11 ms·

Kansas couple sues IP mapping firm for turning their life into a “digital hell”

123 points by antr 10y ago

UVB-76 10y ago
Fusion covered this story in depth four months ago: [1] http://fusion.net/story/287592/internet-mapping-glitch-kansas-farm/ http://fusion.net/story/287592/internet-mapping-glitch-kansa... [2] http://fusion.net/story/290772/ip-mapping-maxmind-new-us-default-location/ http://fusion.net/story/290772/ip-mapping-maxmind-new-us-def...
- kjhughes 10y ago
  Yes, and those references are even cited in this article. Title link should be changed to one of these, away from wrapper article.
raverbashing 10y ago
"when MaxMind was first choosing the default point on its digital map for the center of the U.S." This doesn't make any sense. Why does it need to return a place in the middle of the US when the location is unknown? This is what it should return: "location is unknown" and absolutely NOT a pair of geographical coordinates
- dalbin 10y ago
  It's very common to return the centroid of the matched location (city, state or country).
  - ghshephard 10y ago
    It's a terrible approach, as it throws off all sorts of algorithms, and has the effect seen above. If you have to return a Long/Lat, make sure that your "Unknown" is something that nobody would ever confuse with being a valid address - North Pole, South Pole, In the middle of some Ocean, Dessert, or Mountain Range - whichever is least likely to be valid for your particularly application. This makes it much easier for downstream application developers to filter out "Invalid" addresses, and simply eyeballing them on a map makes it clear what the "Invalid" value is.
    - mnw21cam 10y ago
      And of course, nobody has thought of the possibility of including an accuracy radius with the position, so instead of having a point saying "It's here", you have "It's anywhere within this area".
      - TeMPOraL 10y ago
        It's the same with site metrics, or sensors in IoT - your measurement isn't X, it's X +/- Y, with some measurement error distribution.
      - MichaelGG 10y ago
        Anyone that's driving out to a farm without checking other data sources will probably just ignore the accuracy radius.
    - ghaff 10y ago
      It may be a terrible approach in your view but it's essentially universal and is often the best one. If I ask just about any database for the Lat/Long of some city, it's going to return the location of some approximation for the center of the city--which may be a park, a house, or the middle of a river. It's not going to, nor should it, tell me "invalid question" because the city (or really any address within that city) isn't really represented by a single Lat/Long point.
      - ghshephard 10y ago
        I've worked on a number of applications, where we need to make a decision as to what the long/lat will be of "Unknown" - and we always pick something that is guaranteed to throw a flag for downstream consuming applications. Recognizing how your data will be used, and taking some precaution to ensure that it doesn't result in scenarios described in the article is quite often fairly straightforward. (As evidences - The article itself made it clear that when they don't know the actual location, they have changed the long/lat to return a value in the middle of a lake to avoid this sort of problem in the future).
    - 10y ago
  - raverbashing 10y ago
    Not when this has consequences for whomever lives there "Just send the drones to bomb the centroid of city X" doesn't seem so smart Or they should have a giant disclaimer on their results saying that their information is subject to errors and it should not be used for legal/law-enforcement purposes
- andylynchnz 10y ago
  Sometimes it seems there is no better alternative, hence the existence of Null Island (http://www.nullisland.com/ http://www.nullisland.com/).
- Dylan16807 10y ago
  There's always some uncertainty. What do you want it to return when it can tell the location is Springfield, but no further? Will your suggestion actually stop devs from blindly converting into coordinates?
  - mondoshawan 10y ago
    Then it should return both the center of Springfield and an accuracy measurement, like a city boundary. If the act of returning a location is inherently unreliable, then that must be made clear.
    - Dylan16807 10y ago
      That's the current API. Devs ignore the accuracy number.
      - rayiner 10y ago
        Return the three points that define the bounding circle.
        Dylan16807 10y ago
        And then a layer deep in the app that's trying to simplify the world calls a function that calculates the center of that circle. Or averages the points, or returns just the first one, depending on laziness. The mapping world doesn't work in bounding circles, so it gets converted, and it probably gets converted in a way that loses important information.
        esmi 10y ago
        Or just a point and a radius (a.k.a. an accuracy number).
        rayiner 10y ago
        Three points on the edge is better because it forces the developer to actually think about what he's doing.
- yummybear 10y ago
  Maybe because the location isn't simply unknown, it's known to be in the US, but not any indication of where in the US. I'd imagine it's the same as finding the geographic location of a street - often a point on the middle of the street is picked. Not saying that this couldn't have been handled better though.
  - cmdrfred 10y ago
    Make it the White House, Statue of Liberty or Mount Rushmore, not a private persons house.
- cnvogel 10y ago
