National Security Draft For Fining Tech Company "Noncompliance" On Wiretapping

Jeremiah Cornelius writes with what looks to be part of CISPA III: Children of CISPA. From the article: "A government task force is preparing legislation that would pressure companies such as Facebook and Google to enable law enforcement officials to intercept online communications as they occur. ... 'The importance to us is pretty clear,' says Andrew Weissmann, the FBI's general counsel. 'We don't have the ability to go to court and say, "We need a court order to effectuate the intercept." Other countries have that.' Under the draft proposal, a court could levy a series of escalating fines, starting at tens of thousands of dollars, on firms that fail to comply with wiretap orders, according to persons who spoke on the condition of anonymity to discuss internal deliberations. 'This proposal is a non-starter that would drive innovators overseas and cost American jobs,' said Greg Nojeim, a senior counsel at the Center for Democracy and Technology. 'They might as well call it the Cyber Insecurity and Anti-Employment Act.'"

Comments

FBI's general counsel - having a laugh?

[Fluffeh]

'We don't have the ability to go to court and say, "We need a court order to effectuate the intercept."...

Can this guy be serious? The FBI doesn't have the ability to go to court and ask for a court order allowing them to listen in on conversations? Wow. Just utterly wow.

Re:FBI's general counsel - having a laugh?

[nbauman]

'We don't have the ability to go to court and say, "We need a court order to effectuate the intercept."...

I think he means, "Without a reasonable suspicion that a crime has been committed, we don't have the ability to go to court ..."

Re:FBI's general counsel - having a laugh?

[Mullen]

'We don't have the ability to go to court and say, "We need a court order to effectuate the intercept."...

Can this guy be serious? The FBI doesn't have the ability to go to court and ask for a court order allowing them to listen in on conversations? Wow. Just utterly wow.

That leads me to believe that the FBI just says this stuff so that a good chunk of the population, which does not understand the 4th Amendment or Court Orders in general, just buys into what they are saying, just so they can get it.

How the FBI intercepts anything without a warrant or court order and the evidence is not thrown out of court, is beyond me.

Re:FBI's general counsel - having a laugh?

[Schmorgluck]

Yeah, I mean, seriously. Every wiretaping scandal in the past years in the USA is due to non-compliance with due process. Only the judiciary branch can suspend the fundamental rights of individuals. That's what due process is for.

Re:FBI's general counsel - having a laugh?

[cdrudge]

Actually, what I think he means is that even if a court grants an order, if the company does not track or have in place a method to monitor communications, then they could be fined in an escalating fashion.

For instance, most ISPs track what address gets assigned to which customer via DHCP, but there have been some ISPs that either don't, or won't give that information out as it's not guaranteed accurate. The FBI could get a court order for the information, but if the ISP doesn't track it, they can just say they don't have it. With the draft, the court could levy a fine against the company that can't or won't implement the necessary logging of that information.

Re:FBI's general counsel - having a laugh?

[AK Marc]

Just having read TFS, it's about "interception" of communications "as they occur" not logging. The ISPs that were telcos are used to regulations, and all have LI in place. The start-ups didn't design the network from scratch with that in mind, and now they are fighting against regulations that are almost 100 years old, as if they are somehow "new" and a "surprise".

Re:FBI's general counsel - having a laugh?

[Anonymous Coward]

He isn't saying that they can't get a court order to wire tap. The issue here is much larger than that. As I read it, there isn't an effective way to "wire tap" these forms of communications. They are basically going to fine tech companies until they reprogram their technologies so that the FBI can "wire tap" a chosen individual. From the article they mention that when Google uses SSL on the email client, the FBI can no longer just request that the user's ISP let them sniff the bits from the target. Thus they can't effectuate or put into operation an intercept.

The fact that they think it is perfectly reasonable to force companies to rebuild their systems and protocols to allows for easy interception is insane.

Re:FBI's general counsel - having a laugh?

[AK Marc]

The police walk into your telephone switch room with a warrant, you let them listen. That's much much older than CALEA, that's only 20 years old.

Re:FBI's general counsel - having a laugh?

[AK Marc]

So your argument is that the FBI should snoop more on more people and more traffic, rather than more directed snooping based on evidence? Though I think the real reason is that G+ is encrypted, so the FBI wants it from Google so they don't have to decrypt it themselves.

Re:FBI's general counsel - having a laugh?

[Jeremiah Cornelius]

Of course.

This is what is called "a limited hangout". They are already doing worse. This is to distract from that, and to send a discreet message to Google and Twitter that they function as outsourced, privatized intelligence bitches -- or else.

Re:FBI's general counsel - having a laugh?

