Slashdot Mirror

← Back to Stories (view on slashdot.org)

Congress Passes Bill Allowing Warrantless Forfeiture of Private Communications

Posted by timothy on from the stinkin'-badges-apparently-suffice dept.

Prune writes Congress has quietly passed an Intelligence Authorization Bill that includes warrantless forfeiture of private communications to local law enforcement. Representative Justin Amash unsuccessfully attempted a late bid to oppose the bill, which passed 325-100. According to Amash, the bill "grants the executive branch virtually unlimited access to the communications of every American." According to the article, a provision in the bill allows “the acquisition, retention, and dissemination” of Americans’ communications without a court order or subpoena. That type of collection is currently allowed under an executive order that dates back to former President Reagan, but the new stamp of approval from Congress was troubling, Amash said. Limits on the government’s ability to retain information in the provision did not satisfy the Michigan Republican."

64 of 379 comments (clear)

  1. PRIVATE encryption of everything just became... by Karmashock · · Score: 5, Insightful

    ... mandatory. Seriously, what is the NSA going to do when the consequences of their arrogance propagate fully through our information culture? Eventually, everything of consequence is going to be held on private servers using private encryption keys that no one has access to but the users. The actual servers that push the information around are going to be shuffling around black boxes.

    --
    I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
    1. Re:PRIVATE encryption of everything just became... by Matt.Battey · · Score: 2, Informative

      Don't forget it is the NSA who approves what type of encryption are legal for citizens to own. In the case of AES relies solely that combining 256 random bits with 256 non random bits, sufficiently, is too difficult to decipher except for the most powerful computer systems.

    2. Re:PRIVATE encryption of everything just became... by Karmashock · · Score: 4, Informative

      They can't practically stop people from using any kind of encryption. Once the encryption procredure is handled entirely client side, how would you even know if the data was encrypted to spec unless you tried to decrypt it? And that's an awkward thing to admit to people that are assuming your service doesn't even try to do that.

      Really, the whole NSA mission against general data has a big expiration date hanging on it. The cloud concept is obviously dead in the water in the long term unless the encryption keys and engine is kept client side. And are the terrorists of the future really going to be sending their terrorist plots over email and conventional cell phone calls? I can think of hundreds of ways to send information of an extremely criminal and national security relevant nature... completely anonymously... forever.

      The only reason they're getting anything now is because our enemies are computer illiterate. That is like relying on your enemy being literally illiterate... forever. It isn't going to happen.

      The whole thing is a giant waste of time and money. IF they had half a clue, they'd do their best to convince everyone that they're not actually going to wire tap everyone secretly. I know they say that all the time but they're not very convincing at it are they? Exactly. To be convincing, they need to be subtle. Which means the giant data centers and big laws flowing through congress are the opposite of what they should be doing IF they had a clue.

      But they quite clearly don't have a clue so they're just going to spend billions of tax payer dollars to accomplish jack shit. As usual.

      --
      I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
    3. Re:PRIVATE encryption of everything just became... by AaronLS · · Score: 3, Informative

      Not disagreeing with you, but want to clear up what it means to make cloud storage, or any type of server storage, secure and inaccesible from court orders:

      In the case of dropbox, data is stored encrypted, but the server software holds the encryption keys so it can serve the data to clients unencrypted. This means subpeanas and other legal/law enforcement actions can access the data by going to the server operators, who likely will not challenge the order.

      If you instead encrypt the data client side before you send it to the server, then everyone who accesses the data must also have the key.
      What if you want to revoke access for one person? You have to download the data client side, decrypt/re-encrypt with a new key, reupload, provide key to remaining sharers. So this technique only really works for data that you do not share, i.e. just your personal stuff, and is essentially what people do now when they encrypt data before uploading it to dropbox.

      Asymmetric techniques don't really apply here unless you're only sharing with one party. You combined your private key and their public key to encrypt the data, then only they can decrypt it. This does not work when dealing with 3 or more parties, unless some are going to share the same key for one side of the asymmetric encryption, in which case you're back to the same problem we had with sharing a symmetric key.

    4. Re:PRIVATE encryption of everything just became... by mi · · Score: 4, Informative

      Don't forget it is the NSA who approves what type of encryption are legal for citizens to own.

