Slashdot Mirror
Court Upholds Warrantless Internet Snooping
amigoro writes to let us know about an appeals court ruling on Friday that holds that federal agents can snoop on an individual's web surfing, email and all other forms of Internet communication habits without a warrant. The court found recording this kind of information to be analogous to the use of a pen register. In 1979 the Supreme Court ruled that this technique did not constitute a search for Fourth Amendment purposes.
with the anti-wiretapping laws passed several decades ago? Please fill me in, do those have any effect or did they just sweep past them and make them irrelevent?
Well, back to rejecting software patent applications.
With a "pen register" all they get is the phone number you called.
That would be analogous to the IP address that you connected to (and maybe the port).
The question is how are they capturing the IP addresses? If they're capturing the packets, that's the same as a wiretap.
Encryption. Learn it. Love it. Live it.
From TFA: "The search is no more intrusive than officers' examination of a list of phone numbers or the outside of a mailed package, neither of which requires a warrant, Judge Raymond Fisher said in the 3-0 ruling."
;)
I don't see what all the hoopla is all about. They're not opening the emails or reading any content. At least, they should not be.
Take your foil hats off...
Cheers.
Mark
The article says that they're allowed to monitor the addresses of the websites and email you use, but not neccesarily the content of the page itself. For example if you went to a website you had to log in to, they wouldn't be able to find out what was on those pages without a warrant.
Still sucks, since getting the address of a webpage is pretty much equivalent to getting the page itself 99% of the time.
+++OUT OF CHEESE ERROR+++ REDO FROM START +++
They are allowed to look at the sender information on your e-mails and domain of websites you are looking at. The contents of the e-mails and which pages of a website, ie the URL, are still off limits.
If brevity is the soul of wit, then how does one explain Twitter?
...the court said, although the government learns what computer sites someone visited, "it does not find out the contents of the messages or the particular pages on the Web sites the person viewed."The search is no more intrusive than officers' examination of a list of phone numbers or the outside of a mailed package, neither of which requires a warrant, Judge Raymond Fisher said in the 3-0 ruling. I think that his honor missed something here. He seems to be saying that knowing the address of a web page is like knowing the address on an envelope, and in either case the contents is not being snooped upon. In the case of the letter he would be right, for a letter can contain anything ( I could mail a recipe for braised goat's eyes to Bin Laden ).
But a web address often has a 1-to-1 corespondence with its contents. Knowing the address is one simple - and undetectable - step from knowing the contents. They are doing an unconstitutional search here.
So they won't mind if I start encrypting everything then.
Circuit Courts of Appeals only have jurisdiction over cases arising in their proper Circuit. This decision is not applicable anywhere but the Ninth Circuit.
m b/d/df/US_Court_of_Appeals_and_District_Court_map. svg/620px-US_Court_of_Appeals_and_District_Court_m ap.svg.png
http://upload.wikimedia.org/wikipedia/commons/thu
Editors, please.
What the ruling held was that the header information of your email (and web browsing I believe) is subject to exactly the same standards as the information about what phone numbers you dial. Mostly this seems like an appropriate and totally correct extension of offline legal standards to the online world. The only reason that it is more problematic is that an email header includes things like the subject which contains a little bit of the content.
Still all things considered this seems like the correct rule. Subject lines don't contain that much information and if you are concerned you can just use an unrevealing subject. Moreover, we already contemplate the possibility that someone who happens to glance at the recipients screen might notice the title so it really doesn't seem like we have the same expectation of privacy for the title of the message as we do for the body.
Anyway for a better more interesting discussion about this case you can check out Orin Kerr's comments over at the Volokh Conspiracy.
If you liked this thought maybe you would find my blog nice too:
Is Mike Rowe in that one? Because I'm not watching if he isn't.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
People died for the Freedom that too many of us seem willing to trade away.
If the worst thing that happens to you is some jail time because you refused to reveal your keys, consider yourself ahead of the game.
Fascism begins when the efficiency of the Government becomes more important than the Rights of the People.
This mess developed over time.
All this stems from a distinction in wiretap law that goes back to the dial telephone era. Listening to voice requires a warrant, because that info belongs to the parties of the call only. But information used by the telephone company itself to route the call, like dial digits, can be requested from the telephone company. A "pen register" was classically a little electromechanical gadget that recorded dial pulses as dashes on a paper tape. There was no way to extract voice info with a pen register.
