Slashdot Mirror


DOJ Wants ISPs to Log User Traffic UPDATED

Anonymous Coward writes "Kevin Poulson writes in an article in SecurityFocus that in an early draft of the White House's "National Strategy to Secure Cyberspace", the DOJ proposes that the US enact European style 'data retention' laws, which force ISPs to log and retain all of your email headers, as well as your Web browsing history." Nothing worse for the DOJ to be upstaged by Europe in oppressive lawmaking, they must feel like they're losing their edge. Update: 06/19 23:04 GMT by M : The SecurityFocus article has been updated with this note, saying that the U.S. denies having any plans for data-retention laws. Guess we'll have to wait until the plan is released to see.

111 of 335 comments (clear)

  1. I guess... by Anonymous Coward · · Score: 4, Funny

    I'll have to meet real girls instead of browsing pr0n.

  2. First post? by Paradoxish · · Score: 4, Insightful

    Maybe, I dunno. But anyway... this sucks. Doesn't anyone at the DOJ realize that keeping a history of web browsing is about the equivalent of having someone follow you around with a pen and some paper and record the address of every place you visit during the day? I don't understand how keeping track of information like this can possibly help with security or ANYTHING for that matter.

    --
    If you need to interpret my post, then you don't get it.
    1. Re:First post? by treat · · Score: 2
      . Doesn't anyone at the DOJ realize that keeping a history of web browsing is about the equivalent of having someone follow you around with a pen and some paper and record the address of every place you visit during the day?


      Which is also the equivalent of putting cameras in public places, which makes it easy to track someone's movements throughout the entire day. Therefore, this will not be an effective argument against such monitoring to people who already consider things like cameras in public places to be a good idea.

    2. Re:First post? by gorf · · Score: 4, Insightful

      Which is also the equivalent of putting cameras in public places...

      (Emphasis mine) My web browser is certainly not in a public place.

    3. Re:First post? by nsanit · · Score: 2, Interesting

      My web browser is certainly not in a public place.

      Uhhh....you may be right, your browser is not, however...

      What comes into and goes out of your browser, may very well be in a public place, unless you are browsing an intranet, which since you've posted here, you're obviously not restricting yourself that much.

      If you can be absolutely sure that your traffic never touches a network that has nothing to do with the government, your statement would be true. The chances of that are pretty damned slim since a lot of big pipes in the US have some affiliation with a publicly funded university.

      However, while their motivation may be different, your ISP could monitor everything you do and it would be akin to retail stores with security cameras.

      Please understand, I dislike the idea as much as anyone, I just dont know if there's much we can do about it.

      --
      They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety.-Franklin
    4. Re:First post? by Dr+Caleb · · Score: 2
      And who follows them around all day with a pen and paper recording everything they are recording about you?

      It's just a way for the govenerdment to make the citizens think that are doing something about security. If they were actually doing something to protect the people, the "Office of Homeland Security" would call the Department of Transport and tell them to enforce seatbelt laws. How many lives a day would that save? How many lives a day will be saved by my mail headers and URLs being monitored?

      --
      "History doesn't repeat itself, but it does rhyme." Mark Twain
    5. Re:First post? by killmenow · · Score: 2

      I don't understand how keeping track of information like this can possibly help with security or ANYTHING for that matter.
      What I don't get is this: Evidence exists that the CIA, FBI, NSA, et. al. already had enough raw data in their hands that if they had their heads on right, they could've stopped the 9/11 attack...so the amount of information they have access to already isn't the problem...it's what they do with it.

      So how the hell is giving them more data going to help? All it will do is cause information overload and all those cops will start ignoring even more than they do already...which will actually make it easier for those bent on crime and distruction.

      After all, if there are 50 average joe's to every 1 kidnapper/drug dealer/terrorist, then if I'm one of the bad guys...I'd be hoping the government is too busy watching the 50 good guys so as to be more likely to overlook me.
    6. Re:First post? by symbolic · · Score: 2

      People who don't mind cameras in public places, and who think that there's no 'reasonable expectation of privacy' in public, probably wouldn't be the least bit bothered if someone caught them (with a camera) in an embarrassing moment (in public) and then plastered it all over the net. Or would they?

    7. Re:First post? by symbolic · · Score: 2

      I AGREE with you, I think the government has no right to moniter what I do with out reasonble cause. I slowly see us givng up our democrasy for security.

      Correction...for the illusion of security. It's nothing more than a PR pill given to the public in order to mask the underlying problem.

    8. Re:First post? by gorf · · Score: 2

      I agree with you completely.

      What I was saying was that, if you're walking about publicly, by the very action of doing it publicly you can't really complain about people knowing about it. But you've got a reasonable expectation of privacy in your own home, and similarly you should have a reasonable expectation of privacy when you're browsing the web from your own home.

      Just like people could monitor what you're doing in your home by using listening devices, secret cameras etc, similarly your ISP can do so.

  3. Mail headers. by Lemmy+Caution · · Score: 3, Interesting

    Article seems slashdotted, so I haven't read it yet... but what does this mean for those of us who run our own mail servers? Do we know have retention and reporting requirements on our systems at home?

    1. Re:Mail headers. by Bouncings · · Score: 2, Redundant
      I managed to get the article. Here is a reprint of the text.

      Cyber Security Plan Contemplates U.S. Data Retention Law

      Internet service providers may be forced into wholesale spying on their customers as part of the White House's strategy for securing cyberspace. By Kevin Poulsen, Jun 18 2002 3:46PM UPDATE:U.S. Denies Data Retention Plans

      An early draft of the White House's National Strategy to Secure Cyberspace envisions the same kind of mandatory customer data collection and retention by U.S. Internet service providers as was recently enacted in Europe, according to sources who have reviewed portions of the plan.

      In recent weeks, the administration has begun doling out bits and pieces of a draft of the strategy to technology industry members and advocacy groups. A federal data retention law is suggested briefly in a section drafted in part by the U.S. Justice Department.

      The comprehensive strategy is being assembled by the President's Critical Infrastructure Protection Board, headed by cyber security czar Richard Clarke, and is intended as a collaborative road map for further action by government agencies, private industry, and Congress.

      While not binding, proposals that find their way into the final version of the National Strategy would likely have added weight in Congress, and could lead to legislation.

      A controversial directive passed by the European Parliament last month allows the 15 European Union member countries to force ISPs to collect and keep detailed logs of each customer's traffic, so that law enforcement agencies could access it later.

      Data to be gathered under the European plan includes the headers (from, to, cc and subject lines) of every e-mail each customer sends or receives, and every user's complete Web browsing history. The period of time that the data will have to be retained is up to each member country; specific legislative proposals range from 12 months to seven years, according to Cedric Laurant, a policy analyst at the Electronic Privacy Information Center (EPIC), which opposed the directive.

      "Somebody could see their past for the last seven years be completely open," says Laurant, speaking of the European directive. "It violates freedom of speech and the basic principal of the presumption of innocence."

      The draft of the U.S. plan does not specify how much data ISPs would be forced to collect, or how long they would have to store it. The White House did not return phone calls on the strategy, which is scheduled for release in September.

      --
      -- Ken Kinder ken@_nospam_kenkinder.com http://kenkinder.com/
    2. Re:Mail headers. by zaius · · Score: 2

      I was thinking the same thing. I find it very difficult to believe that they can force the tens of thousands of us (at least) who run our own mail/DNS servers to keep logs for x years, and then turn them over at their request. It's also not that difficult to set up your own mail/DNS server, and I don't think that terrorists/criminals capable of doing anything worth preventing would have too hard of a time with it.

    3. Re:Mail headers. by jmd! · · Score: 3, Insightful

      Your ISP wouldn't do it on their mail server, they would have to sniff all outbound port 25 traffic and record that way. Scary stuff, since even PGP doesn't help much. They'd still known everyone I mail. Time to start putting the Subject: in the body of the message, people!

    4. Re:Mail headers. by jmd! · · Score: 2

      > That's what anonymous remailers are for.

      How do I actually tell the remailer the final destination? Never used one before... connect to a web server on it via HTTPS? SMTP or mail header can't be used, that's sniffed, body can't be used, that's encrypted.

    5. Re:Mail headers. by mOdQuArK! · · Score: 2

      The general idea is that you wrap your message in several layers of encryption, then bounce your message through 3 or more randomly-picked, anonymous remailers. Each remailer "peels" a level of encryption off the message, and then the just-decrypted part of the message tells it the next remailer to send the rest of the encrypted message. The final message is sent directly to the desired recipient, although the contents of the message can be still encrypted.

      Each anonymous remailer has various algorithms to try and make traffic analysis more difficult (random outgoing delivery, fake messages, etc).