      There is no illegal encryption — not in the US. You can use anything you can get your hands on.

      Now, getting your hands on something, the NSA can't break, may be difficult — because they have sabotaged efforts to develop strong crypto. But not because it is illegal.

      That said, the existing freely available software — including OpenSSL — can be used properly to defeat would-be spooks. We know this — and the observation is confirmed by occasional stories on how the government leans on companies to reveal the private keys. If they could break the encryption itself, they wouldn't be demanding keys...

      --
      In Soviet Washington the swamp drains you.
    5. Re:PRIVATE encryption of everything just became... by Karmashock · · Score: 2

      Never going to happen. The banks at the very least wouldn't allow it.

      --
      I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
    6. Re:PRIVATE encryption of everything just became... by Matt.Battey · · Score: 2

      Today on CNN, the commentators after the Brennan press conference said that the CIA was correct in saying that no non-bad-guys were killed by drone strikes. That's because the CIA redefined bad-guys to be any human of fighting age (13-60). So, that means that Grandma and your kid brother are free to use encryption, because they definitely aren't terrorists. They get to keep their shoes on at the airport, so there you go!

    7. Re:PRIVATE encryption of everything just became... by Karmashock · · Score: 2

      You're assuming it is either/or.

      You have per client access rules and passively encrypt everything. What is more, the encryption keys can be held on office thin clients that transparently download the decryption engine and keys from an onsite server which likewise can serve both to remote users as part of their login script.

      Non-technical people won't even know it is happening. Technical people will of course. If you want to keep things just a bit more secure, you can have remote clients RDP into a Terminal server that retains the keys and engine in the office such that neither ever leave the office.

      None of this is complicated. I could set all this up myself fairly quickly. You can even double encrypt things if you want. Why tell dropbox you're even using your own encryption? No reason to do that. Just upload encrypted files and have them encrypt them again. It is all data.

      --
      I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
    8. Re:PRIVATE encryption of everything just became... by Karmashock · · Score: 2

      Not at all. I can think of several types of encryption that are not decipherable in any reasonable amount of time or with any reasonable amount of computing power. Even accounting for moore's law there are some very strong encryption methods that render the data so hard to decrypt that it is worthless to anyone without the key.

      I even know of at least one that is literally impossible to decrypt. Like... you would need to be literally god and able to bend reality around your finger to break it.

      Look, you don't need to make it unbreakable in most cases. You just need to make it so hard that they'll never bother.

      I can think of a few that are easily that hard and will be that hard for generations. And if I wanted to make something that no one could break even with a billion years of trying... I could do that as well.

      Look at the statue in front of the NSA. It contains 4 ciphers. The first 3 have been broken. The last one has not... by anyone. Type unbreakable codes or ciphers into google and see what comes up. There are lots of examples of codes that have never been broken. And that is the extreme response. I don't even need to do that. I just need to make it hard enough.

      --
      I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
    9. Re:PRIVATE encryption of everything just became... by AaronLS · · Score: 2

      Someone could probably make a business of exactly the architecture you describe, providing a small onsite appliance that does this orchestration. So you use their cloud storage solution, and they provide an architecture that guarantees only your onsite appliance has the keys capable of decrypting the data.

    10. Re:PRIVATE encryption of everything just became... by AaronLS · · Score: 2

      It doesn't. As far as I can tell from his vague description of XOR'ing "random bits" with "nonrandom bits", he's talking about a very specific mode of using AES, which is OFB or CTR. In both cases it is clearly documented that reusing the key stream would destroy security. As long as you follow the specification for these modes it is secure.

    11. Re:PRIVATE encryption of everything just became... by Anonymous Coward · · Score: 3, Interesting

      Why not use the protocol that PGP uses? The data is encrypted with one symmetric key that is unique to each packet or archive. Then copies of that symmetric key are encrypted with each party's public key. So, the sender sends to nine others, there are ten public keys attached that can decrypt the data's volume key, assuming the sender wants to retain the ability to read the contents.

      The hard part is making sure the keys belong to the right people. However, this isn't that difficult. That is what keysigning parties and a web of trust is for. In fact, because a keysigning party is about validation, just handing every guest a printed sheet showing people's key ID and thumbprint, then having the guests cross-check them and physically tick off the ones they have vetted is good enough.

