Slashdot Mirror


Judge Orders Deleted Emails Turned Over

Anonymous Coward writes "In a lawsuit brought by the Federal Trade Commission, a subpoena sent to Google orders the turnover of the complete contents of a Gmail account, including deleted e-mail messages. The Judge has granted the subpoena and orders that all e-mail messages, including deleted messages, be divulged. Google's privacy policy says deleted e-mail messages 'may remain in our offline backup systems' in perpetuity. It does not guarantee that backups are ever deleted. So much for the Delete Forever button."

103 of 600 comments (clear)

  1. oh! by Janek+Kozicki · · Score: 2, Funny

    Nothing for you to see here. Please move along.

    oh, really?

    --
    #
    #\ @ ? Colonize Mars
    #
  2. Hate to say 'I told you so', but... by TripMaster+Monkey · · Score: 4, Interesting


    I TOLD YOU SO.

    I've maintained before that Google retains far too much information to make the use of Gmail anything less than a full-blown privacy nightmare. (For more information, please look here and here.)

    And now, the chickens have come home to roost. From TFA:
    The subpoena asks for not only current e-mail but also deleted e-mail: "All documents concerning all Gmail accounts of Baker...for the period from Jan. 1, 2003, to present, including but not limited to all e-mails and messages stored in all mailboxes, folders, in-boxes, sent items and deleted items, and all links to related Web pages contained in such e-mail messages."
    A stunning victory for the Establishment and a horror show for private citizens everywhere. Welcome to 1984.

    And before you start, please don't object that the person affected is a defendant in a criminal proceeding, because that's quite beside the point. The point is that Google has this information on you, and will hand it over upon request. This vindicates the caterwauling of all the privacy advocates concerning Google and Gmail, and establishes a dangerous legal precedent. Remember, as our 'inalienable' rights are systematically stripped away by the architects of the New World Order, more and more of the things you do become 'illegal'...and subject to criminal persecution...er...prosecution. It might not be long before you are being referred to as 'defendant'...what will you think of your Gmail account then?
    --
    ____

    ~ |rip/\/\aster /\/\onkey

    1. Re:Hate to say 'I told you so', but... by The+Snowman · · Score: 2, Informative

      This is one more reason why my email is a regular old email account and I access it via secure POP/SMTP. If I want to delete email, I can do it myself and make sure that it is gone forever. Maybe I'm paranoid. Better safe than sorry.

      I think the real issue here is control. By allowing Google to control your email, you are forced to stand helpless when shit like this happens. Google may offer nice services, but do you really want to give up control over your personal data such as emails? I don't.

      --
      24 beers in a case, 24 hours in a day. Coincidence? I think not!
    2. Re:Hate to say 'I told you so', but... by eln · · Score: 2, Funny

      I agree with you that gmail takes way too many liberties with personal privacy, but really any mail system other than your own will have a similar issue. Presumably, all of the webmail providers backup their data, and store it offline for unspecified lengths of time, and presumably they would all be subject to subpoenas for that information.

      Even if you store mail on your own servers, there is no guarantee that the same mail isn't stored somewhere else, such as say the Sent Messages folder of whoever sent it to you. The only way to maintain privacy is to not discuss private matters through email.

      Much like those naked pictures of yourself taken at that frat party in 1983, you must assume that once a piece of information makes its way on to the Internet, it is not going to remain private.

    3. Re:Hate to say 'I told you so', but... by eln · · Score: 5, Insightful

      Your ISP presumably backs up customer mail on a regular basis, and keeps those backups for God knows how long. POP accounts are no more secure than webmail accounts when talking about "deleted" mail.

    4. Re:Hate to say 'I told you so', but... by AKAImBatman · · Score: 5, Insightful

      Before you fly off the handle here, keep in mind that Google has only been ordered to produce the emails. What will be interesting is whether or not Google is able to produce the emails. If so, how many of them will they be able to retrieve? The subpoena itself - which is scary, but unfortunately a part of the legal system - is really secondary to this. A judge can't magically make deleted data reappear, no matter what they order. But if the data is not deleted... well... then your fears are fully justified.

      I've always wondered if that clause was more of a CYA clause meant to get around the fact that plenty of stuff may remain in the GoogleFS for a period of time after it has been "deleted", but without a live index. The results here may very well show if that is true or not.

    5. Re:Hate to say 'I told you so', but... by TheSkyIsPurple · · Score: 2, Informative

      Sorry, but If your email was ever on a computer (trust me, it was), and that computer was backed up when your email was on it (you hope it was), you're still open (oh crap).

      Whoever your provider is just needs to be subpoena'd, and voila... everything you thought you removed is back in action.

    6. Re:Hate to say 'I told you so', but... by MyNymWasTaken · · Score: 5, Interesting

      If you're concerned about your privacy, why are you sending sensitive information in the clear over email; through any provider?

      Use PGP!

      And would you mind telling me how gmail is any different than hotmail or yahoo mail in regards to managent's access to email contents?

      what will you think of your Gmail account then?

      "I refuse to divulge my PGP private key & passphrase."

    7. Re:Hate to say 'I told you so', but... by maelstrom · · Score: 2, Funny

      But but but, Google has a web page that says they won't be evil! This can not be!

      --
      The more you know, the less you understand.
    8. Re:Hate to say 'I told you so', but... by szembek · · Score: 5, Insightful

      The point is that Google has this information on you, and will hand it over upon request

      I think this would be better stated if you replace "will hand it over upon request" with "must hand it over when ordered to by a judge". I see a big difference there.

      --
      nothing
    9. Re:Hate to say 'I told you so', but... by IDontAgreeWithYou · · Score: 5, Funny

      Yeah, I mean you wouldn't want the following email message to get out into the public

      to: MOM
      from: TripMasterMonkey
      Subject: Second Post :(


      Mom, I only got second post on the slashdot story about Gmail. Well, at least I got +5 interesting for mentioning 1984. If you need me, I'll be in the basement. A new story is coming out in 5 minutes and I have to do some serious copying and pasting and then mention privacy concerns. See you upstairs later tonight for dinner.

      Love, Your son TMM ^_^
      --
      Finding other idiots on /. that agree with your opinion doesn't make it any less stupid.
    10. Re:Hate to say 'I told you so', but... by serutan · · Score: 4, Insightful

      Maybe I'm missing something, but since when does email exist in a different universe than any other kind of mail? Courts have always had the power to subpoena (or whatever the legal term is) personal correspondence. This new ruling doesn't require Google to keep anybody's email forever, Google already does that on their own. The court is simply demanding to see specific correspondence during a specific time period. Same as it could demand a stack of love letters in someone's dresser drawer. People who want to keep their mail secret forever should burn it, and those same people shouldn't use GMail.

    11. Re:Hate to say 'I told you so', but... by geoffspear · · Score: 4, Insightful
      Erosion of the expectation of privacy actually diminishes your rights to privacy. The 4th Amendment's use the the word "unreasonable" to describe what sorts of searches and seizures are forbidden makes this a problem.

      What someone in 1789 considered "reasonable" might be very different from what someone today considers "reasonable". Imagine what sort of things a person will consider to be "reasonable" when they grew up expecting that the government would read their personal email and that they shouldn't care because they've got nothing to hide.

      --
      Don't blame me; I'm never given mod points.
    12. Re:Hate to say 'I told you so', but... by vux984 · · Score: 5, Insightful

      Why more so than Hotmail, Yahoo, or any other webmail? I'm sure all their "privacy" promises are at least as loose as Google's.

      While any ISP, including your local pop3 box provider would likely comply with this request...

      Only google claims to want to "organize all the worlds information", including the information *you* no longer value, like old emails you've deleted. They have value to them for their profiling/advertising efforts.

      While any ISP *might* have an incidental backup of your email going back 3 years. Google is the only one that is likely to be systematically going to the trouble of keeping your email, all of it, going back forever.

      It only remains a question of how much data Google has actually retained. Though they don't guarantee to delete mail when trashed, in practice they probably do eventually, and the case concerns events two or three years ago.

      Exactly. No other ISP is likely to be able to produce much more than an incidental or partial backup that far back; but nobody here will be surprised if Google can bring back everything. (Complete with relevant ads down one side.)

    13. Re:Hate to say 'I told you so', but... by deadlinegrunt · · Score: 4, Funny

      I would think that they have Google Backup. Beta of course...And only employees can be invited.

