DOJ Wants ISPs to Log User Traffic UPDATED

Anonymous Coward writes "Kevin Poulson writes in an article in SecurityFocus that in an early draft of the White House's "National Strategy to Secure Cyberspace", the DOJ proposes that the US enact European style 'data retention' laws, which force ISPs to log and retain all of your email headers, as well as your Web browsing history." Nothing worse for the DOJ to be upstaged by Europe in oppressive lawmaking, they must feel like they're losing their edge. Update: 06/19 23:04 GMT by M : The SecurityFocus article has been updated with this note, saying that the U.S. denies having any plans for data-retention laws. Guess we'll have to wait until the plan is released to see.

Comments

I guess...

[Anonymous Coward]

I'll have to meet real girls instead of browsing pr0n.

First post?

[Paradoxish]

Maybe, I dunno. But anyway... this sucks. Doesn't anyone at the DOJ realize that keeping a history of web browsing is about the equivalent of having someone follow you around with a pen and some paper and record the address of every place you visit during the day? I don't understand how keeping track of information like this can possibly help with security or ANYTHING for that matter.

Re:First post?

[treat]

. Doesn't anyone at the DOJ realize that keeping a history of web browsing is about the equivalent of having someone follow you around with a pen and some paper and record the address of every place you visit during the day?

Which is also the equivalent of putting cameras in public places, which makes it easy to track someone's movements throughout the entire day. Therefore, this will not be an effective argument against such monitoring to people who already consider things like cameras in public places to be a good idea.

Re:First post?

[gorf]

Which is also the equivalent of putting cameras in public places...

(Emphasis mine) My web browser is certainly not in a public place.

Re:First post?

[gorf]

Which would then be the equivalent of putting a camera in a public toilet, by the same analogy.

Re:First post?

[nsanit]

My web browser is certainly not in a public place.

Uhhh....you may be right, your browser is not, however...

What comes into and goes out of your browser, may very well be in a public place, unless you are browsing an intranet, which since you've posted here, you're obviously not restricting yourself that much.

If you can be absolutely sure that your traffic never touches a network that has nothing to do with the government, your statement would be true. The chances of that are pretty damned slim since a lot of big pipes in the US have some affiliation with a publicly funded university.

However, while their motivation may be different, your ISP could monitor everything you do and it would be akin to retail stores with security cameras.

Please understand, I dislike the idea as much as anyone, I just dont know if there's much we can do about it.

Re:First post?

[MatthewC]

The problem isn't whether or not having the Big G following us around with a pen and paper would prove effective. They would probably make all kinds of arrests. The problem is the Big G is following us around with a pen and paper, period. If the government does not have a warrant, they should not be tracking, or mandate the tracking, of my behaivor. They should not have access to the books I read, the places I visit, my personal conversations, the movies I rent, what I buy, or anything else. Once a system like this is in place, what keeps anyone (*cough!* Ashcroft is a lunatic*cough!*) in the government from going after anyone they feel like, only needing to slap the word "terrorist" on them? Hackers are terrorists; gangs are terrorists; pornographers, trenchcoat mafia, people who don't use Windows, communists, greens, libertarians, anyone who makes an .mp3, immigrants, video game makers, video game players, rappers, and on and on all fall into someone in the government's definition of "terrorist," and just about every one of us is could fall into one of these categories.

Re:First post?

[Paradoxish]

Which is also the equivalent of putting cameras in public places, which makes it easy to track someone's movements throughout the entire day. Therefore, this will not be an effective argument against such monitoring to people who already consider things like cameras in public places to be a good idea.

I don't agree. For one thing, my house and my computer are not "public places". The websites I visit may be, but what I use to get there IS NOT. Here's an analogy...

Cameras in public places are kind of like the hit trackers that exist on websites today. They only "track" me if I happen to visit the place where they are and they can only track my obvious features. In the same way cameras can't tell you who I am, only what I look like, website tracking programs can show you my IP and maybe a little bit about me - but not who I am. Public cameras don't follow me around and neither do website tracking progs.

On the other hand, tracking my browsing habits specifically is a whole lot different. Now you've got a camera that's following me specifically. It knows who I am and can tell you exactly where I go, how long I stay there, and what I do once I'm there. It is definetly different.

Re:First post?

[duck0r]

I AGREE with you, I think the government has no right to moniter what I do with out reasonble cause. I slowly see us givng up our democrasy for security. Bush wants compelete power so he can be "more effective in the war against terrosium". It seems like historys repeats it self, much like the Romans did. Think, question everything liberate the truth.

Re:First post?

[Dr Caleb]

And who follows them around all day with a pen and paper recording everything they are recording about you?

It's just a way for the govenerdment to make the citizens think that are doing something about security. If they were actually doing something to protect the people, the "Office of Homeland Security" would call the Department of Transport and tell them to enforce seatbelt laws. How many lives a day would that save? How many lives a day will be saved by my mail headers and URLs being monitored?

Re:First post?

[killmenow]

I don't understand how keeping track of information like this can possibly help with security or ANYTHING for that matter.

What I don't get is this: Evidence exists that the CIA, FBI, NSA, et. al. already had enough raw data in their hands that if they had their heads on right, they could've stopped the 9/11 attack...so the amount of information they have access to already isn't the problem...it's what they do with it.

So how the hell is giving them more data going to help? All it will do is cause information overload and all those cops will start ignoring even more than they do already...which will actually make it easier for those bent on crime and distruction.

After all, if there are 50 average joe's to every 1 kidnapper/drug dealer/terrorist, then if I'm one of the bad guys...I'd be hoping the government is too busy watching the 50 good guys so as to be more likely to overlook me.

Re:First post?

[EvanED]

Of course, with face recognition software, etc. it's possible - and unfortunatly being implemented - to have a network of cameras track someone's movement.

Re:First post?

[EvanED]

>>It's just a way for the govenerdment to make the citizens think that are doing something about security. If they were actually doing something to protect the people, the "Office of Homeland Security" would call the Department of Transport and tell them to enforce seatbelt laws. How many lives a day would that save? How many lives a day will be saved by my mail headers and URLs being monitored?

I must object. Enforcing seatbelt laws would cause more people to use them, so after a brief period of high arrests, the number of people who are arrested would decline. This way, they can make arrests they never would have made. So we would be safer: more people would be in jail.

Re:First post?

[symbolic]

People who don't mind cameras in public places, and who think that there's no 'reasonable expectation of privacy' in public, probably wouldn't be the least bit bothered if someone caught them (with a camera) in an embarrassing moment (in public) and then plastered it all over the net. Or would they?

Re:First post?

[symbolic]

I AGREE with you, I think the government has no right to moniter what I do with out reasonble cause. I slowly see us givng up our democrasy for security.

Correction...for the illusion of security. It's nothing more than a PR pill given to the public in order to mask the underlying problem.

Re:First post?

[Cognitive Dissident]

Which is also the equivalent of putting cameras in public places, which makes it easy to track someone's movements throughout the entire day. Therefore, this will not be an effective argument against such monitoring to people who already consider things like cameras in public places to be a good idea.

We do conduct a lot of private business in public, you know. This is more like the equivalent of making the taxis and public transport system (bus, subway, whatever) keep logs of everyone's travels, making all merchants keep logs of things you buy, making newsstands keep logs of things you read, etc... and requiring them all to provide those logs to the police.

Re:First post?

[Jaysyn]

I don't know where you live but they *DO* enforce seatbelt laws in Florida. If they see you driving by without a seatbelt on, even if you are doing the speed limit, or whatever, they will pull you over & issue you a citation.

Of course this doesn't bother me, becasue I'm uncomfortable if I don't have a seatbelt on while I'm driving.

Jaysyn

Re:First post?

[gorf]

I agree with you completely.

What I was saying was that, if you're walking about publicly, by the very action of doing it publicly you can't really complain about people knowing about it. But you've got a reasonable expectation of privacy in your own home, and similarly you should have a reasonable expectation of privacy when you're browsing the web from your own home.

Just like people could monitor what you're doing in your home by using listening devices, secret cameras etc, similarly your ISP can do so.

Mail headers.

[Lemmy Caution]

Article seems slashdotted, so I haven't read it yet... but what does this mean for those of us who run our own mail servers? Do we know have retention and reporting requirements on our systems at home?

Re:Mail headers.

[Bouncings]

I managed to get the article. Here is a reprint of the text.

Cyber Security Plan Contemplates U.S. Data Retention Law

Internet service providers may be forced into wholesale spying on their customers as part of the White House's strategy for securing cyberspace. By Kevin Poulsen, Jun 18 2002 3:46PM UPDATE:U.S. Denies Data Retention Plans

An early draft of the White House's National Strategy to Secure Cyberspace envisions the same kind of mandatory customer data collection and retention by U.S. Internet service providers as was recently enacted in Europe, according to sources who have reviewed portions of the plan.

In recent weeks, the administration has begun doling out bits and pieces of a draft of the strategy to technology industry members and advocacy groups. A federal data retention law is suggested briefly in a section drafted in part by the U.S. Justice Department.

The comprehensive strategy is being assembled by the President's Critical Infrastructure Protection Board, headed by cyber security czar Richard Clarke, and is intended as a collaborative road map for further action by government agencies, private industry, and Congress.

While not binding, proposals that find their way into the final version of the National Strategy would likely have added weight in Congress, and could lead to legislation.

A controversial directive passed by the European Parliament last month allows the 15 European Union member countries to force ISPs to collect and keep detailed logs of each customer's traffic, so that law enforcement agencies could access it later.

Data to be gathered under the European plan includes the headers (from, to, cc and subject lines) of every e-mail each customer sends or receives, and every user's complete Web browsing history. The period of time that the data will have to be retained is up to each member country; specific legislative proposals range from 12 months to seven years, according to Cedric Laurant, a policy analyst at the Electronic Privacy Information Center (EPIC), which opposed the directive.

"Somebody could see their past for the last seven years be completely open," says Laurant, speaking of the European directive. "It violates freedom of speech and the basic principal of the presumption of innocence."

The draft of the U.S. plan does not specify how much data ISPs would be forced to collect, or how long they would have to store it. The White House did not return phone calls on the strategy, which is scheduled for release in September.

Re:Mail headers.

[zaius]

I was thinking the same thing. I find it very difficult to believe that they can force the tens of thousands of us (at least) who run our own mail/DNS servers to keep logs for x years, and then turn them over at their request. It's also not that difficult to set up your own mail/DNS server, and I don't think that terrorists/criminals capable of doing anything worth preventing would have too hard of a time with it.

Re:Mail headers.

[Chiasmus_]

The article isn't slashdotted. It doesn't mention private mail servers.
I'm guessing that the DOJ isn't pleased by the concept of private mail servers, though. It makes this kind of stuff much more difficult to subpoena. I own the domain www.youhavenochancetosurvivemakeyourtime.com; the WHOIS contact information is listed as Bageeno Hormonis of 123 Fake Street in Springfield. (Granted, the government could still track me down if it deemed necessary, but I'm sure that kind of stuff has to be an annoying waste of resources for them).

My best guess is that, yeah, retention requirements for public mail servers would apply to private mail servers, and you'd get hit with a substantial fine if the government tried to subpoena your mail and found it missing.

Re:Mail headers.

[ljaguar]

Now, how the heck are they gonna log my web browsing history? Just log all the hosts I connect with destination port 80? Or are they actually gonna peak in to individual packet content and reconstruct the GET message?

The latter sounds expensive to me. But then the former would be worthless, if I were to connect to vague topiced sites such as geocities or mail.yahoo.com (no way to track which user I was logged in as) or even cdrom.com.

www.IwannaBlowUpAmericaBecauseIamATerrorist.org is a different story though...

Re:Mail headers.

[jmd!]

Your ISP wouldn't do it on their mail server, they would have to sniff all outbound port 25 traffic and record that way. Scary stuff, since even PGP doesn't help much. They'd still known everyone I mail. Time to start putting the Subject: in the body of the message, people!

Re:Mail headers.

[THE ROCK]

Where I work we use a proxy for this functionality (SQUID) as a company CYA type of thing (along with access controls and the like, squid rocks!) Most ISPs already use proxy caching to alleviate their bandwidth usage so keeping the logs of what sites everybody visits would not be hard in the least.

There really is no EASY way around this. You can try to influence the person responsible for keeping the logs (kind of like how I tell squid not to log any web traffic coming off of MY PC at work, I guess I'm easy to corrupt when its my own interests that I have at heart) or try funneling all of your traffic through an ipsec tunnel going to some remote location, so that its logged to that remote user instead of you.

Hardly seems worth it. I guess if you could make your browser sit there and download random pages all day long you can at least wreck the S/N ratio so someone really has to dig to see what you're actually looking at. I don't know how effective that would be if "they" don't get overloaded by the volume of data that systems like echelon deal with however.

Re:Mail headers.

[EvanED]

I'll be d/ling random pages, that's for sure. Web pages I make will also be server-side scripts, and will obfusticate the actual address you're opening. Pseudo-code algorithm:

1. person comes to page
2. script assigns session a unique ID
3. script spouts out page with obfusticated links (for example, www.mysite.org/loadurl?url=lkjdfgkljsdwk43tvkfsdva sekzfdhgsdkj;id=234572345987439) generated from the ID
4. user goes to one of the links
5. script translates URL, loading page (start at step two)
6. script marks ID as used; further attempts to use that ID will result in errors

Each page will have a fixed URL people could bookmark if they really needed to.

Re:Mail headers.

[jmd!]

> That's what anonymous remailers are for.

How do I actually tell the remailer the final destination? Never used one before... connect to a web server on it via HTTPS? SMTP or mail header can't be used, that's sniffed, body can't be used, that's encrypted.

Re:Mail headers.

[mOdQuArK!]

The general idea is that you wrap your message in several layers of encryption, then bounce your message through 3 or more randomly-picked, anonymous remailers. Each remailer "peels" a level of encryption off the message, and then the just-decrypted part of the message tells it the next remailer to send the rest of the encrypted message. The final message is sent directly to the desired recipient, although the contents of the message can be still encrypted.

Each anonymous remailer has various algorithms to try and make traffic analysis more difficult (random outgoing delivery, fake messages, etc).

It's a pretty good theoretical setup (requiring that eavesdroppers be able to monitor all paths through the remailer "network" to have full traffic analysis coverage), but the hard part is keeping all of those remailers up & running reliably (since most of the remailers are being provided by volunteers with limited resources).

