Slashdot Log In
Inside Comcast's Surveillance Policies
Posted by
kdawson
on Mon Oct 15, 2007 10:24 PM
from the cost-you-a-pretty-penny dept.
from the cost-you-a-pretty-penny dept.
Monk writes "The Federation of American Scientists has obtained a recently disclosed Comcast Handbook for Law Enforcement which details its policies for divulging its customers' personal information. (Here's the handbook itself in PDF form.) All of Comcast's policies seem to follow the letter of the law, and seem to weigh customer privacy with law enforcement's requests. This is in apparent contrast to AT&T and a number of other telecommunication companies, which have been only too happy to give over subscriber records. According to the handbook, Comcast keeps logs for up to 180 days on IP address allocation, and they do not keep all of your e-mails forever (45 days at most). VoIP phone records are stored for 2 years, and cable records can only be retrieved upon a court order. The document even details how much it costs law enforcement to get access to personal data (data for child exploitation cases is free of charge)."
Related Stories
Submission: Inside Comcast's Surveillance Policies by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Secure your email (Score:3, Informative)
(Mac OS X 10.3+) http://www.joar.com/certificates/ [joar.com]
(Windows) http://www.marknoble.com/tutorial/smime/smime.aspx [marknoble.com]
Re: (Score:2)
Hash: SHA1
re: http://www.joar.com/certificates/ [joar.com]
I read your MAC OSX article/how-to.
What? Not one mention or link to information on GPG http://www.gnupg.com/ [gnupg.com]
and/or PGP???
http://www.pgp.com/ [pgp.com]
I support and use the former and recommend the latter to my Microsoft locked-in friends.
What about enigmail http://enigmail.mozdev.org/for [mozdev.org] Thunderbird
or firegpg http://firegpg.tuxfamily.org/ [tuxfamily.org] for firefox?
Open your mind.
P.S. Note that this post is signed
Re:Secure your email (Score:4, Interesting)
As much as I really despise the centralized philosophy behind S/MIME and x.509, there's something to be said for avoiding the 'web of trust' models that lie underneath GPG as its currently used, because most users just don't want to have to deal with it.
Getting people to use encryption is always a tough sell, because most people, to be perfectly frank, lead lives that are so completely boring that nobody would ever want to read their mail, and they know it. Therefore, they're not going to expend much effort getting it working. Either it works all automagically, or they don't use it at all.
I've yet to see a GPG implementation that comes as close to being foolproof as some S/MIME implementations (like Apple's), once you get the certificates set up. Once you've received a signed message from someone, you have their public key. Once you have that, the encryption button is magically enabled, and you can send encrypted stuff to them. Even Sente's Mail frontend to GPG isn't that easy to use.
Parent
Re:Secure your email (Score:4, Insightful)
Or the flip side of the equation. Many are already placing already anything and everything about themselves on MySpace and Facebook. With so much information already public and available, what's to hide?
Parent
Re: (Score:2)
Re: (Score:2, Interesting)
(Mac OS X 10.3+) http://www.joar.com/certificates/ [joar.com]
(Windows) http://www.marknoble.com/tutorial/smime/smime.aspx [marknoble.com]
While I appreciate the idea and all, why? It's really not worth the time to encrypt my email. Do you think that if the feds are monitoring your line, they are just going to say, "Damn! He's encrypted. Let's move on to the next." I'm going to guess not. If anything, seeing that you email is encrypted might be enough to peak their interest to make you MORE
Re: (Score:3, Insightful)
Hash: SHA1
Nothing incriminating in your email? Not worried about 'them' monitoring your emails? Think again.
"Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety"
Ben Franklin
And BTW, encrypting email only takes a few minutes to set up and no (perceptible) time when signing/encrypting a message.
- --
Bill Arlofski
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: 'email gpgpublickey@revpol.com
Re:Secure your email (Score:5, Insightful)
No
Do I care if they snoop in my email?
Yes
Will I encrypt my email because they're snooping?
No - in the case of confidential messages, they have always been dealt with cryptically.
Can I do anything about them snooping in my email - regardless if it's encrypted or not?
Absolutely not
Can we do anything about them snooping in my email?
We can try
I am such a low priority for them that as long as it doesn't disturb my day to day routine, I really don't worry about it. I don't even notice if they are even sniffing my packets.
It's like being robbed in your home when you're out. It doesn't matter if you have an alarm system or not, if someone wants property of yours, they will get it.
You can double lock your doors, put bars on the windows, pay for a monitoring service, or whatever, it will not stop a determined person from getting whatever they want to get.
That hassle of behavior is not worth it to me. Supporting a group or honest politician to stop the snooping is worth the hassle.
I'm not going to go downtown and walk across the street out of my way just to avoid the town crier (you know, every town has one, a crazy coot parked in the center of town that says the end of the world is coming). I will confront him if he confronts me.
