3 ms·

Wait so this captures HTTP request "metadata" - is that everything but the body of the request? But it also sounds like more. They're talking about Facebook c

Wait so this captures HTTP request "metadata" - is that everything but the body of the request? But it also sounds like more. They're talking about Facebook correspondence names, email address "to"s and "froms" - stuff you can't get out of HTTP "metadata" but have to analyze the content body and extract. So if they're analyzing content, isn't that a line they're crossing into content? And how are "Internet search terms" metadata? I guess if it's part of the URL as query parameters it's metadata?

declan 13y ago
The problem for engineers is that what lawyers call metadata does not track the application/transport/Internet/link layer model we all know and love. A good rule of thumb is that unless it's in the body of a message and maybe a Subject: line, DOJ argues it's not content. URLs could go either way. Re: Internet search terms, later in my article I try to address that: Whether the FBI believes its port reader software should be able to capture Subject: lines, URLs that can reveal search terms, Facebook "likes" and Google+ "+1s," and so on remains ambiguous, and the bureau declined to elaborate this week. The Justice Department's 2009 manual (PDF) requires "prior consultation" with the Computer Crime and Intellectual Property Section before prosecutors use a pen register to "collect all or part of a URL."
- deleted 13y ago
  [deleted]
rpedroso 13y ago
I'm skeptical of that claim by the article. The relevant paragraph: There's a significant exception to both sets of laws: large quantities of metadata can be intercepted in real time through a so-called pen register and trap and trace order with minimal judicial review or oversight. That metadata includes IP addresses, e-mail addresses, identities of Facebook correspondents, Web sites visited, and possibly Internet search terms as well. It sounds like the author is speculating about what "metadata" might mean. There is no evidence cited by the article to suspect otherwise. I also doubt they're capturing "everything but the body of the request". HTTP-Basic authorization headers include usernames and passwords, and I doubt passwords are considered "metadata" under the law. Assuming that the FBI follows the law, these devices are probably more selective than that.
- declan 13y ago
  Fortunately, the author is right here to say you're incorrect. The article cited and linked to federal law with the PR/TT definition of metadata. It gave examples of header fields the FBI is asking for. It linked to and excerpted from original DOJ FCC documents offering additional examples of what the government believes to be valid metadata. It linked to and excerpted from a DOJ manual that spends about four pages talking about what's metadata or not. The author even posted a court opinion elaborating on what's metadata: https://plus.google.com/u/0/112961607570158342254/posts/9Cu7Q9kDUhc https://plus.google.com/u/0/112961607570158342254/posts/9Cu7... But clearly the author is just "speculating!" Sigh. I fear for the future of the republic.
  - jdp23 13y ago
    It's kind of like the scene in Annie Hall -- "I have Marshall Mcluhan right here!"

declan 13y ago

The problem for engineers is that what lawyers call metadata does not track the application/transport/Internet/link layer model we all know and love. A good rule of thumb is that unless it's in the body of a message and maybe a Subject: line, DOJ argues it's not content. URLs could go either way. Re: Internet search terms, later in my article I try to address that: Whether the FBI believes its port reader software should be able to capture Subject: lines, URLs that can reveal search terms, Facebook "likes" and Google+ "+1s," and so on remains ambiguous, and the bureau declined to elaborate this week. The Justice Department's 2009 manual (PDF) requires "prior consultation" with the Computer Crime and Intellectual Property Section before prosecutors use a pen register to "collect all or part of a URL."

deleted 13y ago
[deleted]

rpedroso 13y ago

I'm skeptical of that claim by the article. The relevant paragraph: There's a significant exception to both sets of laws: large quantities of metadata can be intercepted in real time through a so-called pen register and trap and trace order with minimal judicial review or oversight. That metadata includes IP addresses, e-mail addresses, identities of Facebook correspondents, Web sites visited, and possibly Internet search terms as well. It sounds like the author is speculating about what "metadata" might mean. There is no evidence cited by the article to suspect otherwise. I also doubt they're capturing "everything but the body of the request". HTTP-Basic authorization headers include usernames and passwords, and I doubt passwords are considered "metadata" under the law. Assuming that the FBI follows the law, these devices are probably more selective than that.

declan 13y ago
Fortunately, the author is right here to say you're incorrect. The article cited and linked to federal law with the PR/TT definition of metadata. It gave examples of header fields the FBI is asking for. It linked to and excerpted from original DOJ FCC documents offering additional examples of what the government believes to be valid metadata. It linked to and excerpted from a DOJ manual that spends about four pages talking about what's metadata or not. The author even posted a court opinion elaborating on what's metadata: https://plus.google.com/u/0/112961607570158342254/posts/9Cu7Q9kDUhc https://plus.google.com/u/0/112961607570158342254/posts/9Cu7... But clearly the author is just "speculating!" Sigh. I fear for the future of the republic.
- jdp23 13y ago
  It's kind of like the scene in Annie Hall -- "I have Marshall Mcluhan right here!"