      It's a pretty good theoretical setup (requiring that eavesdroppers be able to monitor all paths through the remailer "network" to have full traffic analysis coverage), but the hard part is keeping all of those remailers up & running reliably (since most of the remailers are being provided by volunteers with limited resources).

      In addition, remailers are notorious for having been abused by spammers to cover their tracks using email-to-mailing list or email-to-netnews gateways.

  4. Will they fund it? by cardshark2001 · · Score: 4, Insightful

    Logging such a huge volume of data requires massive hard-drive space, extra CPU power, extra manpower. All of those things cost money.

    Considering how little money ISP's tend to make, I don't see this as at all fair, unless the government will pony up the cash.

    --
    WWJD? JWRTFA!
    1. Re:Will they fund it? by delta407 · · Score: 4, Interesting

      Besides which, what defines an ISP? I do work for a school that shares an Internet line with a nearby company; the router is in the school, and the company can use the school's cache server and mail relay. Does the school have to log everything? They certainly can't pay for it.

      Then again, if the government would provide cash for some upgrades, I'm sure they wouldn't mind.

    2. Re:Will they fund it? by bsDaemon · · Score: 2, Insightful

      It isn't fair even if they DO fund it. It is just wrong and evil. What about prsumption of innocense and, freedom of press, freedom of speech, due process? How about 'reasonable expectation of privacy'? Fuck the federal government. "...--That to secure these rights, Governments are instituted among Men, deriving their just powers from the consent of the governed, --That whenever any Form of Government becomes destructive of these ends, it is the Right of the People to alter or to abolish it..."

      So there.

    3. Re:Will they fund it? by symbolic · · Score: 2


      Since when has the lack of an expectation of privacy conveyed a right to log, track, spy on, profile, or otherwise stalk an individual - ESPECIALLY by the government, and ESPECIALLY without cause?

    4. Re:Will they fund it? by symbolic · · Score: 2


      You're right - it isn't fair. But there's precedent. This very thing happened with the telcos already, to the tune of some $500 million that was handed out BY the FBI, to the telcos, in order to defray the cost of upgrading equipment in a manner necessary to comply with CALEA. One unintended consequence is that now the telcos have implemented MORE than was granted by the FCC (based on what the FBI and other law enforcement agencies had requested), fearing that they may be forced to add this extra functionality at some point in the future. All it takes now is a switch to activate the new goodies.

    5. Re:Will they fund it? by dsoltesz · · Score: 2

      Sorry, when the gov't passes edicts like this on themselves, it never supplies funds for actually following the new law or policy. Somehow, the effected agencies/divisions/teams must come up with the money to meet requirements (e.g. get all the Unix folks PCs because suddenly M$ Word is the required word processor). It's certainly not going to supply funds to ISPs to expand storage and whatnot. However, what will happen is the ISPs will be forced to raise prices to cover the costs.

  5. I wonder.. by Space+Coyote · · Score: 2

    I wonder if Zero Knowledge, Inc. might decide that it might be time to re-introduce their personal anonymous web browsing service.

    --
    ___
    Cogito cogito, ergo cogito sum.
  6. They changed their mind! by I+Want+GNU! · · Score: 5, Informative

    I visited the site, and this is what it says here. I'm posting it in case the site gets slashdotted. [And I'm not a karma whore since I already have 50.]

    U.S. Denies Data Retention Plans

    The Justice Department refutes claims that Internet service providers could be forced to spy on their customers as part of the U.S. strategy for securing cyberspace.
    By Kevin Poulsen, Jun 19 2002 12:24PM
    An early draft of the White House's National Strategy to Secure Cyberspace envisions the same kind of mandatory customer data collection and retention by U.S. Internet service providers as was recently enacted in Europe, according to sources who have reviewed portions of the plan.

    But a Justice Department source said Wednesday that data retention is mentioned in the strategy only as an industry concern -- ISPs and telecom companies oppose the costly idea -- and does not reflect any plan by the department or the White House to push for a U.S. law.

    In recent weeks, the administration has begun doling out bits and pieces of a draft of the National Strategy to technology industry members and advocacy groups. On Tuesday, sources who had reviewed segments of the plan said a federal data retention law is suggested in a section written in part by the Justice Department.

    The comprehensive strategy is being assembled by the President's Critical Infrastructure Protection Board, headed by cyber security czar Richard Clarke, and is intended as a collaborative road map for further action by government agencies, private industry, and Congress.

    While not binding, proposals that find their way into the final version of the National Strategy would likely have added weight in Congress, and could lead to legislation.

    A controversial directive passed by the European Parliament last month allows the 15 European Union member countries to force ISPs to collect and keep detailed logs of each customer's traffic, so that law enforcement agencies could access it later.

    Data to be gathered under the European plan includes the headers (from, to, cc and subject lines) of every e-mail each customer sends or receives, and every user's complete Web browsing history. The period of time that the data will have to be retained is up to each member country; specific legislative proposals range from 12 months to seven years, according to Cedric Laurant, policy fellow at the Electronic Privacy Information Center (EPIC), which opposed the directive.

    "Somebody could see their past for the last seven years be completely open," says Laurant, speaking of the European directive. "It violates freedom of speech," as well as the legal principal that a defendant is presumed innocent until proven guilty.

    The White House did not return phone calls on the National Strategy, which is scheduled for release in September.

    1. Re:They changed their mind! by jazman_777 · · Score: 2
      U.S. Denies Data Retention Plans

      As Bismarck once said, "Nothing is confirmed until officially denied."

      --
      Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
    2. Re:They changed their mind! by I+Want+GNU! · · Score: 2

      As Bismarck once said, "Nothing is confirmed until officially denied."

      I deny that I have tens of billions of dollars in Microsoft. (-:

      No seriously, I don't.

  7. Update. by Lemmy+Caution · · Score: 2

    Finally got through, and ... Nothing to worry about yet. Apparently, this is from a misreading of the report. No data retention requirements, these aren't the droids you're looking for, move along.

    1. Re:Update. by Lemmy+Caution · · Score: 2

      It's not as if there haven't been enough abuses of civil liberties in the name of the war on some terrorists. Just as I was inclined to believe any story that depicted Bill Clinton as wily horndog, I'm inclined to give some credibility to any story that indicated that Bush, Cheney, Ashcroft, and friends took another big bite out of civil rights, privacy, and the presumption of innocence.

    2. Re:Update. by RatFink100 · · Score: 2

      Interesting choice of quote since those were the droids they were looking for - they just managed to fool them they weren't.

      Or maybe that's what you intended to imply?

  8. FPWL by Peridriga · · Score: 2, Funny

    Wow...

    Now the DOJ will have the biggest Free Password List on the web..

    Could you imagine the amount of money they could make from X-10 pop-under ads...

  9. They're the only ones NOT looking by Ars-Fartsica · · Score: 3, Insightful
    Any ISP employee, sysadmin or free email provider admin can already look at your data any time they please. And they do.

    At least the government will probably be required to disclose what they do.

    Your best bet is to not send any sensitive info over email, and don't store any unencrypted sensitive or private data in online storage systems.

    1. Re:They're the only ones NOT looking by digitalsushi · · Score: 4, Informative
      As a netadmin for a small-medium sized ISP, I'm going to have to disagree with that on two levels. First off, most of us small guys dont have all the bells and whistles, or disposable overhead to implement free tools to spy on our users. Quite a few of us pipe our customers "straight through". (That and you need to remember that the majority of us are no Vincent Cerfs.. we're smart people but we could sit here 24 hours a day and still not have enough time to learn it all- but thats another thread)


      Second, for the things that we *can* look at (easy stuff like say someone's POP mailbox, just a text file) there is (most people wont believe this) actually an honor system amongst admins. We won't edit a mailbox if its broken until we have permission. Otherwise we might see something that isnt ours to see. Privacy is THE most important thing we can promise our customers, so everything else has to take the back seat, even if it means some uptime.


      Even given that, though, I do recommend that people encrypt their email, cause just cause I wont read your mail, doesn't mean the kid who has a 60 minute kernel exploit who just rooted me wont- (the rooting being another thread, lets not talk about perfection in admining here) (So sorry to reply like this, but I just took it a little personally. We're not all sleazy. Most of us arent.)

      --
      slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
    2. Re:They're the only ones NOT looking by GMontag451 · · Score: 2
      Yes, but it's illegal for them to do it.

      It's perfectly legal for them to look at any information on their servers. Whether or not they actually do is a different question. There are absolutely no restrictions on what an ISP can or cannot do with your personal data beyond what they put in their privacy policy. Hell, even the phone companies, who are heavily regulated by the FCC, can tap anyone's phone at anytime and listen, as long as it is for "quality assurance" or "maintenence purposes". They just can't give out the info to the police without a supoena.

