7 ms·
Senate bill rewrite lets feds read your e-mail without warrants
- ck2 14y agoWanna bet there is an exclusion for legislators in the bill? Just like they get their own pass for the TSA at airports.
- jamesbritt 14y ago" ... two legs better."
- meaty 14y agoYay to the EU Safe Harbour. Oh no wait a minute. This is why we host all our stuff ourselves in a UK DC. Snooping legislation is crazy in the land of the free
- mtgx 14y agoHasn't UK just passed an outrageous snooping bill recently?
- meaty 14y agoYes but we're still protected by DPA and European data protection law.
- gregsq 14y agoThe writing on the wall was visible to the Australian government as well, which chanced free trade agreements to keep things local.
- indiecore 14y agoHow is Australia these days?
- datalus 14y agoThe land of the free? Whoever told you that is your enemy.
- spindritf 14y agoIn UK you can go to jail for not remembering your password. There's nothing to "yay". > A 19-year old from Lancashire has been sentenced to 16 weeks in a young offenders institution for refusing to give police the password to an encrypted file on his computer. http://www.theregister.co.uk/2010/10/06/jail_password_ripa/ http://www.theregister.co.uk/2010/10/06/jail_password_ripa/
- pixelbath 14y ago"Forgetting" the password to files comprising the entirety of evidence pertaining to the investigation of a crime is hardly the same as being jailed for forgetting an arbitrary password.
- CapitalistCartr 14y agoIt looks the same to me. If the "files comprising the entirety of evidence" are what's encrypted, then there is no case unless and until they decrypt them. What's to stop them from jailing anyone they want who can't/won't decrypt everything on their computer at demand? This is exactly how police states operate. A police state doesn't require evil intent. On the contrary, each one starts out with the BEST of intentions.
- smokeyj 14y agoYou rascally government! Can we just cut the foreplay? Let's fire up the incinerators and form some orderly lines.
- owendbybest 14y agoIt's time for more encryption, at least for anything we store in "the cloud".
- smokeyj 14y agoI wish there was a router that could automagically handle encryption. This way even grandma could plug in her "freedom box" behind her router and have secure communications. Maybe a simple web based admin page to manage configuration.
- 1337biz 14y agoWould love to see this, i.e. some open source box, that just handles OpenVPN and TrueCrypt for the local network. As an idea it sounds not that overtly complex to realize - just hoping somebody will take something like this one day on Kickstarter.
- jim-greer 14y agoThat sounds very hard. How does it know to encrypt my Google docs, but not my public tweets?
- mtgx 14y agoI'm hoping web crypto will solve this, but only if the e-mail and storage service providers offer the option in an intuitive way, and I don't think the big ones like Google and Microsoft will want to do that unless we all demand it. It's also not going to be a finished draft until 2014, so we have to wait a little more. http://www.w3.org/2012/webcrypto http://www.w3.org/2012/webcrypto
- thematt 14y agoWeb crypto will never solve this, especially not when provided by a big company like Google/MSFT. They'll always have provisions to make the unencrypted version available to authorities. You can only trust client side encryption.
- dendory 14y agoBye cloud, we hardly knew ye.
- wissler 14y agoSome of us have observed that the cloud was a stupid idea from the beginning. All the cloud should be is an encrypted data service for locally run and stored programs, without anyone but you having access to the data in unencrypted form.
- meaty 14y agoYou are probably one of the last bastions of common sense. Everyone is eager to sell out their data.
- fauigerzigerk 14y agoAnd why would lawmakers be intimidated by encryption? They could just force you to decrypt whenever one of those agencies asks for it and punish you with lengthy jail terms if you refuse.
- pyre 14y agoIf everyone used encryption, and they started doing this, we could at least get rid of the facade of "we are not attempting to pool power in a way that will lead to a police state." It would be a bald-faced power-play.
- wissler 14y agoExactly. It means the pretense evaporates, and that the sheep wake up. I mean, if some government agent rifles through their stuff in the cloud, the sheep don't care. But if they knock on the sheep's door and do it, then the sheep is going to get angry, if he's innocent.
- greenyoda 14y agoAt least if they had to force you to decrypt, you would know that they had access to your data and they couldn't read it secretly. Also, forcing you to decrypt something would presumably require an order from a judge, which would presumably require the police to show probable cause.
- rayiner 14y ago"At the moment, Internet users enjoy more privacy rights if they store data on their hard drives or under their mattresses, a legal hiccup that the companies fear could slow the shift to cloud-based services unless the law is changed to be more privacy-protective." It's not really a legal hiccup. Let's rewrite it without the editorializing: "At the moment, Internet users enjoy more privacy rights if they keep their data private than if they share their data with non-governmental third parties..." If you tell me you're planning to kill someone, the FBI doesn't need a search warrant to get me to testify about what you said. A subpoena will do. Why should it be different if you tell Google you're planning on killing someone, by storing "Killing Someone Plans.doc" on their servers in plain text?
