6 ms·

There's no federal law requiring AT&T to hold onto this data. There's possibly a FISA court requirement (too secret to reveal), but AT&T has long been an excee

There's no federal law requiring AT&T to hold onto this data. There's possibly a FISA court requirement (too secret to reveal), but AT&T has long been an exceedingly willing part of the gov's spying apparatus. It fed these records and Internet data to the feds without any court order, and only escaped legal troubles when Obama, contrary to his campaign promises, gave AT&T, Verizon and more retroactive immunity

imroot 2y ago
I'm no longer under this specific NDA, so, I can talk a bit about this. It was well known in the wireless industry that ATT collected and kept the most data on all of the carriers: 7 years for text metadata, "7 years" for call history (I put that in quotations because it was rumored that ATT kept them indefinitely, but, there were technical limitations for restoring data that far back), and 7 years for the contents of the text messages themselves. Verizon was up there as well, but, I don't remember specifics. The carrier that I worked with kept only 3 days content of the actual messages, 28 days for the text message metadata, and 28 days for the call records for their enforcement database, but, they could get calling records and sms envelope information for billing back 7 years, and at the time, we had to implement sharding at the database layer that maintained the warrant database due to the amount of traffic that we were receiving from the calling systems and the amount of queries/data that we were sending out, in near realtime, to law enforcement users who paid $10,000/month for access to that data. AT&T wasn't storing this data out of the kindness of their heart, it was a (probably small) revenue stream for them.
- mozman 2y ago
  Ah, back in the day the FBI would pay our CTO $5000/hr to talk to and work with him. On top of that we would charge them a monthly colo fee for their equipment that collected data of customers. Sometimes they had warrants, but mostly just bought the data. A year or so after 9/11 and that relationship lasted years.
  - niutech 2y ago
    Welcome to the US - claimed "praiser" of freedom, but with no respect for privacy. Even the EU is better at maintaining privacy than the US.
    - twelve40 2y ago
      the EU is much more aggressive at banning and censoring websites though. I can't recall the last time I ran into a website in the US that's blocked at the provider level (private moderation like e.g. Youtube is a different story). Maybe Tiktok is the most famous, but it's still around and available afaik. But in the EU, ran into "the government has decided this information is bad for you" all the time, with a nice notice from the internet provider. My hunch is that under various pretexts both societies will continue to drift towards more censorship and less privacy, perhaps with some temporary local differences.
      - fennecbutt 2y ago
        I've never encountered anything like that while over here.
      - niutech 2y ago
        It depends on the country, the EU doesn't have the same laws for Internet censorship. Still in most EU countries it is better than in the US: https://en.wikipedia.org/wiki/Internet_censorship_and_surveillance_in_Europe https://en.wikipedia.org/wiki/Internet_censorship_and_survei...
- whamlastxmas 2y ago
  Retention periods seem like a moot point if the government just slurps every piece of data anyway and stores it indefinitely
  - deleted 2y ago
    [deleted]
    - deleted 2y ago
      [deleted]
  - smegger001 2y ago
    Not everyone in law enforcement gets to play with the NSA's toys though. Some actually have their warrant and subpoenas glanced at by a judge before it gets rubber stamped.
    - mrandish 2y ago
      While being briefly "glanced at" by a judge is certainly better than nothing (or just already having the data like NSA), practically it just means law enforcement needs to adapt some generic boilerplate justification text to each request.
- theGnuMe 2y ago
  They keep personal customer details like SSNs indefinitely despite no longer being a customer.
- toomuchtodo 2y ago
  Thank you for sharing this, it is helpful context when discussing data security and privacy with regulators and federal Congressional reps.
deleted 2y ago
[deleted]
illiac786 2y ago
That’s interesting, I did not know this about the Obama govt. Do you have a good article about this? (Yes I’m lazy I could search for this)
- BEEdwards 2y ago
  https://www.politifact.com/article/2008/jul/14/obamas-wiretapping-flip-flop-yes/ https://www.politifact.com/article/2008/jul/14/obamas-wireta...
renegade-otter 2y ago
They added windows to this now, but I always wondered what this windowless skyscraper was, back in the day, in Downtown NYC. https://nymag.com/intelligencer/2016/11/new-yorks-nsa-listening-station-is-hiding-in-plain-sight.html https://nymag.com/intelligencer/2016/11/new-yorks-nsa-listen...
- matthewdgreen 2y ago
  That’s the AT&T Long Lines Building. It probably did have an NSA surveillance closet, but it wasn’t built without windows for that reason. The story I was told (by older colleagues when I worked at AT&T Labs) was that it was built during a time when riots and street violence were more common, so the fortress appearance was to ensure the city could maintain long-distance connectivity during urban unrest. I believe there was another similar nexus downtown near the World Trade Center, which was destroyed on 9/11. For at least a couple of weeks we had very limited communications and credit cards were hard to use as a result.
  - renegade-otter 2y ago
    Perhaps, but the other version would explain the "nuclear-war-proof" thing. I am sure the employees were told SOME kind of legend, because that building begs questions.
    - matthewdgreen 2y ago
      A tall above-ground building with no windows doesn’t seem like a good candidate to survive a nuclear blast.
      - petre 2y ago
        Yup, an underground structure would normally be a better design. But that would quickly get flooded with water in Manhattan in the event of a nuclear blast followed by loss of power.
      - Spooky23 2y ago
ascorbic 2y ago
Americans like to complain about the GDPR, but it exists to prevent exactly this sort of thing. Data cannot be retained longer than it's actually needed or required by law, and can't be sold without explicit permission. Law enforcement can't just buy data: they need to have legal authority to get it (though in many countries the bar for that is too low). In most cases the cheapest and easiest approach is to collect as little data as possible, and to delete it as soon as it's not strictly needed. This greatly reduces the compliance burden.
- PierceJoy 2y ago
  Do Americans complain about the GDPR? I’ve only ever seen them say they wish the US had something similar.
  - Kwpolska 2y ago
    American businesses, especially in predatory industries like adtech, complain all the time.
    - _heimdall 2y ago
      I would hardly roll that up to all Americans though. Of course companies who's business model is seriously hurt by GDPR would complain. Most Americans wouldn't even know what GDPR is, let alone have a reason to complain about it.
      - Jensson 2y ago
        They are talking about Americans on this site, who very often work at companies that GDPR is made to stop predating on users. Many European users here also works at such companies, so you often see it from them as well, but not as often since those companies are mostly American.
        _heimdall 2y ago
        Ah got it, I totally missed that context here somehow. I hadn't noticed a habit of Americans here complaining about GDPR, but that's interesting given another common pattern here of libertarian ideas. An American complaining about a different countries internal policies doesn't seem particularly libertarian.
yazzku 2y ago
> There's no federal law requiring AT&T to hold onto this data. This is false? https://www.law.cornell.edu/uscode/text/18/2703 https://www.law.cornell.edu/uscode/text/18/2703 https://www.usnews.com/news/articles/2015/05/22/how-long-cellphone-companies-store-your-call-records https://www.usnews.com/news/articles/2015/05/22/how-long-cel...
- rsingel 2y ago
  There's required disclosure using an administrative subpoena for records over 180 days old if they have them CALEA requires phone (and later broadband) equipment to conform to wiretapping standards, and if a carrier gets a court order to wiretap it has to provide that data from warrant receipt til warrant expiration. Landlines have some data retention requirements. But there's no law on broadband or wireless data retention. There may well and likely is a secret FISA court order under section 702 that's been served to telecoms, but an astonishingly small number of people in govt and industry know whether that actually says that they just have to hand over records in real time or whether they need to keep records for some period of time.
fieldcny 2y ago
That’s was Bush not Obama

