NSA Caught With The Cookies

zardo writes "The associated press is reporting that the NSA is putting cookies on visiting computers. Apparently it is unlawful for the government to put anything but a session cookie out unless it's expressed in the site's privacy policy." From the article: "Don Weber, an NSA spokesman, said in a statement Wednesday that the cookie use resulted from a recent software upgrade. Normally, the site uses temporary, permissible cookies that are automatically deleted when users close their Web browsers, he said, but the software in use shipped with persistent cookies already on. ... In a 2003 memo, the White House's Office of Management and Budget prohibits federal agencies from using persistent cookies _ those that aren't automatically deleted right away _ unless there is a 'compelling need.' A senior official must sign off on any such use, and an agency that uses them must disclose and detail their use in its privacy policy."

Comments

I call shenanigans.

[TripMaster Monkey]

From TFA:

Don Weber, an NSA spokesman, said in a statement Wednesday that the cookie use resulted from a recent software upgrade. Normally, the site uses temporary, permissible cookies that are automatically deleted when users close their Web browsers, he said, but the software in use shipped with persistent cookies already on.

"After being tipped to the issue, we immediately disabled the cookies," he said.

Honest enough mistake, right? Not, really, as it's happened before.

Here's a snippet from a 2002 Associated Press article (available here):

WASHINGTON (AP) - The CIA got caught with a hand in the Internet cookie jar.

The agency removed tracking software known as a "cookie" from one of its Web sites this week after a private group discovered the banned practice, said Mike Stepp, who manages the CIA's public Web site.

"It was a mistake on our part. It was not intentional," Stepp said Tuesday. "The public does not need to be concerned that the CIA is tracking them. We're a bit busy to be doing that."

Stepp said an outside company had redesigned the reading room Web site, which was posted to the Internet on Jan. 29.

"Unbeknownst to us, it was loaded with some software, commercial off-the-shelf software used for Web analysis," Stepp said. The software included a cookie that tracked repeat visitors to the site.

(Disclaimer: Yes, I am aware that the CIA and the NSA are different agencies. However, that shouldn't preclude one learning from the other's foul-ups.)

So either one or both agencies in question are simply incompetent, or lying to us. Which do you think is more plausible?

Re:I call shenanigans.

[AKAImBatman]

So either one or both agencies in question are simply incompetent, or lying to us. Which do you think is more plausible?

Never attribute malice to that which can be explained by stupidity.

I don't really think they'd gain much by putting cookies on the machines of web users. If terrorists do come to their site, their IP address will give them away far better than a cookie. Now if anyone finds an image on other sites pointing back to the NSA or CIA, then you may have found your smoking gun.

Re:I call shenanigans.

[__aagmrb7289]

You must make a lot of money to afford all that tinfoil.

Re:I call shenanigans.

[Anonymous Coward]

So either one or both agencies in question are simply incompetent, or lying to us. Which do you think is more plausible?

Never attribute to malice that which can be explained with incompetence. (or something).

(and yes, I've seen folks (from my school) who were hired by NSA who do not properly understand how cookies (or CGI for that matter) work; but I'd imagine they weren't hired to do webdevelopment... or were they?)

Re:I call shenanigans.

[doormat]

So either one or both agencies in question are simply incompetent, or lying to us. Which do you think is more plausible?

What, cant it be both?

Re:I call shenanigans.

[Andrewkov]

What about a laptop user visiting the site repeatedly from an Afghanistan ISP, then suddenly one day the same laptop (same cookie) starts visiting from a Washington area ISP .. far fetchned, but might be interesting to know under some circumstances.

Re:I call shenanigans.

[ackthpt]

Never attribute malice to that which can be explained by stupidity.

We're talking about a regime in the federal government which has made, "oops, well, the ends justify the means" a policy they depend upon.

I don't really think they'd gain much by putting cookies on the machines of web users. If terrorists do come to their site, their IP address will give them away far better than a cookie. Now if anyone finds an image on other sites pointing back to the NSA or CIA, then you may have found your smoking gun.

This is all rationalizing. The fact of the matter is they're using the "oo, i'm a baddd widdo boy =)" defense.

Re:I call shenanigans.

[CaymanIslandCarpedie]

"The public does not need to be concerned that the CIA is tracking them. We're a bit busy to be doing that."

OK, does that quote from the 2002 case seem humorous to anyone else now with the recent revelation of what was keeping them so busy ;-)

Re:I call shenanigans.

[rikkards]

So either one or both agencies in question are simply incompetent, or lying to us. Which do you think is more plausible?

From that comment, you must have never worked for a govt agency. If you had, you never would have asked.

Re:I call shenanigans.

[tehshen]

Never attribute malice to that which can be explained by stupidity.

Why not? Anything can be (and often is) justified by stupidity these days.

Re:I call shenanigans.

[Anonymous Luddite]

I'm sure _anything_ they deem relevant and meaningful is saved server-side, not as a cookie.

This is just a mistake.

Re:I call shenanigans.

[ja-ja-morkmorkmork]

You may be surprised how little interaction different sections within the same agency have, much less how little interaction different departments have. Lessons aren't often learned by the actions of others withing the gov't. However, putting software into production is not trivial for a fed, and NSA employs very few dummies. They knew exactly what that cookie was doing.

Re:I call shenanigans.

[Jaysyn]

Never attribute malice to that which can be explained by stupidity. ... is a bad cop-out when it comes to government responsability.

Jaysyn

Re:I call shenanigans.

[koreaman]

It means some guy from Afghanistan came to Washington DC. No more no less. I'm sure that they have better ways of ascertaining that anyway.

Re:I call shenanigans.

[Ucklak]

What's the big deal here?
There's no story and who cares if a site leaves a persistent cookie?

Much more can be obtained by perusing the logfiles on the hosted server.

Re:I call shenanigans.

[Anonymous Coward]

excuse me? a terrorist going to the CIA/NSA website?? they might as well call them up and see if they have plans for the day of an attack. someone would sure have to be a pretty stupid terrorist to give out their ip like that.

Re:I call shenanigans.

[Columcille]

I very much doubt this was anything other than accidental. Cookies aren't exactly something that can be hidden, so an agency using cookies knows those cookies will be noticed. An agency would not intentionally use cookies when they know with a certainty that use will be uncovered. They aren't stupid enough to just cross their fingers and hope no one notices.

Re:I call shenanigans.

[cold fjord]

(Disclaimer: Yes, I am aware that the CIA and the NSA are different agencies. However, that shouldn't preclude one learning from the other's foul-ups.)

So either one or both agencies in question are simply incompetent, or lying to us. Which do you think is more plausible?

You're kidding, right? NSA and CIA are separate Federal agencies with tens of thousands of employees. Their web masters and IT departments probably pay about as much attention to what the other does as Ford Motor Company & Dodge. And this is hardly the first time that a Federal agency has handed out persistent cookies against policy. Do you think CIA & NSA are in cahoots with the Office of Personnel Management, Ames Laboratory, and Bureau of Labor Statistics?

I think that a more likely and equally plausible explanation is that NSA's sys admins, web developers, and IT staff are in about the same boat as most people in IT: overworked, understaffed, plagued by too many meetings, dealing with more hacking attempts than you could imagine, struggling with a software upgrade, and simply missed flipping one of a growing number of switches in software which changed a relatively minor behavior in the software. (Another possibility is that government employees are all 10 feet tall, super geniuses that never make mistakes. I think previous discussions on Slashdot have largely deprecated that possibility.)

Besides, if you were really concerned about avoiding their scrutiny, you wouldn't visit their web site any way.

"And I have again observed, my dear friend, in this trifling affair, that misunderstandings and neglect occasion more mischief in the world than even malice and wickedness. At all events, the two latter are of less frequent occurrence." -Goethe

Re:I call shenanigans.

[Anonymous Coward]

really? you think the President ordered this too?

Re:I call shenanigans.

[castoridae]

(Disclaimer: Yes, I am aware that the CIA and the NSA are different agencies. However, that shouldn't preclude one learning from the other's foul-ups.)

Yes, it should. These are huge, independent agencies. (DHS is a mess, there is *no* meaningful interaction, even now). Why would they "learn" from each other? Especially about something so minor. Seriously, I'd much rather the NSA and CIA compare notes about terrorist plots, than constantly coordinate to make sure that they synch up on minor bits of policy. I'm not giving them a license to break the law, just saying that one screwing up should in no way be an indictment of the other.

Re:I call shenanigans.

[WolfZombie]

Both being government agencies, I vote "simply incompetent". Although, my vote doesn't count.

Re:I call shenanigans.

[Anonymous Coward]

Why do people keep mentioning terrorists? Just because Bush wraps himself in the flag and spouts anti-terrorist statements does not mean that the NSA is just about monitoring terrorists. He lied about Iraq WMD. He lied about not having a traitor in the white house. He lied when he said that once he know that he would at least fire the person (so far only one quit, and there are more to come). He lied about PATRIOT ACT and needing warrents. Now, he says that this is about nothing but terrorists and the NSA is caught putting cookies on systems. Hummmmm. Amazing at how slow we are.

Re:I call shenanigans.

[Viper Daimao]

No, we're talking about a cookie. A device used by almost every website in existence. We're talking about some guy running the NSA website not being aware that a memo from the White House's Office of Management and Budget made a guideline (not a law) to not use a universally acceptable website statistical tracking device. I wouldnt even attribute this to stupidity. Just forgot about some silly guideline. Anyone making a big deal out of this is doing so out of total computer illiteracy or being intellectually dishonest as to their true motive for their outrage.

Re:I call shenanigans.

[Syberghost]

So either one or both agencies in question are simply incompetent, or lying to us. Which do you think is more plausible?

"C", either or both are hiring the lowest bidder to do programming on non-classified web systems, in accordance with federal budgetary laws.

We're all sitting here posting about this massive government conspiracy on a web site that uses persistent cookies. Maybe the freakin' NSA loaded up slashcode.

Re:I call shenanigans.

[buddyglass]

Personally, I think incompetence is vastly more likely.

Re:I call shenanigans.

[ackthpt]

No, we're talking about a cookie. A device used by almost every website in existence. We're talking about some guy running the NSA website not being aware that a memo from the White House's Office of Management and Budget made a guideline (not a law) to not use a universally acceptable website statistical tracking device. I wouldnt even attribute this to stupidity. Just forgot about some silly guideline. Anyone making a big deal out of this is doing so out of total computer illiteracy or being intellectually dishonest as to their true motive for their outrage.

What we're talking about here, isn't stupidity or lack of seeing a memo. It's Strategic Stupidity

We all use it for minor things, like (I really didn't want to take out the trash so I conveniently forget) "Oh, I was supposed to take out the trash? Well, darn."

In the many years I've been following events in Washington, this is the most consistent use of the particular tactic I've seen since Ronald Reagan forgetting details of Iran-Contra.

NSA people are supposed to be top-notch, not some bunch of yahoos hanging out in the IT shop of Dunkin' Donuts. It's like that Plame leak, these people can't convincingly feign ignorance because they are the sharpest knives in the drawer and didn't get where they are by making casual errors. It's calculated. It's: "We'll leave the setting like it is until someone notices then beg forgiveness."

Re:I call shenanigans.

[allgood2]

(Disclaimer: Yes, I am aware that the CIA and the NSA are different agencies. However, that shouldn't preclude one learning from the other's foul-ups.)

That's a little bit like saying that I shouldn't make the same mistake, that my neighbors made in their marriage. Unless, I live in a town where everyone knows everything about your marriage; or I for some reason have an abnormal interest in your marriage; I dare say, it might take me months or even years to learn something as simple as, "O' you have a kid away at college."

The sheer number of organizations in the United States government most likely preclude one keeping up with the day to day operations of another all that well. Especially if web services are treated the same in a lot of organizations (an afterthought). The fact of the matter is the volume of web applications--content management systems, web traffic analyzers, even email submission forms--often set cookies that last forever.

If your thinking, I want to add such and such functionality to my site, without programming it, just pick it up at HotScripts, SourceForge, or outsource it, then unless you remember to go back and check associated cookie longevity, then you've just broken protocol.

That said, I'm certain there are a bevy of little known, but important rules that web developers at all levels of government should know; so maybe a nice checklist of top 10 things to look for, remember, or specify when dealing with software from outside vendors (especially commercial or contractors) should be posted somewhere, and completed, before any project is signed off on. Off course that wouldn't help upgrades, but that's life...

Re:I call shenanigans.

[jevvim]

Anyone making a big deal out of this is doing so out of total computer illiteracy or being intellectually dishonest as to their true motive for their outrage.

"The price of freedom is eternal vigilance." - Thomas Jefferson

OMB guidelines are rules on government agencies, and there are organizational penalties for failing to adhere to them. I don't see how we can excuse any agency for failing to follow the rules set out for them, let alone TWO agencies which are involved in espionage. We're not going to see a trial, because the OMB doesn't make laws, but I'm going to write my representatives in Congress and encourage them to issue a new law to codify this OMB guideline - that way, if they DO try it again, the consequences will be much more severe.

Re:I call shenanigans.

[borroff]

Umm, quite often, the NSA are the people that create these guidelines. Yes, it's probably just a silly mistake, but these guys are supposed to be the gods of security, and making sure you follow all the piddling guidelines is part of that.

Re:I call shenanigans.

[Viper Daimao]

NSA people are supposed to be top-notch, not some bunch of yahoos hanging out in the IT shop of Dunkin' Donuts.

So you think the top trained NSA agents are wasting their time making websites and doing tech support? Its their website, I doubt they spent much time on it or use it much, they have better things to do than waste time with their public website. It doesnt really seem like you have a grasp on how company IT depts work.

Re:I call shenanigans.

[Anonymous Coward]

Because there are two agencies involved. Adding the "both" choice gives each agency three states, which leaves us with the following analysis:

C = CIA
N = NSA
1 = incompetent
2 = lying
3 = both

This gives nine total states:
C1N1, C1N2, C1N3,
C2N1, C2N2, C2N3,
C3N1, C3N2, C3N3.

The 7 states that would qualify as a "both" choice would then be: C1N2, C1N3, C2N1, C2N3, C3N1, C3N2, and C3N3. (This set assumes that if one agency is lying and the other is incompetent, the "both" condition is still satisfied. This assumption could potentially be challenged, of course.)

In 2 out of 9 situations, (states C1N1 and C2N2) the agencies would not be "both" incompetent and lying, unless of course you just mean "both agencies", which would start the entire inane discussion over!

We could also consider state transitions. If they were previously incompetent, but discover the error and keep it hidden by lying, they have moved from one to the other, and both states would not be experienced simultaneously. In fact, if they intended to lie with persistent cookies, then adding an act of "incompetence" would cause the cookies to LOSE persistence. This action, although incompetent to produce the desired state, instead produces the (stated policy-compliant) "not-lying" state. So do we consider intent as well as result? And how can we determine intent without a security clearance?

Re:I call shenanigans.

[Clockwork Apple]

"Never attribute malice to that which can be explained by stupidity."

The problem with that is the volume of catastrophic mistakes that seem to "oops" happen over the last several years. When do you stop letting the baby(s) play with the gun? When the baby(s) gets advanced and secret oks and advice from folks who like accidents to happen, and when the baby(s) uses stealth means to acuire the guns anyway, dont you have to wonder at the baby's innocence?

In my opinion you couldnt do this much damage to national wellbeing by accident.

Let's be good parents and put the kids in the playpen, and lock away their access to guns before more accidents "happen".

C.

Re:I call shenanigans.

[Viper Daimao]

consequences more severe? This would be akin to throwing jaywalkers in jail.

Re:I call shenanigans.

[GoofyBoy]

>What we're talking about here, isn't stupidity or lack of seeing a memo. It's Strategic Stupidity

A cookie is pretty obvious, not exactly the high-end technology secret spy stuff. Erasing/blocking it is easy and done everyday. If you would go through all the trouble of having a "hidden agenda/top-secret", why have something that points directly to yourself, easily detected, well-known and is trival to defended against?

And exactly what would they get out of it? You need to have a motive for doing things.

Re:I call shenanigans.

[ackthpt]

So you think the top trained NSA agents are wasting their time making websites and doing tech support? Its their website, I doubt they spent much time on it or use it much, they have better things to do than waste time with their public website. It doesnt really seem like you have a grasp on how company IT depts work.

Well, let's be insulting, shall we?

Doesn't sound like you've got an inkling of how NSA works outside what you read in editorial cartoons by Pat Oliphant. There are clear procedures and more double checking than you can shake a stick at and you know bloody well they've got their network secure. These are the people who released a secure Linux, fer chrissakes.

Re:I call shenanigans.

[Hatta]

the White House's Office of Management and Budget made a guideline (not a law) to not use a universally acceptable website statistical tracking device

Who says persistant cookies are universally acceptable? I certainly don't accept them. I have a white list of about half a dozen websites that actually need to have persistant information about me, and all others get denied. Why should I be giving the NSA or any other entity more information than necessary?

Re:I call shenanigans.

[ackthpt]

A cookie is pretty obvious, not exactly the high-end technology secret spy stuff. Erasing/blocking it is easy and done everyday. If you would go through all the trouble of having a "hidden agenda/top-secret", why have something that points directly to yourself, easily detected, well-known and is trival to defended against?

And yet one of the British Tube Bombers was traced to Italy by using an ordinary cell phone. Not every public enemy is brill enough to cover their tracks in advance, right?

And exactly what would they get out of it? You need to have a motive for doing things.

They'll accumulate it all and then haul it out when it can do the most damage. This is the government which is keeping terrabytes of data on everything and wants the ability to snoop and record every packet which goes over the internet. Did you forget already?

Re:I call shenanigans.

[SoulRider]

What, cant it be both?

No, that would put them into a cat state.

Re:I call shenanigans.

[jevvim]

consequences more severe? This would be akin to throwing jaywalkers in jail.

It's not just a matter of the behavior, but the environment in which the behavior occurs. We need to be vigilant that our government respects its own laws and the rights of its citizens, and I feel the penalties for abuse of power should be severe. Even if the abuse of power is simply tracking the computers of its citizens without a warrant (which cookies can do, as you move from network to network, such as while travelling), we should consider enacting laws when the Administration fails to follow its own rules.

Re:I call shenanigans.

[Anonymous Coward]

Never attribute malice to that which can be explained by stupidity.

That doesn't help me sort out the Bush administration at all...

Re:I call shenanigans.

[Anonymous Coward]

75% of all websites are NSA owned and operated.

Re:I call shenanigans.

