Gross Breach Of Privacy at Stuffiminto.com

I’d just like to say that Sully is quite the piece of work. For those of you who don’t know who Sully is, he is the owner and forum administrator at cruising.stuffiminto.com, and owner of the company stuffiminto.com.

Just because he didn’t like my self chosen title, he changed it and my signature to my e-mail address without telling me. That pretty much tells you what kind of person he is. BTW, posting someone’s e-mail address on the internet without their permission is a gross violation of their privacy, and if done by a forum administrator, a gross abuse of their position. It is also a gross breach of trust between a forum user and the forum.

This is particularly ironic considering that stuffiminto.com claims to be:

Stuffiminto.com’s immediate plans are to develop and launch the stuffiminto.com website, building a very unique and rapidly growing online community, replacing a lot of redundancy in online communities / social networking sites on the web today.

And the terms of service for the cruising.stuffiminto.com forum clearly states:

Note that entering your email address will not leave you open to ’spam’, as you can choose to hide it from other board users. You’ll probably be able to allow other registered users to contact you via email, but the system won’t display your email address to them unless you give permission.

I’d also point out that most of my posts there were on-topic, and I tried to be a good contributor to his site, inspite of Sully’s refusal to answer a simple question about why SanderO was given such preferential treatment. BTW, he never did say why SanderO wasn’t banned for his spamming the forums.

I’d also point out that as of this posting, they have not deleted my posts per my wishes, even though they were the ones who violated the terms of service first, not me.

To give you an idea of the maturity level of their forum administration, this is the message I received when I tried to view the forum after being banned.

Apparently, their forum owner/administrator doesn’t feel bound by the terms of service agreement to respect the privacy of members….so join at your own risk.

Update:

Sean Sullivan sent me an e-mail. I have confirmed that this email address is legitimate, via a google search, as one having been used by Sullivan in the past. My google search for it turned up a few things, including this comment about his selling a Hirsch 45′ sailboat, which he mentioned owning on Stuffiminto.com. The chances of two Sean Sullivans owning a Hirsch 45′ sailboat in the New York/New Jersey area at the same time is rather miniscule.

Here is the raw source of the e-mail, with my e-mail info redacted.

Delivered-To: ****************
Received: by 10.100.231.14 with SMTP id d14cs21878anh;
Tue, 3 Mar 2009 06:50:29 -0800 (PST)
Received: by 10.142.191.5 with SMTP id o5mr3657409wff.53.1236091828176;
Tue, 03 Mar 2009 06:50:28 -0800 (PST)
Return-Path:
Received: from web111501.mail.gq1.yahoo.com  web111501.mail.gq1.yahoo.com [67.195.15.133])
by ********** with SMTP id 32si14705963wfc.49.2009.03.03.06.50.27;
Tue, 03 Mar 2009 06:50:28 -0800 (PST)
Received-SPF: pass (*********: domain of  seansullivanjobs at yahoo.com designates 67.195.15.133 as permitted sender) client-ip=67.195.15.133;
Authentication-Results: ********; spf=pass (*********: domain of  seansullivanjobs at yahoo.com designates 67.195.15.133 as permitted sender) smtp.mail=seansullivanjobs@yahoo.com; dkim=neutral (body hash did not verify) header.i=@yahoo.com
Received: (qmail 32117 invoked by uid 60001); 3 Mar 2009 14:50:27 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1236091827; bh=A+AeuvdwG8hEpRMTEl93BgpWFVl3zcV5pDa/gy8OlUE=; h=Message-ID:X-YMail-OSG:Received:X-Mailerate:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=sBGtx92+T/xM1Qxrzl2×1ucYdG8KphETPlTloGr0ioNa9o0VBnbORb4peM0jw9YRv8gS5C5p5gIJAhxb54gTXJPw1xtXYyA3xVQMa4LuwsVra3qA669iqd3pCmyvRhJTyj1VVh+9RDf0aMQMxKH54yKbxEq66D+p3aonD9VFDtw=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:X-YMail-OSG:Received:X-Mailerate:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=Cn5q0rZfhvPcrYvYr3LbC90EdxjafWDTw4i6OYOsikEIlP6VlqBC+t3/SrWWYuov+/9wj/Jjyru8ryKchb3HcujOEYAVYpK0DC58Tg+J/3TjqiTeLq/mI4Vw0umyWUDWaOhYSIPCb062pTYbVIz1nbhQjavoCcS/1qRDakXKMEc=;
Message-ID: <516702.31268.qm@web111501.mail.gq1.yahoo.com>
X-YMail-OSG: P0YVmLcVM1kRFIuZ_FS3×0m5BPJNaJwFj4oJdVg07ssW1SEpqGKJt9UgXeJrpt0qAdvN52imMpHjxzwxr1ZM0qbr8uOuuvykw3vVHrbfraALqwAw.fwvwtNxL5.G_3v1Qc9wPhmHggByfHpoFLyXo.zJkVAYTfag.754HdaeO4iObYuO8zMWZVYFAvZHYw–
Received: from [68.246.169.146] by web111501.mail.gq1.yahoo.com via HTTP; Tue, 03 Mar 2009 06:50:27 PST
X-Mailer: YahooMailWebService/0.7.289.1
Date: Tue, 3 Mar 2009 06:50:27 -0800 (PST)
From: Sean Sullivan
Reply-To:  seansullivanjobs at yahoo.com
Subject: I’ll come for a visit
To: ************
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii

