Michael Arrington comes to the defense Sunday of one of his Crunchfund portfolio companies, Path, arguing that the New York Times‘s Nick Bilton is just piling on after Path “showed its belly” by apologizing for secretly copying and storing its users’ contacts in a company database.

But Arrington’s just wrong – it’s not piling on – and just because Path apologized, that doesn’t mean that it or the industry should get a free pass.

Bilton’s main point is spot-on: Path CEO Dave Morin, a Facebook veteran, should have known and did know that secretly copying users’ contact information was wrong and that his behavior is becoming all too familiar in the Valley.

Set aside Morin’s tenure at Facebook. Simply look at this exchange with Gawker in regards to the same issue with the first version of Path – where Morin states “Path does not retain or store any of your information in any way.”

Knowing that was an issue, Morin went on to launch a future version that secretly plundered the contacts from users’ iPhones. Path didn’t  even bother to use hashes to protect the data and stored it on their own servers in plain text. Path isn’t even using encryption to keep contact data on their servers, instead saying it’s protected with an “industry standard firewall,” which is just laughable to anyone who has followed the exploits of Anonymous over the last year.

But Arrington says it’s time to let up on Path because the company apologized and deleted the data. After all, Morin thought he could solve the problem by saying Path was being “proactive” in building a consent mechanism into upcoming versions of the app.

Bullshit. It’s time to stop letting start-ups and big companies (I’m looking at you, Google and Facebook) pretend they don’t understand basic fair information practices and then just “apologize” later after backing slightly off a huge insult to user privacy.

For start-ups that don’t know – the rules are really simple and basically boil down to “Don’t be a secretive asshole.”

Fair Information Practices have been around since the early 1970s. There are five of them. Notice, Choice, Access, Security and Redress. Basically that means you tell people why and how you collect data and what you do with it. You give them a choice about whether to provide it and a way for them to see/correct/delete. You use real security (e.g. in Path’s case, if they didn’t use MD5 hashes instead of collecting the plain-text, then the database should be encrypted and access to the database should be extremely limited inside Path). The company should also say what it plans to do if it violates that agreement.

This stuff is extremely basic, and Bilton is right to continue criticizing Path after it showed its belly. Path (and other apps) made the decision to blatantly abuse their users’ trust, *exactly* because it thinks it can be like Facebook and just ride out the storm after an apology, if they got caught.

As Bilton writes:

<blockquote>It seems the management philosophy of “ask for forgiveness, not permission” is becoming the “industry best practice.” And based on the response to Mr. Morin, tech executives are even lauded for it.</blockquote>

Instead of lecturing Bilton on being mean to Path, Arrington ought to be wondering why the hell he invested in a company that has absolutely no respect for its users, their privacy and basic standards of decency. Instead, he penned a column about how the net can become a “mob,” and what a shame it is that you can’t reason with a mob.

While I’ve always appreciated Arrington’s passion for start-ups, I find it very disturbing that he considers the users who raised their voices after being betrayed by Path on its march to the big bucks a “mob”. They aren’t a mob – and while they may not get every detail right, the people we call “users” are usually smart enough to know when they are being screwed.

And they got screwed, intentionally by a company you invested in, Michael. That should worry you more than a column from Nick Bilton.

Facebook recently got caught hiring a PR firm to push stories about a Google social feature that Facebook thought was too deep an invasion of privacy.

The ploy backfired on the social networking giant and its PR firm.

Catch a flavor of the story with these posts (Getting Caught, Getting Caught Covering Up) from my fellow Epicenter writer, Sam Gustin.

Parents often think their teenage children will post anything to the web, and that it’s fair game for them to comment on their kid’s status messages. But teens have a different idea of what kind of public space Facebook actually is, according to new research from Microsoft.

In restaurants, people often dine close enough to overhear every conversation, but they pretend to not listen in. This act of ‘giving someone space’ is a gift of privacy. Goffman calls it ‘civil inattention.’

Civil inattention is a social norm, driven by an ideal of respect. Staring at someone or openly listening in on their conversations is a violation of social norms which makes people uneasy because it is experienced as an invasion of privacy. For teens, the same holds true online; they expect people – most notably, those who hold power over them – to respect their space.

That’s the one of the conclusions from Microsoft researchers Danah Boyd and Alice Marwick in their new paper (.pdf).

I love Creative Commons-licensed content. At Wired.com, we rely heavily on photographers who license their photos on Flickr for re-use with credit.

And now, I’m launching a data-mining project at the site world-facts.net using 10 years of posts from BoingBoing.net, which they license under a liberal Creative Commons license, allowing re-publishing for non-commercial ventures.

