfully offers to attach itself to any open wireless network it can see, most people have implemented some kind of security on their wifi network. There are a number of ways to ‘secure’ your wifi. The old standard was to use ‘WEP’ encryption, and many people still use this today; in my own street there are over a dozen WEP-secured networks visible to me as I drive past with my phone tasked to ‘listen’ for them. All WEP networks, no matter how tricky or how long their password (or ‘key’) is, are basically open-access to me. WEP encryption is so insecure that I can literally crack it with software running on my phone. DO NOT think you’re secure if you’re running a WEP encrypted network.
Your MAC address is a bit like the licence plate on your car - it is a unique identifier for your wireless adapter; this could be a USB device hanging out the back of your machine, or a tiny chip build into the middle of it. Some people ‘secure’ their wireless network by configuring it to only allow certain MAC addresses to connect. This would be pretty secure, if it weren’t so painfully easy to change your MAC addresswith a few keystrokes. There is even free software for smartphones which can do the same thing in seconds. So if your network is secured through only allowing a certain set of MAC addresses to connect, it’s not really secure at all. WPA, or WPA2 is a much more secure method for securing your network. If you have a home or work wireless connection, get into it and change it to WPA or WPA2 as soon as you can. Ideally, your passphrase should be long and random, and definitely not be single word or name. With a WPA network and a good passphrase, you can feel reasonably secure that your wifi won’t be hacked directly.
Be wary of ‘free wireless’. With less than $100 worth of equipment, unscrupulous characters can create a free wireless hotspot and allow anyone to connect and have internet access, and use this connection to tunnel into your computer to extract information, or simply to ‘listen in’ to your internet traffic, stealing passwords as you use them. Remember that if someone was to access your computer, even for a few seconds, any of your data, including the key to your own wifi network, can be extracted. Location tracking, iPhone, android phone, various software. encrypt iphone backup
Documents with Passwords The pervasive Microsoft Office, including the commonly used Word and Excel, includes a password protection option as a built-in feature. PDF documents can be password protected so that they can only be viewed by those in-the-know, and then placed on websites or intranets, making them available to everyone.
As much as it pains me to shatter your illusions of security, a Microsoft Word (or Excel, etc) password can be cracked in somewhere between 20 seconds and 10 minutes, depending on the method and the computing power applied, and a password-protected PDF is similarly insecure. If you want to secure a document, use a third part encryption tool like truecrypt. As with any tool, your encryption is only as secure as your password, so a good passphrase is still important.
Lost or Stolen Computer
Most people don’t encrypt their hard drive. If you use the built-in encryption that comes with your operating system, then it’s only as safe as your password, which takes less than 5 minutes for a specialized tool to crack. If you’re serious about security, I recommend encrypting your whole hard drive with a tool like truecrypt. It will allow you to encrypt the entire disk, making it inaccessible to all but a professional hacker with a lot of equipment and lot of time on their hands.
Email Security If you’re using an online email provider like GMail, Hotmail or Yahoo, the server itself is pretty well secured. The most likely method for someone to get into your online email is to obtain your password. The easiest way to get someone’s password is to ask them for it. This is the principle used in phishingattacks, where you are usually tricked into entering your username and password in an imitation site. When visiting your email site, you should get to the site directly rather than using a link provided in an email.
Another way your email may be accessed is by catching it during the transmission. For example, a packet sniffer may ‘listen’ to your network traffic and put all the pieces together to reconstruct an email as it passes through the network. One way to safeguard information during transmission is to encrypt it using PGP (or OpenPGP). A free software package like Thunderbird can be combined with a free OpenPGP pluginto give you secure encryption and decryption capabilities, right on your desktop. In this way, you’re safe from losing data by sending email to the wrong address, or leaving email in your inbox and having someone else access it there As long as your computer is secure, you use a secure passphrase, it isn’t compromised by having been used somewhere else where it can be harvested, you’re not tricked by a phishing attack, and your data isn’t captured unencrypted en-route, your email should fairly secure.
The Bottom Line
As one of our services, we often perform Penetration Testingfor clients. We crack their wifi, sniff their packets, phish their staff, decrypt protected documents, and as a part of that, as often as not, we harvest valuable information from staff computers. One of the easiest ways into a secure corporate network is to penetrate the home network of a staff member first, so it should be remembered that when it comes to data security, securing your home is as important as securing your workplace.
