Slashdot Mirror
That Was Fast: Leahy Drops Warrantless E-mail Surveillance Bill
Presto Vivace writes "Under the right conditions, online activism can be very effective. U.S. Senator Patrick Leahy has already abandoned his warrantless e-mail surveillance bill we discussed this morning. 'The Vermont Democrat said today on Twitter that he would "not support such an exception" for warrantless access. ... A vote on the proposal in the Senate Judiciary committee, which Leahy chairs, is scheduled for next Thursday. The amendments were due to be glued onto a substitute (PDF) to H.R. 2471, which the House of Representatives already has approved. Leahy's about-face comes in response to a deluge of criticism today, including the ACLU saying that warrants should be required, and the conservative group FreedomWorks launching a petition to Congress -- with over 2,300 messages sent so far -- titled: "Tell Congress: Stay Out of My Email!""
Translation, "I thought nobody would notice."
The truth is that all men having power ought to be mistrusted. James Madison
Whenever this stuff can't get through Congress it just ends up in a Friday night EO dump. Is this one important enough for Black Friday? We'll know by Monday.
No time like the present to start using encrypted forms of communication.
fuck off leahy
the template is broken on the earlier story. why doesn't slashdot seem to care that some of their templates are broken?
According to this, Leahy claims CNET was incorrect in its original article and that he never supported the warrantless wiretapping. When he tried to clarify this stance, CNET comes out with this article saying that he backtracked because of the backlash caused by their article. Not going to make the judgment call on which side is right, but it should at least be noted that there are two sides to the story.
...sadly, few voters will remember it when he comes up for re-election.
When the ACLU and a conservative group are loudly on the same side of something, you know whatever it is is bad.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
His email could be read too...
Just think of all those contributors that would be upset...
He'll resubmit after he gets all of his email encrypted...
Now that it was shot down from being in the open, it will reappear in a unrelated bill, buried under 1000's of other layers so it wont be noticed until its too late.
---- Booth was a patriot ----
Final Jeopardy Answer: The opposite of political "Mom and Apple Pie"
Contestants, all politicians, risk political capital in guessing what this is.
Final Jeopardy Question: Anything the ACLU and conservative groups vocally oppose
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Translation: The CNET story was wrong.
Politicians do a lot of dumb things, but this would have been a total reversal for Leahy.
Grant Gross, Washington reporter, IDG News Service
He's a cum-burping shit stain.
Leahy denies that the CNET story was ever true, so it may be not be the case that he changed his mind. As far as I can tell, every source for the claim that he was backing warrantless e-mail surveillance comes from the same story in CNET based on the same anonymous leak. Senator Leahy says that the version of the bill cited was never his. Other reporters have doubted the story from the start, and think that the draft is actually something proposed by Sen. Chuck Grassley (R-Iowa). It sounds more in character for the latter. It doesn't make much sense to assume that Leahy flipped and then instantly flopped as soon as he got some public blowback. That would have inevitably resulted the second the revised version of the bill was introduced at the upcoming hearing.
It will be back. When attention of the public focuses elsewhere.
This is especially ironic since Leahy is not only handling this warrantless wiretap issue, but he is also a man who has already has resigned from a Senate committee for his inability to keep secrets. http://www.nytimes.com/1987/07/29/us/iran-contra-hearings-senator-leahy-says-he-leaked-report-of-panel.html
We could have fixed this whole privacy thing from the beginning, but for whatever reason we didn't.
There was a time when people read E-mail using local clients. Freeware programs such as Thunderbird and Pegasus Mail were common.
The issue could have been addressed by fiat from any one popular software package. It would only have required:
1) For each user, generate a default public and private key on install
2) Add a field to the protocol requesting the recipient's public key if they have one
3) Add a field advertizing the sender's public key
4) Add a button on the interface for "Prevent others from reading the content"
Done right, that's all it would have taken.
The protocol allows for experimental fields which can be ignored if the client doesn't understand, and there is already a mechanism for "delivery confirmation" which could be adapted for "public key confirmation". It would have taken very little to have the client intercept the public key response, process it, and not bother the user about it.
The mouseover for the button could have said "use encryption if the recipient has a compatible client".
At the time, this would have been a feature that mainstream clients didn't have (Outlook, Exchange, &c), so it would have been a selling point for open source. It would have led people to encourage the recipient to change to a more secure client. There would be an incentive to make other packages compatible, and soon the feature would be everywhere.
All of this could have been implemented transparently for the naive user, with a more sophisticated interface for advanced users who needed more control.
But for some reason we didn't do that, and now everyone reads their E-mail online. We didn't make this a de-facto standard, and now we've missed our chance. (I've often wondered if the browser could automatically encrypt/decrypt the content of specific named text blocks from specific sites such as gmail. Then the content could be encrypted online, but show cleartext to the user.)
We have the means and expertise to fix some of these problems, all it takes is the will to do it.
Big deal, big nothing. So now they need a warrant. How hard do you think that is to get? The FISA courts approved 11252 of 11273 requests from 2004-2011.
and pass a retroactive legalize anyway deal like they did with FISA abuse.
