10 ms·
FBI pressures Internet providers to install surveillance software
- northwest 13y agoNot naming names, but... > AT&T, T-Mobile, Verizon, Comcast, and Sprint declined to comment.
- clicks 13y agoI'll repaste a comment I made elsewhere, that seems applicable here: If a company is approached by any spooky three-letter agency, the higher-ups of that company could possibly interpret that as a validation that they've made it 'big' -- and furthermore, they could see in that offer a security that three-letter agencies then have an interest in seeing the company continue to scale up and succeed (because of limited funds, three-lettered agencies can't just go merrily creating tools that work properly with the 'next facebook' every other 9 months... and furthermore, there's no knowing if they'll come across resistance when they solicit 'direct access' to the next company. Also, NSA would have just loved it if China and Russia was a big user of Facebook... so I can even imagine them doing something subtle to try to make that a reality). Sadly, I do not see this trend ending anytime soon.
- bhauer 13y agoIndeed. That gives new emphasis to the notion of regulatory capture, wherein the regulatory agency has a vested interest in the continued success of its regulated clients. In this scenario, in a manner of speaking, the agency is seeking to be "captured," so that it can continue to leech lifeblood from the host.
- declan 13y agoSee also, from my earlier article: http://news.cnet.com/8301-13578_3-57593538-38/how-the-u.s-forces-net-firms-to-cooperate-on-surveillance/ http://news.cnet.com/8301-13578_3-57593538-38/how-the-u.s-fo... "The government has a lot of leverage," including contracts and licenses, said a representative for an Internet company. "There is a lot of pressure from them. Nobody is willingly going into this."
- tippytop 13y agoThe reciprocal, my Internet company will spy on my users in exchange for a government contract, wouldn't be called leverage, it'd be called corruption.
- northwest 13y ago> ... wherein the regulatory agency has a vested interest in the continued success of its regulated clients. The logical consequence for the consumer would then be to boycott these clients.
- dangrossman 13y agoThat might be logical, by some chain of reasoning, but it's not reasonable. To boycott them would mean to disconnect yourself from the internet -- impractical for many. Even if you live in a privileged zone with smaller ISPs available, your data still transits through these companies. By cutting yourself off, you forego giving them some miniscule amount of money, but you also disconnect yourself from news and the ability to communicate and organize with others who feel the same.
- deleted 13y ago[deleted]
- wil421 13y agoI think that the damage is already too great. They are probably already in all the hubs, exchanges and its not like they will give them back. It's no surprise that they are collecting all the cell data too, whether it be metadata or content. Who knows what kinda stuff they have in the actual hardware beside the repeaters they have on the fiber cables. My question is how do we enact a change. The genaral public (non-tech people) may not fully understand the implications of what they are doing and how much of our data thy are taking. If the large companies are just going to bend over how do we do something?
- northwest 13y agoSome say we need to get behind them ;-) But more seriously, the only healthy basis for a way out I see is to make literally every part of the "stack" open and transparent. "Open" as in "open source", both regarding hardware and software.
- wil421 13y ago<Some say we need to get behind them ;-) I've meet them too as long as out keeps the terrorists out they're fine with it. Open source software would help especially open source networking software.
- northwest 13y agoWhat I was trying to say: When people bend over, your best bet is to get "right behind" them, if you know what I mean ;-)
- jaekwon 13y agoLet's ask Stallman!
- mingmecca 13y agoIt seems like end to end encryption is the only way to go. It makes the UX not as convenient, but convenience is the carrot that has led us to this dismal point.
- northwest 13y ago> Judges are not always in a position, Boothby said, to understand how technology has outpaced the law. How is it that this issue was not already addressed, yet? Who runs this show?
- Zirro 13y agoIt would seem that those with the ability to address this issue are close to those who benefit from the lack of understanding.
- declan 13y agoIt depends on who you ask. But the DOJ and FBI and NSA are very good about getting what they want from Congress. I can't think of any clear examples in the last 15 years when Congress has rolled back surveillance authority. (They're thinking of doing it now re: email search warrants, but (a) it will have little practical effect because major companies already require it following a court decision and (b) even that limited reform is still not final and could actually make things worse.) Remember, the Patriot Act was sitting on a shelf long before 9/11, with the DOJ looking for good arguments in favor of it: http://news.cnet.com/8301-31921_3-20058797-281.html http://news.cnet.com/8301-31921_3-20058797-281.html Long before 9/11, the U.S. Department of Justice drafted the so-called Enhancement of Privacy and Public Safety in Cyberspace Act (PDF), which goes by the awkward and not very memorable acronym of EPPSCA. In July 2000, the Clinton administration forwarded EPPSCA to Congress, where it was introduced by Sen. Patrick Leahy (D-Vt.) and met with a generally chilly response.