      I once worked on a project for a company that had multiple offices for messaging around the globe. All messages were encrypted with the receiver's key and had an expiration date. They were dropped into a message pool, propagated to the other sites. The receivers had special software which looked for their key ID, pulled messages out, and the user could decrypt them at their leisure. Since the data was pushed out similar to NNTP, only the site where the message originated from knew who the sender was, because it was just a part of the changes propagated to the other sites. To save space, all messages expired after a time.

      The result of this was a messaging system that was secure, and was plausibly deniable. The sender and receiver got their messages, but the sending site didn't know where the receiving site was, and vice versa.

      This was done internally because one of this startup's site was in a very repressive country (no, NOT the US or the UK...), and needed to communicate securely and freely about some topics.

    12. Re:PRIVATE encryption of everything just became... by currently_awake · · Score: 4, Insightful

      Private spying gets you information, public spying gets you intimidation. Possibly they have changed their goals.

    13. Re:PRIVATE encryption of everything just became... by mlts · · Score: 2

      Incorrect. The NSA/NIST produce official, standardized versions of crypto libraries (which is a good thing because there are a lot of people who are clueless about the math principles behind crypto, and would use something braindead like ECB, or if hashing passwords, not bother with a salt.)

      In the early 1990s, there was the Clipper chip that would have Skipjack loaded onto it on a secure site. This was something cryptographers were worried about because once that chip became common, the other shoe would drop, which was to make crypto illegal.

      There were attempts to make crypto illegal. Around 1991, the honorable senator from Connecticut, Joe Lieberman, was trying to pass bills to make encryption illegal, which is why PRZ wrote PGP 1.0 (and subsequent versions) in the first place, so there was a tool out there, legal or not, to protect people.

      As it stand now, whatever encryption algorithm I use is legal here in the US. Realistically, a mainstream algorithm is a good choice since there are a lot of homegrown ones which would get easily broken by a decent cryptographer.

    14. Re:PRIVATE encryption of everything just became... by Frobnicator · · Score: 2

      PRIVATE encryption of everything just became mandatory.

      Go look back at the bill, start at page 22.

      Observe that unencrypted communications can be retained for five years. But any encrypted communications can be kept indefinitely.

      Also note that the law doesn't say anything about who enciphered it nor about if they are able to decipher it. If it was encrypted at any point along the journey it qualifies for unlimited retention.

      --
      //TODO: Think of witty sig statement
    15. Re:PRIVATE encryption of everything just became... by towermac · · Score: 2

      No, that's what happened. And when you don't have that random plane, you let your friends and allies die.

      Or give up the only weapon you have that is working, when your ships and planes and soldiers are losing. That's how you lose a war.

      I'm just glad I wasn't one of those 20 people. Dang. Because they did a good job, I don't have to know what that feels like.

    16. Re:PRIVATE encryption of everything just became... by colinb8 · · Score: 2

      You can Google for "Churchill Coventry dilemma" but make sure you read the sober articles, not the conspiracy theories. As it happens, when I just Googled the top five links all deny that Coventry was deliberately sacrificed.

      For a short trustworthy account of Ultra I suggest "Top Secret Ultra" by Peter Calvocoressi.

      http://en.wikipedia.org/wiki/Coventry_Blitz
      ... while Churchill was indeed aware that a major bombing raid would take place, no one knew what the target would be.

      Peter Calvocoressi was head of the Air Section at Bletchley Park, which translated and analysed all deciphered Luftwaffe messages. He wrote "Ultra never mentioned Coventry... Churchill, so far from pondering whether to save Coventry or safeguard Ultra, was under the impression that the raid was to be on London."