  It should just return a precision estimate along with the data. Here's what the ancient (from january 1996) standard for "location" records in the DNS specifies, which in my view is very sensible: https://tools.ietf.org/html/rfc1876 https://tools.ietf.org/html/rfc1876 SIZE The diameter of a sphere enclosing the described entity, in centimeters, expressed as a pair of four-bit unsigned integers, each ranging from zero to nine, with the most significant four bits representing the base and the second number representing the power of ten by which to multiply the base. This allows sizes from 0e0 (<1cm) to 9e9 (90,000km) to be expressed. This representation was chosen such that the hexadecimal representation can be read by eye; 0x15 = 1e5. Four-bit values greater than 9 are undefined, as are values with a base of zero and a non-zero exponent. HORIZ PRE The horizontal precision of the data, in centimeters, expressed using the same representation as SIZE. This is the diameter of the horizontal "circle of error", rather than a "plus or minus" value. (This was chosen to match the interpretation of SIZE; to get a "plus or minus" value, divide by 2.) ...so, for a point "somewhere" in the united states, I'd reckon that SIZE=1·10⁰m (1 times 10^0=1m) and HORIZ (and VERT) PRE set to 5·10⁶m (5 times 10^6=5000km) would be a sane choice. (measuring on google maps, the united states seem to measure about 4500km from east- to west-coast)
  - UVB-76 10y ago
    This assumes users of the data don't then report the location, and ignore the precision estimate.
  - grkvlt 10y ago
    > "expressed as a pair of four-bit unsigned integers, each ranging from zero to nine, with the most significant four bits representing the base and the second number representing the power of ten by which to multiply the base. [...] Four-bit values greater than 9 are undefined, as are values with a base of zero and a non-zero exponent." That is the stupidest data format I have ever heard of...
  - grkvlt 10y ago
    The precision is in cm, so HORIZ PRE will be 5e8 or 500000000cm = 5000km and VERT PRE is more likely to be around 1e5 or 100000cm = 1km although I'm not sure about this value - maybe 5km or 5e5 would better account for the height variation in the US?
- s_kilk 10y ago
  It seems this kind of mistake just keeps cropping up again and again, from api results to programming language features. For some reason, people have this real, buring desire to return something that __looks__ useful, even in the most abject failure case.
- btbuildem 10y ago
  If they weren't stuck thinking that the US is the centre of the world, they could've used Null Island as a better default.
  - dpiers 10y ago
    It's the default location for US-based IP addresses. Other countries have their own defaults.
SlashmanX 10y ago
I wonder if that couple could take advantage of this and start a life of cyber crime from now on in a sort of 'boy who cried wolf' situation
- stuffonkeyboard 10y ago
  Yeah exactly. Americans answer to anything, just sue the living hell out of everyone ...
  - FussyZeus 10y ago
    How in the world is this not a valid reason to sue? This private company's faulty data has led to a ton of stressful interaction with all kinds of Law Enforcement who bang on their doors for everything from a stolen iPhone to kidnapping and exploitation. I don't think a settlement is out of the question here, frankly I think $75k is incredibly reasonable.
    - ghaff 10y ago
      Yeah, in fact, the amount seems calculated to elicit a response along the lines of the following: "Wait. Are you sure it's only 3 zeros? Hell, write them a check and be done with it." I'm not sure the company really did anything wrong here. They can't check every area center for not being someone's house or somewhere else problematic. But this case is a particular outlier and the amount requested is petty cash levels--unless they worry about setting a precedent.
      - FussyZeus 10y ago
        > I'm not sure the company really did anything wrong here. I wouldn't say it's "wrong", I don't believe they did it maliciously. Negligence I think is the more appropriate term. Their software when it encounters an IP it doesn't know should say that, not simply return the default position. That would be like if every time you searched for a recipe that some website didn't know, it just gave you the recipe for macaroni and cheese.
joebergeron 10y ago
I get that this is indicative of a bigger issue: default behavior. Choosing to return something as arbitrary as //almost// the center of the US as a default when the location is unknown is pretty universally ridiculous. And in production code expected to have a huge user base and likely a lot of situations where there's no known location? Alright. That said, after reading again and again how ridiculous desicions like these lead to these disproportionate real-world effects, I can't help but laugh at the sheer absurdity of it all. "Digital hell", indeed.
- redcalx 10y ago
  I like how they 'fixed' it by moving the default to the centre of a lake. So you still have the waste of police (or whoever) driving out to some location before they figure out what's going on.
  - alex_hitchins 10y ago
    You would think it better to set it to a police headquarters.
    - redcalx 10y ago
      Yeh good compromise. The ideal solution would be for their API to not report a precise location if it doesn't know one. I guess they have no simple method of stating a region rather than a point, and if they did the consumer of the APIs would probably just use the centre of the region most of the time. I guess they could just not give lat/long when unknown, but still state country, state, county, etc. if they're known.
      - Pxtl 10y ago
        Exactly. If your API returned wkt text for the perimeter of the area, somebody who stores a simple lat-long pair is going to take the centroid and store that.
      - alex_hitchins 10y ago
jessaustin 10y ago
This is kind of like "SWATting", in that we hold anyone and everyone except police responsible for horrible things done by police. One would have expected some sort of procedure to have developed, between the second and four-hundred-thirty-second time the sheriff's department drove out to hassle these people. Apparently one would be expecting too much.