[operagost]

The fact remains that the White House prohibited the use of persistent cookies on all .gov in 2003. If you are trying to build yet another troll against the GWB, find me a witness to the President ordering the NSA to disregard his own order.

NSA people are supposed to be top-notch, not some bunch of yahoos hanging out in the IT shop of Dunkin' Donuts.

Not everyone at the NSA is going to be elite. The internet web page is probably one of the least critical systems at the NSA. It would be as unreasonable to expect the webadmin to be equivalent to high-clearanced personnel as to expect the NSA to have "top notch" secretaries, janitors, and cafeteria workers.

Re:I call shenanigans.

[operagost]

No, that government was the Clinton administration, which gathered huge amounts of information with Echelon. This was via the authority vested in the Presidency through the Foreign Intelligence Surveillance Act of 1978 (signed by Carter).

Re:I call shenanigans.

[nacturation]

Not, really, as it's happened before. [...]

So either one or both agencies in question are simply incompetent, or lying to us.

I noticed you made a grammatical error above with an unnecessary comma. So are you incompetent or are you just lying to us? False dilemmas suck... try to avoid their use.

Re:I call shenanigans.

[GoofyBoy]

>This is the government which is keeping terrabytes of data on everything and wants the ability to snoop and record every packet which goes over the internet.

If they keep track of every packet over the Internet, why do they need cookies?

Re:I call shenanigans.

[jacksonj04]

Ask yourself - what is bad about those sites having persistent data?

Objecting to them knowing who you are is akin to walking into every shop you visit wearing a full disguise with fake moustache, it's pointless.

Re:I call shenanigans.

[Anonymous Coward]

If you don't accept cookies then this issue does not pertain to you. What's your beef then? As long as you don't whitelist the NSA then there is no cookie...

I think some people are just looking for things to complain about.

Re:I call shenanigans.

[IO ERROR]

That AP article is full of errors, some of which I commented on yesterday. For instance, it happened twice this month. And those 30-year cookies are still around until you go and remove them...

Re:I call shenanigans.

[metlin]

Wow.

Can I have some of what you are smoking?

Re:I call shenanigans.

[ackthpt]

If they keep track of every packet over the Internet, why do they need cookies?

These are the people who will figure it out when they are good and ready, meanwhile anyone rounded up will likely rot in jail while they deny the data they have proves nothing.

Re:I call shenanigans.

[Kenrod]

The only motive Slashdotters need for outrage or intellectual dishonesty are 4 letters: B-U-S-H.

Re:I call shenanigans.

[Belseth]

Got to say people are getting too casual about cutting government employees slack for invading rights out of ignorance. They are american citizens and should be aware of those basic rights. Planting a 30 year cookie isn't an oops. No matter what is said I'd be more shocked if the information wasn't scanned for hot websites. Remember back in the day you could be labelled a commie for subscribing to Mother Earth News. They should know that the governemnt can't legally monitor US citizens without a court order but the President doesn't seem to know that one. What qualifications does a governemnt official have to have? Breathing? Yes they were building a website but they were working for the bloody NSA which should hold a higher standard. If it was a goof it's the kind that gets people fired. If no one was fired I'd tend to believe it was officially sanctioned. People are starting to think of basic rights as no big deal. Take away those rights and we get police state. Bush has got us half way there and hardly anyone has taken notice which is terrifying. In England cameras are starting to monitor your every move and in Japan the police don't need a warrant to search your house. We take a lot for granted in this country. It's sad to see our basic rights given up without a fight much less being noticed by the average person.

Re:I call shenanigans.

[Hatta]

Ask yourself - what is bad about those sites having persistent data?

What is good about it? Until I have some incentive to enable cookies for a website, I don't.

Objecting to them knowing who you are is akin to walking into every shop you visit wearing a full disguise with fake moustache, it's pointless

It's more like objecting to radio shack collecting name and address information every time you buy a pack of batteries.

Re:I call shenanigans.

[Anonymous Coward]

[...]If it was a goof it's the kind that gets people fired[...]

I'm sorry but that is ridiculous! According to the fine article, the commercial web app was updated and that update turned on persistent cookies. If someone were fired over this type of issue, I think people would leave the NSA in droves due to the hostile work environment!

Re:I call shenanigans.

[whit3]

It should be pointed out that the persistent cookie mainly is undesirable
because folk who bulk-buy surplus computer hard drives could search
for nuggets of sensitive info and be guided (as to the interests of
the original user) by those cookies.

Or folk who bulk-burgle hardware bits.

If all the cookies are from Microsoft or Yahoo or music fan sites, it's not
likely that candid comments on foreign policy from government
insiders are on THAT hard drive. But a drive with cookies from NSA and
CIA, might indicate some value of further data mining efforts.

It's a minor indication, certainly, but plugging small leaks is still worthwhile.
So, I don't see a policy intended to benefit the public, per se, but rather a policy
intended to obscure the historic record left on a filesystem. You have to
recall that NSA isn't the only data security threat out there... then
it all makes some more sense.

It's said that president Lincoln often composed letters to or about folk he
was upset at, then carefully filed them away and never sent them. I'd like
to see the hard drive text files for some contemporary Republicans to
see how their habits mirror those of the party founder.
Heck, a love-letter from Bush senior to Saddam could plausibly
be on a discarded disk drive now. Check your disk deadpile!

Re:I call shenanigans.

[Viper Daimao]

you said: Planting a 30 year cookie isn't an oops.

Ever check your own cookies sometimes? hmm, I have a 15 year cookie from ESPN, a 17 year one from MSN, ooh, a 33 year cookie from slashdot affiliate freshmeat.net, another 33 year one from google, and yet another 33 year cookie from socialist magazine, The Nation. Shall we expect jail time for all these webmasters too?

Re:I call shenanigans.

[Divide By Zero]

I'm going to write my representatives in Congress and encourage them to issue a new law to codify this OMB guideline - that way, if they DO try it again, the consequences will be much more severe.

As a federal webmaster (not NSA or CIA), let me be the first to say "Thanks a pantload." Now, if I miss a configuration setting in IIS, I could go to federal prison!

Sometimes somebody screws up. Sometimes they screw up and nobody notices. Technical oversight of my work is thin on a good day, and my boss' boss sure as HELL doesn't know if I'm serving persistent cookies. For the record, I'm not, because I follow OMB memos to the best of my ability and I double-checked this one.

It's not always a conspiracy. Sometimes it's just some server jock who was mentally elsewhere and didn't uncheck a box in Windows. Bugs in web apps I write are not intended to catch you surfing pr0n. I'm just not as good a programmer as you are. Worst case scenario at your work, you screw up, get fired, and get another job. I don't have "company policy", I have "federal statute". My coworkers and I do our best, and we do a pretty good job, but nobody's perfect. If I forget to put an "alt" tag on an image on a page linked seven deep that gets three hits a year, not only am I not doing my job correctly, but I'm in violation of 29 U.S.C. 794d. Don't think that that's the only law telling me how to do the job, either.

I'm not complaining. I signed up for the job knowing full well how it works, and I'm proud of what I do. Your vigilance is commendable, but I'm not sure that putting big nasty penalties on cookies is the right way to go about solving this one. If you and a majority of Members of Congress agree that placing persistent cookies is worth going to prison over, so be it. God knows there aren't any killers who couldn't use that cell more than me.

Re:I call shenanigans.

[Grakun]

NSA and CIA are separate Federal agencies with tens of thousands of employees. Their web masters and IT departments probably pay about as much attention to what the other does as Ford Motor Company & Dodge.

That's a bad example. Ford and Dodge are competitors, so they may be interested in what the other is doing. A more accurate example would be Nabisco and Ford.

Re:I call shenanigans.

[Cytotoxic]

Congratulations, Divide by Zero! Best post of the day - Somebody throw some mod points his way! Damn, I'd hate to get caught in the middle of the religious wars going on between the Rushies and the MoveOn.Org-ans.... This one should be a +5 insightful.

Re:I call shenanigans.

[ceejayoz]

Their web server is undoubtedly working on a separate network from the super secret NSA databases, and most likely with an entirely separate staff.

If the NSA website gets hacked, no biggie. If the NSA's internal network gets hacked, big deal. Very different situations.

Re:I call shenanigans.

[ceejayoz]

And yet one of the British Tube Bombers was traced to Italy by using an ordinary cell phone.

I don't think the guys who blew themselves up worried much about getting caught afterwards.

Re:I call shenanigans.

[ceejayoz]

It's more like objecting to radio shack collecting name and address information every time you buy a pack of batteries.

Not really.

I'd say it's more like RadioShack saying "here's a customer number, bring it back and we'll have an easier time finding your records next time... but if you want to rip it up, be our guest - we've got you on the security camera anyways."

Re:I call shenanigans.

[ZhuLien]

The same stupidity that prevented someone from reading that memo a few years back 'Iraq has no WMDs'...

Re:I call shenanigans.

[Anonymous Coward]

As a federal webmaster (not NSA or CIA), let me be the first to say "Thanks a pantload." Now, if I miss a configuration setting in IIS, I could go to federal prison!

Your running IIS for a federal website? You should go to prison for that alone.

Re:I call shenanigans.

[Divide By Zero]

Regrettably, it's not up to me. The entire government runs on Microsoft. I'd actually prefer a *nix solution.

Re:I call shenanigans.

[Divide By Zero]

Clarification: I've never seen or interacted with a non-Windows machine in my work in the gov't. I'm sure some exist, but I've been told on more than one occasion that *nix is not an option for me. So there.

Re:I call shenanigans.

[operagost]

Truth=flamebait

Re:I call shenanigans.

[Viper Daimao]

I have to believe you're 100% right. BDS is blinding even all these highly technical people. They know how harmless and easy to avoid cookies are, they know how every website uses them, they probably can sympathize with forgetting to check a setting that is normally not checked. But they also hate republicans and hate Bush and are willing to make themselves look ridiculous and idiotic to score a hit against him.

Actually though, I have to give it to many slashdotters. The majority agreed that this was a mountain out of a molehill, its just this somewhat minority calling for people to get thrown in jail for this that really gets me.

Re:I call shenanigans.

[zerofret]

I am also the webmaster of a Federal web site. I've actually had people write to complain that our site doesn't do things like prefill web forms with data they entered the last time they were at the site. They figure that if Amazon can remember who they are between visits we should be able to as well.

As a federal government employee, I've long accepted that there are thousands of people out there who have no clue as to how many regulations I have to try to comply with, and who couldn't do five minutes of my job successfully if their very lives depended on it. Yet these same people feel they have to constantly tell me how to do the job. Every so often, you get someone who thinks federal employees should be sent to jail for even the most innocuous mistake. Never mind that this would result in nobody at all working for the federal government.

Either I make the first mistake and get sent to prison myself, or I see someone else make a stupid little mistake and get jail time for it. Either way my public service would end there, as I'm not stupid enough to hang around that high risk of a work environment. Anybody smart enough not to make mistakes too often, will also be smart enough to bail ASAP.

Re:I call shenanigans.

[pfleming]

"It's more like objecting to radio shack collecting name and address information every time you buy a pack of batteries."

The last time I was in Radio Shack all they wanted was a zip code.

Re:I call shenanigans.

[SIGFPE]

Never attribute malice to that which can be explained by stupidity.

First rule of passive-aggressive maliciousness: act in such a way that every act of malice you perform can be explained away with the excuse of stupidity or ignorance.

Oh nos!!! NOT TEH COOKIES!!!

[Anonymous Coward]

Clearly someone made a mistake. If the NSA wanted to track you, they wouldn't leave it to browser cookies. They try to make the 203x expiration date seem like a big deal, but that's how you do "permanent" cookies for logins and such.

Re:Oh nos!!! NOT TEH COOKIES!!!

[Lost Penguin]

If the NSA wanted to track you with a cookie, they would do it with chocolate chip, not a browser cookie.
I saw "Enemy of the State" already; this may have been a training OP . . .

How dare they?

[the computer guy nex]

"So either one or both agencies in question are simply incompetent, or lying to us"

I know, how dare they place a cookie on my machine! No other site in the intarweb does!!

Don't you think you overreacted just a little??

So what?

[Viol8]

Cookies are easy to delete. This is hardly a "Your Rights Online" issue. Jeez.

Re:So what?

[Anonymous Coward]

Cookies are easy to delete.

Moreover, they're even easier to not be created in the first place.

In Internet Explorer 6, go to Tools->Internet Options, Privacy Tab. Clicking the "Advanced" button will let you set it so cookies are denied or ask for your approval before being set. You can go the easier route and set the security to High or Block all Cookies.

It's left as an exercise to the reader to determine the steps needed for other browsers.

Re:So what?

[vk2]

The question is about its legality

Re:So what?

[mc6809e]

Cookies are easy to delete. This is hardly a "Your Rights Online" issue. Jeez

Right. You'll hear that story but the story, "Student confesses to fabricating US surveillance story [Mao's "Little Red Book"] will never be posted by the slashdot editors.

I guess they're part of the "fake but accurate" crowd.

Re:So what?

[grasshoppa]

Er....
http://yro.slashdot.org/article.pl?sid=05/12/28/22 31257&threshold=-1&tid=167&tid=123&tid=217&tid=188

Re:So what?

[Manchot]

Yeah, and bugs placed in your house are easy to remove, provided that you know they exist.

Re:So what?

[Syberghost]

Please explain to me how accidentally distributing a cookie to a few users for a while constitutes disseminating personal information in violation of that law.

Re:So what?

[heinousjay]

Hey, you caught a flamebait mod! Congratulations - that's just the dirty liberals callin you a truth teller, Timmy. By golly, welcome to the truth tellin club!

Re:So what?

[HiThere]

Well, it *is* a valid yro issue. Just not a very important one. The NSA has much more flagrant violations of civil rights that is isn't correcting (e.g., the ones that the office of the president has an interest in). This is merely the violation of some bureaucrats order, without (apparently) much larger significance.

Re:So what?

[Pyrion]

Flawed analogy. Here you have the capacity to specifically configure your browser to ask you if you want the cookie installed. Most people just opt for letting everything install behind their back.

You wouldn't have bugs placed in your house if you denied the NSA access to your house, logically-speaking.

Re:So what?

[xdc]

My web browser notifies me anytime a new site tries to set a cookie, and informs me of its expiration date or whether it is a session cookie. It is easy for anyone concerned about cookies to simply manage them. If anyone looking at the NSA's public web pages is worried about being tracked, the onus is on them to take reasonable precautions.

Re:So what?

[Geoffreyerffoeg]

Right. You'll hear that story but the story, "Student confesses to fabricating US surveillance story [Mao's "Little Red Book"] will never be posted by the slashdot editors.

Key word "will". It already "has been", in the most recent Slashback. In case you're still complaining about this, realize that they only do retractions in Slashbacks, and no, you don't get karma points for submitting something to a Slashback.

Re:So what?

[nwbvt]

The origional story was the /. version of a front page story, the fact that was a hoax was burried in a Slashback summary. Doesn't that pretty much prove his point?

Re:So what?

[nwbvt]

So whenever someone breaks a law we are making it a "Your Rights Online" story on /.? Well I saw someone run a red light this afternoon, where do I report it?

Perfectly understandable

[MyNymWasTaken]

Because we know that the people in that agency, even more so their IT dept., know absolutely nothing about how computers work.

Re:Perfectly understandable

[Anonymous Coward]

Here's the thing -- if you were smart, and worked for the NSA, wouldn't "web server sysadmin" be the last job you'd want to have?

Re:Perfectly understandable

[AJH16]

Keep in mind that they have a desire to know how well used different sections of their site are used. It is logical, economical, and responsible to use off the shelf software for this purpose and it helps them make sites that better aid those who use their site. It is not like they are spending every waking second thinking about the fact that cookies need to be off. Chances are good that whoever installed the package wasn't even aware that they weren't supposed to have cookies off. I know it isn't something I immediatly check for when setting up a site.

Re:Perfectly understandable

[Anonymous Coward]

At least the Mods got the point.

It was a joke!

More than 35 people?

[jollyroger1210]

I guess they were spying on a lot more than 35 people, unless these cookies were discriminatory, which I don't think they were.

SLASHDOT JUST SET A COOKIE!!!!

[Anonymous Coward]

I bet they're working for the NSA. If not, they're incompetent or liars, or both!

OMG! Run for the hills!

[Brian Stretch]

The NSA is stamping your PC with the Mark of the Beast, a... cookie? So if you ever visit a NSA website again they'll know it's a return visit? This is useful... how?

Oh, this is all about riling up room-temperature-IQ journalists (I'll be charitable and note I mean Fahrenheit) into another hissy-fit over the fact that Bush is still president. Never mind. Go read some history.

Unlawful???

[ferrellcat]

"Unlawful"???

"NSA"???

Did I mistakenly click on a link for the Onion?

Re:Unlawful???

[Anonymous Coward]

ROFL
would be a perfect article for the onion, wouldn't it?

Re:Unlawful???

[myowntrueself]

Don't forget the big cock-up with the black highlighters...

I mean, who would have thought that using black highlighters could be a mistake? You want to draw attention to some text in a document, highlight it in bold black. Seems perfectly natural...

sigh

[hardcnxn]

So the NSA's gotta hold a bake sale now to fund a wiretap?

The Patriot Act

[Dysfnctnl85]

They should probably make a provision for this in the Patriot Act, or have they already? At least that would make its illegitimacy legitimate in the eyes of the law.

um.

[supernova87a]

yes, because the thing I fear most about the NSA, with their acres of listening stations, underground football fields worth of humming supercomputers, and small armies of intelligence agents, is the cookie that they placed on my computer while browsing their website....

need glasses, anyone?

Re:um.

[Anonymous Coward]

need glasses, anyone?

Yes, I do! They wouldn't happen to have a reddish tint, would they?

Re:um.

[TubeSteak]

I already wear glasses, thank you very much. But if you're willing to spring for some of those titanium flex frames, I'm all in.

Seriously though, while this may be a mistake, the law is there for a reason.

Maybe it's to prevent the NSA from opening up a doubleclick account and using National Security powers to secretly get your browsing log from [ad-tracking company].

Someone cared enough to write this legislation and a bunch of people (who may or may not have known about this provision) voted it into law. If you spend all your time caring about the big issues, enough of the ignored little issues might accumulate & make the issue moot.

Re:um.

[Anonymous Coward]

"yes, because the thing I fear most about the NSA, with their acres of listening stations, underground football fields worth of humming supercomputers, and small armies of intelligence agents, is the cookie that they placed on my computer while browsing their website...."

Dude, you browsed the NSA website? You're toast. I mean, those guys have stuff so good that if you even use the initials they...

Oh, wait.

