8 ms·

> USA reading your mail: Business as usual. According to the first paragraph of the article you linked: "NSLs can only request non-content information, such a

> USA reading your mail: Business as usual. According to the first paragraph of the article you linked: "NSLs can only request non-content information, such as transactional records, phone numbers dialed or email addresses mailed to and from." According to the sample NSL from the article you linked: "We are not directing that you provide, and you should not provide, information pursuant to this letter that would disclose the content of any electronic communication. [...] Subject lines of emails and message content are content information and should not be provided pursuant to this letter." So NSL is not the USA "reading your email." I'm not defending the NSL, but I am opposed to misinformation, as well as the frequent attempts to paint the USA as being just as bad as China.

sneak 14y ago
> NSLs can only request non-content information NSLs can't legally request ANYTHING. They are UNCONSTITUTIONAL. The government has NO AUTHORITY to issue them. The fact that they are presently limiting themselves to illegal request x instead of illegal request y is not relevant. Let's skip the abuses of the FBI et al and talk about the government as a whole for a minute. Are you aware that the NSA monitors _all_ traffic at major exchanges in the US? http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_controversy http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_co... The USA reads your mail and messages at several different steps along the way. See also: recent changes in Skype to allow for wiretapping at the request of the US government.
- tptacek 14y ago
  'haberman's comment includes actual information. Can we not punish people for posting information? I doubt very much that 'haberman approves of NSLs, especially since he said as much. Moreover, your comment may actually be incorrect; a good chunk of all the mail Gmail handles is never on the wire in a format that can be decrypted with any known attack without access to Google's (often pinned) secret keys. The NSA's ability to snarf it off the wire, stipulated, does not connote their ability to read it.
  - tomjen3 14y ago
    By making them sound less dangerous he is making it more difficult to oppose them.
    - groby_b 14y ago
      So lying is OK if it furthers a cause you believe in? The facts should be treated as such for all sides of a debate, even if you disagree with the outcome of the debate.
  - AJ007 14y ago
    This "good chunk" is what? gmail to gmail? As far as I'm aware the majority of internet users are still using unencrypted plain text email.
    - munin 14y ago
      when I receive email from people on non-Google hosted domains, I sometimes check the headers and see that mail was delivered to my gmail with ESMTPS, using TLS. so a lot of non-google hosted mail on the internet will use ESMTPS for delivery between servers, silently. you can check this too by looking at the SMTP headers on some mail in your inbox.
      - sneak 14y ago
        The PKI is broken, and I bet a lot of client SMTP plays fast and loose with certificate checking anyway, even if it wasn't. DNSSEC can't come fast enough. It helps against passive adversaries, but if someone's got access to the sending mailserver's network there are active MITM attacks that will probably defeat this. Option 1: Try doing MITM and sending a self-signed cert for Google. The client smtpd may accept it anyway. (Cost: free) Option 2: Spend resources to obtain a legitimate intermediate CA cert, and issue a valid cert for Google's mailserver, and MITM with that. (Cost: ca $25k-$100k, maybe less with proper connections.) The only thing worse than self-censorship after assuming an insecure channel is a false sense of security.
- duaneb 14y ago
  What are you defining legality as? Just because something is legal doesn't mean it's constitutional (and vice-verse).
- duaneb 14y ago
  What are you defining legality as? Just because something is legal doesn't mean it's constitutional (and vice-verse).
- thornofmight 14y ago
  Where can I read about these recent changes to Skype? I use Skype mostly for IM, but also the occasional voice/video call, what's a better, more secure alternative?
- thornofmight 14y ago
  Where can I read about these recent changes to Skype? I use Skype mostly for IM, but also the occasional voice/video call, what's a better, more secure alternative?
tomjen3 14y ago
I understand as a hacker that you want to provide the truth, but the way to stop these letters isn't to downplay their danger, but to make people scared to death of them.
- haberman 14y ago
  If someone appeals to me to care about X but lies about the facts of X, their credibility is damaged in my eyes and I am inclined to think that they are overplaying the danger. For example, "sneak" replied to my comment with lots of CAPITAL LETTERS and links to other information. But I'm already less inclined to trust sneak, since he/she is already known to play fast and loose with the facts.
  - sneak 14y ago
    I don't mean to appear to be playing fast and loose with the facts. Certainly, the NSA tapping exchanges is a different issue than whatever restrictions the government has placed on itself when issuing NSLs for message metadata. The fact is, message metadata is enough. I have friends and acquaintances that have been harassed and detained by officials based on their names appearing in contact lists of other suspected-but-not-charged-with-anything individuals. We're not even talking about evidence of actual communications such as message headers or metadata. The fact that they can (and do) pull thousands of people's message headers and have access to the communications graph and traffic frequency without ANY JUDICIAL OVERSIGHT WHATSOEVER means that their ability to conduct state-sponsored extrajudicial harassment is way out of control. It truly doesn't matter if NSLs allow them to get the body of the messages or not. If you're on the radar, you and everyone you communicate with regularly is a target. There are no legal remedies for this sort of stuff anymore. If you do anything of import non-anonymously, you can expect to have your hardware stolen and never returned (under the guise of a search), your travel impeded, your accounts inaccessible (google "civil asset forfeiture"), your social network harassed and detained similarly, and your access to legal remedies hindered in every conceivable way. A half-dozen examples known to me personally come to mind immediately. I'm sure there are more that I don't know about. The threat is very real, and trying to split hairs about whether or not "reading your email" means message bodies or just headers is not productive.
csoghoian 14y ago
I'm a privacy researcher, specifically focusing on government access to data held by Internet companies. Google, your employer, will not confirm, on the record, what they will or will not disclose when they get an NSL. The NSL statute does not authorize the disclosure of transactional records. 18 USC 2709(b)(1) states that the government can only get "the name, address, length of service, and local and long distance toll billing records" Furthermore, a 2008 opinion from the Office of Legal Counsel at DOJ specifically confirmed that the FBI cannot use NSLs to get email to/from data, even though the government has asked for it in the past. See: http://www.justice.gov/olc/2008/fbi-ecpa-opinion.pdf http://www.justice.gov/olc/2008/fbi-ecpa-opinion.pdf NSLs are gagged, and so Google cannot confirm when it gets NSLs, or for which customers the government is seeking data. However, Google could very easily provide information to the public confirming what it will and will not deliver to the FBI when it receives an NSL. I have asked Google's legal and DC policy team for this info, repeatedly, and hit a brick wall.
- taliesinb 14y ago
  I'm not a privacy researcher, but my guess is this is probably less "they won't answer because all your worst fears are true" and more "they won't answer because they don't want to narrow their future options and political maneuvers".
retrogradeorbit 14y ago
http://www.wired.com/threatlevel/2007/06/librarians-desc/ http://www.wired.com/threatlevel/2007/06/librarians-desc/ Does reading your library records count... How do you know the same hasn't been done with your email? You don't. Because it's secret. Is this an open society? A free society?

