ISP Tracking Legislation Hits the House 332
cnet-declan writes "CNET News.com reports that Republicans in the U.S. House of Representatives announced yesterday legislation to force ISPs to keep track of what their users are doing. It's part of the Republicans 'law and order agenda,' with other components devoted to the death penalty, gangs, and terrorists. Attorney General Gonzales would be permitted to force Internet providers to keep logs of Web browsing, instant message exchanges, and e-mail conversations indefinitely. The draft bill is available online, and it also includes mandatory Web labeling for sexually explicit pages. The idea enjoys bipartisan support: a Colorado Democrat has been the most ardent supporter in the entire Congress."
Good luck (Score:5, Insightful)
Re:Good luck (Score:5, Insightful)
Don't give them ideas.
the problem is, they don't realize the massive hardware costs that would be involved.
What's more if they did understand the expense and barriers of such a plan, they wouldn't care.
Re:Good luck (Score:5, Insightful)
I don't know about you, but I connect to a mail server using SSL, and the server is not operated by my ISP. Are they going to log some unintelligible bits? Are they going to force people to use their ISP's mail server? Who is an ISP? Anybody who resells bandwidth? How will they know you're reselling bandwidth? Etc...
Re: (Score:2)
Re: (Score:3, Interesting)
ISP's keep logs anyway. When we get a subpoena from the feds for "any and all" logs related to a customer's usage, they know they're just going to get things like dhcp logs and mail server logs. On the *extremely* rare occasion where they require full blown network activity, they get a network trace dump. I remember one instance where the person's network traffic was fairly light, so the dump was a few hundred MB for a couple of days. While in another instance, we were required to trace someone's traf
Re: (Score:2)
No, but if you're on this list they'll just assume you're doing something wrong. They'll summon the FBI, who will take away your computer(s) for analysis and question you. Hello police state!
Re:Good luck (Score:4, Insightful)
Whoever your e-mail provider is is also an ISP. They provide an Internet service. Therefore, they are required to maintain whatever logs are mandated by the government. If that includes storing backups of e-mails, so be it. The company that provides you access to the Internet doesn't have to maintain that information--they're just a conduit.
Of course, the government might try to claim this, and then they will simply shut down any ISP for which they go after this information. It's pretty well impossible to capture and maintain all of the traffic that crosses the ISP's gateway for any useful length of time.
Re: (Score:3, Informative)
Re:Good luck (Score:4, Insightful)
If that happens, some company will spring up outside the USA that will charge a monthly fee to tunnel your Internet traffic through their servers via SSH. And they'll send you the server's public key fingerprint via postal mail so that you can verify that there's no man-in-the-middle attack. That will be foolproof unless the US govt decides to start opening mail and altering anything that looks like a public key fingerprint or SHA sum or whatever. And then the foreign companies will start broadcasting their public keys via short-wave radio. And then the govt could ban short-wave radios. And then... this is beginning to look like North Korea...
Note that I do not believe any of this will really happen. I do not believe we Americans will accept a totalitarian government. I don't even believe we'll accept small steps in that direction in the long run. I think the proposed policy is destined to fail and is the result of (a) a power-hungry administration (whose time is up in 2 years anyway) and (b) a desire to catch terrorists and (c) an extraordinarily bad understanding of technology.
It's amazing to me how legislators and policy-makers fail to understand crucial points about technology. They believe that DRM can be effective (or, failing that, they make it illegal to break), they blithely ignore the global reach of the Internet, and they don't know how easy it is to use strong encryption. They need to pick and choose their battles differently.
Re:Good luck (Score:5, Insightful)
How about a little bipartisan power grab, who'll continue to pass the ball back and forth every four or eight years. They'll keep the people entertained by focusing on social issues (are we pro-gay or anti-gay this year?) while the actual running of government is left to Party lead... sorry, political families like the Kennedys, Bushs and Clintons putting relatives in key positions whenever their side wins an election. Presumably in close cooperation with corporations who run large lobby groups and are the only ones with a considerable sway in day-to-day politics and pay attention to rider bills and the like. Between an election system where it's almost impossible to create a third party and so much of the mass media controlled by corporate interests, it'll seem like the will of the people. I don't think the question is "would people oppose a totalitarian government" as much as "would Americans recognize a totalitarian government before they were neck deep in one?".
