Slashdot Mirror
Inside Comcast's Surveillance Policies
Monk writes "The Federation of American Scientists has obtained a recently disclosed Comcast Handbook for Law Enforcement which details its policies for divulging its customers' personal information. (Here's the handbook itself in PDF form.) All of Comcast's policies seem to follow the letter of the law, and seem to weigh customer privacy with law enforcement's requests. This is in apparent contrast to AT&T and a number of other telecommunication companies, which have been only too happy to give over subscriber records. According to the handbook, Comcast keeps logs for up to 180 days on IP address allocation, and they do not keep all of your e-mails forever (45 days at most). VoIP phone records are stored for 2 years, and cable records can only be retrieved upon a court order. The document even details how much it costs law enforcement to get access to personal data (data for child exploitation cases is free of charge)."
I'll trot this pony out one more time:
(Mac OS X 10.3+) http://www.joar.com/certificates/
(Windows) http://www.marknoble.com/tutorial/smime/smime.aspx
So they follow the letter of the law isn't the law what is preventing privacy ?
That's odd. I'd have thought it cost "do it or be fined/arrested".
The law doesn't protect you. You protect you. Encrypt.
Complying with requests from "Law Enforcement" is quite a bit different from complying with requests to assist a US government agency with an anti-terror program. Local law enforcement is far removed from the latter.
/.'ers? They still haven't changed thier undocumented policies related to bandwidth limitations on "unlimited bandwidth" accounts.
Is this an attempt to improve Comcat's poor reputation among
Internet, Voice, TV. All on one subpoena.
Interesting read, especially considering the "Comcast Confidential" footer at the bottom of every page. That said, it's informative only insofar as it states there's laws to be considered, and makes clear the folks at Comcast insist on following them. Nothing in that document is very different than a typical publically-available TOS. Here's an excerpt:
As for the email policies referred to in the summary, Comcast does not store emails any longer than the subscriber chooses keeps them.
Put another way, Comcast doesn't store your emails. You do.
Yay for viral PR provided by Comcast... nice handbook... how much different is it from the "real" handbook?
"At present I shall only give you my Opinion that tho' your Reasonings are subtle, and may prevail with some Readers, you will not succeed so as to change the general Sentiments of Mankind on that Subject, and the Consequence of printing this Piece will be a great deal of Odium drawn upon your self, Mischief to you and no Benefit to others. He that spits against the Wind, spits in his own Face. "
If you've been paying attention to the news, the service providers simply cave into the government's demands for personal information then cry for legislation to retroactively exonerate them when they're caught breaking the law. Policies, legally-binding agreements, and laws mean jack in the current environment.
I swear to God...I swear to God! That is NOT how you treat your human!
Comcast is *the* Devil.
Shame they had to add some flamebait into thei post.
Using openSUSE instead of Windows since 9th of October, 2007 and liking it.
For any interested here is the equivalent info on Cox Communications: http://www.cox.com/policy/leainformation/default.asp http://www.cox.com/policy/leainformation/CoxLawfulInterceptWorksheet.pdf
'and cable records can only be retrieved upon a court order'
Are they saying that comcast will hand over identity and ip records WITHOUT a court order? The only 'balanced' policy would be to turn over nothing to law enforcement without a court order and even then to oppose the order if possible.
"All of Comcast's policies seem to follow the letter of the law, and seem to weigh customer privacy with law enforcement's requests. This is in apparent contrast to AT&T and a number of other telecommunication companies, which have been only too happy to give over subscriber records."
Apples and oranges. "Monk" is comparing Comcast's words to AT&T's actions..
It's nice to know that Comcast is able to write a policy manual that follows the law, but surely a written policy telling employees to break the law would trigger a minor scandal.
Anyone who's ever been in a large organization is familiar with lip-service CYA written policies.
How seriously does Comcast take this policy? Do they give training sessions to the people who need to implement it? Do they back up or undercut the people who go "by the book?"
"How to Do Nothing," kids activities, back in print!
look what russia is doing. tsar putin has created a new empire and cold war to go with it, killing free press and political freedom. would-be emperor bush is helping by not taking his head out of his ass for bit of fresh air and the religious right are screaming for crusades. the iss is likely the last bit of space cooperation between the two that you will see.
I was told more-or-less the same thing when I interviewed at comcast earlier this year.
