Slashdot Mirror


FBI Pushing For 2-Year Retention of Web Traffic Logs

suraj.sun writes to tell us that the FBI is pushing to have ISPs keep detailed records of what web sites customers have visited for up to two years. Claiming a desire to combat "child pornography and other serious crimes," the FBI and others are pressing for increased data retention, which they have been doing since as early as 2006. "If logs of Web sites visited began to be kept, they would be available only to local, state, and federal police with legal authorization such as a subpoena or search warrant. What remains unclear are the details of what the FBI is proposing. The possibilities include requiring an Internet provider to log the Internet protocol (IP) address of a Web site visited, or the domain name such as cnet.com, a host name such as news.cnet.com, or the actual URL such as http://reviews.cnet.com/Music/2001-6450_7-0.html. While the first three categories could be logged without doing deep packet inspection, the fourth category would require it. That could run up against opposition in Congress, which lambasted the concept in a series of hearings in 2008, causing the demise of a company, NebuAd, which pioneered it inside the United States."

36 of 256 comments (clear)

  1. Won't someone please think of the children by ravenspear · · Score: 5, Insightful

    Seriously is child pornography going to be trotted out for EVERY encroachment on privacy that we have to endure year after year?

    It's getting so old.

    1. Re:Won't someone please think of the children by Monkeedude1212 · · Score: 5, Funny

      I think the government should no longer be able to tax me, to help combat child pornography and other serious crimes.

    2. Re:Won't someone please think of the children by ircmaxell · · Score: 5, Interesting

      Welcome to the world of politics...

      Seriously though, what happens when you don't use the dns provider of the ISP (either running your own, or using a 3pd DNS provider)? Would that make anyone running their own DNS server (or an alternate third party) a suspicious person? They would only be able to log IP addresses then, and given the proliferation of mass shared hosts, how is this helpful? If a child porn site was on a godaddy server, and you go to another site on the same server, would you have to prove you went to the other site? More guilty until proven innocent...

      --
      If a man isn't willing to take some risk for his opinions, either his opinions are no good or he's no good
    3. Re:Won't someone please think of the children by Threni · · Score: 3, Funny

      That and terrorism. TERRORISM!!! What about TERRORPORN! Naked children with BOMBS! Won't someone please think of the photographs?

    4. Re:Won't someone please think of the children by dgatwood · · Score: 4, Funny

      No, but we're nowhere near the end of abuse of kiddie porn as a justification for invasion of privacy. I'm just waiting to see someone propose a law that requires children be photographed naked annually with the pictures stored in a national database so that they can more rapidly identify the victims of abuse. From a logical perspective, it's completely valid. From an ethical perspective, it's completely appalling.

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

    5. Re:Won't someone please think of the children by sopssa · · Score: 3, Interesting

      And what about https? Or would it be mandatory for ISP's to do man-in-the-middle attack so they can store the data?

    6. Re:Won't someone please think of the children by eln · · Score: 5, Insightful

      Seriously is child pornography going to be trotted out for EVERY encroachment on privacy that we have to endure year after year?

      Yes, because it works so well. Just try passing "The Invasion of Privacy Act of 2010" and you'll get laughed off the Senate floor. Present the exact same bill, only change the title to "Child Protection Against Predators Act of 2010" and it'll pass easily. If you can link your bill to child porn, then everyone who even dares to say a word against it is instantly labeled as a supporter of the sexual abuse of children. This is because whenever you say anything about child porn or child predators, the entire electorate completely loses the ability to think rationally and responds in a completely emotionally reactionary way. Emotionally reactionary people are extremely easy to manipulate.

      It's sort of funny how so many people who decry the loss of civil liberties in the name of "socialism" will gladly give up their civil liberties in the name of "protecting children".

