10 ms·

I have mixed feelings about this. Some of the metadata in my opinion is obviously OK to collect - the stuff that would have been captured by a pen register dec

by Aloha 13y ago

I have mixed feelings about this. Some of the metadata in my opinion is obviously OK to collect - the stuff that would have been captured by a pen register decades ago - Who you called, who called you, how long you talked - this stuff, which is otherwise known as call detail records it available to nearly everyone who works for the telco and is not really what I would consider private. Other stuff - like Geolocation data is in my opinion clearly not OK to collect - it constitutes an unreasonable encroachment on privacy, normally to track someone historically a warrant must be obtained first, and it required probable cause, I see no reason why a lesser standard should be applied here. I don't consider blanket recording of calls to be acceptable, but I don't see that as something that has been happening, at least on domestic to domestic endpoints (it's not really technically feasible to do with the way the telephone network is structured), its a bit easier to record calls going to international endpoints because of the structure of the PSTN - VoIP is its own deal, and YMMV on weather you can actually capture those calls or not. I don't want to see us throw the baby out with the bath water as it were, nor do I want the unreasonable encroachment on privacy to continue.

xyzzyz 13y ago
One could argue similarly that collecting email is also OK, as emails are also available to nearly everyone who works for email provider company. I can very easily imagine people who would want to keep the phone call metadata private.
- Aloha 13y ago
  Collecting metadata about email is OK - as in, who you mailed, and who mailed you. This information is no more private than the address on an envelope being sent to you via the postal service. Collecting the email itself I think has a higher bar to cross - the logic used in the CDR collection was akin to that of the postal mail address question.
dkokelley 13y ago
A question of legal history: Were warrants required to "tail" a suspect? If not, I could see the case being made that indiscriminately "tailing" all cell phone users is an extension of following someone in a car. I disagree that the same standard applies, but from a legal perspective I think it's important to note whether there was a precedent set that allows "publicly available" or "non-invasive" data to be collected sans warrant.
- jrochkind1 13y ago
  No warrant is required to follow someone in public. Why do you think call record and geolocation data are 'publicly available' data? How are they accessible to the public at large? If they were accessible to the public at large, the government wouldn't need to ask teleco's for the info, or for permission to install the government's own tracking devices -- if someone in the public at large asks a teleco for this info, they aren't going to get it, it clearly isn't public information.
  - dkokelley 13y ago
    I would include call record and geolocation data in the "non-invasive" category, because they can be accessed without disrupting the target. On the other hand, "publicly available" data are the publicly observable actions the target takes. Twenty years ago that meant getting in a car and driving somewhere. These days that might also include a Twitter stream or GPS EXIF data on publicly published photos.
    - jrochkind1 13y ago
      I suspect the courts would agree that actual public things, like a twitter stream or publicly published photos, can be viewed and recorded without a warrant. And I would agree with you that that is right and proper. I find your 'non-invasive' category to be odd though. I am not sure there is any legal basis for 'non-invasive' having any bearing on these issues, nor do I think it ought to. Recording the full contents of all your phone calls would be just as 'non-invasive' as recording the 'metadata' -- it would not 'disrupt the target' in any case. I don't see what 'non-invasive' has got to do with it.
      - dkokelley 13y ago
        From a legal perspective, I don't know if non-invasive data collection falls under a certain category. I know that authorities cannot enter my home and bug it or install cameras without a warrant. Authorities cannot install a camera in my bathroom to see if I am flushing away drugs, but can they ASK the water company to tap my pipe as it returns to wastewater management? The first action would require a warrant, since they are violating my home and person to obtain the information. If the same or comparable data are gathered through the cooperation of a third party, does that action still require a warrant? I suppose the standard of 'non-invasive' is whether information is collected directly from my non-public activities (warrant certainly required) or from compliant third parties. Of course if the third party does not cooperate then a warrant will compel their cooperation. I would argue that ANY data collection on a target should require a warrant issued by a judge for probable cause. So, indiscriminate collection of cell phone metadata would be prohibited, because my metadata is included, and there is no probable cause for surveillance against me.
mrobot 13y ago
One difference is that it's not in a central GOV DB. Shouldn't it be considered private if the company can guarantee me it's not analyzed by the government without my knowledge?
