17 ms·

Patriot Act amendment needing a warrant for browsing history fails

402 points by thinkingemote 6y ago

woofcat 6y ago
I'm curious at how the article implies that DoH is going do anything. I'd imagine CloudFlare, etc. would comply with FBI requests just as much as your local ISP. Factor in co-operation from CDN's and really that covers a vast array of data that the US Government could access.
- tialaramex 6y ago
  The main practical problem is that the NSA and similar agencies currently collect absolutely everything. Regardless of warrants, constitutional amendments, or senators banging their fists on the table, these agencies operate with impunity and they know it. DoH pragmatically reduces their ability to conduct such global surveillance. "Pervasive Monitoring is An Attack". We speak of man's laws and nature's as though they were the same kind of thing but they really, really aren't. I can no more magically replay the session keys from last week's Wikipedia visit in response to a court order, a warrant or the US Constitution itself than I could dance on the surface of the sun if they required that. The idea here isn't that Public Enemy Number One today is protected from surveillance, but instead that you today are protected from the hypothetical surveillance of your past that might be authorised if some day you become Public Enemy Number One.
- quit32 6y ago
  For one cloudflare is a lot more reputable than most US ISPs. Cloudflare explicitly says "We committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours." https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/ If gov tried to force CF to change that they would likely put up a huge public legal fight to prevent it whereas ATT / Verizon and Comcast would bend over backwards to secretly comply while also simultaneously seeing if they could inject some ads into the pages you visited.
  - billme 6y ago
    Cloudflare is neither magically protected from secret US court orders, nor is there any reason to believe that data is not saved by the US.
  - lonelappde 6y ago
    Does CloudFlare have multiple external auditors verifying their claims?
    - jgrahamc 6y ago
      https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/ https://blog.cloudflare.com/announcing-the-results-of-the-1-...
    - quit32 6y ago
      Literally the next para in that blog - "we committed to retaining KPMG, the well-respected auditing firm, to audit our practices annually and publish a public report confirming we're doing what we said we would." In addition Mozilla put them through a rigorous process when selecting them as their default DoH provider which included them contractually agreeing to adhere to their stated policy. https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy
  - quit32 6y ago
    Also worth noting that cloud flare is a large driving force behind encrypted SNI which is the last nail in the coffin for putting ISPs in the dark when your average consumer is browsing the net. https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/ Basically when you connect over https using TLS 1.2 to a site that is hosted on a shared server or behind a load balancer, your browser must tell it in clear text which host name it is trying to connect to. Encrypted SNI in TLS 1.3 also encrypts this info such that if you are also using DoH or DNS over TLS to encrypt DNS query then the ISP can only see the IP of server you connect to which is often going to be a huge cloud provider's load balancer that might serve hundreds or more different sites throughout the day / at the same time.
badrabbit 6y ago
Actual terrorists(like 9/11 type, well funded) know better than to even touch anything digital for comms. They literally get a drone strike for having called a known terrorist or for going to a wedding other terrorists with cell phones go to. For home grown terrorism, how many school shootings happen when the people who know the shooter literally tell police/fbi beforehand about the state of the shooter. Are school shooters not terrorists? They have a social/political gripe and the terror is their way to get their voice out, avenge (like jihad) or inflict change. So why are they failing so bad even after almost 20 years of patriot act? Politicians don't want to be blamed because they know the next terrorist attack will happen soon and it can't be prevented,except the politicians that gut the patriot act will be blamed for it. On the flip side,information on voters,tracking them like this helps politicians
- lonelappde 6y ago
  Terrorism has been removed of its meaning since 2001. Terrorism means using violence or threat of violence to influence social or political decisions. Not everything bad is terrorism. A mentally ill person going on a murder-suicide rampage after beijg ignored by a girl is not a terrorist. A person acting in their self-interest in a way that contributes to systemic racism or oppression is not a terrorist. Hunting or threatening people of a certain race or gender or orientation or hobby to scare them and others away is terrorism. Blowing up buildings to pressure decision makers into a policy change is terrorism. Maybe manipulating a single individual via threats or minor violence could be considered small scale terrorism (but their are better words, like harassment or abuse or stalking or assault).
  - KittenInABox 6y ago
    > Terrorism means using violence or threat of violence to influence social or political decisions. So like the shooting of a black church by a white supremacist explicitly for the purposes of espousing white supremacy? > Hunting or threatening people of a certain race or gender or orientation or hobby to scare them and others away is terrorism. So like the lgbtq club shooting, or the black church, or the 1989 shooting specifically targeting women?
brenden2 6y ago
I do most of my browsing in private mode anyway. I'm usually pretty careful to never put things onto websites that I don't want people to find publicly as well. The US has no strong privacy protections, so you should just assume that nobody has your best interest in mind. This includes HN, Reddit, and the FAANG giants. Although Apple is probably the only one that isn't strongly incentivized to violate your privacy.
- TheAdamAndChe 6y ago
  The data collected is collected en masse at the ISP level. Using incognito mode won't do anything for these searches.
  - brenden2 6y ago
    This doesn't work so well when you a) disallow tracking cookies and b) don't use your ISP's DNS servers. I used to work directly with these big ISPs, and I can assure you they aren't very sophisticated. Even if they log every IP you send a packet to, and they know every domain that points to each of those IPs, they can't know exactly what you requested or which particular website you visited provided these websites use HTTPS.
