National Security Draft For Fining Tech Company "Noncompliance" On Wiretapping

Jeremiah Cornelius writes with what looks to be part of CISPA III: Children of CISPA. From the article: "A government task force is preparing legislation that would pressure companies such as Facebook and Google to enable law enforcement officials to intercept online communications as they occur. ... 'The importance to us is pretty clear,' says Andrew Weissmann, the FBI's general counsel. 'We don't have the ability to go to court and say, "We need a court order to effectuate the intercept." Other countries have that.' Under the draft proposal, a court could levy a series of escalating fines, starting at tens of thousands of dollars, on firms that fail to comply with wiretap orders, according to persons who spoke on the condition of anonymity to discuss internal deliberations. 'This proposal is a non-starter that would drive innovators overseas and cost American jobs,' said Greg Nojeim, a senior counsel at the Center for Democracy and Technology. 'They might as well call it the Cyber Insecurity and Anti-Employment Act.'"

Comments

FBI's general counsel - having a laugh?

[Fluffeh]

'We don't have the ability to go to court and say, "We need a court order to effectuate the intercept."...

Can this guy be serious? The FBI doesn't have the ability to go to court and ask for a court order allowing them to listen in on conversations? Wow. Just utterly wow.

Re:FBI's general counsel - having a laugh?

[nbauman]

'We don't have the ability to go to court and say, "We need a court order to effectuate the intercept."...

I think he means, "Without a reasonable suspicion that a crime has been committed, we don't have the ability to go to court ..."

Re:FBI's general counsel - having a laugh?

[Mullen]

'We don't have the ability to go to court and say, "We need a court order to effectuate the intercept."...

Can this guy be serious? The FBI doesn't have the ability to go to court and ask for a court order allowing them to listen in on conversations? Wow. Just utterly wow.

That leads me to believe that the FBI just says this stuff so that a good chunk of the population, which does not understand the 4th Amendment or Court Orders in general, just buys into what they are saying, just so they can get it.

How the FBI intercepts anything without a warrant or court order and the evidence is not thrown out of court, is beyond me.

Re:FBI's general counsel - having a laugh?

[Schmorgluck]

Yeah, I mean, seriously. Every wiretaping scandal in the past years in the USA is due to non-compliance with due process. Only the judiciary branch can suspend the fundamental rights of individuals. That's what due process is for.

Re:FBI's general counsel - having a laugh?

[cdrudge]

Actually, what I think he means is that even if a court grants an order, if the company does not track or have in place a method to monitor communications, then they could be fined in an escalating fashion.

For instance, most ISPs track what address gets assigned to which customer via DHCP, but there have been some ISPs that either don't, or won't give that information out as it's not guaranteed accurate. The FBI could get a court order for the information, but if the ISP doesn't track it, they can just say they don't have it. With the draft, the court could levy a fine against the company that can't or won't implement the necessary logging of that information.

Re:FBI's general counsel - having a laugh?

[Jeremiah Cornelius]

Of course.

This is what is called "a limited hangout". They are already doing worse. This is to distract from that, and to send a discreet message to Google and Twitter that they function as outsourced, privatized intelligence bitches -- or else.

Re:FBI's general counsel - having a laugh?

[BitterOak]

Why do they need a court order anyway? I thought the NSA was tcpdumping (or flushing) the entire flow of data on the Internet into their multi-bazzillion dollar datacenter. This is what happens when peoples jobs depend on the lawmaking industry.

Problem is, companies like Facebook and Google (the two mentioned in the summary) have been migrating to SSL over that past few years. https is the default means for connecting to Facebook now, and it has been an option for Google now for a couple of years. The more people use SSL, the less these "tcpdumps" are effective. This is why the feds need to go to Google or Facebook to get this information. Interesting that Skype wasn't mentioned.

Re:FBI's general counsel - having a laugh?

[Jane Q. Public]

"The police walk into your telephone switch room with a warrant, you let them listen. That's much much older than CALEA, that's only 20 years old."

That's pretty irrelevant, though, because with telephones, tapping is pretty darned easy. But with other technologies it has NEVER been possible to "just listen in"... it just wasn't built in.

That's not "refusal", it's simply not building something in a way that expressly caters to the police. And I don't give a damn. The police don't have a right to run the tech world.

If they can't keep up, tough shit.

Re:FBI's general counsel - having a laugh?

[ganjadude]

the FBI's general counsel. 'We don't have the ability to go to court and say, "We need a court order to effectuate the intercept." Other countries have that.'

Last time I checked, that was always a selling point of this country

Re:FBI's general counsel - having a laugh?

[Jane Q. Public]

"Wiretap warrants require a lot more than just reasonable suspicion of a crime, though. "

Absolutely. They require probable cause, which means real evidence. Of course, then there are the secret rooms the government built into some telco offices that simply siphon off data without anybody's knowledge or consent. Those are established fact... they are the whole reason Congress had to give telcos "immunity" for passing on the information. But as far as I know, there still isn't a law that allows the government to do it legally or constitutionally.

"Wiretap laws were written to fit the idea that phone companies were simple carriers who would respect the integrity of customer's conversations, and since they didn't provide services themselves, people had a reasonable expectation of privacy."