- ptaipale 10y ago
  The problem is not only with police or law enforcement, though. It seems all sorts of individuals and organisations knock the door of the farm because they don't realize they were given a dummy location.
jobigoud 10y ago
> center spot coordinates are 39.8333333,-98.585522. > go with a simpler 38.0000,-97.0000. Wait a minute, that's a weird rounding. Even if it's ill-advised, why did he chose that rather than 40,-99?
dangrossman 10y ago
Why are these law enforcement agencies turning up to -any- latitude/longitude pair from an IP-to-location database? Even when the location is "known" it's still just going to point to the center of a city or region an IP range was allocated to at some time. To map a specific IP to a specific physical location you want to arrest someone at, you'd have to actually go to the ISP (with a subpoena) and ask them what customer that IP was allocated to at a specific time, then look up that customer's address. They know that, right?
- adventured 10y ago
  Most likely reason? Ignorance. Very few people (sub 1% of the earth's population) actually know how an IP works, how an IP is assigned, or what their weak and often non-relationship to physical locations or GPS coordinates are. So when said people use a product that pretends to offer accurate correlation, they don't know any better.
  - ultramancool 10y ago
    But you'd think that if their job was law enforcement of internet crimes, they would have to have at least a very basic understand of this sort of thing. It couldn't be more than a 2 or 3 hour training course to teach people a bit about IP and how to use subpoenas or other law enforcement requests to ISPs to get what they need.
    - jdavis703 10y ago
      I barely know the first thing about how supply chains for illegal drugs work, and I suspect most of the population is like me. Law enforcement however should understand how this works however, otherwise how can they do their job effectively? Likewise if they're investigating computer crimes they should have some basic understanding of how computers work (at least from a practical perspective, they don't need the theory of why computers work).
    - throwaway049 10y ago
      It doesn't look like law enforcement of internet crimes is the main use of this product. More like general law enforcement is just one use among many. That said, I am surprised the local sheriffs don't immediately recognize the address and disregard it, after the first few misunderstandings.
cesarb 10y ago
While most are focusing on the "default location" issue, I can see another issue in this article: Why are people expecting the output of an IP mapping database to be precise enough to send law enforcement to that physical location? From what I could gather from the article, law enforcement (and others) are treating it as if it was as exact as a reverse phone number lookup, while in reality there's no way a global IP mapping database can get much more precise than "around that city" (unless perhaps if the IP address is in a datacenter). That is, even without it being a "default location", sending people to the GPS coordinates obtained from an IP mapping database is nonsense.
- sneak 10y ago
  If cops weren't dumb, they wouldn't be cops.
  - sctb 10y ago
    Please don't comment like this here.
    - sneak 10y ago
      Could you please be more specific? I thought it was well-known by now that police in the United States are either violent, unintelligent thugs or complicit in allowing same to operate. He asked a sincere question, this is a sincere answer. I wish to abide by the rules for commenting here, so I respectfully request what you mean by "like this".
      - ptaipale 10y ago
        >I thought it was well-known by now that police in the United States are either This "well-known" is a poor way to make arguments. Try to substitute "police" with something like "black people" and you might see the problem.
        sneak 10y ago
tzakrajs 10y ago
Were the police using this as an escape to burn time? Why even investigate?
SFJulie 10y ago
Half of the classical problem of any detection system (like GPS, big data, IA): the cost of false positive. The other one being false negative (like an alarm not detecting trepassing). False positive are called artefacts, but people want to believe so much in the infallibility of IT that they use detection system as if the result were error prone. Hence what I call the Oracle syndrome: genuinely scientific person relying on an inaccurate system by nature as an exact system. Then they scale up system an what is anecdotal occurence becomes a serious concern with accumulation. Non conformity with expectations are not handled anymore, they are disdained and measurement systems (hence that can fail) are used as exact systems. It is like death penalty: should we care about the innocent people that will pay a dear price from wrongfully giving too much trust in non perfect systems knowing there is a tendency to make it hard to contest the decision because it would attack the trust we have in the system?
FussyZeus 10y ago
You would think after like fourth or fifth IP search turned up this some bloody farm these guys might start questioning that result. I don't work in LE at all but if I was, and I was getting sent to the same damn house every other week for everything from drug trafficking to sex slavery I'd start raising an eyebrow whenever dispatch tried to have me go there again. I suppose they really can't just not go because of the gravity of most of those calls, but you'd think at least the stolen cellphone/car could wait until the morning.
- manarth 10y ago