- Aloha 13y ago
  The presumption by many people was that it was available to the government on demand before, it matters little to me if the government has it whenever it asks for it, or has it on file in near realtime - either way, I get no notice that someone has asked for it.
  - mrobot 13y ago
    I see, so we might see this as a temporary latency increase that will be quickly argued against or worked around in the name of efficiency.
mhurron 13y ago
> Who you called, who called you, how long you talked - this stuff, which is otherwise known as call detail records it available to nearly everyone who works for the telco And to law enforcement with a warrant for a specific person relating to an ongoing investigation. All the NSA just got rid of that pesky legal requirement. Why all the fuss? Also that anyone at the telco that used that information, if that got out that anyone probably wouldn't have a job for long.
- maxerickson 13y ago
  Call detail records generally don't require a warrant. I posted this article the other day: http://www.crypto.com/blog/celltapping/ http://www.crypto.com/blog/celltapping/
  - Aloha 13y ago
    Exactly my arguments about CDR's, I have mixed feelings about disclosing location with CDR's - but if it were a landline, the location part is sort of a given, unless using a beige box or some other diverter like object (like a DISA on a PBX).
    - maxerickson 13y ago
      All you really said is that you were comfortable with things the way they are. I'd like to see some sort of data rights legislation, where when I ask the phone company to please try to connect me to some other person I can expect that they are minimizing access to those details. I wouldn't even mind if my requests related to service problems meant authorizing a period of wider disclosure. That at least changes the tone of the privacy discussions (and 'trusted third parties' are a well carved out aspect of privacy).
      - Aloha 13y ago
        I'm uncomfortable with the way things are, I'd rather things be more like they were a decade (or more) ago, which is to say nearly universal access by law enforcement to call detail records on demand, these records might include location call is placed from (for both Mobile and Landline telephones), I'm also comfortable with disclosure of Text Messaging metadata (envelope information), but not Geolocation data attached to texts without a warrant. I'm deeply uncomfortable with anything beyond this - that includes but is not limited to geolocation data not tied to a voice call without a warrant, taps on IP/Text/Voice content without a warrant.
Laremere 13y ago
I disagree. I interned twice at a telco, and while I had access to a bunch of information in databases as a developer, I had no access to call records, and in general you didn't have access to it unless you needed it for work. The problem is as I understand it, the NSA currently has the view that if a corporation has access to it, then it's not private and they get free reign. It's not that I don't expect Google to have my gmail records, or my phone to have call records and geolocation. Those companies can use that data to improve their services to me. It's when the NSA decides that they have access to all of this information from all these companies is when I have a problem.
- Aloha 13y ago
  Different companies, different policy, I worked in customer care, and later in a quasi-engineering role. In both cases, and two different companies I had full access to customer CDR's.
  - modeless 13y ago
    Which two? I'd appreciate being able to avoid those companies.
    - ars 13y ago
      That's kinda silly unless you can confirm that the other companies are not doing exactly the same thing.
    - Aloha 13y ago
      It's really all of them - If your doing a job that involves either customer care, or resolving call based issues, you have the ability to: See call detail records, sometimes capture voice calls to and from that subscriber, capture signalling data in realtime, track a mobile user in call thru the system for the purposes of finding defective network elements. There is a good reason why we had these abilities, they were essential to resolve and troubleshoot user reported issues. For example, if a customer reported troubles or call quality issues calling 202-555-1212, I needed to be able to pull their CDR's so I could determine which outbound trunk group the call went out on, so I could report it to that carrier to see if they could resolve.
DanielBMarkham 13y ago
"I don't want to see us throw the baby out with the bath water as it were, nor do I want the unreasonable encroachment on privacy to continue." I believe you have a valid point about moderation being the key here. Obviously there are bad people in the world, and obviously the state has a need to investigate their actions in an effort to protect us from them. And it is always a mistake to go around with your hair on fire demanding absolute answers to nuanced questions. But right now from where I'm standing? I'm happy with throwing a lot of baby away. Maybe we keep his foot. Or a toenail. Rest of him's gotta go. Here's the reason why: we are at the end of a slippery slope, not at the beginning. We started off with the state knowing next to nothing. Bit by bit, over the decades, they've encroached more and more. We've got to roll this back and take an honest look at whether all that we've lost was worth it.