They also do not monitor outbound traffic at all unless for diagnostic purposes or because of a warrant. I was told, point blank, that they simply 'do not want to know' what is going on with their subscribers.
And to be frank, I can't say that I blame them. Collecting subscriber usage data is more of a liability than anything else these days.
Where did they obtain this allegedly confidential document? If it was leaked, could it have been done exactly for this kind of publicity on internet message boards? And, even if it is authentic, just because these are their policies does not mean that this is how things are handled within the company. Also, it disturbs me that Comcast, an ISP, would use pixelated graphics for its in-house confidential handbooks. Also also, to wit, hiding in anonymity (as other posters have suggested) can only work for so long. To do so is to rely on the inadequacy of their aggregating technology. What /.er would bet on the inadequacy of technology? We must protect our privacy now, otherwise we will condone a world where we lose our rights to it.
S/MIME is designed to work with centralized Certificate Authorities. If you roll your own CA and issue yourself a self-signed certificate, you'll be able to sign stuff, but people who receive your messages will get a big "BAD SIGNATURE" error or warning, because they won't have your CA in their trusted chain. In order to get it to work, you'd need to get them the CA certificate, and they'd need to import it into their trusted root database. (Which is a security risk -- you do not want to encourage clueless users to start importing certs from every idiot they want to talk to into their Trusted Root.)
It is much better to just get a personal certificate from Thawte or several of the other places online that give them out. Thawte is aimed at people who want authenticated communication; it's not anonymous and in fact they require some form of Government ID in order to issue one. If you want to use S/MIME anonymously or pseudonymously, you're better off going to OpenCA and getting one through them. (Their CA cert isn't included by default in most browsers and OSes like Thawte's is, but at least your correspondents only need to import one additional certificate to recognize yours, and it comes from a basically legitimate institution. That's a lot better than importing random people's CA certs into your root DB.)
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
The rule is one rifle (AK-47 or similar) per household for protection, no heavy weapons, explosives, or caches of weapons.
The military isn't so stupid as to ban civilian ownership of all weapons; it would just make the population more exposed -- not just to foreign hostiles, but also to sectarian violence, and the usual criminal elements -- rather than safer.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
http://en.wikipedia.org/wiki/Cheetah's
Gentlemen's clubs are the enemies of Good Americans(TM) and so it's probably right that the PATRIOT Act be used to spy on their owners.
After all, the ladies inside wear g-strings. What do they have to hide?...
Shiny. Let's be bad guys...
Off topic: why do you keep referring to Vonage as Vontage ?
It's an invasion of privacy that they log identifiable information at all... if anything it should just be generalized information for debugging purposes and that's it.
All 19 hijackers were known terrorists 09-10-2001. Lack of FBI intelligence does not justify warrantless wiretaps..
Yes, you can do this. (And in fact, I think this is the way to go on a lot of crypto, e.g., PGPfone or OTR Messaging's fingerprint-verification systems that don't require any PKI.)
However, for email, you may and probably do want to talk to a lot of people that you may never meet in person or communicate with any other way. This makes verifying a lot of individual fingerprints cumbersome -- but if you don't have any other method for proving authenticity, you create a massive security hole for MITM attacks.
So you pretty much need some way of verifying that the public key you're being given matches the intended recipient of the message, without going to the recipient and verifying it out-of-band for each new person you want to communicate with. This requires some form of PKI; either a web of trust where lots of individuals verify each others' identity, and you can find trust paths through the web to virtually everyone else (in theory), or you have centralized "trusted authorities" whose reputation is based on verifying others' identities. PGP uses the first method (mostly), S/MIME uses the second (again, mostly). Either one can sort of be used the other way around -- Thawte's personal certificates utilize a web of trust, and you can have psuedo-authorities using PGP by setting the weight of their trust very high, so that anyone they verify is considered OK. But they both function best when they're used according to their designs.
If you only want to talk to one person securely, then sure, you can generate your own certificate, they can do the same, you can exchange them and verify the fingerprints through some hard-to-forge method (like voice phone). But this only works if you can recognize each others' voices. If you're trying to communicate with someone you've never met before, it's vulnerable to spoofing and MITM (you try to call them, but instead of them, you get the attacker posing as them; likewise, they try to call you, and instead get someone posing as you). It's not a scalable solution.
But for instant messages, where you're probably communicating over and over with a relatively small group of people, and even telephony in many instances, it would be fine. But email in particular is probably not a good match for infrastructure-less PK crypto.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."