eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
It was the Simpsons who first broke the story: Major League Baseball was spying on Barts thoughts with a special satellite that he shot down, only to have Mark McGwire come and hush the whole thing up. But subscribers to Major League Baseballs MLB.TV service may be surprised to hear what the big leagues are learning about them, or at least trying to learn: their physical location.
MLB.TV is a series of subscription services that allow users to view almost any Major League Baseball game live, broadcast over the Internet using Windows Media or Real streaming video technology. Viewers see one of the teams home broadcasts with that teams announcers. Afterwards, games are available in an archive and in a condensed format that has only the action in the game. (Im a subscriber and its generally a very cool service that I would recommend, especially if you live out of the TV coverage area for your team.)
Because TV networks buy the rights to these broadcasts in their viewing areas, MLB.TV enforces local blackout rules. In other words, if you live in the New York area you may not be able to watch a Mets game on MLB.TV because Channel 11 (WPIX) may be broadcasting it. MLB.TVs blackout rules provide specific lists of ZIP codes for each team in which computer users will be blacked out.
Wait a minute! How do they know what ZIP code your computer is in? Have they installed a secret homing beacon in the computer? Have they scanned your files for your home address? Are they reading your brain waves, as they did to Bart?
Perhaps the location they use is just based on the one on your credit card or some other records you produce? No, MLB.TV customer service insists its based on the IP address of the computer you are using. Since there is no “ZIP Code” field in the IP packet format, I was curious about what technique they are using to determine physical location based on network address.
Next Page: Accuracys an issue.
Page 2
It turns out what they are doing is much less accurate and threatening than they indicate. I asked Major League Baseball Advanced Media how they went about determining ZIP codes of users based on IP addresses. They didnt respond after several days, but Im pretty sure I know what they are doing. It appears to be a technique similar to that used by Malaysian software company Hexa Software Development Center (HSDC).
Click the link just above and on the home page in a yellow box and you will see an attempt to tell you where you are. Sometimes its frighteningly accurate, sometimes bewilderingly wrong. But it all makes sense. The product is a database of IP addresses and physical locations of ISP POPs, network concentrators and similar facilities that are IP-addressable. Im guessing that they also have a database of IP client address ranges associated with those ISP facilities because it works too quickly for them to be performing a tracert.
The ISPs dont report to Major League Baseball (at least not yet), and the addresses of such devices and their assigned client ranges can easily change as ISPs add and remove points of presence and perform other maintenance. For this reason HSDC must update the product and the database periodically.
The end result is that the location you see on the HSDC Web page, and likely the location that MLB.TV thinks youre viewing from, is actually the location of your ISPs point of presence. Im in north Jersey, but HSDC says Im in New York City (where my ISPs DSL POP is). When Im connected through a VPN service I use HSDC thinks Im in Portland, Maine!
There are even better stories. A friend of mine in northeast Pennsylvania has a satellite connection for Internet access, and HSDC puts him in Virginia (where his satellite companys network operations center is). And of course if youre behind a corporate gateway of some kind, your location will likely be that of the gateway, so if youre at a branch office your location could be that of headquarters. To be fair, Ive also seen examples where people in Anytown, USA, were told they were in Anytown, USA.
As a final test I tried to view a Yankees-Mets game (6/27/2004) on both my ISP and VPN connections. As my theory predicted, I was blacked out on my ISP connection but let through on my VPN connection.
I think its fair to say that MLB.TV is overselling their capabilities. They have a specific list of ZIP codes for each teams blackout, and they simply cant know whether youre in one of those ZIP codes. On top of the inexactness Ive described so far, consider the possibility that you live in a border area for the blackout. How can the location detection know if youre on the right side of the line?
Imagine what would be possible with accurate physical location techniques. At the very least a certain amount of surreptitious marketing could happen, but so what? Is it really a scary thing at all? Maybe not. At the worst they would know your ZIP code or some level similarly granular. If theyre a commerce site, they already know it. If someone can tell me why I should be scared of this please do so.
Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983.
Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:
More from Larry Seltzer