    7. Re:Won't someone please think of the children by Philip+K+Dickhead · · Score: 3, Insightful

      "Won't Get Fooled Again"

      We'll be fighting in the streets
      With our children at our feet
      And the morals that they worship will be gone
      And the men who spurred us on
      Sit in judgement of all wrong
      They decide and the shotgun sings the song

      I'll tip my hat to the new constitution
      Take a bow for the new revolution
      Smile and grin at the change all around
      Pick up my guitar and play
      Just like yesterday
      Then I'll get on my knees and pray
      We don't get fooled again

      The change, it had to come
      We knew it all along
      We were liberated from the fold, that's all
      And the world looks just the same
      And history ain't changed
      'Cause the banners, they are flown in the next war

      I'll tip my hat to the new constitution
      Take a bow for the new revolution
      Smile and grin at the change all around
      Pick up my guitar and play
      Just like yesterday
      Then I'll get on my knees and pray
      We don't get fooled again
      No, no!

      I'll move myself and my family aside
      If we happen to be left half alive
      I'll get all my papers and smile at the sky
      Though I know that the hypnotized never lie
      Do ya?

      Yeaaaaaaaaaaaaaaaaaaaaaaaaah!

      There's nothing in the streets
      Looks any different to me
      And the slogans are replaced, by-the-bye
      And the parting on the left
      Are now parting on the right
      And the beards have all grown longer overnight

      I'll tip my hat to the new constitution
      Take a bow for the new revolution
      Smile and grin at the change all around
      Pick up my guitar and play
      Just like yesterday
      Then I'll get on my knees and pray
      We don't get fooled again
      Don't get fooled again
      No, no!

      Yeaaaaaaaaaaaaaaaaaaaaaaaaah!

      Meet the new boss
      Same as the old boss

      --
      "Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
    8. Re:Won't someone please think of the children by HangingChad · · Score: 4, Insightful

      Seriously though, what happens when you don't use the dns provider of the ISP (either running your own, or using a 3pd DNS provider)?

      I'm using Google's open DNS, but the ISP could still figure out where I was going. Which means the FBI can track anyone who doesn't know how to use TOR. And I'm guessing one of those three letter agencies figured out a man-in-middle type attack for that. So I guess that means you'll have to do the really nasty surfing at McDonald's, Starbucks or some other unsecured wi-fi connection.

      Whew, that was tough. I'm sure some of you could come up with even better alternatives. And to put people through that meager effort they're going to require your ISP to keep massive volumes of individually identifiable information for two years.

      Time for the FBI to face up to the fact they're only going to catch the stupid ones.

      --
      That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
    9. Re:Won't someone please think of the children by Anonymous Coward · · Score: 3, Informative
    10. Re:Won't someone please think of the children by Locke2005 · · Score: 3, Interesting

      The people downloading "kitty porn" for free are doing nothing to encourage the creation of more of it. Go after the money trail instead -- the people that deserve to go to jail are the people that are paying for it, and I don't believe tracing the flow of funds requires monitoring every single internet connection. Also, laws are publicly recorded -- as soon as you announce you're going to start doing this, anybody that knows they are breaking a law is just going to start encrypting their connections and going through anonymous proxies, meaning that this technology is only effective against people who don't think they are doing anything wrong!

      --
      I've abandoned my search for truth; now I'm just looking for some useful delusions.
    11. Re:Won't someone please think of the children by morgan_greywolf · · Score: 3, Interesting

      Deep packet inspection can be a very, very resource intensive thing. I seriously doubt that any such laws will be likely to require deep packet inspection. For one, it would put quite a few smaller ISPs out of business for good.

      I have a feeling I know why the FBI wants this. It used to be that all the traffic passed through telco routers owned by Verizon and AT&T. Nowadays, most traffic is being handled by companies like Level3 or UUNet. They had it easy with the telcos, who always had a close relationship with government regulators. Businesses like Level 3, Google, etc., are far less likely to be cooperative.