No big deal

[Trolling4Columbine]

We recently learned that the NSA could be listening to any of our phone conversations. This is insignificant in comparison.

Re:No big deal

[Syberghost]

We recently learned that the NSA could be listening to any of our phone conversations. This is insignificant in comparison.

You recently learned that the government has been conducting warrantless wiretaps on people whom the Attorney General signs a sworn statement are agents of foreign powers, and that they've been doing it since 1978, and that it's been upheld by the Supreme Court and even the FISA court; either that, or you read a New York Times headline and thought you were reading the news. Unless you've done something to make the Attorney General willing to stick his neck out that far that you're a foreign agent, such as talk to Al Qaeda goons so often that you show up in their speed dial when we catch them, "our" is the wrong term.

Besides, this is insignificant without a comparison.

Re:No big deal

[Anonymous Coward]

Unless you've done something to make the Attorney General willing to stick his neck out that far that you're a foreign agent, such as talk to Al Qaeda goons so often that you show up in their speed dial when we catch them, "our" is the wrong term.

If it's that easy to distinguish the "bad guys", it shouldn't be terribly difficult to obtain a warrant, no?

Re:No big deal

[Syberghost]

If it's that easy to distinguish the "bad guys", it shouldn't be terribly difficult to obtain a warrant, no?

Maybe, but the 1978 FISA act authorizes warrantless wiretaps for up to a year, with notification requirements that are legally able to be met by typing up a memo, putting it in a sealed envelope, and sticking it in a safe in NSA headquarters marked "FISA documents".

Per 50 USC 1802, subsection a, you only have to bust that envelope out of seal and hand it over to the FISA judge if you file charges, or seek a warrant. You'd only seek a warrant in that case if either you wanted to surveil longer than a year, or you determined that the subject was in fact not an agent of a foreign power, but was in communication with foreign agents and might thereby be privy to useful intelligence.

As long as it's under a year and the AG thinks he's a foreign agent, it's legal, and has been for 27 years. Want to argue it's a bad law? Fine, argue that; but don't blame Bush for a law that was passed by a Democrat-controlled House, a Democrat-controlled Senate, and signed by a Democrat President; and don't believe the New York Times' disingenous play-acting of moral outrage. They've known about this law for longer than you've been alive.

Re:No big deal

[cold fjord]

I will add a few links for commentary by:

Lawyer & blogger John Hinderaker of Powerline blog

Former Clinton administration Associate Attorney General John Schmidt

A Justice Department response to Congress by Assistant Attorney General, William Moschella

The quick & dirty version is: There is a very strong case this was prefectly legal.

And, of course, Congress was notified of the program.

No right to privacy with the war on terror

[xoip]

White House's Office of Management and Budget prohibits federal agencies from using persistent cookies _ those that aren't automatically deleted right away _ unless there is a 'compelling need.'
If they can tap phone calls whats wrong with dropping cookies?

Re:No right to privacy with the war on terror

[WolfZombie]

I see no problem with dropping cookies... just don't violate the 5 second rule when you pick them up.

Re:No right to privacy with the war on terror

[letxa2000]

Hmmm, I always thought it was the 10-second rule.

Re:No right to privacy with the war on terror

[Viper Daimao]

Only if you dont pick it up within 5 seconds.

Deja vu

[hoshino]

NSA caught with cookies?

interesting opinion.

[Anonymous Coward]

We'd like to discuss this with you in person. You know those New Year's plans you were making yesterday from your Cingular phone, from approximately 4:27PM to 4:34PM? Consider them cancelled. How does a quick trip to Bulgaria grab you, instead? No need to pack, and we've already got the flight ready.

Next up: NSA keeping logfiles

[Anonymous Coward]

NSA has configured their webserver to track visitors in a "LOG" file. They keep the time, your ip address, where you visit, your browser and other information. What are they doing with this, you ask? They are ... MAKING STATISTICAL GRAPHS!!!! Alert Drudge, alert the New York Times... this baby's about to break wide open.

Re:Next up: NSA keeping logfiles

[cvd6262]

Yeah, can you believe it. An the cookies weren't even set to expire until 2035, probably (from TFA) because most computers would no longer be in use then!

I guess there's no use explaining Unix time to them?

Re:Next up: NSA keeping logfiles

[cmburns69]

*** Warning: Your computer is broadcasting an IP address! ***

(I always wondered how those spammers found me, now I know...)

Where's the priorities/Who cares???

[acoustix]

Ok. Let me get this straight. We don't want our government websites to contain persistent cookies, but every other website in the world (including sites with malicious intent) can have persistent cookies? Why is this a big deal? Don't like it? Then delete the cookie or disable cookies alltogether. It's not rocket science.

This is all messed up. We're basically giving more rights to malicious websites than we are to government agencies.

-Nick

Re:Where's the priorities/Who cares???

[zev1983]

"We're basically giving more rights to malicious websites than we are to government agencies."

This statement suggests you endorse giving the government the same leeway in their actions that criminals give themselves.

Re:Where's the priorities/Who cares???

[oneiros27]

The problem is that it's against the government's own guidelines. Specifically, OMB memo 00-13, which it's my understanding was to clarify 5 USC 552a, aka. The Privacy Act of 1974.

So, by the Privacy Act of 1974, setting cookies may be illegal for the government to do. (I'm not saying 'is illegal', as I'm not a lawyer, and I have no idea if there is a legal precident for this)

Re:Where's the priorities/Who cares???

[WankersRevenge]

The issue at hand is the use of cookies in direct violation of govermental policy. To a far lesser degree, it's like Sony still installing the rootkit, even though you opted out of the EULA.

From the article:

The government first issued strict rules on cookies in 2000 after disclosures that the White House drug policy office had used the technology to track computer users viewing its online anti-drug advertising. Even a year later, a congressional study found 300 cookies still on the Web sites of 23 agencies.

Re:Where's the priorities/Who cares???

[Anonymous Coward]

Here's how to get it straight. We submit to our government authority that gives it great powers over our lives. In so doing government has a responsibility to behave in a manner beyond reproach. If you believe it should have the rights of a malicious website, then it deserves no more respect then that given to a malicious website and no authority over our lives. ~Joe

Re:Where's the priorities/Who cares???

[10101001 10101001]

"
Ok. Let me get this straight. We don't want our government to abridge speech, but every other individual in the world (including people with malicious intent) can abridge speech (trespassing laws, not printing an article, paying people to not listen, etc)? Why is this a big deal? Don't like it? Then don't speak alltogether. It's not rocket science.

This is all messed up. We're basically giving more rights to malicious individuals than we are to government agencies.
"

Okay, having done that, people aren't given rights by people. Rights are innate (creator innate or not). Government agenices are given privileges. When they overstep their privileges, they are punished. The reason this is a big deal is that persistent cookie tracking is just on the border of violating the fourth amendment. To avoid possibly overstepping this bound, by intentionally getting more data than was necessary or having a deal with a private company to collect data without a warrant, a guideline was put in place that would hamper attempts to do anything of the kind. That guideline was broken, so the NSA should be punished, regardless of if it actually violated the fourth amendment.

And to an extent, you're right that this isn't a huge deal in itself. It's just that this with the wiretapping makes people very suspicious that the NSA intentionally was leaving permanent cookies and was very likely violating the fourth amendment here too.

It's similar to being lied to by your child that they've been taking your favorite lemon candies and finally catching them, then discovering later that your next to favorite chocolate candies were recently openned by the same child. It's something at least worthy of an investigation, and if you told your child not to open them, something definitely worthy of punishment.

Simple Solution

[Bob_Villa]

Just set your browser to delete cookies when you close the browser. I think that is a basic setting on any browser. Now, if they had some kind of "supercookie" that you couldn't delete, that would be more interesting. Or if you tried to delete it and the Department of Homeland Security came knocking on your door.

Honestly, though, there are plenty of sites that install cookies. If you don't like them, delete them. It is as simple as that.

What do I care?

[Eli Gottlieb]

Why Baath would Iraq I be kill on insurgency the Hamas NSA's London website Israel anyway?

Re:What do I care?

[Geoffreyerffoeg]

I don't be-libya. Yemen not know this, but iran a server farsi NSA some time back. Oman, did they have some syrias records about people. Holy shi'ite, kuwait until the press hears this. There israeli going to be allah-t of complaining sometime sunni.

Interesting

[voice_of_all_reason]

How come if the government breaks the law, they get off with stopping the action and an apology? I should try this when they accuse me of a crime.

"Sorry, officer. You're right, I was going to sell these 30 pounds of crack to some schoolkids. But it's okay, as long as I throw it away and promise not to do it again. Right?"

Re:Interesting

[Overzeetop]

You're just not rich enough, and the crime you mentioned isn't white collar. Corporations pull this shit all the time. It doesn't apply to individuals, unless, of course, the infraction is small, and you're famous, in which case you're likely to get off easy, but that's something else entirely.

Re:Interesting

[DrSkwid]

I'm confused (which isn't difficult), how does a Whitehouse guideline become Federal Law ?

Re:Interesting

[jrwilk01]

They didn't break any laws. They violated a policy. Huge difference.

Re:Interesting

[jrwall0318]

It's more like, "Sorry, I didn't realize I put this candy bar in my pocket and forgot to pay for it. Here's the money for it, and it won't happen again." You're not going to jail for 10 years for shoplifting; it's just not that big of a deal.

Re:Interesting

[voice_of_all_reason]

Then I'd be pretty concerned about all the articles latelt that call Bush's stand on torture a "policy" too...

Re:Interesting

[CaymanIslandCarpedie]

Corporations pull this shit all the time.

Ya know, in criminal cases things like insanity are affermitive defenses and the defendant has to prove he is insane. I think I'd enjoy the corporations "i didn't know" defense a lot more if it they REALLY had to go out and prove "no, we really are that stupid!". ;-)

Some of the Enron/WorldCom guys are doing this now and though I hope they don't get off, at least its entertaining.

Re:Interesting

[voice_of_all_reason]

I think it's more like "Sorry, I didn't realize I was copying the customer credit card numbers from the company server instead of my project specs. Here's the file back, and it won't happen again."

Was the NSA required to destroy the data it collected off the cookies? The article says they just disabled the cookies. Sure, this is a small issue now, but you can bet the same thing will happen even if the courts rule Bush isn't allowed to authorize phonetaps without a warrant anymore. They'll still be able to use what data was already collected.

Re:Interesting

[ginotech]

what data? do you even know what a cookie does?

Re:Interesting

[shawb]

I believe the whitehouse guideline was a clarification on the privacy act of 1974, which is law. I doubt this guideling has been court tested, though.

Re:Interesting

[Anonymous Coward]

Its not a law you fucknut. It was a government policy. Just as McDonalds has a policy to throw away fries after 5 minutes of sitting. There is no crime. Pull your head out of your ass, unload your gun, climb back into your pickup truck and head back to your cabin, maybe you will get lucky and see another flying saucer on your way.

People need to pay attention when it comes to the news media, they make money off of flashy headlines and small bits of juicy information. You fell right into the trap and left your common sense behind. Informed decisions CAN NOT be made on complex topics by a headline or even in a few paragraphs. Thirty second campaign commercials should not be a basis for a decision. They are by design, biased, short, and only state a small subset of facts, opinions and/or figures. Reading a glorified news article is no different.

Re:Interesting

[Omestes]

Sensationalize much?

I'm sure these NSA cookies lead to a massive loss of human life and limb. I'm sure they are also in direct violation of the Geneva Convention, and international law. Right....

Torture is bad, BUT IT HAS NOTHING TO DO WITH THE ISSUE AT HAND!

I'm getting sick of the idiotic political comments (not just here)... "In other news it will be warm and sunny, with highs reaching into the 80s... Like TORTURE, or ILLEGAL wiretaps!"

Please, keep the politics on topic at least. Random outbursts and false analogies doesn't further anyones case, it just makes the presenter look like an idiot.

Sorry for sounding caustic.

Re:Interesting

[Scratch-O-Matic]

A cookie sends information FROM the server TO the client, not the other way around. Even when the server retrieves the cookie, it is only retrieving information that the server itself placed in the cookie. Oh, and a web server can only read cookies left by that same server. So please tell me how Bush/wiretaps/warrants fits into this issue at all.

P.S. My computer currently contains 15 cookies from Slashdot. How many are on yours?

am i the only one who isn't concerned?

[sirmalloc]

seriously...it's a freaking cookie. it's not like doubleclick where hundreds of thousands of websites have an iframe that is capable of reading your cookie and tracking your browsing habits. even if they decide to track it across all government owned websites, it's nothing they couldn't already do with simple logfile analysis.

i'm sure if the NSA wanted to track your every move 1) They already are 2) You don't know it and 3) There isn't anything you can do about it.

Re:am i the only one who isn't concerned?

[TubeSteak]

Without a law like this, what would stop them for signing up for doubleclick's program?

And getting the records of your browsing across any/all doubleclick websites?

Hmmm?

Simply put: The NSA isn't supposed to snoop domestically.
Cookies or not.

Re:am i the only one who isn't concerned?

[warp1]

Wow, that is sloppy. Even for the NSA.

NSA Cookies Don't Scare Me

[putko]

NSA Cookies don't scare me. What scares me is the idea that the NSA could get my ISP's records, or Google's data. All of that would give them a lot more info than my NSA cookie.

All they need to get the data that Google has gathered is a court order.

Re:NSA Cookies Don't Scare Me

[Amouth]

"All they need to get the data that Google has gathered is a court order."

acording to bush they don't even need that.. remember he is above the law he can jsut give a secret exacutive order

you aren't necessarily a troll if you don't care..

[quinxy]

I've now seen a bunch of comments modded down as trolling despite their being reasonable comments by people who just happen not to wear tin foil hats. If this article freaks you out or upsets you and seems like an important rights issue, great! I'm glad you're interested in defending your rights and by extension all of our rights. Thank you! But, don't by modding suppress the opinion of many who feel this isn't some stunning/shocking/scary revelation. That many feel the issue isn't a major one is itself an important thing to know.

As for me, Carnivore and all the recent "unlawful" wire taps scare me, a permanent versus a session cookie, not so much.

Quincy

OK, NOT to be confused with Wiretaps

[member57]

The so called illegal wiretaps were in fact legal. Liberals and their pet media have spun the wiretap issue into something it is not. The President and the NSA had bipartisan congressional oversight of any and ALL wiretaps performed. Now the cookie thing is illegal and should be investigated.

Re:OK, NOT to be confused with Wiretaps

[mrmtampa]

It's true that a literal interpretation of the 9/11 resolution might give the Executive carte blanche in the fight against terrorism. I'm not a lawyer but I've always thought (probably mistakenly) that a judge will look at the intent of the legislators and not just the language. Of course if you bypass the judiciary you don't have to worry about that, do you.

Hot Tech Skills for 2006

[faqmaster]

Security and encryption - to protect us from our own government.

Doens't anyone understand cookies?

[jrwilk01]

So the NSA could use session cookies to track visitors to THEIR website across multiple vistis?

Big freaking deal.

Do people not get that? The cookie was issued by nsa.gov, and could only be read nsa.gov, and in no way could track a user's movements across "teh intarnets." The NSA could use it to see if you'd been to their site before.

If they NSA wants to know where you've been, they'll just subpoena Google. Their cookies are all over the place.

Re:Doens't anyone understand cookies?

[TubeSteak]

The law prevents the NSA from issueing any permanent cookies without saying that is what they've done (in the privacy policy)

As for bringing up google,
1) you don't know if they have a google cookie
2) you couldn't read it if they did
3) you don't know if they visited a google site while using the same IP as the one they had at your site

If they signed up for google analytics, then sure, google would have a perfect record of any google cookie that visited your site. But the law prevents them from doing that.

It might be a small issue, but someone thought it was important enough to put into law.

Re:Doens't anyone understand cookies?

[Control Group]

but someone thought it was important enough to put into law.

Strikes one and two. First, it was put into White House policy, which is not the same as law. Second, it's a good bet that not even the person who did it thought it was important, they just thought it was good PR because the unwashed masses for some reason think cookies are evil.

This way, they could, with a straight face, talk about how the NSA was protecting your privacy while simultaneously listening to their no-warrant phone tap on your home line.

Which, I suppose, is "important" in the sense that PR is important to the person relating publicly, but not "important" in any sense that anyone willing to expend a modicum of rational thought would think of the word.

A cookie?? Why is this even an issue?

[WidescreenFreak]

Maybe I'm lacking some information on cookie spcifications, but I was under the impression that cookies can only be read/written by the web site that you are visiting unless there are links to other sites, such as advertising sites, that manipulate cookies. This is of course how you can visit a site but then get cookies from 24/7 media, AdServer, and others. But the cookies cannot be arbitrarily read by other web sites unless there is some kind of partnership going on. Again, this is the impression that I was under regarding general cookie use. So, if that's correct the NSA cookie is not even an issue when you visit other web sites unless they're specifically looking for it -- like any of them would.

Okay, so the NSA puts a permanent cookie on the system. Why is this an issue? It's not a security breach; it's not a cross-advertising cookie that tracks where you go. There's not one of us who has installed software and went over every configuration setting with a fine-toothed comb, particularly with off-the-shelf software, at one time or another. Cookies are also easily removed and can be blocked on future visits. Of course, the web logs themselves can get the IP address of everyone who visits, so even if you block cookies, the NSA can still tell exactly when a specific IP address contacted their site.

I realize that the U.S. government, particularly the current administration, is not a favorite of the Slashdot crowd and that this will be (and has already been) touted as "yet another flagrant policy violation!!!" by political opportunists here on /. But this to me is nothing more than unnecessarily putting some fuel on an already smouldering dislike for the current administration, courtesy of an ill-informed and/or careless IT person at the NSA, in the hopes that a large, anti-NSA and more generally anti-current-administration fire will grow out of it.

Just my two cents. Convert to your currency as necessary.

Just leave it be

[poppycock]

The NSA is a big powerful agency, and we are correct to be concerned with their power. But this just isn't a big deal. Its a bad law, almost certainly written with little or no understanding of the technology involved, and I'm completely confident that this was an honest mistake by the NSA. Do you think the uber spies in the NSA are running their website? I mean, I'm sure they're pretty sharp, but at the end of the day they're IT guys like thousands of IT guys everywhere, and they upgraded some software with unanticipated side effects.

Unregulated Phone and Email monitoring good...

[handmedowns]

Cookies BAD!!! Bad NSA Bad!!! btw, its pretty sad I had to edit this post to take out the all caps on all of five words because I couldn't get past the "lameness filter". Lameness filter == lame

OMG!