    - snazz 6y ago
      If you're not using DNS over HTTPS, then they're still tracking your DNS queries regardless of which server you use.
      - brenden2 6y ago
        This is true, but it requires deep packet inspection, and that's something which usually isn't on by default. They might enable it for specific clients under some circumstances, but I haven't heard of ISPs logging that level of detail permanently. I suppose the could run a service that just inspects DNS packets, pulls out the domains, and correlates them with each client, but I haven't heard of that being deployed in the wild (although perhaps that's changed). Their DNS severs, however, and definitely doing this, and they sell that data to 3rd parties. TLS SNI also leaks the domain name, but again that would require deep packet inspection to extract and correlate with the clients. Definitely possible, but probably not deployed.
billme 6y ago
If the bill does not pass in any form, the Patriot Act dies — do not amended anything, let the Patriot Act bill die.
giffarage 6y ago
Between Https and VPNs, this seems ineffectual for people who actually want to stay hidden. Am I missing something?
- softwaredoug 6y ago
  Except the US is sadly notorious for weakening encryption standards. One common example is how it was hard for a long time to export strong encryption https://en.m.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.m.wikipedia.org/wiki/Export_of_cryptography_from_...
- lenlorijn 6y ago
  Metadata such as what domains/ip's are contacted can still be harvested.
  - nickbauman 6y ago
    And remember: metadata is everything. It makes the actual content of the communication discoverable and indexable. The information of what you're saying and doing is not actionable without being able to find it / categorize it at scale.
notthemessiah 6y ago
When we look at the kinds of things these surveillance powers are used for, it's a glimpse of how it's abused. Thanks to FOIA requests, we found that the Boston Regional Intelligence Center was using their surveillance capabilities to spy on Occupy Boston during the Boston Marathon that was bombed, despite the ostensible aim of the center being to coordinate local and federal intelligence capabilities and despite the FBI receiving a tip from Russia that the Tsarnaevs were up to something. If we want to make the world safer, we should focus on making responsible and strategic use of the intelligence we have than to grant new powers. http://www.justiceonline.org/unaware_of_tsarnaev_warnings http://www.justiceonline.org/unaware_of_tsarnaev_warnings
- nelaboras 6y ago
  There is probably also an issue of too much information. All these massive efforts generate data that is barely ever used as the time and resources just aren't there.
  - komali2 6y ago
    Reminds me of how back in 2003 we were cracking jokes about how the FBI was still making their way through the 2000's 4chan posts.
- throwaway0a5e 6y ago
  > If we want to make the world safer, we should focus on making responsible and strategic use of the intelligence we have than to grant new powers. Always look at the incentives. The Boston Bombing intelligence "failure" is not a failure of intelligence. We got exactly what the incentives were set up to deliver. The system works, it's just not spec'd out to deliver what people think it is. A mostly law abiding protest group that dares loudly complain about the government "doing it wrong" is an actual threat to law enforcement because it is a threat to the status quo. The voters might listen to them. The voters might install politicians who make promises of "doing it right" which usually includes allocating resources on things other than law enforcement. Drug treatment instead of drug crime task forces for example. That's a real risk to law enforcement agencies and gets treated as such. On the other hand you have two dudes with some bombs. Worst case they kill a couple hundred people and make the public hate them in the process. Sure that makes you look like incompetent fools but the public already thinks of you that way so you don't lose anything. No politician is going to get elected on a promise of turning your organization upside down because you failed to catch some lone wolves. Maybe you can even find a way to blame someone/something else and get some extra power out of it. Those guys were not a real risk to the organizations tasked with stopping people like them and were likewise ignored. That said, as much as it pains me to defend the MA state police the failure mode of the status quo they have settled into is pretty benign. The false positive rate on terrorism is so high and they are so eager to LARP as combat troops that if they did thoroughly follow up on every tip they got they'd likely have a much higher body count than the real terrorists. Doing unethical things to maximize their incomes and minimize their work (the gripe most people have with the MA state police) is pretty harmless by comparison.
duxup 6y ago
I'm a bit impressed how close it was to passing.
- billme 6y ago
  Bill should not be passed in any form, since if it is not, Patriot Act dies.
- jellicle 6y ago
  Don't take that for actual closeness. In many votes including this one, Senators may want to vote against leadership but will only do so if permitted. So if, say, 5 more Democrats had insisted on voting yes to make the amendment pass, McConnell would have told 5 more Republicans that they were disallowed from voting against it, and the amendment would have failed by... one vote. The dynamic here is that Republican politicians often want to present themselves to constituents as being against the police state or big government, but the party/party leadership wants to pass measures such as this. So the individual politicians are accommodated to the extent that they don't interfere with the party passing what it wants. You see a similar dynamic in quite a lot of votes. TL;DR: McConnell knows how to count.
  - duxup 6y ago
    I don't doubt the premise can happen, I am not inclined to assume it is the case automatically.
diablo1 6y ago
Define 'your' browsing history. Where I live you can buy a SIM card with cash, load it with credit and surf on a 3G/4G network, without having to register the SIM or attach your legal name to it in any way. I can also encrypt my phone, turn on permanent incognito mode, disable Javascript, and have uBlock Origin running to stop trackers. Good luck trying to pin my legal name to a particular website visit. Then there's the fact that 3G/4G uses vague carrier-grade-NAT IPV4 addresses so countless others all share the same IP address enabling you to 'hide among the crowd' (providing the useragent is something common that many people use like Safari on an iPhone5)