      --
      BSD is designed. Linux is grown. C++ libs
    14. Re:Hate to say 'I told you so', but... by MobyDisk · · Score: 4, Insightful
      Mod down this alarmist. Records are subpoenaed all the time in criminal cases. There's nothing special about this case whatsoever. This shouldn't even be on Slashdot since this happens every single day.
      I've maintained before that Google retains far too much information to make the use of Gmail anything less than a full-blown privacy nightmare.
      Google doesn't claim that your email will remain private against government subpoenaes! Why does that make it a privacy nightmare? Hint: If you don't want it to be evidence against you, don't store it unencrypted on private company email servers. On a related note, don't write it down and lock it in a drawer, don't hide it under the mattress, and don't put it in a safe deposit box under your name. None of these things are safe from a subpoena.
      And before you start, please don't object that the person affected is a defendant in a criminal proceeding, because that's quite beside the point.
      Actually, that is the entire point. I would agree with you if this were Google being pressured or requested to give the information. But this was done with the proper documentation from a judge in a court of law. The fact that you hand wave it away and blame Google is quite beside the point.
    15. Re:Hate to say 'I told you so', but... by AKAImBatman · · Score: 4, Insightful

      I would think that they have Google Backup.

      I don't see why that's a "safe" assumption. The Google search engine churns through terabytes of data that can easily be recreated. That safety net allowed them to test their GoogleFS system before using it on other applications like Mail. GoogleFS was very much built around the concept that the system is its own backup. If any one PC in the cluster fails, they simply yank it and throw in another. No recovery is attempted on the old PC. They simply repair and wipe it if it's feasible, or junk it if it would cost too much time.

      Thus in this guy's case, the matter will likely depend on whether Google explicitly maintains an index of deleted email and accounts, or if they simply "delete" things by removing the indexes and waiting until the various GoogleFS rebuilds wipe out the extra data.

    16. Re:Hate to say 'I told you so', but... by malchus842 · · Score: 5, Interesting

      This is why I'm my own ISP (so to speak). I run my own server, and do my own backups, which I retain ONLY for disaster recovery purposes. The system is backed-up each nite, with the backup files copied to another system. After 3 days, the backups are expunged with a secure erase program. It's all automated. It never hits tape, and as such, if I delete something, it's gone.

      I also religiously encrypt outbound email, and ask my correspondants to encrypt mail they send to me.

      Now, don't get me wrong - I don't think this is 100% secure, but it sure beats letting Google/Comcast/AT&T/Earthlink/MSN or whoever determine what gets kept and what doesn't.

      I would never change back - come what may, as long as owning a server is legal, that's how I'm getting my email. And if they try to make it illegal, well, Jefferson told us how to deal with that problem.

    17. Re:Hate to say 'I told you so', but... by LordOfTheNoobs · · Score: 2, Funny

      Formal Reply To Request
      Requestor : DOJ
      Requestee : Google Inc.

      SEND 2003 01 15 0134 UTC - Hey bob how r u ? ...
      RCPT 2003 01 15 0145 UTC - Good but ur gay lol @ u ...
      +
      + Ads by Goooooogle
      +
      + Buy gay for cheap!
      + gaystufffakesite.com
      +
      SEND 2003 01 15 0149 UTC - That's not funny. Hey let's screw the FTC
      RCPT 2003 01 15 0203 UTC - Ok let's go.

      (...)

      --
      They're there affecting their effect.
    18. Re:Hate to say 'I told you so', but... by selfabuse · · Score: 2, Informative

      I can't speak for all ISPs, but at least at the one I've worked at, it doesn't happen quite like that. The mail server is backed up daily at a specified time. Any messages that happened to be in your pop mailbox at that time would be backed up. Lets say the backups are running at midnight, and you had just checked your mail before you went to sleep at 11pm. The only mail on the backup tape would be anything you had recieved between 11pm and midnight. The stuff that we're interested in backing up on the mail server, is not in fact the customers mail. We're more concerned with the config files, and the actual OS etc, so if the server was to die, we could ressurect it easily. We generally only keep backups for a week also. They're mostly for disaster recovery, and if there was a disaster, we'd want the tape from the previous day - something several months old would probably not help, unless the machine had been hacked and we hadn't noticed it for quite a while. In a situation like that, we'd actually prefer to rebuild the box from scratch anyway.

    19. Re:Hate to say 'I told you so', but... by SydBarrett · · Score: 3, Insightful

      oh no the super evil gubermints have won by making us use teh gmails and outlawed all other email serviceZ and googles didn't say what they were doing with the email and you don't need a court odor to OH WAIT

      You guys ever hear of a search warrant? A signed one of those can let people in your FUCKING HOUSE, nevermind your email. IT'S SCARY!

      Oh, nice use of both "New World Order" and 1984 in one post. I award you double kook points for that.

    20. Re:Hate to say 'I told you so', but... by gnixdep · · Score: 2

      They can't charge the courts for the information, but they're not obligated to do anything other than a flat-text dump.

      If it's base64 files, that's up to the attorney's techs to decode.

    21. Re:Hate to say 'I told you so', but... by Slightly+Askew · · Score: 2, Interesting
      "I refuse to divulge my PGP private key & passphrase."

      That's ok, we'll just subpoena you're personal computer, PDA, desk, cell phone, etc. to find your private key. I'm sure there's a copy of it around here somewhere.

      Oh, and this is Jack Bauer. He'll be asking you for your passphrase in Holding Room B.

      --
      Public use of any portable music system is a virtually guaranteed indicator of sociopathic tendencies. -- Zoso
    22. Re:Hate to say 'I told you so', but... by 42forty-two42 · · Score: 2, Insightful

      Google's bigtable presentation gives some clues onto this. Bigtable purges deleted information in a batch manner, not as the delete requests are given. It seems they'd need such a CYOA term to use such a system.

    23. Re:Hate to say 'I told you so', but... by Alex+P+Keaton+in+da · · Score: 2, Insightful

      I am not your lawyer, and this isn't legal advice in any way- I can only speak to hypotheticals.
      That being said, it is clear that your legal understanding comes from Law and Order and Matlock.
      I am not trying to be a jerk, but seriously- you are one of those people who thinks that at if you ask a cop "are you a cop?" and they say no then you will get off because it is entrapment...
      The law is complex, and perhaps you should study it a bit before commenting.

      --
      And All I Ask is a Tall Ship And a Star to Steer Her By
    24. Re:Hate to say 'I told you so', but... by 1u3hr · · Score: 4, Insightful
      Only google claims to want to "organize all the worlds information", including the information *you* no longer value, like old emails you've deleted. They have value to them for their profiling/advertising efforts.

      A supposition. What's the point of matching ads to messages you've already deleted; meaning you will never display them again? If they wanted to process them for their "profile" they would already have done that. It seems more likely to me that Google does intend to delete trashed messages, but just doesn't want to promise exactly when they'll get around to it. Maybe a scheduled garbage collection once an hour/week/month. Anyway, this case may reveal just how it works.

    25. Re:Hate to say 'I told you so', but... by dextromulous · · Score: 2, Informative

      IRC, is that recorded?
      Yes and no. It can be, so assume it is. It is, however, normally recorded by a user or bot on the channel for archival purposes. See http://ds9a.nl/klogbot/ for an example.

      I don't know why computer communication isn't given the same legal protections as phone conversations. In most states, intercepting a phone call is illegal, and so is recording them without concent. How is communicating with a computer different than communicating with a phone?
      Because in _most_ cases "computer communication" means the Internet and relies on "public" systems to relay messages. Telephone conversations, OTOH, are a "dedicated" connection between two people who have "leased" lines. You can do this with computers as well (even using quantum security, http://www.magiqtech.com/ ,) but it is not the Internet. In the case of IRC, you are posting to a semi-public forum, not to one person over a private connection.

      How can I encrypt my emails so the person recieving can read them, but everyone else can't?
      GPG, PGP, etc.

      --
      There are two types of people in the world: those who divide people into two types and those who don't.
    26. Re:Hate to say 'I told you so', but... by AKAImBatman · · Score: 2, Insightful

      If you manage to kill the FBI and local Police Force, then the US would have a lot more problems on its hands than just someone failing to respond to a subpoena.

      Keep in mind that situations like Waco have happened throughout the FBI's history, going all the way back to the gangsters of the 20's. Having stockpiles of powerful munitions and arms is rarely sufficient to withstand a full out assault from well-equipped and well-trained FBI teams. The only reason why most situations take time to resolve is that the FBI desires a minimal loss of life.

