Slashdot Mirror
Court Upholds Warrantless Internet Snooping
amigoro writes to let us know about an appeals court ruling on Friday that holds that federal agents can snoop on an individual's web surfing, email and all other forms of Internet communication habits without a warrant. The court found recording this kind of information to be analogous to the use of a pen register. In 1979 the Supreme Court ruled that this technique did not constitute a search for Fourth Amendment purposes.
with the anti-wiretapping laws passed several decades ago? Please fill me in, do those have any effect or did they just sweep past them and make them irrelevent?
Well, back to rejecting software patent applications.
With a "pen register" all they get is the phone number you called.
That would be analogous to the IP address that you connected to (and maybe the port).
The question is how are they capturing the IP addresses? If they're capturing the packets, that's the same as a wiretap.
Encryption. Learn it. Love it. Live it.
The article says that they're allowed to monitor the addresses of the websites and email you use, but not neccesarily the content of the page itself. For example if you went to a website you had to log in to, they wouldn't be able to find out what was on those pages without a warrant.
Still sucks, since getting the address of a webpage is pretty much equivalent to getting the page itself 99% of the time.
+++OUT OF CHEESE ERROR+++ REDO FROM START +++
They are allowed to look at the sender information on your e-mails and domain of websites you are looking at. The contents of the e-mails and which pages of a website, ie the URL, are still off limits.
If brevity is the soul of wit, then how does one explain Twitter?
I don't see what all the hoopla is all about. They're not opening the emails or reading any content. At least, they should not be.
Take your foil hats off...
Cheers. Except that, as far as I know, it's not illegal to post something without a return address on it.
...the court said, although the government learns what computer sites someone visited, "it does not find out the contents of the messages or the particular pages on the Web sites the person viewed."The search is no more intrusive than officers' examination of a list of phone numbers or the outside of a mailed package, neither of which requires a warrant, Judge Raymond Fisher said in the 3-0 ruling. I think that his honor missed something here. He seems to be saying that knowing the address of a web page is like knowing the address on an envelope, and in either case the contents is not being snooped upon. In the case of the letter he would be right, for a letter can contain anything ( I could mail a recipe for braised goat's eyes to Bin Laden ).
But a web address often has a 1-to-1 corespondence with its contents. Knowing the address is one simple - and undetectable - step from knowing the contents. They are doing an unconstitutional search here.
So they won't mind if I start encrypting everything then.
Circuit Courts of Appeals only have jurisdiction over cases arising in their proper Circuit. This decision is not applicable anywhere but the Ninth Circuit.
m b/d/df/US_Court_of_Appeals_and_District_Court_map. svg/620px-US_Court_of_Appeals_and_District_Court_m ap.svg.png
http://upload.wikimedia.org/wikipedia/commons/thu
Editors, please.
What the ruling held was that the header information of your email (and web browsing I believe) is subject to exactly the same standards as the information about what phone numbers you dial. Mostly this seems like an appropriate and totally correct extension of offline legal standards to the online world. The only reason that it is more problematic is that an email header includes things like the subject which contains a little bit of the content.
Still all things considered this seems like the correct rule. Subject lines don't contain that much information and if you are concerned you can just use an unrevealing subject. Moreover, we already contemplate the possibility that someone who happens to glance at the recipients screen might notice the title so it really doesn't seem like we have the same expectation of privacy for the title of the message as we do for the body.
Anyway for a better more interesting discussion about this case you can check out Orin Kerr's comments over at the Volokh Conspiracy.
If you liked this thought maybe you would find my blog nice too:
People died for the Freedom that too many of us seem willing to trade away.
If the worst thing that happens to you is some jail time because you refused to reveal your keys, consider yourself ahead of the game.
Fascism begins when the efficiency of the Government becomes more important than the Rights of the People.
This mess developed over time.
All this stems from a distinction in wiretap law that goes back to the dial telephone era. Listening to voice requires a warrant, because that info belongs to the parties of the call only. But information used by the telephone company itself to route the call, like dial digits, can be requested from the telephone company. A "pen register" was classically a little electromechanical gadget that recorded dial pulses as dashes on a paper tape. There was no way to extract voice info with a pen register.