    12. Re:Won't someone please think of the children by Philip+K+Dickhead · · Score: 4, Insightful

      If child molestation is actually your concern, how come we don't see Bradley tanks knocking down Catholic churches?
      ~ Bill Hicks, 1993, referencing the Waco siege

      --
      "Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
    13. Re:Won't someone please think of the children by Locke2005 · · Score: 3, Insightful

      Seriously is child pornography going to be trotted out for EVERY encroachment on privacy that we have to endure year after year? No, not every encroachment. The wars on terrorism, drugs, and gangs, will be trotted out for many other encroachments. "Terrorism" is already used to restrict your right to anonymous travel. Fighting gangs was used as an excuse for random checkpoints in California. And drugs... will, approximately half the people in jail in the US are there on drug related charges -- trust me, being in jail is a HUGE encroachment on your privacy!

      --
      I've abandoned my search for truth; now I'm just looking for some useful delusions.
    14. Re:Won't someone please think of the children by tomhudson · · Score: 4, Informative

      "Businesses like Level 3, Google, etc., are far less likely to be cooperative.:

      Wrong about google. Google has said that they don't need a subpoena, just a belief that the cops *could* get a subpoena, and they'll roll over on you.

      And google has a LOT of data on you.

    15. Re:Won't someone please think of the children by Jah-Wren+Ryel · · Score: 3, Interesting

      meaning that this technology is only effective against people who don't think they are doing anything wrong!

      Which perfectly suits the needs of 'law enforcement' - we've got a long history of them going after the defenseless and ignorant - like civil forfeiture laws where the property is charged with a crime (literally, lawsuits are titled like US vs One Jeep Wrangler I think being non-sentient qualifies as being 100% defenseless) or even the child porn laws where they go after kids for sexting pictures of themselves rather than hunt down the people who actually abuse kids in the manufacturing of child porn.

      --
      When information is power, privacy is freedom.
    16. Re:Won't someone please think of the children by JWSmythe · · Score: 3, Interesting

          I'd expect the logs would require IP's and/or hostnames.

          HTTP, it's trivial to sniff hostnames.
          HTTPS, it's trivial to see the destination IP.

          HTTPS only works one IP per host, so that gives a positive track to where they were going.

          Of course, domains change ownership, and IP's change, so what an IP is today, could be anything else tomorrow.

          I'm curious to if by "ISP", they mean the residential line providers, or both ends? At my old job, they'd end up with about 2Gb of log files per day per server. There were 15 redundant servers. That was just for one site. I don't even care to think about how much storage was required for all the logs across 150 servers. No, it didn't scale evenly. The web server logs were dumped every few hours, just so it didn't fill up the drives, but left enough for forensics, if we needed them.

          (15 * 2) * 365 * 2 = 21,900Gb. I would love to still be there, and have them ask for 22Tb of logs. :) I was joking with someone about how to deliver those. I suggested burnt CD's. 14,500 CD's would be fun to offer up. We then thought a little harder, and though paper tape would be the way to go. :) I know there would be better methods, but we were looking for the entertainment value in it. :) I'd feel really sorry for the guy who had to feed 14,500 CD's into a machine to burn for the feds on demand. :)

          Logistically, this would become a nightmare for almost any provider, except for mom & pop shops.

      --
      Serious? Seriousness is well above my pay grade.
    17. Re:Won't someone please think of the children by hairyfeet · · Score: 3, Interesting

      Not only that, if they are not recording what the actual website looked like when you visited it what is to keep the IP address from changing to something naughty two years from now? After all IP addresses change all the time, and what was...say some stupid fan site a year ago...who knows what it will be two years from now?

      And how would you "prove" your innocence? They show up with a list of IP addresses from a year and a half ago, how do I prove they are/aren't mine? How do I prove where I did/didn't go a year and a half ago? Hell I don't even have the same PC I did a year and a half ago as it finally gave up the ghost!