The issue could have been addressed by fiat from any one popular software package.
Thus solving it for users of one package.
Yes, solving it for one package. As mentioned in the post, there would be an incentive for other packages to implement the scheme in order to be compatible. As mentioned in the post. Perhaps enough incentive to form a Tipping point.
2) Add a field to the protocol
Which protocol? SMTP? POP? IMAP? UUCP?
The protocol allows for experimental fields
Same question.
Which one do you think? Do you need a complete spec, or will just an outline do? Google is your friend.
The mouseover for the button
Oh, this would solve the problem only for the people with GUI mail clients.
Did you really think I was advocating implementing this only on GUI clients?
The point was to get enough naive users into the system to make it a de-facto standard. Most naive users use a GUI client, so starting there would put the solution before a wide audience quickly.
could have said "use encryption if the recipient has a compatible client".
Sorry. How does my email client know what email client YOU are using and whether it supports this? Is there a new protocol you are proposing where one client asks another prior to sending an email? What happens if the recipient is offline?
If you have the public key for the recipient, then they have a compatible client. If you don't, you send the message in the clear and request the public key.
Really, this isn't rocket science - the first message I receive from the recipient would contain their public key. My first message to them would be in the clear, but would provoke a public-key sendback which my client would silently process.
(I've often wondered if the browser could automatically encrypt/decrypt the content of specific named text blocks from specific sites such as gmail. Then the content could be encrypted online, but show cleartext to the user.)
If you are limiting yourself to defining "email" as "gmail accessed via a web browser", you simplify the problem considerably. Of course Google could store all your email in an encrypted form and send you a javascript (if you have a js enabled/capable broswer) applet that decodes it on your system. If you send them your public key, they could even encrypt the stuff they store on their disks as it came in for you, if it wasn't already. You still have the problem of how you make sure every system you use to access that email has the key kept locally, and what happens for people who have gmail forwarded to some place else.
So, yes, the problem is rather trivial if you force everyone and everything through one mail server and ignore the huge diversity in protocols used to transport email and the kinds and types of clients/servers used to do it.
The protocol doesn't matter, since the message body can contain any text.
You could, for instance, encode public keys as part of the body of any message by wrapping it in a field delimiter which the client could pick out. If your browser isn't compatible, then the recipient would see the public key encoding as text.
This isn't so different from digital signatures, which are encodings of binary data attached to the bottom of a document body. I'm only suggesting that a similar method be used to attach the sender's public key, and have the client make note of the public keys as it gets them.
The sender uses the recipient's public key if it has one. Otherwise, it sends in the clear. The first messages will be in the clear, and encoded for all subsequent messages.
Really, this is not rocket science. Take a moment to think things through.
The law enforcement and intelligence agencies continue to push for more and more data (warrentless wiretapping of every internet packet that flows through AT&Ts tapping points, wholesale retention of internet data by ISPs, email snooping, increasing numbers of CCTV cameras private and public and who knows what else) yet I dont see any funding anywhere for the massive numbers of agents required to find the few needles in that ever-larger haystack and turn that massive pile of data into useful information.
Great, shining a light on this got the asshole to withdraw his latest attempt to violate his oath of office, but it is NOT ENOUGH. Until and unless Ruling Party politicians can expect to get their asses bounced off the public teat for this kind of behavior, they'll try again and again. It's long past time to end Leahy's career of public disservice.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Result: not a bother. Illegal spying on Americans will continue without impediment.
If it would have been a Republican amendment nobody would have cared. Surprising a Democrat had the nerve to create this. But they both like to do whatever they want and usually get away with this.
The "Bill" had in Leahy's and Obama's mind had gotten out of control.
What is 'out of control'?
The "Bill" would apply equally to all Federal Employees, those elected and those non-elected.
THAT, set a fire under Obama's ass.
Ergo, "Bill" withdrawn.
Now the 'Not So Fast.'
Obama will issue a Secret National Security Executive Order demanding and claiming the right to
all 'ALL' communications by USA non-Governmental citizens.
The processing will be handled at a US Facility in Utah and far remove from FOIA.
A sad day indeed.
patents and copyright rule sin usa are too much....
you did yourself right out of business ROFL....
He should have read the frigging bill ( some lobbyist wrote ) before he proposed it.
You're angling towards what's called deliberative democracy. It takes many forms, including the Open Mic discussion form invented by the Spanish protestors and popularized by OWS. There is a jury duty based approach that's practical form for large governments :
You simply replace the presidential veto with the requirement that all legislation must pass a jury trial with 300 jurors randomly selected from amongst the voters---you need a couple hundred for any real statistical significance. Advocates selected by any 2% of congress as well as the president conduct a debate on the bill, after which the jurors vote. There is of course still a presidential veto of sorts in that the president himself can come himself and deliver a good speech about why the bill should be scrapped.
There is considerable evidence that such a jury trial scheme would improve governance. On contentious issues, people vote much more sensibly after watching a debate on that issue. Also, people are usually quite hostile to unfairness and corruption, meaning pork barrel legislation should take a nose dive.
The Christian religion has been and still is the principal enemy of moral progress in the world. -- Bertrand Russell