      Scientist R. V. Jones, who led the British side in the Battle of the Beams, wrote that "Enigma signals to the X-beam stations were not broken in time," and that he was unaware that Coventry was the intended target. Furthermore, a technical mistake caused jamming countermeasures to be ineffective. Jones also noted that Churchill returned to London that afternoon, which indicated that Churchill believed that London was the likely target for the raid.

      http://www.winstonchurchill.org/learn/myths/myths/he-let-coventry-burn
      ... What did Churchill know and when did he know it? The most succinct summary came from one of Churchill's private secretaries, John Colville, in his book, The Churchillians (London, 1981), page 62: ''All concerned with the information gleaned from the intercepted German signals were conscious that German suspicions must not be aroused for the sake of ephemeral advantages. In the case of the Coventry raid no dilemma arose, for until the German directional beam was turned on the doomed city nobody knew where the great raid would be. Certainly the Prime Minister did not. The German signals referred to a major operation with the code name "Moonlight Sonata." The usual "Boniface" secrecy in the Private Office had been lifted on this occasion and during the afternoon before the raid I wrote in my diary (kept under lock and key at 10 Downing Street), "It is obviously some major air operation, but its exact destination the Air Ministry find it difficult to determine." ''

  2. Over to you, SCOTUS by Tokolosh · · Score: 5, Insightful

    If you do not declare this unconstitutional, immediately and unambiguously, then you have failed The People.

    Your credibility is already hanging by a hair.

    --
    Prove anything by multiplying Huge Number times Tiny Number
    1. Re:Over to you, SCOTUS by Anonymous Coward · · Score: 3, Informative

      The same SCOTUS that just said your employer can order you to do 25 minutes of security checks without compensation? The copyright extension SCOTUS? The fascism rubber-stampers in black robes? Good-luck.

    2. Re:Over to you, SCOTUS by XxtraLarGe · · Score: 2

      Don't worry, I'm sure President Obama won't sign this bill.

      --
      Taking guns away from the 99% gives the 1% 100% of the power.
    3. Re:Over to you, SCOTUS by BarbaraHudson · · Score: 5, Insightful

      What if those communications are contained in your phone, tablet, laptop or home computer. Sounds like they can seize all that without a warrant as well ...

      --
      "Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
    4. Re:Over to you, SCOTUS by Archangel+Michael · · Score: 2

      Actually, the SCOTUS isn't the final arbiter, the people are. The DoI clearly sets forth a framework where tyrannical government can be overthrown.

      I define Tyranny as any government serving its own interest (the interest of the Government itself) over that of the people. Yes, we have an elected tyranny, not because of the elected officials (which we change) , but because the bureaucracy that powers the real "government" isn't elected.

      This is the police state that serves itself.

      --
      Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
    5. Re:Over to you, SCOTUS by Sir_Eptishous · · Score: 2

      Don't worry, the Roberts Court will be fine with this.

      --
      We play the game with the bravery of being out of range
    6. Re:Over to you, SCOTUS by mythosaz · · Score: 3, Insightful

      While I disagree with the 25-minute screenings, I'm not paid for walking through security, taking the elevator and logging into my workstation either.

      SCOTUS merely maintained what was already in the Portal to Portal act: that things relevant to the job itself (e.g. butchers sharpening their knives) got paid, and that security searches were analog to time spent driving to work or taking the a long flight of stairs to your office.

      Integrity Staffing Solutions, Inc. are, unquestionably, a bunch of shit-bags who should move the time-clocks to the other side of the sometimes up-to 25 minute screening machines, but it's not exactly like SCOTUS is out to screw people on this one. Someone in risk management there realized that they'd still be more profitable with the tiny bit of bad press and some legal fees than to pay overtime.

      Eat a bag of dicks Integrity Staffing Solutions, Inc. -- but I don't blame SCOTUS.

    7. Re:Over to you, SCOTUS by mythosaz · · Score: 4, Informative

      Vote was reasonably even across party lines.
      https://www.govtrack.us/congre...

      71% of (D) voted for it.
      80% or (R) voted for it.

      9 congresscritters didn't vote, split 5(D), 4(R).

    8. Re:Over to you, SCOTUS by jedidiah · · Score: 2

      Oh. I will blame SCOTUS.

      This isn't something that's an inherent part of getting to work. This is an extra burden specifically put in place by the employer. It is a REQUIREMENT demanded of employees. It doesn't matter if it is "relevant" to the job or not.

      If your employer says you have to stand on one leg for 25 minutes before and after a shift, that's time that they owe you in compensation. They are stealing your time and the gatekeepers are allowing it.