  From the original Fusion article[1], it sounds like the local LE know exactly what's going on, but need to intervene with people who aren't local - FBI agents, federal marshals, IRS collectors, ambulances, police officers, etc: > “That poor woman has been harassed for years,” Butler County Sheriff Kelly Herzet told me by phone. Herzet said that his department’s job has become to protect the Taylor house from other law enforcement agencies. [1] http://fusion.net/story/287592/internet-mapping-glitch-kansas-farm/ http://fusion.net/story/287592/internet-mapping-glitch-kansa...
jaynos 10y ago
Similar situation near Atlanta, Georgia (not the center of the US) was discussed earlier this year [1]. Reply All had a good podcast about figuring out the real issue [2] in this case. [1] http://fusion.net/story/214995/find-my-phone-apps-lead-to-wrong-home/ http://fusion.net/story/214995/find-my-phone-apps-lead-to-wr... [2] https://gimletmedia.com/episode/53-in-the-desert/ https://gimletmedia.com/episode/53-in-the-desert/
manarth 10y ago
There are a lot of comments saying that given a fixed area (e.g. "Somewhere in the USA), that it's common to return the centroid of a polygon. There's an interesting note in the Fusion article[1], where it mentions "[the farm] is a two-hour drive from the exact geographical center of the United States". > As any geography nerd knows, the precise center of the United States is in northern Kansas, near the Nebraska border. Technically, the latitudinal and longitudinal coordinates of the center spot are 39°50′N 98°35′W. > In digital maps, that number is an ugly one: 39.8333333,-98.585522 > So MaxMind decided to clean up the measurements and go with a simpler, nearby latitude and longitude: 38.0000,-97.0000. I wonder whether that decision - to choose a location, rather than use the precise centroid of the area - will cost MaxMind the case. [1] http://fusion.net/story/287592/internet-mapping-glitch-kansas-farm/ http://fusion.net/story/287592/internet-mapping-glitch-kansa...
- domfletcher 10y ago
  I also wonder how many Law enforcement officials are turning up at 39.8333333,-98.585522 because they're using a different geoip provider.
  - jlgaddis 10y ago
    Someone close by should go there and stick a sign in the ground reading "This is not the location you're looking for".
    - ptaipale 10y ago
      However, for some people it actually is the location they're looking for. The closest road junction to that place actually has some signs: https://goo.gl/maps/1vyM9Ss7o8t https://goo.gl/maps/1vyM9Ss7o8t I wonder how many geocaches are hidden in that patch? (Hmm... had to register to geocaching.com to find out; apparently just one at the exact spot and then a couple nearby.)
- Raphmedia 10y ago
  Why don't they return 00.000000,00.000000 or the GPS position for the North Pole instead? Would be a lot less confusing that the data was void.
DanBC 10y ago
Here are some comments from a while ago: https://news.ycombinator.com/item?id=11466849 https://news.ycombinator.com/item?id=11466849
saalweachter 10y ago
So I think there's an important lesson in here for software engineers. How do you design your API so that it is as difficult as possible for your clients to misinterpret? The "always return a center & accuracy" API is very simple and elegant, but with the benefit of hindsight, you can assume that a significant fraction of your users are just going to ignore that accuracy number and treat the center as precise. As was pointed out elsewhere in this thread, the default point isn't the only problem -- any town, city, or state will generate similar problems. One option would be to return a richer result type: (COUNTRY, "United States") (CITY, "Portland, OR, USA") (REGION, latlng-a, latlng-b) (POINT, latlng, accuracy) Now it becomes more difficult for a client to pretend most of those are precise points. The best API is sometimes not the one that is easiest to use but most difficult to misuse.
- whack 10y ago
  I appreciate the notion that "explicit is better than implicit", so as to minimize assumptions and miscommunications. But that said, if the service is providing details for a region using the center-and-radius approach, that sounds perfectly reasonable. It explicitly states what is being returned, and the fact that it isn't a single point. For responsible clients who are using the API correctly, this data-response is the easiest to parse and make sense of. I would hate to see a world where services are responsible for generating and clients are responsible for parsing data in an overly convoluted and cumbersome format, just to minimize the risk of irresponsible clients misinterpreting it.
- Frondo 10y ago
  I'd return a rectangle instead of a circle. One point would be the upper-left corner, the other the lower right corner. To get to the "center" you'd have to do arithmetic on the coordinates, which would encourage thinking.
sscotth 10y ago
Reminds me of this: https://aaasen.github.io/github_globe/ https://aaasen.github.io/github_globe/ Previous Discussion: https://news.ycombinator.com/item?id=6470600 https://news.ycombinator.com/item?id=6470600 http://imgur.com/cGuetKg http://imgur.com/cGuetKg
SteveCoast 10y ago
Trying to make this better with open GeoIP data over at http://browserlocation.co/ http://browserlocation.co/
walrus01 10y ago
There are two completely separate fucked up things here: a) Maxmind shouldn't be returning a location like this for "Anywhere in the USA". It should either be 0,0 for unknown or something totally obvious like the Washington Monument in WA DC. b) The fact that clueless/ignorant law enforcement is blithely trusting and USING this spurious data. Someday a person is going to get SWATTed and shot dead over this sort of thing.
jtrtoo 10y ago
Contrarian perspective: These GeoIP firms should start offering businesses in a given area the ability to sponsor the area and become the default location.