Then came Touch-Tone. Now the switching data was in the voice channel. After some court decisions, it was established that listening to the voice channel and extracting tones was OK, if done with "minimal" access to the voice channel.
Over time, this led to the "pen register" exception being extended to content the telco didn't process, including tones sent during a call to third-party services like voice mail, packet headers, E-mail headers, cellular location data, etc. Then came a "lower standard for stored messages", which included SMS messages and E-mail. Then came bulk interception via CALEA. Then the Patriot Act.
In Canada, the police need a warrant (CanLII link) to get a dialled-number recorder placed on someone's phone (though apparently such a warrant is easier to get than a wire-tapping warrant), so extending this to the Internet wouldn't really be all that scary.
I think Quebec's general unwillingness to trust the federal government probably helps a lot here.
http://outcampaign.org/
Time to start using:r k)
http://en.wikipedia.org/wiki/Tor_(anonymity_netwo
and
http://en.wikipedia.org/wiki/GNU_Privacy_Guard
The alternative would be to vote the idiots out of office, but it doesn't seem as if that will happen any time soon.
Exactly.
Now, there are possible ways to get the IP addresses that you connect to WITHOUT getting any more information than that (and such information is just about useless).
But I don't trust the government to put any effort into protecting MY Freedoms and privacy when it is so much easier for them to abuse such.
There is a huge difference between knowing that I connected to 66.35.250.150 on port 80
and
Knowing that I connected to http://yro.slashdot.org/comments.pl?sid=247095&ci
--
Appeals Court Rules No Privacy Interest in IP Addresses, Email To/From Fields
The Ninth Circuit Court of Appeals ruled Friday in United States vs. Forester that IP addresses and the To/From fields in emails are the legal equivalent of dialed phone numbers and the government can get a court order to obtain them without showing probable cause as would be needed in a search one's house.
The Court extended to the internet a 1979 case known as Smith vs. Maryland, where the Supreme Court found that individuals have no reasonable expectation of privacy in the phone numbers they dial because they transmitted them to the phone company in order to complete the call. However, under Smith, the contents of the calls could not be listened in on without proving probable cause to a judge.
The Ninth Circuit, ruling in an appeal of an Ecstasy-drug ring conviction found that emails' To/From fields and visited IP addresses were the internet's equivalent of phone numbers. For example, the government could get a log that said a person visited to http://66.230.200.100/ (Wikipedia's address). However, the court suggested that knowing full urls are very close to content (e.g. http://en.wikipedia.org/wiki/Ecstasy) and would likely require a higher burden of proof to obtain than mere IP addresses.
From a footnote in the decision:
Surveillance techniques that enable the government to determine not only the IP addresses that a person accesses but also the uniform resource locators (URL) of the pages visited might be more constitutionally problematic. A URL, unlike an IP address, identifies the particular document within a website that a person views and thus reveals much more information about the persons Internet activity. For instance, a surveillance technique that captures IP addresses would show only that a person visited the New York Times' website at http://www.nytimes.com/ whereas a technique that captures URLs would also divulge the particular articles the person viewed.Professor Orin Kerr questions whether the decision is about getting this information from an ISP or whether it was from a device installed on a computer surreptitiously. He suggests the latter should require a higher standard, but I'm not sure why? Perhaps it's because that might require law enforcement to enter a person's house?
-----[0_o]-----
We are not amused.
I'm wondering if the argument could be made that the internet is a public space and therefore the wiretap laws don't apply?
;)"
"I don't see what all the hoopla is all about. They're not opening the emails or reading any content. At least, they should not be.
The legality of proxies?
On Slashdot, that is known as the null set.
I send email signed with GPG. Mess with the headers, sure, but the BODY can't be tampered with. Read, yes, tamper, no.
If something must remain confidental (source code, thoughts, company plans), it is put onto a server, and a reference sent via email (with GPG signing). The recipient can CERTAINLY go to the web page, where she will be redirected to an SSL page.
As soon as the SSL connection is set up, I use Apache Basic Authentication. Give me a user name and password. And these are reasonably secure. At least, I can detect hacking attempts, and take down the server if needed.
Won't tell anyone anything, really... And, for good measure, the server isn't in the US (and if I *were* in the US, it would be located out of the US anyway).
And, yes, I am paranoid.
Just another "Cubible(sic) Joe" 2 17 3061
The constitution isn't divine. I call for a reform. When it originally was written it did not take a 2007 context. Had it been written in 2007 it would of forbidden this type of wiretapping.
