18 ms·

They left off one very popular messenger, SMS: * Message content: All * Subpoena: can render all message content for the last 1-7 years * 18 U.S.C 2703(d): c

They left off one very popular messenger, SMS: * Message content: All * Subpoena: can render all message content for the last 1-7 years * 18 U.S.C 2703(d): can render all message content for the last 1-7 years * Search warrant: can render all message content for the last 1-7 years * Vague suspicion plus a small fee to the carrier: can render all message content for the last 1-7 years

authed 5y ago
You forgot email... and they don't need a warrant for messages older then 180 days if in the cloud (they never delete them, too): https://www.consumerreports.org/consumerist/house-passes-bill-requiring-warrants-for-searching-older-emails-files/ https://www.consumerreports.org/consumerist/house-passes-bil...
- kingcharles 5y ago
  IIRC the only reason this amendment was made was because the 180 day limit was found unconstitutional anyway by an appellate court. So, technically the amendment did nothing. It doesn't matter where your data is held, locally or cloud, (if you are an American resident and your data is in the USA) as it is _your_ data and it is unconstitutional for them to read it without a warrant. In theory.
  - authed 5y ago
    > It doesn't matter where your data is held, locally or cloud In the US it does
    - kingcharles 5y ago
      Citation? This ruling has been adopted by the US Supreme Court: https://privacylaw.proskauer.com/2007/06/articles/electronic-communications/the-sixth-circuit-affirms-individual-expectation-of-privacy-in-emails/ https://privacylaw.proskauer.com/2007/06/articles/electronic...
      - authed 5y ago
        Look at the link I posted up there? it is 10 years newer then yours
    - encryptluks2 5y ago
      If they are local and encrypted... oops, forgot the encryption key.
heavyset_go 5y ago
There's also: * Law enforcement simply asks nicely: can render all message content for the last 1-7 years
- Consultant32452 5y ago
  * Law enforcement wants to stalk ex-girlfriend: can render all message content for the last 1-7 years
- gnopgnip 5y ago
  The Stored Communications Act makes disclosing the contents of messages without a search warrant unlawful
  - jc01480 5y ago
    You are correct. There’s also varying 2-party/1-party consent required depending on the state in the absence of a warrant. But unless you’re targeting the devices, you will not get much at all from service providers. They simply don’t keep it contrary to what I read here.
  - AnthonyMouse 5y ago
    The people responsible for investigating and prosecuting such crimes have some not so great incentives to avoid doing so and keep the whole thing secret though, don't they? And then when they get caught, they do this: https://cdt.org/insights/the-truth-about-telecom-immunity/ https://cdt.org/insights/the-truth-about-telecom-immunity/
    - 2OEH8eoCRo0 5y ago
      Sounds like an easy way to have your case tossed out in court. It's funny how much this differs from my own personal experience with law enforcement. The friends I know are timid as hell and don't do anything without a warrant just to stay on the safe side- even if they probably don't need one.
      - 5y ago
lsiebert 5y ago
It's about secure messaging
grumple 5y ago
Source is a few years old, but I suppose we can make another FOIA request to find out how long carriers store text messages these days - it was basically 0-5 days a decade ago: https://www.nbcnews.com/technolog/how-long-do-wireless-carriers-keep-your-data-120367 https://www.nbcnews.com/technolog/how-long-do-wireless-carri...
- FateOfNations 5y ago
  Idk... back in the mid 2000s my parents managed to get a transcript of all of my (minor) sister's SMS messages for a few months back (as part of a billing dispute).
- jc01480 5y ago
  You’ll be lucky if it’s any longer than 24-hours now. There’s no business use case for building and maintaining the technological infrastructure to manage it for years. It’s private info and they can’t sell it to anyone without legal liability. If LE gave them the funds to build this infrastructure and use it for retention then the service provider is essentially an agent of the state at that point.
  - xanaxagoras 5y ago
    You're overstating the technical difficulty of archiving and retrieving text.
    - grumple 5y ago
      I can only imagine that the scale of all US SMS messages is absolutely staggering. It probably eclipses all other text formats combined in terms of daily production. Here's a blog post from a few years ago estimating it at 26 billion text messages per day and rising: https://www.textrequest.com/blog/how-many-texts-people-send-per-day/ https://www.textrequest.com/blog/how-many-texts-people-send-... Not counting media and assuming they are all 160 byte messages, that's 4 terabytes per day, or about 200 wikipedia's per day. I guess that's not too bad in terms of storage requirements, certainly a management amount of data for a telecom to store. But assuming that you want those indexed and easily retrievable somehow, it could get very burdensome to manage and interact with, and that tends to balloon the size at least a little bit as well. The liability and legal issues around it (both externally and internally - don't want employees spying on their exes, leaking data from celebs, in addition to the policing issues, etc) makes it pretty undesirable to store though.
jc01480 5y ago
Major service providers do not maintain SMS history beyond 24 hours, let alone 1-7 years (last time I worked a case that is). They’re transparent about it as well. Look up the LE liaison contacts on their sites and they’ll clearly list what is available or not available. That’s why it’s crucial to get the actual devices themselves. Reason: the infrastructure to manage SMS content for every customer for 7 years with zero business justification/use case is phenomenal. They’d spend most of their time responding to civil and criminal subpoenas/warrants. That would be a feat the NSA would be proud of. Been there and done that a 100 times. (This also aligns with certain VPN providers refusing to keep logs. It’s a cost that provides zero returns, so they cut it as a business decision, not because they’re trying to stick it to the man.
- wyldfire 5y ago
  There's no reason for them to keep those records, other than for law enforcement's sake. No use case for calling up your operator to ask about that text message you got "from Fred at 4am one day a couple years ago."
- superkuh 5y ago
  I'm surprised to hear this has changed so significantly since the snowden leaks. Especially after the blatant attack on Qwest CEO Joseph Nacchio for refusing to spy. It was established then that the major mobile telcos in the USA were keeping and providing sms full data for 2-5 years (t-mobile, at&t, verizon, etc).
  - yownie 5y ago
    and also that the government was subsidizing the programs when the companies complained about the added costs.
- lrvick 5y ago
  I went to a major cell provider and asked them nicely for access to SMS for all their customers and they happily took money and gave me an API. This was for a startup. I have no doubt they do the same for governments.