      Destroying complete police forces would mean that there was a war on our own soil. Thus the Army would be brought in for the common defense. By then, any subpoena would have been long forgotten and considered irrelevant to the situation. The US Troops would make zero effort to enforce the demand of the subpoena, and would actually invalidate the evidence if they did attempt enforcement.

    27. Re:Hate to say 'I told you so', but... by KarmaMB84 · · Score: 2, Insightful

      and with a proper subpoena, they can look at much worse information on you... this isn't new.

    28. Re:Hate to say 'I told you so', but... by Surt · · Score: 2, Funny

      "I refuse to divulge my PGP private key & passphrase."

      of course, followed by:

      "And stop torturing me in this secret eastern european prison, #@##$$%!"

      --
      "Who is the Journal of Quantum Physics going to believe?" --Stephen Hawking
    29. Re:Hate to say 'I told you so', but... by mdielmann · · Score: 2, Insightful

      Like I always say, "If you want to keep a secret, don't tell anyone." Or it's corollary, "I only trust me and you, and I'm not sure about you..."

      If you don't people to know shit, don't record it, whether in writing, email, audio, or anything else. Otherwise there is the risk it will come back to haunt you.

      --
      Sure I'm paranoid, but am I paranoid enough?
    30. Re:Hate to say 'I told you so', but... by vux984 · · Score: 2, Interesting

      A supposition.

      But not one made completely off the cuff.

      What's the point of matching ads to messages you've already deleted; meaning you will never display them again?

      Matching ads to *them* nothing. But they don't match ads based on the content of a single message; its based on the aggregate information you have, fine tuned by whats in a particular message.

      If I receive 200 messages about vampire bats and then you send me a "Hey! Whats up?" they can show me some ads about bats, because nothing else is more relevant, and they know i like bats.

      If you send me a "Hey! You need a bat?" They can show me some ads for the winged bats instead of the wooden ones... because from the profiling they know what kind of bats I like.

      etc.

      I agree deleted messages might have less value than messages I want to keep, but perhaps not... some people delete practically everything. Suppose I'm a big stereo buff, and am always corresponding with various online stores about bits; and after buying a component I delete the bulk of the pre-sales correspondance. Suppose also that I keep all the birthday pictures my family sends me... my profile if they only looked at what I kept would, after a few years be a whole lot of birthday pics, and few recent inquiries about stereo components -- suggesting I'm much more interested in birthdays (and might be in the market for party hats, flowers, cakes, etc), and not stereos, which make up the bulk of my correspondance. Deleting messages clearly skews the accuracy of the profile.

      If they wanted to process them for their "profile" they would already have done that.

      When they improve their profiling algorithms they'll want to run it against the original data.

      It seems more likely to me that Google does intend to delete trashed messages, but just doesn't want to promise exactly when they'll get around to it.

      Definately a possiblity. Likely for most ISPs. I'm not convinced its nearly as likely for google.

      But as you said, perhaps we'll learn from this case.

    31. Re:Hate to say 'I told you so', but... by thatguywhoiam · · Score: 4, Informative
      This is why I'm my own ISP (so to speak). I run my own server, and do my own backups, which I retain ONLY for disaster recovery purposes. The system is backed-up each nite, with the backup files copied to another system. After 3 days, the backups are expunged with a secure erase program. It's all automated. It never hits tape, and as such, if I delete something, it's gone. I also religiously encrypt outbound email, and ask my correspondants to encrypt mail they send to me.

      That's very commendable, and worthwhile.

      But just so you know...

      When the NSA goes datamining, they divide the intercepted traffic into two piles: clear and encrypted. Both piles get processed. Except yours has a red flag next to it.

      Better to maintain a normal usage profile and be even sneakier about important correspondance, if you are worried about it. (And you should be.) Its all hassle vs security. If you are going to that much trouble already, why not go all the way and use stego or something that doesn't scream "I am encrypted info" like PGPMail? (for example)

      --
      If Jesus wants me it knows where to find me.
    32. Re:Hate to say 'I told you so', but... by budgenator · · Score: 2, Informative
      Get GPG, GNU Privacy Guard installed and set up on your system; and it runs on about everything.
      Then you generate a key pair one key is public and people who want to send you encrypted files or emails get it either from you or a keyserver (I think) and a private key that decrypt what the others have sent you and actually use it. If you need to know that the identity is really who you think they might be, then you need to set up a key signing party where you will;

            1. Generate A Key Pair (already done)
            2. Send Public Key To Designated Keyserver (or Coordinator)
            3. Send Public Key Info To Coordinator
            4. Show Up At The Party
            5. Verify Your Key Info
            6. Verify Everyone Else's Key Info
            7. Verify Everyone Identify for IDs You Will Sign
            8. Sign All The Verified IDs On The Verified Keys
            9. Send The Signed Keys Back Up To The Designated Keyserver (or to the key owner)
      as outlined at cryptnet.net. I've thought about telling people who send me email that my email filter thinks everything that's plain text is spam and to resend just to get to critical mass.
      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
    33. Re:Hate to say 'I told you so', but... by GoofyBoy · · Score: 2, Informative

      http://world.std.com/~reinhold/dicewarefaq.html#su bpoena

      and
      from http://www.faqs.org/faqs/pgp-faq/part2/

      3.21. Can I be forced to reveal my pass phrase in any legal
      proceedings?

      Gary Edstrom reported the following in earlier versions of this FAQ:

      - -----
      The following information applies only to citizens of the United
      States in U.S. Courts. The laws in other countries may vary. Please
      see the disclaimer at the top of part 1.

      There have been several threads on Internet concerning the question of
      whether or not the fifth amendment right about not being forced to
      give testimony against yourself can be applied to the subject of being
      forced to reveal your pass phrase. Not wanting to settle for the many
      conflicting opinions of armchair lawyers on usenet, I asked for input
      from individuals who were more qualified in the area. The results
      were somewhat mixed. There apparently has NOT been much case history
      to set precedence in this area. So if you find yourself in this
      situation, you should be prepared for a long and costly legal fight on
      the matter. Do you have the time and money for such a fight? Also
      remember that judges have great freedom in the use of "Contempt of
      Court". They might choose to lock you up until you decide to reveal
      the pass phrase and it could take your lawyer some time to get you
      out. (If only you just had a poor memory!)

      --
      The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
    34. Re:Hate to say 'I told you so', but... by jred · · Score: 2, Interesting

      Just send all "private" emails like this...

      First line is "I hate your fucking guts"

      Then the attachment of goatse/tubgirl, which contains the real message...

      I mean, who the fuck is going to spend a lot of time staring at tubgirl???

      --

      jred
      I'm not a mechanic but I play one in my garage...
    35. Re:Hate to say 'I told you so', but... by tacokill · · Score: 2, Interesting

      When the NSA goes datamining, they divide the intercepted traffic into two piles: clear and encrypted. Both piles get processed. Except yours has a red flag next to it.

      Ridiculous! Do you really think that the NSA is trying to crack ALL encrypted traffic? Yes, I know about the "spying on americans" issue and all that. But think about it from a labor standpoint.

      There are many many "normal" uses of encryption that go on every single day.
      - SSH
      - SSL
      - PGP
      - VPN


      If you think the NSA is looking at every single packet and "marking" them based on whether they are encrypted or not, I think you are mistaken. Think of all the legit traffic that is encrypted. It's a bunch. A whole bunch. And not even the NSA has the resources to parse through all of it, much less analyze it in any form.

    36. Re:Hate to say 'I told you so', but... by cherryrocks · · Score: 2, Funny

      Usable interfaces will be the downfall of civilized society, mark my words!!

    37. Re:Hate to say 'I told you so', but... by Bios_Hakr · · Score: 2, Interesting

      Something like this happened to a friend of mine. We were in the military, living on-base in an overseas location. He was probably into some bad shit; we all were back then. Before we knew it was bad we were portscanning and mailbombing people just because it was "fun". Anyway...

      So, he gets charged with some violation of some regulation. They come in and seize two desktops, a laptop, a printer, a monitor, KVM, and anything else computer related. They even took the keyboard and mouse. They took his fucking CD player because it "could be used to hold a data CD". Well, the data was protected with some kind of encryption. I don't know if he used PGP or MagicFolders; but something to obfuscate the data was in-place.

