Slashdot Mirror
National Security Draft For Fining Tech Company "Noncompliance" On Wiretapping
Jeremiah Cornelius writes with what looks to be part of CISPA III: Children of CISPA. From the article: "A government task force is preparing legislation that would pressure companies such as Facebook and Google to enable law enforcement officials to intercept online communications as they occur. ... 'The importance to us is pretty clear,' says Andrew Weissmann, the FBI's general counsel. 'We don't have the ability to go to court and say, "We need a court order to effectuate the intercept." Other countries have that.' Under the draft proposal, a court could levy a series of escalating fines, starting at tens of thousands of dollars, on firms that fail to comply with wiretap orders, according to persons who spoke on the condition of anonymity to discuss internal deliberations. 'This proposal is a non-starter that would drive innovators overseas and cost American jobs,' said Greg Nojeim, a senior counsel at the Center for Democracy and Technology. 'They might as well call it the Cyber Insecurity and Anti-Employment Act.'"
No, the fourth amendment is there to make sure that investigations are actually investigating something reasonable, rather than just harassing somebody the officers don't like.
You do not have a moral or legal right to do absolutely anything you want.
Actually, what I think he means is that even if a court grants an order, if the company does not track or have in place a method to monitor communications, then they could be fined in an escalating fashion.
For instance, most ISPs track what address gets assigned to which customer via DHCP, but there have been some ISPs that either don't, or won't give that information out as it's not guaranteed accurate. The FBI could get a court order for the information, but if the ISP doesn't track it, they can just say they don't have it. With the draft, the court could levy a fine against the company that can't or won't implement the necessary logging of that information.
Respectfully submitted: Did anyone bother to read the FBI's actual testimony, which was linked in the WaPo article?
http://www.fbi.gov/news/testimony/going-dark-lawful-electronic-surveillance-in-the-face-of-new-technologies
Note the date of the testimony: February 17, 2011
This has been on the burner for a while now.
Feds have had the ability to target SSL interception for years. Hell, even I had it it in a micro-corp I ran IT at four years ago.
It's available as a commercial off-the-shelft product, and the law enforcement versions have the right connections to 'just work'. THink about that for a minute, and if you don't grok it, go install some SSL Observatory plugins.
Doing /driftnet/ style SSL inspection is another problem altogether.
And that tells you something about the types of intercepts they're having trouble with.
They're not only mining shit when they don't even have a suspect in mind. They're so used to it that they want it to be illegal to make it difficult.