imroot 2y ago

I'm no longer under this specific NDA, so, I can talk a bit about this. It was well known in the wireless industry that ATT collected and kept the most data on all of the carriers: 7 years for text metadata, "7 years" for call history (I put that in quotations because it was rumored that ATT kept them indefinitely, but, there were technical limitations for restoring data that far back), and 7 years for the contents of the text messages themselves. Verizon was up there as well, but, I don't remember specifics. The carrier that I worked with kept only 3 days content of the actual messages, 28 days for the text message metadata, and 28 days for the call records for their enforcement database, but, they could get calling records and sms envelope information for billing back 7 years, and at the time, we had to implement sharding at the database layer that maintained the warrant database due to the amount of traffic that we were receiving from the calling systems and the amount of queries/data that we were sending out, in near realtime, to law enforcement users who paid $10,000/month for access to that data. AT&T wasn't storing this data out of the kindness of their heart, it was a (probably small) revenue stream for them.

mozman 2y ago
Ah, back in the day the FBI would pay our CTO $5000/hr to talk to and work with him. On top of that we would charge them a monthly colo fee for their equipment that collected data of customers. Sometimes they had warrants, but mostly just bought the data. A year or so after 9/11 and that relationship lasted years.
- niutech 2y ago
  Welcome to the US - claimed "praiser" of freedom, but with no respect for privacy. Even the EU is better at maintaining privacy than the US.
  - twelve40 2y ago
    the EU is much more aggressive at banning and censoring websites though. I can't recall the last time I ran into a website in the US that's blocked at the provider level (private moderation like e.g. Youtube is a different story). Maybe Tiktok is the most famous, but it's still around and available afaik. But in the EU, ran into "the government has decided this information is bad for you" all the time, with a nice notice from the internet provider. My hunch is that under various pretexts both societies will continue to drift towards more censorship and less privacy, perhaps with some temporary local differences.
    - fennecbutt 2y ago
      I've never encountered anything like that while over here.
    - niutech 2y ago
      It depends on the country, the EU doesn't have the same laws for Internet censorship. Still in most EU countries it is better than in the US: https://en.wikipedia.org/wiki/Internet_censorship_and_surveillance_in_Europe https://en.wikipedia.org/wiki/Internet_censorship_and_survei...
whamlastxmas 2y ago
Retention periods seem like a moot point if the government just slurps every piece of data anyway and stores it indefinitely
- deleted 2y ago
  [deleted]
  - deleted 2y ago
    [deleted]
- smegger001 2y ago
  Not everyone in law enforcement gets to play with the NSA's toys though. Some actually have their warrant and subpoenas glanced at by a judge before it gets rubber stamped.
  - mrandish 2y ago
    While being briefly "glanced at" by a judge is certainly better than nothing (or just already having the data like NSA), practically it just means law enforcement needs to adapt some generic boilerplate justification text to each request.
theGnuMe 2y ago
They keep personal customer details like SSNs indefinitely despite no longer being a customer.
toomuchtodo 2y ago
Thank you for sharing this, it is helpful context when discussing data security and privacy with regulators and federal Congressional reps.