In addition, remailers are notorious for having been abused by spammers to cover their tracks using email-to-mailing list or email-to-netnews gateways.

Curious

[PovRayMan]

I once logged packets going in and out of my machine and I generated a huge log file very fast. It was only like 200kb, but really... for an ISP to log as much as they're being asked to, they would need INCREDIBLE storage to hold it all, wouldn't they? I wonder if then ATTBI would tax me another $5 a month to pay for their storage equipement.

Re:Curious

[JetScootr]

I think the appropriate answer to the DoJ is "Give us a big enough pipe, we'll forward the data to you, and you can archive the hell out of it if you like."
Drown them in their own sauce. Before long, they'll be telling all the ISPs in the country "UNCLE!"
If nothing else, we'll get a BIG increase in the capacity of the Internet backbone before it's all over. Note for the humor-impaired: This suggestion is a joke. I think the bozo at DoJ who proposed this should be fired/recalled for constitutional abuse of power for even suggesting this.

Will they fund it?

[cardshark2001]

Logging such a huge volume of data requires massive hard-drive space, extra CPU power, extra manpower. All of those things cost money.

Considering how little money ISP's tend to make, I don't see this as at all fair, unless the government will pony up the cash.

Re:Will they fund it?

[delta407]

Besides which, what defines an ISP? I do work for a school that shares an Internet line with a nearby company; the router is in the school, and the company can use the school's cache server and mail relay. Does the school have to log everything? They certainly can't pay for it.

Then again, if the government would provide cash for some upgrades, I'm sure they wouldn't mind.

Re:Will they fund it?

[bsDaemon]

It isn't fair even if they DO fund it. It is just wrong and evil. What about prsumption of innocense and, freedom of press, freedom of speech, due process? How about 'reasonable expectation of privacy'? Fuck the federal government. "...--That to secure these rights, Governments are instituted among Men, deriving their just powers from the consent of the governed, --That whenever any Form of Government becomes destructive of these ends, it is the Right of the People to alter or to abolish it..."

So there.

Re:Will they fund it?

[Telastyn]

Furthermore, why?

I certainly don't want the government breathing down my neck because some wily hacker sent some nasty email on my behalf to the president while browsing www.kiddie-pr0n-r-us.com from my spoofed ip.

After all, who's to say that ISP's records are sancrosant? Would the government take over the ISP's? I think not.

Re:Will they fund it?

[jazman_777]

Considering how little money ISP's tend to make, I don't see this as at all fair, unless the government will pony up the cash.

"the government will pony up the cash" is a euphemism for "the government will extract more money from people under threat of force, and give it to the ISPs so that the ISPs will monitor us, for the children of course, with an added layer of bureaucracy, so the state can expand its power."

Re:Will they fund it?

[mr_exit]

I want to know if they plan on setting any minimum standards on data security of this information.....
If I was an isp I would use cheep tape drives and dump out all the logs onto cheep dlt tape and just turf them all into a big box in a cupbord in the office..... If any of the tapes go bad (which they often do around here... thats why we write 3 at a time) you just say.... oops sorry, we tried our hardest..

Re:Will they fund it?

[eddeye]

> unless the government will pony up the cash.

Which is to say, unless WE pony up the cash.

Re:Will they fund it?

[hottoh]

News flash friend - you will fund it.

The consumer funds everything, wheather you want it or not. Oh but it creates jobs at the ISP, HDD manufactures get to sell more crap to eventually go to the land fills, more people get hired to make all the crap, so more people can be employed hauling crap to the land fill, and.......

Re:Will they fund it?

[symbolic]

Since when has the lack of an expectation of privacy conveyed a right to log, track, spy on, profile, or otherwise stalk an individual - ESPECIALLY by the government, and ESPECIALLY without cause?

Re:Will they fund it?

[symbolic]

You're right - it isn't fair. But there's precedent. This very thing happened with the telcos already, to the tune of some $500 million that was handed out BY the FBI, to the telcos, in order to defray the cost of upgrading equipment in a manner necessary to comply with CALEA. One unintended consequence is that now the telcos have implemented MORE than was granted by the FCC (based on what the FBI and other law enforcement agencies had requested), fearing that they may be forced to add this extra functionality at some point in the future. All it takes now is a switch to activate the new goodies.

Re:Will they fund it?

[dsoltesz]

Sorry, when the gov't passes edicts like this on themselves, it never supplies funds for actually following the new law or policy. Somehow, the effected agencies/divisions/teams must come up with the money to meet requirements (e.g. get all the Unix folks PCs because suddenly M$ Word is the required word processor). It's certainly not going to supply funds to ISPs to expand storage and whatnot. However, what will happen is the ISPs will be forced to raise prices to cover the costs.

I wonder..

[Space Coyote]

I wonder if Zero Knowledge, Inc. might decide that it might be time to re-introduce their personal anonymous web browsing service.

Re:I wonder..

[jazman_777]

I wonder if Zero Knowledge, Inc. [zeroknowledge.com] might decide that it might be time to re-introduce their personal anonymous web browsing service.

I wonder if Zero Knowledge, Inc., is just a front for a CIA/NSA monitoring operation?

They changed their mind!

[I Want GNU!]

I visited the site, and this is what it says here. I'm posting it in case the site gets slashdotted. [And I'm not a karma whore since I already have 50.]

U.S. Denies Data Retention Plans

The Justice Department refutes claims that Internet service providers could be forced to spy on their customers as part of the U.S. strategy for securing cyberspace.
By Kevin Poulsen, Jun 19 2002 12:24PM
An early draft of the White House's National Strategy to Secure Cyberspace envisions the same kind of mandatory customer data collection and retention by U.S. Internet service providers as was recently enacted in Europe, according to sources who have reviewed portions of the plan.

But a Justice Department source said Wednesday that data retention is mentioned in the strategy only as an industry concern -- ISPs and telecom companies oppose the costly idea -- and does not reflect any plan by the department or the White House to push for a U.S. law.

In recent weeks, the administration has begun doling out bits and pieces of a draft of the National Strategy to technology industry members and advocacy groups. On Tuesday, sources who had reviewed segments of the plan said a federal data retention law is suggested in a section written in part by the Justice Department.

The comprehensive strategy is being assembled by the President's Critical Infrastructure Protection Board, headed by cyber security czar Richard Clarke, and is intended as a collaborative road map for further action by government agencies, private industry, and Congress.

While not binding, proposals that find their way into the final version of the National Strategy would likely have added weight in Congress, and could lead to legislation.

A controversial directive passed by the European Parliament last month allows the 15 European Union member countries to force ISPs to collect and keep detailed logs of each customer's traffic, so that law enforcement agencies could access it later.

Data to be gathered under the European plan includes the headers (from, to, cc and subject lines) of every e-mail each customer sends or receives, and every user's complete Web browsing history. The period of time that the data will have to be retained is up to each member country; specific legislative proposals range from 12 months to seven years, according to Cedric Laurant, policy fellow at the Electronic Privacy Information Center (EPIC), which opposed the directive.

"Somebody could see their past for the last seven years be completely open," says Laurant, speaking of the European directive. "It violates freedom of speech," as well as the legal principal that a defendant is presumed innocent until proven guilty.

The White House did not return phone calls on the National Strategy, which is scheduled for release in September.

Re:They changed their mind!

[jazman_777]

U.S. Denies Data Retention Plans

As Bismarck once said, "Nothing is confirmed until officially denied."

Re:They changed their mind!

[I Want GNU!]

As Bismarck once said, "Nothing is confirmed until officially denied."

I deny that I have tens of billions of dollars in Microsoft. (-:

No seriously, I don't.

Re:They changed their mind!

[whereiswaldo]

But a Justice Department source said Wednesday that data retention is mentioned in the strategy only as an industry concern -- ISPs and telecom companies oppose the costly idea -- and does not reflect any plan by the department or the White House to push for a U.S. law.

Read: ISPs and telecom companies are on notice of what the future holds. It's only a matter of upgrading their infrastructure and we're hosed. No mention of consumers opposing the costly idea (costly in terms of freedom)

Re:They changed their mind!

[Halcyon-X]

The SecurityFocus article has been updated with this note, saying that the U.S. denies having any plans for data-retention laws. Guess we'll have to wait until the plan is released to see.

Sorry for bolding, but it just occurred to me how sad it is that we can't take the government's word at face value anymore. What is this, marketing? (Irony intended)

Update.

[Lemmy Caution]

Finally got through, and ... Nothing to worry about yet. Apparently, this is from a misreading of the report. No data retention requirements, these aren't the droids you're looking for, move along.

Re:Update.

[Lemmy Caution]

It's not as if there haven't been enough abuses of civil liberties in the name of the war on some terrorists. Just as I was inclined to believe any story that depicted Bill Clinton as wily horndog, I'm inclined to give some credibility to any story that indicated that Bush, Cheney, Ashcroft, and friends took another big bite out of civil rights, privacy, and the presumption of innocence.

Re:Update.

[RatFink100]

Interesting choice of quote since those were the droids they were looking for - they just managed to fool them they weren't.

Or maybe that's what you intended to imply?

Time to switch to anonymous proxies...

[Anonymous Coward]

Does anyone know if using anonymous web surfing services, like Anonymizer or COTSE, will help, with their URL encryption? Of course, this won't fix the problem of e-mail headers, but it might keep flags from being raised when you visit a "hacker" site, or some other "suspect" material on the web.

Re:Time to switch to anonymous proxies...

[4of12]

There used to be anonymous re-mailers like penet and some by cypherpunks (C2) that would be nice to have around. I think spam usage killed off those remailers that survived the suits by the Church of Scientology.

What the U.S. government doesn't realize is that the same unreasonable searches of your cyberhome that they think will do "something" to combat terrorism (it's arguable just how much genuine security this gains), are also the same policies that, as they are mimicked worldwide, will make it easier for oppressive regimes (North Korea, Iraq, China, Saudi Arabia, etc.) to clamp down on political dissent and the free exchange of ideas in their nations.

I can only presume that the Bush administration has decided for us that some small amount of potential security under hypothetical circumstances is worth the cost in freedom of expression, not only in the United States but around the world.

And here was I, thinking that the U.S. was a standard bearer promoting democracy and the principles of human rights embodied in the U.S. Constitution.

Re:Time to switch to anonymous proxies...

[jazman_777]

And here was I, thinking that the U.S. was a standard bearer promoting democracy and the principles of human rights embodied in the U.S. Constitution.

You were educated by the State, right? What did you expect? And you do get your news from those Yapping Lapdogs for the State, CNN (aka "Pentagon Press Release Network")? We are all thoroughly indoctrinated into all the Correct Myths.

FPWL

[Peridriga]

Wow...

Now the DOJ will have the biggest Free Password List on the web..

Could you imagine the amount of money they could make from X-10 pop-under ads...

Re:FPWL

[Verizon Guy]

That seems a little self-defeating. Why not just hack into thatchicksite.com?

*sigh*

[sheepab]

The DOJ is on crack. If they think for ONE f*cking second that this would actually work, they're wrong. Ill just start encrypting my email more often. Lets see them get through to my mail headers under 128bit RSA. Yeah I know they have Carnivore, but it only selectively stores email. So, what do you think they will call the machine that collects all THIS information? Lets have a little slashdot naming game shall we? Department of Justice my ass. They need a new name too. Department of Snooping, gives a new meaning to the acronym DOS.

Re:*sigh*

[NanoGator]

" If they think for ONE f*cking second that this would actually work, they're wrong. Ill just start encrypting my email more often. Lets see them get through to my mail headers under 128bit RSA."

Yeah, that's a good plan: Give them a reason to think you're up to no good. That'll keep'em from investigating ya.

Re:*sigh*

[neocon]

Um, yeah, except that as it turns out, it was the article's author who was on crack.

Re:*sigh*

[symbolic]

Works both ways...do you think that a t3rr0rlst would be stupid enough to put the kind of revealing information in their e-mail that will flag Carneyvore, or reveal anything substantive in the logs retained by ISPs? Hasn't it been stated that one of the methods used consisted of common phrases that had secondary meanings to those using them? Who knows what "Let's do a picnic tomorrow" could actually mean? Hell, they could throw someone for an even bigger loop be creating a diversion - one dude's subject might read ... "I love women's laced panties", and the text that follows (about said subject) could mean ANYTHING based on a prior system set up those engaged in the communication. Those reading it will probably be patting themselves on the back knowing that they've discovered a poor sap's preference for women's underwear.

Re:*sigh*

[NanoGator]

Don't you think it'd be all over the news if the Gov't was chasing down false leads?

I mean seriously, who cares if they read our e-mail? What are they going to get from it? They already have my social security #. THey have my date of birth, mother's maiden name, the city I was born in, how much money I've made in my life, where I've lived all my life, who I've worked for, what kind of car I drive, my physical description, and so on. What is going to be revealed in e-mail that they aren't privvy to now? Who cares?

I don't care if some gov't agent is reading my overly-affectionate emails to my GF. I'll never even meet the guy!

Fight corporations when they try to peek into your lives, but don't fight the Gov't. They're out to protect you.

Re:*sigh*

[symbolic]

Check this out:

http://www.csmonitor.com/2002/0108/p1s4-usju.htm

Further, Lawrence Tribe (a Constitutional scholar) suggested on last night's Nightline that what the government is doing may very well consitute an unreasonable search (skirting the Fourth Amendment) If the government is out to 'protect' me, who was it 'protecting' during J. Edgar Hoover's reign (COINTELPRO), when the very kinds of abuses that every American should fear, were actually occurring?

They're the only ones NOT looking

[Ars-Fartsica]

Any ISP employee, sysadmin or free email provider admin can already look at your data any time they please. And they do.

At least the government will probably be required to disclose what they do.

Your best bet is to not send any sensitive info over email, and don't store any unencrypted sensitive or private data in online storage systems.

Re:They're the only ones NOT looking

[Rolo Tomasi]

Any ISP employee, sysadmin or free email provider admin can already look at your data any time they please. And they do.

Yes, but it's illegal for them to do it. Everyone can already beat the living snot out of you any time they please, but do you want it to be legal for the cops?