      After 4 months, we still hadn't heard anything from the cops. We started calling the lawyers trying to find out what was happening. They basicly responded that the case was on-hold pending collection of evidince.

      Well, 14 months later, he was scheduled to move to another base. They refused to let him because they still had him "under investigation". 20 months later, they refused to let him leave the military (his contract had expired) because he was under investigation.

      They ended up not allowing him to be promoted, not allowing him to move, not allowing him to get out for just over 6 years. All because he wouldn't give up his key.

      26 months *after* he should have been allowed to leave the military, they ordered him to go to Kuait. They also ordered him to take a bunch of Anthrax shots. He refused the shots (they have done some pretty bad things to people) and they gave him a dishonorable discharge a few weeks later.

      The shit of it? The commander promised that they would hold on to his computers till they can read the data. She promised that she'd have her best guys look at it every year till they figured it out. She promised that when they found what they were looking for, they'd find him and lock him up in a military prison.

      --
      I'd rather you do it wrong, than for me to have to do it at all.
    38. Re:Hate to say 'I told you so', but... by TapeCutter · · Score: 3, Interesting

      I was in full agreement up until: "...much less analyze it in any form"

      If I were a spook I would not want to figure out every message coursing through the interwebs, I would be more interested in tracking who is talking to whom. That way when I decide to piss all over peoples privacy I could seize and decrypt the accounts of the evil-doers and all their mates at slashdot. - The eternal problem that is easy to spot, is who decides what constitues evil? Are there non-binary levels of "evil", and if so what are they?

      OTOH: This kind of social network monitoring and analysis has dismantled extremly vile networks involving child tourtue and sexual abuse of toddlers. Most notably in the mid 90's in Denmark where some very high profile Danes were implicated in an international child abuse network. The result in Denmark was public revultion with thousands of people attending mass protests.

      How many people would peacfully tolerate privacy protection for that kind of activity sent over a global public network for profit? Should we refuse to employ bomb sniffing dogs to monitor snail mail because the dog might pick on an innocent package?

      From anarchists all the way across the political spectrum to 1984, the spanish inquisition and the crucifiction of Christ, every one of us looks for nirvana in a personal "book of rules", this "nirvana rule book" only exists within the deluded individual's mind. The fact that "nirvana for all" can not be discovered through a single "book of rules" does not slow humanities enthusiaim for writing "rule books" and forcefully applying varying interpretations on to everyone they encounter. I'm not saying human nature is wrong, it just "is".

      BTW: "1984" is a brilliantly insightfull book, "Animal Farm" is equally as brilliant and in my mind closer to the "truth" about ourselves.

      --
      And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
    39. Re:Hate to say 'I told you so', but... by svkal · · Score: 2, Insightful
      If all it took to defeat the NSA was some simple PGP....wouldn't that put the NSA out of business pretty quickly?
      Well, no. It would certainly make the job of gathering information a lot harder. It probably does. But I am unsure of in what way you expect them to "go out of business" because of this. Obviously the U.S. isn't going to shut down its intelligence agency simply because the general population(or more accurately, a subset of it) vastly overestimates its capability, and obviously they aren't going to state publicly that what still-relevant ciphers they are able to break and on what kind of scale they can and do break them(which would be a puzzling move, anyway, since everyone would assume that they'd be lying if they did that). "If" all it took to defeat the NSA was some simple PGP, they wouldn't be the omniscient all-seeing eye that they tend to be portrayed as in fiction. But they would be fully operative, though perhaps not doing exactly the things that outsiders imagine them to do.

      Now, I'm not trying to say that I know what the NSA does or can do. Rather, I'm trying to say is that I do not, and neither do you(unless you're not telling us something rather significant). So, not knowing what they're doing, we basically have (at least) two possible grounds for speculation: we can speculate based on what they do in fiction(The Digital Fortress being a prime example of the genre. I think I read about ten random pages of that book without encountering a single sentence that didn't either highly amuse me or make me cringe with its extreme lack of understanding of the subject matter(which I have only a cursory familiarity with myself - but you'd think that you'd take a week or two to do some reading before you start writing a novel about the stuff)), or we can speculate based on what is likely to be possible based on the science(or, to be paranoid, the part of the science which is publicly known).

      I won't repeat those points here - someone else already did that in this thread - suffice it to say that unless the NSA are far, far ahead of the rest of the world when it comes to cryptographic theory and/or computing power, there are several commonplace ciphers that they cannot possibly decrypt. As far as I know, there are no strong indications that they are so far ahead that they can actually do things that we assume to be impossible given the current general technological level of mankind.

      Another little eye-opener: it is quite easy to make a perfect encryption system(assuming a secure channel for the key, which is needed anyway). Have a randomly generated key as long as the message, and you have a one-time-pad, which the NSA cannot possibly break(this can, of course, be mathematically proved, which is the beauty of the argument). Given this knowledge, why haven't the NSA "gone out of business"? Surely, if I were a terrorist(or whomever the NSA is hunting these days), I would go to the hassle of setting up some kind of physical key exchange network for a one time pad system?

      (Naturally, OTP implementations can be "broken" by not attacking them from a cryptographic angle, i.e. rather using keylogging, social engineering, etc. But this is probably what the NSA actually does with too-hard-to-break encryption as well, so if you somehow expect the NSA to perish instead of having to resort to it in the latter case, I can see no logical reason that you shouldn't expect them to do so in the former.)

  3. Easiest way to deal with this in 2 easy steps by rikkards · · Score: 3, Informative

    1. Stop using the web interface and enable POP
    2. Start using a client and your favourite encryption software

    1. Re:Easiest way to deal with this in 2 easy steps by Mostly+a+lurker · · Score: 5, Informative
      Using the POP interface to Gmail, by default keeps a copy on the server. If you override this default, it then becomes deleted email that Google's privacy policy states 'may remain in our offline backup systems' in perpetuity.

      Encryption would be the way to go with email if all your correspondents would agree to cooperate. In my case, there are perhaps two people I correspond with regularly via email who might consider making the effort.

  4. email longevity & PGP by MyNymWasTaken · · Score: 5, Insightful

    All email messages exist in perpetuity. They can be stored as backups in any server that they touch between the sender & the receiver.

    If you're concerned about the contents of your emails being divulged - USE (open/gnu/etc...)PGP!

    If that is still too insecure for you, meet the recipient in the middle of the park for a strolling conversation; and don't forget the white noise generator.

    1. Re:email longevity & PGP by das_cookie · · Score: 3, Funny
      If that is still too insecure for you, meet the recipient in the middle of the park for a strolling conversation; and don't forget the white noise generator.

      I prefer the Cone of Silence to secure my communications.

      --

      You! Yes, YOU! Out of the gene pool!

  5. This is Why... by eno2001 · · Score: 5, Insightful

    ...it makes much more sense to run your own mail server. That's what I do. I don't trust ANYONE but myself with my mail.

    --
    -"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
    1. Re:This is Why... by Anonymous Coward · · Score: 2, Insightful

      so do you only email yourself? because most people don't run their own server and every msg you send or receive is being stored on somebody else's mail server.

      email just isn't secure and 100% private. we all just need to accept it, however much it does suck. i hate it too, but it's the truth

    2. Re:This is Why... by davmoo · · Score: 4, Insightful

      You better re-examine your idea of security here. For starters, your ISP that you connect your server to can easily store both sides of a conversation...it has to pass through their server *both ways* for you to communicate. Then it has to pass through their upstream tap, and so on.

      Unless you use strong encryption, your email server is no more safe than using gmail, and the only person you're kidding is yourself.

      --
      I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
    3. Re:This is Why... by tgd · · Score: 4, Insightful

      And what about your mail sitting in relays on the net? I'd bet at least once in a while one of those gets picked up by a backup system.

      If you want to tell someone something securely, you need to make up a language only you two know and whisper it in their ear.

      What you're doing is only marginally more secure (and enormously more of a pain in the ass) than using GMail. At least when a disk croaks at Google you won't lose your mail. Disk croaks at your house, its gone.

      Oh wait, you have backups? Did your e-mails you deleted off your home system magically get deleted off of them, too?

  6. The Government Hates Google by taylor_venable · · Score: 5, Interesting

    With everything that's been going on lately, it sounds like the American government really wants to take Google down in the war of public opinion. The gov't just keeps trying to make them look worse and worse. And since the American courts typically just allow the gov't to do whatever it wants, they're winning.