authed 5y ago

You forgot email... and they don't need a warrant for messages older then 180 days if in the cloud (they never delete them, too): https://www.consumerreports.org/consumerist/house-passes-bill-requiring-warrants-for-searching-older-emails-files/ https://www.consumerreports.org/consumerist/house-passes-bil...

kingcharles 5y ago
IIRC the only reason this amendment was made was because the 180 day limit was found unconstitutional anyway by an appellate court. So, technically the amendment did nothing. It doesn't matter where your data is held, locally or cloud, (if you are an American resident and your data is in the USA) as it is _your_ data and it is unconstitutional for them to read it without a warrant. In theory.
- authed 5y ago
  > It doesn't matter where your data is held, locally or cloud In the US it does
  - kingcharles 5y ago
    Citation? This ruling has been adopted by the US Supreme Court: https://privacylaw.proskauer.com/2007/06/articles/electronic-communications/the-sixth-circuit-affirms-individual-expectation-of-privacy-in-emails/ https://privacylaw.proskauer.com/2007/06/articles/electronic...
    - authed 5y ago
      Look at the link I posted up there? it is 10 years newer then yours
  - encryptluks2 5y ago
    If they are local and encrypted... oops, forgot the encryption key.

heavyset_go 5y ago

There's also: * Law enforcement simply asks nicely: can render all message content for the last 1-7 years