There is such a concept in the Talmud (Hilkheta Ke-Vatra'ei) and this a legal system with a divine ordination. The only reason why Jews don't use it is because our legal system has been messed up by the Romans and the Muslims. The Romans outlawed the ordination (semicha) of rabbis (as a legal power not as a communal leader as we see today) murdering any who dared to be ordained or give ordinance. Followed by Muslims who tortured to death the last of our Geonim destroying our exiled legal system. Our legal system and religion has been a mess ever since. The last bit of legal system of the Talmud that is left is annulment of unattended oaths and mirage contracts which require not legal power in the Jewish legal system.
The laws were written with specific technologies in mind.
For example a wiretap is conceptually, if not legally, tied to telephony. In order to be a wiretap, a communication must have an aural component. Thus intercepting an email being sent over WiFi is not a wiretap, but a VoIP intercept is. Likewise intercepting an email with a voice mail attachment (such as might be generated by a voice mail/email gateway on a system like Asterix) might qualify as a wiretap.
There are provisions for controlling the reading of text messages, but the law is written for a system like the old Telex system, in which the messages are ephemeral,but stored in temporary buffers at various stages of delivery. Thus while intercepting an email in a transfer agent queue is questionable, once it is delivered to your email box at the ISP, it becomes fair game. It is no longer in transit, but stored on a server. In the days of Telex, you'd take your message of the teleprinter, read it, and shred it, knowing that it was gone forever, not recoverable from your mail box or from backup tapes.
The third part of the ECPA laws deals with something called a Pen Register: a device that is attached to an old fashioned phone line to capture the in-band signaling of the phone numbers being called. Even though the privacy concerns for email or web proxy logs are identical, these situations are not covered by the Pen Register Act.
The underlying problem is this: although attempts were made in the laws to make them independent of a specific technology, those efforts failed because US law (unlike EU law) does not recognize a fundamental right to private communication. There are packages of specific rights secured by the Bill of Rights, statutes and common law privacy concerns, but these rights are much less than a true right of private communication. The reason is that you can't have a meaningful right to private communication when that communication is mediated by a third party like an ISP or a telephone company, not unless you have a fundamental right to informational privacy.
Without a right to information privacy, anything that falls into the hands of a third party is fair game. This includes information ISPs or telephone companies store in order to route and deliver a message, up to and including the entire content of the message. ECPA, which consists of the Wiretap Act, the Stored Communications Privacy Act and Pen Register Act, closed these loopholes in its time, but as of today those loopholes are wide open again.
This process will repeat itself forever, no matter how many times we close the loophole, until a fundamental right of informational privacy is recognized. We could do that be adopting into law the EU Data Directive. The reason we don't is that this would hurt US companies which are flourishing by exploiting the America's backwater status when it comes to privacy.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Especially where the URL in question links to an email message! Many webmail services use URLs to access individual emails. Snooping these addresses can actually OPEN email messages. How can this be allowed?
Keygrabbers, bots, password snooping...and that's just the guys from Microsoft! :>
If this stops building from exploding, it's fine with me. It's not like the net's been private for over ten years...
Want something private? Create an ssh tunnel.
--- For a good time mail uce@ftc.gov
Comment removed based on user account deletion
Here is a little snippet from the Fine ruling..... Surveillance techniques that enable the government to determine not only the IP addresses that a person accesses but also the uniform resource locators (URL) of the pages visited might be more constitutionally problematic. A URL, unlike an IP address, identifies the particular document within a website that a person views and thus reveals much more information about the persons Internet activity. For instance, a surveillance technique that captures IP addresses would show only that a person visited the New York Times' website at http://www.nytimes.com/ whereas a technique that captures URLs would also divulge the particular articles the person viewed. They seem to be saying it's more problematic if this surveillance technique is capable of yielding any useful information. Please explain why the government would even want to use any technique that's not useful ? Well, ok, some hypothetical other government, not the incompetent boobs we are stuck with. But you get my point. Another point to consider, the 9th circuit is the most frequently overturned court in the countryhttp://www.realclearpolitics.com/articles/2 006/11/supreme_court_cleans_up_after.html
If reviewed by the supreme court, it very well might not stand.
Great news comes in strange forms sometimes...
Now we can all begin converting our internal infrastructure to using very strong, protocol-based encryption, end-to-end. Bittorrent for http, secure, anonymous, private networks wrapped around our standard applications and more.
Begin now, if you're not using strong encryption.. you should be. Don't let the government WE put into place, tell you what YOU can do with your own Internet time.