- Aloha 13y ago
  I actually would argue we're about half way up, we can choose to continue to slide down the hill, or claw our way higher, and have the government have less access, or 'give up' and slide down the hill, hoping that the overlords are benevolent. I personally want to claw our way a little higher up the hill again.
- rayiner 13y ago
  I agree we're on a slippery slope, but disagree that it's a slope of state encroachment. The precedents at issue here are decades old (the line of cases starts in the 1960's), and even the first time the 4th amendment status of phone calls came up in the 1920's, the Supreme Court determined that they were not protected because the phone company had access to them. The government has not been invading previously protected spaces. The slope here is people broadcasting previously private information indiscriminately into the ether, to locations that the government always had access to.
  - DanielBMarkham 13y ago
    I believe that you are saying that the people, by using new methods to communicate, are encroaching in on government's "natural" right to scrape up everything it possibly can? That's certainly an interesting way of looking at it. The government retains all the rights to collect anything it can, and it's up to the citizens to act in such a manner as to stop it. Please correct me if I missed this. Fascinating 180-degree reversal of natural rights.
xyzzy123 13y ago
There are scaling effects here which I don't think you're taking into account. We're not talking about pen registers or targeted investigations anymore. We're talking about big data techniques, trawling through massive databases to find related suspects and evidence of suspicious behaviour. A guilt inference engine. "Google suspects". This is both quantitatively and qualitatively different from your view that "CDRs are available to people who work at the telco".
- Aloha 13y ago
  I'm somewhat OK with big data being used in this case, these are cases that traditional police work cannot be used in. So long as our court system remains a strong protector of the innocent, big data in this case is used to generate a list of people to talk to, to interview, and often to rule out. I'm very leery of thoughtcrime and guilt by association, but its up to the courts to make sure we are protected, and that the rights of the innocents are protected.
  - xyzzy123 13y ago
    I believe this gets to the crux of the argument. Broadly, I think there are two views on why the U.S. has laws regarding "unreasonable" search and seizure: a) Being searched all is unreasonable because it inconveniences those being searched, takes up their time and involves a degree of forced submission. b) Being searched all the time is unreasonable because it grants the government too much power over the individual. The government should not be able to snoop into the lives of private citizens without good reason. True freedom and perfect enforcement of crime are incompatible. You can hold (a) or (b) or both. Digital searches happen quietly and invisibly, so is it OK to be constantly searched if it involves no personal inconvenience? I believe you hold mostly position (a), whereas those who believe this program is bad (including me) hold (a) and (b).
    - Aloha 13y ago
      Correct. I largely hold position (a). I believe in position (b) as well, but there is a bar there, if something is above a certain level of invasion in invokes my belief in position (b) otherwise I consider it to be generally acceptable. Geolocation data is one of those things that invokes position (b) because I consider it to be an unreasonable invasion of privacy.
Buttons840 13y ago
I (and probably many others) would be more accepting of my data being collected and analyzed if there was an equal effort by the government to make it's own data equally available and easily analyzed. Instead I feel like the government is as secret as ever (and prone to blatant lies) and I'm skeptical of their actions by default. Can I use any of this new tech to see which lobbyists a Senator talked to before an unpopular vote or listen in on some of those back-room meetings? Or is it only the general population that gets spied on?
declan 13y ago
You wrote: "the stuff that would have been captured by a pen register decades ago" Yes, but pen registers (as noted in Judge Leon's opinion today) were different: they lasted a few days and were targeted at an individual. Neither case holds for bulk NSA surveillance that lasts indefinitely and vacuums up billions of records.
- dalke 13y ago
  In addition, the opinion points out that the "Supreme Court itself has long-recognized a meaningful difference between cases in which a third party collects information and then turns it over to law enforcement ... and cases in which the government an the third party create a formalized policy under which the service provider collects information for law enforcement purposes. ... It's one thing to say that people expect phone companies to occasionally provide information to law enforcement; it is quite another to suggest that our citizens expect all phone companies to operate what is effectively a joint intelligence-gathering operation with the Government." All of pp 47-56 are used to contrast "the stuff that would have been captured by a pen register decades ago" with what the NSA does now.