  10. What's next? by cardshark2001 · · Score: 2, Insightful

    Perhaps the DOJ should be able to find out the title of every book I purchase, every TV show I watch, what kind of hamburger I buy.

    Wholesale spying is not justified by the war on terrorism. Especially for us non-Arab, born and raised in America types. It's just an excuse for the government to do something they've wanted to do for a long time anyway.

    --
    WWJD? JWRTFA!
    1. Re:What's next? by sirwired · · Score: 2

      Wholesale spying is not justified by the war on terrorism. Especially for us non-Arab, born and raised in America types.

      Um, wholesale spying is not justified on U.S. citizens, period. All citizens (and for that matter, residents) are granted equal protection under the constitution, Arab or not, native born or not. There should be no distinctions. (Okay, there is the exception that the president must be native-born.)

      SirWired

  11. Personal domains by forehead · · Score: 2

    What I want to know is how this impacts those of use who own/operate our own domains and SMTP server (i.e. those of us who do not use ISP supplied SMTP servers to send out mail). Will we be forced to log our own traffic for fear mean old Uncle Ashcroft wants to know who we emailed three years ago? Will we have to enact some sort of robust long term backup of these logs (i.e. fire resistant safes and offsite backups of logs)? What if, through no fault of our own, a fire destroys the last weeks worth of backups and Uncle Bush needs yesterdays logs (i.e. how paranoid about backing things up do we need to be)?

    --
    --
    1. Re:Personal domains by Indy1 · · Score: 2

      The day the government touches ANY of my boxes, is the day they pry the keyboard out of my cold dead hands (or on a more practical basis, have moved overseas to a far more enlightened country). The facism being proposed in the American government is sickening, and i fear the day the majority of it is passed into law. Big brother, meet Uncle George and Cousin Ashcroft.

      --
      Lawyers, MBA's, RIAA? A jedi fears not these things!
  12. Re:Curious by JetScootr · · Score: 2, Interesting

    I think the appropriate answer to the DoJ is "Give us a big enough pipe, we'll forward the data to you, and you can archive the hell out of it if you like."
    Drown them in their own sauce. Before long, they'll be telling all the ISPs in the country "UNCLE!"
    If nothing else, we'll get a BIG increase in the capacity of the Internet backbone before it's all over. Note for the humor-impaired: This suggestion is a joke. I think the bozo at DoJ who proposed this should be fired/recalled for constitutional abuse of power for even suggesting this.

    --
    Pavlov wouldn't be so famous if he'd used a can opener instead of a bell.
  13. Sounds reasonable by atrowe · · Score: 2, Troll
    I value my privacy as much as the next guy, but I don't think the DOJ's request is at all unreasonable. In fact, most ISP's already do log their user's traffic. In fact, if you're using a major ISP such as AT&T or Earthlink to read this, your traffic is almost certainly being logged right at this moment. This isn't necessarily a bad thing. On the contrary, logging user's activities on-line allows law enforcement to catch spammers (I'm sure most Slashdotters hate spammers), virus writers and distributers, software pirates, pedophiles, and all sorts of other cyber-miscreants. This is a Good Thing. I sure as hell don't want to be on-line with those types of people, and I'm sure most other readers will agree with me here.

    It seems that the issue at hand isn't the act of logging activities themselves, but how willing your ISP is to distribute those logs. In all previous cases I am aware of, ISP's do not give out personal information about a user without first being served with a subpoena. This is no worse than the restrictions we have had on wiretapping and eavesdropping for the past 50 or so years, so I don't see any reason for anyone to get upset about this. If you aren't breaking the law, then you have nothing to worry about, and your information will remain private in the hands of your service provider, however if you're doing something illegal, then there is no reason that the FBI or such should not be able to serve your ISP with a subpoena to obtain your usage logs. Its perfectly within our Constitutional rights for the government to do this, and anyone who is made nervous because of this probably has something to hide.

    --

    -atrowe: Card-carrying Mensa member. I have no toleranse for stupidity.

    1. Re:Sounds reasonable by schon · · Score: 2, Insightful

      I don't think the DOJ's request is at all unreasonable

      Of course it's unreasonable. Think about this: The logs don't show content.

      Your email headers don't show what you were talking about - you emailed "somejoeuser99@hotmail.com" asking about his lost puppy... but unbeknownst to you, he's a suspected terrorist, and all of a sudden, you're being investigated... They pull up your http traffic file, and it turns out that the HTML email he sent you has IMG tags that pull pictures from known terrorist sites.

      You'll probably change your mind once you're in an FBI interrogation chamber.. that bare bulb shining in your face, as Agent Smith says "Vhy vhere you communicating vis a known terrorist? Ve haf vays of makink you talk!"

      Or better yet, someone wants to make your life hell, so they get some anonymous web space, put some content that might interest you, and get you to view it... then then change the content to some terrorist propaganda, and place an anonymous call to the FBI. Suddenly there is PROOF that you've been visiting terrorist sites.. so you must be a terrorist!

      Think it can't happen in good ole' USofA? Just like the McCarthy witchhunts couldn't happen.

    2. Re:Sounds reasonable by zenyu · · Score: 2

      I sure as hell don't want to be on-line with those types of people

      If you aren't breaking the law, then you have nothing to worry about

      anyone who is made nervous because of this probably has something to hide.

      By god, Hoover! You're alive!

      Mr. Atrowe, if that is you're real name, I don't want to share the internet with your type of people, but I'm not lobbying to have the FBI come knocking on your door; Though you obviously have something to hide. The worst thing you could say I was doing to hurt your kind was that time I voted for a pro-education mayor. That doesn't even try to fix you, just save your children from your horrible fate.

    3. Re:Sounds reasonable by DreamingReal · · Score: 2
      Its perfectly within our Constitutional rights for the government to do this, and anyone who is made nervous because of this probably has something to hide.


      Congratulations Mensa-member! You've fallen into the same fallacious assumption that marks all American intellects that are both lazy and foolish - If you're innocent, then you have nothing to hide. Yes, you are in the company of esteemed patriots such as McCarthy, Hoover and Stalin (hey I didn't say American patriots). So on behalf of John Ashcroft, I would like to thank you, good citizen, for dulling your mind and accepting the dictate of your DictatH^H^H^H^H^President, who says that the only way to save liberty and justice for all, is to destroy them.

      --
      We want some answers and all that we get
      Some kind of shit about a terrorist threat

      - Ministry
  14. This is how Gray Davis would do it. by rice_burners_suck · · Score: 2

    I have a better idea. The UN should pass a law requiring that all network traffic in the world, whether on a home LAN or through the Internet, must pass through one central checkpoint machine that will log all the traffic. This will provide a worldwide data retention center where authorities and large corporations can perform queries to figure out exactly what someone was doing. (Obviously, defendants won't be allowed to perform similar queries, because that wouldn't be fair.)

    Oh yeah... And the central machine that would fulfill this function would be a 386 SX with a tape drive serving as RAM, running Windows XP Professional, and it would be connected to the Internet through a 1200 baud modem. This will make true worldwide broadband a reality and keep the economy strong.

  15. hmmm.. by crimoid · · Score: 3, Interesting

    This is only slightly different than forcing telcos to retain phone records, with one exception.

    Many URL's can be used to guess WHAT data you've been looking at without actually looking at the website. For example, if someone saw the URL: http://www.nakedkids.com they would assume that it was child porn and whomever looked at it should be red-flagged and investigated. Quite possibly however this site could have NOTHING to do with porn and could simply have a questionable DNS name.

    Perhaps if ISPs were only allowed to track IP addresses....

    1. Re:hmmm.. by Geeyzus · · Score: 2

      Many URL's can be used to guess WHAT data you've been looking at without actually looking at the website. For example, if someone saw the URL: http://www.nakedkids.com they would assume that it was child porn and whomever looked at it should be red-flagged and investigated. Quite possibly however this site could have NOTHING to do with porn and could simply have a questionable DNS name.

      If www.nakedkids.com DIDN'T have to do with child porn, they might want to rethink their company name / marketing strategy...

      But regarding your point, I want to say things like this would be caught in the follow-up investigation. Not that I want people investigating me, but I probably won't be thrown in the back of a squad car for visiting a site with a weird name if it actually sells propane and propane accessories, for example...

      Mark

  16. Only if they have a cameera by tomhudson · · Score: 2, Interesting

    Even if the DoJ were to keep a log of your web browsing, who's to say it was you sitting at the keyboard?

    I can see people making scripts to go to all sorts of "undesireable sites", and when they get busted, they can prove they were nowhere near the computer at the time.

    Would also smoke out all sorts of surveillance schemes.