- dgellow 6y ago
  > Where I live you can buy a SIM card with cash, load it with credit and surf on a 3G/4G network, without having to register the SIM or attach your legal name to it in any way. Where is that? My experience in Europe and Thailand is that I have to sign documents and show a proof of identity.
  - ryanlol 6y ago
    In Europe “I’m sorry, I didn’t take my passport with me, but I remember my passport number” has had a 100% success rate for me.
    - mindslight 6y ago
      So then you're committing fraud or whatever. Once again, law abiding people bear the burden while bogeyman-with-beard just gives a false number. One of the general difficulties with the government threat actor is that law abiding people have to thread the needle of both technical protection and legal requirements.
      - socks 6y ago
        Quoting your own true passport number is not fraud. Fraud would be supplying a fake passport number / fake passport / doctored photocopy.
foob4r 6y ago
I would be surprised if many of the common public believed that warrantless searches of anyone are reasonable, while exempting federal elected officials from the same law. Now's a good time to call you senator (if they voted against this) and tell them that they fucked up by weakening your rights and freedoms. Then, get a VPN or better use Tor as much as you can.
- billme 6y ago
  What? If this bill is not passed, Patriot Act dies, why would you want this bill to pass?
- rrtthu 6y ago
  If TOR had fiver-level speed I'd be on all the time. The trade off is just too high.
  - foob4r 6y ago
    True although it's getting better every day. I do use it frequently and do run a few relays, and that's probably the only way to improve it.
    - newscracker 6y ago
      Do you have any simpler resources on how to do it? If it were simpler to run a relay on a provider that allows it, and it doesn’t cost much (say $10 a month) to give Tor users a little more speed, that’d be helpful. The last time I looked at the documentation, it seemed quite involved and complex (of course, I wouldn’t want the security of Tor users to be compromised due to any misconfiguration). If there were something for Tor like Sandstorm for web apps or Algo for WireGuard, more people could run relays and help everyone.
      - foob4r 6y ago
        I use ovh (although the tor network is saturated with ovh) and https://tor-relay.co https://tor-relay.co ; literally takes 5 mins after vm is provisioned. Here's a giant list of hosts you can look into - https://community.torproject.org/relay/community-resources/good-bad-isps/ https://community.torproject.org/relay/community-resources/g... I spent maybe an hour researching based my in criteria. You can host just an exit (most helpful), or a couple of relays (aim for 100mbps+, and decent bandwidth). You can get a lot for $5/month for each relay.
bhauer 6y ago
I am absolutely no fan of Bernie Sanders. I disagree with him on a majority of policy matters. However, this popular media framing, which blames the failure of this amendment on Bernie Sanders, is unhinged. It's not just this Register article; you'll see the same sniping at Sanders specifically in most articles that carry a negative opinion on the PATRIOT Act. Being absent for the vote is shameful, sure. But how about laying the blame somewhere more meaningful? For example, on us Californians who re-elected Feinstein despite knowing she is absolutely abysmal on privacy. Californians like myself should carry this shame, not Sanders and Vermont voters. We Californians are sorry for voting so blindly and continuously re-electing terrible senators.
- varjag 6y ago
  It failed by one vote. If he did his damn job and showed up it could turn out different.
  - Floegipoky 6y ago
    As somebody else explained, if he had showed up to vote against it the amendment almost certainly would have still failed by 1 vote. The party whips would have just required one of the other "no"s to switch. The reality is that party leadership controls exactly what gets voted on and when, and to a large extent predetermines who is allowed to vote yes and no. The rest is just theater.
    - varjag 6y ago
      I must be obtuse, but if it's all a theatre what's the point of him being a senator then?
malloryerik 6y ago
So, this amendment lost by one vote, and Bernie Sanders didn't vote. Does anyone know what happened? I've understood him as having been against most of the Patriot Act since its inception.
- logicchains 6y ago
  Maybe the NSA showed up at his doorstep and made him an offer he couldn't refuse?
- brendoelfrendo 6y ago
  Perhaps it's because Section 215 is already expired and Sanders doesn't plan to vote for its renewal, so he doesn't see a point in voting for an amendment that makes said renewal more likely to pass?
xwowsersx 6y ago
There is a typo in the title. Should be "amendment".
- dang 6y ago
  Fixed now. Thanks!
tehjoker 6y ago
No one should accept the state's justifications on the basis of terrorism for expanding its surveillance powers. Terrorism from the middle east comes from US imperial intervention there, if they wanted to stop "terrorism" they would stop terrorizing the middle east. Instead, expansions of the police agency powers are probably aimed at surveiling political targets that have become disfavored. The bait and switch the USG loves to use, and in fact all governments love to use, is to point to a (possibly nonexistent) external enemy and use that to scare the population into accepting ever increasing authoritarian measures domestically.
r3trohack3r 6y ago
I don’t understand. Isn’t the surveillance program illegal? Wouldn’t this be passing a law that would require the government follow the law? Serious question, I was under the impression this was equivalent to warrantless wire tapping, which was already illegal.
- hedora 6y ago
  The executive branch (under GWB, Obama and Trump) has argued the law is ambiguous. Since congress just considered this amendment and rejected it, it will be harder for the Supreme Court to rule that the executive branch misinterpreted the law when it concluded that 100% digital surveillance is OK. We already have secret courts and indefinite pre-trial detention in the US. This is another small step in the creation of a police state. The precedent this vote created only took 37 votes in a chamber that is skewed much further right than the electorate. It would take about 55% of the vote to get the senate to be 50% democrat. That would give them enough procedural control to stop this sort of thing (if they bothered; they didn’t under Obama...) This is not democracy in action. This is democracy in its death throes.