by Aloha 13y ago

xyzzyz 13y ago

One could argue similarly that collecting email is also OK, as emails are also available to nearly everyone who works for email provider company. I can very easily imagine people who would want to keep the phone call metadata private.

Aloha 13y ago
Collecting metadata about email is OK - as in, who you mailed, and who mailed you. This information is no more private than the address on an envelope being sent to you via the postal service. Collecting the email itself I think has a higher bar to cross - the logic used in the CDR collection was akin to that of the postal mail address question.

dkokelley 13y ago

A question of legal history: Were warrants required to "tail" a suspect? If not, I could see the case being made that indiscriminately "tailing" all cell phone users is an extension of following someone in a car. I disagree that the same standard applies, but from a legal perspective I think it's important to note whether there was a precedent set that allows "publicly available" or "non-invasive" data to be collected sans warrant.

jrochkind1 13y ago
No warrant is required to follow someone in public. Why do you think call record and geolocation data are 'publicly available' data? How are they accessible to the public at large? If they were accessible to the public at large, the government wouldn't need to ask teleco's for the info, or for permission to install the government's own tracking devices -- if someone in the public at large asks a teleco for this info, they aren't going to get it, it clearly isn't public information.
- dkokelley 13y ago
  I would include call record and geolocation data in the "non-invasive" category, because they can be accessed without disrupting the target. On the other hand, "publicly available" data are the publicly observable actions the target takes. Twenty years ago that meant getting in a car and driving somewhere. These days that might also include a Twitter stream or GPS EXIF data on publicly published photos.
  - jrochkind1 13y ago
    I suspect the courts would agree that actual public things, like a twitter stream or publicly published photos, can be viewed and recorded without a warrant. And I would agree with you that that is right and proper. I find your 'non-invasive' category to be odd though. I am not sure there is any legal basis for 'non-invasive' having any bearing on these issues, nor do I think it ought to. Recording the full contents of all your phone calls would be just as 'non-invasive' as recording the 'metadata' -- it would not 'disrupt the target' in any case. I don't see what 'non-invasive' has got to do with it.
    - dkokelley 13y ago
      From a legal perspective, I don't know if non-invasive data collection falls under a certain category. I know that authorities cannot enter my home and bug it or install cameras without a warrant. Authorities cannot install a camera in my bathroom to see if I am flushing away drugs, but can they ASK the water company to tap my pipe as it returns to wastewater management? The first action would require a warrant, since they are violating my home and person to obtain the information. If the same or comparable data are gathered through the cooperation of a third party, does that action still require a warrant? I suppose the standard of 'non-invasive' is whether information is collected directly from my non-public activities (warrant certainly required) or from compliant third parties. Of course if the third party does not cooperate then a warrant will compel their cooperation. I would argue that ANY data collection on a target should require a warrant issued by a judge for probable cause. So, indiscriminate collection of cell phone metadata would be prohibited, because my metadata is included, and there is no probable cause for surveillance against me.

mrobot 13y ago

One difference is that it's not in a central GOV DB. Shouldn't it be considered private if the company can guarantee me it's not analyzed by the government without my knowledge?