sneak 14y ago

> NSLs can only request non-content information NSLs can't legally request ANYTHING. They are UNCONSTITUTIONAL. The government has NO AUTHORITY to issue them. The fact that they are presently limiting themselves to illegal request x instead of illegal request y is not relevant. Let's skip the abuses of the FBI et al and talk about the government as a whole for a minute. Are you aware that the NSA monitors _all_ traffic at major exchanges in the US? http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_controversy http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_co... The USA reads your mail and messages at several different steps along the way. See also: recent changes in Skype to allow for wiretapping at the request of the US government.

tptacek 14y ago
'haberman's comment includes actual information. Can we not punish people for posting information? I doubt very much that 'haberman approves of NSLs, especially since he said as much. Moreover, your comment may actually be incorrect; a good chunk of all the mail Gmail handles is never on the wire in a format that can be decrypted with any known attack without access to Google's (often pinned) secret keys. The NSA's ability to snarf it off the wire, stipulated, does not connote their ability to read it.
- tomjen3 14y ago
  By making them sound less dangerous he is making it more difficult to oppose them.
  - groby_b 14y ago
    So lying is OK if it furthers a cause you believe in? The facts should be treated as such for all sides of a debate, even if you disagree with the outcome of the debate.
- AJ007 14y ago
  This "good chunk" is what? gmail to gmail? As far as I'm aware the majority of internet users are still using unencrypted plain text email.
  - munin 14y ago
    when I receive email from people on non-Google hosted domains, I sometimes check the headers and see that mail was delivered to my gmail with ESMTPS, using TLS. so a lot of non-google hosted mail on the internet will use ESMTPS for delivery between servers, silently. you can check this too by looking at the SMTP headers on some mail in your inbox.
    - sneak 14y ago
      The PKI is broken, and I bet a lot of client SMTP plays fast and loose with certificate checking anyway, even if it wasn't. DNSSEC can't come fast enough. It helps against passive adversaries, but if someone's got access to the sending mailserver's network there are active MITM attacks that will probably defeat this. Option 1: Try doing MITM and sending a self-signed cert for Google. The client smtpd may accept it anyway. (Cost: free) Option 2: Spend resources to obtain a legitimate intermediate CA cert, and issue a valid cert for Google's mailserver, and MITM with that. (Cost: ca $25k-$100k, maybe less with proper connections.) The only thing worse than self-censorship after assuming an insecure channel is a false sense of security.
duaneb 14y ago
What are you defining legality as? Just because something is legal doesn't mean it's constitutional (and vice-verse).
duaneb 14y ago
What are you defining legality as? Just because something is legal doesn't mean it's constitutional (and vice-verse).
thornofmight 14y ago
Where can I read about these recent changes to Skype? I use Skype mostly for IM, but also the occasional voice/video call, what's a better, more secure alternative?
thornofmight 14y ago
Where can I read about these recent changes to Skype? I use Skype mostly for IM, but also the occasional voice/video call, what's a better, more secure alternative?