If the government we put into place is not representing your best interests, its time to replace them with one that does.
Lock everything down and keep prying eyes out.
The way I look at it, if you could catch one more "bad guy" a day
Lots.
As opposed to Ben Franklin's:
They'd rather follow Otto Bismark's opinion:
The problem is that it is the Government that chooses what "crime" and what "evidence" will be used to charge a person.
And the Government is composed of people. Sometimes honourable. Many times petty and vindictive if not outright criminals. Which is why our country was founded upon the belief that you cannot trust the Government. That we had to limit the Government's authority and protect the Rights of the People.
It's all about how you view Rights and whether you are with Franklin or Bismark.
Fuck Bush et al.
Very truly yours,
Kilgore Trout
..Internet searches you!
Not exactly. While the decision isn't binding anywhere but in the Ninth, it is persuasive authority everywhere. And given that the 9th is the most liberal circuit in the nation, how could a judge elsewhere decide that the decision isn't liberal enough?
says the coward without the guts to even post on a real account
As if a "real account" gives my post less anonymity than the "anonymous coward" account. If you're that concerned, my real name is Jake Campbell... or is it? It doesn't matter.
Re: crypto...
GP: Until they illegalize it.
PP: Anyway - you've got no worries. If the USG tried that, you'd use all those wonderful 2nd-amendment protected firearms to overthrow it? :
Actually, you could make a Second Amendment argument to the court. Is strong crypto still on the ITAR list? If so, it's a "munition" and the Second Amendment guarantees your right to it.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
The question is how are they capturing the IP addresses? If they're capturing the packets, that's the same as a wiretap.
That's a valid point, supported by disturbing evidence. What I think they want you to think is that they can require ISPs to keep the information and demand it at any time. TIA was planned before 911 and is largely in place, despite overwhelming popular objections and Congressional disaproval.
There are objections to the other practices as well.
Friends don't help friends install M$ junk.
"This process will repeat itself forever, no matter how many times we close the loophole, until a fundamental right of informational privacy is recognized."
Copyright gives me certain right over things I create and place in a tangible form (including this post).
| And what happened with the anti-wiretapping laws passed several decades ago?
A court called household cordless phone calls "radio broadcasts" as I recall, so anyone can listen
in on them legally -- whether LE or a nosy neighbor kid.
Still true?
Hide all sigs: Click HELP+Prefs (top), VIEWING (last on right), DISABLE SIGS (3rd on left) and SAVE (hidden at bottom).
Likewise, the court said, although the government learns what computer sites someone visited, "it does not find out the contents of the messages or the particular pages on the Web sites the person viewed."
Unbelievable statement.
Anyway stop whining and do something about it.
http://www.mysecureisp.com/
Defeat the ZIONIST occupied GOVERMENT! HEIL HITLER!
USSA (United Soviet States of America) were democracy is waved like a flag but never actually used.
They get only the URLs and email addresses. They do not get the content. In fact, if they were to receive the content without a warrent, they would not be allowed to enter the items into evidence in court. Indeed, the judge would probably throw the whole case out.
Note that the excuse for non-suppression is disengenious, as the judge should have been the remedy.
Also note that if e-mail addresses were obtained, that means that more than just the IP headers were being looked at. Packet inspection had to be done in order to obtain the e-mail addresses from within the packet.
This ruling effectively is a precedent for the illegal NSA spying.
You are being MICROattacked, from various angles, in a SOFT manner.
I read the headline as "Court Upholds Warrantyless Internet Shopping," and thought "Big deal. That's like buying something off of Ebay."
I guess that a misread like that might hint that it's almost time for me to consider going to sleep. Next thing I know, I'll be misreading reports of Microsoft making partnerships with novels, people buying Praystations, people going mad for IPphones and Gnus for Nerds.
Or maybe my brain has just gone offline from reading too many articles on the SCO case. I'm gonna get my lawyer onto Dril McBirde! I'll Suse!
First this is about IP addresses NOT URL's. So this is NOT about the police finding out you visited slashdot.org but rather 66.35.250.150.
There is a HUGE difference.
For email it is the to/from field that is being found out, again a mile and a half removed from the actual contents of the email.
So the judge is right when he sees this as the same as finding out the telephone numbers or reading the addresses of envelopes.
Second is the expectation of privacy. The internet is a public network, surely a slashdotter should know that anything transmitted over the internet is public to all? Just because it is more efficient for network equipment to implement routing to limit your traffic to just the relevant bits of that public network does NOT mean you should not expect your information to end up in every corner of the world.