Aloha 13y ago
The presumption by many people was that it was available to the government on demand before, it matters little to me if the government has it whenever it asks for it, or has it on file in near realtime - either way, I get no notice that someone has asked for it.
- mrobot 13y ago
  I see, so we might see this as a temporary latency increase that will be quickly argued against or worked around in the name of efficiency.

mhurron 13y ago

> Who you called, who called you, how long you talked - this stuff, which is otherwise known as call detail records it available to nearly everyone who works for the telco And to law enforcement with a warrant for a specific person relating to an ongoing investigation. All the NSA just got rid of that pesky legal requirement. Why all the fuss? Also that anyone at the telco that used that information, if that got out that anyone probably wouldn't have a job for long.

maxerickson 13y ago
Call detail records generally don't require a warrant. I posted this article the other day: http://www.crypto.com/blog/celltapping/ http://www.crypto.com/blog/celltapping/
- Aloha 13y ago
  Exactly my arguments about CDR's, I have mixed feelings about disclosing location with CDR's - but if it were a landline, the location part is sort of a given, unless using a beige box or some other diverter like object (like a DISA on a PBX).
  - maxerickson 13y ago
    All you really said is that you were comfortable with things the way they are. I'd like to see some sort of data rights legislation, where when I ask the phone company to please try to connect me to some other person I can expect that they are minimizing access to those details. I wouldn't even mind if my requests related to service problems meant authorizing a period of wider disclosure. That at least changes the tone of the privacy discussions (and 'trusted third parties' are a well carved out aspect of privacy).
    - Aloha 13y ago
      I'm uncomfortable with the way things are, I'd rather things be more like they were a decade (or more) ago, which is to say nearly universal access by law enforcement to call detail records on demand, these records might include location call is placed from (for both Mobile and Landline telephones), I'm also comfortable with disclosure of Text Messaging metadata (envelope information), but not Geolocation data attached to texts without a warrant. I'm deeply uncomfortable with anything beyond this - that includes but is not limited to geolocation data not tied to a voice call without a warrant, taps on IP/Text/Voice content without a warrant.

Laremere 13y ago

I disagree. I interned twice at a telco, and while I had access to a bunch of information in databases as a developer, I had no access to call records, and in general you didn't have access to it unless you needed it for work. The problem is as I understand it, the NSA currently has the view that if a corporation has access to it, then it's not private and they get free reign. It's not that I don't expect Google to have my gmail records, or my phone to have call records and geolocation. Those companies can use that data to improve their services to me. It's when the NSA decides that they have access to all of this information from all these companies is when I have a problem.

Aloha 13y ago
Different companies, different policy, I worked in customer care, and later in a quasi-engineering role. In both cases, and two different companies I had full access to customer CDR's.
- modeless 13y ago
  Which two? I'd appreciate being able to avoid those companies.
  - ars 13y ago
    That's kinda silly unless you can confirm that the other companies are not doing exactly the same thing.
  - Aloha 13y ago
    It's really all of them - If your doing a job that involves either customer care, or resolving call based issues, you have the ability to: See call detail records, sometimes capture voice calls to and from that subscriber, capture signalling data in realtime, track a mobile user in call thru the system for the purposes of finding defective network elements. There is a good reason why we had these abilities, they were essential to resolve and troubleshoot user reported issues. For example, if a customer reported troubles or call quality issues calling 202-555-1212, I needed to be able to pull their CDR's so I could determine which outbound trunk group the call went out on, so I could report it to that carrier to see if they could resolve.

DanielBMarkham 13y ago

"I don't want to see us throw the baby out with the bath water as it were, nor do I want the unreasonable encroachment on privacy to continue." I believe you have a valid point about moderation being the key here. Obviously there are bad people in the world, and obviously the state has a need to investigate their actions in an effort to protect us from them. And it is always a mistake to go around with your hair on fire demanding absolute answers to nuanced questions. But right now from where I'm standing? I'm happy with throwing a lot of baby away. Maybe we keep his foot. Or a toenail. Rest of him's gotta go. Here's the reason why: we are at the end of a slippery slope, not at the beginning. We started off with the state knowing next to nothing. Bit by bit, over the decades, they've encroached more and more. We've got to roll this back and take an honest look at whether all that we've lost was worth it.