      This smells a little too much to me like a "bust anyone you don't like for free" card as defending yourself against some list held in a cop's hand will prove damned near impossible. What's next? "Oh he used CCleaner to empty his temp files and Defraggler to defragment his hard drive, which just proves he was destroying evidence!". Give me a fricking break! How come we supposedly won the cold war and now I have the urge to do " In Soviet Amerika" jokes?

      --
      ACs don't waste your time replying, your posts are never seen by me.
  2. Evidence Already? by Doc+Ruby · · Score: 5, Insightful

    Will the FBI give us some evidence already that mandatory retained data has been essential to actually solving some significant fraction of crimes, or some convincing evidence that its lack is the only reason some significant fraction goes unsolved?

    Without that evidence, their insistence on invading our privacy instead of protecting it as they're instructed by the Constitution that gives them their powers should just be laughed at.

    --

    --
    make install -not war

    1. Re:Evidence Already? by Doc+Ruby · · Score: 4, Insightful

      That isn't an argument. That's a contradiction.

      That's why we have to demand evidence. The more we let the police have power without evidence, the more our police state abuses our rights instead of protecting them. A faithy police state is precisely what the Qaeda wants. And exactly the opposite of the government our Constitution creates.

      --

      --
      make install -not war

  3. This just in: by honestmonkey · · Score: 5, Insightful

    All stores and restaurants will have to keep logs of every customer that comes in, whether they buy anything or not, including full video of them while they were in the store. Microphones must be set up at every table in the restaurant to record all dinner conversation. All of this data must be kept for ever and a day, and available to anyone who appears to be in law enforcement. Why is real life any different than the web?

    --
    Everything you know is wrong, Just forget the words and sing along.
  4. Lollipop, Lollipop by adipocere · · Score: 3, Funny

    We should log lollipop purchases, so we can crack down on those guys in big white vans with FREE CANDY on the side.

  5. Before someone says it by Anonymous Coward · · Score: 5, Informative

    This goes beyond the data retention laws in the EU, and even those are under a lot of public pressure and currently being looked at by the highest courts. What you'll see is that your guys will back down from requiring access logs and make ISPs "just" keep a log of the IPs of their customers for two years, like the EU requires, and they'll call it a compromise.

  6. somehow i just don't believe this statement ... by neonprimetime · · Score: 4, Insightful

    If logs of Web sites visited began to be kept, they would be available only to local, state, and federal police with legal authorization such as a subpoena or search warrant

    1. Re:somehow i just don't believe this statement ... by dkleinsc · · Score: 3, Insightful

      Yeah, I mean it's not like they'd invent some special subpoena that doesn't require any sort of judicial oversight.

      --
      I am officially gone from /. Long live http://www.soylentnews.com/
  7. This will be a good idea by florescent_beige · · Score: 5, Insightful

    until someone offers $100,000 to a $15/hr tech to give them two years of Senator X's browsing records. After that, it will have "served its purpose" and will "no longer be in the public's interest".

    --
    Equine Mammals Are Considerably Smaller
  8. Horrible humor by TiggertheMad · · Score: 4, Funny

    ahh the old think of the kids line. It always works and people never have the guts to say that some things don't simply protect kids.

    Isn't that the problem with child pornography, that people are 'thinking of the kids'....?

    --

    HA! I just wasted some of your bandwidth with a frivolous sig!
  9. there is not enough storage in America for this. by swschrad · · Score: 3, Insightful

    and in the event somehow that the devil intervenes to allow this to come true, the feds should pay to store the data. pay the upfront money to build the servers and the additional air conditioning and power, pay the maintenance money to hire techs and buy tape and repair the machines and run a 24x7 watch on the center. and pay all legal, recovery, and processing fees for every single request.

    --
    if this is supposed to be a new economy, how come they still want my old fashioned money?
  10. Re:Think of the kids by ottothecow · · Score: 3, Interesting
    The thing is...for how much they go after the child pornography viewers...is it really that much of a problem?