dontbenebby 6y ago
As a practical matter who do they get this "browsing history" from? I see a lot of people suggesting folks use a VPN. But if they're getting the history via companies like Google, they'd link together your records just as easily. I see VPNs often being touted as anonymity tools, when it's my understand not all VPNS have multiple users sharing one IP. (Ex: it's my understanding that an Algo VPN might obscure your geographic location, it's an IP unique to you. Not clear on how a commercial service like Tunnelbear works - many services tout no logging but seem to stay mum on if IPs are shared) If any of the above is incorrect, please feel free to jump in and reply but it looks to me like moving as much browsing over to Tor as possible is the best move if you're worried about anonymity and not simply someone owning the wifi you are connected to.
- ipnon 6y ago
  Pseudo-anonymity is sufficient for those whose life is not in danger (like a journalist or dissenter). Personally identifying yourself to websites is an optional use of the Internet, as is participation in ad networks such as Google and Facebook. You are correct that ad networks have more information than your ISP does. The VPN will protect you from your ISP. Pseudo-anonymity is what protects you from ad networks. An easy implementation is to provide no personally identifiable information while using the web, and siloing the personally identifiable information when necessary. 1 email for your bank accounts and unemployment registration that uses your real name. A variety of differing emails and logins for all other websites.
  - dontbenebby 6y ago
    >You are correct that ad networks have more information than your ISP does. The VPN will protect you from your ISP. So to be clear, they'd get the data from the ISP? I'm not surprised DNS queries get saved but whole URLs is another thing. I guess I shouldn't be surprised, but I am a little bit, that they'd expend the $$$ to store that info longer than necessary for core business functions. >An easy implementation is to provide no personally identifiable information while using the web, and siloing the personally identifiable information when necessary. 1 email for your bank accounts and unemployment registration that uses your real name. A variety of differing emails and logins for all other websites. I do this + throw the banking and personal email into Firefox containers. Guerillamail is really useful for creating stuff like a HN account though it's sadly abused often enough many sites won't let you register using it anymore: https://www.guerrillamail.com/ https://www.guerrillamail.com/ (The other issue being requiring SMS auth after an initial signup)
cryptonector 6y ago
FYI, no warrant is needed to set up a pen register on a person of interest. That's where LEOs request that the Post Office record the envelope metadata of all your correspondence. ISTM that pen registers not requiring warrants is reasonable -- I'm not sure it's good for society, but it is reasonable. ISTM that keeping track of cleartext metadata emitted by personal devices on the public Internet is exactly like a pen register. DNS w/ QName minimization, DoH/DoE, and preferably DNSCurve, are techniques that can reduce the visibility of various metadata involved in gathering browsing history.
d0ne 6y ago
Committing the initial capital to form a FEC recognized national political party "The Privacy Party" to begin direct opposition to this and related activities. If you are interested in collaborating or learning more: https://theprivacyparty.org/ https://theprivacyparty.org/
- bgorman 6y ago
  What is the purpose of this party given the Libertarian party already exists and has ballot access in all states?
  - brandmeyer 6y ago
    The libertarian party also considers taxation to be unethical confiscation of private property, and advocates for the privatization of most-to-all government-provided services. If either of those are anathema to you, its hard to vote Libertarian.
glitchc 6y ago
That's unfortunate. What's Bernie's excuse?
btilly 6y ago
A point from Enlightenment Now that I wish was better understood. Groups that use terrorism to get their way almost always fail. This should not surprise us. Terrorism is the last available option for a weak interest group that has no better way to make their will felt. Therefore as scary as it is to face, the fact that they are resorting to it is evidence that they are underdogs and we should not be surprised that they later fail. Given that fact, the extreme efforts that we take to drive the nail even farther into terrorism is overkill.
- linuxftw 6y ago
  > Groups that use terrorism to get their way almost always fail. Totally untrue. When the US used atomic bombs to level cities in Japan, that was terrorism. The goal was to strike fear into the regime and the people for an unconditional surrender. It was not an attack against the military or government, it was an act of terrorism. When the US uses drone strikes to blow up weddings, that's terrorism. They are not actively engaged in a military conflict, even if there is allegedly some 'terrorist' they are trying to kill. The communist revolutions in various places heavily employed terrorism.
  - salawat 6y ago
    I actually think there may be a legitimate criticism here if you define demonstrating nuclear weapon/asymmetric warfare capability as employing terror toward political ends and stop there. I'd tread carefully there though. That's a lot of sensitive history you're coloring with a rather unattractive brush. There is a lot that prevents that particular viewpoint from being convincing without dragging down a lot of the framework of Western political discourse, however, to the point you may find astonishingly few people willing to entertain it. In the West, it is generally accepted that application of violence is justifiable. Those examples you called up fit within that justifiable envelope, in the first case, near unanumously, and in the latter case, it fit enough for majority buy in, but with significant controversy as well. Point being, the label of terrorism in the eyes of Western political discourse necessarily connotes violence of an unjustifiable or unsanctioned by the majority nature. I'm curious on your view of the Civil War. Would the secession and war waged by the Southern States (or by the Union retaking them) also qualify as terrorism?
gentleman11 6y ago
It only needed a single additional vote to pass and Bernie abstained
dang 6y ago
https://news.ycombinator.com/item?id=23172870 https://news.ycombinator.com/item?id=23172870