Then came Touch-Tone. Now the switching data was in the voice channel. After some court decisions, it was established that listening to the voice channel and extracting tones was OK, if done with "minimal" access to the voice channel.
Over time, this led to the "pen register" exception being extended to content the telco didn't process, including tones sent during a call to third-party services like voice mail, packet headers, E-mail headers, cellular location data, etc. Then came a "lower standard for stored messages", which included SMS messages and E-mail. Then came bulk interception via CALEA. Then the Patriot Act.
In Canada, the police need a warrant (CanLII link) to get a dialled-number recorder placed on someone's phone (though apparently such a warrant is easier to get than a wire-tapping warrant), so extending this to the Internet wouldn't really be all that scary.
I think Quebec's general unwillingness to trust the federal government probably helps a lot here.
http://outcampaign.org/
Time to start using:r k)
http://en.wikipedia.org/wiki/Tor_(anonymity_netwo
and
http://en.wikipedia.org/wiki/GNU_Privacy_Guard
The alternative would be to vote the idiots out of office, but it doesn't seem as if that will happen any time soon.
Exactly.
Now, there are possible ways to get the IP addresses that you connect to WITHOUT getting any more information than that (and such information is just about useless).
But I don't trust the government to put any effort into protecting MY Freedoms and privacy when it is so much easier for them to abuse such.
There is a huge difference between knowing that I connected to 66.35.250.150 on port 80
and
Knowing that I connected to http://yro.slashdot.org/comments.pl?sid=247095&ci
--
Appeals Court Rules No Privacy Interest in IP Addresses, Email To/From Fields
The Ninth Circuit Court of Appeals ruled Friday in United States vs. Forester that IP addresses and the To/From fields in emails are the legal equivalent of dialed phone numbers and the government can get a court order to obtain them without showing probable cause as would be needed in a search one's house.
The Court extended to the internet a 1979 case known as Smith vs. Maryland, where the Supreme Court found that individuals have no reasonable expectation of privacy in the phone numbers they dial because they transmitted them to the phone company in order to complete the call. However, under Smith, the contents of the calls could not be listened in on without proving probable cause to a judge.
The Ninth Circuit, ruling in an appeal of an Ecstasy-drug ring conviction found that emails' To/From fields and visited IP addresses were the internet's equivalent of phone numbers. For example, the government could get a log that said a person visited to http://66.230.200.100/ (Wikipedia's address). However, the court suggested that knowing full urls are very close to content (e.g. http://en.wikipedia.org/wiki/Ecstasy) and would likely require a higher burden of proof to obtain than mere IP addresses.
From a footnote in the decision:
Surveillance techniques that enable the government to determine not only the IP addresses that a person accesses but also the uniform resource locators (URL) of the pages visited might be more constitutionally problematic. A URL, unlike an IP address, identifies the particular document within a website that a person views and thus reveals much more information about the persons Internet activity. For instance, a surveillance technique that captures IP addresses would show only that a person visited the New York Times' website at http://www.nytimes.com/ whereas a technique that captures URLs would also divulge the particular articles the person viewed.Professor Orin Kerr questions whether the decision is about getting this information from an ISP or whether it was from a device installed on a computer surreptitiously. He suggests the latter should require a higher standard, but I'm not sure why? Perhaps it's because that might require law enforcement to enter a person's house?
-----[0_o]-----
We are not amused.
I think you're missing a key point -- an e-mail has a subject line, while a phone number or a letter mailed by post does not. Even without reading the contents of the message (and I don't believe for a minute that they don't -- call me paranoid), you can see what the message is about. Not true of a phone call or letter.
Also, as stated elsewhere, any web address has a direct relationship to the contents of a web page. This is more information than just a phone number or address on a letter.
Personally, I'm not sure why they're being so lazy -- generally courts will give warrants fairly easily. And it's not the time lag involved in obtaining a warrant, either -- I think you can get a warrant after the fact if time is of the essence. Given other actions of our current government, I'm more inclined to believe that they want as little paper trail related to some of these searches as possible. I don't typically tend toward such paranoid thinking, but past behavior offers a strong suggestion of current and future behavior.