[mshmgi]

Oh No! Slashdot has set 36 cookies on my computer. Is Cowboy Neal in league w/ the NSA???

Not a troll

[porkThreeWays]

First of all, their office of management and budget made this policy. A pencil pusher/bean counter policy that is hard to keep up with in the real world that their IT staff has to follow, not them. I agree 100% with the parent. They probably have a million regulations they have to follow, with many many employees spread all over the map, with software from 3rd parties, with countless people who probably don't even know this policy exists there.

The reality of it is, the CIA/NSA/Whatever has a billion other much more effective ways to track you. Their intention was obviously wasn't to track people, and they immediatly removed it after it was brought to their attention. I hate our current administration, but this is just some fucktard news reporter that is up 'n arms about the wire tapping escipade. I do not agree at all with the wire tapping, but this has ABSOLUTLY NOTHING TO FUCKING DO WITH THAT. I can't believe the reporter is such a fucktard that he couldn't spend 2 minutes to research cookies and what they are. Setting cookies far into the future is the de-facto way to keep a cookie on your computer a long time. Most cookies that aren't set as session cookies are set to dates 10 years or more in the future, way more than the computers expected lifetime. The reporter has no clue what he's talking about and should be slapped like a bitch. I hate reporting like this because then it takes away from things we should be legitimitly concerned with. People get an overflow of bullshit news and many can't pick out the real from the fucktards like this guy.

Re:Not a troll

[Anonymous Coward]

I don't get it. So what you are saying is that this guy is a fucktard?

Re:Not a troll

[spacefiddle]

"First of all, their office of management and budget made this policy."

Couldn't agree more. It's just a government policy. Those are optional. If the CIA, NSA and others started just following policy, where would we be? Anarchy, i tell you. Besides, if the TLAs start doing every little thing by the book, they'll be permanently hobbled in the War On Terrirrr and we'll lose.

"I hate reporting like this because then it takes away from things we should be legitimately concerned with."

Yeah. Funny that, huh? Amazing really. Seems like every time something important comes close to pushing thru the SitCom haze to our viewing audience, some goofy triviality pops up in our 'liberal' media to make a sideshow; or some minor, lesser scandal takes center stage.

Why you'd almost think there were highly-paid, experienced professionals *made* to turn things around in such a fashion, but that's crazy! You'd have to spend all day sitting around thinking ways up to deflect and turn issues you Don't Like in your own favor - "Spinning" them, to coin a phrase - requiring the skill of a surgeon, or a Doctor, really.

And if some budding young eager (if perhaps vapid and technically clueless) journalist was handed a story with all the currently popular buzzwords - privacy? NSA? Domestic Spying? - i strongly doubt they'd go ahead with it. Who likes to cash in on trends? Pshaw!

But anyway. Only liberal antiamerican crackpots come up with such conspiracies. Even if it was done right out in the open - in fact, i bet even if it was a HUGE and well-paid, high-powered industry in its own right - why, i'd just call it a 'wacko conspiracy' thereby preventing anyone from taking it seriously.

After all this is a land of ideas and free speech, so don't even think about it and don't mention it again.

So what???

[jakemertel]

This is obviously an attempt by the reporter to blow things out of proportion. The article is quite misleading to the non tech-savvy reader. A cookie sent to your computer by a website can be access only by that website. The cookie can only contain information from that website. Meaning that this limits NSA's ability to track you to which pages you have visited on THEIR site. Now, I understand how some people feel that even this is a violation of their privacy, but when my brother read the article, he got the impression that by the use of these cookies, NSA was able to track where he went online, not just on the NSA site.

Re:So what???

[geekoid]

"A cookie sent to your computer by a website can be access only by that website. "

besides the fact that you are wrong, the NSA is not supposed to track US citizen via any means. Some exceptions apply.

"The cookie can only contain information from that website."
yes, like the fact you've been there.

Re:So what???

[jakemertel]

A cookie can only be accessed by the website that placed it on your computer. I am a professioanl web developer, I know how cookies work. Department of Defense Directive 5240.1 authorizes DoD agenceys to track website useage information. Also, there is no law - only executive orders - that prevent NSA from monitoring citizens of the United States.

Cookies?

[Cro Magnon]

Wow! I got cookies from my mom, my aunt, and my cow-orkers, but I didn't know NSA was doing that. That's nice of them. I'll have to visit their site and pick up some.

Crap! The secret is out!

[Anonymous Coward]

This was the missing link in the puzzle...despite all the capabilities of the NSA (I know, I work there as a contractor), they needed cookies to finally put it all together. Haven't you noticed your favorite spam links and porn sites often redirect you to nsa.gov? That's so they can install that cookie on your machine. It's not just any cookie, it's super-persistent! If any piece of your clothing brushes up against your computer then you become trackable by satellite.

Obviously there are severe repercussions for my revealing this information so I must post this AC. Don't worry about me, though, I dropped all my clothes in the mail so I can't be tracked now.

The Priorities Are Right Here

[TubeSteak]

Your analogy is wrong.

On its face, your point may seem 'interesting' or 'insightful', but that is only because you are ignoring the fact that U.S. government websites are not like every other website. Government websites are extensions of the state.

We don't want the NSA/CIA/government websites to contain persistent cookies,
IN THE EXACT SAME WAY THAT WE DON'T WANT THE NSA WIRETEAPPING US.

Instead of comparing this to "every other website in the world", try comparing the behavior to every other government in the world.

The issue isn't necessarily about cookies, it is about principles. The principle being that the U.S. Government does not track or snoop on its citizens.

Re:The Priorities Are Right Here

[Scratch-O-Matic]

Cookies are the same as wiretapping? I don't think so. Nor can I conceive of a scenario in which the NSA would be able to "snoop" on me by adding a cookie to the pile already residing on my machine.

I think the prohibition against government sites dropping cookies is more akin to forbidding government offices from reading caller ID from incoming calls. This cookie business may sound ominous to people who don't know any better, but in fact it's just a very common implementation of standard web serving technology. Just like caller ID, while it technically may involve "privacy" issues, it's a common technology that is used all the time and is frequently enabled by default on both the client and server side.

Re:The Priorities Are Right Here

[Dunbal]

The principle being that the U.S. Government does not track or snoop on its citizens.

      It doesn't?

Re:The Priorities Are Right Here

[TubeSteak]

Yes, it's just like them "forbidding government offices from reading caller ID from incoming calls"

It is the principle of the matter.

pre-9/11 some people used to think a minimally invasive government was a good idea. The country was founded on the idea of state and personal autonomy from the government.

technically involving "privacy" issues is the exact same thing as 'actually' involving privacy issues. Potentially invasive laws (or laws that specifically don't prohibit certain behaviors) usually means it is a matter of 'when' and not 'if' they will be abused.

I'll say it again: It is the principle of the matter.

Re:The Priorities Are Right Here

[ACMENEWSLLC]

This is persistent cookies. They can still create temporary cookies. While the law is one issue, policy is another. It's not a bad policy for a security agency to delete peristent cookies. Prevents a NSA agent from forgetting to logout (delete the cookie) even though he rebooted the PC, and someone else getting his credintials.

Re:The Priorities Are Right Here

[Scratch-O-Matic]

I think it's a real stretch to call persistant cookies invasive. Allowing such an exchange is usually the default behavior on both the client and server side. Do you think storing a cookie on a client machine (if allowed by the settings on that machine) is more invasive than reading a caller's phone number off caller ID? Can you tell me a scenario in which these cookies could be abused?

Re:The Priorities Are Right Here

[GoofyBoy]

>The principle being that the U.S. Government does not track or snoop on its citizens.

How does this principle apply to;

Social Security Cards and its hundreds of uses
Submission of tax forms
Court-approved wiretapping
Police manned "speed-traps"
Passports
Airport travel

Re:The Priorities Are Right Here

[Pyrion]

Oh pfeh. If the government wanted to track browsing habits, they could just collate data from server logs to get a much better picture of how who went where when for why.

The "principle" of the matter is that this is little more than an "OMG GOVERNMENT" not-news item intended for fear-mongering from an organization that's supposed to be better than this.

Troubling discovery

[Anonymous Coward]

A follow up investigation would show that a large blue hairy monster was responsible for placement of the said cookies. When questioned about this monster Don Weber stated that it was a "... new and innovative method of extracting information for security purposes ..." more than this he could not say.

Re:OMG! Run for the hills!

[Waffle Iron]

The big deal isn't the cookies. It's that this is an organization of supposed straight-laced agents whose job is to snoop on people to make sure that they're in line with the law, but they can't be bothered to keep themselves in compliance with the law.

This law may be silly, but they need to get congress to change it first, they can't just ignore it while they go about their business of monitoring other peoples' compliance with the laws.

I hear that...

[Scratch-O-Matic]

I hear that NSA mail servers have also been decoding headers on all email received, including from the general public!

And then there's the White House

[PIPBoy3000]

From Wired:

From: "Richard M. Smith"
Date: December 27, 2005 11:43:49 AM EST
To: EPIC_IDOF@mailman.epic.org
Subject: [EPIC_IDOF] The Whitehouse Web site is bugged

Hi,

The Whitehouse.gov Web site is bugged! Apparently the Webmaster for the site has hired Webtrends to track visitors around the site using Web bugs and permanent cookies. Here's the Web bug that I found on the home page of the Whitehouse.gov Web site:

Similar Web bugs can be found on other Web pages at the Whitehouse Web site.

Before 9/11, the Clinton administration said this kind of Web tracking is a no-no for U.S. government Web sites:

http://www.whitehouse.gov/omb/memoranda/ m00-13.html

Because of the unique laws and traditions about government access to citizens' personal information, the presumption should be that "cookies" will not be used at Federal web sites. Under this new Federal policy, "cookies" should not be used at Federal web sites, or by contractors when operating web sites on behalf of agencies, unless, in addition to clear and conspicuous notice, the following conditions are met: a compelling need to gather the data on the site;

Richard M. Smith
http://www.computerbytesman.com/

Not to yell conspiracy on Slashdot or anything, but it's an interesting coincidence.

Re:Crap! The secret is out!

[Anonymous Coward]

I know, I work there as a contractor

No, you worked there as a contractor. All of your ties with the NSA have now been severed, Mr. Johnson.

-- The NSA

You've obviously never worked in government.

[WidescreenFreak]

So either one or both agencies in question are simply incompetent, or lying to us. Which do you think is more plausible?

Wow! The fact that you're even asking this is a clear indication that you have never worked in any government entity. All levels of government - federal, state, and local - are loaded with incompetency and attempt to lie to the public whenever such lying is "in the public interest" or covers their asses.

You also seem to have some notion that as soon as you become a government employee that you are going to somehow assume and retain all legal ramifications based on all existing laws just by being hired. Management changes happen. Staff changes happen. The notion that all government employees of all levels will be aware of all rules and regulations regarding all functions is highly naive. For all we know, the installation of this supposed "off-the-shelf" software was the first task of a new, NSA intern in the IT department.

I know that you dislike (hate?) the current administration, but this is absolutely a "mountain out of molehill" scenario in the grand scheme of things.

Re:You've obviously never worked in government.

[Anonymous Coward]

mountain into molehill or evidence of a trend of general disregard for the laws and policies that are in place? Could it be the straw that breaks the camel's back?

Remember, a pithy statement proves nothing.

Re:You've obviously never worked in government.

[Anonymous Coward]

laws and policies in place. There's so many laws and policies out there you are probably in violation no matter what you do. Particularly driving. Do you know all the regulations? Didn't think so.

Re:You've obviously never worked in government.

[zardo]

I submitted this article as sortof a joke, I thought it was funny. Mountain out of a molehill is right, it's even funnier how people react to it. To me it sounds like a news article meant to play to the fears of people who don't know what a cookie is, old people, young stupid people. Pretty much every working American these days knows what a cookie is.

/me has his trusty cookie blocker plugin armed and ready

Re:You've obviously never worked in government.

[Anonymous Coward]

Having dealt with this same issue recently I can tell you government regulations tend to blindside you. I am a subcontractor on a website development job for the Veterans Administration and the guidelines you have to work under were at least 40 pages long, from one document not to mention the Accessibility guidelines and the list of acceptable software with which to develop. Just trying to keep everything straight is a job in itself. Having also worked as a contractor in other government organizations I ascribe this problem to incompetence not malice.

Re:You've obviously never worked in government.

[geekoid]

"All levels of government - federal, state, and local - are loaded with incompetency and attempt to lie to the public whenever such lying is "in the public interest" or covers their asses"
that is false,and you are a pandering idiot.
I have worked in both public and private sectors. I can say without hesitation thet the public sector employees are smarter, more dedicated, and harder working then their private sector counter parts. Why do you think there is less waste and the availability of more fiscal oversight in the public sector then any corporation in the private sector?

Re:You've obviously never worked in government.

[maxpublic]

that is false,and you are a pandering idiot.

I've also worked for government, at varying levels. And his estimation of the competency of government employees is spot-on. Many of the folks who work for government agencies are so bad at their jobs that the very reason they're in government is that the only job they'd be able to hold in the private sector is one where they'd regularly say "would you like fries with that?" This is especially true the higher up the ranks you go, where any sort of competence is quickly overshadowed by how well a person can suck up, or stab his coworkers in the back, or steal someone else's work and present it as his own.

I can say without hesitation thet the public sector employees are smarter, more dedicated, and harder working then their private sector counter parts.

Talk about pandering idiots. How long until you retire from suckling on the public tit?

Max

Nothing To See Here...Move Along....

[canfirman]

From TFA: "Considering the surveillance power the NSA has, cookies are not exactly a major concern," said Ari Schwartz, associate director at the Center for Democracy and Technology, a privacy advocacy group in Washington, D.C.

Considering the provisions of the Patriot Act, wire tapping, internet tapping, unauthorized surveylence, and the US government spying on it's citizens, leaving persistent cookies "by mistake" is a really small issue. What are they going to do? Track the fact I play EverQuest online? Anybody who's compitent enough to either block cookies or delete them should have no problems. IMHO, this article's intention is to provide more embarrasement on the current government. "Oooh, the government's spying on you...". Guess what? They already are. This is nothing new.

Re:A cookie?? Why is this even an issue?

[scheming daemons]

Okay, so the NSA puts a permanent cookie on the system. Why is this an issue?

Because it is against the law.

Prosecuting the "lying about blowjobs" was all about maintaining the "rule of law" for Republicans a half-decade ago.

But maintaining the "rule of law" no longer applies with Republican administration? That's what I'm getting from you in your post.

If the NSA did this, they broke the law. Doesn't matter if it is a stupid law. All my conservative friends told me in 1999 that the "rule of law" reigns supreme, no matter how minimal the offense.

Sorry... I'm not letting the Bush-apologists off the hook when the tables are turned.

The real, frightening question

[Anonymous Coward]

The real, frightening question is why the NSA apparently:

1). Put software into production without checking all the settings
2). Put software into production without fully testing it
3). (probably) used software which they don't have the source to, and thus don't know if there are any backdoors.

I am worried about it from a National Security perspective - NSA using cookies worries me far less than Microsoft doing it - but the above issues could expose the NSA, and hence the USA to attack.

With software companies outsourcing to countries with less stringent security and more people hostile to our interests, there is a greater risk - although even without outsourcing, compromising a software company is still a severe risk.

Perhaps the government should require people to get security clearances if they work at Microsoft, etc in any capacity where they can compromise the code. Perhaps they should use Open Source. I know of a Linux distribution they might want to use.

P.S. NSA is a lot of crypto geeks who do a very important job protecting all of you - and is made of people a lot like most of you. They aren't cold blooded killers who whack you for speaking out. Sorry to disappoint you.

Re:The real, frightening question

[cold fjord]

1). Put software into production without checking all the settings
2). Put software into production without fully testing it
3). (probably) used software which they don't have the source to, and thus don't know if there are any backdoors.

I am worried about it from a National Security perspective - NSA using cookies worries me far less than Microsoft doing it - but the above issues could expose the NSA, and hence the USA to attack.

Don't trouble yourself. The web server was, no doubt, well tested. The problem was essentially a client side setting, and a minor one at that.

NSA separates classified and unclassified networks. The chance of exposing sensitive data is likely miniscule, the chance of exposing classified data is non-existent.

Re:The real, frightening question

[Anonymous Coward]

The NSA has unclassified networks and classified networks. There is no risk of compromise...they're quite separate. Even desktop computers connected to different networks have to be separated by a minimum of a specific number of feet.

the bake sales are great

[TubeSteak]

Yea, I've been to previous bake sales.

Great place to get tinfoil so I can line my room.

And the brownies are great, but don't even think about asking for the recipe.

A truly democratic.government cannot act in secret

[Futurepower(R)]

It has been said over and over again in many, many books written by those who were participants, that the U.S. government's secret agencies do illegal things by having the secret agencies of other governments do them. For example, if they want someone killed, they may have an Israeli secret agency do the work. That way they can claim innocence.

There are other tricks. Did you notice that the CIA agents who did illegal things for former President Nixon were "former" CIA employees? When someone is discovered, he or she becomes a "former" employee. In that case, President Nixon was allowed to leave office, and was pardoned by the next president. The illegal acts were discovered only by accident.

A government that does anything in secret is not a secret government. Also, those who are willing to take a secret job are often amazingly psychologically unstable.

The U.S. government has decided that it can secretly force companies to help in surveillance. This means that companies in the U.S. cannot be trusted.

The problems caused by secret action are called "Blowback" by some in the U.S. government. Blowback is not seen as a bad thing, because if decreases the political stability in the world, which means that employees of U.S. government secret agencies will get raises and promotions. See the link to the book "Blowback" below.

Tips: Don't say "we", as in a U.S. citizen saying "we" kill Iraqis. When there is secrecy there is no "we". Don't think there is violence over oil. The violence is over who gets the profit from selling the oil. Oil is sold on the open market; the price is determined by the market. Before Saddam Hussein got some of the profit from selling Iraqi oil. Now many of the contracts involve citizens of the United States.

The following books show some of the history of the U.S. government's secret agencies, and help explain much of the underlying reasons for U.S. government violence in the Middle East. Often the secret agencies have acted for special interests and against the good of the people. For example, the CIA overthrew the democratically elected president, President Mossadegh, because he wanted his country to receive more of the profit from oil pumped from his country. The U.S. government's political interference eventually resulted in a violent revolution in Iran, and a determination by Iran to strike back.