- afarrell 13y agoThere are federal judges who do not use email. They have their secretaries print out their emails, handwrite their responses, and then their secretaries type them up.
- northwest 13y agoNot forcing judges to be "eternal students" is like giving people democracy but closing all schools and media outlets.
- state 13y agoI have been reading the cypherpunks archives recently, and have noticed that Declan was pretty active on that list. Thought it worth mentioning, as his articles have been popping up on HN with increasing frequency.
- declan 13y agoYep. Julian Assange and I go way back. :)
- diminoten 13y agoWait so this captures HTTP request "metadata" - is that everything but the body of the request? But it also sounds like more. They're talking about Facebook correspondence names, email address "to"s and "froms" - stuff you can't get out of HTTP "metadata" but have to analyze the content body and extract. So if they're analyzing content, isn't that a line they're crossing into content? And how are "Internet search terms" metadata? I guess if it's part of the URL as query parameters it's metadata?
- declan 13y agoThe problem for engineers is that what lawyers call metadata does not track the application/transport/Internet/link layer model we all know and love. A good rule of thumb is that unless it's in the body of a message and maybe a Subject: line, DOJ argues it's not content. URLs could go either way. Re: Internet search terms, later in my article I try to address that: Whether the FBI believes its port reader software should be able to capture Subject: lines, URLs that can reveal search terms, Facebook "likes" and Google+ "+1s," and so on remains ambiguous, and the bureau declined to elaborate this week. The Justice Department's 2009 manual (PDF) requires "prior consultation" with the Computer Crime and Intellectual Property Section before prosecutors use a pen register to "collect all or part of a URL."
- deleted 13y ago[deleted]
- rpedroso 13y agoI'm skeptical of that claim by the article. The relevant paragraph: There's a significant exception to both sets of laws: large quantities of metadata can be intercepted in real time through a so-called pen register and trap and trace order with minimal judicial review or oversight. That metadata includes IP addresses, e-mail addresses, identities of Facebook correspondents, Web sites visited, and possibly Internet search terms as well. It sounds like the author is speculating about what "metadata" might mean. There is no evidence cited by the article to suspect otherwise. I also doubt they're capturing "everything but the body of the request". HTTP-Basic authorization headers include usernames and passwords, and I doubt passwords are considered "metadata" under the law. Assuming that the FBI follows the law, these devices are probably more selective than that.
- declan 13y agoBy request I just posted this 2006 court opinion that says all email headers except Subject: lines are metadata. No wiretap order required to do a live intercept: https://plus.google.com/u/0/112961607570158342254/posts/9Cu7Q9kDUhc https://plus.google.com/u/0/112961607570158342254/posts/9Cu7...
- oscargrouch 13y agoIn any other civilized country, after being caught spying, governments would be ashamed and massacrated by public opinion and politicians would review and stop their actions immediatly .. but in US they(the big brother) have no shame at all.. they continue to do it as if theres nothing wrong with.. and people just act normal while civil rights get shattered appart in pieces.. people need to get real.. this is pretty serious.. this will have a great impact and damage not only on civil rights but also in business.. Im sure a lot of people form outside US are waking up and will start to build their own local versions of sucessful US bussiness.. and this is just the tip of the iceberg.. we can think of a lot of other things coming, and none of the are good for anybody
- northwest 13y agoYour first sentence would imply that at least the UK, Germany and France are not civilized countries.
- declan 13y agoOn a per-capita basis, the Netherlands is at the top with far more electronic surveillance than almost any other country, and the U.S. is at the bottom. (This may be only domestic LE surveillance, can't remember.)
- MisterWebz 13y agoThe number of times the Dutch police have legally tapped telephone and internet lines may vastly exceed that of others such as the U.S. because the U.S. (thinks it) doesn't need a warrant and as such it's not being logged as a wiretap. Some numbers of Dutch wiretaps: http://www.thehollandbureau.com/2010/03/07/the-netherlands-champion-in-national-surveillance/ http://www.thehollandbureau.com/2010/03/07/the-netherlands-c...
- declan 13y agoThanks for the citation. Excerpt from the article: "That is 1681 per day. 84% of this tapping concerned mobile phones. Compare this with the news that there were 2208 taps in the United States in the whole of 2007." It's comparing like to like. Neither numbers include intelligence-related surveillance, only domestic criminal law enforcement. The Dutch are wiretap-happy and the U.S., thanks to Title III, is relatively restrained.