      --
      A Pirate and a Puritan look the same on a balance sheet.
    9. Re:Over to you, SCOTUS by Lunix+Nutcase · · Score: 2

      Plenty of contemporaries said that the Patriot Act would to lead all the things it has. That you're ignorant of them does not mean they didn't exist. The ACLU was all over trying to fight against it due to all its onerous provisions. Michael Moore, love him or hate him, was all over it at the time in his film Fahrenheit 9/11. But at the time many of these criticisms were shot down as being overreactions.

    10. Re:Over to you, SCOTUS by mythosaz · · Score: 2

      Then blame the SCOTUS of 1974, who already decided this case.

  3. Re: PRIVATE encryption of everything just became.. by Anonymous Coward · · Score: 4, Funny

    But cloud is great, right? They told me cloud is great!

  4. Ok Justin by Anonymous Coward · · Score: 5, Insightful

    I have actually met this guy in person, I have nothing against him, but holy shit. Before he actually cared and I would have backed him up 100% opposing this without question. But he seems to have gone for the republican kool aid and somehow wants to blame this on.... the executive branch.

    Look man, the executive branch doesn't make laws and the law enforcement agencies that report to it already had this power. This is congress who isn't part of the executive branch passing the law. Don't go in there a decent guy and come out a soulless husk spewing what you hear on Fox News. Don't try to shift blame on that 'Obama' fictional character everyone seems to want to. You're better than that.

    1. Re:Ok Justin by wiredlogic · · Score: 3, Informative

      and the law enforcement agencies that report to it already had this power.

      The summary is wrong. The unlimited, open-ended collection powers enacted by EO12333 only apply to government employees and employees of contractors subject to background investigation for national security reasons.

      --
      I am becoming gerund, destroyer of verbs.
  5. Congressman Amash’s letter sent to Colleague by Anonymous Coward · · Score: 5, Informative

    Dear Colleague:

    The intelligence reauthorization bill, which the House will vote on today, contains a troubling new provision that for the first time statutorily authorizes spying on U.S. citizens without legal process.

    Last night, the Senate passed an amended version of the intelligence reauthorization bill with a new Sec. 309—one the House never has considered. Sec. 309 authorizes “the acquisition, retention, and dissemination” of nonpublic communications, including those to and from U.S. persons. The section contemplates that those private communications of Americans, obtained without a court order, may be transferred to domestic law enforcement for criminal investigations.

    To be clear, Sec. 309 provides the first statutory authority for the acquisition, retention, and dissemination of U.S. persons’ private communications obtained without legal process such as a court order or a subpoena. The administration currently may conduct such surveillance under a claim of executive authority, such as E.O. 12333. However, Congress never has approved of using executive authority in that way to capture and use Americans’ private telephone records, electronic communications, or cloud data.

    Supporters of Sec. 309 claim that the provision actually reins in the executive branch’s power to retain Americans’ private communications. It is true that Sec. 309 includes exceedingly weak limits on the executive’s retention of Americans’ communications. With many exceptions, the provision requires the executive to dispose of Americans’ communications within five years of acquiring them—although, as HPSCI admits, the executive branch already follows procedures along these lines.

    In exchange for the data retention requirements that the executive already follows, Sec. 309 provides a novel statutory basis for the executive branch’s capture and use of Americans’ private communications. The Senate inserted the provision into the intelligence reauthorization bill late last night. That is no way for Congress to address the sensitive, private information of our constituents—especially when we are asked to expand our government’s surveillance powers.

    I urge you to join me in voting “no” on H.R. 4681, the intelligence reauthorization bill, when it comes before the House today. /s/

    Justin Amash
    Member of Congress

  6. At least there's no pretense here... by Kazoo+the+Clown · · Score: 5, Insightful

    No pretense they have any respect for the Constitution, due process or the privacy of citizens. There's no doubt everyone will have to take matters into their own hands now. No doubt they'll make that illegal too, at which point only criminals will have any privacy.

  7. That's not how it works by Sycraft-fu · · Score: 4, Informative

    The court can't just jump up and say "We don't like that, it goes out." They have to follow procedure which means a challenge has to appear in front of them. That challenge can also only be brought by someone with standing, meaning that this law had a negative impact on you somehow.