- jim-greer 14y ago> Why should it be different if you tell Google you're planning on killing someone, by storing "Killing Someone Plans.doc" on their servers in plain text? Because there's an expectation of privacy when you store information with password protection. http://en.wikipedia.org/wiki/Expectation_of_privacy http://en.wikipedia.org/wiki/Expectation_of_privacy
- tadfisher 14y agoWhat if I print out the document in plain English and store it in a safe-deposit box? I'd say that's a more apt comparison.
- jerf 14y agoMetaphors are not helpful for understanding this sort of issue. It's a bit like and a bit not like all kinds of things, and isn't exactly enough like anything else.
- mseebach 14y agoI agree you don't need metaphors, but not because it's not like anything, rather because it's too simple to need a metaphor: If you give something, anything, to a third party to handle or keep, the government can't demand to go and look at it without a warrant. The government can't demand to go look in your safety deposit box, it can't get your library check out records, it can't see how many airline miles you have, it can't read the mail in your PO box etc etc without a warrant. Of course, in some of those cases, the third party will cooperate without a warrant, but they're not required to.
- sneak 14y agoIs anyone surprised by this, in the wake of PATRIOT and NDAA? The time to leave the US is now. You no longer have the basic rule of law. Collect your family and possessions and emigrate. It's not easy[1], but it's the only way, now. We're never getting those rights back. [1] I did it. It's tough, no foolin'.
- 16s 14y agoWhere did you move to? Honestly, I really am curious.
- moens 14y agoI'm not the OP, but: Anywhere with mountain plains (2000ft+) for decent growing and grazing for cattle or sheep. Temperate zones are best to minimize disease vectors. This can work anywhere (even in the US) because rule of law is more or less like cell phone coverage. > http://img203.imageshack.us/img203/9017/worldfactor10.jpg http://img203.imageshack.us/img203/9017/worldfactor10.jpg
- johngunderman 14y agoIf you don't mind me asking, what country did you move too that has better personal rights? I know that Canada and most of the EU have a worse track record than the US when it comes to this. IMHO moving out of the US just avoids the problem, instead of solving it. We need to put more support behind advocacy groups like the EFF who's mission statement is to fight against the infringement of personal rights.
- protomyth 14y agoWhich Senator's staffs rewrote the bill?
- moens 14y agoWhich Senator's lobbyists rewrote that bill? ftfy
- protomyth 14y agoYep, someone lobbied and it might not be an actual lobbyist, but a government agency. Regardless, some Senator or Senators is responsible for the rewrite. We need to know which ones did it. How it was done or who they took direction from is irrelevant. One or more Senators signed off on this.
- r00fus 14y agoFrom the article, I read it's Leahy's: "CNET has learned that Patrick Leahy, the influential Democratic chairman of the Senate Judiciary committee, has dramatically reshaped his legislation in response to law enforcement concerns. A vote on his bill, which now authorizes warrantless access to Americans' e-mail, is scheduled for next week."
- mekane8 14y agoThis is troubling. Anyone have advice for who to contact about this? (Should I look up my senator, congresspeople, both?)
- zrail 14y agoContact your senators. Here's a handy search site: http://whoismyrepresentative.com/ http://whoismyrepresentative.com/
- deleted 14y ago[deleted]
- cacois 14y agoI think this is a great idea - making people aware of this assault on rights is the best possible course of action, at this point
- mercurialshark 14y agoSorry, on a plane and somehow deleted former post with iPad. Anyway, I'm still serious about getting former profs/legal scholars involved in a podcast setting, hn members with insight to how it will have a deleterious effect on tech progress (the cloud) and launching a fierce social media campaign from it.
- mercurialshark 14y agoBecause nothing says freedom like regulators from the OSHA and SEC warrantlessly reading your drunk messages.
- Wohlf 14y agoWow, there's a lot of speculation and circlejerking in these comments, and very little actual discussion. Whoever thought up this rewrite picked a perfect time. With the whole Patreaus situation still fresh, "A Senate proposal touted as protecting Americans' e-mail privacy" seems like a home run for the Senate. I hope people realize how dangerous this would be.
- joering2 14y agoOK enough is enough! In the light of this bill, post-thanksgiving time I will spend on cleaning up all my email boxes and would like your suggestions for a new email account that fulfills the following requirements: - is located off shore, preferably some small country with less draconian laws that exists now and could be implemented in near future (15 years?), BUT stable enough so that my service can be reliable, - content of my emails is automatically encrypted, - and at this point, I am fine with paying for my email. The amount of work it lets me do, I am fine with paying up to $49/month, I think. Thanks!