Re:They're the only ones NOT looking

[digitalsushi]

As a netadmin for a small-medium sized ISP, I'm going to have to disagree with that on two levels. First off, most of us small guys dont have all the bells and whistles, or disposable overhead to implement free tools to spy on our users. Quite a few of us pipe our customers "straight through". (That and you need to remember that the majority of us are no Vincent Cerfs.. we're smart people but we could sit here 24 hours a day and still not have enough time to learn it all- but thats another thread)

Second, for the things that we *can* look at (easy stuff like say someone's POP mailbox, just a text file) there is (most people wont believe this) actually an honor system amongst admins. We won't edit a mailbox if its broken until we have permission. Otherwise we might see something that isnt ours to see. Privacy is THE most important thing we can promise our customers, so everything else has to take the back seat, even if it means some uptime.

Even given that, though, I do recommend that people encrypt their email, cause just cause I wont read your mail, doesn't mean the kid who has a 60 minute kernel exploit who just rooted me wont- (the rooting being another thread, lets not talk about perfection in admining here) (So sorry to reply like this, but I just took it a little personally. We're not all sleazy. Most of us arent.)

Re:They're the only ones NOT looking

[GMontag451]

Yes, but it's illegal for them to do it.

It's perfectly legal for them to look at any information on their servers. Whether or not they actually do is a different question. There are absolutely no restrictions on what an ISP can or cannot do with your personal data beyond what they put in their privacy policy. Hell, even the phone companies, who are heavily regulated by the FCC, can tap anyone's phone at anytime and listen, as long as it is for "quality assurance" or "maintenence purposes". They just can't give out the info to the police without a supoena.

Re:They're the only ones NOT looking

[BalkanBoy]

Actually it is Vinton Cerf rather than Vincent...

What's next?

[cardshark2001]

Perhaps the DOJ should be able to find out the title of every book I purchase, every TV show I watch, what kind of hamburger I buy.

Wholesale spying is not justified by the war on terrorism. Especially for us non-Arab, born and raised in America types. It's just an excuse for the government to do something they've wanted to do for a long time anyway.

Re:What's next?

[sirwired]

Wholesale spying is not justified by the war on terrorism. Especially for us non-Arab, born and raised in America types.

Um, wholesale spying is not justified on U.S. citizens, period. All citizens (and for that matter, residents) are granted equal protection under the constitution, Arab or not, native born or not. There should be no distinctions. (Okay, there is the exception that the president must be native-born.)

SirWired

Re:What's next?

[cardshark2001]

I agree that all citizens should enjoy the same protection, regardless of race.

My point was that we most likely face the threat of terrorism from Arabs. It's just a fact, the odd Timothy McVeigh is the exception to the rule.

We have enemies, we know what they look like, and where they are from. We should use that knowledge, not pretend that it is false for politically correct reasons.

Personal domains

[forehead]

What I want to know is how this impacts those of use who own/operate our own domains and SMTP server (i.e. those of us who do not use ISP supplied SMTP servers to send out mail). Will we be forced to log our own traffic for fear mean old Uncle Ashcroft wants to know who we emailed three years ago? Will we have to enact some sort of robust long term backup of these logs (i.e. fire resistant safes and offsite backups of logs)? What if, through no fault of our own, a fire destroys the last weeks worth of backups and Uncle Bush needs yesterdays logs (i.e. how paranoid about backing things up do we need to be)?

Re:Personal domains

[Erotomek]

What I want to know is how this impacts those of use who own/operate our own domains and SMTP server (i.e. those of us who do not use ISP supplied SMTP servers to send out mail).

I hope Jenda is already working on a new version of Mail::Sender...
Because he's not pro-terrorist, now is he?

Re:Personal domains

[Indy1]

The day the government touches ANY of my boxes, is the day they pry the keyboard out of my cold dead hands (or on a more practical basis, have moved overseas to a far more enlightened country). The facism being proposed in the American government is sickening, and i fear the day the majority of it is passed into law. Big brother, meet Uncle George and Cousin Ashcroft.

Spoofing header info

[zubernerd]

Can't the data the ISP have to log be spoofed by those who know what they are doing. If so, only us poor saps who have "nothing to hide" are screwed... the "pros" will do other things... Chalk this one up in the "dumbass idea of the month club"

Cost

[Quixotic137]

Considering the time it takes to set up a tracking system like this, plus the storage space, plus helping law enforcement retrieve the data it requests, I don't think this is really going to be effective. I work for a small wireless ISP and if I had to set something like this up, we would be screwed.

Numerous broadband providers have gone bankrupt already. The number of requests directed at huge broadband providers could be huge. Besides, law enforcement would end up with large amounts of data that don't really prove much, since criminals (and non-criminals) can encrypt their emails anyway.

once a karma whore always a karma whore

[Anonymous Coward]

"I'm not a karma whore because I already have 50" simply means "I karma whored enough and now I can do this simply because I enjoy it"

Re:once a karma whore always a karma whore

[I Want GNU!]

Not that there's anything wrong with it. :-)

I just try to write good comments when/where they will get noticed, so that I have the greatest impact on the greatest # of people, that's all.

Sounds reasonable

[atrowe]

I value my privacy as much as the next guy, but I don't think the DOJ's request is at all unreasonable. In fact, most ISP's already do log their user's traffic. In fact, if you're using a major ISP such as AT&T or Earthlink to read this, your traffic is almost certainly being logged right at this moment. This isn't necessarily a bad thing. On the contrary, logging user's activities on-line allows law enforcement to catch spammers (I'm sure most Slashdotters hate spammers), virus writers and distributers, software pirates, pedophiles, and all sorts of other cyber-miscreants. This is a Good Thing. I sure as hell don't want to be on-line with those types of people, and I'm sure most other readers will agree with me here.

It seems that the issue at hand isn't the act of logging activities themselves, but how willing your ISP is to distribute those logs. In all previous cases I am aware of, ISP's do not give out personal information about a user without first being served with a subpoena. This is no worse than the restrictions we have had on wiretapping and eavesdropping for the past 50 or so years, so I don't see any reason for anyone to get upset about this. If you aren't breaking the law, then you have nothing to worry about, and your information will remain private in the hands of your service provider, however if you're doing something illegal, then there is no reason that the FBI or such should not be able to serve your ISP with a subpoena to obtain your usage logs. Its perfectly within our Constitutional rights for the government to do this, and anyone who is made nervous because of this probably has something to hide.

Re:Sounds reasonable

[schon]

I don't think the DOJ's request is at all unreasonable

Of course it's unreasonable. Think about this: The logs don't show content.

Your email headers don't show what you were talking about - you emailed "somejoeuser99@hotmail.com" asking about his lost puppy... but unbeknownst to you, he's a suspected terrorist, and all of a sudden, you're being investigated... They pull up your http traffic file, and it turns out that the HTML email he sent you has IMG tags that pull pictures from known terrorist sites.

You'll probably change your mind once you're in an FBI interrogation chamber.. that bare bulb shining in your face, as Agent Smith says "Vhy vhere you communicating vis a known terrorist? Ve haf vays of makink you talk!"

Or better yet, someone wants to make your life hell, so they get some anonymous web space, put some content that might interest you, and get you to view it... then then change the content to some terrorist propaganda, and place an anonymous call to the FBI. Suddenly there is PROOF that you've been visiting terrorist sites.. so you must be a terrorist!

Think it can't happen in good ole' USofA? Just like the McCarthy witchhunts couldn't happen.

Re:Sounds reasonable

[zenyu]

I sure as hell don't want to be on-line with those types of people

If you aren't breaking the law, then you have nothing to worry about

anyone who is made nervous because of this probably has something to hide.

By god, Hoover! You're alive!

Mr. Atrowe, if that is you're real name, I don't want to share the internet with your type of people, but I'm not lobbying to have the FBI come knocking on your door; Though you obviously have something to hide. The worst thing you could say I was doing to hurt your kind was that time I voted for a pro-education mayor. That doesn't even try to fix you, just save your children from your horrible fate.

Re:Sounds reasonable

[tomhudson]

Card-carrying Mensa [mensa.org] member. I have no toleranse for stupidity.

Just means that people stupid^H^H^H^H^H^Hproud enough to join Mensa are also too stupid^H^H^H^H^H^Hproud to learn how to spell. ...

Re:Sounds reasonable

[sickasfuck]

atrow writeth: (...) In all previous cases I am aware of, ISP's do not give out personal information about a user without first being served with a subpoena. This is no worse than the restrictions we have had on wiretapping and eavesdropping for the past 50 or so years, so I don't see any reason for anyone to get upset about this. If you aren't breaking the law, then you have nothing to worry about, and your information will remain private in the hands(...)
.. by the same mentality, one might argue John Ashcroft can look up your anus .. NO?! .. why, do you have something to hide?
your skewed idea of privacy will certainly make your life easier in the increasingly United Police States of America

Re:Sounds reasonable

[DreamingReal]

Its perfectly within our Constitutional rights for the government to do this, and anyone who is made nervous because of this probably has something to hide.

Congratulations Mensa-member! You've fallen into the same fallacious assumption that marks all American intellects that are both lazy and foolish - If you're innocent, then you have nothing to hide. Yes, you are in the company of esteemed patriots such as McCarthy, Hoover and Stalin (hey I didn't say American patriots). So on behalf of John Ashcroft, I would like to thank you, good citizen, for dulling your mind and accepting the dictate of your DictatH^H^H^H^H^President, who says that the only way to save liberty and justice for all, is to destroy them.

Re:Sounds reasonable

[pentalive]

When they came for the spammer
- I did not speak up, who likes spam anyway
When they came for the "virus writers"
- I did not speak up
When they came for the software pirates
- I did not speak up
one day I did criticize the "them" and they
came for me...
- no one was left to speak up.

I am not for spam, viruses or piracy, But I am also not for the survelence state the world is becomming.

When you loose a right or a privacy a terrorist laughs!

Re:Okay

[sheepab]

It's an unworkable idea even voluntarily. Who is going to PAY for the storage, retention, and transfer of the GIGABYTES of data that these records will require the ISPs to keep?

I would think that much data would take up more than GB's, more like TeraBytes.

This is how Gray Davis would do it.

[rice_burners_suck]

I have a better idea. The UN should pass a law requiring that all network traffic in the world, whether on a home LAN or through the Internet, must pass through one central checkpoint machine that will log all the traffic. This will provide a worldwide data retention center where authorities and large corporations can perform queries to figure out exactly what someone was doing. (Obviously, defendants won't be allowed to perform similar queries, because that wouldn't be fair.)

Oh yeah... And the central machine that would fulfill this function would be a 386 SX with a tape drive serving as RAM, running Windows XP Professional, and it would be connected to the Internet through a 1200 baud modem. This will make true worldwide broadband a reality and keep the economy strong.

Encrypted Messaging

[dmelomed]

Attempts like this just make encrypted messaging protocols more desired. SMTP is just old, slow, rusty, and stupid. See here: IM2000

actually if you follow the link

[lingqi]

you will see that there is an update: US DENIES DATA RETENTION PLANS

Re:actually if you follow the link

[EvanED]

Of course, from the 1940s until 1995(?), Area 51 didn't exist. There was no air force base in the Nevada desert, and all the pictures of one are faked.

The Alien and Sedition acts from the 1790s were also to monitor the undeclared war against France, not to make it illegal for the Jefferson crowd to speak out against the Hamilton crowd. (Don't forget these pieces of legislation, in my mind the most unconstitutional acts to ever pass through the US Congress.)

The US also knew *nothing* about anything relating to the Sept 11 attacks. All that stuff you hear about the Phoenix memo and whatnot; it's all lies.

Electronic log files

[Quixotic137]

How would they know if the data they get is real anyway? I can write a perl script to generate fake sendmail log files all day...

hmmm..

[crimoid]

This is only slightly different than forcing telcos to retain phone records, with one exception.

Many URL's can be used to guess WHAT data you've been looking at without actually looking at the website. For example, if someone saw the URL: http://www.nakedkids.com they would assume that it was child porn and whomever looked at it should be red-flagged and investigated. Quite possibly however this site could have NOTHING to do with porn and could simply have a questionable DNS name.

Perhaps if ISPs were only allowed to track IP addresses....

Re:hmmm..

[Geeyzus]

Many URL's can be used to guess WHAT data you've been looking at without actually looking at the website. For example, if someone saw the URL: http://www.nakedkids.com they would assume that it was child porn and whomever looked at it should be red-flagged and investigated. Quite possibly however this site could have NOTHING to do with porn and could simply have a questionable DNS name.

If www.nakedkids.com DIDN'T have to do with child porn, they might want to rethink their company name / marketing strategy...

But regarding your point, I want to say things like this would be caught in the follow-up investigation. Not that I want people investigating me, but I probably won't be thrown in the back of a squad car for visiting a site with a weird name if it actually sells propane and propane accessories, for example...

Mark

Re:hmmm..

[bob_eh]

http://freshmeat.net/ comes to mind as one bad example. but what happens if you want company.net, and compnay.com is porn. Then they may flag you..

Re:hmmm..

[uid8472]

Perhaps if ISPs were only allowed to track IP addresses....

Um, there's this thing the DNS has called a PTR record... although if the questionable host name is just a web vhost (that is, it's a non-canonical name; the IP address doesn't map back to the same domain name), you might be okay, if the actual web server isn't also named something noteworthy (e.g. www3.smutserver.com).

Only if they have a cameera

[tomhudson]

Even if the DoJ were to keep a log of your web browsing, who's to say it was you sitting at the keyboard?

I can see people making scripts to go to all sorts of "undesireable sites", and when they get busted, they can prove they were nowhere near the computer at the time.

Would also smoke out all sorts of surveillance schemes.

Re:Only if they have a cameera

[Disevidence]

Actually, your post reminds me. Wasn't there some sort of backdoor/bug/virus which allowed remote users to view your computer video camera?

If what I recall is correct, they could prove it was you.

(I could be wrong however, im searching /. for the story..)

Re:Only if they have a cameera

[antirename]

Yeah, it's about 3 year old news called BO2K, subseven, yadda yadda yadda. If you don't run antivirus you might have one of these. Even if you do run antivirus but you're using windows, you really wouldn't know unless you found ports open for no reason. Standard .exe compression programs make these little bastards undetectable to antivirus programs (does that count as a varient?) although they have to be completely configured before they're wrapped. Oh yeah, hooking into your monitor speaker is a standard feature these days as well. Saves file as a .wav, as far as I know common trojans don't stream it yet... a hacker would have to download the take... but it's been a few months since I checked. If you didn't know this, and you are running windows, and maybe just possibly your antivirus software is out of date, and you honestly don't know what ports are open, and why, then I really hope you're not running a server. And if you are, please at least try to keep it from DOSing me... if that fails, unplug the bitch and GO BACK TO CLASS! (Or, just make it a habit to check bugtraq every day or two and fix whatever the nice people there tell you to). Peace.