[BitterOak]

Why do they need a court order anyway? I thought the NSA was tcpdumping (or flushing) the entire flow of data on the Internet into their multi-bazzillion dollar datacenter. This is what happens when peoples jobs depend on the lawmaking industry.

Problem is, companies like Facebook and Google (the two mentioned in the summary) have been migrating to SSL over that past few years. https is the default means for connecting to Facebook now, and it has been an option for Google now for a couple of years. The more people use SSL, the less these "tcpdumps" are effective. This is why the feds need to go to Google or Facebook to get this information. Interesting that Skype wasn't mentioned.

Re:FBI's general counsel - having a laugh?

[Jane Q. Public]

"The police walk into your telephone switch room with a warrant, you let them listen. That's much much older than CALEA, that's only 20 years old."

That's pretty irrelevant, though, because with telephones, tapping is pretty darned easy. But with other technologies it has NEVER been possible to "just listen in"... it just wasn't built in.

That's not "refusal", it's simply not building something in a way that expressly caters to the police. And I don't give a damn. The police don't have a right to run the tech world.

If they can't keep up, tough shit.

Re:FBI's general counsel - having a laugh?

[ganjadude]

the FBI's general counsel. 'We don't have the ability to go to court and say, "We need a court order to effectuate the intercept." Other countries have that.'

Last time I checked, that was always a selling point of this country

Re:FBI's general counsel - having a laugh?

[Jane Q. Public]

"Wiretap warrants require a lot more than just reasonable suspicion of a crime, though. "

Absolutely. They require probable cause, which means real evidence. Of course, then there are the secret rooms the government built into some telco offices that simply siphon off data without anybody's knowledge or consent. Those are established fact... they are the whole reason Congress had to give telcos "immunity" for passing on the information. But as far as I know, there still isn't a law that allows the government to do it legally or constitutionally.

"Wiretap laws were written to fit the idea that phone companies were simple carriers who would respect the integrity of customer's conversations, and since they didn't provide services themselves, people had a reasonable expectation of privacy."

It's not that they didn't provide services. They didn't provide content. As the courts have ruled: there is a lesser standard of evidence needed for telephone records (who called who, and when, for example) than there is for the content of the telephone conversation (wiretap).

But this brings up a good point. Telcos were (FCC Regulations) classified as Title II "Common Carriers". I.e., they provide the call service, but are strictly forbidden from intercepting or interfering with the content (conversation) without a warrant.

It is quite possible to classify and regulate Cable companies and other ISPs as Title II Common Carriers. In fact, the FCC has wanted to do it for decades. But lobbyists got Congress to pass a law specifically excluding ISPs from Common Carrier status. That was one of the biggest mistakes of the last few decades.

The solution: get Congress to remove the exclusion from ISPs. Then the vast majority of your privacy concerns go away, virtually overnight: it will then be prohibited for ISPs (or anybody, including usage trackers) from monitoring your activities without a warrant. Most of the major privacy and security concerns surrounding the Internet simply disappear.

Sure, there will still be a few criminals doing it now and then. But criminals tapped (probably still tap) telephones, too. But the big problem -- government and corporations -- will be forced to leave it alone.

Re:FBI's general counsel - having a laugh?

[Anonymous Coward]

Feds have had the ability to target SSL interception for years. Hell, even I had it it in a micro-corp I ran IT at four years ago.

It's available as a commercial off-the-shelft product, and the law enforcement versions have the right connections to 'just work'. THink about that for a minute, and if you don't grok it, go install some SSL Observatory plugins.

Doing /driftnet/ style SSL inspection is another problem altogether.

And that tells you something about the types of intercepts they're having trouble with.

They're not only mining shit when they don't even have a suspect in mind. They're so used to it that they want it to be illegal to make it difficult.

Re:FBI's general counsel - having a laugh?

[gnoshi]

Wait, just so I'm clear: you're saying that law enforcement has the ability to do one of the following:
1. Generate an SSL certificate trusted by the browser (i.e. using a CA which is trusted by the browser) and 'MITM' the connection
2. Use an SSL certificate which doesn't derive trust from a trusted CA, but prevent the browser from notifying the user that the certificate is invalid
3. Has the actual certificate of the server the traffic to which they want to interept

I guess they could also just be intercepting using untrusted certificates and hoping people ignore it - and most probably would.

Re:FBI's general counsel - having a laugh?

[AK Marc]

Nearly all technologies have "easy" snooping technologies built in. Even point to point fiber. Every teleco office around here has a splitter that all connections into the building runs through. Every cellular base station I've seen deployed will tap a call, though many don't bother and instead tap at the controllers in a more central location.

