Slashdot Log In
Which ISPs Are Spying On You?
Posted by
kdawson
on Mon Jun 11, 2007 06:24 PM
from the what-do-they-keep-and-how-long-do-they-keep-it dept.
from the what-do-they-keep-and-how-long-do-they-keep-it dept.
firesquirt sends us an article from Wired about a survey they conducted to determine major ISPs' data retention and other privacy practices. Over a period of two months, four national ISPs would not give Wired the time of day; and another four answered some of their questions in a fashion not altogether reassuring.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
All of them (Score:2, Informative)
Re:All of them (Score:5, Insightful)
Parent
That's true... (Score:5, Insightful)
Parent
Re:That's true... (Score:4, Interesting)
Parent
Re: (Score:3, Insightful)
Re:All of them (Score:5, Informative)
Parent
Re: (Score:2, Informative)
that was funny.
All of them, DUH (Score:2)
Re:All of them, DUH - NO. Some do the right thing (Score:5, Interesting)
http://www.rsync.net/resources/notices/canary.txt [rsync.net]
In addition to a stated policy of "No data or meta-data concerning the behavior of our customers or filesystem contents will ever be divulged to any law enforcement agency without order served directly by a US court having jurisdiction. All such orders will be reported to our entire customer base."
You should read their philosophy page [rsync.net].
Parent
Re:All of them, DUH - NO. Some do the right thing (Score:4, Informative)
Ummm... dream on about this part (at least), as "Patriot Act"-backed demands (with or without a warrant) can forbid the disclosure of said demand.
And while an especially conscientious service provider might insist on dotting i's and crossing t's, it is doubtful any of their personnel (or bosses) will be willing to be jailed as a "terrorist".
Parent
Re: (Score:2)
That is what the canary is for (!)
Read this again:
rsync.net warrant canary [rsync.net]
If they are served with a secret warrant, they simply stop updating the warrant canary...
Which, since everyone knows what it means, effectively functions as a way of disclosing that they've been served with a warrant demanding nondisclosure. I hope they're not relying on whatever lawyer told them that this was a good idea to bail them out after the fact, or they may be in for a rather rude surprise.
Re:you should read more closely ... the canary ... (Score:5, Interesting)
Sort of. But it's an interesting idea. The law *does* prevent them from stating that they've been raided, in certain situations anyway.
But does the same law have the power to force them to continue publishing signed lies ? That's what they'd be doing if they continued to claim that they have never been raided after they where indeed raided.
I don't know enough US-law to know the answer, but atleast it's not obvious that it wouldn't work.
Parent
Re: (Score:2)
Re: (Score:2)
So? BFD. I wouldn't give Wired the time of day, either. Wired had promise in the last century, but is nothing more than a hybrid of Ars Technica and People Magazine.
In spite of what the people at Wired think of themselves, they're not the New York Times, or any other news organization with a 100+ year track record of journalism (recent gaffes notwithstanding). They're just a garish tech fanboi rag, and not even a goo
in EU this is mandated by the government... (Score:4, Informative)
Noisy clickstream (Score:5, Insightful)
As for the other things such as IM's, emails, torrents, ect I can encrypt those should I feel the need. Yes, I could start using TOR, but it's slow and watching a web crawler do a random walk can be entertainment all by itself.
Re:Noisy clickstream (Score:5, Funny)
Parent
Re:Noisy clickstream (Score:5, Funny)
Parent
Re:Noisy clickstream (Score:5, Informative)
Also see Bruce Schneier's opinion on the matter [schneier.com].
In short, it isn't a good idea.
Parent
Re: (Score:2, Informative)
Secure proxy? (Score:2)
but it's that very effort that makes it cost prohibitive to do it across a broad scale
That's a good idea. Poisoning the data well.
I'm wondering if a secure proxy would defeat your ISP's snooping? For some reason I was thinking it's possible to snoop https traffic. Difficult, but possible. It would certainly be a pain the rear and an ISP would need a good reason to go to all the trouble. Especially with so many, many people who wouldn't bother. All the search engine would have is the proxy IP, all
Re: (Score:2)
Install filter before logs are made. Problem solved.
Filtering a log pretty much makes it useless as evidence. Though the Feds can just disappear you regardless of legal procedure these days.
ISP's fearful of RIAA/MPAA? (Score:5, Insightful)
I would think all they need to do is show they warned their users they are 1. being watched 2. downloading illegal data. Actually providing the authorities with a history of the data is not their job and should only be the acquired by the authorities with their own equipment and only under a court order.
At the least the ISP's should give their users the ability to opt-out of their "data retention" programs.
Re: (Score:3, Interesting)
Most ISPs assign dynamic IP addresses to the majority of their customers. Where I used to work, we used RADIUS to provide dynamic IP addressing to our customers, and we would keep logs that would let us determine which customer had any given IP address on any given day and time. This data was used to help troubleshoot customer login problems, resolve billing disputes with customers, suspend and/or warn customers who had violated our terms and conditions of use, and
Re:ISP's fearful of RIAA/MPAA? (Score:4, Insightful)
I would like to think that no ISP would ever spy on me or keep records of my activities. I would like to think that no ISP would provide data without a court order. Unfortunately, what I would like to think bears little relation to what actually is. And my understanding is that the (US) government no longer requires a court order to demand such things.