    1. Re:The Government Hates Google by maelstrom · · Score: 3, Insightful

      If you were a prosecutor with any amount of sense at all, wouldn't you request the same thing? It isn't some big conspiracy theory to hurt Google, this is someone doing their job, and a pretty good one from what it sounds like. It will be interesting to see what records pop up.

      --
      The more you know, the less you understand.
  7. U R pwned. by Bob+Cat+-+NYMPHS · · Score: 5, Interesting

    Hey, I happen to know YOUR company does backups! You deleted your mail from the server, but you didn't hunt down those tapes in the vault, did you? Huh?

    Does NO ONE remember Ollie North and the White House PROFS system? 20 years later, and people still think incriminating data will always just go away when you desire.

    INFORMATION WANTS TO BE COPIED.

  8. One other possibility by benjjj · · Score: 2, Interesting

    Might Google be under some sort of secret agreement with the gov't to hold on to emails, just for circumstances like these? It really doesn't make much sense from a storage perspective to keep around tons of deleted emails. If I were Google, the Delete Forever button would clear any deleted email off of my very crowded storage systems at the same time that it clears it out of a user's inbox.

    1. Re:One other possibility by jim_v2000 · · Score: 2, Insightful

      Might Google be under some sort of secret agreement with the gov't to hold on to emails Dude...no. Take the tinfoil off.

      --
      Don't take life so seriously. No one makes it out alive.
  9. Sigh by Benanov · · Score: 2, Insightful

    Time to cancel some webmail accounts. I'm sure Yahoo and/or MSN (which I quit using long ago) will do this too.

    I doubt I can set up my own MTA...any good howto's out there, or should I *urp* google it? :)

  10. Please !!!! by powerlord · · Score: 4, Interesting

    Someone think of the poor people that will have to read through all the spam that goes through one mailbox!!!

    Heck ... I can picture the defense getting a 80GB archive tape and being told that was all messages recieved. Yes, 99.999% of them are spam. Enjoy.

    Talk about burying the opposition in paperwork.

    --
    This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
  11. Encrypt everything. by Blackknight · · Score: 2, Insightful

    If you don't want other people to read your mail, encrypt it. They can subpoena your mail all they want, but without the private keys they won't be able to read it.

    1. Re:Encrypt everything. by brasscount · · Score: 5, Informative

      Encrypt away, they'll subpoena the email, you're right. Then they'll subpoena the passphrase. If you don't comply with the subpoena for the passphrase, they'll obtain a search warrant, and find where you wrote it down, admit it, its in a card in your wallet, or in some pass store software, isn't it? Then they'll use good old fashioned forensics to decrypt the shadow cache and drag a list of passwords on your server out in the open.

      And finally, if that doesn't work, they'll throw you in jail for contempt of court until such time as you do remember your passphrase.

      Don't underestimate the power of the government to discover secrets, they've been in the business for years.

      What concerns me more is this enforced compliance with a subpoena for a crime that might have been committed, but for which they have to conduct a search to determine if evidence exists that a crime was committed. This thing stinks to high heaven of unconstitutional and illegal search and seizure. Where are the lawyers screaming habeas corpus?

      --
      Confidentiality, Integrity, Availability: without Availability the other two are assured, as is Bankruptcy.
    2. Re:Encrypt everything. by Threni · · Score: 3, Informative
  12. So if you really hate someone with a gmail account by kalirion · · Score: 2, Funny

    Hey buddy, Here's that kiddy porn you wanted. -Anonymous

  13. Re:That's just like... by gEvil+(beta) · · Score: 5, Funny

    BadAnalogyGuy, is that you?

    --
    This guy's the limit!
  14. With apologies to Douglas Adams by Tackhead · · Score: 5, Funny
    "Doing No Evil - a HOWTO Guide, presented in Socratic Dialogue form, courtesy of Zaphod Beeblebrox"

    Google: The gmail documents may remain present in our offline backup system.
    IRS: I eventually had to go down to the cellar...
    Google: That's the offline backup system's machine room.
    IRS: ... with a torch.
    Google: Ah, the lights had probably gone.
    IRS: So had the stairs.
    Google: But you found the tape, didn't you?
    IRS: Yes. It was backed up on paper tape stored in the bottom of a locked drawer beneath a PC04/PC05 tape reader with a dot-matrix printed sign on the door saying 'ACHTUNG! ALLES LOOKENSPEEPERS.' Ever thought of going into search technology?

  15. Comment removed by account_deleted · · Score: 4, Insightful

    Comment removed based on user account deletion

  16. Baleeted! by RyoShin · · Score: 2, Funny

    Let's hope that the U.S. Government never goes after Strongbad, or he could be in trouble.

  17. POP can delete client-side by everphilski · · Score: 2, Informative

    ... but still retain every email server-side.

    Remember, Google unabashadly says it wants to index the world's knowlege. Your emails, personal or not is part of that knowlege...

  18. Just a word of warning by tod_miller · · Score: 2, Insightful

    I gaurantee 100% of other email systems keep you 'deleted' emails in backups.,

    100%, why?

    Because it would time effort when you delete an email togo back and remove it from backups.

    Just because google is the only one who drew light to this matter, doesn't mean that they are:

    The first
    The only

    But the comments on here give me the impression that you guys think otherwise.

    Does your own backup handle emails intelligently? Does it know not to backup deleted emails? (I am not saying it is impossible for mail server backups may do on account of space, who knows). But that is deleted emails.

    What about will have soon to have been deleted emails? (red dwarf on temporal paradox)

    You can go back and fetch that magnetic tape all over again, so wipe that smug 'my backup doesn't touch the trach folder' smile of your face you overweight fucking IT tech.

    --
    #hostfile 0.0.0.0 primidi.com 0.0.0.0 www.primidi.com 0.0.0.0 radio.weblogs.com
  19. how appropriate! by corbettw · · Score: 4, Interesting

    Considering my first meeting today was regarding how best to redesign the mail system to make it easier to comply withsubpoenas in the future. Step one of that redesign: turn off the backups!

    Just more proof that the 'e' in email doesn't stand for 'electronic', it's 'evidence'.

    --
    God invented whiskey so the Irish would not rule the world.
    1. Re:how appropriate! by panda · · Score: 2, Insightful

      And then I would be the first person to LEAVE your ISP if you did not do backup s of ANY system.

      Why? If you hire an ISP to provide you with Internet Service, then what do you care if they backup their servers or not? If all you want from them is an Internet connection, then it doesn't matter, so long as they meet their contract with you.

      If you're using their SMTP and POP3 servers, and you're relying on email to conduct your extremely important business communications, I suggest you read the RFCs and find out exactly how email works. There's no guarantee that any given message is every going to reach its intended destination. Email is only slightly more reliable than the US Postal Service.

      I don't backup any of the mail servers that I'm responsible for administrating because it's a pointless waste of time. Email is ephemeral, and I remind everyone that they should not bet the farm on email.

      --
      Just be sure to wear the gold uniform when you beam down -- you know what happens when you wear the red one.
  20. Procedural Note by EconomyGuy · · Score: 4, Insightful

    It's worth noting that this fight isn't over yet. The defendant has lost his motion to squash the subpoena based on a privileged communications argument. That's really not surprising... the argument is tantamount to saying "I receive letters from my lawyer in the mail, so you can't have any of my mail." It's just not gonna fly in our civil justice system which has very liberal rules of discovery.

    However, based on the article Google has not yet had the opportunity to respond to the subpoena. The third party can always move to squash, and that's where things will get interesting. Will Google be able to convince the court that certain messages are deleted and thus not retrievable. Or, perhaps, that the defendant believed he was deleting the messages and thus deserves to have the messages kept under lock?

    These are questions only Google, as the third party, can raise. Now that the judge has issued the subpoena, Google is in a position to actually make those motions. And, if my legal education is worth anything, my money says Google/defendant will appeal if they lose because it's such a new area of the law that an Appeals Court really ought to announce a legal precedence.

    --
    Only 120 characters... who can summarize their entire world understanding in 120 characters?!
  21. Easier way to deal with this in 2 easy steps by digitaldc · · Score: 5, Insightful

    1. Buy stamps, envelopes & paper
    2. Use the Postal Service

    --
    He who knows best knows how little he knows. - Thomas Jefferson
  22. Yippee; How is it unusual? by PhYrE2k2 · · Score: 3, Insightful

    Yippee? SO they're asking for older backups from Google (as much as they have) in order too look at e-mail that may have been deleted in some sort of scramble before the order was in place. So what? Guess what? They order a history of transactions from your bank; They order a history of credit card purchases; They order a list of telephone calls from your telephone carrier; They order a list history from your ISP or employer.