    That's one of the reasons the government loves the secret gathering so much, makes it harder for it to get challenged. If you can't show this harmed you, then you can't fight it in court.

    So someone has to be impacted by this, challenge it, and it has to be appealed up to the SC. Then and only then do they rule on it.

  8. Sid Meier is a time traveler by C.+Mattix · · Score: 4, Insightful

    I get to break this out again:

            As the Americans learned so painfully in Earth's final century, free flow of information is the only safeguard against tyranny. The once-chained people whose leaders at last lose their grip on information flow will soon burst with freedom and vitality, but the free nation gradually constricting its grip on public discourse has begun its rapid slide into despotism. Beware of he who would deny you access to information, for in his heart he dreams himself your master.
                    Commissioner Pravin Lal, "U.N. Declaration of Rights"
                    Accompanies the Secret Project "The Planetary Datalinks"

  9. Everyone who blamed Bush for everything... by FlyHelicopters · · Score: 4, Insightful

    Obama is just as bad... that doesn't excuse Bush from his errors, and he had many...

    But frankly, if Obama doesn't Veto this, then he is the same scum of the Earth and frankly both sides need to be tossed out on their bums...

    Voting third party may not bring in "better", but it will at least do SOMETHING different than the Repubs and Dems who are different sides of the same coin...

    1. Re:Everyone who blamed Bush for everything... by aardvarkjoe · · Score: 2

      It doesn't matter, he can't veto it. 325-100 is a veto-proof passage.

      My understanding is that he can. Congress could then override the veto with a 2/3 majority of both the House and the Senate, but at least the President would be on record that he refused to approve the bill.

      --

      How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
  10. Re:Congressman Amash’s letter sent to Collea by Qzukk · · Score: 4, Interesting

    I urge you to join me in voting “no” on H.R. 4681, the intelligence reauthorization bill, when it comes before the House today.

    Thank you for posting the bill number, since neither slashdot nor the hill thought we should be able to look it up and see who voted for this bullshit.

    It appears in the Senate it was passed by voice vote by a bunch of cowards that did not want their name attached to the bill.

    --
    If I have been able to see further than others, it is because I bought a pair of binoculars.
  11. Cutting through the alarmist deceptive stuff. by Verdatum · · Score: 3, Insightful
    Here's the important part: "That type of collection is currently allowed under an executive order that dates back to former President Reagan, but the new stamp of approval from Congress was troubling, Amash said."

    In other words, the only issue he has with this bill is that it acknowledges an Executive Order is in place. It doesn't even particularly bless it. Nothing is changing other than a slightly-less tacet approval of an order that has been around for decades. It's not a terribly long bill, check it out yourself

  12. Re: PRIVATE encryption of everything just became.. by roc97007 · · Score: 3, Insightful

    Unfortunately, I suspect that anyone who is not a geek or privacy advocate still believes it.

    --
    Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
  13. Re: PRIVATE encryption of everything just became.. by Anonymous Coward · · Score: 5, Insightful

    Anyone who is a geek and/or privacy advocate never believed it.

  14. Re: PRIVATE encryption of everything just became.. by MobSwatter · · Score: 2

    The NSA: "Made in China"... Full communist cultural adoption... Next: Human sterilization lotteries...

  15. Re: PRIVATE encryption of everything just became.. by Karmashock · · Score: 4, Informative

    Good thing geeks are responsible for building the entire information backbone.

    Look, decoding things client side isn't expensive. It isn't a big deal. All you have to do is retrain a copy of the decryption engine and key client side. Which means if you're running a large company network that hosts all company files on data centers in the "cloud" then all the IT guy has to do is maintain ONE tiny server client side that serves those two things to the clients. Which they download as part of their login script... etc etc etc.

    It isn't hard. And when that is in place... assuming the NSA has total control over the data center that is the cloud... what exactly do they have? Jack and shit.

    --
    I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
  16. When everything you say or do by azav · · Score: 2

    When everything you say or do is recorded by the authorities, do you really want to be part of that world?

    --
    - Zav - Imagine a Beowulf cluster of insensitive clods...
  17. Glad to see this pushed through by hackshack · · Score: 5, Informative

    So they can't settle on a decent healthcare system for us, but when it comes to spying on us... push it right through!