The police aren't running the tech world, they are just requesting that if you build something, that you allow warrants to be served against it.

Re:FBI's general counsel - having a laugh?

[rtb61]

Sorry but targeting the end point of communications is just way to big a reach. What's to stop targeting of Banks, of online retailers, of typical business and how about the typical user. Once you attempt to force end point communications how do you write the law to limit how far that goes. The FBI wants the right to force everyone to become a spy on everyone else, sorry but fuck off. I remain honourable in my communications and spy and deceive for no one. This directly attacks the morals of any administrator of a system and attempts to force people against their will to deceive others.

Re:FBI's general counsel - having a laugh?

[SuricouRaven]

Physically, yes. And that gets you access to a huge pile of data. Actually finding what you want in there takes more work - things like emails or IM you can simply pull out with a filter, but a facebook conversation would require someone familiar with the facebook architecture and possibly a lot of work. The FBI is going to get very annoyed if they submit the warrant to a company and are told that they've put a man to work on the task, but it'll take a few hours to pull the information needed from seven different databases.

Re:FBI's general counsel - having a laugh?

[drinkypoo]

It is quite possible to classify and regulate Cable companies and other ISPs as Title II Common Carriers. In fact, the FCC has wanted to do it for decades. But lobbyists got Congress to pass a law specifically excluding ISPs from Common Carrier status. That was one of the biggest mistakes of the last few decades.

Sigh. How could you get everything else right, and get this so very wrong? There was no mistake involved. They did precisely what they wanted to do. They saw that all communications would eventually move to the internet, so they gave themselves broad-reaching control over it so that they could perform warrantless wiretapping and exert other forms of control as well.

Make no mistake. Exclusing ISPs from common carrier status was not a mistake. It was a deliberate and evil decision specifically intended to support warrantless wiretapping and suppression of free speech.

Re:FBI's general counsel - having a laugh?

[gstoddart]

Can this guy be serious? The FBI doesn't have the ability to go to court and ask for a court order allowing them to listen in on conversations? Wow. Just utterly wow.

The really disturbing thing is I think TFA is saying that companies like Facebook and Google would be required to build wire-tapping into their stuff so that if the government ever asks it is there.

There is currently no way to wiretap some of these communications methods easily, and companies effectively have been able to avoid complying with court orders. ... Instead of setting rules that dictate how the wiretap capability must be built, the proposal would let companies develop the solutions as long as those solutions yielded the needed data.

I think that government is getting ready to ask^H^H^Hforce industry to build in a mechanism ensuring that any and all things can be tapped.

Essentially they want all technology built such that it can be tapped, and they're willing to force companies to do it, and the privacy implications be damned. What they want is the always available ability to listen to anybody's conversations, and they want the companies to pay to build this capability into their products.

So in the act of 'protecting our freedom' and 'going after terrorists', we all lose. This is terrible.

Essentially we will have law enforcement punching holes in technology they don't understand, and the probable result will be technology which has unintended security holes that can be exploited.

It isn't that they don't have the legal ability to get a court order, they just want to 'fix' the situations in which the technology doesn't really allow for it, and remove any of the last barriers when a company is unwilling to do it by levying the fines.

Re:FBI's general counsel - having a laugh?

[Jane Q. Public]

"The police aren't running the tech world, they are just requesting that if you build something, that you allow warrants to be served against it."

No. The difference is subtle, but it is still a difference and one that makes a definite difference.

They are requesting that if you build something, you build it so that they can listen in. That's not the same as just "letting them" listen in when they have a warrant. You have to design your system so that they can.

Rights are inconvenient

[Anonymous Coward]

The 4th Amendment is getting in the way of FBI evidence-gathering.
Good; that's what it's for.

Re:Rights are inconvenient

[Sarten-X]

No, the fourth amendment is there to make sure that investigations are actually investigating something reasonable, rather than just harassing somebody the officers don't like.

Re:Rights are inconvenient

[Bing Tsher E]

Don't be so petty. The fourth amendment is so that investigations can't devolve into general-purpose evidence gathering sessions. It's to guarantee our privacy. Nice try, though, in your try to characterize the issue as law enforcement 'just being pesky.'

No,

[gatfirls]

They're whining that companies don't drop everything end change their business model to a law enforcement intelligence and evidence gathering organization at their request. *This* is "big government"; part of your business model has to include an Open API to the government with a real time feed to help them do their jobs. It would be hilarious if their response could be to allow them to access the petabytes of information and find the needle in the universe of needles themselves.

Amazing...

[Darkness404]

Its amazing that even with a court system that bends over backwards to help "law enforcement" agencies, they still think they need even more ways to violate basic rights.