402 points by thinkingemote 6y ago

I'm curious at how the article implies that DoH is going do anything. I'd imagine CloudFlare, etc. would comply with FBI requests just as much as your local ISP. Factor in co-operation from CDN's and really that covers a vast array of data that the US Government could access.

tialaramex 6y ago
The main practical problem is that the NSA and similar agencies currently collect absolutely everything. Regardless of warrants, constitutional amendments, or senators banging their fists on the table, these agencies operate with impunity and they know it. DoH pragmatically reduces their ability to conduct such global surveillance. "Pervasive Monitoring is An Attack". We speak of man's laws and nature's as though they were the same kind of thing but they really, really aren't. I can no more magically replay the session keys from last week's Wikipedia visit in response to a court order, a warrant or the US Constitution itself than I could dance on the surface of the sun if they required that. The idea here isn't that Public Enemy Number One today is protected from surveillance, but instead that you today are protected from the hypothetical surveillance of your past that might be authorised if some day you become Public Enemy Number One.
quit32 6y ago
For one cloudflare is a lot more reputable than most US ISPs. Cloudflare explicitly says "We committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours." https://blog.cloudflare.com/announcing-1111/ https://blog.cloudflare.com/announcing-1111/ If gov tried to force CF to change that they would likely put up a huge public legal fight to prevent it whereas ATT / Verizon and Comcast would bend over backwards to secretly comply while also simultaneously seeing if they could inject some ads into the pages you visited.
- billme 6y ago
  Cloudflare is neither magically protected from secret US court orders, nor is there any reason to believe that data is not saved by the US.
- lonelappde 6y ago
  Does CloudFlare have multiple external auditors verifying their claims?
  - jgrahamc 6y ago
    https://blog.cloudflare.com/announcing-the-results-of-the-1-1-1-1-public-dns-resolver-privacy-examination/ https://blog.cloudflare.com/announcing-the-results-of-the-1-...
  - quit32 6y ago
    Literally the next para in that blog - "we committed to retaining KPMG, the well-respected auditing firm, to audit our practices annually and publish a public report confirming we're doing what we said we would." In addition Mozilla put them through a rigorous process when selecting them as their default DoH provider which included them contractually agreeing to adhere to their stated policy. https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy
- quit32 6y ago
  Also worth noting that cloud flare is a large driving force behind encrypted SNI which is the last nail in the coffin for putting ISPs in the dark when your average consumer is browsing the net. https://blog.cloudflare.com/encrypted-sni/ https://blog.cloudflare.com/encrypted-sni/ Basically when you connect over https using TLS 1.2 to a site that is hosted on a shared server or behind a load balancer, your browser must tell it in clear text which host name it is trying to connect to. Encrypted SNI in TLS 1.3 also encrypts this info such that if you are also using DoH or DNS over TLS to encrypt DNS query then the ISP can only see the IP of server you connect to which is often going to be a huge cloud provider's load balancer that might serve hundreds or more different sites throughout the day / at the same time.

badrabbit 6y ago

Actual terrorists(like 9/11 type, well funded) know better than to even touch anything digital for comms. They literally get a drone strike for having called a known terrorist or for going to a wedding other terrorists with cell phones go to. For home grown terrorism, how many school shootings happen when the people who know the shooter literally tell police/fbi beforehand about the state of the shooter. Are school shooters not terrorists? They have a social/political gripe and the terror is their way to get their voice out, avenge (like jihad) or inflict change. So why are they failing so bad even after almost 20 years of patriot act? Politicians don't want to be blamed because they know the next terrorist attack will happen soon and it can't be prevented,except the politicians that gut the patriot act will be blamed for it. On the flip side,information on voters,tracking them like this helps politicians

lonelappde 6y ago
Terrorism has been removed of its meaning since 2001. Terrorism means using violence or threat of violence to influence social or political decisions. Not everything bad is terrorism. A mentally ill person going on a murder-suicide rampage after beijg ignored by a girl is not a terrorist. A person acting in their self-interest in a way that contributes to systemic racism or oppression is not a terrorist. Hunting or threatening people of a certain race or gender or orientation or hobby to scare them and others away is terrorism. Blowing up buildings to pressure decision makers into a policy change is terrorism. Maybe manipulating a single individual via threats or minor violence could be considered small scale terrorism (but their are better words, like harassment or abuse or stalking or assault).
- KittenInABox 6y ago
  > Terrorism means using violence or threat of violence to influence social or political decisions. So like the shooting of a black church by a white supremacist explicitly for the purposes of espousing white supremacy? > Hunting or threatening people of a certain race or gender or orientation or hobby to scare them and others away is terrorism. So like the lgbtq club shooting, or the black church, or the 1989 shooting specifically targeting women?

brenden2 6y ago

I do most of my browsing in private mode anyway. I'm usually pretty careful to never put things onto websites that I don't want people to find publicly as well. The US has no strong privacy protections, so you should just assume that nobody has your best interest in mind. This includes HN, Reddit, and the FAANG giants. Although Apple is probably the only one that isn't strongly incentivized to violate your privacy.