Simply put, networks work by your computer shouting I got info, who wants it? It is no more private then when you shout your drink order in a crowded bar. Sure, normal practice means that only the bartender on duty pays attention but ANYONE could listen to it and you are a fool to think otherwise. There is a reason for encryption after all.
Lastly there is the idea that privacy is an absolute right. No it ain't. Lots of things ain't private because absolute privacy and a civilization are mutually exclusive. Even the simplest things are impossible to enforce without invading privacy? "My drivers license officer? That is none of you business." "My credit rating? What concern is that of yours?" "Have I paid my bills? Do you mind, that is for me to know."
Privacy is NOT a get out of jail free card despite what some lawyers seem to think. This guy is NOT fighting for all our freedoms, he is trying to get out of his deserved punishment.
While many would think those are fundamental rights, many would not want the government ot be responsible for ensuring all have those rights, at least amongst many US citizens. These reasonable disagreements is why we have the Constitution, which is what we have to hang our hats on, and is why we have Article V to change it when we need to. And sure, someone will probably point out the 10th amendment, but that talks about people retaining power, not asserting rights, which I believe is a subtle but important distinction.
Anyway, with all the energy I see here that goes into asserting fundamental rights, (one of privacy in this case) I was glad to see an entry that alludes to the basic problem. I would contend though that an assumption that it can't be changed because of "corporate America" takes away so much of its potential. If the world really is different because of technology, and this InterWeb thingy, then go the grassroots route. It is done here on many issues. And I think that I sense a defeatist attitude because of past failures (for instance, in securing a fundamental fair-use right interpretation that would be favorable to end users). If you don't like how laws are being intepreted, then fight for new legislatoin to clarify in explicit detail what is needed. Grass-roots campaigns that are against major money interests have shown signs that they could be very effective in a relatively short period of time. Take the story of Porkbusters, for instance. While all of its goals have not been met yet, in a short order of time, they have raised awareness and gotten promises (but to little action yet unfortunatley) that their "demands" are met.
And I think people should aim higher though. I would love to see a grass-roots campaign emerge from a place like Slashdot, that would push for something like a right to "privacy" . For instance, something like "The right to privacy, being fundamental to a right of free though, shall not be abridged, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing . . . " (I would guess something about the time of the records in which one searched, but I just can't make it concise, like I think all rights should be stated) Maybe one could not get to the point of passing a Constitutional Amendment, but I could easily envision a movement centered around such a right to be embraced by a large group of people. From there, given that much of the audicence would be techno-philes, and this InterWeb thingy, you have the seeds of an inevitable Viral Marketing campaign which would almost inevitably result in some senators and congressment sponsoring at least to strenghten privacy in our laws.
http://daviddfriedman.blogspot.com/2005/12/differe nt-argument-for-right-to-bear.html
"Tempers are wearing thin. Let's just hope some robot doesn't kill everybody." --Bender
One other thing to remember: while governments do tend to be the biggest threat to freedom and happiness, they're not all you have to worry about. Even that UK law only says you have to give your keys to the government, not just anyone who asks. You don't have to give your keys to Google, for example, so that they can scan your emails to give you better ads. You don't have to give your encryption keys to your neighborhood network-sniffing burglar so that he knows that you RSVPed to a party and you won't be home at a certain time.
Even if encryption doesn't protect you from active attacks by the government, you should be using it anyway. "Learn it, love it, live it" indeed!
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
It doesn't matter if I say,
"Hey Bob-The-Anarchist, let's go be subversive!"
or
"Hey Bob-The-Anarchist, KJLJALIUHFFLKAJHSLSAUFRGGFGFGJEUCJDKUEUD"
Even if they can't decode the second one, anyone listening still knows I was talking to the "Enemy of the People," Bob.
So, seeing how what's at issue in this article is who you're talking to more than what you're saying, encryption is, unfortunately, not super relevant.
I think the only technical solution here is to use steganography and communicate through a very large (unwitting) third party -- like Slashdot: one might post reasonable-sounding forum posts containing hidden information. And even this solution is low-bandwidth, high-latency, and precariously-secure at best (were it high-bandwidth, it would come to dominate the traffic to and from that third party [Slashdot], and then the communication would become obvious). So basically, it's a pretty crappy compared with what we're used to.
I agree with your premise that we should routinely encrypt stuff; I'm all for encryption. But here I don't think it helps in particular, and, sometimes, a false sense of security is worse than no security at all.