This information is provided for Private Investigators such as myself; not for lawyers, police or other law enforcement, so it will not cover warrants or other similar topics.
It’s generally assumed by many people, including many professional investigators, that electronic tracking (often referred to as “GPS Tracking”) is unlawful in Australia. As is so often the case, there is a lot more to it than that, and most people, including many so-called ‘professional’ investigators, don’t understand the law.
Victoria
Under the Surveillance Devices Act (Vic) a tracking device is an electronic device, the primary purpose of which is to determine the geographical location of a person or an object.
You can’t knowingly install, use or maintain a tracking device;
To locate a person without their consent
To locate an object without the consent of the person having (lawful) possession of that object.
Consent to be tracked, or for an object to be tracked, can be either express or implied. Express consent is where you are asked and accept being tracked. You might also sign a contract which includes the ability to track you.
For example, if your contract of employment includes a term which binds you to the acceptable use policies of your organisation’s technology or vehicles, and that policy includes a clause which allows the location of company property to be identified and/or recorded, then you’ve probably consented to your company phone, laptop and car being fitted with a tracking device without your further consent. Similar clauses are often found in modern rental car agreements, allowing them to track the car at will.
A sealed package which has a label explaining that it may be being tracked may satisfy the requirements of implied consent if you accept possession of it.
The Primary Purpose of the device must be to determine location. In Victoria, a mobile phone which also transmits location information is arguably 1) for making calls 2) for sending and receiving email 3) for browsing the web 4) for running other software or playing games … and somewhere down the list, it may also be for determining location. It is therefore arguable that software on a phone which transmits location information does not make that phone a tracking device, and is therefore not regulated.
The illegal act is using the device to locate someone or something. The tense is the present; ie. where someone or something currently is. There are data logging devices available which record their position to a file within the device, which is later downloaded. Under the wording of the Victorian statute, retrieving the location history of a person or object may not constitute an offence, as it is technically not ‘locating’ the object (present tense) in anything close to real-time, and the recording of location information is not expressly forbidden.
Radio tracking collars for dogs, wildlife, etc, also fall into the definition of tracking devices. If you’re tracking your dog, the dog must be in your possession. Exactly who is in possession of wildlife is a bit more tricky, but permits are required for this activity anyway, and it’s not something that comes up much in the life of a PI.
If your dog, car, etc is stolen, the possession of that object is not lawful, so no consent is required to use a tracking device to locate it in Victoria (this is not the case in all states). Commercial services exist which rely on this principle to recover stolen cars.
I include this example for clarity, because it comes up a fair bit in my line of work. If a person asks you to place a tracking device on a vehicle which is in their possession, the ownership of the vehicle is irrelevant, and the installation of the device is lawful. However, the use of that device while another person (eg. a spouse) is in possession of the vehicle is unlawful unless that other person has consented to being tracked. Again I emphasise that who owns the car makes no difference – the consent must be from the person in (lawful) possession of it when the device is being used, or being installed, or being maintained.
Surveillance Devices Act 1999 (Vic)
NSW
The difference between Victorian and NSW law on this subject is subtle but important.
In NSW, a tracking device is one which is capable of being used to determine or monitor the geographical location of a person or an object. Being capable is very different to something the primary purpose of which is to determine location. In NSW, a mobile phone with a built-in GPS is quite capable of determining location, even if that’s not it’s primary purpose, which clearly makes it a tracking device.
The rest of effective law in NSW is the same as in Victoria (see above).
Surveillance Devices Act 2005 (NSW)
Western Australia
The definition of a tracking device is much the same as NSW, and includes any device capable of being used for tracking. In WA, however, they have gone a lot further.
Not only is a person using/installing/maintaining an unlawful tracking device breaking the law, but so is the causing it to be attached/used/installed, etc. In this way, a client asking for their car to be tracked so they can find out where their spouse is going is in breach as much as the PI installing the device.
Another important difference in WA is what I can only assume was an error in drafting where no exception is made for unlawful possession of an object. In all other Australian jurisdictions, consent is required from the person in lawful possession of the object to be tracked. In WA, consent is required from that person even if their possession is unlawful. In WA, therefore, tracking a stolen car to aid in its recovery would be unlawful, with both tracking company and the car owner (who is causing it to be tracked) both in breach of the legislation.