TheAdamAndChe 6y ago
The data collected is collected en masse at the ISP level. Using incognito mode won't do anything for these searches.
- brenden2 6y ago
  This doesn't work so well when you a) disallow tracking cookies and b) don't use your ISP's DNS servers. I used to work directly with these big ISPs, and I can assure you they aren't very sophisticated. Even if they log every IP you send a packet to, and they know every domain that points to each of those IPs, they can't know exactly what you requested or which particular website you visited provided these websites use HTTPS.
  - snazz 6y ago
    If you're not using DNS over HTTPS, then they're still tracking your DNS queries regardless of which server you use.
    - brenden2 6y ago
      This is true, but it requires deep packet inspection, and that's something which usually isn't on by default. They might enable it for specific clients under some circumstances, but I haven't heard of ISPs logging that level of detail permanently. I suppose the could run a service that just inspects DNS packets, pulls out the domains, and correlates them with each client, but I haven't heard of that being deployed in the wild (although perhaps that's changed). Their DNS severs, however, and definitely doing this, and they sell that data to 3rd parties. TLS SNI also leaks the domain name, but again that would require deep packet inspection to extract and correlate with the clients. Definitely possible, but probably not deployed.

billme 6y ago

If the bill does not pass in any form, the Patriot Act dies — do not amended anything, let the Patriot Act bill die.

giffarage 6y ago

Between Https and VPNs, this seems ineffectual for people who actually want to stay hidden. Am I missing something?

softwaredoug 6y ago
Except the US is sadly notorious for weakening encryption standards. One common example is how it was hard for a long time to export strong encryption https://en.m.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.m.wikipedia.org/wiki/Export_of_cryptography_from_...
lenlorijn 6y ago
Metadata such as what domains/ip's are contacted can still be harvested.
- nickbauman 6y ago
  And remember: metadata is everything. It makes the actual content of the communication discoverable and indexable. The information of what you're saying and doing is not actionable without being able to find it / categorize it at scale.

notthemessiah 6y ago

When we look at the kinds of things these surveillance powers are used for, it's a glimpse of how it's abused. Thanks to FOIA requests, we found that the Boston Regional Intelligence Center was using their surveillance capabilities to spy on Occupy Boston during the Boston Marathon that was bombed, despite the ostensible aim of the center being to coordinate local and federal intelligence capabilities and despite the FBI receiving a tip from Russia that the Tsarnaevs were up to something. If we want to make the world safer, we should focus on making responsible and strategic use of the intelligence we have than to grant new powers. http://www.justiceonline.org/unaware_of_tsarnaev_warnings http://www.justiceonline.org/unaware_of_tsarnaev_warnings

nelaboras 6y ago
There is probably also an issue of too much information. All these massive efforts generate data that is barely ever used as the time and resources just aren't there.
- komali2 6y ago
  Reminds me of how back in 2003 we were cracking jokes about how the FBI was still making their way through the 2000's 4chan posts.
throwaway0a5e 6y ago
> If we want to make the world safer, we should focus on making responsible and strategic use of the intelligence we have than to grant new powers. Always look at the incentives. The Boston Bombing intelligence "failure" is not a failure of intelligence. We got exactly what the incentives were set up to deliver. The system works, it's just not spec'd out to deliver what people think it is. A mostly law abiding protest group that dares loudly complain about the government "doing it wrong" is an actual threat to law enforcement because it is a threat to the status quo. The voters might listen to them. The voters might install politicians who make promises of "doing it right" which usually includes allocating resources on things other than law enforcement. Drug treatment instead of drug crime task forces for example. That's a real risk to law enforcement agencies and gets treated as such. On the other hand you have two dudes with some bombs. Worst case they kill a couple hundred people and make the public hate them in the process. Sure that makes you look like incompetent fools but the public already thinks of you that way so you don't lose anything. No politician is going to get elected on a promise of turning your organization upside down because you failed to catch some lone wolves. Maybe you can even find a way to blame someone/something else and get some extra power out of it. Those guys were not a real risk to the organizations tasked with stopping people like them and were likewise ignored. That said, as much as it pains me to defend the MA state police the failure mode of the status quo they have settled into is pretty benign. The false positive rate on terrorism is so high and they are so eager to LARP as combat troops that if they did thoroughly follow up on every tip they got they'd likely have a much higher body count than the real terrorists. Doing unethical things to maximize their incomes and minimize their work (the gripe most people have with the MA state police) is pretty harmless by comparison.

duxup 6y ago

I'm a bit impressed how close it was to passing.

billme 6y ago
Bill should not be passed in any form, since if it is not, Patriot Act dies.
jellicle 6y ago
Don't take that for actual closeness. In many votes including this one, Senators may want to vote against leadership but will only do so if permitted. So if, say, 5 more Democrats had insisted on voting yes to make the amendment pass, McConnell would have told 5 more Republicans that they were disallowed from voting against it, and the amendment would have failed by... one vote. The dynamic here is that Republican politicians often want to present themselves to constituents as being against the police state or big government, but the party/party leadership wants to pass measures such as this. So the individual politicians are accommodated to the extent that they don't interfere with the party passing what it wants. You see a similar dynamic in quite a lot of votes. TL;DR: McConnell knows how to count.
- duxup 6y ago
  I don't doubt the premise can happen, I am not inclined to assume it is the case automatically.