Thank you Boing Boing for trusting the community and trusting the world enough to know that you’ll still be successful even if you don’t control every use of your work. And I’d also like to thank Rob Beschizza, a BoingBoinger not pictured above, who helped me figure out how to make the import work out.

Photo: BoingBoing gathered in a rare group appearance at the ETech conference in 2008 Credit: Vissago

A few weeks ago, I wrote a story for Wired.com about how two performance artists had scraped 1 million Facebook profiles to create a fake dating site — the story took off quickly, as did the cease-and-desist letters from Facebook’s lawyers.

The site — Lovely-Faces.com — is shut down now, but the duo explains their view of their success (.pdf). You can also see me speaking with Fox News 11 about the project (note the great backdrop from the Wired.com conference room).

Facebook Profiles Scraped for Fake Dating Site: MyFoxLA.com

This week’s Saturday Night Live had three versions of Mark Zuckerberg kicking the show off. Not knee-slapping, but actually quite funny.

In December, Twitter received a court order from the Justice Department seeking details on users connected to Wikileaks, an order that came with a gag order forbidding the site from revealing the existence of the order.

Twitter fought that gag order and won the right to tell the account holders about the order, giving them the opportunity to quash it in court.

In today’s post for Wired.com, I propose that this become the standard for the tech industry:

Twitter briefly carried the torch for its users during that crucial period when, because of the gag order, its users couldn’t carry it themselves. The company’s action in asking for the gag order to be overturned sets a new precedent that we can only hope that other companies begin to follow.

The decision would be laudatory in almost any situation, and may even be unprecendented by a massive tech firm. The only other gag orders that I can think of that were challenged in court was one served on the Internet Archive, one on a small library, and another served on Nicholas Merrill, the president of the small NYC-based ISP Calyx Internet Access, who spent years resisting a National Security Letter order seeking information about one of his clients.

Even more remarkable, Twitter’s move comes as a litany of companies, including PayPal, Mastercard, VISA, and Bank of America, follow the political winds away from the First Amendment, banning donations to WikiLeaks. And Amazon.com voluntarily threw the site off its hosting platform, even though there’s nothing illegal in publishing classified documents. [...]

Twitter deserves recognition for its principled upholding of the spirit of the First Amendment. It’s a shame that PayPal, Amazon, Visa, Mastercard, Bank of America and the U.S. government all failed — and continue to to fail — at their own versions of that test.

Late last year, Susannah Baldwin asked me to be on her parenting show on KWMR radio to talk about Facebook. Thankfully, Susannah asked really good questions and kept away from fear mongering to talk clearly about parents, kids, and Facebook.

If you are a parent living in the digital age, it’s worth your time to give her show a listen, and you can find some online at her website, baldwinonair.com.

In Glenn Greenwald’s recent response to Wired’s explanation of why it is not releasing more of the Bradley Manning/Adrian Lamo chat logs in the Wikileaks controversy, he defends himself by unethically cherry-picking and truncating a quote from an e-mail from me, that he says, erroneously, that I explicitly put on the record.

He writes that I said, “I’ve long been a fan of your work and I’ll continue to be.”

That’s true, but there was no period after the word “be”.

Instead, the full sentence was, “I’ve long been a fan of your work and I’ll continue to be, but I think you screwed this up, Glenn, and it’s pretty disappointing that you seemed to let your infatuation with Wikileaks color your analysis.”

Any journalism 101 student will tell you Greenwald’s quote is a clear violation of journalistic ethics.

So in the spirit of openness, here’s the e-mail I sent Greenwald on June 18, 2010, trying to be diplomatic about what I thought was clearly a hatchet job on a very good journalist.

Glenn -

Suffice it to say I’m disappointed by your article, which I find to be warped by your allegiance to Wikileaks, which gets nothing but glowing accolades from you, despite ample evidence that Assange and Wikileaks aren’t acting in good faith.

You make much of Wired not revealing all of the transcripts. [...]

Moreover, you go to some lengths to portray Poulsen as some sort of consigliere to Lamos, when what Poulsen has done over the years is simply develop a source.

He wasn’t the only security journalist to have the same relationship. In fact, it was Brian Krebs, formerly of the Washington Post, who got the inside scoop from Lamo about his foray into the NY Times database. Lamos gave him the screenshots, and Krebs then contacted the Times and wrote up the story. http://www.infosecnews.org/hypermail/0202/5510.html (ED. NOTE 12/30/2010: This timeline is not correct – Krebs was on the story simultaneously and had a long relationship with Lamos, but Poulsen published first.)

What exactly is a journalist supposed to do otherwise, when a hacker comes with proof they’ve broken into a company? You make it sound nefarious (strange and complicated, in your words). In fact, it’s exactly what happened with Gawker’s Ryan Tate and the recent vulnerability in AT&T’s iPad interface. Frankly, your characterization of it is slimy.