Surveillance Devices Act 1998 (WA)
South Australia
Tracking devices are defined, but nothing in the legislation prohibits or even regulates their private or commercial use.
Queensland
No regulation or prohibition exists.
Tasmania
No regulation or prohibition exists.
Northern Territory
The definition and description of the offence is essentially the same as NSW.
Surveillance Devices Act 2007 (NT)
ACT
The definition and description of the offence is essentially the same as NSW.
If you believe I’ve made an error in the above, or it’s since become out of date, please let me know. =)
This information is provided for Private Investigators such as myself; not for lawyers, police or other law enforcement, so it will not cover warrants, emergency interception or other similar topics. As a professional investigator, these questions come up fairly often – Can I make a call to someone and record it? Can I record incoming calls? Can these calls be used as evidence?
Relevant Legislation
There are two kinds of legislation which you’ll need to understand when it comes to recording phone calls; telecommunications interception legislation (Commonwealth or ‘Federal’ law), and listening devices legislation (State law). You will need to understand both, and due to the latter, the resulting legality of call recording varies between states, even though telecommunications are generally a Commonwealth responsibility.
Telecommunications Interception Legislation
Under Section 7 of the Telecommunications (Interception and Access) Act 1979, you cannot lawfully intercept a communication passing over a telecommunications system. If that looks pretty clear, then you’ve probably not read much legislation in the past.
Breaking it down:
Intercept includes listening to or recording, without the knowledge of the parties
A communication means a conversation or message and can include data, images, sound, video, speech, etc.
Passing over covers the time between when it is sent or transmitted at one end, and when it is accessible to the recipient at the other end.
a) Accessible to the recipient means it has been delivered, or it is under the control of the recipient, or it has been received
A telecommunications system … is one which transmits communications electrically, but not solely by radio. (Ie. a phone network, but not CB radio)
The first option should be apparent from point (1) above – if you have the knowledge of the parties, then this section does not apply to you, so (subject to Listening Devices legislation in your state) you can lawfully record the call. You should note that it doesn’t say anything about consent, but instead uses the word knowledge.
Knowledge vs. Consent - What difference does it make?
Knowledge and Consent are quite different things. In this case, once you tell the other party to the conversation that the call is being recorded, then under this legislation it lawfully can be – even if they say “no” or tell you to stop*. (*Check the Listening Devices legislation in your state, which may, in effect, overrule this.) In the case of interception, you’re not asking them for their permission or consent – you’re just making them aware of the recording – and this is what makes it lawful.
If you’ve ever tried having an open conversation with someone after you just told them it’s being recorded, you’ll realise that it either takes a while for them to forget, and so open up to you, or they don’t forget, they remain guarded, and you never get the whole story.
What if you don’t want them to know the call is being recorded?
From the breakdown of section 7 above, you can see this section only applies to interceptions passing over a telecommunications system. This is a key point, because if a phone conversation is recorded after it is accessible to the recipient, then it’s not passing over a telecommunications system, so it’s not covered by section 7.
Passing over? How does that help?
It’s probably easiest to explain by using some examples of ways you might record a phone conversation:
Using a speakerphone and making a recording in same room. As soon as the sound exits the speaker, it is available to you, and is therefore no longer passing over the telecommunications system, so it’s no longer covered by Section 7.
Using a software device on your own computer, a digital recording of the call is made within your computer. Once the call enters your computer it is under your control, so it is no longer passing over the telecommunications system. Even if you hear the sound slightly after the recording is made, it was under your control from the moment it entered your system, which was obviously before you recorded it.
Using recorder plugged into a phone such that the sound is diverted both to your ear and to the recorder – once the sound was under your control (after all, you had control enough control to divert it to your recorder), it’s no longer passing over a telecommunication system.
Note that these examples only apply when you’re a party to the conversation (ie. when you are the intended recipient of the message which is being recorded) and do not apply if you are recording a call between other people which you’re not a party to.
Why does my insurance company warn me that the call is being recorded?
