[ppml] Nasty business with 2003-3

[william<at>elan.net]

USPS codes can only narrow down the search to very small area if the last 
4 digits are includes (i.e. ZIP+4 as you indicate), but last 4 digits are 
not considered to be required part of zip or postal code - it is optional 
and used and added primarily by postal carriers to help in mail routing,
most people omit it when just casually writing the address and I would 
suspect ISPs and customers that care about privacy will omit this last 4 
digits. 

Just zip code itself (5 digits) is usually wide enough (size of small city)
and is not a violation of prvicay - while at the other hand it comes very 
usefull in identifying statistical distribution of assignments, particulary
by automated means (its a lot easier to automate system to obtain and use 
database ofall zip codes then for all cities and villages, large and 
small in the US).

Now this does not mean I agree with the policy - I'm opposed to it as I do 
not believe the kind of privacy requirements that are being asked are 
necessary and their presense causes problems for those investigating 
incidents of abuse and allow for much more abuse directly from ISPs. 
However not passing policy just because of presence of zip code is just 
complete nonsence. If city name is there, the address might as well include
zip and make statistic analysis easier. 

On Thu, 12 Feb 2004 Michael.Dillon at radianz.com wrote:

> There is a policy proposal that, on the face of it, is about improving the 
> privacy of residential customers. It allows an ISP to remove a customer's 
> name and street address from a whois entry. But it says nothing about zip 
> codes. And that is the root of the problem...
> 
> Here are some references that show how a Zip+4 code or a Postal Code can 
> be used to narrow down the physical location of a person to a small enough 
> area to make it easy to stalk someone or burn down their house in the 
> middle of the night.
> 
> USA
> http://www.usps.com/zip4/zipfaq.htm
> http://www.usps.com/history/history/his3_5.htm
> 
> Canada
> http://www.infinitegravity.ca/postalcodeformat.htm
> http://www.canadapost.ca/personal/tools/pg/preparation/mpp6-02-e.asp
> 
> Now the board of trustees did note this as an issue and referred the 
> policy proposal back to the AC. But the AC did not address the privacy 
> issue at all. They simply bounced it back to the BoT with a note that they 
> had "discussed" the issue.
> 
> This is a flawed policy proposal. It claims to improve residential privacy 
> and yet it does not remove all the data which identifies the residential 
> user.
> 
> --Michael Dillon