tomjen3 14y ago

I understand as a hacker that you want to provide the truth, but the way to stop these letters isn't to downplay their danger, but to make people scared to death of them.

haberman 14y ago
If someone appeals to me to care about X but lies about the facts of X, their credibility is damaged in my eyes and I am inclined to think that they are overplaying the danger. For example, "sneak" replied to my comment with lots of CAPITAL LETTERS and links to other information. But I'm already less inclined to trust sneak, since he/she is already known to play fast and loose with the facts.
- sneak 14y ago
  I don't mean to appear to be playing fast and loose with the facts. Certainly, the NSA tapping exchanges is a different issue than whatever restrictions the government has placed on itself when issuing NSLs for message metadata. The fact is, message metadata is enough. I have friends and acquaintances that have been harassed and detained by officials based on their names appearing in contact lists of other suspected-but-not-charged-with-anything individuals. We're not even talking about evidence of actual communications such as message headers or metadata. The fact that they can (and do) pull thousands of people's message headers and have access to the communications graph and traffic frequency without ANY JUDICIAL OVERSIGHT WHATSOEVER means that their ability to conduct state-sponsored extrajudicial harassment is way out of control. It truly doesn't matter if NSLs allow them to get the body of the messages or not. If you're on the radar, you and everyone you communicate with regularly is a target. There are no legal remedies for this sort of stuff anymore. If you do anything of import non-anonymously, you can expect to have your hardware stolen and never returned (under the guise of a search), your travel impeded, your accounts inaccessible (google "civil asset forfeiture"), your social network harassed and detained similarly, and your access to legal remedies hindered in every conceivable way. A half-dozen examples known to me personally come to mind immediately. I'm sure there are more that I don't know about. The threat is very real, and trying to split hairs about whether or not "reading your email" means message bodies or just headers is not productive.

csoghoian 14y ago

I'm a privacy researcher, specifically focusing on government access to data held by Internet companies. Google, your employer, will not confirm, on the record, what they will or will not disclose when they get an NSL. The NSL statute does not authorize the disclosure of transactional records. 18 USC 2709(b)(1) states that the government can only get "the name, address, length of service, and local and long distance toll billing records" Furthermore, a 2008 opinion from the Office of Legal Counsel at DOJ specifically confirmed that the FBI cannot use NSLs to get email to/from data, even though the government has asked for it in the past. See: http://www.justice.gov/olc/2008/fbi-ecpa-opinion.pdf http://www.justice.gov/olc/2008/fbi-ecpa-opinion.pdf NSLs are gagged, and so Google cannot confirm when it gets NSLs, or for which customers the government is seeking data. However, Google could very easily provide information to the public confirming what it will and will not deliver to the FBI when it receives an NSL. I have asked Google's legal and DC policy team for this info, repeatedly, and hit a brick wall.

taliesinb 14y ago
I'm not a privacy researcher, but my guess is this is probably less "they won't answer because all your worst fears are true" and more "they won't answer because they don't want to narrow their future options and political maneuvers".

retrogradeorbit 14y ago

http://www.wired.com/threatlevel/2007/06/librarians-desc/ http://www.wired.com/threatlevel/2007/06/librarians-desc/ Does reading your library records count... How do you know the same hasn't been done with your email? You don't. Because it's secret. Is this an open society? A free society?