IP Laws

[igotmybfg]

This would put the government at odds with its own policy, as well as make some big media companies really, really mad. The reality is that surfing the web now encompasses many more things than just vanilla html sites - and because of that, internet companies have found it easier to make money. Storing that history would now require much more space, and, due to the fact that most online businesses are now going for pay-per-use models instead of advertising-based, the government would end up storing a whole bunch of content that is, ironically enough, protected by copyright law. In effect, the government would be breaking the law - the copyright law that John Ashcroft & Co. are doing so much to proserve, protect, and extend.

Re:IP Laws

[detritus.]

If state DMV's can get away with selling driver's license carrier's information, I wouldn't be surprised if the government sells the information, and/or uses it for their own research/census-type mischevious plans..

Thank God I'm not a Yank!!!

[Anonymous Coward]

My god beuracrats are stupid!!!!!

The biggest problems wiht this are the fact that to do this for all of you ppl in the US that use the web will end up generating HUGE log files. Who ius going to pay for the storage space required to house these bohemoths????

What exactly do they expect to achieve in doing this??? By far the vast majority of web users are NOT terorists or criminals (lets just ignore those downloading priated software etc.) They are just going to weind upo wiht lots of stored prOn URLs and inane sites.

For this inative to be of any use, they will have to employ quite a few ppl to troll through these vast log file looking for the needle in the haystack.

Stock prices soar

[frameshift]

Seagate and maxtor stock prices just jumped 10%, western digital 8%. Conspiracy i tell you!

EU countries will probably NOT ratify it after all

[sickasfuck]

At least UK, it seems:

Home Secretary David Blunkett has admitted he blundered over plans dubbed a "snooper's charter" to give a raft of public bodies in the UK access to private e-mail and mobile phone records.

The proposals are to be put on hold indefinitely in the face of huge opposition, which the home secretary conceded his department totally failed to predict. (...)

See http://news.bbc.co.uk/hi/english/uk_politics/newsi d_2051000/2051117.stm for more info.

we need a standard "envelope" for email

[jimmcq]

You always hear the analogy that email is just sending a postcard... well, its about time that we start to make email "envelopes" (aka encryption) standard for ALL email.

I think Joe Sixpack would be more inclined to use encryption if he thought it was just an envelope to put mail into... he doesn't need to know about technojargon like PGP, GPG, SSL, S/MIME, X.509 certificates, just tell him its an "email envelope" instead of the old postcard he's used to.

The only thing that really needs to be public is the To address. Everything else could be encrypted (enclosed in the envelope) except for maybe a couple fields like the From Address and the maybe the Subject Line (but even those could be "inside").

What needs to happen before email encryption becomes a "standard" thing that everyone uses all the time?

Re:we need a standard "envelope" for email

[NanoGator]

" think Joe Sixpack would be more inclined to use encryption if he thought it was just an envelope to put mail into... "

I don't undertand why he'd need to do this. It's a computer reading the logs searching for patterns, not a human reading the emails looking for hidden meaning. If he encrypts it, it'll flag him and then a human'll look into it, which is exactly what the invasion to his privacy would be.

Re:we need a standard "envelope" for email

[random735]

[What needs to happen before email encryption becomes a "standard" thing that everyone uses all the time?]

just one thing: email encryption needs to become a standard, and then it will become a standard.

I'm not just being flippant here... I don't use it because no one else does and I don't want to guide my parents through decrypting the email I send them.

Maybe once all common email programs include a common encryption utility that's cross compatible with all the other email clients, i'll do it.

As it is, encrypting email is worse than sending HTML email.. and that already causes me tremendous irritation.

Re:we need a standard "envelope" for email

[extrarice]

//quote
Maybe once all common email programs include a common encryption utility that's cross compatible with all the other email clients, i'll do it.
//end quote

Then the envelope become tissue paper: see-thru and fragile.

Re:we need a standard "envelope" for email

[hkhanna]

I think Joe Sixpack would be more inclined to use encryption if he thought it was just an envelope to put mail into.

Good analogy, however opening a sealed envelope not addressed to you is a felony in the United States. So going by that analogy, it would be illegal to "open the envelope" (reverse the encryption) unless it was addressed to you. So basically what you've just said is that the DMCA's anti-circumvention clause has some ground to it. I mean, hey, if its illegal to open an envelope in real space, then howdy-do! we've already got a law in place that would prevent opening an "envelope" in cyberspace. I don't mean to troll...just point out that if encryption and envelopes are to be analogous, then we're going to need anti-circumvention clauses to outlaw opening an e-mail not addressed to you.

Hargun

Re:we need a standard "envelope" for email

[jimmcq]

If he encrypts it, it'll flag him

Not if everyone encrypts their mail. Does the post office flag every piece of mail enclosed in an opaque envelope for further "inspection"?

Re:we need a standard "envelope" for email

[jimmcq]

So basically what you've just said is that the DMCA's anti-circumvention clause has some ground to it. I mean, hey, if its illegal to open an envelope in real space, then howdy-do! we've already got a law in place that would prevent opening an "envelope" in cyberspace

I'm all for an "email envelope" that is protected just the same as a realspace envelope... but that's not the same as the broad scope anti-circumvention clause. It is only illegal to open envelopes that have been sent through federal postal system, but anyone is free to open any other envelopes that haven't been submitted to the Post Office.

Re:we need a standard "envelope" for email

[NanoGator]

"Not if everyone encrypts their mail."

They don't need to, they don't have anyting to worry about. As I said, it's a computer reading the messages, not a human.

You're not preventing the Government the ability to read your email, instead you're opening a wider door for potential terrorists to communicate.

Re:we need a standard "envelope" for email

[Arandir]

I'm all set to use PGP/GPG. It's integrated into my mail client. I have registered my public key. That's the easy part.

The hard part is my mom, my boss, my friends, the guys on the mailing list... Until they all get PGP/GPG and make a public key, encryption doesn't do me a bit of good. I don't care how much PGP integration the current crop of mail clients have, generating valid and robust keys and then maintaining them through software upgrades, harddrive crashes and ISP changes, is something the average Joe Sixpack (as well as my mom) is not going to be able to handle.

Think about it. The day every computer user knows how to properly maintain a set of PGP keys is the day people stop opening binary email attachments, stop using "password" and "drowssap" as passwords, and start checking the security of webpages before the start shopping online.

Re:we need a standard "envelope" for email

[T-Ranger]

Your analogy is flawed. Opening a letter not addressed to you is illegal. Owning a letter opener is not, but the DMCA makes owning a electronic knife illegal.

Re:we need a standard "envelope" for email

[Anonymous Coward]

I am quite sure that any potential terrorists are quite capable of encrypting their emails already. Which of course means that the terrorists are getting better privacy than the rest of us.

Re:we need a standard "envelope" for email

[random735]

How do you figure? Is PGP see-thru/fragile because everyone uses it? (would it become less secure it more people used it?)

Granted the industry is liable to standardize on something stupid like they did with CSS, but the fact is, if it's not compatible, it's not useful.. and there's no reason it can't be compatible AND secure.

If the encryption varies with the email client, well that's certainly not very useful.

Re:we need a standard "envelope" for email

[EvanED]

>>I don't undertand why he'd need to do this. It's a computer reading the logs searching for patterns, not a human reading the emails looking for hidden meaning. If he encrypts it, it'll flag him and then a human'll look into it, which is exactly what the invasion to his privacy would be.

Two problems with your statement.

First, it will flag innocent statements to be read by a human (after all; the reason they'd need to be checked by a human is a computer filter would be imperfect). Statements such as "Boy, I hope that some Al-Quida, bin Ladin loving, terrorist doesn't bring as bomb to my office in the Empire State Building to blow it up."

Second, it's not really an invasion of privacy to see someone else's encrypted message. To extend the envelope analogy, do you think the postal clerk delivering your mail is invading your privacy by looking at the envelope? Does the message "sdflknqowielsker39qw48ytlk;fnob63q4htq3o4iy69q34h tnuyre9btq54obp5ypgybow56`2" mean anything to you?

Re:we need a standard "envelope" for email

[EvanED]

What if we could get some big e-mail provider to encrypt messages sent between accounts on that same service automatically?

If we were lucky, we might even be able to use Microsoft's monopoly to our advantage. Here's my reasoning:

1. ISPs won't like this; extra processing, extra storage, bad PR, etc. Making the storage almost useless would be a good way to get the law repealed after they point out "look at all this we have to do, and look what effect it's having!"
2. By rule 1, MSN won't like it (they are an ISP)
3. Similarily, Hotmail probably won't like it
4. MSN and Hotmail collaborate with the people who write Outlook to integrate automatic encryption
5. Other e-mail clients are coersed into supporting the encryption as well.
6. Voila! Universal encryption.

Problems:
1. Centralized key storage. Microsoft software. 'nuff said.
2. Encryption algorithm - public access or propriatary?

Re:we need a standard "envelope" for email

[NanoGator]

" Statements such as "Boy, I hope that some Al-Quida, bin Ladin loving, terrorist doesn't bring as bomb to my office in the Empire State Building to blow it up."

Show me one time when that has happened. They're doing a much better job than that.

"Second, it's not really an invasion of priacy to see someone else's encrypted message. "

I never claimed it was. What I said was that the people's privacy is safe. All that's happening is that a computer is recording the messages. So what? A program reads the message, does a pattern match, and moves on. Virtually nobody's message is going to get read by somebody who could care about it.

If you encrypt it, though, what good is that going to do besides make somebody say "Wtf is so important that they are encrypting their message this heavily?"

The only good you are doing by encyrpting your messages is making it easier for September 11th part II to come along.

Re:we need a standard "envelope" for email

[NanoGator]

Good idea: Give the Gov't a reason to ban encyrption all together. All it takes is one more terrorist attack, and they will pass it.

Re:we need a standard "envelope" for email

[EvanED]

>>
" Statements such as "Boy, I hope that some Al-Quida, bin Ladin loving, terrorist doesn't bring as bomb to my office in the Empire State Building to blow it up."

Show me one time when that has happened. They're doing a much better job than that.
>>

And how do you know that? You don't, because the FBI doesn't tell anyone how their carnivore is doing.

>>
"Second, it's not really an invasion of priacy to see someone else's encrypted message. "

I never claimed it was.
>>

What's this then? "If he encrypts it, it'll flag him and then a human'll look into it, which is exactly what the invasion to his privacy would be."

>>All that's happening is that a computer is recording the messages.

Until the computer program flags a message, tarnished or not.

>>Virtually nobody's message is going to get read by somebody who could care about it.

There are two problems with that. First, let's say I recorded all your telephone conversations. I probably really wouldn't care what you said, as it doesn't affect me. But would you like that? If your answer is yes, e-mail me your mailing address and I'll come and bug your phones.

Second problem: "Virtually".

>>If you encrypt it, though, what good is that going to do besides make somebody say "Wtf is so important that they are encrypting their message this heavily?"

Unless, as someone else said, everyone encrpyts it.

>>The only good you are doing by encyrpting your messages is making it easier for September 11th part II to come along.

Two problems with this statement too. Are you saying I'll be involved in September 11 Part II? If so, please let me know what evidence you have. If not, then why would encrypting my messages help the approach?

Second problem: the terrorists are doubtless already encrypting their messages. They know of eschalon and carnivore, and are steering clear of them. They adapt to our surveillence abilities; hence bin Ladin stopping use of his cell phone when he learned we were recording all his coversations.

Re:we need a standard "envelope" for email

[EvanED]

Then it'll be "the day when guns are outlawed, only outlaws will have guns" only more so.

Banning encryption won't help. I think they know that.

Re:we need a standard "envelope" for email

[EvanED]

Oh, not to mention it would clearly be in violation of the freedom of speech. Hence why there were only export regulations on crypto in the 80s and early 90s.

Re:we need a standard "envelope" for email

[NanoGator]

"And how do you know that? You don't, because the FBI doesn't tell anyone how their carnivore is doing. -- Here's an alternative question: How would they keep the innocent victim quiet?

There are two problems with that. First, let's say I recorded all your telephone conversations. I probably really wouldn't care what you said, as it doesn't affect me. But would you like that? If your answer is yes, e-mail me your mailing address and I'll come and bug your phones. -- The Gov't already knows my social security #, my date of birth, mother's maiden name, every city I've ever lived, every car I've ever owned, all of my phone #'s, my family history, where I was born, my physical description, and my bank account and CC #'s. They aren't going to gain any more information about me that I find sensitive. If you are an agent for the Gov't and already have access to that info, then you may bug my phone. That right disappears when you attempt to steal my identity.

"Unless, as someone else said, everyone encrpyts it." -- The only benefit to that is you'll thwart the US's abilities to collect info to prevent Sept 11th Part II from happning. As I said, the Gov't has nothing to gain but your personal safety. It's not like MS is calling for this.

"Are you saying I'll be involved in September 11 Part II? If so, please let me know what evidence you have. If not, then why would encrypting my messages help the approach?" -- I never said that. Don't you think it's a little ridiculous that I'd accuse you of aiding a terrorist? I realize I didn't make that point rather clear, but be serious. What I meant: By thwarting the US's ability to keep tabs on everybody's email, you're making it futile for the Gov't to look for hints that we're going to be attacked again.

What's really assine about this (besides the fact that the Gov't has nothing to gain from your personal info...) is that the Internet is the only place where Al-Qaeda can communicate. Any other means, though possible, aren't practical. So what you are saying to the Gov't is 'Fuck you! I want to look at porn in private! I don't care if it means you can't sniff for early warnings of an attack!"

I know you care about privacy. I care about privacy too! But there are certain things I will not do to pay for them. I will not let my privacy be exploited as a weakness. If you were to replace the DOJ with Time Warner, I wouldn't be having this convo now. I'd say "Warner sucks!" and get modded up for it.