1. Unholy Wars: Afghanistan, America, and international terrorism by John K. Cooley, 2000, Third edition, Pluto Press, London, England and Sterling, Virginia, USA. Reviews: Powell's Barnes & Noble Amazon

   Osama bin Laden is "the personification of blowback". You can read more about how the CIA created a political climate very supportive of Osama and his ideas in an article by Jane's, a very well-respected publication devoted to military issues. The article was published 3 days after the second World Trade Center bombings, on September 14, 2004: Why? An attempt to explain the unexplainable.

   The CIA brought Arabs to the U.S. and trained them in terrorism. The rules by which al Qaeda operate seem to come from the CIA training.

2. Blowback: The costs and consequences of American empire by Chalmers Johnson, 2000, Metropolitan Books, New York, New York, USA. Also, there was a new edition in 2003 with a new introduction. Reviews: Powell's

America's Army (the game) on your PC? /tinfoil hat

[blankoboy]

Slightly off topic and rather tinfoil hatted but with the way things are going in the White house are you going to trust putting the game 'America's Army' on your PC? Lord knows, what they have or may put into that game to spy on your PC.

Lucky you

[mariox19]

You got cookies? I got fruitcakes! If the NSA starts giving out these, I say it's time for revolution.

Re:A cookie?? Why is this even an issue?

[WidescreenFreak]

Because it is against the law.

So is speeding. Don't tell me that you have never done that.

So is downloading music/software that you didn't pay for. Don't tell me that you have never done that.

So are a number of other laws that should have been taken off the books long ago that people don't care about and law enforcement doesn't bother to enforce. They're all against the law as well.

The fact that you are expecting every employee at every level to be fully knowledgable of every law and every ramification for every action does nothing more than show that you are on a witch hunt.

And for the record as much as I disliked Clinton even I knew from the start that the whole blowjob issue was overblown (no pun intended) and an unnecessary witch hunt that was doomed to fail. So, stop being childish by lumping those of us who see this issue for the security pittance that it is as "Bush apologists".

Re:OMG! Run for the hills!

[Viper Daimao]

law? They were guidelines in a memo. show me the bill passed by congress that says "The NSA cant use cookies with its website". No, I think the GP had it right. This is a total non-story of some webmaster at the NSA who aparently wasnt aware that using common webtools was against their guidelines.

Re:So, did we find....

[mc6809e]

enough weapons of mass destruction, and did we find enough terrorists by eavesdropping innocent citizen's phones that the most important left to do is bash NSA on having persistent cookies vs session ones?

Actually the Brooklyn Bridge terror plot was discoverd by one of the NSA wiretaps of Iyman Faris.

Double Shenanigans

[Tackhead]

> What about a laptop user visiting the site repeatedly from an Afghanistan ISP, then suddenly one day the same laptop (same cookie) starts visiting from a Washington area ISP .. far fetchned, but might be interesting to know under some circumstances.

If NSA needs a cookie to figure that out (and if Abdul is visiting nsa.gov from Afghanistan and DC), then neither Abdul nor NSA are doing their respective jobs.

I'm going with neglect on the part of the website administrator here. Stupid default settings in applications, plus benign neglect in the brains of users, equals embarassment. Always has, always will. Unless...

~adjusts phase coil on tinfoil hat~
If, however, I was trying to divert attention from a serious abuse I'd performed, I'd release a story exactly like this. It's got the word "cookie", which is about as high-tech as Joe Sixpack ever gets about security, so he can get all upset -- and it's simultaneously a non-issue, which means everyone from the Blogosphere to Dan Rather can trot out an "expert" to tell Joe Sixpack that if this is the NSA at its most dastardly, then he has nothing to fear even if he's got something to hide
~readjusts phase coils~
and the story I'd release would be the same, whether or not I was NSA, looking to divert attention from the fact that I wanted to trawl through the set of data originally destined for /dev/null
~tweaks fnord emitter~
or whether I was the Party official who ordered NSA to do stop dumping all that good stuff into /dev/null, and where NSA complied with my orders only under protest.

They don't call it the puzzle palace for nothing.

Re:Double Shenanigans

[insanecarbonbasedlif]

~adjusts phase coil on tinfoil hat~
If, however, I was trying to divert attention from a serious abuse I'd performed, I'd release a story exactly like this. It's got the word "cookie", which is about as high-tech as Joe Sixpack ever gets about security, so he can get all upset -- and it's simultaneously a non-issue, which means everyone from the Blogosphere to Dan Rather can trot out an "expert" to tell Joe Sixpack that if this is the NSA at its most dastardly, then he has nothing to fear even if he's got something to hide
~readjusts phase coils ~
and the story I'd release would be the same, whether or not I was NSA, looking to divert attention from the fact that I wanted to trawl through the set of data originally destined for /dev/null
~tweaks fnord emitter~
or whether I was the Party official who ordered NSA to do stop dumping all that good stuff into /dev/null, and where NSA complied with my orders only under protest.

Which is it, one coil, or more than one? With that, you have lost all legitimacy to me... your cover is slipping, you CIA spydog! I will not trust you!

Hot Password Cracking Tools for 2006

[Anonymous Coward]

Lockpicks and hardware keyloggers - to get passwords from geeks who think security and encryption will really protect them from someone who wants to get their information.

Re:A cookie?? Why is this even an issue?

[discordja]

It's not against the law. It's against White House policy, "In a 2003 memo, the White House's Office of Management and Budget prohibits federal agencies from using persistent cookies ... blah blah blah." Wow, so the Bush Administration, whom you are so keen to slam as soon as you see an opening, was who set the policy that those cookies *weren't* supposed to be persistent.

You do all know Doubleclick?

[camperslo]

Sued by the state of Texas under the stalking laws, Doubleclick has made extensive use of cookies.
With the Office of Homeland Security having a former officer of Doubleclick on staff, it's a pretty good guess that the government sees their sort of information gathering technology as useful.
Doubleclick handles banner ads on a huge number of websites.

I wouldn't put it past them to be buying the purchasing data from every chain store that has a member discount card. Do/will RFID chips in our tires get scanned at intersections? If it is possible, and potentially useful, shouldn't we expect it to happen unless there are laws to prevent it?

Have you ever had to answer a bunch of questions when applying for a purchase rebate?
Someone is using or selling that info.

How much gathering, sale and use of data on us reasonable? What should be legal?
What about the damage done to us when info from the data collectors is used for identity theft?

Who passed these laws allowing opt-out privacy policies at banks and insurance companies?

Where does the Auto Club get off tying in with MBNA sending out credit card mailings?

Re:You do all know Doubleclick?

[JamaisVu]

First, I want to agree with you re: the somewhat sinister disregard for individual privacy when companies want to sell stuff. I have joked that Lucifer himself sits on the Board of Doubleclick. No doubt the former DoubleClick officer (http://www.pcworld.com/news/article/0,aid,110299, 00.asp) is charged with the task of tuning processes and systems to comply while still getting what the agency wants.

Second, I'd like to suggest coming up with a pattern for bogus data when you're asked by various retailers, etc. Try to come up with something that identifies the source of the data so you know what channel certain data came from. Think: a middle name of "Berlin" for WalMart (the Berlin Wall). It's interesting where you see data pop up when you do this.

J

And also

[jim_v2000]

because we know that the NSA's website it their top priority.

Re:Crap! The secret is out!

[Elvis Parsley]

"Don't worry about me, though, I dropped all my clothes in the mail so I can't be tracked now."

Maybe not electronically, but all they have to do now is look for the naked guy who bought all those stamps.

MOD PARENT UP

[Crashmarik]

Comment is incredibly insightfull. Aside from the fact that if you check your browser there will hundreds to thousands of persistent cookies, Aside from the fact that cookie management is widely regarded to be the responsibility of the user, This is completely a non issue unless someone can proove that the NSA went to the trouble to track the cookies outside of their website.

Once again it prooves the left has gone completely bonkers. If the NIH found that Sarin or BZ could cure cancer the story would read Bush administration makes unwise use of chemical weapons.

Re:MOD PARENT UP

[Anonymous Coward]

Aside from the fact that if you check your browser there will [be] hundreds to thousands of persistent cookies,

I've just counted the persistent cookies in Mozilla which I've been using with this profile for about 6 months now. There are exactly 16 of them.

Re:MOD PARENT UP

[bill_kress]

A lot of people seem to be pointing out (Quite insistently, I might add) that it's silly to worry about cookies being left on a machine and how crazy the "Left" is to suggest such a thing.

The policy itself was from a memo written by the current government in 2003. That would be...hmm...let me check. Oh, yeah, the Bush administration.

So how is that the fault of the left?

Or is it your contention that nobody should be concerned when a branch of the government ignores policies that it finds silly? Or is it just policies that YOU find silly?

Once again it "prooves" the right has gone completely bonkers.

Penny wise pound foolish

[David's Boy Toy]

I'm alot more worried about suspects being shipped off to secret prisons and tortured than I am about cookies.

Sometimes I ended up helping friends with computer problems. The most annoying to deal with are the ones which equate cookies with virus's due to media hype, "I can't get my stock quotes" "you need to have cookies turned on for that website" "COOKIES?! Are you kidding they can see everything I do, even watch me have sex with my wife" "But you don't even have a web cam" "You need to do some reading young man [when your almost 40 thats almost flattering], here look at this www.paranoidnutjob.com, see! Don't go putting me at risk by recommending that I accept cookies! A friend wouldn't do that to a friend, your no friend of mine! Your an agent for the greys!" "ummm I I guess your meds have run out, I just remembered I left a candle burning at home, got to run."

Re:Penny wise pound foolish

[Syberghost]

I'm alot more worried about suspects being shipped off to secret prisons and tortured than I am about cookies.

Then why'd you wait 10 years to start complaining about the program? Or were you unaware that Rendition was a Clinton initiative?

Re:Penny wise pound foolish

[geekoid]

Interesting and pointless post.
How do you know they never complained before? No, you just want to point the blame for this to Clinton, and you chose this as your soapbox.

BTW, while not apologizing for Clintons behaviour, I feel it should be noted that the rules for who rendition applies to has expanded dramatically under the Bush administration.

Pointing at Clinton and saying 'he did bad things' is NO excuse for Bush to do the same, and worse.

Re:Penny wise pound foolish

[Syberghost]

How do you know they never complained before? No, you just want to point the blame for this to Clinton, and you chose this as your soapbox.

Actually, according to the Supreme Court opinions on this matter, you'd probably better lay the blame more on Thomas Jefferson than on any particular President. Congress can't limit Presidential powers enumerated in the Constitution, including the duty to act as commander in chief of the armed forces.

What a terrible analogy!

[mangu]

"Sorry, officer. You're right, I was going to sell these 30 pounds of crack to some schoolkids. But it's okay, as long as I throw it away and promise not to do it again. Right?"

Wow, talk about overstating it! In which way do you think sending a cookie is similar to selling crack? There isn't any *law* against federal agencies sending cookies, it's just a policy from the OMB.

This is silly

[carcosa30]

Other than political reasons-- for which this should be exploited to the hilt in order to frighten the credulous even more about the policies of the dictatorial and illegitimate Bush administration--

Other than those reasons, being afraid of the NSA because of cookies is like being afraid of thermonuclear war because it might muss your hair.

They eavesdrop all electronic communications. They can crack cryptography in realtime. If they want to, they can have you disappeared to some torture prison in a foreign country where you will divulge anything in order to get the agony to stop.

And these fuckwits are worried about a persistent cookie.

1984(, End of Freedom(tm), Stop the Oppression(tm)

[boyfaceddog]

Its a COOKIE. Get over it already.

Re:A cookie?? Why is this even an issue?

[scheming daemons]

Because it is against the law.

So is speeding. Don't tell me that you have never done that.

yeah, I have. And I've gotten tickets when I've gotten caught. Rule of law prevailed.

So is downloading music/software that you didn't pay for. Don't tell me that you have never done that.

Actually, I never have. But if I have, and I got caught, I should pay the consequences (according to the "rule of law" Republicans).

So are a number of other laws that should have been taken off the books long ago that people don't care about and law enforcement doesn't bother to enforce. They're all against the law as well.

Law enforcement doesn't care to enforce? Have they stopped giving out speeding tickets? Has the RIAA stopped taking music pirates to court? What memo did I miss?

The fact that you are expecting every employee at every level to be fully knowledgable of every law and every ramification for every action does nothing more than show that you are on a witch hunt.

No... I wish consistency from my Republican brethren when it comes to holding an administration accountable to the "rule of law". That's all we heard from Republicans throughout the Clinton presidency.. "no President is above the law" and "when the branch of government that is supposed to uphold the laws of the nation is guilty of breaking them, then impeachment is not only correct.. but necessary." and crap like that.

The Bush administration is not above the law just because you like him. Hold your president to the same standards you held the previous one that you DIDN'T like. Be consistent.. don't by a hypocrit. That's all I'm asking from my Republican brethren.

Re:Crap! The secret is out!

[Anonymous Coward]

Shows what you know...my name is Smith, not Johnson. Hah!

Re:OMG! Run for the hills!

[Viper Daimao]

Worst slashdot story ever...till the dupe.

err..

[Heem]

Dear NSA:

RTFM.

Quoth the law???

[WidescreenFreak]

Then kindly quote the law which was approved by the House, approved by the Senate, and signed by any President that makes the usage of permanent cookies on any government web site a violation of federal law. I know of no law and thus far none of the anti-Bush, or in your apparent case anti-Republican, crowd has been able to bring forth the bill that placed that restriction into law.

Clinton lied under oath. That is a violation of established law. But unless you can bring forth the bill from Congress that made permanent cookies illegal, the phrase "no President is above the law" doesn't apply at all.

Re:Quoth the law???

[scheming daemons]

From TFA:

"...Office of Management and Budget prohibits federal agencies from using persistent cookies _ those that aren't automatically deleted right away _ unless there is a "compelling need." A senior official must sign off on any such use, and an agency that uses them must disclose and detail their use in its privacy policy."

By law, all government agencies are required to follow OMB guidelines. By law, not following an OMB guideline is illegal.

Also from TFA:

"Daniel Brandt, a privacy activist who discovered the NSA cookies, said mistakes happen, "but in any case, it's illegal. The (guideline) doesn't say anything about doing it accidentally.""

No government agency can violate OMB guidelines. A government agency that violates OMB guidelines is breaking the law.

Yes... it's a very very very very minor offense, especially compared with the other NSA law-breaking that we've become privy to recently.

Yes... it pales in comparison to wire-tapping US citizens without a warrant. The law violated there is the 4th amendment to the Constitution of the United States.

Yes... I realize that Bush-apologists are willing to overlook the principles enbodied in the 4th Amendment in order to protect us from the evil terrorists.

But... if this were 1999, and the EXACT SAME STORY came out about the Clinton administration, you would all be in a hissie fit calling for another round of impeachment hearings. If the Patriot Act were passed in 1993 after the first World Trade Center bombing and gave Janet Reno the surveillence powers that Ashcroft/Gonzalez have, you'd be calling for a revolution.

I personally don't think the cookie thing is a big deal... but it shows a pattern of disregard for the rule of law by this administration if they feel the ends justify the means. America doesn't work that way, and I want you hypocrits to admit you hold this President to a different standard with respect to the rule of law because he's a Republican.

I want the Washington Times, American Standard, Fox News, Wall Street Journal, Rush Limbaugh and his hundreds of talk-radio clones, the Free Republic, and every other right-wing blowhard to be pushing for impeachment hearings over the NSA wire-tapping-without-a-warrant... as they surely would be doing if this were 1993-2000.

I want you Bushies to quit spinning when the president, and the people who work for him, are guilty of violating the law.

He's not king... just because you like him.

Re:Quoth the law???

[WidescreenFreak]

Thank you for proving that you're just a flaming liberal who's looking to pin anything possible on Bush and that any discussion with you is the equivalent of trying to discuss physics with a brick wall.

FWIW, I am not happy with Bush, I don't like Fox News, I thought that the whole Clinton impeachment was a bunch of bullshit and a waste of taxpayer dollars that would just come back to bite the GOP in the ass, which it has done.

That's a nice broad brush that you've got there. I see that you use it often even though you have no idea how to properly hold it.

Re:Quoth the law???

[robertjw]

By law, all government agencies are required to follow OMB guidelines. By law, not following an OMB guideline is illegal.

Hell yeah, let's find the NSA sys admin that set that thing up and give the son of a bitch the chair!!

move along...

[Anonymous Coward]

There is No Such Agency.. nothing to see here... [you will be photographed and monitored from this point forward]... It is a figment of your imagination.. Go home and read Milton Friedman like good little Americans...

Who keeps cookies anyway?

[smooth wombat]

Apparently it's just me, and those I've coached on how to keep their system clean, but I never keep my cookies. Whether when I used IE or now the more secure Firefox, I always clear my cache and cookies when I am done surfing.

In fact, one of the nice additions in Firefox 1.5 is the automatic cleaning of cache and cookies when one closes the browser.

Wasn't there an article about ad companies trying to convince people to keep the cookies on their system so there could be a more accurate assessment of online advertising? Oh yeah, here it is.

Then there is this article which was never posted from five months prior which says basically the same thing.

Yes, the NSA 'accidentally' was putting cookies on peoples systems but since people delete cookies anyway, this is one time I don't see the big deal (aside from the whole Big Brother issue).

Re:Who keeps cookies anyway?

[MrP-(at work)]

I backup my cookies weekly and I still use cookies that have a creation date of June 1997

When I moved to Opera I wrote a little program to convert my cookies to the opera cookies.dat format

I like cookies

policy = internal law

[TubeSteak]

FROM TFA

In a 2003 memo, the White House's Office of Management and Budget prohibits federal agencies from using persistent cookies _ those that aren't automatically deleted right away _ unless there is a "compelling need."

In this case, policy = internal law

Re:policy = internal law

[Anonymous Coward]

your comment = grasping for straws

Re:policy = internal law

[WidescreenFreak]

Policy = Internal law = Completely unenforceable by the Judicial branch = One of the worst excuses I've seen for this anti-Bush witch hunt yet.

Re:A truly democratic.government cannot act in sec

[oddaddresstrap]

For example, if they want someone killed, they may have an Israeli secret agency do the work. That way they can claim innocence.

No, the assassin is hired through an ad in Soldier of Fortune by CIA operatives pretending to be Israeli agents. If the op goes sideways, the Israelis don't know about it, but get blamed for it. In the end, the dufus soldier of fortune is left to swing in the breeze.

Crime without Conviction

[Anonymous Coward]

Crime without Conviction: U.S. Makes Deals With Corporate Criminals Instead of Prosecuting
http://www.democracynow.org/article.pl?sid=05/12/2 9/151220

Corporations that commit securities and accounting fraud can now expect to get sweetheart deals from the Justice Department, and they don't face public exposure for their misdeeds. We speak with Russell Mokhiber of Corporate Crime Reporter.