deleted 2y ago

[deleted]

illiac786 2y ago

That’s interesting, I did not know this about the Obama govt. Do you have a good article about this? (Yes I’m lazy I could search for this)

BEEdwards 2y ago
https://www.politifact.com/article/2008/jul/14/obamas-wiretapping-flip-flop-yes/ https://www.politifact.com/article/2008/jul/14/obamas-wireta...

renegade-otter 2y ago

They added windows to this now, but I always wondered what this windowless skyscraper was, back in the day, in Downtown NYC. https://nymag.com/intelligencer/2016/11/new-yorks-nsa-listening-station-is-hiding-in-plain-sight.html https://nymag.com/intelligencer/2016/11/new-yorks-nsa-listen...

matthewdgreen 2y ago
That’s the AT&T Long Lines Building. It probably did have an NSA surveillance closet, but it wasn’t built without windows for that reason. The story I was told (by older colleagues when I worked at AT&T Labs) was that it was built during a time when riots and street violence were more common, so the fortress appearance was to ensure the city could maintain long-distance connectivity during urban unrest. I believe there was another similar nexus downtown near the World Trade Center, which was destroyed on 9/11. For at least a couple of weeks we had very limited communications and credit cards were hard to use as a result.
- renegade-otter 2y ago
  Perhaps, but the other version would explain the "nuclear-war-proof" thing. I am sure the employees were told SOME kind of legend, because that building begs questions.
  - matthewdgreen 2y ago
    A tall above-ground building with no windows doesn’t seem like a good candidate to survive a nuclear blast.
    - petre 2y ago
      Yup, an underground structure would normally be a better design. But that would quickly get flooded with water in Manhattan in the event of a nuclear blast followed by loss of power.
    - Spooky23 2y ago

ascorbic 2y ago

Americans like to complain about the GDPR, but it exists to prevent exactly this sort of thing. Data cannot be retained longer than it's actually needed or required by law, and can't be sold without explicit permission. Law enforcement can't just buy data: they need to have legal authority to get it (though in many countries the bar for that is too low). In most cases the cheapest and easiest approach is to collect as little data as possible, and to delete it as soon as it's not strictly needed. This greatly reduces the compliance burden.

PierceJoy 2y ago
Do Americans complain about the GDPR? I’ve only ever seen them say they wish the US had something similar.
- Kwpolska 2y ago
  American businesses, especially in predatory industries like adtech, complain all the time.
  - _heimdall 2y ago
    I would hardly roll that up to all Americans though. Of course companies who's business model is seriously hurt by GDPR would complain. Most Americans wouldn't even know what GDPR is, let alone have a reason to complain about it.
    - Jensson 2y ago
      They are talking about Americans on this site, who very often work at companies that GDPR is made to stop predating on users. Many European users here also works at such companies, so you often see it from them as well, but not as often since those companies are mostly American.
      - _heimdall 2y ago
        Ah got it, I totally missed that context here somehow. I hadn't noticed a habit of Americans here complaining about GDPR, but that's interesting given another common pattern here of libertarian ideas. An American complaining about a different countries internal policies doesn't seem particularly libertarian.

yazzku 2y ago

> There's no federal law requiring AT&T to hold onto this data. This is false? https://www.law.cornell.edu/uscode/text/18/2703 https://www.law.cornell.edu/uscode/text/18/2703 https://www.usnews.com/news/articles/2015/05/22/how-long-cellphone-companies-store-your-call-records https://www.usnews.com/news/articles/2015/05/22/how-long-cel...

rsingel 2y ago
There's required disclosure using an administrative subpoena for records over 180 days old if they have them CALEA requires phone (and later broadband) equipment to conform to wiretapping standards, and if a carrier gets a court order to wiretap it has to provide that data from warrant receipt til warrant expiration. Landlines have some data retention requirements. But there's no law on broadband or wireless data retention. There may well and likely is a secret FISA court order under section 702 that's been served to telecoms, but an astonishingly small number of people in govt and industry know whether that actually says that they just have to hand over records in real time or whether they need to keep records for some period of time.

fieldcny 2y ago

That’s was Bush not Obama