    So what? They're asking for a bit of a backlog. This is no surprise

    --

    when you see the word 'Linux', drink!
  23. The moral by TheCarlMau · · Score: 3, Funny

    The moral of this story is to never write down anything you don't want copied or seen by other eyes. I mean, look at the ancient Egyptians. We are reading their words today and they are hidden in booby-trapped tombs!

  24. Re:Why save deleted message? by dmatos · · Score: 2, Informative

    As others have pointed out above and below, what happens when Google runs a standard backup program _before_ you've deleted your email? It ends up on a tape, and that tape ends up in a fire-proof vault somewhere. Pushing the "delete" button does not cause that email on that tape in that vault to suddenly self-destruct.

    Sure, it could take a lot of time, but under a subpoena, Google may be forced to go through all of their archive tapes and grab every piece of data from every time period they have recorded.

    --

    It may look like I'm doing nothing, but I'm actively waiting for my problems to go away.
    --Scott Adams
  25. This is not a big deal. by Lord+Bitman · · Score: 2, Insightful

    Giving someone access to *cough*"deleted" mail is no worse than giving them access to mail in the first place.
    If you want to argue about something, say that they have no right to go digging through someone's mail looking for maybes.

    --
    -- 'The' Lord and Master Bitman On High, Master Of All
  26. No suprise by Todd+Knarr · · Score: 2, Insightful

    This isn't a suprise. What Google's policy says is simple and obvious: "We make backups of our systems. That includes data files like your mailbox. We archive the backups on a rotating schedule that you don't know, so don't go assuming you know when any particular day's backup will be wiped. And we don't go back and alter those backups when you modify your data, so don't assume that deleting something today makes it disappear from all backups back to the beginning of time (or the inception of our service).". This subpoena is no different from a standard subpoena to a company asking for all documents including archived copies. If you wrote a memo, it got archived and then later you decided to shred your copies of the memo, the archived copies still have to be turned over in response to the subpoena. And note that GMail's not special in this regard. If you recieve your e-mail through your ISP and use their POP3/IMAP server to get it, it's probably backed up the same way and subject to the same risk of being subpoena'd

    First rule: if you want control over your data and when it's destroyed, you must never allow it onto systems which you don't control.

  27. Re:There may be business value by Ph33r+th3+g(O)at · · Score: 2, Interesting

    And the very things one deletes can be quite telling, as well.

    --
    I too have felt the cold finger of injustice.
  28. You think email is bad? by ShyGuy91284 · · Score: 2, Interesting

    I was rather concerned with how the speaker on the BBC special about Google stepped around the question about retained search history from users by identifyable means (They didn't say what it was, and I'm not very familiar with web technology, so might be IP or MAC (maybe not), Idk). Emails are one thing, but I think most have googled something they are ashamed of or wouldn't want others knowing about. Yes, they know you searched for "ultra-midgest-fetsh" last night, and may use it in the future against you.

    --
    In undeveloped countries, the consumer controls the market. In capitalist America, the market controls you.
  29. Finally, a use for spam! by backwardMechanic · · Score: 3, Funny

    There's now more spam than legitamate email in the world, right? And we're all using spam filters, yes? Why not forward all your spam to a gmail account. If enough of us do it, google will see such a drop in SNR that there won't be any point storing all those old emails. What's that you say? Still not enough data to fill the mighty google? Set your random number generator to stun...

  30. the problem is Google's data retention policy by Anonymous Coward · · Score: 2, Informative

    Every intelligent organization saw the writing on the way years ago, and went to a 1-week backup recycling policy. That is, backups are only kept for a week, after which the media is reused for a newer backup. All staff is fully aware that if they need something from backup that they inadvertantly deleted, they have less than a week to put through the restore request.

    That will, of course, prevent future historians of your organization from using those old backup archives to help develop an organizational history. It will also prevent your organization from data-mining those archives (which is why Google kept them; so much for "don't be evil").

    But, and this is important, it also stops these subpoenas. You can't turn over data that you don't have.

    The thing is that you have to have this policy in place before you run into any legal issues. You can't decide that you're not going to keep backups after you've been sued or otherwise have reason to believe that you'll be subpoenaed.

    You have to put this policy in place, and then you have to adhere to it strictly. You can't decide to keep some backups and not others; because then if you get accused of criminal activity then any destroyed data will be seen as being discretionary and part of a cover-up. Put another way, you can only destroy data as part of routine mandatory policy, and not because you don't like that data.

    And, of course, if you do get sued/subpoenaed, then you have to retain the data related to the matter from that point.

  31. Retention of data - just curious by sceptre1067 · · Score: 3, Interesting

    Does anybody use voice mail provided to them from their cell phone or landline phone provider?

    Where is that data stored?

    Has any telco been ordered by a court to turn over that voice data?

    Just curious...

    1. Re:Retention of data - just curious by MrNougat · · Score: 3, Interesting

      At a former employer, we moved from a PBX phone system to a VoIP (internal) phone system. In the VoIP system, voicemails were saved as .WAV files to a voice server, and also emailed to the recipient.

      The company I worked for had come under subpoena in the past, and a lot of effort was expended to retrieve the data the subpoena requested. With the PBX, once a voicemail is deleted, it was gone. Not so with the VoIP system - voicemails would be found on the phone server, on mail servers, on workstation email client cache, and anywhere that end users decided to save the WAV files - and any backup tapes for the above. If another subpoena occurred, we may have been responsible to discover, transcribe and deliver information about voicemails going back to the beginning of the VoIP system.

      That would be horrendously expensive. In order to circumvent this, investment was made in a third party system that would strip voicemail files out of everything. They wouldn't be backed up to tape they would be deleted from any system after some time period (30 days?). That way, we could state such in our data retention policy, and any subpoena including voicemails would only go back 30 days, and not forever.

      If you don't have the data, and are destroying it in accordance with a data retention policy, it can't be subpoenaed.

      I know this is all somewhat tangential to your question, but I figured you might find it interesting.

      --
      Web 2.0 == Giant Blogspam Circle Jerk
  32. What privacy? by frinkacheese · · Score: 5, Interesting


    Look folks.. Privacy simply does not exist. You'll get your search terms read, email copied, if you encrypt you have to give over the keys and if you don't then you get put into prison anyway.

    Your phone will be tapped, mobile will be tracked, cars followed with "traffic enforcement cameras". Your DNA will be on file, biometrics saved and your Underground trips logged.

    Everywhere you go there are CCTV cameras, face recognition. Your purchases are tracked with credit cards, store loyalty cards and RFID tags. Your bank transactions are flagged if they look interesting and the tax people peer into your account looking for money that suddenly appears.

    1984 got here, oh, 22 years ago now...

  33. Re:That's life in America by gilroy · · Score: 3, Insightful
    And this shows why the most dangerous threat to liberty is not the black hats or the covert agents, it's the citizenry:

    I think invasions of privacy like this are terrible, but I won't scold the US because I understand that they are doing it to protect me and everyone else in my country. I know that it opens up abuse, but *maybe* reading someone's email will save another person's life (or a lot of people).

    Sure, maybe this time they're trying to protect you (though it seems it's actually more of a tax dispute). The possibility of abuse is huge and scary.

    It might be that reading deleted emails, or wiretapping American citizens, or planting infiltrators in protest groups, will save some lives. You know what? Too bad. We hear all the time how "freedom has costs" and we honor "the greatest generation" and the current military for being willing to risk their lives for freedom. Here's the kicker: If you live in a free society, you must tolerate risks in the name of freedom too.

    There's a chance unbridled surveillance will prevent a terrorist attack. There's a much higher chance that unbridled surveillance will destroy the Republic as we know it. I am for preserving the liberties that make the nation worth living in.
  34. Uh, no. by _KiTA_ · · Score: 2, Informative

    Working for an ISP, I have to point out that we have better things to spend money on than a tech sitting at our email server making backups all day every day. Our mail server currently handles around 10,000 customers and if we were going to back it up, even once, we'd need to corner the market on backup tape casettes. And that's not even pointing out that it'd be near impossible to restore.

    I like (HOPE) that we're a normal ISP in this reguard.