123 points by antr 10y ago

Fusion covered this story in depth four months ago: [1] http://fusion.net/story/287592/internet-mapping-glitch-kansas-farm/ http://fusion.net/story/287592/internet-mapping-glitch-kansa... [2] http://fusion.net/story/290772/ip-mapping-maxmind-new-us-default-location/ http://fusion.net/story/290772/ip-mapping-maxmind-new-us-def...

kjhughes 10y ago
Yes, and those references are even cited in this article. Title link should be changed to one of these, away from wrapper article.

raverbashing 10y ago

"when MaxMind was first choosing the default point on its digital map for the center of the U.S." This doesn't make any sense. Why does it need to return a place in the middle of the US when the location is unknown? This is what it should return: "location is unknown" and absolutely NOT a pair of geographical coordinates

dalbin 10y ago
It's very common to return the centroid of the matched location (city, state or country).
- ghshephard 10y ago
  It's a terrible approach, as it throws off all sorts of algorithms, and has the effect seen above. If you have to return a Long/Lat, make sure that your "Unknown" is something that nobody would ever confuse with being a valid address - North Pole, South Pole, In the middle of some Ocean, Dessert, or Mountain Range - whichever is least likely to be valid for your particularly application. This makes it much easier for downstream application developers to filter out "Invalid" addresses, and simply eyeballing them on a map makes it clear what the "Invalid" value is.
  - mnw21cam 10y ago
    And of course, nobody has thought of the possibility of including an accuracy radius with the position, so instead of having a point saying "It's here", you have "It's anywhere within this area".
    - TeMPOraL 10y ago
      It's the same with site metrics, or sensors in IoT - your measurement isn't X, it's X +/- Y, with some measurement error distribution.
    - MichaelGG 10y ago
      Anyone that's driving out to a farm without checking other data sources will probably just ignore the accuracy radius.
  - ghaff 10y ago
    It may be a terrible approach in your view but it's essentially universal and is often the best one. If I ask just about any database for the Lat/Long of some city, it's going to return the location of some approximation for the center of the city--which may be a park, a house, or the middle of a river. It's not going to, nor should it, tell me "invalid question" because the city (or really any address within that city) isn't really represented by a single Lat/Long point.
    - ghshephard 10y ago
      I've worked on a number of applications, where we need to make a decision as to what the long/lat will be of "Unknown" - and we always pick something that is guaranteed to throw a flag for downstream consuming applications. Recognizing how your data will be used, and taking some precaution to ensure that it doesn't result in scenarios described in the article is quite often fairly straightforward. (As evidences - The article itself made it clear that when they don't know the actual location, they have changed the long/lat to return a value in the middle of a lake to avoid this sort of problem in the future).
  - 10y ago
- raverbashing 10y ago
  Not when this has consequences for whomever lives there "Just send the drones to bomb the centroid of city X" doesn't seem so smart Or they should have a giant disclaimer on their results saying that their information is subject to errors and it should not be used for legal/law-enforcement purposes
andylynchnz 10y ago
Sometimes it seems there is no better alternative, hence the existence of Null Island (http://www.nullisland.com/ http://www.nullisland.com/).
Dylan16807 10y ago
There's always some uncertainty. What do you want it to return when it can tell the location is Springfield, but no further? Will your suggestion actually stop devs from blindly converting into coordinates?
- mondoshawan 10y ago
  Then it should return both the center of Springfield and an accuracy measurement, like a city boundary. If the act of returning a location is inherently unreliable, then that must be made clear.
  - Dylan16807 10y ago
    That's the current API. Devs ignore the accuracy number.
    - rayiner 10y ago
      Return the three points that define the bounding circle.
      - Dylan16807 10y ago
        And then a layer deep in the app that's trying to simplify the world calls a function that calculates the center of that circle. Or averages the points, or returns just the first one, depending on laziness. The mapping world doesn't work in bounding circles, so it gets converted, and it probably gets converted in a way that loses important information.
      - esmi 10y ago
        Or just a point and a radius (a.k.a. an accuracy number).
        rayiner 10y ago
        Three points on the edge is better because it forces the developer to actually think about what he's doing.
yummybear 10y ago
Maybe because the location isn't simply unknown, it's known to be in the US, but not any indication of where in the US. I'd imagine it's the same as finding the geographic location of a street - often a point on the middle of the street is picked. Not saying that this couldn't have been handled better though.
- cmdrfred 10y ago
  Make it the White House, Statue of Liberty or Mount Rushmore, not a private persons house.
cnvogel 10y ago
It should just return a precision estimate along with the data. Here's what the ancient (from january 1996) standard for "location" records in the DNS specifies, which in my view is very sensible: https://tools.ietf.org/html/rfc1876 https://tools.ietf.org/html/rfc1876 SIZE The diameter of a sphere enclosing the described entity, in centimeters, expressed as a pair of four-bit unsigned integers, each ranging from zero to nine, with the most significant four bits representing the base and the second number representing the power of ten by which to multiply the base. This allows sizes from 0e0 (<1cm) to 9e9 (90,000km) to be expressed. This representation was chosen such that the hexadecimal representation can be read by eye; 0x15 = 1e5. Four-bit values greater than 9 are undefined, as are values with a base of zero and a non-zero exponent. HORIZ PRE The horizontal precision of the data, in centimeters, expressed using the same representation as SIZE. This is the diameter of the horizontal "circle of error", rather than a "plus or minus" value. (This was chosen to match the interpretation of SIZE; to get a "plus or minus" value, divide by 2.) ...so, for a point "somewhere" in the united states, I'd reckon that SIZE=1·10⁰m (1 times 10^0=1m) and HORIZ (and VERT) PRE set to 5·10⁶m (5 times 10^6=5000km) would be a sane choice. (measuring on google maps, the united states seem to measure about 4500km from east- to west-coast)
- UVB-76 10y ago
  This assumes users of the data don't then report the location, and ignore the precision estimate.
- grkvlt 10y ago
  > "expressed as a pair of four-bit unsigned integers, each ranging from zero to nine, with the most significant four bits representing the base and the second number representing the power of ten by which to multiply the base. [...] Four-bit values greater than 9 are undefined, as are values with a base of zero and a non-zero exponent." That is the stupidest data format I have ever heard of...
- grkvlt 10y ago
  The precision is in cm, so HORIZ PRE will be 5e8 or 500000000cm = 5000km and VERT PRE is more likely to be around 1e5 or 100000cm = 1km although I'm not sure about this value - maybe 5km or 5e5 would better account for the height variation in the US?
s_kilk 10y ago
It seems this kind of mistake just keeps cropping up again and again, from api results to programming language features. For some reason, people have this real, buring desire to return something that __looks__ useful, even in the most abject failure case.
btbuildem 10y ago
If they weren't stuck thinking that the US is the centre of the world, they could've used Null Island as a better default.
- dpiers 10y ago
  It's the default location for US-based IP addresses. Other countries have their own defaults.