- silentOpen 13y agoIt's very simple: a free country is run by free software by definition. A free country has published laws that are implemented and debugged (adjudicated) in public. If the FBI wants carriers to install software on their network devices, the FBI is implementing regulatory law as code in the network substrate. The source and its build and development process must be public. They have no magic tricks and there is no unknown capability that this could compromise. It's simply a requirement for a country governed by the law. It's how we watch the watchers. Seeing as how we can't even get voting machine source code released, I have little faith that the spy state will cede its code in the near future. Given this, it's now time for all able-minded hackers to build tools for personal liberty and spread them far and wide. Godspeed.
- jivatmanx 13y agoThe author of the code for section 215 of the Patriot act, Sensenbrenner, says it is being used totally beyond what he intended. In this sense, it can be said to be executing arbitrary code, perhaps it can be said that the typical method of those in power is to look through the 10,000+ page laws, search for the weakest and most arbitrary provision, and exploit it to the fullest extent possible. Of course, part of the reason for this is that no debugging was done - after receiving the law, the military went so far as to lie about how it was being used.
- mpyne 13y agoNo offense but Sensenbrenner deserves his share of blame for this too. People pointed out even back then that that Patriot Act was way overbroad and could lead to things exactly like this. Militaries plan against the capabilities of a possible opponent, not just what they think the opponent intends to do. Congress should never have let it get passed in the shape it was in, but Sensenbrenner should have written the legislation keeping in mind the capability it would give the Executive branch, not just presumed intent.
- oscargrouch 13y agoIts because some of the issues we are facing right now, that we should value even more the work of guys like RMS. open software its not just about hackerism, education and freedom in the hacker sense of being able to understand things and how they work because they are open.. but also in the sense of transparency.. we effectivelly know what is running in our own machines.. open source its a pretty good weapon to achieve transparency.. and its something we need badly now.. (its not just about cryptography)
- coldcode 13y agoHow does this solve the issue with intercepting SSL traffic? Without "content" there isn't much to go on in deciding how you could use the packets?
- declan 13y agoSimple. Send a pen register/trap and trace order to, say, Microsoft for a target's Hotmail traffic (except Subject: lines and body content). I disclosed Microsoft's wiretap compliance system in this article last month: http://news.cnet.com/8301-13578_3-57593538-38/how-the-u.s-forces-net-firms-to-cooperate-on-surveillance/ http://news.cnet.com/8301-13578_3-57593538-38/how-the-u.s-fo... If it's Hushmail in Canada, that's why we have MLATs.
- mladenkovacevic 13y agoOK I'll hand it to you that was a pretty important article.
- declan 13y agoIt looks like that was directed at me. So: Thanks! :)
- drblast 13y agoI think the fact that this is done on a large scale makes people more complacent. "Oh, they're monitoring the whole Internet for terrorists? OK!" But if you told anyone, "The Feds have decided to monitor you and 1000 other people chosen at random for the next year. Your phone calls will be stored, and all of your web browsing activity will be logged. They probably won't use it, but it's being stored just in case." People would have a fit.
- nrivadeneira 13y agoConsidering everyone on the internet is being logged in some sort of way by various entities at all times, I think most are used to it by now. The government may have judicial powers, but I think most people have accepted being tracked by things like browsers, analytics services, social networks, etc. The next logical question is "How would government tracking affect my life differently than Facebook tracking, and would it make my life worse?" Considering the average person is probably not committing felonies on a regular basis, the conclusion is generally "Well honestly, it's more likely that Facebook tracking will affect my life negatively (ie. somehow posting the weird things I look at on the internet on my news feed) than government tracking." Since this person has already accepted Facebook tracking as part of their lives, it's then pretty easy to accept government tracking. Mind you, this is all speculation on what the average person might think, but I'm not a big fan of slippery slope arguments so I tend to agree.
- foxhop 13y agoAT&T partners with defence contractors to implement email spying http://www.informationweek.com/government/security/feds-isps-team-on-cybersecurity-for-defe/230800180 http://www.informationweek.com/government/security/feds-isps...
- known 13y agoObedience or Peace? What is USA seeking from rest of the world?
- icantthinkofone 13y agoIf you want to continue to ignore the reason for this then this sounds bad. And almost everybody here is ignoring the cause and fixating on the symptom.
- emiliobumachar 13y agoPlease be more explicit. What do you call cause, and what do you call sympton?
- mars 13y agoQwn
- northwest 13y agoIf you want to turn this eternal discussion into results: https://news.ycombinator.com/item?id=6152935 https://news.ycombinator.com/item?id=6152935