    1. Re:Only if they have a cameera by Disevidence · · Score: 2

      Actually, your post reminds me. Wasn't there some sort of backdoor/bug/virus which allowed remote users to view your computer video camera?

      If what I recall is correct, they could prove it was you.

      (I could be wrong however, im searching /. for the story..)

      --
      Think nothing is impossible? Try slamming a revolving door.
  17. EU countries will probably NOT ratify it after all by sickasfuck · · Score: 3, Interesting
    At least UK, it seems:

    Home Secretary David Blunkett has admitted he blundered over plans dubbed a "snooper's charter" to give a raft of public bodies in the UK access to private e-mail and mobile phone records.

    The proposals are to be put on hold indefinitely in the face of huge opposition, which the home secretary conceded his department totally failed to predict. (...)

    See http://news.bbc.co.uk/hi/english/uk_politics/newsi d_2051000/2051117.stm for more info.
  18. we need a standard "envelope" for email by jimmcq · · Score: 4, Insightful

    You always hear the analogy that email is just sending a postcard... well, its about time that we start to make email "envelopes" (aka encryption) standard for ALL email.

    I think Joe Sixpack would be more inclined to use encryption if he thought it was just an envelope to put mail into... he doesn't need to know about technojargon like PGP, GPG, SSL, S/MIME, X.509 certificates, just tell him its an "email envelope" instead of the old postcard he's used to.

    The only thing that really needs to be public is the To address. Everything else could be encrypted (enclosed in the envelope) except for maybe a couple fields like the From Address and the maybe the Subject Line (but even those could be "inside").

    What needs to happen before email encryption becomes a "standard" thing that everyone uses all the time?

    1. Re:we need a standard "envelope" for email by NanoGator · · Score: 2

      " think Joe Sixpack would be more inclined to use encryption if he thought it was just an envelope to put mail into... "

      I don't undertand why he'd need to do this. It's a computer reading the logs searching for patterns, not a human reading the emails looking for hidden meaning. If he encrypts it, it'll flag him and then a human'll look into it, which is exactly what the invasion to his privacy would be.

      --
      "Derp de derp."
    2. Re:we need a standard "envelope" for email by jimmcq · · Score: 2

      If he encrypts it, it'll flag him

      Not if everyone encrypts their mail. Does the post office flag every piece of mail enclosed in an opaque envelope for further "inspection"?

    3. Re:we need a standard "envelope" for email by jimmcq · · Score: 2

      So basically what you've just said is that the DMCA's anti-circumvention clause has some ground to it. I mean, hey, if its illegal to open an envelope in real space, then howdy-do! we've already got a law in place that would prevent opening an "envelope" in cyberspace

      I'm all for an "email envelope" that is protected just the same as a realspace envelope... but that's not the same as the broad scope anti-circumvention clause. It is only illegal to open envelopes that have been sent through federal postal system, but anyone is free to open any other envelopes that haven't been submitted to the Post Office.

    4. Re:we need a standard "envelope" for email by NanoGator · · Score: 2

      "Not if everyone encrypts their mail."

      They don't need to, they don't have anyting to worry about. As I said, it's a computer reading the messages, not a human.

      You're not preventing the Government the ability to read your email, instead you're opening a wider door for potential terrorists to communicate.

      --
      "Derp de derp."
    5. Re:we need a standard "envelope" for email by Arandir · · Score: 2

      I'm all set to use PGP/GPG. It's integrated into my mail client. I have registered my public key. That's the easy part.

      The hard part is my mom, my boss, my friends, the guys on the mailing list... Until they all get PGP/GPG and make a public key, encryption doesn't do me a bit of good. I don't care how much PGP integration the current crop of mail clients have, generating valid and robust keys and then maintaining them through software upgrades, harddrive crashes and ISP changes, is something the average Joe Sixpack (as well as my mom) is not going to be able to handle.

      Think about it. The day every computer user knows how to properly maintain a set of PGP keys is the day people stop opening binary email attachments, stop using "password" and "drowssap" as passwords, and start checking the security of webpages before the start shopping online.

      --
      A Government Is a Body of People, Usually Notably Ungoverned
    6. Re:we need a standard "envelope" for email by T-Ranger · · Score: 2, Insightful

      Your analogy is flawed. Opening a letter not addressed to you is illegal. Owning a letter opener is not, but the DMCA makes owning a electronic knife illegal.

    7. Re:we need a standard "envelope" for email by NanoGator · · Score: 2

      " Statements such as "Boy, I hope that some Al-Quida, bin Ladin loving, terrorist doesn't bring as bomb to my office in the Empire State Building to blow it up."

      Show me one time when that has happened. They're doing a much better job than that.

      "Second, it's not really an invasion of priacy to see someone else's encrypted message. "

      I never claimed it was. What I said was that the people's privacy is safe. All that's happening is that a computer is recording the messages. So what? A program reads the message, does a pattern match, and moves on. Virtually nobody's message is going to get read by somebody who could care about it.

      If you encrypt it, though, what good is that going to do besides make somebody say "Wtf is so important that they are encrypting their message this heavily?"

      The only good you are doing by encyrpting your messages is making it easier for September 11th part II to come along.

      --
      "Derp de derp."
    8. Re:we need a standard "envelope" for email by NanoGator · · Score: 2

      Good idea: Give the Gov't a reason to ban encyrption all together. All it takes is one more terrorist attack, and they will pass it.

      --
      "Derp de derp."
    9. Re:we need a standard "envelope" for email by NanoGator · · Score: 2

      "And how do you know that? You don't, because the FBI doesn't tell anyone how their carnivore is doing. -- Here's an alternative question: How would they keep the innocent victim quiet?

      There are two problems with that. First, let's say I recorded all your telephone conversations. I probably really wouldn't care what you said, as it doesn't affect me. But would you like that? If your answer is yes, e-mail me your mailing address and I'll come and bug your phones. -- The Gov't already knows my social security #, my date of birth, mother's maiden name, every city I've ever lived, every car I've ever owned, all of my phone #'s, my family history, where I was born, my physical description, and my bank account and CC #'s. They aren't going to gain any more information about me that I find sensitive. If you are an agent for the Gov't and already have access to that info, then you may bug my phone. That right disappears when you attempt to steal my identity.

      "Unless, as someone else said, everyone encrpyts it." -- The only benefit to that is you'll thwart the US's abilities to collect info to prevent Sept 11th Part II from happning. As I said, the Gov't has nothing to gain but your personal safety. It's not like MS is calling for this.

      "Are you saying I'll be involved in September 11 Part II? If so, please let me know what evidence you have. If not, then why would encrypting my messages help the approach?" -- I never said that. Don't you think it's a little ridiculous that I'd accuse you of aiding a terrorist? I realize I didn't make that point rather clear, but be serious. What I meant: By thwarting the US's ability to keep tabs on everybody's email, you're making it futile for the Gov't to look for hints that we're going to be attacked again.

      What's really assine about this (besides the fact that the Gov't has nothing to gain from your personal info...) is that the Internet is the only place where Al-Qaeda can communicate. Any other means, though possible, aren't practical. So what you are saying to the Gov't is 'Fuck you! I want to look at porn in private! I don't care if it means you can't sniff for early warnings of an attack!"

      I know you care about privacy. I care about privacy too! But there are certain things I will not do to pay for them. I will not let my privacy be exploited as a weakness. If you were to replace the DOJ with Time Warner, I wouldn't be having this convo now. I'd say "Warner sucks!" and get modded up for it.

      "They adapt to our surveillence abilities; hence bin Ladin stopping use of his cell phone when he learned we were recording all his coversations." -- Yep. And when the US Gov't says "We can't sniff the e-mail because too much of it is encyrpted" then Bin Laden will be able to use AOL to communicate with his brainwashed cronies. At least with carnivore, they have to be extremely careful and always on their toes.

      It's okay if you disagree with my opinion. But I don't think I could restate my points much clearer than they are now. My safety is far more important to me than anything I have in e-mail or in the sites I go to. TO tell you the truth, I think you're being idiotic if you are posting sensitive information on the net somewhere. If your mail's not encrypted now, I don't know why you think you should start all of the sudden. Some bored tech support guy at your ISP who's only making $10 an hour could get bored and watch what you're doing. You have a lot more to fear from somebody like that than you do the Gov't, by a LONG shot.

      --
      "Derp de derp."
    10. Re:we need a standard "envelope" for email by NanoGator · · Score: 2

      "You haven't addressed my statement that this is useless. As I've spread throughout this post so you'd be SURE to see it, as well as making it perfectly clear in a reply to anohter of your posts, the TERRORISTS WILL BE USING ENCRYPTION."