Consultant32452 5y ago
* Law enforcement wants to stalk ex-girlfriend: can render all message content for the last 1-7 years
gnopgnip 5y ago
The Stored Communications Act makes disclosing the contents of messages without a search warrant unlawful
- jc01480 5y ago
  You are correct. There’s also varying 2-party/1-party consent required depending on the state in the absence of a warrant. But unless you’re targeting the devices, you will not get much at all from service providers. They simply don’t keep it contrary to what I read here.
- AnthonyMouse 5y ago
  The people responsible for investigating and prosecuting such crimes have some not so great incentives to avoid doing so and keep the whole thing secret though, don't they? And then when they get caught, they do this: https://cdt.org/insights/the-truth-about-telecom-immunity/ https://cdt.org/insights/the-truth-about-telecom-immunity/
  - 2OEH8eoCRo0 5y ago
    Sounds like an easy way to have your case tossed out in court. It's funny how much this differs from my own personal experience with law enforcement. The friends I know are timid as hell and don't do anything without a warrant just to stay on the safe side- even if they probably don't need one.
    - 5y ago

lsiebert 5y ago

It's about secure messaging

grumple 5y ago

Source is a few years old, but I suppose we can make another FOIA request to find out how long carriers store text messages these days - it was basically 0-5 days a decade ago: https://www.nbcnews.com/technolog/how-long-do-wireless-carriers-keep-your-data-120367 https://www.nbcnews.com/technolog/how-long-do-wireless-carri...

FateOfNations 5y ago
Idk... back in the mid 2000s my parents managed to get a transcript of all of my (minor) sister's SMS messages for a few months back (as part of a billing dispute).
jc01480 5y ago
You’ll be lucky if it’s any longer than 24-hours now. There’s no business use case for building and maintaining the technological infrastructure to manage it for years. It’s private info and they can’t sell it to anyone without legal liability. If LE gave them the funds to build this infrastructure and use it for retention then the service provider is essentially an agent of the state at that point.
- xanaxagoras 5y ago
  You're overstating the technical difficulty of archiving and retrieving text.
  - grumple 5y ago
    I can only imagine that the scale of all US SMS messages is absolutely staggering. It probably eclipses all other text formats combined in terms of daily production. Here's a blog post from a few years ago estimating it at 26 billion text messages per day and rising: https://www.textrequest.com/blog/how-many-texts-people-send-per-day/ https://www.textrequest.com/blog/how-many-texts-people-send-... Not counting media and assuming they are all 160 byte messages, that's 4 terabytes per day, or about 200 wikipedia's per day. I guess that's not too bad in terms of storage requirements, certainly a management amount of data for a telecom to store. But assuming that you want those indexed and easily retrievable somehow, it could get very burdensome to manage and interact with, and that tends to balloon the size at least a little bit as well. The liability and legal issues around it (both externally and internally - don't want employees spying on their exes, leaking data from celebs, in addition to the policing issues, etc) makes it pretty undesirable to store though.

jc01480 5y ago

Major service providers do not maintain SMS history beyond 24 hours, let alone 1-7 years (last time I worked a case that is). They’re transparent about it as well. Look up the LE liaison contacts on their sites and they’ll clearly list what is available or not available. That’s why it’s crucial to get the actual devices themselves. Reason: the infrastructure to manage SMS content for every customer for 7 years with zero business justification/use case is phenomenal. They’d spend most of their time responding to civil and criminal subpoenas/warrants. That would be a feat the NSA would be proud of. Been there and done that a 100 times. (This also aligns with certain VPN providers refusing to keep logs. It’s a cost that provides zero returns, so they cut it as a business decision, not because they’re trying to stick it to the man.

wyldfire 5y ago
There's no reason for them to keep those records, other than for law enforcement's sake. No use case for calling up your operator to ask about that text message you got "from Fred at 4am one day a couple years ago."
superkuh 5y ago
I'm surprised to hear this has changed so significantly since the snowden leaks. Especially after the blatant attack on Qwest CEO Joseph Nacchio for refusing to spy. It was established then that the major mobile telcos in the USA were keeping and providing sms full data for 2-5 years (t-mobile, at&t, verizon, etc).
- yownie 5y ago
  and also that the government was subsidizing the programs when the companies complained about the added costs.
lrvick 5y ago
I went to a major cell provider and asked them nicely for access to SMS for all their customers and they happily took money and gave me an API. This was for a startup. I have no doubt they do the same for governments.