Codes of practice (eg. Industry Guideline - Participant Monitoring of Voice Communications) guide organisations such as phone and insurance companies to alert people before recording calls. They are even told to allow people to opt-out of call recording (effectively setting up implied consent), while the legislation clearly doesn’t require this.
Listening Devices Laws
Beware: satisfying the federal legislative requirements so that you’re not ‘intercepting’ your own phone call could still leave you illegally recording it in your state.
Once you’re past the telecommunications interception legislation, you’re effectively in the same situation as someone recording a conversation on the street, or in a meeting room – you’re subject to relevant State and Territory based Listening Devices laws.
These laws vary from state to state:
in some states when you’re a party to the conversation you can record it even without telling the other party (eg. Victoria)
in other states, parties to the conversation need to consent to the recording (eg. NSW)
To check out your state and the rules which apply, you’ll need to check out this post: Listening Devices Laws in Australia.
Recording conversations and using Listening Devices is regulated in most states of Australia, and like so many other things the rules are quite different from state to state. In this post I’m going to compare the laws which apply in each state and territory.
I’m aiming this at Private Investigators, not at law enforcement, so Warrants etc will not be covered. This is just a summary of the main points - I’ve provided links to the relevant legislation so you can get the rest of the detail.
Note also that some states have legislation restricting the advertising and sale of listening devices, separately from their use.
Listening Devices are generally defined as anything which is capable of being used to overhear, record, monitor or listen to a conversation (except a hearing aid). Definitions vary slightly between states, with the above definition applying in Victoria. Things to note from this definition:
It doesn’t have to be able to record the sound to be a listening device
It doesn’t have to transmit the sound somewhere else to be a listening device (a normal Dictaphone is a listening device)
A video camera which records sound is usually also a Listening Device
If your intention is to listen to something other than a conversation, your device may still be a listening device when it is capable of being used to listen to a conversation.
Even if your device is a classified as a Listening Device, it may still be lawful to use it in some circumstances
Generally it’s an offence both to use the listening device unlawfully and to publish or use any record of a conversation unlawfully recorded - check the legislation in your state or territory.
Victoria
You cannot install, use or maintain a listening device to overhear, record, monitor or listen to a Private Conversation unless you’re a party to the conversation, or you have consent of all the parties to that conversation.
A Private Conversation is one in circumstances where you may reasonably assume the parties to it don’t want to be overheard by others, unless the parties should reasonably expect that they may be overheard.
Key points and examples:
If you are a party to the conversation, the use of a Listening Device is not restricted.
If you’re not a party to the conversation, you need consent from all the parties - not just one. Consent may be express or implied.
If the conversation is loud enough for you to hear it, in a place where you or other people may hear it, use of a Listening Device is not restricted.
If you’re listening to anything other than a private conversation, use of a Listening Device is not restricted.
Workplaces
Listening devices cannot be used in toilets, washrooms, change rooms or lactation rooms.
Surveillance Devices Act 1999 (Vic)
New South Wales
You cannot install, use, maintain or cause to be used a listening device to overhear, record, monitor or listen to a Private Conversation unless you are a party to the conversation and have the consent of all the principle parties to that conversation, or the consent of one of the principle parties and it’s for the protection of their interests.
Express or implied consent of one of the principle parties makes you a party to the conversation.
A Private Conversation is one in circumstances where you may reasonably assume the parties to it don’t want to be overheard by others, unless the parties should reasonably expect that they may be overheard.
Where you are recording a conversation to protect your own interests, it is for your own use and must not be communicated to other parties.
Key points and examples:
If you are a party to the conversation, and if you have consent from all the principle parties (express or implied), you may use a Listening Device.
If you are a party to the conversation, and you are recording the conversation to protect your own lawful interests (eg. as evidence against later invented allegations of what was said) then you do not need consent from the other parties
If you’re not a party to the private conversation, use of a Listening Device is restricted even if you have consent.
If the conversation is loud enough for you to hear it, in a place where you or other people may hear it, then it’s not a private conversation and use of a Listening Device is not restricted.
If you’re listening to anything other than a private conversation, use of a Listening Device is not restricted.
“Causing” a Listening Device to be used unlawfully (asking someone else to do it) is also an offence
Workplaces
The use of Listening Devices is not subject to any special rules other than the above.