It is pitch black. You are likely to be eaten by a grue.
I send email signed with GPG. Mess with the headers, sure, but the BODY can't be tampered with. Read, yes, tamper, no.
If something must remain confidental (source code, thoughts, company plans), it is put onto a server, and a reference sent via email (with GPG signing). The recipient can CERTAINLY go to the web page, where she will be redirected to an SSL page.
As soon as the SSL connection is set up, I use Apache Basic Authentication. Give me a user name and password. And these are reasonably secure. At least, I can detect hacking attempts, and take down the server if needed.
Won't tell anyone anything, really... And, for good measure, the server isn't in the US (and if I *were* in the US, it would be located out of the US anyway).
And, yes, I am paranoid.
Just another "Cubible(sic) Joe" 2 17 3061
The laws were written with specific technologies in mind.
For example a wiretap is conceptually, if not legally, tied to telephony. In order to be a wiretap, a communication must have an aural component. Thus intercepting an email being sent over WiFi is not a wiretap, but a VoIP intercept is. Likewise intercepting an email with a voice mail attachment (such as might be generated by a voice mail/email gateway on a system like Asterix) might qualify as a wiretap.
There are provisions for controlling the reading of text messages, but the law is written for a system like the old Telex system, in which the messages are ephemeral,but stored in temporary buffers at various stages of delivery. Thus while intercepting an email in a transfer agent queue is questionable, once it is delivered to your email box at the ISP, it becomes fair game. It is no longer in transit, but stored on a server. In the days of Telex, you'd take your message of the teleprinter, read it, and shred it, knowing that it was gone forever, not recoverable from your mail box or from backup tapes.
The third part of the ECPA laws deals with something called a Pen Register: a device that is attached to an old fashioned phone line to capture the in-band signaling of the phone numbers being called. Even though the privacy concerns for email or web proxy logs are identical, these situations are not covered by the Pen Register Act.
The underlying problem is this: although attempts were made in the laws to make them independent of a specific technology, those efforts failed because US law (unlike EU law) does not recognize a fundamental right to private communication. There are packages of specific rights secured by the Bill of Rights, statutes and common law privacy concerns, but these rights are much less than a true right of private communication. The reason is that you can't have a meaningful right to private communication when that communication is mediated by a third party like an ISP or a telephone company, not unless you have a fundamental right to informational privacy.
Without a right to information privacy, anything that falls into the hands of a third party is fair game. This includes information ISPs or telephone companies store in order to route and deliver a message, up to and including the entire content of the message. ECPA, which consists of the Wiretap Act, the Stored Communications Privacy Act and Pen Register Act, closed these loopholes in its time, but as of today those loopholes are wide open again.
This process will repeat itself forever, no matter how many times we close the loophole, until a fundamental right of informational privacy is recognized. We could do that be adopting into law the EU Data Directive. The reason we don't is that this would hurt US companies which are flourishing by exploiting the America's backwater status when it comes to privacy.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
The constitution isn't divine. I call for a reform.
Be careful what you wish for - the "reform" might not be quite what you wanted, citizen.
Seven puppies were harmed during the making of this post.
Especially where the URL in question links to an email message! Many webmail services use URLs to access individual emails. Snooping these addresses can actually OPEN email messages. How can this be allowed?
Keygrabbers, bots, password snooping...and that's just the guys from Microsoft! :>
If this stops building from exploding, it's fine with me. It's not like the net's been private for over ten years...
Want something private? Create an ssh tunnel.
--- For a good time mail uce@ftc.gov
Comment removed based on user account deletion
Sorry but this is bad news. Suppose you read an article on Fark, some guy gets busted making explosives or smoking salvia or anything crazy like that. You, being the curious type, do a little research and end up on some sites devoted to spreading information the application of which would be illegal. Whether or not you do anything illegal, you make some friends and hang around on their message board or IRC channel where 95% of the talk is off topic anyay.
Now the feds using their tap into the AT&T backbone and their data mining software pull your IP address as going to www.illegal.com repeatedly, and maybe looking at some lab glassware on ebay or whatever. This could amount to probable cause to raid your ass and seriously ruin your day.