      For the last fucking time:

      Encrypting the mail is a flag that the Gov't will have to investigate. IF everybody does it, then the Gov't gets no help from us, just noise. "Hmm, odd, there's an internet cafe in Miami where somebody keeps sending encrypted messages." Your plan would cause this "Hmmm.. Miami is sending encrypted messages."

      Simple as that: You're mucking with the Gov'ts ability to look for signs of an attack. All so that you can hide who you e-mail from the Gov't, even though that information isn't hard to get by somebody intent on looking at you. And no, I'm not arguing for encryption, I'm arguing about expectations. You are a fucking moron if you think "I can email my mother in complete piracy." Encryption can always be broken. Somebody who wants to do that is gonna do it anyway, so you might as well make the Gov'ts job protecting us easier. The internet is PUBLIC. If I were really worried about my messages getting read (again, you are a fucking moron if you think they aren't already by some script kiddie) then I'd be happy to encrypt them and let the Gov't have the key.

      The whole Internet is too public to use as a private communications tool! The Gov't isn't interesting in sniffing you for information unless you give them reason to.

      Why don't you just use your phone? Why don't you go meet the person face to face if your information is oh so valuable. Don't sacrifice my safety over it.

      If you're still saying "So you mean this [OVERSIMPLIFIED EXTREMIST CASE].", then you don't get my point, and I'm not wasting any more time getting you to understand. If you are going to be willfully ignorant of what I'm saying, then there is nothing I can do to help you understand my point. I don't expect you to agree with me. That's fine. All I'm asking for is understanding. "The Gov't may have access to my e-mail. They may protect my interests. They may stop Al Qaeda without my interferance."

      If you twist my meaning to say "Everybody's email should be public!" then you don't get it. That's where the word 'ignorance' will start getting used alot. This is not a black and white world. I don't think you personally using encryption will promote terrorism. I think the whole world doing it will secure the internet for terrorists to use.

      Think about that before saying "If everybody used encryption..."

      --
      "Derp de derp."
    11. Re:we need a standard "envelope" for email by NanoGator · · Score: 2

      Just wanted to thank you for an interesting response. I was getting sick of that other guy making me out to be extremist.

      My opinion is that I'm willing to give up some of my rights to ensure my safety. I don't consider the internet to be a private place in the first place. I don't think the government running a program to scan my traffic for patterns is any worse than what is already availble to somebody to wants to see what I'm up to.

      To me, the difference is that it's automated. I don't remember anybody bitching because their telephone bill came in with a list of who all they called and for how long.

      --
      "Derp de derp."
    12. Re:we need a standard "envelope" for email by NanoGator · · Score: 2

      Nope, it doesn't.

      "But if tomorrow the nice government man wants another one, and another one the day after that, I am going to start to want to resist a little bit to the government wanting my little freedom marbles, no matter how 'noble' the cause."

      You're assuming that the Government wants to take your freedoms away. There's no evidence of that. It isn't in the US's best interests to control everything. If it were looking for an opportunity, it had one on 9-11. Did things change? Yep. But it was nowhere near as drastic as it could have been.

      It's more like this: The man from the Government wants to take one of your marbles so that he can make you safe. You're happy to give him this one, but you're overly-cautious of giving him any more because you're working under the assumption that he wants all your marbles. You don't realize that the constitution prevents him from taking more marbles. You also don't realize that he's not after all of your marbles.

      Try to picture how this metaphor would be different if we were living in Nazi Germany. You'd instantly understand the way things could have been had the US wanted to get rid of Free Speech and privacy. I'm not a fan of George Bush, but he's not really an extremist.

      --
      "Derp de derp."
    13. Re:we need a standard "envelope" for email by NanoGator · · Score: 2

      lol @ Godwin's law. -- thanks for mentioning that, I learned something new today.

      I'm sorry, I couldn't think of a better example. I really did try to come up with a better/less extreme example. :)

      I'm just saying that if the USA was really out to get all our freedoms taken away, things would be drastically different. We'd have real strict laws about what can be published on the internet. The ID card would be around right now. TV would be nothing but commercials for the miliatry.

      Instead what I see are trigger happy military types wanting extremist action, and the Gov't and the people are saying "no, that's too far". So there's lots of bickering

      Frankly, I'm comforted by the bickering. I was really worried that 9-11 would have really locked down our freedoms, but I'm not seeing much of that. The example I used in another post here is that Portland had the Rose festival a couple of weeks ago. We had military ships from USA and Canada docked here. They put up barracades, restricted accesss, and had fewer ships. To my surprise, though, you could still board them.

      One thing that you have done though, and I appreciate this, is that you've shown me that I do take some things for granted. I live in a 'Nar, there are enough people defending my rights that no matter what happens, I'll be okay.' world.

      I needta break out of that. It is reaaaally easy to be comfortable in USA.

      --
      "Derp de derp."
  19. Another good reason to use freenet by mmacdona86 · · Score: 2

    http://freenetproject.org or something like it.

  20. Re:Time to switch to anonymous proxies... by 4of12 · · Score: 2

    There used to be anonymous re-mailers like penet and some by cypherpunks (C2) that would be nice to have around. I think spam usage killed off those remailers that survived the suits by the Church of Scientology.

    What the U.S. government doesn't realize is that the same unreasonable searches of your cyberhome that they think will do "something" to combat terrorism (it's arguable just how much genuine security this gains), are also the same policies that, as they are mimicked worldwide, will make it easier for oppressive regimes (North Korea, Iraq, China, Saudi Arabia, etc.) to clamp down on political dissent and the free exchange of ideas in their nations.

    I can only presume that the Bush administration has decided for us that some small amount of potential security under hypothetical circumstances is worth the cost in freedom of expression, not only in the United States but around the world.

    And here was I, thinking that the U.S. was a standard bearer promoting democracy and the principles of human rights embodied in the U.S. Constitution.

    --
    "Provided by the management for your protection."
  21. Irony by No+Such+Agency · · Score: 2

    If Kevin Poulsen was still up to his old tricks today, this would be exactly the sort of setup that would ensure he was busted very quickly...

    --
    Freedom: "I won't!"
  22. Re:*sigh* by NanoGator · · Score: 2

    " If they think for ONE f*cking second that this would actually work, they're wrong. Ill just start encrypting my email more often. Lets see them get through to my mail headers under 128bit RSA."

    Yeah, that's a good plan: Give them a reason to think you're up to no good. That'll keep'em from investigating ya.

    --
    "Derp de derp."
  23. What's the fuss? by meta-monkey · · Score: 3, Insightful

    Many other posters have already commented that the update to the story says the Gub'ment denies attempts to do this. I'm surprised this story wasn't taken with a grain of salt in the first place...you know this wouldn't stand up to any kind of court scrutiny.

    Really, the idea that the government can arbitrarily spy on anybody, but only look at later if they have a reason, violates your 4th Amendment rights against unreasonable searches (OT: sometimes I feel bad for the 3rd Amendment...it just gets completely ignored. Nobody ever takes to the streets demanding their 3rd Amendment rights be protected. Oh well). The federal government has no power to inventory your entire home, or keep a list of every person with whom you correspond by mail, and as such, they have no similar power to log your email headers or http requests. I don't see this one happening any time soon.

    --
    We don't have a state-run media we have a media-run state.
    1. Re:What's the fuss? by bnenning · · Score: 2, Interesting
      sometimes I feel bad for the 3rd Amendment...it just gets completely ignored


      Actually I recall seeing a semi-serious argument against the SSSCA on 3rd Amendment grounds. The reasoning was that mandating a "cop chip" in all electronic devices to make sure you don't do anything unapproved is effectively quartering an agent of government in your residence. Obviously quite a stretch, but no more so than any number of acts Congress has tried to justify using the Commerce Clause.

      --
      How to solve most of our problems: 1.Lots of nuclear plants. 2.Cure aging.
    2. Re:What's the fuss? by meta-monkey · · Score: 2
      Fascinating. I actually considered that while writing my previous post. In a way, the government forcing an ISP to monitor customers for their benefit could be considered "quarting" a government agent in the ISP's place of business. Specifically, the 3rd Amendment says the government can't quarter soldiers in people's homes, but this may well extend to businesses. Note, IANAL. However, if such legislation were enacted in support of the War on Terror (TM), then it probably wouldn't violate the 3rd Amendment, which allows the government to quarter soldiers in your home in time of war. Here's the complete text:

      Amendment III

      No soldier shall, in time of peace be quartered in any house, without the consent of the owner, nor in time of war, but in a manner to be prescribed by law.