Re: (Score:3, Interesting)
Re:Good luck - SSL? (Score:4, Insightful)
It's my password. If anybody learns what it is they can use my server as a spam relay, read my mail, etc.
Re: (Score:2, Funny)
Bits and bytes don't weigh anything, so it's all free. Besides, I'm sure the hard drive companies will offer steep discounts for bulk purchases.
Re:Good luck (Score:5, Informative)
Here's what the bill says:
SEC. 6. RECORD RETENTION REQUIREMENTS FOR INTERNET SERVICE PROVIDERS.
(a) REGULATIONS.Not later than 90 days after the
date of the enactment of this section, the Attorney General
shall issue regulations governing the retention of records
by Internet Service Providers. Such regulations shall, at
a minimum, require retention of records, such as the name
and address of the subscriber or registered user to whom
an Internet Protocol address, user identification or telephone
number was assigned, in order to permit compliance
with court orders that may require production of such information.
First note that the information they are primarily interested in is being able to tie a user to an IP address. It is trivial for an ISP to keep this information, and any responsible ISP already does so that they can investigate fraud and abuse complaints.
Second, the regulations are to deal with record retention, not tracking. So, if an ISP currently tracks user activity, the AG could require the ISP to keep that information for x days. But this bill does not seem to give anyone the power to order ISPs to start tracking users in ways they aren't already.
Re:Good luck (Score:5, Informative)
From TFA.
"Because there is no limit on how broad the rules can be, Gonzales would be permitted to force Internet providers to keep logs of Web browsing, instant message exchanges, or e-mail conversations indefinitely. (The bill does not, however, explicitly cover search engines or Web hosting companies, which officials have talked about before as targets of regulation.)
That broad wording also would permit the records to be obtained by private litigants in noncriminal cases, such as divorces and employment disputes. That raises additional privacy concerns, civil libertarians say. "
Re: (Score:3, Insightful)
Why you're absolutely right! And there's nothing in the constitution that says we have a right to habeus corpus either, only that it cannot be taken away. All these people trying to be so liberal in their interpretation of things, so silly! The fact that it permits the AG to ask for anything he wants, as long as he collects at least that much information is such a niggling little de
Re:Good luck (Score:4, Informative)
Actually there is: Now, I suggest you go read Title 18, 2257:http://www4.law.cornell.edu/uscode/html/usco
Specifically this line:
"(g) The Attorney General shall issue appropriate regulations to carry out this section."
Now... go out and read about the "appropriate regulations" which have been issued by the Attorney General and their practical applications and implications. For example: Federal agents can enter a private home without warning nor warrant, and search through her computer files to check for compliance. Anything seen during that "visit"--regardless of whether or not it has anything to do with "porn", can be used as evidence of crime. By order of the AG, the 4th Amendment ceases to exist for cam girls (any "cam girl" who shows skin is considered a "producer of pornography" and her home is a "place of business").
As with 2257, this legislation clearly and specifically gives the Attorney General a blank check in writing rules--rules which are not debated before nor voted on by Congress, nor signed by the President, yet which hold the weight of law.
You can bet that the initial "attack" will be 2-pronged: Porn and Terrorism. Morality and Fear.
And let's be very clear about this: This will be done under the authority of a single, unelected man; a man who, in the current incarnation, wrote guidelines telling members of the current administration how to get away with torture.
While there are very few politicians that I trust, I do trust in the conflict of personal interests which pervades Congress to create a situation where there is at least some degree of valid debate and limit of authority.
Re:Good luck (Score:5, Funny)
Re: (Score:2)
Hard disks are obsolete (Score:4, Funny)
This storage method is based on the accoustical storage method that was proven over 50 years ago, now updated with more recent innovations to provide better bit density and bandwitdh. The way this works is that the digital stream is moduled onto a laser that is pointed upwards. As we all know, space is curved, so eventually the laser beam comes back to earth where it can be reread after a long trip through space. There's lots of space out there and it is free.