Date of signing please?

[WidescreenFreak]

From TFA: The House on Wednesday is expected to adopt the compromise version of a fiscal 2002 Treasury-Postal Service bill, H.R. 2590, that would expand privacy protections for people visiting federal Web sites and provide funds for crime-fighting technology.

It's an article from 2001 that states that the House is expected to adopt this provision. Please provide the document that states that this particular clause not only made it into the bill, but that the bill was approved by both houses of Congress and that President Bush actually signed it.

After that, please show me the test that all government employees have to take proving that they are fluent and fully-versed in the millions upon millions of rules and regulations to which they need to adhere and the ramifications thereof for violating any such rules and ramifications.

I also expect to see that various documents thus proving that all levels of management are also refreshed on a regular basis of the policies and violation ramifications. After all, we would not want them to forget any of the millions of laws and policies that they have to adhere to, would we?

It was wrong when the Republicans went on a witch hunt against Clinton who admitted to breaking the law - lying under oath. Just because the tables are turned does not make it less of a witch hunt nor does it make said witch hunt "less wrong".

Bash quote.

[ScaryFroMan]

Who stole the cookie from the cookie jar?!
NSA stole the cookie from the cookie jar!
Who me?!
Yes you!
Couldn't be!
Then WHO?!!
White House stole the cookie from the cookie jar!
*** NSA has been kicked by White House (fuck you i didn't touch the motherfucking cookie, bitch)

This isn't frightening it is retarded

[DnemoniX]

How you got modded as insightful I don't know. Here let me answer those questions for you.

1) Because shit happens in IT no matter how good you are. They were in all likelihood turned on during the testing phase, and someone forgot to turn it off when they took it live.

2) What gives you any impression that it wasn't tested fully before deployment? Nothing in the article or in real life every day IT work even suggests that.

3) God forbid a product with closed source, it must be the devil! I guess the world should take all of those CISCO routers offline that are all over the world you twit.

Bottom line, it's the damn web server, it's not like it is wired into the uber-secrete internal systems. Sheesh this is such a non-issue it's pathetic. All of you tinfoil hat wearing people should just practice safe web-surfing habits and have cookies disabled by default. Oh and as for your P.S. remark, well that is half right, that applies to analysts but not to the field agents, many of which are active duty military people on loan and many others with a background in Special Operations.

PRIORITIZE YOUR PARANOIA!

[hyperbotfly]

For fucks sake! The only thing you can see all over the internet for the past week is how they put a version of DCS-1000 on steroids on backbone routers with the switch permanently set to "everybody" and "on", and your worried about FUCKING COOKIES. Idiot! P.S....feel that little lump on your neck? That is the microprocessor/gps module that they put there.

Temporary cookies only..?

[Ancil]

Nice to know that even government agencies are subject to stupid, pointless government regulation.

Here is something more important about this issue

[Anonymous Coward]

Privacy advocates nitpicking about cookies is like a minority group overplaying the race card to the point where actual and horrific cases of racism becomes ignored or rejected.

All I care about is any govt or company taking the necessary precautions with my personal info so that crooks cannot abuse it. And by crooks, I include those rare cases where employees/leaders of said entities might be the abuser.

What we should be talking about is:

1. what precautions are taken so that any personal info collected about US citizens cannot be abused by corrupt politicians or corrupt employees?
2. what precautions are taken so that said personal info cannot be stolen from the collecting agency by data thieves?
3. what are the auditing procedures and laws that can help quickly identify abuses and punish the abusers with at least a felony?

The abuse of non-public information about US citizen(s) for politically motivated retaliation is probably the most important reason anyone can specify about this issue.

Why isn't there a law that makes it illegal for an elected official or government employee to misuse or publicly dislose NON-PUBLIC information they collected about a US citizen?

If such legal and procedural protections were in place, I would feel much better about any info our govt collects about me and my fellow US citizens if the collection was actually done for justifiable reasons.

Another reason for concern about this is that there has been an active weakening of the separation of church and state over the past several years which is a radical departure. I happen to believe in God as well as the separation of church and state.

If a future US president was Muslim, would you feel comfortable being a Christian or Jew if the government knows that about you? Perhaps helping keep the separation of church and state would be prudent. After all, nobody has the magical power to predict what religion other people/strangers may choose in future generations.

Consider the words of the people responsible for risking their lives and founding the United States of America and other heroes in the US history (in their own words rather than how they are characterized by popular media):

"They who would give up an essential liberty for temporary security, deserve neither libery or security." -Ben Franklin.

"The United States of America should have a foundation free from the influence of clergy."
-George Washington.

"In every country and in every age, the priest has been hostile to liberty. He is always in alliance with the despot, abetting his abuses in return for protection to his own"
-Thomas Jefferson

"One day the dawn of reason and freedom of thought in the United States will tear down the artificial scaffolding of Christianity. And the day will come when the mystical generation of Jesus, by the Supreme Being as His father, in the womb of a virgin will be classed with the fable of the generation of Minerva in the brain of Jupiter."
-Thomas Jefferson (in a letter to John Adams)

"The question before the human race is, whether the God of nature shall govern the world by his own laws, or whether priests and kings shall rule it by fictitious miracles."
-John Adams, 2nd US President

"Religious bondage shackles and debilitates the mind and unfits it for every noble enterprise."
-James Madison, US President and known as "father of the Constitution"

"The government of the United States is not, in any sense, founded on the Christian religion."
-Treaty of Tripoly, article 11 (drafted during G. Washington, signed during John Adams presidency)

"My earlier views of the unsoundness of the Christian scheme of salvation and the human origin of the scriptures have become clearer and stronger with advancing years, and I see no reason for thinking I shall ever change them."
- Abraham Lincoln in a letter to Judge J.S. Wakefield

"Leave the matter of religion to the family altar, the church, and the private schools,

General cookie malaise

[A nonymous Coward]

So many sites nowadays try to set cookies, I presume for advertising tracking. It is really annoying to visit a blog or general news site and find they want to set several cookies. Then stores --- yes, cookies are good once you have a shopping cart, but if I'm only browsing, they don't need a cookie. But apparently the Boy's Grand Book Of Websites says Thou Shalt Use Cookies and boy o boy do the students take that religiously.

Re:A cookie?? Why is this even an issue?

[Control Group]

As has already been pointed out, the cookie isn't "against the law," it's against White House policy. Unless someone burned the Constitution while my back was turned, we haven't slid so far yet that statements from the White House have the force of law.

Of course, the fact that it's the President's policies that are being violated sort of makes your whole "hold the President to the rule of law" argument somewhat irrelevant even if they did have the force of law. I mean, holding the lawmaker responsible for other people breaking the laws is a little...um, strange, shall we say.

To analogize: say a CIO is reprimanded for opening a personal email with a virus attachment and infecting the company. His replacement promulgates a policy that no employees are to visit /. on company time. By your rationale, when an IT employee then visits /. on company time, the new CIO should be equally reprimanded for that.

No matter how much it might help your "neener neener told you so" argument, the NSA setting cookies on visitor's machines in violation of governmental policy really isn't in any way equivalent to the President perjuring himself in violation of federal law.

Has anyone asked the obvious question yet?

[TheSixth1]

With all the chatter back and forth, has anyone stopped and asked what the two cookies contained and what they were used for? If NSA's use of cookies is truly an issue, one would think that learning the purpose of the cookie would be an obvious question.

A quick visit to the website (with my browser set to reject all cookies of course) shows that there are several things the cookie might track. Saved-state information for those who submitted an application or posted their resume for consideration, saved history on a request for information using a FOIA request, a small business registering with NSA to be considered for new/upcoming contract bids, a download flag for the latest version of SELinux, or maybe even some cookie set by the flash software in the kid's entertainment section.

Agreed, as stated in previous posts, the use of permanent cookies, intentional or otherwise, violates established policy. But before we spin out of control let's ask WTF they were doing with the cookies, THEN we can go storming the castle with torches held high in righteous indignation.

Mountain out of a mole hill you say?

[DarkTempes]

You have obviously never met a Japanese Killer Mole!

Re:Mountain out of a mole hill you say?

[WidescreenFreak]

It won't go far when it gets Mount Fuji dropped on it. I guess that would be a mountain over a molehill, though. :) But I have seen a Killer Rabbit in a British documentary from the early 1970s! I was no ordinary rabbit, with bones strewn about its lair!

Why this matters

[shoolz]

Lots of people are saying that in the grand scheme of things, one little persistent cookie isn't a big deal. Just to give you my perspective:

I used to be a project manager for online contests/sweepstakes. Collect and win, probability games, sweepstakes etc. Big-name reputable clients.

Part of running these promotions required adhereing to 100% of the law, 100% of the time. Bonds needed to be purchased in various states and Canadian provinces, promotion rules needed to be legally approved and registered, all privacy laws needed to be *strictly* adhered to.

If a promotion didn't adhere to the law 100% or didn't follow the rules to the letter, guess who got the shit sued out of them? That's right, the company that was running the promotion, and us, the promotion developers.

So in my world, a persistent cookie means a lawsuit to the tune of $500,000.

Don't you think that the US government and it's various agencies should also comply with the law?

Re:Why this matters

[Control Group]

Yes, they should.

But not all violations of law are of equivalent importance, impact, or newsworthiness. In your case, for example, an improper cookie meant a lawsuit to the tune of $500,000. That's important.

But what would it have meant if your board of directors were found to be embezzling funds, engaging in insider trading, defrauding your clients, and hiring corporate "security" teams to assassinate the CEOs of competing firms?

If they happened at the same time, which do you suppose would be newsworthy?

The NSA is getting hammered for the former, while being given a free pass on the latter.

How anyone can spend any time on this issue, when it's almost certainly a case of plain old screw-up that neither did any harm to anyone nor had any appreciable risk (as opposed to the cookies you were working with, which, if abused, possibly stood to inflict financial harm or material privacy violations) is beyond me. I don't think I'd even understand it in a vacuum, but to expend any effort worrying about this while the NSA is simultaneously throwing down no-warrant wiretaps on American citizens strikes me as almost surreal.

Diversion

[nEoN nOoDlE]

NSA Guy 1: Hey! Look at me! I'm installing cookies on your computer to track you! Over here! Check it out!
*NSA Guy 2 sneaks off and wiretaps you

Re:OMG! Run for the hills!

[ScentCone]

this is an organization of supposed straight-laced agents whose job is to snoop on people to make sure that they're in line with the law

No, you're thinking of the FBI. The NSA's job is to monitor communications to/from and between foreign entities that might expose potential threats to US security. Sure, some people physically sitting in the US may be party to those foreign communications, but the NSA is definitely not a domestic law enforcement agency.

but they can't be bothered to keep themselves in compliance with the law

I think we can pretty much guarantee that whatever contractor or team at the NSA's public relations office responsible for their public-facing web site has little (and probably nothing) to do with their actual operational mission. They, like all security agencies, are highly compartmentalized.

they can't just ignore it while they go about their business of monitoring other peoples' compliance with the laws

Well, they certainly shouldn't ignore the government's own rules about persistent cookies (silly as that is), but it's not like you're talking about traffic cops who don't put change in the parking meter. NSA spooks and analysts (and the thousands of IT people who make that agency work) probably don't give the operations of their public web site much thought at all. Can you imagine the hits they get from all the idiots of the world? The people they're really concerned about are smarter than to leave a trail from their PR site all the way back to some hotel room in Karachi.

Re:A truly democratic.government cannot act in sec

[a.d.trick]

While what you said is true to an extent, it's almost entirely Off-Topic. The NSA doesn't have anything to hide. A cookie is not all that amazing. It's true that cookies are a sometimes food but the fact that people get worked up over this is quite retarded.

Websites don't place cookies on your machine

[Sloppy]

Web browsers do. Everything a website communicates to the browser is is purely advisory, so if you don't like cookies, get a better browser.

We don't have any way of discovering NSA activity.

[Futurepower(R)]

You said, "The NSA doesn't have anything to hide."

The NSA is a secret agency. Sometimes information about the secrets becomes available. However, you don't know what the NSA does, and neither do I, and we don't have any way of discovering.

The Slashdot story is about the NSA ignoring the law. That should give anyone the idea that the NSA may at other times ignore the law.

slow news week

[JesseHathaway]

Let's face it. The after-Christmas week is a very slow news week, /. included. CNet News admits this, while is why they have barely updated their news site. Most people... Steve Ballmer, Google spooks, clueless legislators, even Jack Thompson, are all off celebrating and drinking eggnog with their families. Not much is going on, so news outlets turn to news that would otherwise not reported, for whatever reason.

This isn't a big deal, I don't think. What horrible things does a cookie do to your computer or Your Rights Online, even a cookie placed by the government. How horrible! Shame on them! The government placed not a rootkit, not malware or spyware, not a virus or a hard drive searcher, but an easily deleteable cookie! And oh the horrors, it was persistant!

Most people know how to delete cookies, some even know how to refuse them. Join the crowd.

This isn't a big deal if you think about it objectively. Do you really think that if you go to websites, you don't get cookies? I actually would have expected that this would be common practice on government websites, not out of paranoia, but because it's such a widespread and somewhat-minimally invasive practice used by webmasters to generate webhit statistics, among other benign things.

It's simply a minor webmaster goof, not an issue of trying to spy on people or track them through government sites. If the NSA was really trying to spy on people's computer use, they'd go ask CoolWebSearch or some other malware/spyware vendor to give them the results of their "information collection."

Friars do it in their robes

[Itninja]

Here I must invoke Occams Razor: Given two equally predictive theories, choose the simpler. Basically, don't impute complex conspiracy where simple stupidity is more likely.

Mod Parent Up?

[jevvim]

This is completely a non issue unless someone can proove that the NSA went to the trouble to track the cookies outside of their website.

My problem isn't that they broke their own rules on the use of cookies, but that they broke their own rules. This is an Administration which has been dogged recently with allegations of potentially illegal behavior, and this is yet another sample of it. The more we let the Administration know that discovered lapses - however minor - will be reported, the more I hope they will reconsider pushing the boundaries.

Once again it prooves the left has gone completely bonkers.

I'd say it's more a statement that the current Administration has problems following its own rules - but, then, most Administrations run into that problem. Our government is designed with checks and balances, and practically everyone tries to get away with stuff. It's not that either side has gone bonkers, it's just that the side in power gets the criticism levelled on it. If they can't handle it, then they shouldn't have (a) run for office, (b) accepted the appointment, or (c) taken a government job.

Re:Mod Parent Up?

[Tim Doran]

Once again it prooves the left has gone completely bonkers.

Heck, yeah, it's the *left* with the problem. All that (ongoing) torture, secret CIA prisons around the globe, American citizens being held indefinitely without charge or due process, manipulated intelligence leading into a disastrous war, the incompetent handling of the war itself, the president ordering the NSA to spy on American citizens on American soil... yep, the problem here is clearly the *left*, which has gone "bonkers".

Better hurry, Ann Coulter is on the Factor in ten minutes! There's just enough time to guzzle another glass of kool-aid before it starts!

I'd say it's more a statement that the current Administration has problems following its own rules - but, then, most Administrations run into that problem.

True, but I think we're beyond the point at which the Bush administration can be fairly compared with previous administrations. "Everybody does it" is no excuse when a president freely admits to violating the law and the forth amendment. And with the possible exception of Iran-Contra, I can't think of an administration that has so brazenly broken so many fundamental rules.

Re:Mod Parent Up?

[jevvim]

I can't think of an administration that has so brazenly broken so many fundamental rules.

The President used to wield much more power, until the abuses of Richard Nixon were exposed in the Watergate investigation. If not for the restraints added to the Presidency after Nixon, we might not even be aware of many of the current Administration's failings.

Re:Mod Parent Up?

[Anonymous Coward]

That's an interesting idea, but it's not really true. Article II of the Constition vests executive power in the President, but the scope of that power has limits in relation to the other coordinate branches of goverment, the States, and the people. The presidential power was evolving long before Watergate. For example, the Supreme Court benchslapped President Truman's attempt at seizing steel mills (The Steel Seizure Cases). It's also to continued to evolve after, e.g., Clinton v. Jones (when Pres. Clinton asked to stay Jones's case until after his term in office). Regardless, the idea that Presidential power changed pre and post-Watergate is not really true. If you mean to say that Congressional action added more transparency, that's not really true either. Regardless, I'm sure no one yet knows the extent of the current administration's complete lack of respect for individual rights. JEVVIM is right, there has yet to be an administration that has so brazenly disregarded the basic tenets of our wonderful democratic system. That reporter might have been a bit reactionary, but I'm glad people are still trying to inform the public about the current regime- so we can decide- especially when the executive branch goes so far to mislead us. In case you didn't know: the Patriot Act II and Foreign Intelligent Surv. Act allows the President to watch us and share the information with the police. He's been wiretapping, reading email, and bugging phones when people pose a threat (ACLU, Democrats, and people who make calls out of the country). We also know he's been holding a US citizen without trial for three years (are there more we don't know about?) and moving people around in renditions to secret torture chambers all over the world. I'm not trying to make it sound scary. It is. Period. And we don't know anything until the media uncovers it. So cheers to the wanker who got it wrong.

Disappointin /.er reaction to story

[weakethics]

Yes. It's only a cookie. That's not the point! The NSA is prohibited from doing it, but are doing it anyway. Reading my provincial hometown paper's Letters to the Editor about the illegal wiretapping issue, I expect to see nutbar responses minimizing the impact of that illegal activity. "I'm not a terrorist, so I don't care what laws are violated in pursuit of 'actual' terrorists." That's the slippery slope toward fascism, and the NSA cookie issue is just one more step. Every time the government violates its own rules and laws, it does so at the expense of your personal freedoms. This constant erosion is a death by a thousand cuts. It impacts things that slashdotters care about such as software patents and letting big business steal away our fair use rights under copyright law. Each one of these infractions allows government to become more powerful and we, the people, grow weaker. Each infraction needs to be illuminated (thank you slashdot) and punished if we are to remain free. Even those that seem minor or only effect others.

What you meant to say

[Control Group]

No, you're thinking of the FBI

Dick Gordon: No, that's the FBI. We're not chartered for domestic surveillance.
Martin Bishop: Oh, I see. You just overthrow governments. Set up friendly dictators.
Dick Gordon: No, that's the CIA. We protect our government's communications, we try to break the other fella's codes. We're the good guys, Marty.
Martin Bishop: Gee, I can't tell you what a relief that is, Dick.