      --
      We don't have a state-run media we have a media-run state.
    3. Re:What's the fuss? by meta-monkey · · Score: 2

      Man, that Hobbes...he and Calvin were always getting into all kinds of trouble...

      seriously, though, yes, that's why the price of freedom has always been eternal vigilence. It comes from all sides, though. The Right uses external boogeymen, like Reds and A-rabs, to remove your civil rights. Hey, I've got no problem with the government fighting terrorists, but please do it by going into other countries and shooting bad guys, not by spying on me, thanks. The Left, however, uses internal boogymen. Corporate America (tm) is so evil, sorry, we gotta ignore that whole "free speech" thing so we can enact Campaign Finance Reform (insert angels singing here). Property rights? Well, gee, sure, gosh, but come on, Please Think of the Children/Poor/Snail Darters so we gotta take more of your money, 'k, thanks. Sigh. Tends to get one awful depressed...

      --
      We don't have a state-run media we have a media-run state.
  24. Encryption? by JDizzy · · Score: 2

    Who cares what the government logs, when all you simply do is encipher all your traffic to trusted hosts. With anonymous Proxy services being easy to use and setup... more people will simply take notice that they exist, and begin to use them. Some people might even resort to paying a premium to under the counter internet service from their Broadband having friends Finux server. I wonder if this legislation takes into consideration that IP6 can travel right atop of traditional ip4, and can trick out attempts to monitor top level protocols, like email. Besides, you opt out of the monitoring by simply opting out of your providers email facilities. Other forms of message passing exist, and are in use by motivated people.

    The USA is the top internet using place on the planet, and Europe is no doubt second, with Asia/Pac being third. So how the USA officials plan to effectively monitor the data required is interesting. Logically one is left to wonder how well the USA carnivore system is working these days, and its sister Echelon. To resort to forcing these ISP to log data on behalf of the government officials seems very controversial. Almost as if the government is passing on the burden of Carnivore on the backs of the struggling ISP's in America. The interesting thing is: who is to prevent the ISP from simply not logging all the data the government officials claim to require? How would they be able to prove the ISP otherwise?

    --
    It isn't a lie if you belive it.
  25. Not first post. by Disevidence · · Score: 2

    The way i viewed it was much akin to the Australian censorchip laws. Its probably a token political effort designed to say theyre protecting the children and stopping terrorism. Its extremely hard to pin down anything really, and if you want to remain unknown, theres always the library.

    So I'd say, its political point scoring, with no real teeth to it. But hey, it could always be that they progressed to the next chapter of 1984.

    --
    Think nothing is impossible? Try slamming a revolving door.
    1. Re:Not first post. by morgajel · · Score: 2

      I don't know what library you go to, but I have to sign up and provide photoID to use a library computer.

      --
      Looking for Book Reviews? Check out Literary Escapism.
    2. Re:Not first post. by Disevidence · · Score: 2

      Im in Australia, all you have to do is sit down. At least i do here.

      --
      Think nothing is impossible? Try slamming a revolving door.
  26. Seems impossible to do by Coward+Anonymous · · Score: 2

    How would they decide what is loggable and what is not? By looking at ports 80 and 25? The solution to that is simple, switch all your "sensitive" browsing to port 666. Use PGP for your email or perhaps use something as mundane as ICQ, or FTP drop points.
    In addition you can have a script generating spurious emails and web browsing requests all day long so that you quickly overwhelm anyone's ability to actually log anything of substance (if you are really dedicated, you could probably generate 1GB of trash data a day).
    Whoever is thinking about these moronic ideas appears to be technically ignorant.

  27. Re:once a karma whore always a karma whore by I+Want+GNU! · · Score: 2

    Not that there's anything wrong with it. :-)

    I just try to write good comments when/where they will get noticed, so that I have the greatest impact on the greatest # of people, that's all.

  28. Great by The+Pi-Guy · · Score: 2

    Just the opportunity:

    Hey all! Has anyone seen that AL QUEDA member lurking around here? I coulda sworn I saw him with one of the few NUCLEAR BOMBS in the world.

    ... d'oh! You mean they're not monitoring content?? That takes ALL the fun out of it!

    --pi

  29. Industry concern?! by sulli · · Score: 2
    From the updated article:

    But a Justice Department source said Wednesday that data retention is mentioned in the strategy only as an industry concern -- ISPs and telecom companies oppose the costly idea -- and does not reflect any plan by the department or the White House to push for a U.S. law.

    They just have no fucking respect for our rights at all in the DOJ, do they? None whatsoever. I mean, come on - industry concerns?! Sure, industry would have concerns, but have any of these fucknuts heard of liberty and/or privacy?

    Send Lady Liberty back to France, it's over. Sell the Declaration of Independence on Ebay, clearly it has no meaning for our appointed officials.

    --

    sulli
    RTFJ.
  30. It won't pass a court challenge here... by trims · · Score: 2

    I've read the proposal that passed the European Parliament, and if the policy the Bush administration is attempting to put in place is similar, then it won't pass Constitutional muster. It fails on at least three major points:

    • It attempts to require a private entity to perform an action that is explicitly forbidden to the government. The government does NOT have the right to monitor all traffic (be it email, web, internet, snail-mail, phone, or whatever) without a court-order, and can only invoke the National Security exception in narrowly-defined circumstances. In this case, the government is attempting to make an end-run around this prohibition by requiring a private source to do the collection; however, the courts have consistently ruled that the private party is acting at the behest (and defacto control) of the government, and therefore is under the same obligations and restrictions as the government.

    • A bunch of legislation passed in the 1990s grants ISPs "common carrier" status. One of the central legal tennants of Common Carrier is that it is traffic-blind. This applies not only to the carrier itself, but any organization attempting to force the carrier to become traffic-aware (ie know what is being transmitted). Common Carrier is a very well-established concept, and such a executive policy cannot overrule a legal precedent such as it without an explicit law from Congress.

    • finally, practicallity is an issue. The government can legally require that I prove I'm a green Martian before taking an airplane trip, but it won't pass a court challenge because it is an impossible requirement. A slightly less extreme standard is known as Onerous Burden, wherein a plaintiff can contend that such legislation or regulation places an unreasonable burden to comply with it; such a case would be (for example) if port fees to dock at a port exceed the value of the ship docking there.


    I don't think they really realize the volume (either the US or Europe) as to what they're requiring, either. A rough estimate is that an email header is 1k, and that a log of an http request is .5k. For an average user, 1000 http requests (remember, each picture/icon is a new request) and 10 emails per day would be typical. That's about 500k per person per day. For a mid-size ISP with 10,000 users, that's 5GB per day, 1.825 TB per year. Even assuming good compression of 90%, that's 180GB per year. Given that you would need to get a good machine and lots of redundancy for it (remember, this is a LEGAL requirement), I can easily see it costing $30k PER YEAR or more for the hardware alone for log space (plus the additional costs to upgrade the routers/mail servers/proxies and other infrastructure to allow for such vast logging in the first place). I'd estimate that it would be at least triple that, when all other factors are included. Even a $30k capital expenditure per year is a pretty good chunk of change for a company with a probable revenue stream of $3M per year. That's a 1% value of gross receipts (conservatively). And what about someone like Earthlink or similar, who has millions of customers? You're looking at requiring Terabyte storage systems costing multi-millions of dollars.

    Even though I've seen some really dubious legislation and policies over the past 10 years (e.g. DCMA), I don't think this one will fly.

    -Erik

    --
    There are always four sides to every story: your side, their side, the truth, and what really happened.
    1. Re:It won't pass a court challenge here... by kindbud · · Score: 2

      I've read the proposal that passed the European Parliament, and if the policy the Bush administration is attempting to put in place is similar, then it won't pass Constitutional muster.

      DMCA?

      USA Patriot Act?

      2000 Presidential Elections?

      Since when has not passing constitutional muster been a barrier to the government doing whatever it wants? The only barrier these days are the poll numbers, and they can just make those up and put it on the news, and most people will fall into line. So the only effective barrier is what they think they can spin in the media and get away with.

      --
      Edith Keeler Must Die
  31. If they're following the UK... by WolfWithoutAClause · · Score: 2
    then all they're doing is not TELLING you they are tracking email headers, dialled phone numbers and http connections. (In cryptographic circles it's called Traffic Analysis.)

    Blunkett went all uncharacteristically contrite on us, but according to the Register this just means that they're not actually formalising what they are doing anyway.

    They probably really are handing around traffic analysis data like smarties. "Oh looook what he's accessing!" Probably there's people out there being blackmailed right now; there's bound to be some bad apples with access to this data.

    --

    -WolfWithoutAClause

    "Gravity is only a theory, not a fact!"
  32. It's called Peek-A-Booty by MsGeek · · Score: 2
    http://www.peek-a-booty.org/pbhtml/index.php

    It was originally designed to help Chinese Internet users get around the Great Firewall Of China.