Its really amazing what has happened in the last 30 some odd years, to see a nation which used to truly be one of the freest in the world to now only paying lip service to freedoms. It used to be that if you wanted freedom, you came to the US, now its becoming increasingly obvious that if you value freedom, moving out of the US is the way to go.

Re:Amazing...

[Darkness404]

Chile is one of my options, fairly politically stable, modern, fairly free in practice, fairly cheap land, etc.

Some of the non-EU European nations wouldn't be bad, a bit more expensive, but Andorra and Switzerland are potential options. Even though I don't really like crowds and big cities, Hong Kong and Singapore wouldn't be too terrible to live in, but again its more expensive.

The real test though is how free countries are in practice, I mean, North Korea's constitution guarantees freedom of religion and expression, but it certainly isn't practiced. Similarly some countries may have more restrictive laws, but they are never enforced which provides more freedom in practice than a country with laws guaranteeing freedom but that restricts the practice of it.

Re:Amazing...

[Darkness404]

Yeah, I certainly can believe it.

There is a huge disconnect between how countries are portrayed in the media and how they actually are. I mean, who would have thought back in the "cold war days" that someone would flee France for Russia for economic freedom!

What people think they believe in and what they actually believe are two separate things. I remember talking with my grandparents that they were scared that Obama would put the country under martial law, and then when Boston basically went under martial law, they praised the police and thought it was great what they were doing!

Re:Amazing...

[ClioCJS]

You really suck at history, huh? Boston has faced bombers MANY times in the past. MANY. For giggles, google how it relates to the molasses massacre that killed score(s)....

Re:Amazing...

[Bing Tsher E]

"The situation is unprecedented, so unprecedented extreme measures need to be taken" is a standard ploy for those seeking to exercise extreme state power.

Re:Amazing...

[AK Marc]

or the, at least one, house they did search with explicit non-consent.

The law is pretty specific about this. If a violent crime is in progress, then the police have the right to pursue. If a kidnapper breaks into your basement without your knowledge and the police saw him enter with the hostage, the police have the "right" to break into your house and search it. They "shouldn't" use anything found against the homeowner, but they can do so in pursuit.

Much more alarming is the pursuit of the LA cop, who they shot out cars of the wrong person and all that. But that seemed to get less press than other less interesting things.

Re:The bill is doomed to fail

[Darkness404]

Yeah, like the NDAA...

The average American doesn't care about freedom anymore. Sure, they love the -illusion- of freedom, they love the -illusion- of their rights, but when it comes down to it, the average American is perfectly content and even applaud rights violations as long as they think that it won't apply to them. I mean, look at the outright celebration of essentially martial law in Boston, look at the lack of outrage against drone strikes, heck, even look at the widespread cheers for the horrible conditions at Guantanamo.

The average voter doesn't care about freedom, as long as they have their welfare checks, government jobs, medicare and social security. As long as the media can maintain the illusion that the US is the freest country in the world, there won't be any outrage.

translated

[waddgodd]

"What's the point of a warrantless wiretap if we have to go to court to get compliance?"

Meanwhile, a workplace death = $1000

[SuperBanana]

Just a reminder that OSHA and EPA fines, when they happen even under the most egregious circumstances, typically result in fines that barely break four digits.

Re:Meanwhile, a workplace death = $1000

[amiga3D]

Gotta keep you priorities straight. Who cares about a few peasants?

Re:Require law enforcement to follow the Constitut

[amiga3D]

I think they want the same kind of government regulation that China has.

CISPA III: Children of CISPA

[Areyoukiddingme]

Also known as the Capitalize On The Boston Bombing Act.

Re: CISPA III: Children of CISPA

[Bing Tsher E]

"Never Let A Crisis Go To Waste"

We all know what this is about, right?

[Anonymous Coward]

Say you're trying to get someones gmail traffic. Conventionally you could tap it anywhere along the path, so it made sense to pick the ISP who may not have the resources (small ISP) or inclination (AT&T et. al) to resist a bogus wiretap request. The absolute last thing you want is someone like google with resources and inclination to look at your flimsy wiretap request.

Hence the panic. The funny bit is that this is yet another bandaid - true peer-to-peer communication ups the ante again. I wonder what would happen to a company that developed real peer-to-peer communications, but wasn't involved in setting up the call (so they don't have the secret to give the government); would they get caught up in the binary fine escalation too?

"Other countries have that".

[sacrabos]

Yeah, many other countries don't have a 4th Amendment and other Constitutional protections and restrictions on government.

Where's the list of "other countries"?

[oDDmON oUT]

I don't think Egypt and the Arab states should be held out as role models.