"They adapt to our surveillence abilities; hence bin Ladin stopping use of his cell phone when he learned we were recording all his coversations." -- Yep. And when the US Gov't says "We can't sniff the e-mail because too much of it is encyrpted" then Bin Laden will be able to use AOL to communicate with his brainwashed cronies. At least with carnivore, they have to be extremely careful and always on their toes.

It's okay if you disagree with my opinion. But I don't think I could restate my points much clearer than they are now. My safety is far more important to me than anything I have in e-mail or in the sites I go to. TO tell you the truth, I think you're being idiotic if you are posting sensitive information on the net somewhere. If your mail's not encrypted now, I don't know why you think you should start all of the sudden. Some bored tech support guy at your ISP who's only making $10 an hour could get bored and watch what you're doing. You have a lot more to fear from somebody like that than you do the Gov't, by a LONG shot.

Re:we need a standard "envelope" for email

[Fantastic Lad]

Good idea, except sealed envelopes have never stopped aggressive spy activity before, and it certainly won't start now. Indeed, as somebody already mentioned, encrypting a document is like sending up a signal flare crying, "Open me!! I might be important!!"

Further, the better the encryption, the more likely your mail will be examined.

-Fantastic Lad

Re:we need a standard "envelope" for email

[EvanED]

>>
The Gov't already knows my social security #, my date of birth, mother's maiden name, every city I've ever lived, every car I've ever owned, all of my phone #'s, my family history, where I was born, my physical description, and my bank account and CC #'s. They aren't going to gain any more information about me that I find sensitive. If you are an agent for the Gov't and already have access to that info, then you may bug my phone. That right disappears when you attempt to steal my identity.
>>

So your attitude is "they already know too much about me, so it can't get any worse if they know who I e-mail, who I get e-mail from, what web sites I visit, who I call, who calls me, as well as the content of those e-mails and calls? Personally, I see a big difference between knowing where someone is born and the information that would be legal for them to order under this law.

>>
The only benefit to that is you'll thwart the US's abilities to collect info to prevent Sept 11th Part II from happning. As I said, the Gov't has nothing to gain but your personal safety. It's not like MS is calling for this.
>>

...and even more complete control over what we see or who we talk to. In the meantime, why don't we tag everyone in the country with an electronic transmitter that constantly sends our location to the FBI headquarters. Then it would be an easy task of finding out who was present at the scene of a crime, etc. And if we have video cameras constantly coverning every square inch of the country, then we have the evidence that the criminal was there. Finally, since it's of course making everyone safer (*phew!*), the fact that it goes against "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated" doesn't really matter.

>>
I realize I didn't make that point rather clear, but be serious. What I meant: By thwarting the US's ability to keep tabs on everybody's email, you're making it futile for the Gov't to look for hints that we're going to be attacked again.
>>

So all the government has to do if no normal person encrypts their e-mail is to look for encrypted messages? Then what? Decrypt them? See you in a few years at least - if the military's entire computer network is put to work; if a just a few desktops are set on the task, see you in a few million or billion years. Go arrest the person? On what charge (the "In all criminal prosecutions, the accused shall enjoy the right to a speedy and public trial...and to be informed of the nature and cause of the accusation" that the people in Padilla's case are overlooking)? What if I send a random string of characters through the mail system? Will I be flagged as a terrorist because one of my messages "looks" encrypted?

>>
So what you are saying to the Gov't is 'Fuck you! I want to look at porn in private! I don't care if it means you can't sniff for early warnings of an attack!"
>>

And what happens when the US discovers an encrypted message? Even if they know it's from a terrorist to another terrorist, without decrypting it, they have nothing. What would the US do if bin Ladin said "TERRORIST ATTACK TOMORROW!!!"? Well, we gotta close down airports. And bus lines. It would be a good idea to keep people off the road too. So the country entirely shuts down for a day. The attack may or may not happen. If not, will it happen as soon as you start the country up? Probably, and then you're worse off than you were before.

>>
I care about privacy too!
>>

Which is exactly why you wouldn't care if I listened to all your phone conversations??? C'mon, some consistancy here... at least within a single post if not between them...

>>
But there are certain things I will not do to pay for them. I will not let my privacy be exploited as a weakness.
>>

You haven't addressed my statement that this is useless. As I've spread throughout this post so you'd be SURE to see it, as well as making it perfectly clear in a reply to anohter of your posts, the TERRORISTS WILL BE USING ENCRYPTION. They know that the US has had the capability to spy on them this entire time, this law won't change things except to allow them to keep records, and legal up the spying that the government is doing. So they encrypt. So the rest of us sending plain text messages don't give the government any more information.

>>
If you were to replace the DOJ with Time Warner, I wouldn't be having this convo now. I'd say "Warner sucks!" and get modded up for it.
>>

Oh? Given that the DOJ wouldn't be able to increase national security for it (see above), why does it make a difference if the DOJ or Warner does it.

>>
Yep. And when the US Gov't says "We can't sniff the e-mail because too much of it is encyrpted" then Bin Laden will be able to use AOL to communicate with his brainwashed cronies. At least with carnivore, they have to be extremely careful and always on their toes.
>>

Which means they alread encrypt it.

>>
If your mail's not encrypted now, I don't know why you think you should start all of the sudden.
>>

It's not any particular thing about the climate now; it's just that I've (we've; we == the other people supporting this envelope) *always* felt that e-mail should be encrypted.

>>
Some bored tech support guy at your ISP who's only making $10 an hour could get bored and watch what you're doing.
>>

Seems like you're arguing for encryption there. If you encrypt your stuff, that $10/hr tech guy can't do anything.

Re:we need a standard "envelope" for email

[NanoGator]

"You haven't addressed my statement that this is useless. As I've spread throughout this post so you'd be SURE to see it, as well as making it perfectly clear in a reply to anohter of your posts, the TERRORISTS WILL BE USING ENCRYPTION."

For the last fucking time:

Encrypting the mail is a flag that the Gov't will have to investigate. IF everybody does it, then the Gov't gets no help from us, just noise. "Hmm, odd, there's an internet cafe in Miami where somebody keeps sending encrypted messages." Your plan would cause this "Hmmm.. Miami is sending encrypted messages."

Simple as that: You're mucking with the Gov'ts ability to look for signs of an attack. All so that you can hide who you e-mail from the Gov't, even though that information isn't hard to get by somebody intent on looking at you. And no, I'm not arguing for encryption, I'm arguing about expectations. You are a fucking moron if you think "I can email my mother in complete piracy." Encryption can always be broken. Somebody who wants to do that is gonna do it anyway, so you might as well make the Gov'ts job protecting us easier. The internet is PUBLIC. If I were really worried about my messages getting read (again, you are a fucking moron if you think they aren't already by some script kiddie) then I'd be happy to encrypt them and let the Gov't have the key.

The whole Internet is too public to use as a private communications tool! The Gov't isn't interesting in sniffing you for information unless you give them reason to.

Why don't you just use your phone? Why don't you go meet the person face to face if your information is oh so valuable. Don't sacrifice my safety over it.

If you're still saying "So you mean this [OVERSIMPLIFIED EXTREMIST CASE].", then you don't get my point, and I'm not wasting any more time getting you to understand. If you are going to be willfully ignorant of what I'm saying, then there is nothing I can do to help you understand my point. I don't expect you to agree with me. That's fine. All I'm asking for is understanding. "The Gov't may have access to my e-mail. They may protect my interests. They may stop Al Qaeda without my interferance."

If you twist my meaning to say "Everybody's email should be public!" then you don't get it. That's where the word 'ignorance' will start getting used alot. This is not a black and white world. I don't think you personally using encryption will promote terrorism. I think the whole world doing it will secure the internet for terrorists to use.

Think about that before saying "If everybody used encryption..."

Re:we need a standard "envelope" for email

[NanoGator]

Just wanted to thank you for an interesting response. I was getting sick of that other guy making me out to be extremist.

My opinion is that I'm willing to give up some of my rights to ensure my safety. I don't consider the internet to be a private place in the first place. I don't think the government running a program to scan my traffic for patterns is any worse than what is already availble to somebody to wants to see what I'm up to.

To me, the difference is that it's automated. I don't remember anybody bitching because their telephone bill came in with a list of who all they called and for how long.

Re:we need a standard "envelope" for email

[EvanED]

Actually, there have been several instances. Here are three:

1. In the 1790s, the US passed the Alien and Sedition Acts, IMO the most unconstitutional laws in US history. Basically, they made it illegal to criticize the government. At the time we were in an undeclared war with France, so that was the rationalization used (but actually it was almost certainly to keep the followers of Alexander Hamilton in power at the expense of the followers of Tom. Jefferson). Now, these were repealed, I believe under Jefferson.

2. The infamous quartering of the Asian population in internment camps during WWII. They were released, and the epsiode is seen as among the darkest of the many dark spots in US history.

3. The Sedition Act and Espionage Act were passed in 1918. The Sedition Act again made it illegal to speak out against the government of constitution. These were upheld in the Supreme Court because of the war. The ruling includes the "clear and present danger" and the "fire" in a crowded theatre statements. Again, these were repealed following the end of WWI (though a little belatedly; they were still used through 1920) and I believe those convicted under them were pardoned by Wilson.

So there is some hope.

Re:we need a standard "envelope" for email

[EvanED]

>>Encrypting the mail is a flag that the Gov't will have to investigate. IF everybody does it, then the Gov't gets no help from us, just noise. "Hmm, odd, there's an internet cafe in Miami where somebody keeps sending encrypted messages."

First, I suspect there are already enough people who use encryption to keep business, etc. documents under cover that the government couldn't investigate all.

Second, what are they going to do if they find someone using encryption? Sure, in the case of an internet cafe, they might be able to nab some evidence from a keyboard tap or something (with the permission of the cafe owner), but if the suspect is doing it in his house, they're somewhat out of luck. Tapping the keyboard or looking over his shoulder becomes illegal without his permission or a warrant (wouldn't be able to get one on such flimsy "evidence"), so the investigators are left to look into phone records, background, etc. Then we're back with there's already enough encrypted info floating around this would be a daunting task. Granted, they might spot that the person is using an invalid visa or whatever, but that just means the terrorists would have to be more careful.

>>Encryption can always be broken.

Yes, it can. (Well, except one-time pads, which is another story, and quantum encryption, which doesn't exist except in theory.) However, "Encryption can always be broken" and "Encryption can always be broken in under a few millenia" are two different ststements. Try cracking a 4096-bit RSA key while the information it encodes is still useful.

>>Why don't you just use your phone?

Because the government is snoopong it. (Eschelon)

>>Why don't you go meet the person face to face if your information is oh so valuable.

What if that person is spending a year in Germany (I'm in the US) and you carry on regular conversations? Becomes a bit impractical now.

Re:we need a standard "envelope" for email

[milovoo]

>"Don't bother using an over-simplified metaphor to prove me wrong. It means you don't understand my point."

Let's say I have a handful of marbles, and each marble represents a personal freedom. The nice man from the government wants to take one of your marbles so that he can make sure you are safe, and are not going to hurt yourself by having too many marbles. Fine, I still have a lot of marbles left. But if tomorrow the nice government man wants another one, and another one the day after that, I am going to start to want to resist a little bit to the government wanting my little freedom marbles, no matter how 'noble' the cause.

(I just wanted to see if it still held up with a really simple metaphor and I think it does)

-milo

Re:we need a standard "envelope" for email

[NanoGator]

Nope, it doesn't.

"But if tomorrow the nice government man wants another one, and another one the day after that, I am going to start to want to resist a little bit to the government wanting my little freedom marbles, no matter how 'noble' the cause."

You're assuming that the Government wants to take your freedoms away. There's no evidence of that. It isn't in the US's best interests to control everything. If it were looking for an opportunity, it had one on 9-11. Did things change? Yep. But it was nowhere near as drastic as it could have been.

It's more like this: The man from the Government wants to take one of your marbles so that he can make you safe. You're happy to give him this one, but you're overly-cautious of giving him any more because you're working under the assumption that he wants all your marbles. You don't realize that the constitution prevents him from taking more marbles. You also don't realize that he's not after all of your marbles.

Try to picture how this metaphor would be different if we were living in Nazi Germany. You'd instantly understand the way things could have been had the US wanted to get rid of Free Speech and privacy. I'm not a fan of George Bush, but he's not really an extremist.

Re:we need a standard "envelope" for email

[milovoo]

>If it were looking for an opportunity, it had one on 9-11.
>Did things change?
>Yep. But it was nowhere near as drastic as it could have been."

Ummm, are you agreeing with me? The fact that we have not yet
had to get a new national ID card, does not make me willing to
endorse the current plan.
Yup, it could be worse.

>Try to picture how this metaphor would be different if
>we were living in Nazi Germany. You'd instantly
>understand the way things could have been had the
>US wanted to get rid of Free Speech and privacy.

Oh, my apologies, I didn't realize that you had lived through all
that, I guess you're right, I just couldn't possibly understand.
It's OBVIOUSLY totally different.

I yield, because:

a) I think you're not really reading what I wrote
b) the whole "govt should be more conservative or
less conservative" argument is not likely to
generate new results
c) I'm not sure if you invoked godwin's law on purpose

-milo

Re:we need a standard "envelope" for email

[NanoGator]

lol @ Godwin's law. -- thanks for mentioning that, I learned something new today.

I'm sorry, I couldn't think of a better example. I really did try to come up with a better/less extreme example. :)

I'm just saying that if the USA was really out to get all our freedoms taken away, things would be drastically different. We'd have real strict laws about what can be published on the internet. The ID card would be around right now. TV would be nothing but commercials for the miliatry.

Instead what I see are trigger happy military types wanting extremist action, and the Gov't and the people are saying "no, that's too far". So there's lots of bickering

Frankly, I'm comforted by the bickering. I was really worried that 9-11 would have really locked down our freedoms, but I'm not seeing much of that. The example I used in another post here is that Portland had the Rose festival a couple of weeks ago. We had military ships from USA and Canada docked here. They put up barracades, restricted accesss, and had fewer ships. To my surprise, though, you could still board them.

One thing that you have done though, and I appreciate this, is that you've shown me that I do take some things for granted. I live in a 'Nar, there are enough people defending my rights that no matter what happens, I'll be okay.' world.

I needta break out of that. It is reaaaally easy to be comfortable in USA.

On the radio this morning

[OpenGLFan]

This morning I was listening to "the Bob and Tom show", a syndicated radio program. The discussion topic this morning was "How do you goof off at work?"