SlashmanX 10y ago

I wonder if that couple could take advantage of this and start a life of cyber crime from now on in a sort of 'boy who cried wolf' situation

stuffonkeyboard 10y ago
Yeah exactly. Americans answer to anything, just sue the living hell out of everyone ...
- FussyZeus 10y ago
  How in the world is this not a valid reason to sue? This private company's faulty data has led to a ton of stressful interaction with all kinds of Law Enforcement who bang on their doors for everything from a stolen iPhone to kidnapping and exploitation. I don't think a settlement is out of the question here, frankly I think $75k is incredibly reasonable.
  - ghaff 10y ago
    Yeah, in fact, the amount seems calculated to elicit a response along the lines of the following: "Wait. Are you sure it's only 3 zeros? Hell, write them a check and be done with it." I'm not sure the company really did anything wrong here. They can't check every area center for not being someone's house or somewhere else problematic. But this case is a particular outlier and the amount requested is petty cash levels--unless they worry about setting a precedent.
    - FussyZeus 10y ago
      > I'm not sure the company really did anything wrong here. I wouldn't say it's "wrong", I don't believe they did it maliciously. Negligence I think is the more appropriate term. Their software when it encounters an IP it doesn't know should say that, not simply return the default position. That would be like if every time you searched for a recipe that some website didn't know, it just gave you the recipe for macaroni and cheese.

joebergeron 10y ago

I get that this is indicative of a bigger issue: default behavior. Choosing to return something as arbitrary as //almost// the center of the US as a default when the location is unknown is pretty universally ridiculous. And in production code expected to have a huge user base and likely a lot of situations where there's no known location? Alright. That said, after reading again and again how ridiculous desicions like these lead to these disproportionate real-world effects, I can't help but laugh at the sheer absurdity of it all. "Digital hell", indeed.

redcalx 10y ago
I like how they 'fixed' it by moving the default to the centre of a lake. So you still have the waste of police (or whoever) driving out to some location before they figure out what's going on.
- alex_hitchins 10y ago
  You would think it better to set it to a police headquarters.
  - redcalx 10y ago
    Yeh good compromise. The ideal solution would be for their API to not report a precise location if it doesn't know one. I guess they have no simple method of stating a region rather than a point, and if they did the consumer of the APIs would probably just use the centre of the region most of the time. I guess they could just not give lat/long when unknown, but still state country, state, county, etc. if they're known.
    - Pxtl 10y ago
      Exactly. If your API returned wkt text for the perimeter of the area, somebody who stores a simple lat-long pair is going to take the centroid and store that.
    - alex_hitchins 10y ago

jessaustin 10y ago

This is kind of like "SWATting", in that we hold anyone and everyone except police responsible for horrible things done by police. One would have expected some sort of procedure to have developed, between the second and four-hundred-thirty-second time the sheriff's department drove out to hassle these people. Apparently one would be expecting too much.