    It is much more rare that I see stories about the actual pornographers being caught and while the viewers are certainly depraved (and you can argue that by consuming the child porn, they encourage those who make it), aren't the pornographers the ones we would rather catch? It wouldn't surprise me if the amount of children actually being forced into child porn is VERY small since the already existing library of images probably contains enough to keep the perverts trading for a long time.

    If that is true...then this definitely is an excuse to encroach on peoples rights and use the old "think of the children" excuse because if this much effort was really being put in to catching so few potential criminals...it would be a huge waste compared to what those officers could be doing elsewhere.

    --
    Bottles.
  11. Not going to happen anytime soon by Anonymous Coward · · Score: 4, Interesting

    As someone that works in the Adult hosting industry, this is going to be poorly received. A lot of our clients are already hurting for money and as such have scaled back their server footprint. We're pushing servers (disk IO) a lot harder than before -- one easy solution we have is to just disable access logs. Writing 1GB+ of log data per hour swamps disks and just adds huge amounts of overhead. Since these logs are of clients browsing through porn ... it'll cost a decent amount of money to actually be able to start logging again AND to store raw log data for two years.

  12. Monitoring is good by Anonymous Coward · · Score: 5, Insightful

    I have an even better idea. Let's have all law enforcement officials be required to wear audio and video recording equipment at all times, which are available for all citizens to watch. They do work for us, after all, and I think this would help curb police brutality. I know that most officers are good people, but there are a few bad apples, so we can't be too vigilant.

  13. Re:Think of the kids by BarryJacobsen · · Score: 4, Funny

    The thing is...for how much they go after the child pornography viewers...is it really that much of a problem?

    It is much more rare that I see stories about the actual pornographers being caught and while the viewers are certainly depraved (and you can argue that by consuming the child porn, they encourage those who make it), aren't the pornographers the ones we would rather catch? It wouldn't surprise me if the amount of children actually being forced into child porn is VERY small since the already existing library of images probably contains enough to keep the perverts trading for a long time.

    If that is true...then this definitely is an excuse to encroach on peoples rights and use the old "think of the children" excuse because if this much effort was really being put in to catching so few potential criminals...it would be a huge waste compared to what those officers could be doing elsewhere.

    Agreed that the producers are much more of a problem. To that end, wouldn't a much better law be that all digital cameras have embedded 3g that transmits all taken images to the FBI directly?

  14. Host names by unix1 · · Score: 3, Informative

    Host names cannot be logged without packet inspection unless they assume that a corresponding request against the ISP's DNS services constitutes to "visiting" the resolved host name. You are also free to use DNS servers of your choice that are different from your ISP's. You can run your own DNS server too.

    When a client "visits" a URI it:

    1. resolves the host name to IP address via a DNS service
    2. makes a connection to the said IP address
    3. if connection uses SSL, proceeds with the "handshake"
    4. sends host name, URI, and other request info via the above connection

    ISPs can log #2, but cannot log #4 without packet inspection. It's even more complicated if the connection is encrypted (e.g. https).

  15. The 4th ammendment weeps. by Trerro · · Score: 4, Insightful

    The 4th amendment is supposed to require a warrant to BEGIN surveillance. The law doesn't say "they can tap your phones and record all of your conversations, but they can't actually listen to them until a warrant is issued against you." No, they can't tap until they have the warrant.

    This shouldn't be any different.

    Then again, we all know the results of the last large-scale warrantless wiretapping incident (no one was punished, and it's likely still occurring), so I guess it is, in fact, not any different.

  16. Other serious crimes--- by gmuslera · · Score: 3, Insightful

    like destroying the meaning of privacy for all the users of internet?

  17. Yes officer by PPH · · Score: 3, Funny

    We have those log hard copies right here.

    Dammit! Who forgot to put a new ink cartrige in the printer last year?

    --
    Have gnu, will travel.