I can't wait for Obama to take office

[Anonymous Coward]

Then we'll see all this Bush/Cheney crap reversed.

The FBI's testimony on "Going Dark"

[blahblahwoofwoof]

Respectfully submitted: Did anyone bother to read the FBI's actual testimony, which was linked in the WaPo article?

http://www.fbi.gov/news/testimony/going-dark-lawful-electronic-surveillance-in-the-face-of-new-technologies

Note the date of the testimony: February 17, 2011
This has been on the burner for a while now.

No, he wants a live tap no warrant

[Anonymous Coward]

Firstly I notice we're not talking about Skype here, but that surely is where they really want a live tap? I think the fact we're not mentioning skype is telling, as in, it already has a live feed.

Secondly, he's clearly talking about a live tap WITHOUT WARRANT, if the delay from getting a court order won't cause problems, then the 5 minutes to save the voice conversation and send it won't either. So he clearly wants a live tap UNDER FBI CONTROL.

He's seen Syria and Iran's intercept capability and is jealous.

Re:The bill is doomed to fail

[chromaexcursion]

I've gotten many responses from my congressmen and senators. For some of them I wish they didn't waste the paper when they send letters, though it's good for the post office. I do read the the direct email to me.
I've made phone calls as well. A couple times they wanted my full contact info, and I got a letter, or email in response.

Sometimes public opinion works. The republican senator from Pennsylvania switched his position on gun control. Sadly that hasn't passed, yet.
There have been some other notable changes in position due to public position.

The last election proved that ignoring the tech nerd guy is how to lose an election.
D'Oh!

sorry you lost the last election

A matter of national security

[WaffleMonster]

"information services" are exempt from CALEA. CALEA is only for access providers not web sites and information services.

Having the FBI say they don't seek to expand their existing authority while concurrently seeking to have CALEA apply to "information services" is nonsensical doubletalk.

Under CALEA and common sense you cannot be compelled to cough up keys you don't have so the only choice is to go after information services which is a breathtaking new grant of authority *explicitly* excluded from all existing CALEA legislation.

Note TFA also talks specifically about communications between peers without a centralized intermediary....ie direct communications between two XMPP clients. How the hell do you technically accomplish this without fundementally turning the Internet and general purpose execution environment into a locked down police state?

LEA needs to come to terms with the fact they don't get to wholesale easedrop on all communication in clear violation of the law anymore. Its not like they can't already get a warrant for emails from messaging providers and its not like we don't already have fucked up legal regimes like the third party doctrine which effectivly bypasses our rights to privacy when our information is stored on third party systems.

Part of the problem is everytime the government decides to invent absurd concepts out of thin air like free reign on emails > 180 days or grant immunity from civil action when telcoms break existing law more and more people and technologists deploy more and more encryption by default. SMTP between mail systems, IMAP..etc now often using TLS by default..etc. Part of this is government getting what it deserves for acting more like a nation of kings rather than a nation of laws.

It is hard for me to understand with the blessing that is facebook and the rise of massive messaging providers why LEA continues to complain. Full visibility into virtually all bit torrent downloads... They actually have it better than ever before but nothing will ever be enough.

Re:Yeh, it is disappointing

[moeinvt]

I believe the OP was making the comment in the context of civil liberties. There is no way to frame this in a partisan way. The destruction of civil liberties is one place where the two parties always seem to find that wonderful spirit of bi-partisanship.

Hard to believe, but Obama's record on civil liberties is even worse than that of Bush. He has not only perpetuated, but expanded the Bush Administration's radical policies of executive power and state secrets. Bush illegally detained U.S. citizens without charge or trial, Obama is arbitrarily assassinating American citizens without charge or trial.

Obama has re-authorized the Patriot Act multiple times, he voted for the FISA revisions Act(telecom immunity) and also signed the 2012 NDAA. His "promise" not to use it is absolutely meaningless and could be broken with no repercussions.

Healthcare reform? More like "big handout to insurance and pharmaceutical industries".
Killed Bin Laden? Led the raid and personally pulled the trigger did he?
Out of Iraq? On the Bush time-table and only because Iraqi government refused to sign a new SOFA.

A "two sides" view of the world may relieve you of the labor associated with thinking, but doesn't reflect reality.

Re:The bill is doomed to fail

[moeinvt]

The last election proved that the mainstream media determines who the "acceptable" candidates are and ensures that no 3rd party or independent candidate has any hope of winning. The people are then given the illusion of choice in which they pick the lesser of two jackasses.

Obama? Romney? Might as well flip a damned coin to decide which banker-owned, neocon, authoritarian scumbag gets to be president.