Re:Hard disks are obsolete - write-only memory! (Score:5, Interesting)
However, there is a flaw, the earth, solar system, and galaxy itself are moving at incredible rates, the point in space we occupy now will not be the same point that the laser will return to in a hojillion years give or take. BUT! I think you have come up with a very novel approach at creating the proverbial write-only memory. Quick, patent it!
To keep on topic (some mod has been busting my chops lately for trying to have actual interesting conversations), since the bill sets no maximums on the retention requirements I think it's very likely that Gonzalez et al are going to ask for a rediculous amount of data retention. They've been dropping hints about it for years now, something like a permanent record of every website visited would be the first thing they try to mandate. That alone will be a gut-busting storage requirement, and force many non-mega ISPs right out of business. This bill has the potential to radically affect the businesses that provide internet access, and radically alter the privacy people expect when using the internet. While I hope this bill dies quickly, I fear it will ride the tide of "think of the children" with few obstacles.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Re:Good luck (Score:4, Informative)
You underestimate the web pages you visit. I did an experiment a few weeks ago along these lines using Firefox's LiveHTTPHeaders. After hitting the front pages of Slashdot, MSN, Yahoo, and two other portal sites, I had 150 requests. That's 30 requests per page. Just now, loading yro.slashdot.org took over 50 requests.
People generate an enormous amount of web traffic without even thinking about it. To expect every ISP to archive that information just because is crazy. It's only really feasible for someone like Google, who is in the business of profiling potential customers (or AT&T, who is in the business of letting the Feds spy on you).
Re: (Score:2)
Re: (Score:2)
They may as well legislate that gravity be lessened to solve the obesity problem. It's just as feasible from a technical sense.
Google logs every search made by its logged-in users. I expect it's quite feasible to set up a database to record every url requested by every person for quite some time. Unfortunately.
Zero G on the Earth's Surface Is Possible (Score:3, Interesting)
First, find a big asteroid. Put a bunch of metal plates around it with a carbon on the inside and nuclear bombs on the outside. Set off the bombs. If you've set it up right, the plates slam into the asteroid, compressing it tremendously. The
Re:Good luck (Score:4, Insightful)
If an idea starts with "The government should..." and doesn't end with something about providing infrastructure or protecting you from physical harm, it's a bad idea... And even some things that fit the formula are bad ideas too.
Guess it's time to stop using the internet (Score:5, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
Won't somebody please think of the children! (Score:5, Insightful)
I, for one, don't want my kids growing up in a country run by the thought police.
Re:Won't somebody please think of the children! (Score:5, Insightful)
With "Terrorism" and "Think of the Children" as the alternates?
Re: (Score:3, Interesting)
Overcoming the funding gap (Score:2)
Option Labeling of Non-Sexual Content (Score:4, Insightful)
What they need is exactly the opposite: optional Web labeling for non-sexually explicit content.
If you think your site is safe for children then you can add a label to that effect. There could even be a well defined process where, if you labeled your site as safe-for-children and it wasn't, then you could be required to take down the safe-for-children label.
Ideally, there wouldn't just be one safe-for-children label but a variety of specific government defined labels that identified a site as being free of specific types of content (e.g. no nude photos versus no sex photos).
Re: (Score:3, Informative)
Re: (Score:2)
I get to decide what is bad and what is good
You can send you tributes to the folllowing address.........
Pointless (Score:2)
Also considering that these records are kept 'indefinitely' the storage and money spent on this should be subsidized in some sense
Re: (Score:2)
Just email your logs to the Attorney General each evening.
Solves both the problem of where to store them and how to get them to him when he wants to see them.
Simple.
Re: (Score:2)
Re: (Score:2)
huh? (Score:3, Interesting)
Why don't they just put everyone in prison? Then we wouldn't have any crime at all. Problem solved.
Re:huh? (Score:5, Insightful)
The Party's goal isn't to eliminate crime by throwing everyone in jail -- it's to eliminate people who piss it off by merely being able to throw anyone in jail.
You don't have to like Rand to apppreciate that she was onto something when it came to how governments think during the design phase of legislation.
Putting everyone in prison (Score:5, Interesting)
"If all that Americans want is security, they can go to prison. They'll have enough to eat, a bed and a roof over their heads. But if an American wants to preserve his dignity and his equality as a human being, he must not bow his neck to any dictatorial government."