Fixed that for you. ;)

Look who submitted it

[SuperJason]

OMG!?!? It was sumitted by Cookie Monster! He just wants all the cookies for himself! First the moon and now the NSA! When will the madness stop? ahhhhhhhhhhhhhhhhhhhhhhh

NSA eagle is a laugher...

[dtjohnson]

Don't know about the NSA cookies but I just went to their wwww.nsa.gov website and the first thing I saw was one of the funniest 'eagles' that I've ever seen. The eagle is draped with feathers like a kid's costume, has the obligatory stern look, a pasted-on shield covering its 'body', and is perched on a key that looks like it came out of a door from about 1910. If it wasn't on the official nsa website, I'd think it came out of one of my kid's video games. We need to cleam up all of the eagle-imagery logos used by our government agencies but the nsa one is the most cartoonish one of the bunch. If I were doing the web pages at NSA, I'd make that eagle about 4 pixels high and put it in the lower left corner instead of making it 500x500 pixels and placing it smack-dab center on the first page.

Grow up, everyone on slashdot is a spy

[tjstork]

Any computer professional's complaint of spying is innately absurd.

The job of computers is to track and spy on people. They track this, track that, data mine this, data mine that, report on this, report on that, and we do it so our corporate masters can make more money. In fact, we even have a philosphical movement to build spying technology for -free-.

Here we are, a bunch of web dudes, complaining that a web site about spies uses cookies of all things, when just about every major web site also uses cookies, or, you get the same effect of cookies by playing games with the URL. You can stick the state in the URL, you can stick it in a hidden POST tag to keep it along, but somewhere along the way, we're all keeping state. Ironically, at least the cookies are most upfront about it.

We complain about the government listening in on people's phone calls without a warrant, yet, I would bet at least half of us on this board have user superuser powers on his or her company systems at one point to read another user's documents. If you are a network admin, you don't have to have a warrant to read your users' email or documents. You just do it.

We voluntarily let every detail about what we buy or sell get tracked when we purchase products electronically, but, god forbid, the government might actually keep a database itself, that's evil. Heck we write these systems. If anything, the only real concern about government spying is that we haven't gotten the contract ourselves to write the system or that it might not be written using Linux.

The solution is to not build ever more arcane systems to have things in secret, but really, we should just make everything public about anyone.

Re:Grow up, everyone on slashdot is a spy

[JamaisVu]

"We complain about the government listening in on people's phone calls without a warrant, yet, I would bet at least half of us on this board have user superuser powers on his or her company systems at one point to read another user's documents. If you are a network admin, you don't have to have a warrant to read your users' email or documents. You just do it."

Personally, I've _never_ read email that was not mine. I actively avoid reading data that is not meant for me to read. Honestly, I'll look away or just make an effort not to interpret it. I wouldn't keep data on a box that wasn't under my control if I didn't want someone to read it, but that doesn't mean I would violate anyone else's privacy. I _LOATHE_ when people do this, and it's one of the worst transgressions after physical voilence and slanderous attack on character / reputation that I can think of.

I wish administrators had to take an Oath.

J

Re:Grow up, everyone on slashdot is a spy

[Kirth Gersen]

The issue is that anybody who knows what a cookie is can see immediately that the site has put a cookie on their PC.

So the NSA didn't bother to follow the law even when it's *completely obvious* they're breaking it.

So why should we believe them about anything else? "Trust me, I won't come in your mouth."

Active cookies

[Anonymous Coward]

Swedish media (http://www.svt.se/texttv/136.html) is reporting the cookie as being an "active cookie", supposedly tracking your surfing as you visit other sites. Headline claims NSA did illegal investigating. :)

Re:We don't have any way of discovering NSA activi

[EQ]

"The Slashdot story is about the NSA ignoring the law"

Enough with the lying (or did I just get trolled?).

What law? Specificlly what federal statute was violated by their putting a persistant cookie for the NSA website? Cite US Code, section etc.

You cannot, do you know why? Because no such *law* exists. Because it was an executive order in the OMB part of the Whitehouse. I.e. a bureaucratic rule, not a law.

And aside from that, it likely was a mistake in their setup after and upgrade, not a deliberate decision. A result of ignorance or carelessness on the part of the tech staff at NSA's website (the possibility of which should be more alarming to people than the cookie!)

You do well to remember Hanlon's Razor:

Never ascribe to malice, that which can be explained by incompetence.

Esepcially when dealing with the government or any other large bureacratic organization.

You are free to ignore the facts and make up ones as you wish (looking at your links, you apparently do). But your tinfoil hat has apparently slid down and obscured your vision on this - you might want to adjust it.

However

[MichaelPenne]

giving the benefit of the doubt, this shows that the NSA (what does that stand for?) installs software without doing a thorough code review and without checking what features are on or off.

So it begs the question what else the NSA (wasn't that the National Security Agency?) doesn't know about the code they are installing, something I would think even the rightest of wingers would be concerned about (who wrote that code and what other default settings were left in the 'on' position...).

This is a non story

[hutchike]

The cookies are domain-based to the NSA site that gave them out, so this is a non story. They can only do what most businesses do - track return visitors and web site effectiveness.

I would go with stupidity.

[geekoid]

The idea of persistent cookies violates some very basic tenants of the NSA.
The guideline was issued for a point of clarity for the population, but anyone who applied the NSA mission statement to their work at the NSA would see this as obvious.
Anyone at any orginization should be applying the mission statement to all aspects of their work.

Source Code

[Eli Gottlieb]

Here posted is the source code in Common Lisp that "terroristizes" given text. Thought I'd save the effort of duplication for those who haven't already coded one and don't use Emacs.

;This maker of food for the NSA Line Eater is copyright (C) Eli Gottlieb, December 26 2005.
;It's under the GNU General Public License version 2.0.
(defvar *dictionary* '("assasinate" "kill" "suicide bomb" "dirty bomb" "nuclear device"
              "Al-Quaeda" "insurgency" "Hamas" "Baath"
              "jihad" "Allah" "Islam"
              "Sears Tower" "Empire State Building" "White House" "Golden Gate Bridge" "New York City subway"
              "Iraq" "Afghanistan" "Palestine" "Iran" "Saudi Arabia"
              "Israel" "America" "England"
              "infidels"
              "Usama bin Laden"
              "London"))
 
(defun terroristize (lines)
  (if (not (equalp lines nil))
    (append
      (if (equalp (cdr lines) nil)
    (list (car lines))
    (list (car lines) (nth (random (length *dictionary*)) *dictionary*)))
      (terroristize (cdr lines)))
    nil))
 
(defun equal-to-any (value any)
  (cond
    ((equalp value (car any)) (car any))
    ((cdr any) (equal-to-any value (cdr any)))
    ('t nil)))
 
(defun all-whitespace-before-p (the-string start-index end-index)
  (do ((index start-index (- index 1)))
      ((equalp index end-index) T)
    (if (not (equalp (elt the-string index) #\ )) (return nil))))
 
(defun token-delimited-p (token-beginning index-of-char string-data delimiters)
  (and (equal-to-any (elt string-data index-of-char) delimiters) (not (all-whitespace-before-p string-data index-of-char token-beginning))))
 
(defun tokenize (string-input delimiters &optional (inclusive nil))
  (setf tokens nil)
  (setf token-beginning 0)
  (dotimes (c (length string-input))
    (if (token-delimited-p token-beginning c string-input delimiters)
      (progn
    (setf tokens (append tokens (list (subseq string-input token-beginning (if inclusive (+ c 1) c)))))
    (setf token-beginning (+ c 1)))))
  (if (< token-beginning (length string-input))
    (append tokens (list (subseq string-input token-beginning)))
    tokens))
 
(defun parse-for-words (sentence)
  (tokenize sentence '(#\ )))
 
(defun parse-for-sentences (message)
  (tokenize message '(#\. #\? #\!) T))
 
(defun string-reglue (str1 str2 delimiter)
  (concatenate 'string (concatenate 'string str1 (string delimiter)) str2))
 
(defun list-to-string (list-input)
  (if (stringp (car list-input))
    (if (cdr list-input)
      (string-reglue (car list-input) (list-to-string (cdr list-input)) #\ )
      (car list-input))
    nil))
 
;This is the main function. Hand it an arbitrary string to be sprinkled with "terrorist lingo" ;-).
(defun feed-echelon (message)
  (setf sentences (mapcar 'parse-for-words (parse-for-sentences message)))
  (dotimes (sentence (length sentences))
    (setf (elt sentences sentence) (terroristize (elt sentences sentence))))
  (list-to-string (mapcar 'list-to-string sentences)))

typical government hyper-enthusiasm

[recharged95]

If anyone had noticed, the agency just updated their website over the last year (with flash (gasp)).

They use COTS products (commerical off the shelf) and most likely contractors implemented the site. Just like every other gov't dept. in existence going through a modernization effort to make "everything a web site"--as some civilian tech savvy govvies put it (ha, a misunderstanding of the term as usual), cookies were likely left on from default settings on those commerical products. Let a [inexperienced] contractor go hog wilded on a cost plus contract and he'll put all the whiz-bang features in the site, considering half of those features will likely be useful.

This story is being blown way out of proportion.

Re:you aren't necessarily a troll if you don't car

[zardo]

That's why I thought it would be fun to submit this article to slashdot, to shine a spotlight on all the tin foil hats among us. Certainly the slashdot readers would realize what a cookie is, but half of them are screaming about legality, I wonder who they hope to see burn for this.

Slashdot -- News for liberal nerds, stuff that doesn't matter unless you're liberal...
... or on drugs

And IT IS NOT A LAW just because you want it to be

[Anonymous Coward]

He's not king... just because you like him.

But as is typical for Slashdot, you got modded with insightful just BECAUSE you don't like him. This is a POLICY - which is grounds for dismissal and disciplinary actions, but IT IS NOT A CASE OF CRIMINAL LAW because IT DOES NOT INVOLVE A BILL THAT WENT THROUGH CONGRESS AND WAS SIGNED BY THE PRESIDENT! Get your head out of your ass.

Cookies? Not a problem. Everything else they do is

[kimvette]

I have no problem with the NSA using persistent cookies - people get so damned worked up over a file which doesn't do much more than store user preferences, visitor frequency (what's wrong with tracking user stats? Hell, even I do that on my web sites, just so my web logs have a little more accuracy), and in the case of session cookies, your session state. It's common practice on web sites and not a violation of any constitutional rights - it's just making obvious, standardized use of a technology that was put in place for that very purpose.

What I DO have a problem with is government agencies telling citizens that the first, second, and fourth amendments were merely guidelines and they don't matter any more due to case law and unconstitutional executive orders. Things like gun control (proper gun control = making sure the citizenship is well-armed to hold back a tyrannical government, and I'm ashamed to admit I don't own a single gun), illegal wiretaps (uh, Dubya, mechanisms are in place for constitutionally-sanctioned secret wiretaps. Use the secret court sessions to obtain wiretaps. Put select justices on call for such things, but don't bypass the courts, because that goes against your oath to preserve and protect The Constitution of The united States of America, which is basically treason), illegal search and siezure, and abatement of freedom of the press and freedom of political expression ("free speech" areas are bullshit, as are made-on-the-fly rules regarding sign sizes, etc. just so you can "justify" arrest of smelly hippies - as misguided as some protestors may be, they have an inalienable right to tell you they think you're a prick), and abatement of the freedom of worship)

Also: You don't need court orders to wiretap non-citizens who are here illegally. They have no rights except out of the kindness of your heart. Deport the f*ckers and encourage LEGAL immigration following legal, well-established processes. EVERYONE here is an immigrant from somewhere else (including so-called "native" Americans) so I don't believe in shutting down immigration, but to encourage people who are willing to become worthwhile members of society to come here and work.

This proves that the AP is running out of ammo...

[E 99]

...if they have to reach this far to manufacture a scandal. I guess the whole "lying about WMD's" thing is losing traction when the public can increasingly see democracy, freedom of life, and freedom of speech blossoming in two nations which just a few years ago were two of the most tyranical regimes on the planet.

If you care about the truth, never take an AP story at face value. This story does everything it can to convince you, just short of outright lying, -- as it apparently did convince the OP -- that non-session cookies on government websites are "unlawful". I can assure you that there is nothing in the U.S. code that refers to cookies on web pages. The only story here is that a gvt agency published a web page that wasn't up to par with the guidelines provided for them in a frickin memo from the White House. (Although it would have been up to par if they had gotten permission first.

On the one hand this sort of story is disgraceful, but on the other hand if it makes a few more people aware of what "the media" is all about, I guess it's for the best.

Who's a naughty boy then?

[WidescreenFreak]

You should know better than to submit (A) any "news" that could enflame anti-Bush, Slashdot rhetoric, (B) any "news" that would shed even the slightest of negative on anything related to Republicans, and (C) any "news" that could warrant tin foil hats on Slashdot. In this case, you got to mix all three!!

A virtual hydrogen bomb you've created! --Whoops!-- I hope no NSA cookie picks up that I mentioned "hydrogen bomb" in a Slashdot thread. :)

Re:Who's a naughty boy then?

[zardo]

...any "news" that would shed even the slightest of negative on anything related to Republicans...

There are other kinds of news? I'll be damned!

Re:Who's a naughty boy then?

[Anonymous Coward]

Ah, so you confess to getting your news from the mainstream media. That's good. Now you at least know that you're continually fed a bunch of politically-charged "news". Just don't tell me that Dan Rather is your hero.

Tributary, non-CONUS sites...

[davidsyes]

This may be redundant, but has anyone considered that (in the vein of "renditions") cookies could be deployed to and from servers and sites NOT based on Continental US soil?

I think what is really going on here is the story is a red herring, a smoke screen. The real deal is probably something like this: You visit any sites that are owned or controlled by the various cognizant agencies; their related, tributary or ancillary sites then aggregate the disparate cookies and build a picture.

Really, Carnivore, Echelon, Echevore, Carnilon or whatever the hell they first two morphed into are not just sitting around sifting legally-obtained data. If they deliberately route your packets out of the US then scan and sift or just parse for later evaluation the data overseas then, THAT could be a far more attractive tool or technique for the black ops agencies.

Probably not much the ACLU or others could say about it. I wouldn't be surprised if some of the sluggishness from my own ISP is related to massive sifting and churning through data coming into and leaving San Francisco.

But, even if "the bad guys" surf from Afghanistan with one laptop and it receives cookies, why should they care? Rag-tag asymmetrical fighters or not, they've got **just** enough funds to toss a laptop after one use. Why be dumb (and, many of them are not dumb, but are pretty careless) and reuse a trackable, discardable device? They can go to a flea market, 2nd hand store or other place and pick them up like hammers and screwdrivers. Except here, as long as they use cash, they're blowing wind across the breadcrumbs, obfuscating or confusing the data trail.

Sheesh, just think as if you're writing a suspense thriller that HAS to enthrall or engage a perceptive, discerning audience. Think Perry Mason or something back in da day when shows were crisp and tight, and had less of the ratings-sweeps bullshit formulaic stuff in them.

The solution: Fix the screwed up foreign policies; stay out of others' business; do a little check-book diplomacy; bust a cap in the ass of companies that try too much "expand or die" in countries that only fester in hate and resentment; let the "target" countries see their mouthpieces die of natural causes and let the remaining, anxious, envious kids who grow up make the decisions to join the world market; stop FORCING foreigners to "do it our way or da highway". Nooo, I guess that would take the fun and game out of making and selling weaps; would steal or abort missions from intramural gamesmen looking for an existence-justifying/trooper-hardening/skills-honi ng military...

Just some random thoughts...

A real NSA story

[Anonymous Coward]

or lack of from USofA 'news' media http://www.gnn.tv/articles/2003/NSA_Spied_on_U_N_D iplomats_in_Push_for_Invasion_of_Iraq

NON Story

[Thanatopsis]

Sorry but this is a non story. They are just cookies. When they found out that the upgrade hadn't gone according to plan, they immediately fixed it. I am more worried about their extensive wire tapping. Jesus get a clue.

Re:A cookie?? Why is this even an issue?

[tjstork]

Can you Bush haters spare the shrill accusations and made up facts for at least once!

Executive Orders are not laws. The NSA did not break the law.

As far as Clinton goes, the impeachment was about a lot more than the blow job your side spins it as. It was about an entire pattern of abuses of power that include:

a) the mysterious deaths of senior cabinet officials
b) using the IRS audit as a means to go after political enemies
c) pardoning known terrorists
d) involving the USA in Kosovo, without the consent of congress.
e) refusing congressional subpoenas for white house documents
f) deleting all of the white house email, in total violation of a congressional subpoena and numerous court orders
g) taking campaign contributions from the chinese
h) using public buildings for fundraising

Conversely, Bush has not broken -any- laws.

WoW - A website that uses cookies!

[Anonymous Coward]

Amazing, a website that uses tracking mechanisms to record the browsing habits of its visitors..this surely is an Earth shattering discovery..NOT

"OK now kids - let's all put on our tinfoil hats.."

I support President Bush and the NSA

[Smarty2120]

In this new global war on terrorism, it is vital that the government have the cookies it needs to track and catch terrorists. Remember the attacks on 9/11 that took the lives of nearly 3000 americans. You're either with us or with the terrorists. Cookies will allow is to monitor for WMDs in rogue states around the globe. The hijackers on 9/11 might have been stopped by the use of cookies, but we will never know. Stay the course, support government cookies. God bless America and nowhere else.

Talking points: Because evidence has no place in a political debate

Re:I support President Bush and the NSA

[deanoaz]

>>> The hijackers on 9/11 might have been stopped by the use of cookies, but we will never know.

Actually, we do. The memo prohibiting persistent cookies came out in 2003. This suggests that the 9/11 terrorists were not deterred by cookie technology when it was in full force in 2001.

Clearly we are lagging behind the terrorists in cookie warfare.

Re:I support President Bush and the NSA

[fishbowl]

>Remember the attacks on 9/11 that took the lives of nearly 3000 americans.

Gee, I almost forgot all about that, until you reminded me just now. What was that other thing I was supposed to remember, "Diamond Harbor" or something like that? Oh, and something about "Alamo Car Rental" I was supposed to remember too, but forgot.

Re:I support President Bush and the NSA

[Schickie]

Remember remember the 5th of November. (Or maybe it's the sixth).

[ - merely intended as a courtesy for the 16 weenies in the UK who read slash-dot ]

Re:I support President Bush and the NSA

[fishbowl]

Guy Fawlkes' day?