Sailingdog-

I have some free time coming up and I’m thinking of coming down to visit you in MA. I’m only a few hours away.

You talk about lawyers and things like that. I talk about baseball bats.

Want to cause trouble on the internet? You’re going to have to deal with it in real life.

I found out where you are. It may not be as pleasant as your visit with Guiletta, but we’ll “catch up”

Your pal- Sully

The e-mail appears to be from a Yahoo.com webmail address, but was sent from an originating IP address, 68.246.169.146, that appears to be from a Sprint AirCard, since its whois entry comes up with:

OrgName: Sprint PCS
OrgID: SPCS
Address: 12502 Sunrise Valley Dr
City: Reston
StateProv: VA
PostalCode: 20191
Country: US

NetRange: 68.240.0.0 - 68.247.255.255
CIDR: 68.240.0.0/13
NetName: SPRINT-WIRELESS
NetHandle: NET-68-240-0-0-1
Parent: NET-68-0-0-0-0
NetType: Direct Allocation
NameServer: OSSCDNS01.SPCSDNS.NET
NameServer: OSSCDNS02.SPCSDNS.NET
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate: 2003-07-17
Updated: 2004-03-25

However, most of the e-mail header information could be spoofed by someone computer literate enough. I doubt that Sean Sullivan is, due to his troubles with coding and such on his forum. I am also willing to bet that the IP address the e-mail originated from can be traced back to an Aircard or cellular phone owned by Sean Sullivan.

While I can not confirm that this e-mail was actually sent by Sean Sullivan, but feel that it is genuine, as the e-mail address has been confirmed as one used by him for over two years. Activity on this e-mail address traces back to at least 2006. I do not consider his IP address or e-mail address private information, since there was no agreement of privacy between him and I regarding this e-mail, and I can not even be sure it is him. His previous language and behavior has shown him to be psychologically unstable IMHO, and this would be something he would stoop to doing.

I’ve also been contacted by several people who confirm that they have used the  seansullivanjobs at yahoo.com e-mail address to contact Sean Sullivan in the past, and that the Sean Sullivan is one and the same as the owner/administrator over at Stuffiminto.com.

There is a major difference between my posting this e-mail and his posting of my e-mail address, in that I did not have a privacy agreement, he and stuffiminto.com did, which he violated.

Summary:

Basically, we’ve got an e-mail with a definite threat posted using an e-mail address that has been historically linked to Sean Sullivan, as the number of people who own a Hirsch 45′ sailboat that are named Sean Sullivan is probably fairly low.