    Looks like the US and EU will be needing it too...[sigh]

    --
    Knowledge is power. Knowledge shared is power multiplied.
  33. Love/Hate the idea by gerardrj · · Score: 5, Insightful

    Outright I hate the idea, this is just pre-emptive search/seizure. The gov would only propose this because it's in the digital domain where it's A: feasable, B: deemed by J. Pulic to be a non-issue. The could NEVER get such a thing in to action with physical mailings.

    But then I thought.... If every ISP had to monitor port 25, isolate all to and from IPs and email addresses (forged or not), and fill up all those hard drives, tapes and whatnot...
    Can you image how fast SPAM would drop off as the ISPs attempted to control the now real costs of hosting spammers?

    --
    Article X: The powers not delegated... by the Constitution...are reserved...to the people
  34. and then they will... by josepha48 · · Score: 2

    .. sell your email address to the asians so that they can spam you to death...

    --

    Only 'flamers' flame!

  35. Forced proxies and such... by .pentai. · · Score: 2

    So does this mean that ISP's are going to be forced to pipe ALL port 80 traffic through a proxy, because hey, how else do they get EVERY web page we go to...

    Either that or they just keep track of what connections are being made through them to port 80 of places...but then what about web sites simply not on port 80...seems an easy enough way for "terrorists" to avoid being caught.

    And then there's the issue of people who run their own mail servers...I'd LOVE to see the government FORCE me to log all my own damned emails. It's not like it's hard to setup your own sendmail box and use that instead of your isps

  36. Overrated? Why? by NanoGator · · Score: 2

    My parent post here was marked 'Overrated'. I am politely requesting information on what is 'overrated' about it? That kind of implies there's something seriously wrong with my comment, but as of yet I don't see that.

    Somebody help? Frankly, I suspect that it was modded down because the person who did it thought I don't value privacy. That's not true at all. I'm just saying I trust a computer to scan my e-mail and retain my privacy, not a human. Once a human reads my email, I get spooked.

    The internet is NOT a secure communications medium regardless of what the DOJ wants. So why make yourself stand out to them?

    --
    "Derp de derp."
  37. GPG by norweigiantroll · · Score: 2, Insightful

    GPG will protect you from email listening (although I guess they just get the headers, so that won't help much.) Too bad SafeWeb isn't around anymore.

  38. Not "Innocent until proven guilty" in EU by redelm · · Score: 2
    Please understand that the EU is quite different from the US. In most countries (except the UK), there is no judicial presumption of innocence. Free speech does not prohibit prior restraint [chilling effect]. Privacy does not include privacy from police and other authorities.

    I dislike the European plan. But I also recognize it's a different place with very different attitudes of both police and populace. EU member nations are also free _not_ to enact the plan in their countries. I expect that a number, including the UK, will not.

  39. Time for a secure Internet backbone? by dfn5 · · Score: 2, Interesting
    The Internet is a public place. To say that "No one can see where I browse or who I email" is alot like Microsoft saying that it should be illegal to post discovered flaws in their products to the public.

    As far as the individual goes email content can be encrypted. But it looks like the government wants the headers of email and web traffic. Therefore I think there are some things that site maintainers can do to make things more secure.

    1. Always run a web site in SSL mode. Even if you don't have a valid site certificate at least the traffic is encrypted
    2. Run SMTP over SSL? There must be a way to get things like sendmail to try SMTP over SSL before falling back to unencrypted mode
    3. Create a secure Internet backbone? There are virtual Internets out there that run on top of the Internet like mbone and 6bone. If we setup an encrypted backbone using IPsec tunnels site to site then the ISPs wouldn't ever see unencrypted traffic and would have nothing to log. They would just be passing packets with garbage. Then if we play with routing tables if a destination is reachable over the secure backbone the packets would be dumped onto it instead of your local ISP.
    --
    -- Thou hast strayed far from the path of the Avatar.
  40. Re:As long as data goes in the clear ... by Tazzy531 · · Score: 4, Informative
    How bout these: Also if you think this and the USA/PATRIOT Act is unfair, sign the petition to get it repealed
    --


    _______________________________
    "I'm not Conceited...I'm just a realist..."
  41. Oh no! by ImaLamer · · Score: 2

    I can just hear them now!

    Why is it this group of people all visit one web site? And it's from a Russian domain!

    Well, we've looked into it sir - it seems to be a, uhhh, proxy

    What the hell is a proxy?

    We are on it sir!


  42. Re:As long as data goes in the clear ... by neocon · · Score: 2, Interesting

    OK, let's look at those, shall we?

    • 60 of 98 FBI Terrorism Cases were thrown out because of lack of evidence -- isn't the key phrase there `thrown out'? Isn't this, in fact, an example of the system working as it is supposed to?
    • Village Voice Analysis [villagevoice.com] - It's the Village Voice, take it with a grain of salt. -- or a lot of salt as the case may be. The Voice is, of course, the premier voice of the Chomsky/Mailer new left. Even though it has mellowed somewhat with old age and new management, it's hardly a voice of journalistic integrity...
    • Business Week Article discussing the various infringement of civil rights [businessweek.com] -- the columnist seems completely unaware of many of the details of the case (such as the fact that Muhajir has had a lawyer at every stage of the process), and of the supreme court precedent (Ex Parte Quirin). He does manage to fill in some general paranoia for a lack of knowledge of the case, but that hardly makes good journalism, now does it?
    • NYTime Editorial on naming an American citizen as an illegal combatant [nytimes.com] -- more or less the same. But of course, we know the NY Times editorial page's stance on the matter.
    • Ohio State graduates threatened with expulsion/arrest if they "demonstrate or heckle" during Bush's speech [yahoo.com] -- expulsion from the event, of course, but that makes rather less exciting a story, now doesn't it. Anyhow, what an unnamed official of a state school has to do with the Bush administration is unclear.
    • Federal Courts strike down Bush Administrations attempt to prevent people from challenging censorship laws. -- while I'm a big fan of the RMN, and especially of Dave Kopel, this seems little more than an tendentious headline about what is essentially a contract law dispute, no? At any rate, didn't the court strike down this action, and rule that even though Mr. Stillman had signed a contract not to, he would be allowed to publish?
    • Justice Department raising questions about case on John Lindh -- but nothing in this article alleges any lawbreaking, merely that some unnamed officials are alleged to have had not-very-specific `concerns'.
    • Another NYTimes article on illegally detaining American Citizens [nytimes.com] -- this is no different from the other Times piece. It's amazing how many pundits are willing to declare something `unconstitutional' without bothering to read the constitutional law precedent which the administration has very clearly pointed to (Ex Parte Quirin).
    IOW, there are a lot of tendentious claims here, but little backup for any of them.
  43. Misinformation by SamMichaels · · Score: 3, Insightful

    The problem is the general populus and law makers don't understand what they're saying/hearing. A analogy would help to put things into perspective.

    Logging email headers can be compared to the phone company keeping records of your incoming/outgoing phone calls.

    Do they do it now? Yes...and most ISPs keep generic logs as it is.

    Does the phone company retain ALL the info? No...but they CAN get the info and keep it if you're suspected of doing Bad Things...or they can tap the line. Can an ISP track the same amount of info? Sure...but they don't do it right now unless you're doing Bad Things.

    Keeping track of where you go on the web can be compared to driving.

    Does your state's dept of transportation keep track of what road you drive, and what time you did it? No.

    Does your ISP track what sites you go to and when you go to them? No...unless you have a proxy, in which case they might keep a generic log.

    Can the dept of transportation put cameras at all intersections and track your license plate number? Yes...but think of the hideous cost and hideous amount of data. Same goes for an ISP to track where you go.

    It's all about perspective...

  44. What they (the govt) shoud do.. by warpSpeed · · Score: 2

    Lets require that each user of the net record all of his/her activities while on the net with monitoring software installed on thier PCs. And we all know that the good citizens have nothing to hide and will go along with anything Uncle George says.

    Now lets see, who should get the contract for that software... why MicroSoft of course, they are into trust worthy computing now a days.

  45. Secure Tunneling by Chacham · · Score: 2, Insightful

    Even if they do this, places like Anonymizer will provide Secure Tunneling. Anonymizer also has other services, and they seem to be trusted for their part.

    This can handle most web activity. Email can be encrypted, remailed, or signed up for and used through Secure Tunneling, or a similar method.

    As an example, when I browsed the web at work, I used Secure Tunneling. For my email, I used Hushmail. Hushmail encrypted all the data that I saw, so it could not be tracked until it left Hushmail's servers.

    NNTP is a problem. There are anonymous NNTP sites. Altopia, a site run by a staunch Libertarian, seems to be pretty reliable. You can even pay rather anonymously. More recently, Teranews has offered privacy, though I don't know of many reports on their trustworthyness.