Surveillance Devices Act 2005 (NSW)
Queensland
You cannot use a listening device to overhear, record, monitor or listen to a Private Conversation unless you are a party to that conversation.
Express or implied consent of one of the parties speaking or being spoken to (which I will refer to as the principle parties, even though in Qld this term is not used) makes you a party to the conversation. As a party to the conversation, you may use a Listening Device.
A Private Conversation is one in circumstances where you may reasonably assume either of the principle parties don’t want to be overheard by others, unless either of the principle parties having the conversation should reasonably expect that they may be overheard.
Key points and examples:
If you’re not a party to the private conversation, use of a Listening Device is restricted.
If you have consent to overhear/record/etc the conversation from one of the principle parties, you are a party to that conversation.
If you are a party to the conversation, the use a Listening Device is not restricted.
If the conversation is loud enough for you to hear it, in a place where you or other people may hear it, then it’s not a private conversation and use of a Listening Device is not restricted.
If you’re listening to anything other than a private conversation, use of a Listening Device is not restricted.
Only the use, not the installation or maintenance of a listening device is restricted in Qld
Invasion of Privacy Act 1971 (Qld)
Western Australia
You cannot install, use or maintain (or cause to be installed, used or maintained) a listening device to overhear, record, monitor or listen to a Private Conversation unless you are a party to the conversation and have the consent of all of the principle parties, or the consent of one of the principle parties and the use is for the protection of their interests.
Express or implied consent of one of the principle parties makes you a party to the conversation.
A Private Conversation is one in circumstances where you may reasonably assume any of the parties to it don’t want to be overheard by others, unless the parties should reasonably expect that they may be overheard.
Key points and examples:
If you are not a party to the private conversation, the use of a Listening Device is restricted.
If you are a principle party to the conversation and you’re making a recording for protection of your interests, the use of a Listening Device is not restricted.
If you have consent from a principle party to the conversation and you’re making a recording for protection of that party’s interests, the use of a Listening Device is not restricted.
If you are a party to the conversation, and you have consent from all the principle parties, the use of a Listening Device is not restricted.
If the conversation is loud enough for you to hear it, in a place where you or other people may hear it, the use of a Listening Device is not restricted.
If you’re listening to anything other than a private conversation, use of a Listening Device is not restricted.
Surveillance Devices Act 1998 (WA)
South Australia
You cannot use a listening device to overhear, record, monitor or listen to a Private Conversation unless you have consent of all the parties to that conversation, or you are a party to the conversation and the use of the device is in the course of your duty, in the public interest or for the protection your interests.
In the course of duty may refer to Private Investigators.
A Private Conversation is one in circumstances where you may reasonably assume the parties to it don’t want to be overheard by others. There is no exception in SA for circumstances where the parties should reasonably expect that they may be overheard - these are still private conversations.
Key points and examples:
If you are a party to the conversation, and you have consent from all the parties to that conversation, the use of a Listening Device is not restricted
If you are a party to the conversation, and the use is in the course of your duty, or in the public interest, or to protect your interests, the use of a Listening Device is not restricted
If you’re not a party to the conversation, the use of a Listening Device is restricted.
If the conversation is loud enough for you to hear it, in a place where you or other people may hear it, use of a Listening Device is still restricted.
If you’re listening to anything other than a private conversation, use of a Listening Device is not restricted.
Because private optical surveillance is not specially restricted in SA, these rules also form the restrictions on Optical surveillance where it includes audio.
Listening and Surveillance Devices Act 1972 (SA)
Tasmania
You cannot use (or cause or permit to be used) a listening device to overhear, record, monitor or listen to a Private Conversation unless you are a party* to the conversation and have the consent of all of the principle parties, or the consent of one of the principle parties and the recording is for the protection of their interests.
Express or implied consent of one of the principle parties makes you a party to the conversation.
A Private Conversation is one in circumstances where you may reasonably assume the any of the parties don’t want to be overheard by others. There is no exception for circumstances where the parties should reasonably expect that they may be overheard.
Key points and examples:
If you’re not a party to the private conversation, use of a Listening Device is restricted.
If you have consent to overhear/record/etc the conversation from one of the principle parties, you are a party to that conversation.
If you are a party to the conversation, and you have consent of all the principle parties, the use a Listening Device is not restricted.
