4 ms·

The US government requires that all ISPs install wiretapping devices as a precondition for doing business. Failure to install and maintain wiretapping devices

The US government requires that all ISPs install wiretapping devices as a precondition for doing business. Failure to install and maintain wiretapping devices incurs a penalty of $130,000 per day, with a maximum of $1,325,000 per violation (unlimited violations). Assume every ISP is compromised and that every government agency can see everything. https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_...

Nextgrid 4y ago
Due to HTTPS, an ISP will not see which social media account someone is logging in unless it's somehow leaked in unencrypted form (unlikely).
- CapstanRoller 4y ago
  They don't need to leak it. ISPs, web hosts, social media companies, etc. give up the information willingly, and the feds take care of all the correlation work as needed. Remember "SSL added and removed here :^)"? https://archive.is/W3PDG https://archive.is/W3PDG
  - Nextgrid 4y ago
    "SSL added and removed here :^)" was over a decade ago now? HTTPS and encryption since became commonplace. Not to mention, there's really no reason for the feds to try and break/work around HTTPS in this case when they have more than enough to subpoena the provider and they'll happily surrender the logs.
    - CapstanRoller 4y ago
      >"SSL added and removed here :^)" was over a decade ago now? Yes, and surveillance has become even more entrenched since then. >HTTPS and encryption since became commonplace. HTTPS only protects the information in transit. It can't protect you from a backdoored load balancer or other endpoint, which is what that infamous slide was about. The NSA wasn't breaking encryption, but rather compromising the devices that were communicating via HTTPS with you. The little padlock icon in your browser says nothing about the trustworthiness of the server on the other end. It's like talking on a secure line with someone who is actually a spy.

Nextgrid 4y ago

Due to HTTPS, an ISP will not see which social media account someone is logging in unless it's somehow leaked in unencrypted form (unlikely).

CapstanRoller 4y ago
They don't need to leak it. ISPs, web hosts, social media companies, etc. give up the information willingly, and the feds take care of all the correlation work as needed. Remember "SSL added and removed here :^)"? https://archive.is/W3PDG https://archive.is/W3PDG
- Nextgrid 4y ago
  "SSL added and removed here :^)" was over a decade ago now? HTTPS and encryption since became commonplace. Not to mention, there's really no reason for the feds to try and break/work around HTTPS in this case when they have more than enough to subpoena the provider and they'll happily surrender the logs.
  - CapstanRoller 4y ago
    >"SSL added and removed here :^)" was over a decade ago now? Yes, and surveillance has become even more entrenched since then. >HTTPS and encryption since became commonplace. HTTPS only protects the information in transit. It can't protect you from a backdoored load balancer or other endpoint, which is what that infamous slide was about. The NSA wasn't breaking encryption, but rather compromising the devices that were communicating via HTTPS with you. The little padlock icon in your browser says nothing about the trustworthiness of the server on the other end. It's like talking on a secure line with someone who is actually a spy.