  35. Re:That's life in America by x1101 · · Score: 4, Insightful

    next we will all be saying that it is alright that the gov't has our phone lines all tapped, just on the off chance a terrorist might call us and ask for help. why don't we all just back up all of our data online, let them read it all, and find the horrible people then.

    now for me, If you live in a free society, you must tolerate risks in the name of freedom too. this sounds more reasonable. forget the injustices we "must" suffer to remain safe, and start taking a few more risks to ensure that we remain free. otherwise our government becomes no better than the old soviet government or the governmtner that orwell created in 1984 with big brother watching over us.

    --
    "{09f911029d74e35b/==\d84156c5635688c0}"
  36. Back-Ups Get My Back Up by JusticeISaid · · Score: 2

    Most organizations should routinely purge back-ups of mailbox (i.e., IMAP, POP) servers precisely to avoid this type of situation.

    It's no good to wait until a subpoena is served. At that point, you simply have to wait and allow the legal process to play itself out -- all the way out. Even if you prevail at the trial level, you have to squirrel away your back-ups for years because if you destroy them before the requesting party has exhausted all its opportunities for appeal, the organization and possibly its officers are liable to be held in contempt of court. (This discussion is confined to U.S. law; I don't know about other jurisdictions.)

    Even if you don't care about confidentiality, this makes economic sense. Wholly aside from the privacy issue, responding to subpoenas for email back-ups can involve enormous expense in staff and machine time, and while some judges will consider claims by the responding party that the cost of retrieval exceeds the probative value of the backed-up messages in the "offer of proof" by the requesting party (describing what the messages are expected to contain), more often than not that argument doesn't work.

    You can waste a lot of money to collect individual messages from back-up media, only to discover they have no effect on the outcome of the legal proceeding. I've seen it happen.

    Since mass storage is inexpensive these days, and since the majority of messages have a short shelf-life, the sensible thing to do is to give mail users the ability to store as many messages as they want permenently in server-based mail folders, which means they will be picked up by even a very recent back-up, encourage them to get rid of any messages they don't need (perhaps by purging old messages from their INBOX folder automagically), and eradicate your back-up media on a regular basis -- keeping only what you need to restore the message store on your server(s) in the event of a catastrophic failure.

    (By the way, this militates in favor of organizations other, perhaps, than ISPs using IMAP rather that POP. You really don't want to have to go around trying to retrieve messages stored on thousands of desktops and laptops in response to a subpoena.)

    Needless to say, deleted messages should either not be backed up at all, or should should only be stored on daily incrementals for at most a few days.

  37. Re:You're Not Wrong, BUT... by KarateExplosions · · Score: 3, Insightful

    Google warns that "delete forever" does not mean that the message is necessarily gone. Their offline backup servers may contain copies of your messages in perpetuity. Can you think of why this might be?

    Because I can. Like any responsible data company, they don't want you to lose important data... so they back it up.



    Google isn't being exactly 100% altruistic. They are a corporation, so if you want to determine their motivation for any particular thing, look at what motivates all corporations: money.

    They keep a massive amount of data, and not particularly because they are concerned about your data recovery needs, but because the massive amount of data that they can collect and associate with you allows them to better design targeted marketing (ads) directly to you.

    Based on the emails that you send and the emails that you receive, they can determine if you are more likely to be interested in this service or that product. They can shoot advertisements at you like a sniper rifle, as opposed to birdshot.

    Keeping all that data indefinitely allows them to constantly index and profile you for advertising purposes. It allows them to make money.

    On the flip side of that, people are more likely to trust Google with that profitable data if Google fights tooth and nail to ensure the privacy of users, so barring severe punishment from the government, it makes sense for Google to safeguard users' data from the prying eyes of Big Brother.

  38. Re:That's life in America by Elrac · · Score: 2, Insightful

    No, that's the death of America!


    It's beyond me how not anyone could have flagged your post as "insightful". I object most strongly to the entire sentiment of your post.


    To put things into perspective: I'm not at all worried about this particular case. I know that whatever I send over the Internet can and probably will be snooped by Echelon, and even without that, the Internet is simply not a safe medium for confidential data. Nor am I suprised that not all data is necessarily instantly destroyed. Nor that Google is involved. The bigger the target, the more likely the attack.


    What concerns me is your sheep-like blind faith in your corrupt and evil government, combined with your attitude of "if I give up some of my freedoms, this will enable my government to protect me better." You and countless ill-informed dimwits like yourself are the supportive base of a massive, concerted, very deliberate attack on the American Way, the American Constitution and the ideals on which the country was founded. Many good men died for your right not to be micro-managed by an intrusive and abusive government, and your mindless surrender of this right invalidates their lifetime heartblood.


    I'll try to calm down briefly to explain better why I am ranting at you. Here are some things that need to be considered:


    First off, the actual threat to your life and safety from terrorism is negligible. Acts of terrorism usually kill a few dozen to maybe a few hundred people. 9/11 was an outstanding exception that will hopefully be the high water mark for one or more decades. Yes, it sucks to be one of the 3500 people killed in NY, but please consider that:

    • Many, many more people are killed every year in the US by gun-wielding Americans;
    • Many, many more are killed by reckless and/or drunk drivers;
    • Far more die early because they willingly neglect their health, either smoking or drinking or eating excessively;
    ...and we rarely experience national outrage at these things. The thing about terrorism is not the actual danger from it, it's just your warped perception.

    On the other hand, there is strong evidence that US lawmakers do not have your interests at heart:

    • the sudden loss of interest in the case against Microsoft when Bush took office;
    • the new flurry of draconian laws against media file copiers at the behest of the *AA;
    • the inappropriate extension of copyright terms;
    • the recent ruling for industry and against residents in the "resident domain" thing;
    • Bush's attempted sell-out of control of US ports to the UAE.

    IMHO, these happenings all share a common aspect: There is money involved, lots of it, and it is likely that lawmakers are letting their decisions be swayed by the prospect of part of it finding its way into their pockets.

    Your corrupt government is relentlessly extending its own powers to act against its citizens as it pleases, and using terrorism as an excuse. Much of the newly-acquired power is being used to support wealthy industries, not honest citizens. THIS is the real danger, and you are in support of it. I cannot begin to express how strongly I loathe your stupidity.

    --
    When one person suffers from a delusion, it is called insanity. When many people suffer from a delusion it is called Rel
  39. Different Universe by Joe+U · · Score: 2

    Turining your point around, since when does email exist in a different universe than any other kind of mail?

    If I shred my personal mail by running it through a shredder, it's gone. Why is it that if I "delete forever" my email, it's not gone?

    Personally, I think it was a mistake on the part of the computer designers to allow things to be undeleted. The courts are just taking advantage of this flaw to uncover evidence they normally wouldn't have access to.

  40. Re:Am I the only one who doesn't care? by Rick.C · · Score: 3, Insightful
    I never understood what the big deal is with privacy.

    Two hundred and some years ago some guys got all fed up with how they were being treated and so they wrote to the king, "When in the course of human events, it becomes necessary for one people to throw off the political bonds that have connected them with another..." Well, it turns out that the king wasn't all that gracious about the whole thing and there was a lot of killing and other "lashing out" kinds of behaviors.

    Our boys finally prevailed and they realized that any government (even their new government) can fall into this same oppressive mindset, so they put some things in their new constitution that might either prevent oppression altogether, or at least provide a means for citizens to throw off oppression if it occurs.

    One of those things is privacy. Our boys knew that if King George had been able to station a soldier in every private home, their little revolution would never have gotten off the ground.

    We hear a lot of the phrase, "Who cares, I've got nothing to hide." Let's put the shoe on the other foot and ask, "If the government is doing such a good job of protecting us and not oppressing anyone, why should they fear their citizens having a lot of privacy?" In other words, the government's desire to "station a soldier" in eveyone's computer might indicate that they feel they should have something to fear.

    They would know best, after all.

    --
    You were 80% angel, 10% demon. The rest was hard to explain. - Over The Rhine
    "Math in a song is good."-Linford
  41. Re:Am I the only one who doesn't care? by debest · · Score: 3, Insightful

    I never understood what the big deal is with privacy.

    The big deal is that no one in this world is free from having committed actions that many others would find objectionable. There are any number of everyday activities that you do everyday that would fall into this catagory. Eat a burger lately, PETA would like to know who you are. You have a DNA gene that predisposes you to a certain disease, your health insurance company sure would like to know that. You look at hardcore (but legal) porn, the police might like to keep tabs on you. You show interest in the plight of people who might be "associated with terrorism", all sorts of agencies would love to gather what they can about you.