If you are a party to the conversation, and you have the consent of one principle party, and it’s for the protection of that party’s interests, the use of a device is not restricted.
If the conversation is loud enough for you to hear it, in a place where you or other people may hear it, then it’s not a private conversation and use of a Listening Device is still restricted.
If you’re listening to anything other than a private conversation, use of a Listening Device is not restricted.
Because private optical surveillance is not specially restricted in Tas, these rules also form the restrictions on Optical surveillance where it includes audio.
Listening Devices Act 1991 (Tas)
Northern Territory
You cannot install, use or maintain a listening device to overhear, record, monitor or listen to a Private Conversation when;
you’re not a party to that conversation; and
you know that the device is being used (installed, maintained etc) without the express or implied consent of each of the parties.
A Private Conversation is one in circumstances where you may reasonably assume the parties to it don’t want to be overheard by others, unless the parties should reasonably expect that they may be overheard.
This legislation has a big loophole - you need to have actual knowledge that you don’t have the consent of the parties in order for the use of the listening device to be unlawful. If a client asks you to install and use a listening device and they tell you that the parties to the conversation have given consent, both your and their actions are lawful - even when they did not actually consent.
Key points and examples:
If you are a party to the conversation, the use of a Listening Device is not restricted.
If you have consent from all the parties to the conversation, or you think you do (ie. you don’t know that you don’t), then the use of a Listening Device is not restricted.
If the conversation is loud enough for you to hear it, in a place where you or other people may hear it, use of a Listening Device is not restricted.
If you’re listening to anything other than a private conversation, use of a Listening Device is not restricted.
Surveillance Devices Act 2007 (NT)
ACT
You cannot use a listening device to overhear, record, monitor or listen to a Private Conversation unless you are a party to the conversation and have the consent of all of the principle parties, or the consent of one of the principle parties and the recording is for the protection of their interests.
Express or implied consent of one of the principle parties makes you a party to the conversation.
A Private Conversation is one in circumstances where you may reasonably assume the any of the parties don’t want to be overheard by others. There is no exception for circumstances where the parties should reasonably expect that they may be overheard.
Key points and examples:
If you’re not a party to the private conversation, use of a Listening Device is restricted.
If you have consent to overhear/record/etc the conversation from one of the principle parties, you are a party to that conversation.
If you are a party to the conversation, and you have consent of all the principle parties, the use a Listening Device is not restricted.
If you are a party to the conversation, and you have the consent of one principle party, and it’s for the protection of that party’s interests, the use of a device is not restricted.
If the conversation is loud enough for you to hear it, in a place where you or other people may hear it, then it’s not a private conversation and use of a Listening Device is still restricted.
If you’re listening to anything other than a private conversation, use of a Listening Device is not restricted.
Because private optical surveillance is not specially restricted in the ACT, these rules also form the restrictions on Optical surveillance where it includes audio.
Listening Devices Act 1992 (ACT)
=======
If you believe any of the above is in error, please let me know!
The use of optical surveillance devices is regulated in most states of Australia, but very differently in some as compared to others.
Optical surveillance devices are generally defined as things which allow you to observe or record an activity. You should note that the “observe” part of that definition is common, and means that binoculars, telescopes, rifle scopes and night vision devices are all optical surveillance devices, even if they cannot record what they see.
I’ll examine each state in turn, and the differences should become apparent.
Victoria
You can’t use an optical surveillance device to view or record a Private Activity. Whether the place is a ‘public place’ or a ‘private place’, or whether public or private property, is not relevant in Victoria.
A Private Activity is any activity which is carried on inside a building in circumstances where you may reasonably assume the parties to it don’t want to be seen by others, unless the parties should reasonably expect that they may be seen.
If you are a party to the activity, surveillance by you is not restricted. No consent by the other parties is required.
If the activity is happening outside, surveillance is not restricted.
If the parties should reasonably expect they may be seen by people other than themselves, surveillance is not restricted.
If the circumstances indicate the parties don’t care if they are seen, surveillance is not restricted.
Workplaces
Surveillance is not permitted in a toilet, wash room, change room, lactation room.
Surveillance Devices Act 1999 (Vic)
New South Wales
You can only install an optical surveillance device within a premises with the express or implied consent of the owner or occupier of the premises.