These are the actions of a thug, a psycho, or an immature brat. He had a contractual obligation to protect my e-mail address, and intentionally revealed it—and he’s mad at me??? I’m not the one who was being a schizoid site admin.

What is really worrying is that his new website jobs.stuffiminto.com is likely to have even more sensitive information on it, since it is for job hunters and companies. It would be a prime way for someone with no ethics to gather enough information to steal a lot of identities—becoming basically a phishing site. Given Sean Sullivan’s immaturity and lack of anything resembling ethics, I worry about what would happen to anyone who signs up on that site.

I also take threats of physical violence very seriously. I have reported this to both the local police, the FBI, and several other organizations. If he’s adult enough to make threats like that, he’s adult enough to take the consequences.

Update #2:

I received an e-mail from  sitekeeper at stuffiminto.com. Here it is in it’s entirety, with my e-mail information redacted out.

Delivered-To: ################
Received: by 10.100.111.2 with SMTP id j2cs121376anc;
Wed, 1 Apr 2009 08:54:31 -0700 (PDT)
Received: by 10.151.144.4 with SMTP id w4mr7708214ybn.87.1238601270576;
Wed, 01 Apr 2009 08:54:30 -0700 (PDT)
Return-Path: <sitekeeper@stuffiminto.com>
Received: from smtpoutwbe11.prod.mesa1.secureserver.net  smtpoutwbe11.prod.mesa1.secureserver.net [208.109.78.27])
by mx.######## with SMTP id 28si696506gxk.48.2009.04.01.08.54.29;
Wed, 01 Apr 2009 08:54:30 -0700 (PDT)
Received-SPF: neutral (########: 208.109.78.27 is neither permitted nor denied by best guess record for domain of  sitekeeper at stuffiminto.com) client-ip=208.109.78.27;
Authentication-Results: ########## spf=neutral (########: 208.109.78.27 is neither permitted nor denied by best guess record for domain of  sitekeeper at stuffiminto.com) smtp.mail=sitekeeper@stuffiminto.com
Received: (qmail 9647 invoked from network); 1 Apr 2009 15:54:28 -0000
Received: from unknown (HELO p3plgemwbe01-07.prod.phx3.secureserver.n…) (72.167.218.7)
by smtpoutwbe11.prod.mesa1.secureserver.net with SMTP; 1 Apr 2009 15:54:28 -0000
Received: (qmail 16872 invoked by uid 99); 1 Apr 2009 15:54:28 -0000
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=”utf-8″
X-Originating-IP: 72.60.197.51
User-Agent: Web-Based Email 4.14.22
Message-Id: <20090401085428.9e37b748c95175af52be6e35f0d3a29c.924c28d4f8.wbe@email01.secureserver.net>
From:  sitekeeper at stuffiminto.com
To: ################
Subject: We should talk…
Date: Wed, 01 Apr 2009 08:54:28 -0700
Mime-Version: 1.0

Hi,

This is Sean. In case you haven’t noticed, we share a lot in common. We are both multihull enthusiasts, we’re both from New England, we both have (obviously) had careers in computers, etc…

We both have Macs and we both know our way around the internet. During our little online argument, I found you to be a formidable contender. :)

I’m writing to you today because I think if we met under different circumstances, we’d probably actually have been friends.

Even though we got caught up in that big “board war” fiasco, some of your posts were very logical and well thought out, even when the heat was on during the “board war.”

I tried my best to keep my cool, but eventually, having 25 or so people gang up on you at once can frustrate you to no end. I was recently made aware that you have been putting up as much personal information about me as you can in various places on the internet.

I was wondering if we could drop the hate?

Would you mind stopping that or taking some of that down?

We can all find as much personal information as we want on people. I know exactly who you are, where you live and what boat you have, your boat’s name, as well as where it’s kept. (I was getting a little nervous at the level of your campaign against me, so I looked you up.) This information was all easily found on the internet, as I’m sure you had no trouble finding mine.

What I propose is an olive branch… I haven’t thought about you guys since the board war. Today, someone tried joining my site from Sailnet and I went to see who they were before allowing them. I landed on a thread that continues to go on and on about my private board.