- mtgx 14y agoThe best solution right now is probably to use a desktop app that encrypts e-mails locally with OpenPGP before sending them. Can't someone make a Chrome extension that does the same for Gmail, though? There seem to be a few solutions for Firefox.
- sneak 14y agoHint: You are not the first person to notice that crypto can be done client-side in Javascript. There are very good and not-obvious reasons why this is not done.
- aharrison 14y agoCould you please elaborate, so that more people do not fall into this intellectual trap?
- sneak 14y agohttp://www.matasano.com/articles/javascript-cryptography/ http://www.matasano.com/articles/javascript-cryptography/ Basically, the server you're talking to, as well as any resources on that page, can undermine your javascript primitives and render your crypto useless (or just backdoor it). If you trust the server to not backdoor your crypto... you can just trust the server to _do_ the crypto in the first place. There is an effort underway to build better crypto APIs into browsers, but I'll bet you a bitcoin that it's super easy to fuck up the implementation of and most end up being insecure, and/or nobody ends up using it after all.
- pnathan 14y agoI'd like to take this opportunity to remind everyone that GPG encryption for email (and other data) is freely available. It would be considerably more generally usable if someone with design skills contributed to the projects. The Mac GPG integration is nice, but in my explorations outside of that, it's been... difficult to use. Particularly galling is the key distribution problem. :-)
- fauigerzigerk 14y agoEncryption has a couple of drawbacks. If you happen to be unable to decrypt something the authorities want to see, you go to jail for a long time in some countries. And then of course I can't make everyone I communicate with use encryption. So all I can do is encrypt incoming mail, which is rather pointless because there's another unencrypted copy out there and the mail headers will give away where to look.
- mtgx 14y agoIt seems the OTR protocol works around that, as I think the messages are not stored indefinitely like with PGP: http://www.cypherpunks.ca/otr/otr-wpes.pdf http://www.cypherpunks.ca/otr/otr-wpes.pdf
- deleted 14y ago[deleted]
- drcube 14y agohttp://www.gnupg.org/ http://www.gnupg.org/ Problem solved.
- Jach 14y agoDat personal responsibility. Isn't it great when purely technical solutions exist (for quite some time) to these problems?
- scott_karana 14y agoUnfortunately not, encryption is simply a workaround. The bill covers every user of email, but it's not hard to make the argument that neither GPG or PGP are correctly usable by every user of email. Despite there being a technical workaround, it's simply a kludge; strong civil liberties need to be in place, with encryption simply augmenting them.
- shill 14y agoPOST TO FACEBOOK AS: The Senate is voting on a law next week that will let employees from 22 different federal agencies eat your Twinkies whenever they feel like it!!!
- Buzaga 14y agoCouldn't this mean a big hit to ALL american IT companies? I for one(brasilian) would move out of G-mail right off the bat, this bill probably means USA gets to snoop and mine data on anyone even if not an american citizen, possibly even if such thing is illegal in this person country... I'd definitely consider abandoning plenty of USA-based services/business, use an alternative from some other place that has some regard for humanity, spread the word to people I know, maybe even making a living off of it - "come to my service everyone, we're not .com!"
- adventured 14y agoThe short answer: absolutely The relatively strong property rights and privacy laws that the US has enjoyed are being obliterated at warp speed (or more specifically, they're using the leap to digital as a means to bypass all the existing physical protections on the books, pretending none of it applies).
- sneak 14y agohttp://en.wikipedia.org/wiki/ECHELON http://en.wikipedia.org/wiki/ECHELON http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_controversy http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_co... http://en.wikipedia.org/wiki/Room_641A http://en.wikipedia.org/wiki/Room_641A Let's not act like this is something new. Your rights to privacy have been gone for some time.
- tptacek 14y agoThe point of privacy in public policy, or any other right for that matter, isn't that we get things right 100% of the time. We didn't suddenly give up on the idea of mass detention of people by race after we set up Japanese Internment Camps. We are going to get things wrong, regularly. Think of the Constitution and our civil liberty norms as an error correction code. At any one point in time, we'll have flipped numerous bits the wrong way; the point is that over time, the US is overall run in the fashion it was originally intended to run in.
- sneak 14y agoI think that was absolutely true for a very, very long time, ending sometime (±10 years) around the time that I was born (1983). Call it an unrecoverable two-bit error, in your metaphor.
- b6 14y agoI would really like to believe this. But the US is killing its own citizens without due process, according to secret lists. The emails, IMs, and whatever else that we send are being stored at the NSA facility in Utah. These are just bits that need to be flipped back the other way? What greater contradiction to the original ideas of the US could you imagine, and what progress do you see to correct them?