Give me Classic Slashdot or give me death!
Here is a little snippet from the Fine ruling..... Surveillance techniques that enable the government to determine not only the IP addresses that a person accesses but also the uniform resource locators (URL) of the pages visited might be more constitutionally problematic. A URL, unlike an IP address, identifies the particular document within a website that a person views and thus reveals much more information about the persons Internet activity. For instance, a surveillance technique that captures IP addresses would show only that a person visited the New York Times' website at http://www.nytimes.com/ whereas a technique that captures URLs would also divulge the particular articles the person viewed. They seem to be saying it's more problematic if this surveillance technique is capable of yielding any useful information. Please explain why the government would even want to use any technique that's not useful ? Well, ok, some hypothetical other government, not the incompetent boobs we are stuck with. But you get my point. Another point to consider, the 9th circuit is the most frequently overturned court in the countryhttp://www.realclearpolitics.com/articles/2 006/11/supreme_court_cleans_up_after.html
If reviewed by the supreme court, it very well might not stand.
Great news comes in strange forms sometimes...
Now we can all begin converting our internal infrastructure to using very strong, protocol-based encryption, end-to-end. Bittorrent for http, secure, anonymous, private networks wrapped around our standard applications and more.
Begin now, if you're not using strong encryption.. you should be. Don't let the government WE put into place, tell you what YOU can do with your own Internet time.
If the government we put into place is not representing your best interests, its time to replace them with one that does.
Lock everything down and keep prying eyes out.
The way I look at it, if you could catch one more "bad guy" a day
Lots.
As opposed to Ben Franklin's:
They'd rather follow Otto Bismark's opinion:
The problem is that it is the Government that chooses what "crime" and what "evidence" will be used to charge a person.
And the Government is composed of people. Sometimes honourable. Many times petty and vindictive if not outright criminals. Which is why our country was founded upon the belief that you cannot trust the Government. That we had to limit the Government's authority and protect the Rights of the People.
It's all about how you view Rights and whether you are with Franklin or Bismark.
Not exactly. While the decision isn't binding anywhere but in the Ninth, it is persuasive authority everywhere. And given that the 9th is the most liberal circuit in the nation, how could a judge elsewhere decide that the decision isn't liberal enough?
says the coward without the guts to even post on a real account
Re: crypto...
GP: Until they illegalize it.
PP: Anyway - you've got no worries. If the USG tried that, you'd use all those wonderful 2nd-amendment protected firearms to overthrow it? :
Actually, you could make a Second Amendment argument to the court. Is strong crypto still on the ITAR list? If so, it's a "munition" and the Second Amendment guarantees your right to it.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
The question is how are they capturing the IP addresses? If they're capturing the packets, that's the same as a wiretap.
That's a valid point, supported by disturbing evidence. What I think they want you to think is that they can require ISPs to keep the information and demand it at any time. TIA was planned before 911 and is largely in place, despite overwhelming popular objections and Congressional disaproval.
There are objections to the other practices as well.
Friends don't help friends install M$ junk.
| And what happened with the anti-wiretapping laws passed several decades ago?
A court called household cordless phone calls "radio broadcasts" as I recall, so anyone can listen
in on them legally -- whether LE or a nosy neighbor kid.
Still true?
Hide all sigs: Click HELP+Prefs (top), VIEWING (last on right), DISABLE SIGS (3rd on left) and SAVE (hidden at bottom).
Likewise, the court said, although the government learns what computer sites someone visited, "it does not find out the contents of the messages or the particular pages on the Web sites the person viewed."
Unbelievable statement.
Anyway stop whining and do something about it.
http://www.mysecureisp.com/
USSA (United Soviet States of America) were democracy is waved like a flag but never actually used.
Note that the excuse for non-suppression is disengenious, as the judge should have been the remedy.
Also note that if e-mail addresses were obtained, that means that more than just the IP headers were being looked at. Packet inspection had to be done in order to obtain the e-mail addresses from within the packet.
This ruling effectively is a precedent for the illegal NSA spying.
You are being MICROattacked, from various angles, in a SOFT manner.