Intriguingly, you leave out all the attacks from Assange on Poulsen (calling him a manipulator and a snitch). Meanwhile, you ignore all of Assange’s weird attacks on the press any time he doesn’t like a story. Did you read the Mother Jones piece that exposed how Wikileaks fakes its advisory board? Or see Assange’s reaction?

Did you notice that Assange loved the New Yorker profile, until other outlets jumped on the fact that Assange admits that Wikileaks was bootstrapped by spying on the Tor network? Then Assange attacked those outlets and the New Yorker, calling them liars but not saying that Wikileaks didn’t spy on the Tor network. (Which Assange himself all but admitted when he was trying to get support for Wikileaks’ start, writing in an e-mail list that Wikileaks was getting info by spying on Chinese hacker, “when they pull, we pull”) http://cryptome.org/wikileaks/wikileaks-leak2.htm

Then when Assange wanted to drum up donations to Wikileaks after the Manning disclosure, he sent out a blast e-mail pointing to the anonymous Boing Boing comment suggesting that Poulsen was working on behalf of the feds.

And now, thanks to your article, you have commenters saying the same thing.

You mention that you are a fan of Threat Level, but you NEVER mention throughout the story anything of the kind of coverage that Poulsen has done in the last decade. You don’t mention that Threat Level published the NSA docs while they were under court seal. You don’t mention that Poulsen exposed, via a successful FOIA suit, that DHS covered up that its computers got infected with a virus. You don’t mention that he revealed to the world that the FBI has a secret browser vulnerablity. You don’t mention at all the type and kind of coverage that Poulsen is responsible for for over a decade.

That credibility would go a long way to dispelling the slander campaign Wikileaks and its rabid followers are waging against him, for having the audacity to write a story that a leaker had been arrested.

Instead you added to it with insinuations that Kevin is somehow in cahoots with Lamo.

For instance, you make it sound creepy that Poulsen wrote a long profile about Lamo. Huh. Read the story again. Basically, it goes like this. A convicted hacker, now gone legit, calls the police to report a stolen laptop. When the police arrive, instead of focussing on the crime, they 5150 the victim. Lamo contacts Poulsen while in the ward. Poulsen gets the intake sheet, takes his time to develop the story (which could have been made very over the top, COPS THROW EXHACKER CRIME VICTIM IN MENTAL WARD). Lamo gets a diagnosis and new medicine, which oddly helps. Lamo learns something (maybe) about himself. Story is now very interesting, but complicated. Poulsen takes the time to write it well. Then you come along and say it looks fishy.

I appreciate that you spent the time to interview people in the case. But it’s unclear to me where Poulsen crossed any journalistic line. People aren’t *friends* with Lamo. They just end up talking and IMing with him. He used to contact me out of the blue on IM, offering odd leads.

Lamo is clearly starved for attention. Often he gets it by coming up with odd leads. Here he decided to become a rat, and then went on to brag about it. I’m not sure how Poulsen gets tagged or slimed as an informant for reporting it, but Wikileaks managed to do that — and sadly, you helped out.

I’ve long been a fan of your work and I’ll continue to be, but I think you screwed this up, Glenn, and it’s pretty disappointing that you seemed to let your infatuation with Wikileaks color your analysis.

Sincerely,

Ryan Singel

(A snippet of this e-mail going into minutiae has been clipped for readability.)

Additionally, here’s a full, not truncated quote from Glenn Greenwald in that same e-mail thread, about Kevin Poulsen:

“The very idea that I’ve “successfully impugned the reputation of a fucking good journalist” about whom I said: (a) he violated no ethical principle, (b) there was no evidence to suggest he did anything wrong, (c) is someone whose work I’ve admired, and (d) there’s no evidence to question his integrity or good faith — is, to put it mildly, fucking insane.”

So there it is — Glenn Greenwald believes Poulsen has not violated any ethical principle, is someone he admires, and says there’s no evidence he’s done anything wrong or any reason to question his integrity.

Greenwald and I have also had e-mail conversations over the last few days, where I vociferously objected to his slimy, Yuletide Glenn-Beck-esque insinuations about Poulsen. And at no point, did he bring up the e-mail from June, which according to my records of the conversation, includes nothing about whether it is on or off the record.

Stating that I explicitly wanted it on the record is just wrong, and cutting off sentences halfway through to distort the meaning of a sentence wouldn’t pass muster at even a neighborhood weekly. It’s the tactic of FOX News.

It’s especially galling coming from Greenwald, who holds himself up as the the arbiter and scold of the world’s journalistic practices.