Parent
Rogers Slogan is "Don't be not evil." (Score:4, Informative)
These are, after all, the goons who think just about any kind of encrypted traffic coming out of your box is a terrorist threat to the movie industry -- even if it's just a VPN connection.
Does anyone know what Rogers retention policies actually are?
Sure... We spy..... (Score:3, Funny)
Time to encrypt (Score:2)
Sure they know where you went, but not what you viewed or 'said' while there.
Think about that... (Score:5, Insightful)
Sure they know where you went, but not what you viewed or 'said' while there.
Back when I was operating a mailing list on a controversial topic on my home machine, I had a couple rules:
- No postings soliciting or admitting to breaking laws.
- No encrypted traffic (not just on the list: All traffic (except passwords) to-from the machine was in the clear).
The thinking was like this:
- Police, other government investigative agencies, and various unofficial snoops have a long track record of ignoring laws against various kinds of eavesdropping. So you have to assume that the line might be tapped.
- If the police became interested they could always get a warrant and tap the line. (Or illegally tap the line without a warrant to see what's going on, then (if it looked interesting) get a warrant to tap it legally.)
- If the data was encrypted they could STILL get it - by getting a warrant and seizing the computer (and everything else of interest in the house).
- If the data was UNencrypted they would want to keep a low profile to avoid scaring off any "bad guys", would eventually see that there was nothing to go after, and thus would probably switch to hunting real bad guys elsewhere and go away WITHOUT breaking in and trashing stuff.
"Encrypt everything" seems like a nice solution. But if only a few are doing it, just the fact that their traffic is encrypted makes them targets. It's easy to trump up enough stuff to get a warrant and go after the machine.
Once a LOT of people are all swapping lots of encrypted traffic (as the default way of "sealing" the "envelope" on the datagrams) the fact of encryption will stop making the users targets. (The police can still get a warrant and grab the machines. But with so many potential machines to grab they'll have to find some other way to pick the ones to hit - like by bothering to dig up real "probable cause" from other evidence, like they're supposed to.)
Fortunately we don't need to construct a "shelling point" for this: The internet is gradually moving toward pervasive encryption, as the legitimate need to encrypt for personal and corporate security becomes broadly understood. Once that becomes the norm our electronic "papers" will be about as secure as our physical ones. We're starting to get there. But IMHO we're not there yet.
Unfortunately we WON'T be fully safe using encryption until the typical machine configurations are such that, if the machines are seized, it will be impossible to recover incriminating data from them - even with passwords browbeaten out of their owners. Until that time it will still be useful to bypass encryption by raiding one of the machines at the endpoints.
= = = =
Re the list and "no encrypted traffic": When one of the regulate-the-internet laws was about to make it too much hassle to continue, we closed down the list (after finding volunteers to run its successor and - since the participants hadn't agreed to have their info forwarded - announcing the successor on the original list and giving people time to sign up.
Now I regularly use SSH to telecommute or to access the primary house machine from the vacation house. But that's still low-profile: It's clear from the IP addresses that the SSH connections are going to the company, coming from it, or coming from a single external dialup machine via a particular service provider.
Parent
sAKafdfDds6SFALGI5as4fdf564saDDdaASDSsdaf (Score:5, Insightful)
64F5F6sAS4Dd46KJfUYd0NsafH54UJ6Y35U135KdYUsU1Jf35
JD3hFdJf8o
SD45uio5K2o
Parent
Re:sAKafdfDds6SFALGI5as4fdf564saDDdaASDSsdaf (Score:4, Funny)
Parent
Re: (Score:2, Insightful)
IRC logs (Score:3, Interesting)
I seldom spend time on IRC.
Two weeks ago I was on #debian.
I asked the people if the conversations get logged.
Nobody present could tell me.
Is there a place when you can look up such things?
Re: (Score:3, Funny)
Re: (Score:2)
Unofficially logged, well IRC is a lot like ham radio, once you broadcast it theres nothing you can do.
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
AOL (Score:5, Funny)
VPN ISPs? (Score:2)
Re: (Score:3, Informative)
The problem is that the US via CALEA is requiring things like Cisco routers used to terminate many VPN connections be wiretap-friendly, so
Re: (Score:2)
So, I would tunnel to a friendly country like Sealand (example) and send all my packets out from there.
Now that we know what to expect..... (Score:2)
Suggested Search terms:
"Well damn, if I look at crack sites, am I going to be busted for attempted piracy" when I was really looking for a download 30 trial of autodesk Inventor 2008. Its also interesting that directly after the last law related passed, all crack sites are asking for some small amount of payment --- so as to verify identity....
I'm absolutely certain that search terms can be made to communicate to the spys well enough to cause a "MAD - S
Time of Day (Score:2, Funny)
What, they blocked port 123?
010000100110100101101110011000010111001001111001 (Score:4, Funny)
Re: (Score:2)
Re:That's easy (Score:5, Insightful)
Somewhere, there are lobbyists laughing at this comment.
Parent
Too Easy (Score:2)
-Stare at the TV 4 hours a day
-Stop participating in your Government.
-Allow Civics/government programs to be gutted.
-Turn away from reason to embrace The Lord.
It's _soo_ easy to whip off comments like yours. But it's more patriotic to be labled a Democratic (as in democracy) nut job.
Re: (Score:3, Insightful)
The net is being reined in by those who don't like it. There's little anyone who cares can do to stop it.
Re: (Score:2)