I read the headline as "Court Upholds Warrantyless Internet Shopping," and thought "Big deal. That's like buying something off of Ebay."
I guess that a misread like that might hint that it's almost time for me to consider going to sleep. Next thing I know, I'll be misreading reports of Microsoft making partnerships with novels, people buying Praystations, people going mad for IPphones and Gnus for Nerds.
Or maybe my brain has just gone offline from reading too many articles on the SCO case. I'm gonna get my lawyer onto Dril McBirde! I'll Suse!
While many would think those are fundamental rights, many would not want the government ot be responsible for ensuring all have those rights, at least amongst many US citizens. These reasonable disagreements is why we have the Constitution, which is what we have to hang our hats on, and is why we have Article V to change it when we need to. And sure, someone will probably point out the 10th amendment, but that talks about people retaining power, not asserting rights, which I believe is a subtle but important distinction.
Anyway, with all the energy I see here that goes into asserting fundamental rights, (one of privacy in this case) I was glad to see an entry that alludes to the basic problem. I would contend though that an assumption that it can't be changed because of "corporate America" takes away so much of its potential. If the world really is different because of technology, and this InterWeb thingy, then go the grassroots route. It is done here on many issues. And I think that I sense a defeatist attitude because of past failures (for instance, in securing a fundamental fair-use right interpretation that would be favorable to end users). If you don't like how laws are being intepreted, then fight for new legislatoin to clarify in explicit detail what is needed. Grass-roots campaigns that are against major money interests have shown signs that they could be very effective in a relatively short period of time. Take the story of Porkbusters, for instance. While all of its goals have not been met yet, in a short order of time, they have raised awareness and gotten promises (but to little action yet unfortunatley) that their "demands" are met.
And I think people should aim higher though. I would love to see a grass-roots campaign emerge from a place like Slashdot, that would push for something like a right to "privacy" . For instance, something like "The right to privacy, being fundamental to a right of free though, shall not be abridged, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing . . . " (I would guess something about the time of the records in which one searched, but I just can't make it concise, like I think all rights should be stated) Maybe one could not get to the point of passing a Constitutional Amendment, but I could easily envision a movement centered around such a right to be embraced by a large group of people. From there, given that much of the audicence would be techno-philes, and this InterWeb thingy, you have the seeds of an inevitable Viral Marketing campaign which would almost inevitably result in some senators and congressment sponsoring at least to strenghten privacy in our laws.
http://daviddfriedman.blogspot.com/2005/12/differe nt-argument-for-right-to-bear.html
"Tempers are wearing thin. Let's just hope some robot doesn't kill everybody." --Bender
One other thing to remember: while governments do tend to be the biggest threat to freedom and happiness, they're not all you have to worry about. Even that UK law only says you have to give your keys to the government, not just anyone who asks. You don't have to give your keys to Google, for example, so that they can scan your emails to give you better ads. You don't have to give your encryption keys to your neighborhood network-sniffing burglar so that he knows that you RSVPed to a party and you won't be home at a certain time.
Even if encryption doesn't protect you from active attacks by the government, you should be using it anyway. "Learn it, love it, live it" indeed!
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
It doesn't matter if I say,
"Hey Bob-The-Anarchist, let's go be subversive!"
or
"Hey Bob-The-Anarchist, KJLJALIUHFFLKAJHSLSAUFRGGFGFGJEUCJDKUEUD"
Even if they can't decode the second one, anyone listening still knows I was talking to the "Enemy of the People," Bob.
So, seeing how what's at issue in this article is who you're talking to more than what you're saying, encryption is, unfortunately, not super relevant.
I think the only technical solution here is to use steganography and communicate through a very large (unwitting) third party -- like Slashdot: one might post reasonable-sounding forum posts containing hidden information. And even this solution is low-bandwidth, high-latency, and precariously-secure at best (were it high-bandwidth, it would come to dominate the traffic to and from that third party [Slashdot], and then the communication would become obvious). So basically, it's a pretty crappy compared with what we're used to.
I agree with your premise that we should routinely encrypt stuff; I'm all for encryption. But here I don't think it helps in particular, and, sometimes, a false sense of security is worse than no security at all.