The third caller worked at a bank, and she and her co-workers amuse themselves by looking up old high school acquaintances. I don't have a quote, but she said something along the lines of it being fun to see who was overdrawn and who had huge mortgages.

Powers will be abused. Who needs Big Brother?

Re:On the radio this morning

[OpenGLFan]

No. We should be aware that morons WILL have access to our data, so we should think hard about what we allow to be collected.

(Methinks I fed a troll -- or an idiot. But I'll post anyway...)

Haha

[Anonymous Coward]

Europe still blows worse.

Another good reason to use freenet

[mmacdona86]

http://freenetproject.org or something like it.

UPDATE

[SashaM]

UPDATE:U.S. Denies Data Retention Plans

Re:New Auto-Surfing Apps

[drpentode]

Where can I get an auto-surfing app? Sounds like something out of the Matrix. (You know the scene where Neo is sleeping and his computer is doing searches on Morpheus?)

Irony

[No Such Agency]

If Kevin Poulsen was still up to his old tricks today, this would be exactly the sort of setup that would ensure he was busted very quickly...

Confucious

[SlashdotTroll]

Confucious say:

They who want log sit on toilette all day.

I cannot agree any more.

What's the fuss?

[meta-monkey]

Many other posters have already commented that the update to the story says the Gub'ment denies attempts to do this. I'm surprised this story wasn't taken with a grain of salt in the first place...you know this wouldn't stand up to any kind of court scrutiny.

Really, the idea that the government can arbitrarily spy on anybody, but only look at later if they have a reason, violates your 4th Amendment rights against unreasonable searches (OT: sometimes I feel bad for the 3rd Amendment...it just gets completely ignored. Nobody ever takes to the streets demanding their 3rd Amendment rights be protected. Oh well). The federal government has no power to inventory your entire home, or keep a list of every person with whom you correspond by mail, and as such, they have no similar power to log your email headers or http requests. I don't see this one happening any time soon.

Re:What's the fuss?

[bnenning]

sometimes I feel bad for the 3rd Amendment...it just gets completely ignored

Actually I recall seeing a semi-serious argument against the SSSCA on 3rd Amendment grounds. The reasoning was that mandating a "cop chip" in all electronic devices to make sure you don't do anything unapproved is effectively quartering an agent of government in your residence. Obviously quite a stretch, but no more so than any number of acts Congress has tried to justify using the Commerce Clause.

Re:What's the fuss?

[meta-monkey]

Fascinating. I actually considered that while writing my previous post. In a way, the government forcing an ISP to monitor customers for their benefit could be considered "quarting" a government agent in the ISP's place of business. Specifically, the 3rd Amendment says the government can't quarter soldiers in people's homes, but this may well extend to businesses. Note, IANAL. However, if such legislation were enacted in support of the War on Terror (TM), then it probably wouldn't violate the 3rd Amendment, which allows the government to quarter soldiers in your home in time of war. Here's the complete text:

Amendment III

No soldier shall, in time of peace be quartered in any house, without the consent of the owner, nor in time of war, but in a manner to be prescribed by law.

Re:What's the fuss?

[macdaddy357]

Amendment III No soldier shall, in time of peace be quartered in any house, without the consent of the owner, nor in time of war, but in a manner to be prescribed by law. They can now say we are in a time of war. A perpetual war against a boogeyman enemy that is everywhere and nowhere at once, terrorism. The old boogeyman was communism, and the old war, the cold war. Any law they pass now is "in a manner to be prescribed by law." The constitution and bill of rights are ultimately pieces of parchment. They will not protect you. The Philosopher, Thamas Hobbes once said that the people have what ever rights that the state chooses to extend them. Nothing more.

Re:What's the fuss?

[macdaddy357]

Oops. A typo. That's Thomas Hobbes.

Re:What's the fuss?

[meta-monkey]

Man, that Hobbes...he and Calvin were always getting into all kinds of trouble...

seriously, though, yes, that's why the price of freedom has always been eternal vigilence. It comes from all sides, though. The Right uses external boogeymen, like Reds and A-rabs, to remove your civil rights. Hey, I've got no problem with the government fighting terrorists, but please do it by going into other countries and shooting bad guys, not by spying on me, thanks. The Left, however, uses internal boogymen. Corporate America (tm) is so evil, sorry, we gotta ignore that whole "free speech" thing so we can enact Campaign Finance Reform (insert angels singing here). Property rights? Well, gee, sure, gosh, but come on, Please Think of the Children/Poor/Snail Darters so we gotta take more of your money, 'k, thanks. Sigh. Tends to get one awful depressed...

Re:What's the fuss?

[DEBEDb]

No soldier shall, in time of peace be quartered in any house, without the consent of the owner, nor in time of war, but in a manner to be prescribed by law.

Oh, that's easy. It says "in time of peace".
Didn't you hear - there's a war going on?

Re:What's the fuss?

[meta-monkey]

btw, ROFL at your sig. I just about spit out the canteloupe I was eating.

Mini Love

[Nf1nk]

I am partial to having it renamed to the ministry of love

(orwell reference)

Encryption?

[JDizzy]

Who cares what the government logs, when all you simply do is encipher all your traffic to trusted hosts. With anonymous Proxy services being easy to use and setup... more people will simply take notice that they exist, and begin to use them. Some people might even resort to paying a premium to under the counter internet service from their Broadband having friends Finux server. I wonder if this legislation takes into consideration that IP6 can travel right atop of traditional ip4, and can trick out attempts to monitor top level protocols, like email. Besides, you opt out of the monitoring by simply opting out of your providers email facilities. Other forms of message passing exist, and are in use by motivated people.

The USA is the top internet using place on the planet, and Europe is no doubt second, with Asia/Pac being third. So how the USA officials plan to effectively monitor the data required is interesting. Logically one is left to wonder how well the USA carnivore system is working these days, and its sister Echelon. To resort to forcing these ISP to log data on behalf of the government officials seems very controversial. Almost as if the government is passing on the burden of Carnivore on the backs of the struggling ISP's in America. The interesting thing is: who is to prevent the ISP from simply not logging all the data the government officials claim to require? How would they be able to prove the ISP otherwise?

Not first post.

[Disevidence]

The way i viewed it was much akin to the Australian censorchip laws. Its probably a token political effort designed to say theyre protecting the children and stopping terrorism. Its extremely hard to pin down anything really, and if you want to remain unknown, theres always the library.

So I'd say, its political point scoring, with no real teeth to it. But hey, it could always be that they progressed to the next chapter of 1984.

Re:Not first post.

[morgajel]

I don't know what library you go to, but I have to sign up and provide photoID to use a library computer.

Re:Not first post.

[Disevidence]

Im in Australia, all you have to do is sit down. At least i do here.

Re:If it happens - show them how futile it is...

[rbofh]

Even better, there's this thing called encryption. Let them record all the blowfish encoded data they want... they'll never get my session key. :-)

I see a bright future for off-shore encrypted proxys and mailhosts.

Seems impossible to do

[Coward Anonymous]

How would they decide what is loggable and what is not? By looking at ports 80 and 25? The solution to that is simple, switch all your "sensitive" browsing to port 666. Use PGP for your email or perhaps use something as mundane as ICQ, or FTP drop points.
In addition you can have a script generating spurious emails and web browsing requests all day long so that you quickly overwhelm anyone's ability to actually log anything of substance (if you are really dedicated, you could probably generate 1GB of trash data a day).
Whoever is thinking about these moronic ideas appears to be technically ignorant.

Re:Wake up and smell the coffee

[neocon]

Um, yeah, ok, except that nothing of the sort has happened. Care to provide credible cites to anything like that?

Great

[The Pi-Guy]

Just the opportunity:

Hey all! Has anyone seen that AL QUEDA member lurking around here? I coulda sworn I saw him with one of the few NUCLEAR BOMBS in the world.

... d'oh! You mean they're not monitoring content?? That takes ALL the fun out of it!

--pi

Industry concern?!

[sulli]

From the updated article:

But a Justice Department source said Wednesday that data retention is mentioned in the strategy only as an industry concern -- ISPs and telecom companies oppose the costly idea -- and does not reflect any plan by the department or the White House to push for a U.S. law.

They just have no fucking respect for our rights at all in the DOJ, do they? None whatsoever. I mean, come on - industry concerns?! Sure, industry would have concerns, but have any of these fucknuts heard of liberty and/or privacy?

Send Lady Liberty back to France, it's over. Sell the Declaration of Independence on Ebay, clearly it has no meaning for our appointed officials.

Re:0wn3d USA

[neocon]

Um, yeah. Except that unlike the rest of the world, we're not trying anything of the sort.

It won't pass a court challenge here...

[trims]

I've read the proposal that passed the European Parliament, and if the policy the Bush administration is attempting to put in place is similar, then it won't pass Constitutional muster. It fails on at least three major points:

• It attempts to require a private entity to perform an action that is explicitly forbidden to the government. The government does NOT have the right to monitor all traffic (be it email, web, internet, snail-mail, phone, or whatever) without a court-order, and can only invoke the National Security exception in narrowly-defined circumstances. In this case, the government is attempting to make an end-run around this prohibition by requiring a private source to do the collection; however, the courts have consistently ruled that the private party is acting at the behest (and defacto control) of the government, and therefore is under the same obligations and restrictions as the government.
  
  
• A bunch of legislation passed in the 1990s grants ISPs "common carrier" status. One of the central legal tennants of Common Carrier is that it is traffic-blind. This applies not only to the carrier itself, but any organization attempting to force the carrier to become traffic-aware (ie know what is being transmitted). Common Carrier is a very well-established concept, and such a executive policy cannot overrule a legal precedent such as it without an explicit law from Congress.
  
  
• finally, practicallity is an issue. The government can legally require that I prove I'm a green Martian before taking an airplane trip, but it won't pass a court challenge because it is an impossible requirement. A slightly less extreme standard is known as Onerous Burden, wherein a plaintiff can contend that such legislation or regulation places an unreasonable burden to comply with it; such a case would be (for example) if port fees to dock at a port exceed the value of the ship docking there.
  

I don't think they really realize the volume (either the US or Europe) as to what they're requiring, either. A rough estimate is that an email header is 1k, and that a log of an http request is .5k. For an average user, 1000 http requests (remember, each picture/icon is a new request) and 10 emails per day would be typical. That's about 500k per person per day. For a mid-size ISP with 10,000 users, that's 5GB per day, 1.825 TB per year. Even assuming good compression of 90%, that's 180GB per year. Given that you would need to get a good machine and lots of redundancy for it (remember, this is a LEGAL requirement), I can easily see it costing $30k PER YEAR or more for the hardware alone for log space (plus the additional costs to upgrade the routers/mail servers/proxies and other infrastructure to allow for such vast logging in the first place). I'd estimate that it would be at least triple that, when all other factors are included. Even a $30k capital expenditure per year is a pretty good chunk of change for a company with a probable revenue stream of $3M per year. That's a 1% value of gross receipts (conservatively). And what about someone like Earthlink or similar, who has millions of customers? You're looking at requiring Terabyte storage systems costing multi-millions of dollars.

Even though I've seen some really dubious legislation and policies over the past 10 years (e.g. DCMA), I don't think this one will fly.

-Erik

Re:It won't pass a court challenge here...

[kindbud]

I've read the proposal that passed the European Parliament, and if the policy the Bush administration is attempting to put in place is similar, then it won't pass Constitutional muster.

DMCA?

USA Patriot Act?

2000 Presidential Elections?

Since when has not passing constitutional muster been a barrier to the government doing whatever it wants? The only barrier these days are the poll numbers, and they can just make those up and put it on the news, and most people will fall into line. So the only effective barrier is what they think they can spin in the media and get away with.

If they're following the UK...

[WolfWithoutAClause]

then all they're doing is not TELLING you they are tracking email headers, dialled phone numbers and http connections. (In cryptographic circles it's called Traffic Analysis.)

Blunkett went all uncharacteristically contrite on us, but according to the Register this just means that they're not actually formalising what they are doing anyway.

They probably really are handing around traffic analysis data like smarties. "Oh looook what he's accessing!" Probably there's people out there being blackmailed right now; there's bound to be some bad apples with access to this data.

It's called Peek-A-Booty

[MsGeek]

http://www.peek-a-booty.org/pbhtml/index.php

It was originally designed to help Chinese Internet users get around the Great Firewall Of China.

Looks like the US and EU will be needing it too...[sigh]

Love/Hate the idea

[gerardrj]

Outright I hate the idea, this is just pre-emptive search/seizure. The gov would only propose this because it's in the digital domain where it's A: feasable, B: deemed by J. Pulic to be a non-issue. The could NEVER get such a thing in to action with physical mailings.

But then I thought.... If every ISP had to monitor port 25, isolate all to and from IPs and email addresses (forged or not), and fill up all those hard drives, tapes and whatnot...
Can you image how fast SPAM would drop off as the ISPs attempted to control the now real costs of hosting spammers?

Re:Love/Hate the idea

[PaulBellini]

Heh, you wanna maybe check if your .sig agrees with your post?

Re:Love/Hate the idea

[locutus2k]

It seems to me the U.S. is taking on more and more communist tendencies. This is borderline insane. President Shrub just keeps trying to tighten the grip, yet the US does not have the right nor the responsibility to police the internet, and force this country's ideals on other nations.

Re:what if you are the isp?

[wo1verin3]

I guess ISPs themselves will go back to old fashioned memos....

Imagine what happens when admins are backing up/reading the days e-mail and read the subject "Fire Admins"

So...

[neocon]

... now that this turns out to be an unsubstantiated rumor passed on by someone at securityfocus who couldn't be bothered to show a little journalistic integrity, is there any chance we'll see an apology from the nutjobs who come out of the woodwork to shout `See! The US is bad and stuff! The administration is just like the Nazis, dude' whenever a rumor like this comes along will apologize?

No, I guess not. For people that far out on the fringe, there is little hope of something like the actual facts of the situation interfering with their rants...

As long as data goes in the clear ...

[cfortin]

... we can't count on laws to protect our privacy. With the number of governments ( and the increasing disregard for liberty the "war" on terrorism is breeding ) sifting our online traffic increasing daily, its past time to move crypto into the main stream. Let them listen to the hum of white ( almost ) noise.

Re:As long as data goes in the clear ...