Parent
Re:Secure your email (Score:4, Interesting)
Therefore the aggregate effect of large numbers of people using encryption would be to render large-scale electronic surveillance systems useless, since they are only practical for plaintext traffic. (In fact, you don't really even need to be using state-of-the-art crypto; if everyone were using even keys that took a few days to break on a supercomputer, it would prevent most types of high-speed/real-time analysis and force authorities to take much more fine-grained, targeted approaches.
Your argument against taking an individual step to prohibit mass surveillance is the same argument that many people make against voting: your action, taken singularly, has virtually no effect. It is only as part of a group that it is significant. But just as many people deciding to vote the same way can change a government, a large number of people deciding to make the snoopers' jobs (even slightly more) difficult would quickly outpace their resources available for the task.
I don't think the solution is either-or, personally. As concerned citizens, we need to vote. As people with technological knowledge and capabilities, we have a responsibility to not make it easy for those in power to abuse it, through our passivity.
Parent
Re: (Score:3, Interesting)
You can double lock your doors, put bars on the windows, pay for a monitoring service, or whatever, it will not stop a determined person from getting whatever they want to get.
But in this instance it is like having someone in your house at all times who is allowed to go through your stuff at any given time for any particular reason. They aren't suppo
Re:Secure your email (Score:5, Insightful)
This is similar to the idea that you should not let the cops search your home without a warrant even though you don't have anything illegal inside. The more it becomes assumed that only the "bad guys" that are asserting their rights and/or privacy, the more likely such assertions will be thought of as indicative of bad behavior in and of themselves. If the feds assume I'm a criminal simply because I encrypt my email, then they are not doing their job effectively.
Parent
Re: (Score:2)
Hash: SHA1
I agree completely. Excellent point...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: 'email gpgpublickey@revpol.com for my public key'
iD8DBQFHFDmYcBKMMWOpTtwRAq7UAKCwK8z82/ZijTot5Vr3Fjd6TUa4aQCgrvvK
5KnXXA9BewVkH+F7J4Voy8g=
=T/fD
-----END PGP SIGNATURE-----
Re:Secure your email (Score:4, Funny)
This is similar to the idea that you should not let the cops search your home without a warrant even though you don't have anything illegal inside. The more it becomes assumed that only the "bad guys" that are asserting their rights and/or privacy, the more likely such assertions will be thought of as indicative of bad behavior in and of themselves. If the feds assume I'm a criminal simply because I encrypt my email, then they are not doing their job effectively.
Sure, but that is because having the police enter my house is intrusive. They track mud in, can drop anything anywhere and say that they found it there. That can't be done with email. Also, a warrant specifies exactly what they are looking for. Finally, items found in a house search is enough for prosecution. A quote from an email is not. Besides, these guys are not looking for prosecution, they are looking to identify and bust terrorism cells. They are looking to stop the next terrorist attack. They are looking to intercept supplies such as bomb making materials and replace them with something inert. Yes, an email will be evidence, but when it comes to terrorism, they require a open and shut case with multiple arrests. They don't want to pop you for looking for weed.
If the feds assume I'm a criminal simply because I encrypt my email, then they are not doing their job effectively.
I never said that. I said they would take a close look, wasting their time and doing MORE of what you didn't want them to do in the first place. If they can't get your email, they may listen to your phone calls. They may start tailing you. They may start investigating the people you email. Why? Because you thought it would be super cool spy stuff to encrypt your email to keep the evil G-Men out.
Besides, even the SS didn't really need to evesdrop. If they wanted information, they'd kick down your door, torture your little girl until YOU cracked, and put you on a train somewhere with a bunch of people with stars sewn into their clothing.
Parent
Re: (Score:3, Interesting)
Re: (Score:3, Insightful)
It could be worth your life to write a letter that might be seen as having the seeds of treason.
George Bush is not going to have you executed if you look like you may be "seeding the seeds of treason". Hell, if that were the case, all he'd have to do is show up at a anti-war rally and shot the people carrying the signs calling for revolution! Why bother paying Comcast? The King of England read mail to keep himself in power. The feds read mail to prevent a terrorist from killing
Re:Secure your email (Score:4, Informative)
You're kidding, right?
Parent
Re: (Score:2)
Re: (Score:2)
And that I disagree with 100%! Fortunately, I have not heard of a case where terrorism laws have been used to prosecute non-terror related crime. The second that they are, the prosecutor should be tossed out on his ass, not the laws. Punish those that abuse the tools, not the tools themselves.
As for copyright, do you think that its right that the RIAA has more power to spy on you than the federal government? At least the governme
Re: (Score:2)
Re:Secure your email (Score:4, Informative)
Parent
Re:Secure your email (Score:4, Insightful)
Just how many terrorists attacks have we had in the US? Why are you still knee-jerking on a crime that kills less people world-wide (including Israel) than drown in bath-tubs?
As for "they require a open and shut case with multiple arrests" WTF are you talking about? Do you know how many people in Guantanamo are part of "open and shut cases?" NONE. Do you know how many were even "picked up on the battlefield?" Hardly more than 5%.