    --
    Wrists killing you? Not in 2 weeks. Learn Dvorak.
  18. Re:Congressman Amash’s letter sent to Collea by Anonymous Coward · · Score: 2, Insightful

    I hope that most of the congress voted in favor of this out of ignorance. It appears to have passed through both the house and senate under the guise of a routine reauthorization of existing process.

    My hope is that the statutory authorization of warrantless wiretapping was surreptitiously added in the hope that no one would notice. Much like the banking giveaway, the massive increase in individual campaign donations, and the de-legalization of marijuana in DC have been added to the big spending bill. I swear, it's like the election passed and these guys think it's time to celebrate the voters' exhaustion by sneaking in every possible trick while they can still blame it on "the other guys."

    My hope is that there are a lot of incompetent congresspeople and only a few bad ones in there trolling, and it saddens me that this is the best I can hope of my government. I hope they're incompetent, because the alternative is sickening.

  19. Re:Congressman Amash’s letter sent to Collea by Verdatum · · Score: 2

    Thanks for providing this, AC. I don't know what Mr. Amash is talking about. Section 309 doesn't grant any blessing of Executive Order 12333, or any other mechanism of collection. It just states that if any collection takes place without a court order, then it must be disposed of within 5 years with a few very-specific exceptions. The sky is not falling people. Do your research before you freak out based on alarmist stuff like this.

  20. Re: PRIVATE encryption of everything just became.. by aaaaaaargh! · · Score: 2

    Not if you're standing under it and it rains down in torrents.

  21. Re:Congressman Amash’s letter sent to Collea by Verdatum · · Score: 2

    Arg, link fail. I intended to link to the text of H.R. 4681 so you can read section 309 yourself.

  22. Who voted "YEA" to this crap? by MinamataHG · · Score: 4, Informative

    https://www.govtrack.us/congre...

    If your congressman voted YEA and you don't agree, write to him/her.
    They are representing you.

  23. Re: PRIVATE encryption of everything just became.. by currently_awake · · Score: 3, Informative

    A law giving the NSA authority to intercept all communications means that your corporate crypto server will be copied, giving them all your keys so they can decrypt everything. If you want security it must be done entirely at the client side, with only the client having the keys. Any central crypto means they get everything. Also you should assume Microsoft and Google are working for the NSA, so they can patch your OS to copy your client side keys to the NSA if required.

  24. Re: PRIVATE encryption of everything just became.. by Karmashock · · Score: 3, Informative

    You missed everything I said about keeping the keys and decryption engine private... didn't you? Read that again and then comment please... you'll sound less stupid.

    --
    I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
  25. Re:Congressman Amash’s letter sent to Collea by fnj · · Score: 2

    Ban the fucking voice vote, goddammit. It's only a rule of the Senate that allows it. The term does not occur in the Constitution.

  26. Fuck the government by AndyKron · · Score: 2

    Fuck the government

  27. Offensively arrogant by rickb928 · · Score: 2

    We really do have to throw them all out...

    --
    deleting the extra space after periods so i can stay relevant, yeah.
  28. Where are you going to keep your files?? by Taco+Cowboy · · Score: 5, Insightful

    You missed everything I said about keeping the keys and decryption engine private

    With NSA and all the spooks being given the blank check in snooping into every nook and cranny everywhere where do you think you gonna keep your files private ?

    How long you think your files can be safely kept private?

    The problem with the American government - no, not just the POTUS, not just the NSA, not just the Congress, not just the Court System, it's everything - is that it is turning into a totally uncontrollable monster, and it is getting uglier by the day

    --
    Muchas Gracias, Señor Edward Snowden !
  29. Holy fuck.... by sconeu · · Score: 2

    What part of

    The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

    does Congress not understand?

    --
    General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
  30. Re: PRIVATE encryption of everything just became.. by Frobnicator · · Score: 4, Interesting

    But cloud is great, right? They told me cloud is great!

    Yes, cloud is great as a convenience for you.

    It is also great as a convenience for NSA and other agencies. The text of the bill allows that anything that was encrypted can be kept indefinitely. If your web site says HTTPS then it is fair game for permanent governmental storage.