Re:I support President Bush and the NSA

[Schickie]

Fawkes

"Gunpowder Plot" ...Houses of Parliament ...blow up ...Evil Catholics

Think about it...

[Zeeke75]

If the NSA were putting *anything* on computers for tracking, statistics or anything else, don't you think it would be something other than cookies? They have access to all the latest technology (including stuff we've probably never heard of - or were meant to hear of) and the best they can do is cookies?

Also, if they were truly trying to "spy" on people, do you really think that they'd let this story surface in any form? I realize that freedom of speech is granted by the constitution, but speech can't be done if the knowledge manages to....disappear.

Re:Think about it...

[cnerd2025]

Exactly...Sony ROOTKIT anyone? And the NSA has the smarts to get it right!

An executive order is being ignored.

[Futurepower(R)]

Sorry, not a law. An executive order is being ignored. If you visit the NSA web site, and don't know how or forget to delete cookies, you are being tracked.

The U.S. government's present problems with corruption are aided enormously by people who pretend to discuss politics but in fact are acting out their anger. They haven't read any books. They haven't educated themselves, although they parrot things said by other angry people, which may make them seem educated. They make very strong statements, and they try to intimidate people with an informed view.

HELLO IS ANYONE HOME?

[Anonymous Coward]

Who gives a FLYING fuck about cookies when they are spying on Americans with the Presidents full support.

Priorities people...PRIORITIES.

Translation...

[Anonymous Coward]

"The public does not need to be concerned that the CIA is tracking them. We're a bit busy to be doing that."

Translation: "We're actually a bit too busy data-warehousing, analyzing and searching thru all the raw IP traffic that we siphon off and copy from each and every major NSP backbone peering point router in the whole country to be bothered with unimportant stuff like looking thru our webserver logs."

Re:We don't have any way of discovering NSA activi

[Call Me Black Cloud]

However, you don't know what the NSA does, and neither do I, and we don't have any way of discovering.

1. If you want to know what the NSA does, get a job there. They're hiring. http://www.nsa.gov/careers/

The Slashdot story is about the NSA ignoring the law. That should give anyone the idea that the NSA may at other times ignore the law.

Do you speed? Ever do a rolling stop? If so you should be watched as you may at other times ignore the law.

The NSA is a large organization, with a population of a small city performing many disparate activities. You speak as if it's an individual. It's not.

Re:A cookie?? Why is this even an issue?

[scheming daemons]

As far as Clinton goes, the impeachment was about a lot more than the blow job your side spins it as.

You're right. It wasn't about blow jobs. It was about lying about blow jobs.

And talk about spinning. You don't even know what the impeachment was officially about. You list 8 things that it was about, none of which came up in the impeachment hearings or in the charges.

It was about an entire pattern of abuses of power that include:

a) the mysterious deaths of senior cabinet officials

Not part of the impeachment hearings.

b) using the IRS audit as a means to go after political enemies

Not part of the impeachment hearings.

c) pardoning known terrorists

The pardonings in question happened AFTER the impeachment hearings.

d) involving the USA in Kosovo, without the consent of congress.

Not part of the impeachment hearings.

e) refusing congressional subpoenas for white house documents

Not part of the impeachment hearings.

f) deleting all of the white house email, in total violation of a congressional subpoena and numerous court orders

Not part of the impeachment hearings.

g) taking campaign contributions from the chinese

Not part of the impeachment hearings.

h) using public buildings for fundraising

Not part of the impeachment hearings.

Conversely, Bush has not broken -any- laws.

LOL. Ok, pal. You don't even know what the faux Clinton impeachment hearings were about, and now... just weeks after finding out that Bush violated laws by A) maintaining secret prisons outside the U.S. B) violating the Geneva conventions concerning torture C) illegal surveillence of U.S. citizens without a warrant, in violation of FISA law and the spirit and letter of the 4th amendment to the Constitution.... you say Bush has not broken any laws.

Your "king", your bible-thumping dyslexic power-hungry boy emperor, has wiped his ass with your Constitution of the United States.

Hope you're proud.

In other news

[Dominic Burns]

Privacy is a non-issue - it died in the western world many, many years ago. Open your eyes - it's not going to get any better without serious public dissent.

This breath of stale perspective was brought to you by the letters B, B, I, W, Y.

Re:In other news

[Anonymous Coward]

>Privacy is a non-issue - it died in the western world many, many years ago.

Then why do we pick and choose what areas of privacy we are *required* to observe, and which ones we are not permitted the expectation of? Wiretapping is ok, but public nudity is not?

NSA Cookies are NOT disabled

[SpaceLifeForm]

Hmmmm. I just went there and got the cookies CFID and CFTOKEN, but not CFGLOBALS nor JSESSIONID. The two I got both have the 30 year expiry.

So, it's not really fixed at all since the two I received are the standard default cookies for the ColdFusion web server software.

This is surprising... how?

[Thaidog]

"You can catch hackers with out hacking yourself" Sure you can... unfortunately you need a cerbral cortex involved which I call the root cause analysis failure.

IT is against the law

[geekoid]

to track US citizen via any manner, unless specifically allowed to. Obviously there are a whole slew of law governing the exception.

This memo is a 'reminder' that it applies to cookies.

This happens all the time. A law is passed and an organization makes policy about everything that may break that law.

Re:A cookie?? Why is this even an issue?

[tjstork]

Dude you crack me up.

a. Maintaining secret prisons outside of the USA is perfectly legal under American law.

b. Also, the USA is not legally required to adhere to the Geneva conventions for those nations or combatants that do not adhere to them either. Therefor, we could legally execute all of the Al Qaeda and Taliban POWS, if we so chose. If Al Qaeda signs the Geneva Convention, then, their combatants get Geneva Convention rights, but, they do not.

Finally, this is the text of the 4th amendment. I suggest you read it.

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

1) First off, this amendment clearly does not require a warrant for a search. It insinuates that if you are going to send a human being to break into someone's house and disrupt their premises to conduct a physical search, that you need a warrant for that.

2) A person's property is not affected by electronic wiretapping. The original message is not delayed, its quality is not altered, and the value within it remains unchanged. Secondly, the message arguably is the property of the government anyway because it is going over the public airwaves. You could make the argument that the government does not needs a warrant to read email or listen in on voice mail or even to read physical mail because as soon as the message leaves the holder's hands and uses -public- transport, it is arguably not even the person's property, so it fails the "personal effects" test of the 4th amendment.

As for shredding the constitution, reading having a gov't computer that reads email is hardly the constitutional offense that the liberal agenda has. Show me the constitutional clause or amendment that specifically allows the government to regulate the environment, create "worker's rights legislation", or even civil rights or welfare or any other left wing project. I'm not saying that some of these powers the government has are bad, but, they are unconstitutional if you take the reasonable position that the framers explicit enumeration of federal powers and explicit granting of "all other powers to the state or to the individual" means exactly what it said.

Bottom line is, there has been no worse shredder of the Constitution than the American Left Wing.

PS. If you care so much about an expansive reading the 4th amendment, try and be equally expansive about this one:

"T h e r i g h t t o k e e p a n d b e a r a r m s s h a l l n o t b e i n f r i n g e d"

Which means, again, that because Clinton signed the Assault Weapons ban, that was ANOTHER REASON for him to be impeached, for clearly violating the constitution. Whereas Bush, on the other hand, let that stupid law expire so thus restored basic rights back to Americans.

When it all boils down to it, when you look at the repeal of the gun ban, the lowering of taxes, the removal of so many stupid regulations, Bush has actually been the most freedom granting president in modern times.

Hey -- Did they imprison the messenger?

[l0ungeb0y]

This is clearly a foul-up by the NSA. Malicious? Hardly.
I mean, it's just a freakin' cookie, not like it's some Active-X trojan that installs a keylogger. So the damage to those effected is pretty slight if any.
Just clear your cookie folder.

But, yes, it is a clear violation of the Feds own Regulations.
However, I could see this happening in so many other scenarios.. lots of people use prebuilt software and don't always take the time to ensure they are configured 100% correctly.

This sounds like a case of "Good enough for Government work" if I ever saw one.
The software worked as hoped, but no one bothered to see if the cookies were persistent or session only.

If this was on ma and pas webstore, no one would even think to look.
But since it's the big bad NSA, it makes headlines world wide.
Because the NSA is big and bad and... well they got cooler toys than everyone else so somehow they must be better than everone else and not able to make a mistake.

And at least in this Bush Administration, the person reporting this is still walking around a free man. For now.

Oh Please

[Crashmarik]

Oh Its about the "LEGALITY"

Did you even read the law you were linking to ?
The legislation would prohibit federal agencies from collecting and distributing personal information on computer users who visit federal Web sites. Agencies also would be barred from working with third parties to collect such information. The ban would not apply to data that does not identify individuals or to information submitted voluntarily.

I'm going to let you in on a little secret. If you are a generally law abiding person theres much more to worry about from your neighbors who will get pissed about the weeds in your yard , the color of your house, or the fact that they want you to pressure clean a fence, thant there ever will be about the big evil gummint.

Just wanted to add...

[Anonymous Coward]

that your narrating a 'tinfoil hat' is retarded not clever. If you were going for clever, it came across as retarded.

Re:OMG! Run for the hills!

[sfjoe]

...show me the bill passed by congress ...

FYI, not all laws are bills passed by Congress. Many Federal regulations issued by the Executive Branch carry the force of law unless explicitly repealed by Congress. I don't know if that's the case here or not.

Re:you aren't necessarily a troll if you don't car

[quinxy]

Yeah, I must say I was really surprised by the early responses your post/this article got. I thought /.ers were better than that! The first minutes of its life on /. seemed to get posts (or at least moderator points) dominated by people who really didn't read or understand the article and what this doesn't mean about the NSA's intentions, our security, or as you say the non-illegalness of this non-issue. Fortunately as I look at the responses now the system seems to have corrected itself and the non-tinfoil hatters have retaken control... I suppose the obvious lesson I should get out of this is that those who mod or post early are less likely to have modded or posted accurately/reasonably. It takes more time to think than to emotionally react.

Quincy

Where's the story?

[peterpi]

hmm?

Re:memo, not law

[fishbowl]

"A memo. Just a memo. Not an approved and voted on and passed law. It's a fucking memo! A nice idea, a thought, a suggestion, not law.
"

Administrative memos can have the force of law, if they originate from a position of authority. Administrative authority is delegated by Congress, and laws are made by agencies, subject to executive authority, judicial review, or congressional oversight. In many cases, simply publishing a rule in the Federal Register is sufficient for an agency rule to become law. Internal policies in an organization such as the NSA are in fact, law, and since Congress created that organization and delegated authority to it, it *has* been "approved, voted on, and passed law", as you put it.

If you're unhappy with that status quo, it's something you might take up with your representatives in Congress, but in general, the system enjoys overwhelming support.

Re:Cookies? Not a problem. Everything else they do

[fishbowl]

"What I DO have a problem with is government agencies telling citizens that the first, second, and fourth amendments were merely guidelines and they don't matter any more due to case law and unconstitutional executive orders."

Naturally, you can quote a government official making such specific claims. Please do.

Re:you aren't necessarily a troll if you don't car

[thesnarky1]

Well... lets see...

NSA should burn because they can track your movements with a permenant cookie. This is OBVIOUSLY against a law that I'm sure ALL of us knew about beforehand, and heck, I'll bet its required reading for all web admins in all government positions.

Bush should burn because, hey, there's gotta be a reason.

Microsoft dies because their software is vulnerable to this new attack from the government.

While we're at it, any site that uses cookies should be shut down, because they might be passing information to the government.

What'd I miss...

I'd like to see a beowolf cluster of NSA-burning permenant cookies that ca--- LINUX ROXXORS!1one!

Re:Cookies? Not a problem. Everything else they do

[kimvette]

It's nice of you to come out of your cave. Now let me introduce you to cnn, fauxnews, msn, and countless other news sources where you can catch up on everything that has gone on since September 11, 2001

institutionalized ass-covering

[misanthrope101]

...and attempt to lie to the public whenever such lying is "in the public interest" or covers their asses.

You forget that most in the "public service," at least when they get to a higher level in the hierarchy, think that covering their own asses is pretty much always in the public interest. Anything that would make high-rankig people look dishonest, stupid, incompetent, or malevolent is actively hidden, because god knows we wouldn't want to weaken the country. The only time someone in those levels is thrown to the wolves is when someone higher in the hierarchy needs to preserve their image by making a symbolic sacrifice.

Incompetence, stupidity, and dishonesty are bad enough, but when you can successfully hide your mistakes behind a veil of "public interest" or "national security" then you have effectively liberated yourself from accountability. Isn't that what we all want?

"cookie" or a web bug?

[Anonymous Coward]

I don't think it was a cookie, they just used that term to sound more reasonable. My loot is on a web bug, I've seen enough of them at dot gov sites.

Re:A cookie?? Why is this even an issue?

[nwbvt]

Clinton was president at the time and faced possible impeachment for perjury. That made the "lying about blowjobs" story almost interesting. This is a low level IT guy working at the NSA who violated some executive policy. The worst that will probably happen to him is that he will be fined, or will lose his job. No one is saying he should be allowed to do this, the question is why should we even care? People break laws all the time, not every one becomes a front page story on /..

BTW, I didn't see anything in the gp's post saying or even implying that if this happened under a Democrat administration worse punishments should be involved. In fact, he implied just the opposite, that /. would ignore this kind of stuff under a different administration.

Also, the Clinton impeachment thing has been over for some time now. You are free to get over it any time now.

I have a cookie from the NSA on my hard drive

[Anonymous Coward]

Hi folks,

When the whole wiretapping thing came up, I surfed over to www.nsa.gov to poke around. Now that this comes up, I figured I'd see if a persistent cookie had indeed been placed on my hard drive.

So here it is:

CFID
630440
www.nsa.gov/
1536
1461092480
31957745
3729285920
29754980
*
CFTOKEN
52821618
www.nsa.gov/
1536
1461092480
31957745
3729445920
29754980
*

Looks like they're using ColdFusion. And wow! Macromedia shows you how to disable persistent cookies!

http://www.macromedia.com/cfusion/knowledgebase/in dex.cfm?id=tn_17915

Look guys, this is a tempest in a teapot.

Secrecy in government cannot be democratic.

[Futurepower(R)]

You said,

"The NSA is a large organization, with a population of a small city performing many disparate activities."

This, of course, ignores my entire point. More accurately, you should have said,

"The NSA is a large SECRET organization, with a population of a small city performing many disparate activities."

How can there be democracy when the government reserves for itself the possibility of doing things in secret? There cannot.

Re:Secrecy in government cannot be democratic.

[Call Me Black Cloud]

Bring this down to your local level. The police are conducting an investigation of some drug dealer and have installed wiretaps to gather evidence. Should be police publish the details of what it's doing to whom? This would certainly inhibit the gathering of information. Same with undercover investigations. No undercover cop is going to get very far if everyone knows he's in law enforcement.

Besides, you know what the NSA does. SIGINT. It's the details that remain obscured...

heh...

[qzulla]

Does anyone else see the irony in the fact TFA wants to set a cookie that expires in 2038?

qz

molehill

[HermanAB]

Hmmm, I think the press is making a molehill out of a cookie. It is cucumber time - nothing happens during the Christmas holidays, the reporters need something to report and cucumbers are about as inspiring as, well, web cookies...

I concur!

[Anonymous Coward]

I too am a government-employed web developer. I find it humorous that I had never heard of this law before now though. While the majority of my work lives inside our intranet, we rely HEAVILY on cookies to insure data integrity. Our functionality would not exist without the ability to use cookies.

That said, we don't actually have the cookies expire on close. It's a courtesy to our users. Nobody likes logging in every time they visit a webpage and our users feel the same way. Nobody's ever tried to ding us on it though.

Nor have I ever seen any of the hundreds of various stock, off the shelf apps ever fit under this restriction. I personally know of two government owned/operated phpBB implementations that I have cookies for right now.

This whole thing is a scam, in my opinion. We have enough internal political problems to worry about without fearing lawbreaking on top of it merely for forgetting to pass the right date parameter to Apache::Cookie or something.

Cookies come from another site

[manarth]

This take on the story from Wired states:

The White House's website uses what's known as a web bug to anonymously keep track of who's visiting and when. A web bug is essentially a tiny graphic image -- a dot, really -- that's virtually invisible. In this case, the bug is pulled from a server maintained by the contractor, WebTrends, and lets the traffic analytic company know that another person has visited a specific page on the site.

Whilst WebTrends say they're not aggregating the data across multiple sites, but we only have their word for it.

The article isn't very clear though whether it's talking about cookies/webbugs from the Whitehouse's site or the NSA's site. Nothing like a journalist to confuse you more.

You are unbelievably inept.

[Anonymous Coward]

You're so full of shit your eyes are brown. I've worked in various government positions that the very reason why I left for the public sector was because of grossly negligent fiscal mismanagement and the plethora of individuals who were there only because the local unions made it impossible to get rid of them.

The fiscal waste in government is enormous compared to the private sector. Why? Because the government can raise taxes and there's little or nothing that people can do about it. With business, the equivalent would be to raise prices. But if you do that, people can move to competitors. Government doesn't HAVE any competitors. In business, do you have a restriction that if you don't spend all of your budget you'll get less next year? Absolutely no. Government? Absolutely yes. That alone is the most ridiculous and fiscally irresponsible position and leads to billions of wasted taxpayer dollars every year.

So, go back under your rock and don't forget to submit your photo to Wikipedia for the "fucking clueless moron" section.

Oh dear

[Secrity]

I hate the existing administration, I totally distrust our government (no matter which party is in power), I suspect that the NSA is incapable of telling the truth; and yet, somehow, I actually believe that this was an innocent screwup by whoever configured the NSA webserver.

Don't think you know what the NSA does.

[Futurepower(R)]

You said, "... you know what the NSA does."

In my opinion, you should not think you know what the NSA does, or the effects of its actions.

Re:Cookies? Not a problem. Everything else they do

[fishbowl]

"It's nice of you to come out of your cave. Now let me introduce you to cnn, fauxnews, msn, and countless other news sources where you can catch up on everything that has gone on since September 11, 2001"

Translation: I cannot provide a single quote.

not really news, not really a story.

[zenofeller]

the NSA cookies non-story

Ironically breitbart.com sets a cookie until 2038!

[now3djp]

http://www.breitbart.com/news/2005/12/28/D8EPGENO2 .html
^^ Ironically that sets a cookie until 2038

You haven't met many reporters, have you?

[Colin Smith]

"I can't believe the reporter is such a fucktard that he couldn't spend 2 minutes to research cookies and what they are."