diablo1 6y ago

Define 'your' browsing history. Where I live you can buy a SIM card with cash, load it with credit and surf on a 3G/4G network, without having to register the SIM or attach your legal name to it in any way. I can also encrypt my phone, turn on permanent incognito mode, disable Javascript, and have uBlock Origin running to stop trackers. Good luck trying to pin my legal name to a particular website visit. Then there's the fact that 3G/4G uses vague carrier-grade-NAT IPV4 addresses so countless others all share the same IP address enabling you to 'hide among the crowd' (providing the useragent is something common that many people use like Safari on an iPhone5)

dgellow 6y ago
> Where I live you can buy a SIM card with cash, load it with credit and surf on a 3G/4G network, without having to register the SIM or attach your legal name to it in any way. Where is that? My experience in Europe and Thailand is that I have to sign documents and show a proof of identity.
- ryanlol 6y ago
  In Europe “I’m sorry, I didn’t take my passport with me, but I remember my passport number” has had a 100% success rate for me.
  - mindslight 6y ago
    So then you're committing fraud or whatever. Once again, law abiding people bear the burden while bogeyman-with-beard just gives a false number. One of the general difficulties with the government threat actor is that law abiding people have to thread the needle of both technical protection and legal requirements.
    - socks 6y ago
      Quoting your own true passport number is not fraud. Fraud would be supplying a fake passport number / fake passport / doctored photocopy.

foob4r 6y ago

I would be surprised if many of the common public believed that warrantless searches of anyone are reasonable, while exempting federal elected officials from the same law. Now's a good time to call you senator (if they voted against this) and tell them that they fucked up by weakening your rights and freedoms. Then, get a VPN or better use Tor as much as you can.

billme 6y ago
What? If this bill is not passed, Patriot Act dies, why would you want this bill to pass?
rrtthu 6y ago
If TOR had fiver-level speed I'd be on all the time. The trade off is just too high.
- foob4r 6y ago
  True although it's getting better every day. I do use it frequently and do run a few relays, and that's probably the only way to improve it.
  - newscracker 6y ago
    Do you have any simpler resources on how to do it? If it were simpler to run a relay on a provider that allows it, and it doesn’t cost much (say $10 a month) to give Tor users a little more speed, that’d be helpful. The last time I looked at the documentation, it seemed quite involved and complex (of course, I wouldn’t want the security of Tor users to be compromised due to any misconfiguration). If there were something for Tor like Sandstorm for web apps or Algo for WireGuard, more people could run relays and help everyone.
    - foob4r 6y ago
      I use ovh (although the tor network is saturated with ovh) and https://tor-relay.co https://tor-relay.co ; literally takes 5 mins after vm is provisioned. Here's a giant list of hosts you can look into - https://community.torproject.org/relay/community-resources/good-bad-isps/ https://community.torproject.org/relay/community-resources/g... I spent maybe an hour researching based my in criteria. You can host just an exit (most helpful), or a couple of relays (aim for 100mbps+, and decent bandwidth). You can get a lot for $5/month for each relay.

bhauer 6y ago

I am absolutely no fan of Bernie Sanders. I disagree with him on a majority of policy matters. However, this popular media framing, which blames the failure of this amendment on Bernie Sanders, is unhinged. It's not just this Register article; you'll see the same sniping at Sanders specifically in most articles that carry a negative opinion on the PATRIOT Act. Being absent for the vote is shameful, sure. But how about laying the blame somewhere more meaningful? For example, on us Californians who re-elected Feinstein despite knowing she is absolutely abysmal on privacy. Californians like myself should carry this shame, not Sanders and Vermont voters. We Californians are sorry for voting so blindly and continuously re-electing terrible senators.

varjag 6y ago
It failed by one vote. If he did his damn job and showed up it could turn out different.
- Floegipoky 6y ago
  As somebody else explained, if he had showed up to vote against it the amendment almost certainly would have still failed by 1 vote. The party whips would have just required one of the other "no"s to switch. The reality is that party leadership controls exactly what gets voted on and when, and to a large extent predetermines who is allowed to vote yes and no. The rest is just theater.
  - varjag 6y ago
    I must be obtuse, but if it's all a theatre what's the point of him being a senator then?

malloryerik 6y ago

So, this amendment lost by one vote, and Bernie Sanders didn't vote. Does anyone know what happened? I've understood him as having been against most of the Patriot Act since its inception.

logicchains 6y ago
Maybe the NSA showed up at his doorstep and made him an offer he couldn't refuse?
brendoelfrendo 6y ago
Perhaps it's because Section 215 is already expired and Sanders doesn't plan to vote for its renewal, so he doesn't see a point in voting for an amendment that makes said renewal more likely to pass?

xwowsersx 6y ago

There is a typo in the title. Should be "amendment".

dang 6y ago
Fixed now. Thanks!

tehjoker 6y ago

No one should accept the state's justifications on the basis of terrorism for expanding its surveillance powers. Terrorism from the middle east comes from US imperial intervention there, if they wanted to stop "terrorism" they would stop terrorizing the middle east. Instead, expansions of the police agency powers are probably aimed at surveiling political targets that have become disfavored. The bait and switch the USG loves to use, and in fact all governments love to use, is to point to a (possibly nonexistent) external enemy and use that to scare the population into accepting ever increasing authoritarian measures domestically.

r3trohack3r 6y ago

I don’t understand. Isn’t the surveillance program illegal? Wouldn’t this be passing a law that would require the government follow the law? Serious question, I was under the impression this was equivalent to warrantless wire tapping, which was already illegal.

hedora 6y ago
The executive branch (under GWB, Obama and Trump) has argued the law is ambiguous. Since congress just considered this amendment and rejected it, it will be harder for the Supreme Court to rule that the executive branch misinterpreted the law when it concluded that 100% digital surveillance is OK. We already have secret courts and indefinite pre-trial detention in the US. This is another small step in the creation of a police state. The precedent this vote created only took 37 votes in a chamber that is skewed much further right than the electorate. It would take about 55% of the vote to get the senate to be 50% democrat. That would give them enough procedural control to stop this sort of thing (if they bothered; they didn’t under Obama...) This is not democracy in action. This is democracy in its death throes.