[neocon]

the increasing disregard for liberty the "war" on terrorism is breeding

Can you provide any evidence of such a disregard?

Re:As long as data goes in the clear ...

[Tazzy531]

How bout these:

• 60 of 98 FBI Terrorism Cases were thrown out because of lack of evidence - The article even has a quote from an FBI spokesman admitting to arresting and trying to prosecute people knowing that it would never go through.
• Village Voice Analysis - It's the Village Voice, take it with a grain of salt. (I'm just adding it to this list because it is quite insightful.
• Business Week Article discussing the various infringement of civil rights
• NYTime Editorial on naming an American citizen as an illegal combatant
• Ohio State graduates threatened with expulsion/arrest if they "demonstrate or heckle" during Bush's speech - "But immediately before class members filed into the giant football stadium, an announcer instructed the crowd that all the university's speakers deserve to be treated with respect and that anyone demonstrating or heckling would be subject to expulsion and arrest. The announcer urged that Bush be greeted with a "thunderous" ovation.
• Federal Courts strike down Bush Administrations attempt to prevent people from challenging censorship laws
• Justice Department raising questions about case on John Lindh
• Another NYTimes article on illegally detaining American Citizens

Also if you think this and the USA/PATRIOT Act is unfair, sign the petition to get it repealed

Re:As long as data goes in the clear ...

[neocon]

OK, let's look at those, shall we?

• 60 of 98 FBI Terrorism Cases were thrown out because of lack of evidence -- isn't the key phrase there `thrown out'? Isn't this, in fact, an example of the system working as it is supposed to?
• Village Voice Analysis [villagevoice.com] - It's the Village Voice, take it with a grain of salt. -- or a lot of salt as the case may be. The Voice is, of course, the premier voice of the Chomsky/Mailer new left. Even though it has mellowed somewhat with old age and new management, it's hardly a voice of journalistic integrity...
• Business Week Article discussing the various infringement of civil rights [businessweek.com] -- the columnist seems completely unaware of many of the details of the case (such as the fact that Muhajir has had a lawyer at every stage of the process), and of the supreme court precedent (Ex Parte Quirin). He does manage to fill in some general paranoia for a lack of knowledge of the case, but that hardly makes good journalism, now does it?
• NYTime Editorial on naming an American citizen as an illegal combatant [nytimes.com] -- more or less the same. But of course, we know the NY Times editorial page's stance on the matter.
• Ohio State graduates threatened with expulsion/arrest if they "demonstrate or heckle" during Bush's speech [yahoo.com] -- expulsion from the event, of course, but that makes rather less exciting a story, now doesn't it. Anyhow, what an unnamed official of a state school has to do with the Bush administration is unclear.
• Federal Courts strike down Bush Administrations attempt to prevent people from challenging censorship laws. -- while I'm a big fan of the RMN, and especially of Dave Kopel, this seems little more than an tendentious headline about what is essentially a contract law dispute, no? At any rate, didn't the court strike down this action, and rule that even though Mr. Stillman had signed a contract not to, he would be allowed to publish?
• Justice Department raising questions about case on John Lindh -- but nothing in this article alleges any lawbreaking, merely that some unnamed officials are alleged to have had not-very-specific `concerns'.
• Another NYTimes article on illegally detaining American Citizens [nytimes.com] -- this is no different from the other Times piece. It's amazing how many pundits are willing to declare something `unconstitutional' without bothering to read the constitutional law precedent which the administration has very clearly pointed to (Ex Parte Quirin).

IOW, there are a lot of tendentious claims here, but little backup for any of them.

Re:As long as data goes in the clear ...

[H310iSe]

*sigh* ok fair enough, I mean, accepting something as prima facia true w/o looking at the underlying info is, well, something to be avoided. I have to run but if I can get back b4 this discussion closes I'll dig something up for you. Until then 'absolut power corrupts absolutely' applies here and history informs - Look at the FBI/CIA operations from the '50s-late 70s, look what the CIA has done in El Salvadore, in Guatamala, Nicaragua etc. Look at what the fbi did under hoover, against anti-vietnam protesters, and, um, democrats. Now ask yourself if you want these people to be able to get together and have a party in your backyard (you won't be invited, unless you're being indited). Think about it, even if you have 'nothing to hide' that's fine, but just because you control your internal moral ethos by the rules those in power dictate doesn't mean we all do, or that we want to. I don't want to feel that I'm obliged to censor my thoughts, in my own house for christ's sake, in fear that someone may be listening and if these thoughts are out of favor now (or loose favor in the future) they could be called up and used against me by people who, don't forget, have power over me.

For example, if the FBI comes, arrests you, throws you in jail for a month, then you get out (due to lack of evidence (see above)) - did they have to do anything else to destroy you? what happened to your house (who paid your rent/mortgage), what happened to your community respect/standing? what happened to your friends, your sig. other., what happened to your raise, your promotion, your job?

see?

Re:As long as data goes in the clear ...

[neocon]

OK, let's go through what you're saying here, shall we:

• Um... letmecheckno. The Gov't is only supposed to arrest people it has in good faith can be successfully prosecuted. Otherwise, it's abuse. -- Do you have any evidence that the government did not believe it had ample evidence to convict in these cases, or are you just spreading FUD?
• Um... you mean up until he was given to the Navy and put in Solitary Confinement, right? -- under the precedent established in Ex Parte Quirin, and with judicial review of each stage. Even as we speak, his lawyer is filing a motion in a Manhattan courtroom to reverse his being deemed an enemy combatant. As long as he is an enemy combatant, however, he is subject to military jurisdiction.
• Take a note for future reference, that wasn't a piece of journalism -- It was an editorial. -- and what, exactly? As long as it was an editorial it doesn't have to get it's facts right? Sorry, I'm not buying that...
• I just love how you left out the word "arrested". -- Um, huh? You mean the seventh word of the bit you pasted from my post? Doesn't look `left out' to me, but the larger point still stands: what does some statement which may have been made by an unnamed official of a state school have to do with the Bush administration? Anything? And do you have any reason to believe that someone disrupting any other event at Ohio state would not be expelled or arrested?
• Actually, it's an article about what should be classified and what shouldn't. And it's not even about that, it about whether he can take the matter to court. -- did you read the article? Again, this is a contract law question. Mr. Stillman signed a contract when he went to work for Los Alamos. He later decided to violate that contract. The courts ruled that he could. None of this has anything to do with `censorship'.
• Fucking beautiful. Replace "unnamed" with Jessylin A. Radack, and replace "not-very-specific 'concern'" with "coerced confession" It's in the "article". -- no, what's in the emails attached to the article is a discussion of what procedure should be taken in interviewing Mr. Lindh. There is no suggestion of a `coerced confession' at all.
• You should go look up the credentials of the author -- Harvard Law Professor Laurence H. Tribe. -- I'm very familiar with Mr. Tribe's credentials -- namely that he is a partisan hack who has famously made such convoluted arguments as the claim that not favoring certain races in college admissions would be a violation of the equal protection clause of the fourteenth ammendment.
  At any rate, were he familiar with Quirin, he would know that among other things, the SCOTUS found:

  Citizenship in the United States of an enemy belligerent does not relieve him from the consequences of a belligerency which is unlawful because in violation of the law of war. Citizens who associate themselves with the military arm of the enemy government, and with its aid, [317 U.S. 1, 38] guidance and direction enter this country bent on hostile acts are enemy belligerents within the meaning of the Hague Convention and the law of war. Cf. Gates v. Goodloe, 101 U.S. 612, 615, 617 S., 618. It is as an enemy belligerent that petitioner Haupt is charged with entering the United States, and unlawful belligerency is the gravamen of the offense of which he is accused.

  and

  petitioners here, upon the conceded facts, were plainly within those boundaries, and were held in good faith for trial by military commission, charged with being enemies who, with the purpose of destroying war materials and utilities, entered or after entry remained in our territory without uniform-an offense against the law of war. We hold only that those particular acts constitute an offense against the law of war which the Constitution authorizes to be tried by military commission.

So, again, if these are the only claims you can find against the current administration, I'd say they're doing pretty damn well.

Re:As long as data goes in the clear ...

[neocon]

Ah, yes, the left's littany comes out: `El Salvadore ... Guatemala ... Nicaragua'. Do you actually have a complaint about US actions in any of these countries? Faced with a totalitarian regime in Nicaragua which was oppressing its own people and staging guerilla raids into neighboring countries, we helped fund an already-existing local insurgency which fought for and won democratic elections while helping the neighboring countries defend themselves. This bothers you why, exactly?

As for your false arrest scenario, this is a risk any time we allow the police to make arrests, and is why they are required to present an indictment within 48 hours for criminal cases. So unless you are suggesting that we never arrest anyone, this is a risk we will have to face.

Now, if you have any evidence at all that the FBI is arresting people who it does not believe it has a credible case against, go ahead and present it. You haven't done so yet, however.

Re:So... Read "USA Patriot Act"

[neocon]

I have read it. All it does is extend the tactics which were already ruled constitutional 40 years ago when JFK applied them to the mafia to organized terror networks. Not as scary as some of the claims being made about it here, I know, but hey, sometimes fact isn't as exciting as fiction...

and then they will...

[josepha48]

.. sell your email address to the asians so that they can spam you to death...

Big Brother

[uncoveror]

Here is yet another example of the federal government's aspirations to be big brother. Since 9-11, almost nobody will stand up and oppose this stuff. The data they could collect this way might be too much to digest, but they would sure try. It could be 1984 by 2004. I wonder if they monitor webcams? http://www.uncoveror.com/webcams.htm

Re:Big Brother

[zoloto]

orwell was right, the Party is sure to dominate and eradicate even the word Freedom. geekspeak no more for doublething will have wiped out any idea of independance.

Forced proxies and such...

[.pentai.]

So does this mean that ISP's are going to be forced to pipe ALL port 80 traffic through a proxy, because hey, how else do they get EVERY web page we go to...

Either that or they just keep track of what connections are being made through them to port 80 of places...but then what about web sites simply not on port 80...seems an easy enough way for "terrorists" to avoid being caught.

And then there's the issue of people who run their own mail servers...I'd LOVE to see the government FORCE me to log all my own damned emails. It's not like it's hard to setup your own sendmail box and use that instead of your isps

Re:Forced proxies and such...

[gerardrj]

Your ISP most likely has only one access point to the backbone provider. A packet sniffer or two would be all that is necessary for them to scan every single bit of information that traverses their systems.

Yes moving services to non-standard ports would help you avoid the most rudamentary detection, but if the sniffer starts looking for any packets with http:// in them and then monitors that connection you are still vulnerable.

SSL would make things a little more secure, but what are the chance that every web server will offer SSL connections to every user? The CPU overhead would cause server farms to grow rapidly. SSL still only uses a 128 bit key, and that really is not very secure.

Email... there is no way with current SMTP to prevent sniffing/capture of the smtp envelope. This includes the to and from, and a trail of all the systems the message was passed through. RFC3207 has started discussion on how to ompliment transport layer security similar to SSL to SMTP, thus adding an obsticle to snooping. Still, your ISP could track the to/from IPs of the actual connection.

Such a scheme might allow you email system to look up the public key for the target server, start a connection and send the SMTP headers and message in encrypted form.

The ideal solution to all of this would be for the Gov to just stop spying or trying to spy on its citizens. Of course, evidence show that they keep trying harder and in more secretive ways to do that. Hence MY opinion is that ALL internet protocols should have a secure version that allows an evesdropper to get nothing more than the target and source IP addresses. Said servers should either have a mechanism to offer up their public key on request via the protocol, or identify a location to retrieve it from (along with possible identification verification, ala Verisign[ha]).

Overrated? Why?

[NanoGator]

My parent post here was marked 'Overrated'. I am politely requesting information on what is 'overrated' about it? That kind of implies there's something seriously wrong with my comment, but as of yet I don't see that.

Somebody help? Frankly, I suspect that it was modded down because the person who did it thought I don't value privacy. That's not true at all. I'm just saying I trust a computer to scan my e-mail and retain my privacy, not a human. Once a human reads my email, I get spooked.

The internet is NOT a secure communications medium regardless of what the DOJ wants. So why make yourself stand out to them?

Re:So... Read "USA Patriot Act"

[uncoveror]

I would like to read it. Do you have a link?

GPG

[norweigiantroll]

GPG will protect you from email listening (although I guess they just get the headers, so that won't help much.) Too bad SafeWeb isn't around anymore.

Re:New Auto-Surfing Apps

[Sauron23]

Not an app. but you might try:
Programming Perl
O'reilly
ISBN 1-56592-149-6

Re:finally

[zoloto]

what the f*ck are you talking about?? Computer security are you crazy? This is just another attempt for the government to spy on it's own citizens! Security? Since when does snooping on your neighbors or co workers have anything to do with security? Man you people are f*cking stupid.

Not "Innocent until proven guilty" in EU

[redelm]

Please understand that the EU is quite different from the US. In most countries (except the UK), there is no judicial presumption of innocence. Free speech does not prohibit prior restraint [chilling effect]. Privacy does not include privacy from police and other authorities.

I dislike the European plan. But I also recognize it's a different place with very different attitudes of both police and populace. EU member nations are also free _not_ to enact the plan in their countries. I expect that a number, including the UK, will not.

Time for a secure Internet backbone?

[dfn5]

The Internet is a public place. To say that "No one can see where I browse or who I email" is alot like Microsoft saying that it should be illegal to post discovered flaws in their products to the public.

As far as the individual goes email content can be encrypted. But it looks like the government wants the headers of email and web traffic. Therefore I think there are some things that site maintainers can do to make things more secure.

1. Always run a web site in SSL mode. Even if you don't have a valid site certificate at least the traffic is encrypted
2. Run SMTP over SSL? There must be a way to get things like sendmail to try SMTP over SSL before falling back to unencrypted mode
3. Create a secure Internet backbone? There are virtual Internets out there that run on top of the Internet like mbone and 6bone. If we setup an encrypted backbone using IPsec tunnels site to site then the ISPs wouldn't ever see unencrypted traffic and would have nothing to log. They would just be passing packets with garbage. Then if we play with routing tables if a destination is reachable over the secure backbone the packets would be dumped onto it instead of your local ISP.

Re:Time for a secure Internet backbone?