- tptacek 14y agoThis is a thread full of passionately argued polemics about the US national security state and not one link to the legislation proposed in any incarnation. After the debacle that was the trade press reporting on CISPA, it is probably a bad bet that Declan McCullagh got this exactly right. Obviously, a provision that allows law enforcement warrantless access to random people's email would be a terrible thing. It seems a little unlikely that in the wake of the Patraeus scandal, that's what Leahy would really be proposing. Maybe it is. Can we FIND OUT? Late edit: here it is: http://news.ycombinator.com/item?id=4811489 http://news.ycombinator.com/item?id=4811489
- sneak 14y agoNo point. It's shitty living somewhere with a government that would propose this sort of thing. It's also like rearranging the deck chairs on the Titanic, as the NSA et al have already tapped everyone's fibers years ago. Furthermore - it's not a secret that they did so. Books have been written on the matter. The public got suitably outraged, and then nothing happened. The taps are all still there, and the equipment's all been upgraded as the capacities have increased. It truly doesn't matter what these laws say. Your communications in the US are all already monitored as a fact of life.
- tptacek 14y agoI respectfully but vigorously disagree with you that there's no point discovering what proposed laws say. It's our responsibility as citizens to figure this stuff out. There aren't that many "cyber" laws proposed every year. This is a country in which people of African descent couldn't even reliably vote 55 years ago. I refuse to succumb to the notion that all is lost simply because we've had 8-10 years of overreach.
- sneak 14y ago> It's our responsibility as citizens to figure this stuff out. Well, that, or flee. > I refuse to succumb to the notion that all is lost simply because we've had 8-10 years of overreach. If that's the case, I ask non-sarcastically: How many decades of tapped phones, illegal body searches, and indefinite detention and/or torture of political prisoners are you willing to wait for reform before you declare the US an unacceptable place for good and reasonable people to continue living in and paying taxes to? I'm genuinely curious. Is there an upper bound? For me, personally, it was ~8 years. "The most dangerous man to any government is the man who is able to think things out for himself, without regard to the prevailing superstitions and taboos. Almost inevitably he comes to the conclusion that the government he lives under is dishonest, insane and intolerable, and so, if he is romantic, he tries to change it. And even if he is not romantic personally he is very apt to spread discontent among those who are." --H. L. Mencken
- adventured 14y agoA lot of people wonder why Americans aren't more outraged about the increasing number of fascist laws being passed in the US. The obvious answer is that too many Americans no longer believe in the basic rights to property and privacy. The civil liberty wing of the Democrat party has also been completely destroyed. It's not just the policy makers - it's the American people that are at fault. It's their sense of life, ideas and culture that is bankrupt.
- nathan_long 14y ago>> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. I don't understand how anyone can think that the founding fathers would not have considered email and cell phone conversations to fall under this provision. I'm so sad about our country's abandoning the principles of freedom.
- _delirium 14y agoThe main issue here is that it's legislation covering cases not covered by the 4th amendment, i.e. where there is no Constitutional violation in the search, but which the legislature could add additional statutory requirements to. And the main reason that's the case is that you only have 4th-amendment rights in your person and property, but you have no property rights in your Facebook account, which is wholly owned by Facebook, and which you use for free only as a guest. So the only party that could object to a search of Facebook is Facebook itself (they could fight subpoenas, attempting to quash them as unreasonable impositions... not unreasonable impositions on you, but on Facebook). I don't think that's a good state of affairs, but I can see how it logically makes sense. On HN we're often reminded that people have no right as users to any particular service from Google or Facebook, and the reason is that they don't own anything about the service or the data on it. Facebook could sell your data to advertisers, they could mail all your posts to the FBI without a warrant, whatever they want. So similarly there is no 4th-amendment right that you have relating to a search of Facebook, because it's not a search of your person or property, but of theirs. In the Founding generation this wouldn't have been an issue because it was not common to for a person to store significant amounts of their personal papers in a form where they had no ownership over them (even when you stored with a 3rd party, like in a bank safety deposit box, there was typically a contract specifying that you had certain ownership rights). I do think there should be a fix to it, which will require implying some kind of rights that Facebook users have against government searches of Facebook targeted at that user (despite the user having no ownership in Facebook). But one wouldn't want that to go too far, because I can also see the property-rights argument: if I really do want to voluntarily mail the data on my server to the FBI, and I didn't sign a contract with the users saying I wouldn't, why should the users be able to stop me from doing so? You'd have to abrogate property rights with some kind of right-to-information-privacy that supersedes the fact that it's my server and I own its contents. Overall it seems like a situation that the Constitution's framers didn't imagine.
- stfu 14y agoI am just wondering, why the topic here is "senate bill rewrite", and not "Democratic Majority in the Senate wants to led feds read your e-mail without warrants". Maybe it is just me, but the recent (absolutely justified) bashing of the GOP retraction the copyright policy paper makes me wonder, why negative GOP stories have always attached to the party name, while DEM stories are usually attributed to a single politician or the institution per se.