dontbenebby 6y ago

As a practical matter who do they get this "browsing history" from? I see a lot of people suggesting folks use a VPN. But if they're getting the history via companies like Google, they'd link together your records just as easily. I see VPNs often being touted as anonymity tools, when it's my understand not all VPNS have multiple users sharing one IP. (Ex: it's my understanding that an Algo VPN might obscure your geographic location, it's an IP unique to you. Not clear on how a commercial service like Tunnelbear works - many services tout no logging but seem to stay mum on if IPs are shared) If any of the above is incorrect, please feel free to jump in and reply but it looks to me like moving as much browsing over to Tor as possible is the best move if you're worried about anonymity and not simply someone owning the wifi you are connected to.

ipnon 6y ago
Pseudo-anonymity is sufficient for those whose life is not in danger (like a journalist or dissenter). Personally identifying yourself to websites is an optional use of the Internet, as is participation in ad networks such as Google and Facebook. You are correct that ad networks have more information than your ISP does. The VPN will protect you from your ISP. Pseudo-anonymity is what protects you from ad networks. An easy implementation is to provide no personally identifiable information while using the web, and siloing the personally identifiable information when necessary. 1 email for your bank accounts and unemployment registration that uses your real name. A variety of differing emails and logins for all other websites.
- dontbenebby 6y ago
  >You are correct that ad networks have more information than your ISP does. The VPN will protect you from your ISP. So to be clear, they'd get the data from the ISP? I'm not surprised DNS queries get saved but whole URLs is another thing. I guess I shouldn't be surprised, but I am a little bit, that they'd expend the $$$ to store that info longer than necessary for core business functions. >An easy implementation is to provide no personally identifiable information while using the web, and siloing the personally identifiable information when necessary. 1 email for your bank accounts and unemployment registration that uses your real name. A variety of differing emails and logins for all other websites. I do this + throw the banking and personal email into Firefox containers. Guerillamail is really useful for creating stuff like a HN account though it's sadly abused often enough many sites won't let you register using it anymore: https://www.guerrillamail.com/ https://www.guerrillamail.com/ (The other issue being requiring SMS auth after an initial signup)

cryptonector 6y ago

FYI, no warrant is needed to set up a pen register on a person of interest. That's where LEOs request that the Post Office record the envelope metadata of all your correspondence. ISTM that pen registers not requiring warrants is reasonable -- I'm not sure it's good for society, but it is reasonable. ISTM that keeping track of cleartext metadata emitted by personal devices on the public Internet is exactly like a pen register. DNS w/ QName minimization, DoH/DoE, and preferably DNSCurve, are techniques that can reduce the visibility of various metadata involved in gathering browsing history.

d0ne 6y ago

Committing the initial capital to form a FEC recognized national political party "The Privacy Party" to begin direct opposition to this and related activities. If you are interested in collaborating or learning more: https://theprivacyparty.org/ https://theprivacyparty.org/

bgorman 6y ago
What is the purpose of this party given the Libertarian party already exists and has ballot access in all states?
- brandmeyer 6y ago
  The libertarian party also considers taxation to be unethical confiscation of private property, and advocates for the privatization of most-to-all government-provided services. If either of those are anathema to you, its hard to vote Libertarian.

glitchc 6y ago

That's unfortunate. What's Bernie's excuse?

btilly 6y ago

A point from Enlightenment Now that I wish was better understood. Groups that use terrorism to get their way almost always fail. This should not surprise us. Terrorism is the last available option for a weak interest group that has no better way to make their will felt. Therefore as scary as it is to face, the fact that they are resorting to it is evidence that they are underdogs and we should not be surprised that they later fail. Given that fact, the extreme efforts that we take to drive the nail even farther into terrorism is overkill.

linuxftw 6y ago
> Groups that use terrorism to get their way almost always fail. Totally untrue. When the US used atomic bombs to level cities in Japan, that was terrorism. The goal was to strike fear into the regime and the people for an unconditional surrender. It was not an attack against the military or government, it was an act of terrorism. When the US uses drone strikes to blow up weddings, that's terrorism. They are not actively engaged in a military conflict, even if there is allegedly some 'terrorist' they are trying to kill. The communist revolutions in various places heavily employed terrorism.
- salawat 6y ago
  I actually think there may be a legitimate criticism here if you define demonstrating nuclear weapon/asymmetric warfare capability as employing terror toward political ends and stop there. I'd tread carefully there though. That's a lot of sensitive history you're coloring with a rather unattractive brush. There is a lot that prevents that particular viewpoint from being convincing without dragging down a lot of the framework of Western political discourse, however, to the point you may find astonishingly few people willing to entertain it. In the West, it is generally accepted that application of violence is justifiable. Those examples you called up fit within that justifiable envelope, in the first case, near unanumously, and in the latter case, it fit enough for majority buy in, but with significant controversy as well. Point being, the label of terrorism in the eyes of Western political discourse necessarily connotes violence of an unjustifiable or unsanctioned by the majority nature. I'm curious on your view of the Civil War. Would the secession and war waged by the Southern States (or by the Union retaking them) also qualify as terrorism?

gentleman11 6y ago

It only needed a single additional vote to pass and Bernie abstained

dang 6y ago

https://news.ycombinator.com/item?id=23172870 https://news.ycombinator.com/item?id=23172870