You can only install optical surveillance in or on a vehicle or other object with the express or implied consent of the owner or occupier of the vehicle or other object.
An optical surveillance device in your possession, on your premises, in your vehicle, or on your object is not restricted.
Where the occupier of the premises or car changes after the device is installed, the device may no longer be used or maintained unless you have the consent of the new occupier.
Workplaces
Surveillance by an employer while the employee is at work (including by the employer hiring an investigator) is first classified as either overt or covert.
Overt surveillance requires 14 days notice in writing by the employer to the employee, unless it’s not at the usual place of employment. Cameras must be visible and signs must notify people that they may be under surveillance.
Covert surveillance while at work requires the approval of a Magistrate.
Devices used for surveillance at the workplace cannot be also used for surveillance outside the workplace (you will need separate cameras).
Surveillance Devices Act 2005 (NSW)
Workplace Surveillance Act 2005
Queensland
You cannot use an optical surveillance device to view or record a person, without their consent, who would reasonably expect their actions to be private, if they are in a private place OR if they are engaging in a private act.
A Private Act is showering, bathing, using a toilet, being undressed, or sexual activity not usually done in public. (No other act is considered a private act.)
A Private Place is somewhere you’d expect someone to engage in private acts. (Eg. A bedroom, bathroom, toilet, change room. Not a car, park, lounge room, kitchen, office, meeting room.)
If a person is in a private place (eg. a bathroom), surveillance is restricted.
If a person is engaged in in a private act (eg. undressing), even if they’re not in a private place, surveillance is restricted.
If a reasonable person wouldn’t expect their actions to be private (eg. they’re in a public park), surveillance is not restricted.
Criminal Code Act 1899 (Qld)
Western Australia
You can’t use an optical surveillance device to view or record a Private Activity. Whether the place is a ‘public place’ or a ‘private place’, or whether public or private property, is not relevant in WA.
A Private Activity is any activity which is carried on in circumstances where you may reasonably assume the parties to it don’t want to be seen by others, unless the parties should reasonably expect that they may be seen.
If you are a party to the activity, express or implied consent of all the other principle parties is required.
If the parties should reasonably expect they may be seen by people other than themselves, surveillance is not restricted.
If the circumstances indicate the parties don’t care if they are seen, surveillance is not restricted.
Surveillance Devices Act 1998 (WA)
South Australia
Optical surveillance is not regulated in South Australia. Beware that if it transmits or records sound in addition to video, your device may be considered a listening device under the relevant legislation.
Listening and Surveillance Devices Act 1972 (SA)
Tasmania
Optical surveillance is not regulated in Tasmania. Beware that if it transmits or records sound in addition to video, your device may be considered a listening device under the relevant legislation.
Listening Devices Act 1991 (Tas)
Northern Territory
You can’t use an optical surveillance device to view or record a Private Activity. Whether the place is a ‘public place’ or a ‘private place’, or whether public or private property, is not relevant in NT.
A Private Activity is any activity which is carried on in circumstances where you may reasonably assume the parties to it don’t want to be seen by others, unless the parties should reasonably expect that they may be seen.
If you are a party to the activity, surveillance is not restricted.
If the parties should reasonably expect they may be seen by people other than themselves, surveillance is not restricted.
If the circumstances indicate the parties don’t care if they are seen, surveillance is not restricted
Surveillance Devices Act 2007 (NT)
ACT
Optical surveillance (other than for law enforcement) is not regulated in the ACT. Beware that if it transmits or records sound in addition to video, your device may be considered a listening device under the relevant legislation.
Listening Devices Act 1992 (ACT)
If you believe I’ve made an error in the above, or it’s since become out of date, please let me know. =)
Private Investigator Licensing and Subcontracting in Australia
Investigators: Advertising, Subcontracting, Employing and Being Employed
In every state and territory other than the ACT, you are required to hold a license in order to be a Private Investigator in Australia. Exactly what activities constitute acting as an investigator vary slightly between states, but generally anyone who is paid to obtain information as to the character or actions of others, or the nature
of the business or occupation others, to search for missing persons or to conduct surveillance, is acting as an investigator.