    The problem with NNTP service is you cannot encrypt the actual data stream to the NNTP server itself. Hopefully someone will provide such a service. (At another glance, it looks like the Secure Tunneling package includes "Anonymous Newsgroups". But I am not sure what that means.)

  46. Wont work by Codifex+Maximus · · Score: 2

    I can see it now...
    Programs that act like web browsers hitting pages at random generating way too much traffic to record.
    Increases in junk mail to overload the databases with uh... junk From, To, CC addresses.

    I'm sure the Security and Storage industry sectors will be happy.

    --
    Codifex Maximus ~ In search of... a shorter sig.
  47. Of course they don't have any *plans* by billstewart · · Score: 3, Insightful
    They do this sort of thing all the time, and sometimes they get away with it. *Plans* implies that they've gotten sufficiently wide internal buy-in to implement something, or at least to announce it. Simply leaking wish-list desires like this and seeing how the public reacts to it gives them deniability, and lets them pretend it was just an idea, and hey, maybe it'll take off and they'll get to push the envelope a little farther past what common sense and the Constitution actually authorize them to do. In addition, by putting a wide spectrum of proposals out there, from the reasonable to the totally totalitarian wacko, lets them not only know where the edge is, but lets them take any position they want and say "see, we've been talking about this for a long time, and we're just updating this long-discussed plan to reflect current circumstances". Remember Clipper? They got their teeth kicked in on that one. Remember CALEA? That passed, though the telcos resisted for a long time because the FBI wanted billions of dollars of infrastructure implemented in ways that disrupted the potential evolution of the telecom infrastructure and market without actually having to pay for any of it, but it's vague and fuzzy enough that they've been able to use it to gradually impmement some things, even if they're way beyond the Congressional approval level, much less the Constitutional one. Don't expect the ratchet to go back in the other direction without it getting pushed really hard - and this also means support your local so we can stop these things before they start.

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
  48. Boycott by zangdesign · · Score: 2

    Has anyone ever considered the effect of boycotting European websites and European goods for as long as they maintain the legislation?

    I know it's not very realistic, but hey, it's a start.

    --
    To celebrate the occasion of my 1000th post, I will post no more forever on Slashdot. Goodbye.
  49. Honor system? Don't make me laugh by Ars-Fartsica · · Score: 2

    I'm not posting as someone looking from the outside, I'm telling you from the inside that people with access to personal information go snooping through it all the time. Please inform every root user I've ever met about your honor system.

  50. No encrypted email company has ever made it by Ars-Fartsica · · Score: 2

    Joe Sixpack either can't understand encrypted email or doesn't care, because the twenty odd encrypted email startups in the Bay Area have all ended up on the scrap heap, and some of them had truly nice, easy to use solutions.

  51. Re:As long as data goes in the clear ... by H310iSe · · Score: 2

    *sigh* ok fair enough, I mean, accepting something as prima facia true w/o looking at the underlying info is, well, something to be avoided. I have to run but if I can get back b4 this discussion closes I'll dig something up for you. Until then 'absolut power corrupts absolutely' applies here and history informs - Look at the FBI/CIA operations from the '50s-late 70s, look what the CIA has done in El Salvadore, in Guatamala, Nicaragua etc. Look at what the fbi did under hoover, against anti-vietnam protesters, and, um, democrats. Now ask yourself if you want these people to be able to get together and have a party in your backyard (you won't be invited, unless you're being indited). Think about it, even if you have 'nothing to hide' that's fine, but just because you control your internal moral ethos by the rules those in power dictate doesn't mean we all do, or that we want to. I don't want to feel that I'm obliged to censor my thoughts, in my own house for christ's sake, in fear that someone may be listening and if these thoughts are out of favor now (or loose favor in the future) they could be called up and used against me by people who, don't forget, have power over me.

    For example, if the FBI comes, arrests you, throws you in jail for a month, then you get out (due to lack of evidence (see above)) - did they have to do anything else to destroy you? what happened to your house (who paid your rent/mortgage), what happened to your community respect/standing? what happened to your friends, your sig. other., what happened to your raise, your promotion, your job?

    see?

    --
    closed minded is as closed minded does
  52. Fido. by chris_sawtell · · Score: 2

    FidoNet reincarnation starts tomorrow.

  53. Re:*sigh* by symbolic · · Score: 2


    Works both ways...do you think that a t3rr0rlst would be stupid enough to put the kind of revealing information in their e-mail that will flag Carneyvore, or reveal anything substantive in the logs retained by ISPs? Hasn't it been stated that one of the methods used consisted of common phrases that had secondary meanings to those using them? Who knows what "Let's do a picnic tomorrow" could actually mean? Hell, they could throw someone for an even bigger loop be creating a diversion - one dude's subject might read ... "I love women's laced panties", and the text that follows (about said subject) could mean ANYTHING based on a prior system set up those engaged in the communication. Those reading it will probably be patting themselves on the back knowing that they've discovered a poor sap's preference for women's underwear.

  54. Re:*sigh* by NanoGator · · Score: 2

    Don't you think it'd be all over the news if the Gov't was chasing down false leads?

    I mean seriously, who cares if they read our e-mail? What are they going to get from it? They already have my social security #. THey have my date of birth, mother's maiden name, the city I was born in, how much money I've made in my life, where I've lived all my life, who I've worked for, what kind of car I drive, my physical description, and so on. What is going to be revealed in e-mail that they aren't privvy to now? Who cares?

    I don't care if some gov't agent is reading my overly-affectionate emails to my GF. I'll never even meet the guy!

    Fight corporations when they try to peek into your lives, but don't fight the Gov't. They're out to protect you.

    --
    "Derp de derp."
  55. Can We Put this in perspective for the courts? by guttentag · · Score: 4, Interesting
    Let's compare:
    • DOJ wants local garbage men nationwide to store all residential and commercial trash in marked bins for 10 years so the FBI can research an individual's lifestyle
    • DOJ wants power companies to keep detailed records of household power usage so the FBI can determine what time of day is best to break in and plant listening devices
    • DOJ wants all White House officials to publish full transcripts of their meetings so the public knows just how much of Bush's energy policy was written by Enron
    • DOJ wants all ISPs to log and retain all of your email headers and browsing history so the FBI can go through your trash without feeling nauseous.
    Which of the above seems reasonable to you, your Honor?
  56. Re:IP Laws by detritus. · · Score: 2

    If state DMV's can get away with selling driver's license carrier's information, I wouldn't be surprised if the government sells the information, and/or uses it for their own research/census-type mischevious plans..

  57. Re:Fair point, but... by Disevidence · · Score: 2

    Unfortunately, that is the case. While the average good cop/fbi agent whatever wouldn't really care about tracking habits, people with grudges and/or in a position to blackmail can certainly abuse it. Its a pity we can't trust anyone, i wish the world wasn't so fucked up.

    --
    Think nothing is impossible? Try slamming a revolving door.
  58. Not entirely true... by Mac+Degger · · Score: 2, Insightful

    There are, as yet, no data retention laws for ISP's in Europe. The UK tried to do this the other day, and got massively slapped down by the public, thereby forcing them to table the issue.
    Now THAT's democracy in action.

    BTW, doesn't anyone else find the world a scarier place after 9-11? The problem is that it's Bush who is so scary, not Al Quaida...

    --
    -- Waht? Tehr's a preveiw buottn?
  59. Free Web "Helpers" by gregor-e · · Score: 2, Interesting

    All the gummint needs to do is invest heavily in AI "helper" agents that'll assist you with your browsing, finding the best deals, talking to your friends' agents so they can let you know what your friends are doing, etc. Since they do all this for free, these agents should become very popular. Unca Shuga gets to maintain the database the agents need to perform their help, though, so they can see when disaffected youth are studying bomb design, nazism, etc. and can take appropriate pro-active action. They can also see who refuses to use these incredibly helpful little agents, and thereby focus their non-automated energies on those who obviously have something to hide.

  60. TYPO Correction: by NanoGator · · Score: 2

    "I can email my mother in complete piracy."

    I meant 'privacy' not 'piracy'. Been posting too much about the RIAA lately. ;)

    --
    "Derp de derp."
  61. Re:*sigh* by symbolic · · Score: 2

    Check this out:

    http://www.csmonitor.com/2002/0108/p1s4-usju.htm

    Further, Lawrence Tribe (a Constitutional scholar) suggested on last night's Nightline that what the government is doing may very well consitute an unreasonable search (skirting the Fourth Amendment) If the government is out to 'protect' me, who was it 'protecting' during J. Edgar Hoover's reign (COINTELPRO), when the very kinds of abuses that every American should fear, were actually occurring?