ptaipale 10y ago
The problem is not only with police or law enforcement, though. It seems all sorts of individuals and organisations knock the door of the farm because they don't realize they were given a dummy location.

jobigoud 10y ago

> center spot coordinates are 39.8333333,-98.585522. > go with a simpler 38.0000,-97.0000. Wait a minute, that's a weird rounding. Even if it's ill-advised, why did he chose that rather than 40,-99?

dangrossman 10y ago

Why are these law enforcement agencies turning up to -any- latitude/longitude pair from an IP-to-location database? Even when the location is "known" it's still just going to point to the center of a city or region an IP range was allocated to at some time. To map a specific IP to a specific physical location you want to arrest someone at, you'd have to actually go to the ISP (with a subpoena) and ask them what customer that IP was allocated to at a specific time, then look up that customer's address. They know that, right?

adventured 10y ago
Most likely reason? Ignorance. Very few people (sub 1% of the earth's population) actually know how an IP works, how an IP is assigned, or what their weak and often non-relationship to physical locations or GPS coordinates are. So when said people use a product that pretends to offer accurate correlation, they don't know any better.
- ultramancool 10y ago
  But you'd think that if their job was law enforcement of internet crimes, they would have to have at least a very basic understand of this sort of thing. It couldn't be more than a 2 or 3 hour training course to teach people a bit about IP and how to use subpoenas or other law enforcement requests to ISPs to get what they need.
  - jdavis703 10y ago
    I barely know the first thing about how supply chains for illegal drugs work, and I suspect most of the population is like me. Law enforcement however should understand how this works however, otherwise how can they do their job effectively? Likewise if they're investigating computer crimes they should have some basic understanding of how computers work (at least from a practical perspective, they don't need the theory of why computers work).
  - throwaway049 10y ago
    It doesn't look like law enforcement of internet crimes is the main use of this product. More like general law enforcement is just one use among many. That said, I am surprised the local sheriffs don't immediately recognize the address and disregard it, after the first few misunderstandings.

cesarb 10y ago

While most are focusing on the "default location" issue, I can see another issue in this article: Why are people expecting the output of an IP mapping database to be precise enough to send law enforcement to that physical location? From what I could gather from the article, law enforcement (and others) are treating it as if it was as exact as a reverse phone number lookup, while in reality there's no way a global IP mapping database can get much more precise than "around that city" (unless perhaps if the IP address is in a datacenter). That is, even without it being a "default location", sending people to the GPS coordinates obtained from an IP mapping database is nonsense.

sneak 10y ago
If cops weren't dumb, they wouldn't be cops.
- sctb 10y ago
  Please don't comment like this here.
  - sneak 10y ago
    Could you please be more specific? I thought it was well-known by now that police in the United States are either violent, unintelligent thugs or complicit in allowing same to operate. He asked a sincere question, this is a sincere answer. I wish to abide by the rules for commenting here, so I respectfully request what you mean by "like this".
    - ptaipale 10y ago
      >I thought it was well-known by now that police in the United States are either This "well-known" is a poor way to make arguments. Try to substitute "police" with something like "black people" and you might see the problem.
      - sneak 10y ago

tzakrajs 10y ago

Were the police using this as an escape to burn time? Why even investigate?

SFJulie 10y ago

Half of the classical problem of any detection system (like GPS, big data, IA): the cost of false positive. The other one being false negative (like an alarm not detecting trepassing). False positive are called artefacts, but people want to believe so much in the infallibility of IT that they use detection system as if the result were error prone. Hence what I call the Oracle syndrome: genuinely scientific person relying on an inaccurate system by nature as an exact system. Then they scale up system an what is anecdotal occurence becomes a serious concern with accumulation. Non conformity with expectations are not handled anymore, they are disdained and measurement systems (hence that can fail) are used as exact systems. It is like death penalty: should we care about the innocent people that will pay a dear price from wrongfully giving too much trust in non perfect systems knowing there is a tendency to make it hard to contest the decision because it would attack the trust we have in the system?

FussyZeus 10y ago

You would think after like fourth or fifth IP search turned up this some bloody farm these guys might start questioning that result. I don't work in LE at all but if I was, and I was getting sent to the same damn house every other week for everything from drug trafficking to sex slavery I'd start raising an eyebrow whenever dispatch tried to have me go there again. I suppose they really can't just not go because of the gravity of most of those calls, but you'd think at least the stolen cellphone/car could wait until the morning.

manarth 10y ago
From the original Fusion article[1], it sounds like the local LE know exactly what's going on, but need to intervene with people who aren't local - FBI agents, federal marshals, IRS collectors, ambulances, police officers, etc: > “That poor woman has been harassed for years,” Butler County Sheriff Kelly Herzet told me by phone. Herzet said that his department’s job has become to protect the Taylor house from other law enforcement agencies. [1] http://fusion.net/story/287592/internet-mapping-glitch-kansas-farm/ http://fusion.net/story/287592/internet-mapping-glitch-kansa...