How about the thousands arrested in NYC during the republican convention who were then just conveniently released without charges?
Recent history is chock-a-block full of cases where OUR government abused civil rights - when they couldn't find something legit to bust someone for, they stretched to find anything to pin on them - like popping you for looking for weed.
Parent
Re:Secure your email (Score:5, Insightful)
My stock trades are not incriminating either, but they are not sent plaintext. They are also not sent on my ISP mail servers. Sometimes data security is simply data security to prevent mis-use in the wrong hands. There is nothing incriminating, but my credit card order details is not to be made public.
There is a reason to encrypt some sensitive data. ID theft of credit card information is just one of the many reasons.
Parent
Re: (Score:2)
There is a reason to encrypt some sensitive data. ID theft of credit card information is just one of the many reasons.
Very well put. Personally, I can't say my rights are being violated when nothing in my life
Re: (Score:2)
How is the feds going to know any different? Often the only clue is the reciepent is orders@ameritrade.com or Ghadactv8st@gmail.com
Re: (Score:2)
The GGP was stating that he would encrypt his email because the gov't may be listening. I said that was a stupid reason and actually counter productive.
Besides, I think the address is a pretty good clue! Also, I think the physical location of the recipient, say, Tora Bora Afghanistan, would be another pretty good clue to go on.
Re: (Score:2)
How much it costs? (Score:4, Interesting)
Re: (Score:3, Informative)
Re: (Score:2)
They'll just ask for a bigger budget next year.
Re: (Score:3, Informative)
Comcast's charges don't seem unreasonable either, considering the amount of data they'll have to sift through to provide the information.
Misleading article (Score:5, Interesting)
Is this an attempt to improve Comcat's poor reputation among
Re: (Score:2)
seriously, if this is the case i hate comcast quite a bit less. i just sort of assumed they were doing the same thing as att and verizon and rolling over for uncle sam.
PARENT IS TRUE (Score:2)
comast high speed (Score:5, Funny)
Quick and Dirty Summary (Score:5, Informative)
Interesting read, especially considering the "Comcast Confidential" footer at the bottom of every page. That said, it's informative only insofar as it states there's laws to be considered, and makes clear the folks at Comcast insist on following them. Nothing in that document is very different than a typical publically-available TOS. Here's an excerpt:
As for the email policies referred to in the summary, Comcast does not store emails any longer than the subscriber chooses keeps them.
Put another way, Comcast doesn't store your emails. You do.
Re: (Score:2)
You left out the part where a subscriber may elect to not use Comcast mail at all and elect to use another providers service such as Hotmail or Yahoo mail. Comcast does not have any record of these. It's hard to retrieve records that don't exist. I fall in that catagory. I don't use my ISP's email at all.
Quick and dirty is if you receive all services from Comcast. However if you only subscribed to Internet and used Broadvoi
Re: (Score:3, Informative)
correction Vontage and all US VOIP Providers must
There fixed it. From you link..
"The Communications Assistance for Law Enforcement Act (CALEA) is a United States wiretapping law passed in 1994 "
Vontage is US based. Where is Ekiga which ships with Ubuntu based?
http://ekiga.org/index.php?rub=3&pos=0&faqpage=x149.html [ekiga.org]
"1.1.4. What is it compatible with?
Ekiga is compatible with any software, device or router su
Yay for Viral PR (Score:2, Interesting)
Since when did policies matter? (Score:2)
Clarification please... (Score:3, Insightful)
Are they saying that comcast will hand over identity and ip records WITHOUT a court order? The only 'balanced' policy would be to turn over nothing to law enforcement without a court order and even then to oppose the order if possible.
Comcast's words are compared to others' actions (Score:3, Interesting)
Apples and oranges. "Monk" is comparing Comcast's words to AT&T's actions..
It's nice to know that Comcast is able to write a policy manual that follows the law, but surely a written policy telling employees to break the law would trigger a minor scandal.
Anyone who's ever been in a large organization is familiar with lip-service CYA written policies.
How seriously does Comcast take this policy? Do they give training sessions to the people who need to implement it? Do they back up or undercut the people who go "by the book?"
The law doesn't protect you (Score:2, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
And the worst part is, when you ask them for the key to get you out of jail, they won't give you.
Re: (Score:3, Funny)
Re: (Score:2)
Re:The law doesn't protect you (Score:4, Interesting)
They did a distributed computing project a few years back to break a 64 bit encryption method and it took them a little over 5 years. Most encryption keys these days are 128 bits or higher and every bit you add doubles the number of possibilities they'd have to check, so for 128 bit using the same level of resources brute force would take 92,233,720,368,547,758,080 years(assuming that the five years case was an average case). Computers are a lot faster than they were, but not that much faster.
To sum up, if encryption works at all, no one is going to get in without knowing your password, and the shows are bollocks. That said some encryption algorithms do contain backdoors for the US government, and some algorithms are badly written(WEP for instance), P may equal NP and the US government will probably have a quantum computer as soon as they're available so YMMV.
Parent
Re: (Score:2)