It's not that they didn't provide services. They didn't provide content. As the courts have ruled: there is a lesser standard of evidence needed for telephone records (who called who, and when, for example) than there is for the content of the telephone conversation (wiretap).

But this brings up a good point. Telcos were (FCC Regulations) classified as Title II "Common Carriers". I.e., they provide the call service, but are strictly forbidden from intercepting or interfering with the content (conversation) without a warrant.

It is quite possible to classify and regulate Cable companies and other ISPs as Title II Common Carriers. In fact, the FCC has wanted to do it for decades. But lobbyists got Congress to pass a law specifically excluding ISPs from Common Carrier status. That was one of the biggest mistakes of the last few decades.

The solution: get Congress to remove the exclusion from ISPs. Then the vast majority of your privacy concerns go away, virtually overnight: it will then be prohibited for ISPs (or anybody, including usage trackers) from monitoring your activities without a warrant. Most of the major privacy and security concerns surrounding the Internet simply disappear.

Sure, there will still be a few criminals doing it now and then. But criminals tapped (probably still tap) telephones, too. But the big problem -- government and corporations -- will be forced to leave it alone.

Re:FBI's general counsel - having a laugh?

[Anonymous Coward]

Feds have had the ability to target SSL interception for years. Hell, even I had it it in a micro-corp I ran IT at four years ago.

It's available as a commercial off-the-shelft product, and the law enforcement versions have the right connections to 'just work'. THink about that for a minute, and if you don't grok it, go install some SSL Observatory plugins.

Doing /driftnet/ style SSL inspection is another problem altogether.

And that tells you something about the types of intercepts they're having trouble with.

They're not only mining shit when they don't even have a suspect in mind. They're so used to it that they want it to be illegal to make it difficult.

Re:FBI's general counsel - having a laugh?

[gnoshi]

Wait, just so I'm clear: you're saying that law enforcement has the ability to do one of the following:
1. Generate an SSL certificate trusted by the browser (i.e. using a CA which is trusted by the browser) and 'MITM' the connection
2. Use an SSL certificate which doesn't derive trust from a trusted CA, but prevent the browser from notifying the user that the certificate is invalid
3. Has the actual certificate of the server the traffic to which they want to interept

I guess they could also just be intercepting using untrusted certificates and hoping people ignore it - and most probably would.

Re:FBI's general counsel - having a laugh?

[drinkypoo]

It is quite possible to classify and regulate Cable companies and other ISPs as Title II Common Carriers. In fact, the FCC has wanted to do it for decades. But lobbyists got Congress to pass a law specifically excluding ISPs from Common Carrier status. That was one of the biggest mistakes of the last few decades.

Sigh. How could you get everything else right, and get this so very wrong? There was no mistake involved. They did precisely what they wanted to do. They saw that all communications would eventually move to the internet, so they gave themselves broad-reaching control over it so that they could perform warrantless wiretapping and exert other forms of control as well.

Make no mistake. Exclusing ISPs from common carrier status was not a mistake. It was a deliberate and evil decision specifically intended to support warrantless wiretapping and suppression of free speech.

Rights are inconvenient

[Anonymous Coward]

The 4th Amendment is getting in the way of FBI evidence-gathering.
Good; that's what it's for.

Re:Rights are inconvenient

[Sarten-X]

No, the fourth amendment is there to make sure that investigations are actually investigating something reasonable, rather than just harassing somebody the officers don't like.

No,

[gatfirls]

They're whining that companies don't drop everything end change their business model to a law enforcement intelligence and evidence gathering organization at their request. *This* is "big government"; part of your business model has to include an Open API to the government with a real time feed to help them do their jobs. It would be hilarious if their response could be to allow them to access the petabytes of information and find the needle in the universe of needles themselves.

Amazing...

[Darkness404]

Its amazing that even with a court system that bends over backwards to help "law enforcement" agencies, they still think they need even more ways to violate basic rights.

Its really amazing what has happened in the last 30 some odd years, to see a nation which used to truly be one of the freest in the world to now only paying lip service to freedoms. It used to be that if you wanted freedom, you came to the US, now its becoming increasingly obvious that if you value freedom, moving out of the US is the way to go.

Re:Amazing...

[Darkness404]

Yeah, I certainly can believe it.

There is a huge disconnect between how countries are portrayed in the media and how they actually are. I mean, who would have thought back in the "cold war days" that someone would flee France for Russia for economic freedom!

What people think they believe in and what they actually believe are two separate things. I remember talking with my grandparents that they were scared that Obama would put the country under martial law, and then when Boston basically went under martial law, they praised the police and thought it was great what they were doing!

Meanwhile, a workplace death = $1000

[SuperBanana]

Just a reminder that OSHA and EPA fines, when they happen even under the most egregious circumstances, typically result in fines that barely break four digits.

The FBI's testimony on "Going Dark"

[blahblahwoofwoof]

Respectfully submitted: Did anyone bother to read the FBI's actual testimony, which was linked in the WaPo article?

http://www.fbi.gov/news/testimony/going-dark-lawful-electronic-surveillance-in-the-face-of-new-technologies

Note the date of the testimony: February 17, 2011
This has been on the burner for a while now.