jaynos 10y ago

Similar situation near Atlanta, Georgia (not the center of the US) was discussed earlier this year [1]. Reply All had a good podcast about figuring out the real issue [2] in this case. [1] http://fusion.net/story/214995/find-my-phone-apps-lead-to-wrong-home/ http://fusion.net/story/214995/find-my-phone-apps-lead-to-wr... [2] https://gimletmedia.com/episode/53-in-the-desert/ https://gimletmedia.com/episode/53-in-the-desert/

manarth 10y ago

There are a lot of comments saying that given a fixed area (e.g. "Somewhere in the USA), that it's common to return the centroid of a polygon. There's an interesting note in the Fusion article[1], where it mentions "[the farm] is a two-hour drive from the exact geographical center of the United States". > As any geography nerd knows, the precise center of the United States is in northern Kansas, near the Nebraska border. Technically, the latitudinal and longitudinal coordinates of the center spot are 39°50′N 98°35′W. > In digital maps, that number is an ugly one: 39.8333333,-98.585522 > So MaxMind decided to clean up the measurements and go with a simpler, nearby latitude and longitude: 38.0000,-97.0000. I wonder whether that decision - to choose a location, rather than use the precise centroid of the area - will cost MaxMind the case. [1] http://fusion.net/story/287592/internet-mapping-glitch-kansas-farm/ http://fusion.net/story/287592/internet-mapping-glitch-kansa...

domfletcher 10y ago
I also wonder how many Law enforcement officials are turning up at 39.8333333,-98.585522 because they're using a different geoip provider.
- jlgaddis 10y ago
  Someone close by should go there and stick a sign in the ground reading "This is not the location you're looking for".
  - ptaipale 10y ago
    However, for some people it actually is the location they're looking for. The closest road junction to that place actually has some signs: https://goo.gl/maps/1vyM9Ss7o8t https://goo.gl/maps/1vyM9Ss7o8t I wonder how many geocaches are hidden in that patch? (Hmm... had to register to geocaching.com to find out; apparently just one at the exact spot and then a couple nearby.)
Raphmedia 10y ago
Why don't they return 00.000000,00.000000 or the GPS position for the North Pole instead? Would be a lot less confusing that the data was void.

DanBC 10y ago

Here are some comments from a while ago: https://news.ycombinator.com/item?id=11466849 https://news.ycombinator.com/item?id=11466849

saalweachter 10y ago

So I think there's an important lesson in here for software engineers. How do you design your API so that it is as difficult as possible for your clients to misinterpret? The "always return a center & accuracy" API is very simple and elegant, but with the benefit of hindsight, you can assume that a significant fraction of your users are just going to ignore that accuracy number and treat the center as precise. As was pointed out elsewhere in this thread, the default point isn't the only problem -- any town, city, or state will generate similar problems. One option would be to return a richer result type: (COUNTRY, "United States") (CITY, "Portland, OR, USA") (REGION, latlng-a, latlng-b) (POINT, latlng, accuracy) Now it becomes more difficult for a client to pretend most of those are precise points. The best API is sometimes not the one that is easiest to use but most difficult to misuse.

whack 10y ago
I appreciate the notion that "explicit is better than implicit", so as to minimize assumptions and miscommunications. But that said, if the service is providing details for a region using the center-and-radius approach, that sounds perfectly reasonable. It explicitly states what is being returned, and the fact that it isn't a single point. For responsible clients who are using the API correctly, this data-response is the easiest to parse and make sense of. I would hate to see a world where services are responsible for generating and clients are responsible for parsing data in an overly convoluted and cumbersome format, just to minimize the risk of irresponsible clients misinterpreting it.
Frondo 10y ago
I'd return a rectangle instead of a circle. One point would be the upper-left corner, the other the lower right corner. To get to the "center" you'd have to do arithmetic on the coordinates, which would encourage thinking.

sscotth 10y ago

Reminds me of this: https://aaasen.github.io/github_globe/ https://aaasen.github.io/github_globe/ Previous Discussion: https://news.ycombinator.com/item?id=6470600 https://news.ycombinator.com/item?id=6470600 http://imgur.com/cGuetKg http://imgur.com/cGuetKg

SteveCoast 10y ago

Trying to make this better with open GeoIP data over at http://browserlocation.co/ http://browserlocation.co/

walrus01 10y ago

There are two completely separate fucked up things here: a) Maxmind shouldn't be returning a location like this for "Anywhere in the USA". It should either be 0,0 for unknown or something totally obvious like the Washington Monument in WA DC. b) The fact that clueless/ignorant law enforcement is blithely trusting and USING this spurious data. Someday a person is going to get SWATTed and shot dead over this sort of thing.

jtrtoo 10y ago

Contrarian perspective: These GeoIP firms should start offering businesses in a given area the ability to sponsor the area and become the default location.