[randomkind]

Not to be a cynic or anything - that sounds feasable and a good solution; but if that kind of idea catches on and becomes widespread, after a few years they'll (yes, the ominous 'they') wisen up a bit and pass even more silly, restricting legislation. On both crypto and IP. That's why we oughtn't give them any leeway now. Vote with a bullet.

Re:Wake up and smell the coffee

[neocon]

"USA Patriot Act" mean anything to you? Did you bother to check the tap and trace provisions in that? No, because if you're like many of the reps who voted for it, you didn't read the legislation.

On the contrary, having actually read the USA Patriot act, I would point out that it does nothing more than extend actions which were already ruled constitutional forty years ago when JFK applied them to the Mafia to organized terror groups. Not as exciting as the fiction some people here on /. are trying to build up, I know, but hey, fact is rarely as exciting as paranoia...

How about indefinite detention of US citizens without charge or trial (now happening, see the Padilla case).

Mr. Muhajir (ne Padilla) was, in reality, picked up on a material witness warrant, and had access to a lawyer at every stageof the process, under procedures upheld by the 1942 supreme court case Ex Parte Quirin. He is currently contesting said transfer in a court in New York, as is his right. None of this sets a new precedent in any way.

Again, not as exciting as your version, but then, again, reality rarely is.

Re:seig hiel

[macdaddy357]

America isn't Nazi Germany, It's the new Roman Empire. I Just havent figured out if Bush is Caligula or Nero yet.

Re:So... Read "USA Patriot Act"

[neocon]

See here.

Oh no!

[ImaLamer]

I can just hear them now!

Why is it this group of people all visit one web site? And it's from a Russian domain!

Well, we've looked into it sir - it seems to be a, uhhh, proxy

What the hell is a proxy?

We are on it sir!

Misinformation

[SamMichaels]

The problem is the general populus and law makers don't understand what they're saying/hearing. A analogy would help to put things into perspective.

Logging email headers can be compared to the phone company keeping records of your incoming/outgoing phone calls.

Do they do it now? Yes...and most ISPs keep generic logs as it is.

Does the phone company retain ALL the info? No...but they CAN get the info and keep it if you're suspected of doing Bad Things...or they can tap the line. Can an ISP track the same amount of info? Sure...but they don't do it right now unless you're doing Bad Things.

Keeping track of where you go on the web can be compared to driving.

Does your state's dept of transportation keep track of what road you drive, and what time you did it? No.

Does your ISP track what sites you go to and when you go to them? No...unless you have a proxy, in which case they might keep a generic log.

Can the dept of transportation put cameras at all intersections and track your license plate number? Yes...but think of the hideous cost and hideous amount of data. Same goes for an ISP to track where you go.

It's all about perspective...

What they (the govt) shoud do..

[warpSpeed]

Lets require that each user of the net record all of his/her activities while on the net with monitoring software installed on thier PCs. And we all know that the good citizens have nothing to hide and will go along with anything Uncle George says.

Now lets see, who should get the contract for that software... why MicroSoft of course, they are into trust worthy computing now a days.

Secure Tunneling

[Chacham]

Even if they do this, places like Anonymizer will provide Secure Tunneling. Anonymizer also has other services, and they seem to be trusted for their part.

This can handle most web activity. Email can be encrypted, remailed, or signed up for and used through Secure Tunneling, or a similar method.

As an example, when I browsed the web at work, I used Secure Tunneling. For my email, I used Hushmail. Hushmail encrypted all the data that I saw, so it could not be tracked until it left Hushmail's servers.

NNTP is a problem. There are anonymous NNTP sites. Altopia, a site run by a staunch Libertarian, seems to be pretty reliable. You can even pay rather anonymously. More recently, Teranews has offered privacy, though I don't know of many reports on their trustworthyness.

The problem with NNTP service is you cannot encrypt the actual data stream to the NNTP server itself. Hopefully someone will provide such a service. (At another glance, it looks like the Secure Tunneling package includes "Anonymous Newsgroups". But I am not sure what that means.)

Wont work

[Codifex Maximus]

I can see it now...
Programs that act like web browsers hitting pages at random generating way too much traffic to record.
Increases in junk mail to overload the databases with uh... junk From, To, CC addresses.

I'm sure the Security and Storage industry sectors will be happy.

Of course they don't have any *plans*

[billstewart]

They do this sort of thing all the time, and sometimes they get away with it. *Plans* implies that they've gotten sufficiently wide internal buy-in to implement something, or at least to announce it. Simply leaking wish-list desires like this and seeing how the public reacts to it gives them deniability, and lets them pretend it was just an idea, and hey, maybe it'll take off and they'll get to push the envelope a little farther past what common sense and the Constitution actually authorize them to do. In addition, by putting a wide spectrum of proposals out there, from the reasonable to the totally totalitarian wacko, lets them not only know where the edge is, but lets them take any position they want and say "see, we've been talking about this for a long time, and we're just updating this long-discussed plan to reflect current circumstances". Remember Clipper? They got their teeth kicked in on that one. Remember CALEA? That passed, though the telcos resisted for a long time because the FBI wanted billions of dollars of infrastructure implemented in ways that disrupted the potential evolution of the telecom infrastructure and market without actually having to pay for any of it, but it's vague and fuzzy enough that they've been able to use it to gradually impmement some things, even if they're way beyond the Congressional approval level, much less the Constitutional one. Don't expect the ratchet to go back in the other direction without it getting pushed really hard - and this also means support your local so we can stop these things before they start.

forge all headers possible

[tomdarch]

It's simple, enact this and we'll all be forging as much as possible. It wouldn't be complete, but it would be a start.

Call me a luddite...

[Noexit]

But if they ever actually do pass this kind of heavy handed, knee jerk, bullshit legislation, I will chunk every computer I can get my hand on out a window and quit my job. Yes, it will be technically possible to circumvent any kind of logging they put up, but why bother with it? The government will only continue to try to execute a stranglehold on that which it cannot control, thus sucking the life right out of it. It'll be more fun to start the revolution on horeseback with pen and ink anyway.

Carnivore?

[Prof.Phreak]

Isn't this what carnivore is already doing?

Boycott

[zangdesign]

Has anyone ever considered the effect of boycotting European websites and European goods for as long as they maintain the legislation?

I know it's not very realistic, but hey, it's a start.

What I want to see

[bensej]

What I would like to see ISP's required to track is traffic patterns that are clearly emminating from a script kiddie or malicious program. If my Firewall can recognize a Smurf Amplification attack then they should be able to as well. A stream of identical traffic (aside from simple pings) or the signature of a known virus attempting to spread itself. While I know that it would be hard to keep up, but frankly I'm sick of having to waste my time telling ISP's about the illegal activity that is occuring on their network.

Honor system? Don't make me laugh

[Ars-Fartsica]

I'm not posting as someone looking from the outside, I'm telling you from the inside that people with access to personal information go snooping through it all the time. Please inform every root user I've ever met about your honor system.

No encrypted email company has ever made it

[Ars-Fartsica]

Joe Sixpack either can't understand encrypted email or doesn't care, because the twenty odd encrypted email startups in the Bay Area have all ended up on the scrap heap, and some of them had truly nice, easy to use solutions.

dont worry DOJ

[packeteer]

we got a head start on the EU punks with our DMCA...

Re:So... Read "USA Patriot Act"

[uncoveror]

Thanks for that link. It will take time to read all this, but I will do it.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Fido.

[chris_sawtell]

FidoNet reincarnation starts tomorrow.

Re:0wn3d USA

[LowellPorter]

iGo USA #1!!! For democracy!!!

You're forgetting that the USA isn't a democracy, we're a representitive republic. Democracies tend not to work very well.

If you are a bad person...

[nickgrieve]

And you are conducting business over an insecure medium like the internet then you are going to use strong cryptography to protect the contents of your communications. All that is left is traffic analysis. You can feed the watchers false and misleading information to make the analysis imposable.

If you don't do this you are stupid and disserve to get caught. If you are smart you will achieve your goals regardless of being watched.

Re:If you are a bad person...

[nickgrieve]

F U C K
Y O U
I
W O N ' T
D O
W H A T
Y O U
T E L L
M E

Your 3rd ammendment rights

[Will_Malverson]

OT: sometimes I feel bad for the 3rd Amendment...it just gets completely ignored. Nobody ever takes to the streets demanding their 3rd Amendment rights be protected

Don't feel bad. This means that the 3rd amendment worked. It placed a simple constraint on the goverment, and the government has never violated that constraint.

99% of my email is SPAM...

[newerbob]

...and I'd imagine that's true for most people (at least for their "public" email addresses that may have appeared at least once in a newsgroup or on USENET.)

Since email is almost always junk, and easy to forge, I can't imagine that any valuable information will come of this.

Fair point, but...

[BrokenHalo]

This is true, but whatever the motivation for imposing this burden on ISPs, history should tell us that if a system is open to abuse (and http logging is flagrantly so) we can be assured that there are plenty of people out there who are willing to abuse it.

Re:Fair point, but...

[Disevidence]

Unfortunately, that is the case. While the average good cop/fbi agent whatever wouldn't really care about tracking habits, people with grudges and/or in a position to blackmail can certainly abuse it. Its a pity we can't trust anyone, i wish the world wasn't so fucked up.

It's Like The Matrix!

[dupper]

A giant network of human's unknowingly feeding the planets' un-elected rulers;

Matrix:
Energy for electronic life

Real World:
Pr0n URL's for immediate DOJ, childpr0n URL's for eventual congressional investigation.

Can We Put this in perspective for the courts?

[guttentag]

Let's compare:

• DOJ wants local garbage men nationwide to store all residential and commercial trash in marked bins for 10 years so the FBI can research an individual's lifestyle
• DOJ wants power companies to keep detailed records of household power usage so the FBI can determine what time of day is best to break in and plant listening devices
• DOJ wants all White House officials to publish full transcripts of their meetings so the public knows just how much of Bush's energy policy was written by Enron
• DOJ wants all ISPs to log and retain all of your email headers and browsing history so the FBI can go through your trash without feeling nauseous.

Which of the above seems reasonable to you, your Honor?

Re:www.nakedkids.com

[|<amikaze]

indeed. it's only a redirect but still...
Found InterNIC referral to whois.opensrs.net.

Registrant:
NewPic.com Inc.
9 East Loockerman Street
Dover, DE 19901
US

Domain Name: NAKEDKIDS.COM

Administrative Contact:
Hostmaster, Hostmaster www@37.net
9 East Loockerman Street
Dover, DE 19901
US
310-203-6699

Registered to a man in delaware... How strange.

Not entirely true...

[Mac Degger]

There are, as yet, no data retention laws for ISP's in Europe. The UK tried to do this the other day, and got massively slapped down by the public, thereby forcing them to table the issue.
Now THAT's democracy in action.

BTW, doesn't anyone else find the world a scarier place after 9-11? The problem is that it's Bush who is so scary, not Al Quaida...

Living on the edge

[evgeni]

It is about control!

Your face, your fingerprints are not the only thing that makes you unique (i.e. a person that can be identified on as needed basis).

Think about all the information that you send over InterNet (logins/passwords/nicks ... etc), the people who send you emails, the people you send mails to. Scared? :-)

They can always catch you one way or another. But as one saying goes: "The one who is afraid of bears does not go in the wood."

Cheers

Free Web "Helpers"

[gregor-e]

All the gummint needs to do is invest heavily in AI "helper" agents that'll assist you with your browsing, finding the best deals, talking to your friends' agents so they can let you know what your friends are doing, etc. Since they do all this for free, these agents should become very popular. Unca Shuga gets to maintain the database the agents need to perform their help, though, so they can see when disaffected youth are studying bomb design, nazism, etc. and can take appropriate pro-active action. They can also see who refuses to use these incredibly helpful little agents, and thereby focus their non-automated energies on those who obviously have something to hide.

hmmm...keep alive ypur pgp ;)

[allbright69]

although the pressure on the privacy is on the great increase the second wave webs are getting started to secure any private communication. they try to combine the encryption and simplicity. and some managed. for example s-mail. they don't put any effort to make a promotiond crying out loudly about, imho but the product is quite good... ;)

s-mail.com

[franticek]

Yeah, my vote goes for s-mail.com, too.
Looks like the right way how "PGP-for-all" should be.

Red Squad Redux

[seven89]

Many years ago, law enforcement units of various levels of government maintained what were called "Red Squad" files. In theory, the squads and files existed to prevent espionage, subversion and terrorism. Yes, there were "reds" who engaged in such things, although most left-wing activists were generally, for the most part, law-abiding citizens. Unfortunately, any data base of personal associations will include many peaceful types as well as a few actual or potential enemy spies, bombers, etc. So when someone from the personel office of a local factory called his buddy on the local squad, asking about an applicant, the squad guy might reply, "Oh, yeah, we've got a file on that character!" and a perfectly decent citizen would be denied the job.

I followed much of the "Red Squad" controversies during the '80s. The files were indeed abused, and those abuses gave ammunition to those who wanted to reduce the effectiveness of America's foreign and domestic intelligence agencies. AFIK, the agencies themselves pursued some agendas that had much more to do with stifling dissent rather than tracking down the real bad guys. So there was some weird stuff on both sides of the issue.

And so it is now. It's a new day, a new ball game. Law enforcement intelligence units are being re-invigorated beyond all reason. The levels of surveillance of ordinary citizens that government agencies are now working towards is orders of magnitude greater than the local cops writing down license plate numbers of a few hippies at a peace rally.

And what is the real reason for all of this? To prevent acts of mass violence on American soil? Well, that might be a positive side effect, but perhaps the true agenda is to make effective political dissent almost impossible. Those of us who would oppose the great wars now being contemplated at the highest levels of the U.S. government should keep this in mind: They know much, much more about us now than they did 30 years ago. In other words, the true motive for this apotheosis of spooks is not to prevent mass violence, but rather to facilitate it.

"You're Being Watched" ads to help unemployment

[Trazk]

All those popups telling us that we're being watched by our wives, bosses, etc will have to be updated to include the DOJ. That could help our unemployment rates drastically. The amount of man hours needed to fix all the ads has got to be tremendous.

TYPO Correction:

[NanoGator]

"I can email my mother in complete piracy."

I meant 'privacy' not 'piracy'. Been posting too much about the RIAA lately. ;)

Is the US trying to prevent a terrorist attack?

[xyzzy-ladder]

I keep on reading comments saying that the US government is trying to prevent a terrorist attack.

Can anyone back up this claim?