    These are just a few off the top of my head. Heck, here's a few more: a potential landlord would surely like a look at your bank balance. Your boyfriend/girlfriend might be interested in your visits to medical clinics. Your boss might like to know how much spare time you have on weekends. Your racist neighbour might like to know about your ethnic friends. Your parents might like to track where you go on your own time. And on and on and on...

    All of your actions could be legal and ethical, but that doesn't stop people who frown upon (or could benefit from) your legitimate actions from using this information against you in some way. Do you really want people you don't like you, and that you don't like, knowing everything about you?

    Privacy is something that may not be required in the distant future, when humanity evolves to the point where we no longer judge one another, and there exists no reason for fear of recrimmonations for holding beliefs and taking actions that are different than anyone else's. Human nature may never allow us to ever reach this level of trust and comfort with our fellow man. So until that happens, I will value privacy until it is no longer required.

    --
    Look at the tomato! Isn't it sad? He can't dance! Poor tomato!
  42. Re:Encrypted emails any better than partial delete by winkydink · · Score: 2, Insightful

    Can you say "Contempt of Court"?

    A judge can pretty much order you to do anything. Whether that gets held up on appeal or is subject to reversal happens after the fact.

    If you refuse the judge, bring your toothbrush.

    --

    "I'd rather be a lightning rod than a seismometer." -Ken Kesey

  43. Comment removed by account_deleted · · Score: 2, Interesting

    Comment removed based on user account deletion

  44. Re:Can't help but wonder... by Anonymous Coward · · Score: 2, Insightful

    Your post illustrates the problem better than anyting else could.

  45. Re:You're Not Wrong, BUT... by Hollins · · Score: 3, Interesting
    Like any responsible data company, they don't want you to lose important data... so they back it up. Independently. Into offline storage. And when you click the "delete forever" button, your message is not magically removed from media that is not connected to the system.

    I'm not buying it. Here's a way to test your theory. Delete an email message with a large pdf attachment. Wait a few days and contact Google. Tell them you had a hard drive failure and a message you deleted contained the only copy of your Ph.D. thesis. Beg, plead, cajole. Offer them anything.

    I'll bet you a beer you won't get the message back. Google's long-term data retention policies have nothing to do with altruistic measures to protect users from data loss.

  46. a thought on secure mail by DaveJay · · Score: 2, Interesting

    Okay, so let's say we did want to send emails to a small group of people without it coming back to haunt us. This is a lot of work, but then, if you want to do something illegal, you'll probably consider it reasonable.

    First: set up a computer on a residential connection that sends all logs to /dev/null (after you finish setting it up, of course -- heh) and only offers one outward-facing service: ssh.

    Second: set up local accounts for all the people you want to communicate with, and limit them reading their mail locally via ssh only.

    Third: Show each user how to read the email by sshing into the machine and reading the text mails with vi, or with mutt, or some other command-line emailer.

    Fourth: Create an iso that can be used to set the box back up from scratch to the current config, and that performs the install without user intervention, and employs a disk-wiping mechanism during the install.

    Fifth: Set the computer to boot from CD first, and a cron job to reboot the machine every night at 2am.

    Now you can happily send email to each other all day long. Every evening, the box reboots, wipes itself, and reloads everything, so mail isn't stored locally for more than 22 hours or so, limiting the amount of incriminating evidence on the machine. Even if the machine's traffic is captured and stored, the encryption is via ssh, so you can't provide your private key for decryption -- there isn't one.

    Your only real concerns now are ssh exploits, weak passwords, and your cohorts cut and pasting content from the ssh session onto their local computer. But then, if they'd do that, there are probably lots of other ways they're screwing up the heist. ;)

    Also, having never actually done anything like this, it's pure speculation. Someone tell me why it won't work. :)

  47. Re:Hate to say 'You're dead WRONG', but... by budgenator · · Score: 2, Insightful

    I suspect that most ISP's have an official policy of not backingup purely for that reason.

    --
    Apocalypse Cancelled, Sorry, No Ticket Refunds
  48. Companies must understand this will happen... by YesIAmAScript · · Score: 2, Insightful

    And they simply must take steps to ensure they cannot fulfill the request. And I don't mean Andersen shredding documents.

    I mean this: if it can be done, the court may compel to you do it. So Google says "we'll keep it, but we won't do anything with it". Even if you believe them, the court may make them do something with it. So they simply can't keep it.

    Same with DRM. Sony says "Yeah, a Blu-Ray disc can be made that will deactivate your player's ability to play discs, but we'd never do that." Well, they may not, but a company whose IP was breached may compel Sony to do it. Sony's only real way to avoid this is to not make it possible in the player.

    Companies need to take the long view. They want to keep all their options open, but they're just going to end up making a product where the law can compel them to bone customers, and the customers will feel burned eventually.

    Stop holding so much control, it's the only way forward.

    --
    http://lkml.org/lkml/2005/8/20/95
  49. Not possible to decrypt by SiMac · · Score: 2, Insightful

    If the NSA could decrypt GPG-encrypted messages, it would have to have one of the following three things:

    1. A miraculous mathematical advance that made the factoring of the product of two extremely large prime numbers much easier. (Unlikely.)
    2. A quantum computer. (More unlikely.)
    3. More conventional computer power than the rest of the world combined. (Extremely unlikely.)

    All three are completely unrealistic. It is doubtful that the NSA can crack PGP, unless it's through a weakness in one of the symmetric ciphers and not the RSA/DH algorithim.

    1. Re:Not possible to decrypt by cperciva · · Score: 2, Interesting

      3. More conventional computer power than the rest of the world combined. (Extremely unlikely.)

      I'll agree that the NSA certainly doesn't have more general purpose computing power than the rest of the world combined, but I suspect that they may have more special purpose computing power. The NSA uses a lot of custom hardware and has access to significant microprocessor fabrication capacity, and when you're looking at integer factorization, it's not unreasonable to expect a hundred-fold increase in performance when going from general purpose hardware to custom circuitry.

      I would personally be very surprised if the NSA were unable to factor several 1024-bit composites per day.

  50. You have nothing to fear, Comrade! by The+Master+Control+P · · Score: 4, Insightful

    I'm going to install cameras throughout your house. I don't see how this will harm you unless you're growing weed or bringing home prostitutes.

    I'm going to install a satellite phone/monitor/GPS on your car that will phone the police if you exceed the current speed limit. I don't see how this will harm you unless you're breaking the speed limit.

    I'm going to install a keystroke logger on your computer that will record everything you type. I don't see how this will harm you unless you use your computer to transfer money for gangsters.

    I'm going to log every packet your computer sends that leaves the USA (Oh, wait, the NSA beat me to it...). I don't see how this will harm you unless you're secretly communicating with al Qaeda.

    I'm going to steam every piece of mail that arrives in your mailbox open and photocopy it before it gets to you. I don't see how this will harm you unless you were the bastard who was sending the Anthrax letters.

    I'm going to put a rootkit on that CD you bought that will contact me if you try to copy it and then break your computer. I don't see how this will harm you unless you like to rip and share music illegally.

    Have I made my point?

  51. One of few e-mail companies that told the truth by Mark+Programmer · · Score: 2, Insightful

    ... and they got hammered in California for it.

    I remember when members of the California government put pressure on Google to add a "delete" option. I remember when people mentioned on this very forum that the button was a red herring---that archives would generally be kept in any case, and that in fact Google was one of the few e-mail providers to be completely honest about that aspect of modern e-mail. But they added the button anyway, and now someone fell for the ruse.

    When will people---not just Californians, but people in general---when will people learn that you can't legislate away the behavior of an already-established system?

    --

    Take care,
    Mark

    There is a solution...

  52. Re:If you're not doing anything illegal by ebrandsberg · · Score: 4, Insightful

    http://www.quotedb.com/quotes/2283

    See if you can understand the implications?

    Question one: Does someone that refuses to implicate himself in a government witchhunt prove he is guilty?

    Does someone that denies he is involved in the communist party mean he is guilty?

    The point is that any american that is worth his salt SHOULD deny telling the government anything for fear that failure to state his position on something will be construed as anything other than defending his constutuional rights. Check www.papersplease.org for more information.

    Erik