I’m not sure why some of the posters over at your site are continually going on about me and my private board, but I would like to move on.

If you won’t accept an olive branch (which I truly wish you might), at least let’s try to get a truce going.

Life is too short to be all stressed out all the time over this kind of stuff.

What do you think? Let me know…

Sean

Now, I’d point out that a user called JoeChang was publishing my home address, IP address and ISP information as well as my boat’s name and homeport on several forums in defense of Sean Sullivan. The IP address that JoeChang was coming in from was a WWW web-anonymizing proxy server in Germany. I don’t know who it was that was posting as JoeChang, but I do know that it was likely someone who had access to Stuffiminto.com’s IP address log files—either Sean Sullivan or someone he knows—since that is the source of my ISP and IP address information. It is not accessible by normal users.

Here is my reply to Sean Sullivan:

Sean—

I never posted your home address or boat name, or home port. I did go public with what I considered a valid threat. I received an e-mail from  seansullivanjobs at yahoo.com which threatened me with physical harm. All of the information I posted was to validate that the e-mail in question was indeed from you, as was pretty conclusively proven. I don’t take kindly to being threatened and I don’t like being bullied. Do you deny sending the threat?

You violated my privacy on Stuffiminto.com. While I understand why you felt that you needed to change my title, you had NO RIGHT to post my e-mail address, especially when your own site’s terms of privacy state that it would not be revealed without my permission. I get really pissed off when a web forum or website breaks a privacy agreement. Do you deny doing this?

Also, whoever “Joe Chang” was, posted my personal information, home address, boat name, homeport, etc through a web proxy, which I find to be both unethical and cowardly. I could have easily used a web proxy to continue attacking stuffiminto, but I don’t stoop to such tactics.

You instigated it. I tried to be a good member of Stuffiminto, but your very uneven-handed treatment of the sailnetters, many of whom I am friends with, and refusal to even censure SanderO, who was the primary provocateur IMHO, sat pretty badly with me. Your refusal to respond to that issue directly was childish at best. As a matter of fact, last I checked you still has 171 of my posts on stuffiminto.com

I’d also point out that I was not part of a coordinated attack on your forum. The attacks were not coordinated, but in response to your actions. When you piss off a whole lot of people at one time, you can usually expect that all of them will respond.

If you want a truce, you have to have the integrity to step up and accept responsibility for what you did—and make it right. You crossed the line, both by sending a threat to me and by violating the agreement between the users of Stuffiminto.com and the administration there. You accused a group of us of coordinating an attack on your forum, which was clearly not the case. You accused an innocent person of child pornography. If you can’t see that, then we have NOTHING to discuss.

Full disclosure of who “Joe Chang” is, since he was using IP address information that was likely from the IP logs at Stuffiminto.com and public apologies for making threats to me, and to Denby for accusing him of posting child pornography—on Sailnet, Stuffiminto.com and anything-sailing is the minimum I’d expect before “calling a truce”. I would also require that you delete the posts and private information of all the people who you either banned or have requested their posts and information be deleted. These terms are non-negotiable.

I would also point out that I am currently waiting to hear back from my local Police Department regarding your threat, as well as the IC3 group and am more than happy to go forward with my complaints against you and your company with them. Again, I’d point out that I don’t take kindly to being threatened and I don’t like being bullied—and the e-mail was clearly both a threat and an attempt at bullying me. If you want to discuss this and proceed like reasonable adults, that is one thing… otherwise, I will proceed as I feel necessary, based upon your response to this e-mail.

The choice is yours.

Regards,

Dan

And Sean’s reply to me, without the header information this time:

Dan,

I wrote to you because we aren’t all that different. Your responses are a lot like ones I might make if the same things happened to me, so I am going to try this again.

The thing is, everyone made a lot of mistakes here. Admittedly, I probably made more because of the relentless attacks I was under.

I am writing to you to broker a truce, if not a friendship.

I am writing to attempt a “let bygones be bygones” resolution.