Aloha 13y ago
I actually would argue we're about half way up, we can choose to continue to slide down the hill, or claw our way higher, and have the government have less access, or 'give up' and slide down the hill, hoping that the overlords are benevolent. I personally want to claw our way a little higher up the hill again.
rayiner 13y ago
I agree we're on a slippery slope, but disagree that it's a slope of state encroachment. The precedents at issue here are decades old (the line of cases starts in the 1960's), and even the first time the 4th amendment status of phone calls came up in the 1920's, the Supreme Court determined that they were not protected because the phone company had access to them. The government has not been invading previously protected spaces. The slope here is people broadcasting previously private information indiscriminately into the ether, to locations that the government always had access to.
- DanielBMarkham 13y ago
  I believe that you are saying that the people, by using new methods to communicate, are encroaching in on government's "natural" right to scrape up everything it possibly can? That's certainly an interesting way of looking at it. The government retains all the rights to collect anything it can, and it's up to the citizens to act in such a manner as to stop it. Please correct me if I missed this. Fascinating 180-degree reversal of natural rights.

xyzzy123 13y ago

There are scaling effects here which I don't think you're taking into account. We're not talking about pen registers or targeted investigations anymore. We're talking about big data techniques, trawling through massive databases to find related suspects and evidence of suspicious behaviour. A guilt inference engine. "Google suspects". This is both quantitatively and qualitatively different from your view that "CDRs are available to people who work at the telco".

Aloha 13y ago
I'm somewhat OK with big data being used in this case, these are cases that traditional police work cannot be used in. So long as our court system remains a strong protector of the innocent, big data in this case is used to generate a list of people to talk to, to interview, and often to rule out. I'm very leery of thoughtcrime and guilt by association, but its up to the courts to make sure we are protected, and that the rights of the innocents are protected.
- xyzzy123 13y ago
  I believe this gets to the crux of the argument. Broadly, I think there are two views on why the U.S. has laws regarding "unreasonable" search and seizure: a) Being searched all is unreasonable because it inconveniences those being searched, takes up their time and involves a degree of forced submission. b) Being searched all the time is unreasonable because it grants the government too much power over the individual. The government should not be able to snoop into the lives of private citizens without good reason. True freedom and perfect enforcement of crime are incompatible. You can hold (a) or (b) or both. Digital searches happen quietly and invisibly, so is it OK to be constantly searched if it involves no personal inconvenience? I believe you hold mostly position (a), whereas those who believe this program is bad (including me) hold (a) and (b).
  - Aloha 13y ago
    Correct. I largely hold position (a). I believe in position (b) as well, but there is a bar there, if something is above a certain level of invasion in invokes my belief in position (b) otherwise I consider it to be generally acceptable. Geolocation data is one of those things that invokes position (b) because I consider it to be an unreasonable invasion of privacy.

Buttons840 13y ago

I (and probably many others) would be more accepting of my data being collected and analyzed if there was an equal effort by the government to make it's own data equally available and easily analyzed. Instead I feel like the government is as secret as ever (and prone to blatant lies) and I'm skeptical of their actions by default. Can I use any of this new tech to see which lobbyists a Senator talked to before an unpopular vote or listen in on some of those back-room meetings? Or is it only the general population that gets spied on?

declan 13y ago

You wrote: "the stuff that would have been captured by a pen register decades ago" Yes, but pen registers (as noted in Judge Leon's opinion today) were different: they lasted a few days and were targeted at an individual. Neither case holds for bulk NSA surveillance that lasts indefinitely and vacuums up billions of records.

dalke 13y ago
In addition, the opinion points out that the "Supreme Court itself has long-recognized a meaningful difference between cases in which a third party collects information and then turns it over to law enforcement ... and cases in which the government an the third party create a formalized policy under which the service provider collects information for law enforcement purposes. ... It's one thing to say that people expect phone companies to occasionally provide information to law enforcement; it is quite another to suggest that our citizens expect all phone companies to operate what is effectively a joint intelligence-gathering operation with the Government." All of pp 47-56 are used to contrast "the stuff that would have been captured by a pen register decades ago" with what the NSA does now.