3 ms·

Google hands over email addresses based on court orders and (less frequently) warrants. So, the authorities have the resources to request user data by

by clicks 13y ago

Google hands over email addresses based on court orders and (less frequently) warrants. So, the authorities have the resources to request user data by the numbers 14,000 and above from just Google alone for Gmail accounts [1]... and you're telling me we need more cyber security bills to make it even easier for them. Don't you think they already have it easy enough? I'm still skeptical about your claim that presently there exist no means for USG to legally hand over malware samples to the authorities in existing legal frameworks. Can you provide some citation that talks about this? [1] http://www.google.com/transparencyreport/userdatarequests/ http://www.google.com/transparencyreport/userdatarequests/ -- it should be noted that Google complies with the requests a majority of times. Also, it is reasonable to assume that it is mostly American gov't agencies who make up for most of the requests.

tptacek 13y ago
The bill isn't about user data! Even if you think it is, you're not addressing the concern, which is that regardless of what the situation is with user data, it is difficult for private companies to share operational intel with the USG, and even more difficult for the USG to share operational intel out.
jholman 13y ago
Argh, you're describing two entirely unrelated scenarios. And tptacek has explained this many many times already; I've read half a dozen explanations by him in HN comments in the last 3 days alone. Disagree with his suggestions for what we ought to do, sure, but at least try to understand what's going on before you make snippy comments. If the USG thinks John Doe is a criminal, they can go after his data via various avenues, including warrants, subpoenas, NSLs, blah blah. This is one situation. A separate situation is that Google thinks there is crime afoot, and wants to report it, but they cannot meaningfully give any information to law enforcement because of privacy laws. It's like if your business got burgled, and you let the cops into your business to collect evidence, and while doing their job there they find out that John Doe is one of your customers, and that he visited your shop on July 9th, or something, and now you committed a crime for letting the cops know about John Doe. I'm not saying CISPA is a good idea or a bad idea. (And I think various people have raised some legitimate concerns.) I'm saying that you should try to understand what it's permitting; it's not giving the USG new abilities to force their way in to read user data, it's giving victims of crime permission to take certain actions to fight crime. (Maybe we shouldn't give them those permissions, though.) And by the way, it might be reasonable to make assumptions about how many of those transparencyreport requests are USG agencies... EXCEPT that the same *@$% page you linked has actual numbers, that prove your assumption wrong. In the most recent 6-month reporting period, 21,389 total requests, 8,438 of them (40%) from the USG.

by clicks 13y ago

tptacek 13y ago

The bill isn't about user data! Even if you think it is, you're not addressing the concern, which is that regardless of what the situation is with user data, it is difficult for private companies to share operational intel with the USG, and even more difficult for the USG to share operational intel out.

jholman 13y ago

Argh, you're describing two entirely unrelated scenarios. And tptacek has explained this many many times already; I've read half a dozen explanations by him in HN comments in the last 3 days alone. Disagree with his suggestions for what we ought to do, sure, but at least try to understand what's going on before you make snippy comments. If the USG thinks John Doe is a criminal, they can go after his data via various avenues, including warrants, subpoenas, NSLs, blah blah. This is one situation. A separate situation is that Google thinks there is crime afoot, and wants to report it, but they cannot meaningfully give any information to law enforcement because of privacy laws. It's like if your business got burgled, and you let the cops into your business to collect evidence, and while doing their job there they find out that John Doe is one of your customers, and that he visited your shop on July 9th, or something, and now you committed a crime for letting the cops know about John Doe. I'm not saying CISPA is a good idea or a bad idea. (And I think various people have raised some legitimate concerns.) I'm saying that you should try to understand what it's permitting; it's not giving the USG new abilities to force their way in to read user data, it's giving victims of crime permission to take certain actions to fight crime. (Maybe we shouldn't give them those permissions, though.) And by the way, it might be reasonable to make assumptions about how many of those transparencyreport requests are USG agencies... EXCEPT that the same *@$% page you linked has actual numbers, that prove your assumption wrong. In the most recent 6-month reporting period, 21,389 total requests, 8,438 of them (40%) from the USG.