I still have plenty of complaints about the past, as you obviously do as well. I could answer many of your points, because several are perceived, rather than factual. I wouldn’t mind discussing them with you, once we settle the anger. I’m not angry at you. Rather, I was hoping to resolve our differences.

I understand where you’re coming from. You’re angry because I went too far by replacing your user title on our site that read something like “Sully is an asshole” with your email address. This was wrong and I apologize for that action. I was unable to take the “high road” due to the volume of all the attacks.

But listen… I do understand your approach to the problem. It’s the same approach I may have taken. :)

And that brings me to the point. I’m offering an olive branch to you.

Do you care to accept one?

PS: Although the mob has lynched me for falsely accusing Denby of putting up “child porn” (a term I never used), he did post a picture of a naked child with a remote control that I quickly removed from the site after one of my users alerted me to it. You can’t be too careful these days with that stuff because they laws tend to be wildly inerpreted. I should have never mentioned his username, but did because, again, during that attack, I was under emotional stress. Same reason I put up your email address. I should not have done either. But… people kept asking me who it was. I caved. I’m just a regular guy, no different than you. I didn’t accuse Denby of putting up any “child porn.” Just a picture of a naked kid I had to remove.

Sean

Sean Sullivan admits that he breached my privacy and violated the terms of his own website’s privacy agreement. However, he does not address JoeChang, nor does he admit to sending the e-mailed threat, even though it is pretty clearly from him. He also doesn’t agree to my non-negotiable terms. So I replied once again, to clarify the issue for him.

Sean—

I’m not angry with you either. I don’t bullshit. I call it as I see it. If you’re man enough to publicly admit what you did wrong and apologize for it, I’ll say so in my posts. If not, then they’ll stand as they are. As I said previously, the ball is in your court. Speaking of olive branches and truces is fine, but not really proper when you were the one that committed the majority of the wrongs.

If you really understand why I’ve responded the way I have, you’ll understand that I’m not going to accept anything less than a public apology.

You had a legal and ethical responsibility to protect my e-mail address. If you and/or your company suffer for your actions, that isn’t my fault. You brought it upon yourself. Either you have the courage, honesty, and integrity to stand up to what you did and admit it, or you don’t. If you don’t, you’re basically the thug and bully that I called you in my internet posts regarding your threat. If you do, then we may have some common ground for proceeding.

You still haven’t addressed how Joe Chang got my IP Address. I find it somewhat suspicious that he came to Sailnet and SBO forums to attack me using information that I seriously doubt he could have gotten without access to the IP logs at one of the forums I use. I know he didn’t get it from SBO or Sailnet, which leaves stuffiminto.com. If it wasn’t you, I seriously doubt that you don’t know who did it.

You also, still haven’t addressed the reason behind why I changed my user title. Why did SanderO get such preferential treatment, when he was clearly the provocateur in most of the ex-CF vs. Sailnet altercation. A bit more honesty and integrity on your part when all of this started, and it probably never would have escalated to the point it did. SanderO should have been taken to task for provoking a large new group of users. His actions were reprehensible. If you can’t understand why I say that, there is little hope of coming to any sort of truce.

Unless you admit responsibility for breaching my privacy, threatening me, and defaming Denby, and apologize publicly, explain Joe Chang and your actions, and delete the posts and information for those users that have requested it or have been banned on cruising.stuffiminto.com, we have absolutely nothing to discuss. These are my terms—they are non-negotiable. If you’re willing to meet them, then we can proceed from there.

Regards,

Dan

This last e-mail was sent on 1 April 2009 at 1622. He has not replied, so I am taking that to mean that he is unwilling to meet the conditions I set forth as non-negotiable. He does not have the integrity or courage to admit what he has done and openly apologize for it. He is too gutless to come clean about his thuggish behavior and very likely his posing as JoeChang in an attempt to intimidate me.

Please note, that the top sections of this post were written shortly after the events at Stuffiminto.com occurred, but was not posted until Sean Sullivan apparently decided that coming clean about his actions and behavior wasn’t worth doing. All I was asking for is a public admission of his actions as well as a public apology from him.