    Also, they can retain it forever for a number of reasons:

    From the bill now on its way to the President's desk: "(3)(B) A covered communication shall not be retained in excess of 5 years unless ... (ii) the communication is reasonably believed to constitute evidence of a crime ... (iii) the communication is enciphered or reasonably believed to have a secret meaning; (iv) all parties to the communication are reasonably believed to be non-United States persons;"

    #2 should be troubling. Does your communication (which is not limited to just email, but also includes web pages and any other data) have any evidence of a crime? Evidence that you downloaded a movie or software from a warez site, or looked at porn as a minor, or violated any of the policy-made-crimes that even the federal government has declared they are not countable? With an estimate of over 300,000 'regulations-turned-crime', plus laws that incorporate foreign laws (the Lacey Act's criminalization of anything done "in violation of State or foreign law"), pretty much anything you do probably violates some law somewhere in the world. Better preserve it just in case somebody eventually wants to prosecute you for that crime someday.

    #3 refers back to a vague definition of "enciphered" that does not just mean encryption. The "secret meaning" could be as simple as data inside a protocol, Who is to say that the seemingly random bytes "d6 0d 9a 5f 26 71 dd a7 04 31..." used as part of a data stream are really not an encrypted message? Better record it just in case.

    And of course #4, the law has a careful wording about communications between "non-United States persons". Considering the "internet of things", all those devices talking to other devices are not communications between United States persons. It was your camera (a non-United States person) communicating with a data warehouse (a non-United States person), so better exempt that from the 5-year retention policy as well.

    --
    //TODO: Think of witty sig statement
  31. Re: PRIVATE encryption of everything just became.. by Garridan · · Score: 2

    How are they going to copy information that isn't flowing over the lines?

    Simple. They patch your OS with a rootkit. They can make information flow over the lines, so long as it isn't airgapped. And an airgap is only so useful, as stuxnet shows.

  32. Re: PRIVATE encryption of everything just became.. by Zontar+The+Mindless · · Score: 2

    My read of #3:

    "Hi Mom, I baked a couple of really good pans of cornbread with the cornmeal you sent me" just might be code for "Hi Muhammad, received the PCX and both bombs are now ready". You can never be sure, right?

    --
    Il n'y a pas de Planet B.
  33. I wish I had a deeper, more meaningful response... by Loki_1929 · · Score: 3, Insightful

    But fuck these assholes. Fuck all of them; every one of them who voted for this shit. Fuck them regardless of their party or their stances on other issues, or their charity work, or their stupid kids, or their veteran status. Fuck 'em. Burn in Hell you pieces of shit.

    --
    -- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
  34. Laff... we're screwed by koan · · Score: 2

    Just shows what a POS Obama is as well, coming out and speaking as though he was concerned by surveillance, only to have this try to slip by.

    Panderer in Chief.

    --
    "If any question why we died, Tell them because our fathers lied."
  35. Re:Rude Bastard! by Karmashock · · Score: 2

    So you too have reading comprehension issues? Listen, idiots... I have no problem with people disagreeing with me. Disagree all day and I'll be just fine with it. But fail to read my post and then respond to your illiterate interpretation of my posts and I'm going to call you on your illiteracy.

    Take you for example. You are apparently under the impression that I "flew off the handle" because someone disagreed with me. Which is clearly idiotic since it is quite clear that I flew off the handle because the moron commenting on me didn't actually read my post at even a grade school level.

    If you are literally at the level of "run spot run" then please do the internet a favor and do not comment.

    Welcome to the internet.

    http://heeereswilly.ytmnd.com/
    Good day, sir.

    --
    I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
  36. Re: PRIVATE encryption of everything just became.. by Karmashock · · Score: 2

    Which means you're assuming they're going to passively hack every computer in the US and keep it a secret from all the people fiendishly looking for it. Good luck with that plan. The discrepancy between what the computer should be doing and what it is doing will be noticed. When it contacts IP addresses that it shouldn't, it will be noticed... etc. There is no way they'd get away with that for any extended period of time. Which means it would be all over the media and the only people that would allow the hack to stay in place would be people so clueless they don't even read newspapers.

    Utterly impossible to sustain... just no.

    --
    I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.