Broadly, there are two main categories of Private Investigator licenses in Australia - individual licenses, such as an investigator his or herself would hold, and Business or Firm licences. In some states, this business license allows an organisation to employ investigators, while in others it is required before you can advertise investigation services. What these licenses are called also varies.
The laws around employment of investigators vary widely between states. On an investigator license, in some states you can be employed as an investigator but cannot be a subcontractor, while in others you can advertise, subcontract, be employed and even employ others.
Self-employed Investigators
A self-employed investigator would be one who either advertises their own services directly, and/or who subcontracts their services to another organisation, including an investigation agency or insurance company.
This is different to being an employee, where you are on the payroll of an organisation and are employed as an investigator by them. This would not be considered self-employment.
Depending on which state or territory of Australia you are in, you may or may not be able to be self-employed (including subcontracting) simply by being a licensed investigator.
I’m going to look at each state, and whether, on an individual investigator license you are allowed to
Be employed as an investigator
Advertise your services and take clients directly
Subcontract your services
Employ other investigators
Victoria
An individual license holder may be employed as an investigator, may subcontract their services, and may advertise and take on clients directly.
An individual license holder may not employ other investigators.
An individual license holder may be employed as an investigator (by a “Security Firm”, may subcontract their services, and advertise and service clients directly.
An individual license holder may not employ other investigators.
An individual license holder (a “non-agent” license) may be employed as an investigator.
You may not subcontract, advertise and take clients directly, or employ others. To be self-employed you need both a “non-agent” license and an “Agent” license, which is the equivalent to a business license. http://www.police.wa.gov.au/Ourservices … fault.aspx
SA
An individual license holder may work as an employee. (“Agent” licenses are subject to an “employee condition” unless specifically applied for with a “business condition”)
You may not subcontract, advertise and take on clients directly, or employ other investigators.
An individual license holder (called an “Agent” in Tasmania) may be employed as an investigator, may advertise their services and take clients directly, may subcontract their services, and may employee other investigators.
There is no business license for investigators, but a license holder may be a corporation, in which case a Manager must be allocated, and that Manager must meet the criteria for licensing as an Investigator. http://www.consumer.tas.gov.au/security … uiry_agent
NT
An individual license holder may be employed as an investigator, may advertise their services and take clients directly, may subcontract their services, and may employee other investigators.
There is no business license for investigators in the NT, but a license holder may be an individual or a corporation.
In news from the US, a federal appeals court ruled on Tuesday that the FBI and other police agencies now don't need a search warrant to track the locations of mobile phones.
Police can now obtain logs showing where a mobile phone user had travelled without a warrant, because Americans enjoy no "reasonable expectation of privacy" in their cellphones' whereabouts, ie. they should expect that they can be tracked.
In Australia, a warrant is still required by law enforcement agencies to obtain this information, but in some states there is argument that location-tracking software installed on a phone does not make the phone a 'tracking device' under the relevant legislation, and is therefore not unlawful.
Much has been made of a July Facebook “leak” which allegedly disclosed information on over 100 million Facebook users. What some reports have failed to highlight, however, is that the information was already public to begin with.
Security researcher Ron Bowes wrote a Ruby script that downloads information from Facebook’s user directory, a searchable index of public profile pages. The directory does not expose a user’s entire profile and only exposes information that the user has allowed Facebook to make public. This includes names, profile images, and small sampling of the user’s friends. Users can opt out of inclusion in the search, but could potentially still appear on the directory page of a friend who is searchable.
Bowes got the idea of spidering the data so that he could collect statistics about the most common names. Such statistical information isn’t sensitive at all and doesn’t pose any security threat to Facebook users. The data could be useful, however, for building automated account cracking software that is generic and not specific to Facebook. This is because a list of the most common names can be used to assemble a good dictionary of potentially popular usernames for use in brute-force tools that attempt to identify and crack user accounts.
This incident doesn’t represent a breach of Facebook’s security, because the information is made public by design. It highlights, however, the importance of keeping an eye on your social networking privacy settings and understanding how your personal information is used. Many users might not realize that their names and photos are accessible in Facebook’s public user directory.
From http://j.mp/9ttYe1
As soon as I heard about the availability of this data, I promptly downloaded it and added it to my list of sources. On its own it is of limited value, but combined with other sources it can be a valuable investigative tool.