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
Depends which prison. Supermax [spunk.org] doesn't have a crime problem, I can tell you that. 23-hour a day lockdown.
Time to Invest (Score:2)
This would change the way people use the web. (Score:3, Insightful)
You're thinking too hard (Score:3, Funny)
Re: (Score:3, Informative)
Sexuality explicit issue (Score:2)
Re: (Score:2)
It really must be non-existent-- the word doesn't even show up in your post.
You have to admit... (Score:4, Funny)
Re: (Score:2)
I love the spin (Score:3)
If similar bills had no chance in a Republican-controlled Congress, does it really have a chance now? Doubtful, especially since the Democrats have a comfortable majority in the House.
Besides, I'm not a fan of impractical laws that are extraordinarily difficult to enforce. If this bill became law, do you think certain users would create scripts that visit hundreds of thousands of sites, just to clog the log books?
Reagan Turning in His Grave (Score:3, Insightful)
Oh, the conservatives are pissed [cnsnews.com]. But like you said, it all comes down to whether they'll stop strategizing long enough to not elect another Bush.
The price of freedom is eternal vigilance (Score:2)
As also, be professional and use there perferred method of contact.
If in doubt send a letter.If it is real important send a certified letter.
Re: (Score:2)
Aren't those still being held up to be checked for anthrax? If it's time sensitive, try something else.
Nice work (Score:5, Insightful)
"Hey how can we kill off a lot of small businesses so our big behemoth telecomm contributors can make more money in the long run? Ooh! increased operating costs! Our friends have the coffers to handle this while their smaller competitors die off. We'll have to make it look like something else though. Tie it to crime. Everyone hates criminals."
No (Score:3, Insightful)
"What sort of grandstanding can I do to get my name in today's local/state media cycle? Let's see, my likely opponent has introduced a bill in the statehouse mandating that sex offenders register their online accounts. . . . Hrm, what trumps pedophiles? Sure, Terror, domestic Terror! that's the ticket!"
Actually, that is the politician's Chief of Staff thinking; the politician is thinking:
"Does this tie make me look soft on crime? If that minxy little intern thinks
Re: (Score:2)
NSA spying at the same time.
constitution (Score:5, Insightful)
Confusing (Score:2, Interesting)
We here at the Future Crimes Department take pride in knowing you're going to do someth
Three Letters (Score:2)
First Reaction and Real reaction. (Score:5, Interesting)
For those of you that haven't seen Terry Gilliam's Brazil [imdb.com] you must it is an essential requirement for anyone who would just react with the snarkiness I mentioned above.
They can't parse all of that data. A single major ISP on a single day would generate terrabytes of data if everything was logged. In that event any actual law enforcement methods would be swamped by the sheer beureucratic waste of it all. Massive computer systems performing continuous number crunching would still come up with garbage.
But that doesn't matter!
It isn't necessary for this to work. What is necessary is for them to make people perceive that it works at least enough to get it put in place. At that point the system becomes self feeding. Don't like it, well that can get you put on the short list for a check of your habits. Because they can look at a single person's habits, they may be wrong but they can and will do it. But in general the system will be a large self-feeding monstrosoty and any "errors", because there are always errors will be dealt with in the same way that the no-fly-list errors are handled: "not my department, next please!"
Eventually success of this process ceases to be the object only its continuation. Once a large enough beureucracy is established staffed with enough place-men and place-seekers to protect themselves then this will take over. Consider the Drug war as an example. Yes it hasn't hit full steam but think of ho many things today are justified by means of the "Drug War". And take a look at the way justifications for the war are handled. Money for the Partnership for a Drug-Free America (led by America's Drug Czar) is spent convincing us to back the drug war or not to vote for legalization. In turn the DEA's budget (paying America's Drug Czar) goes up and who the hell cares if the drugs are stopped. And they aren't even fighting "Terrorists".
In many respects it reminds me of East Germany. At the height of their power the East German Stasi employed one in fifty members of the population as full or part-time spies. This doesn't count the large beureucratic staff that they had or the massive infrastructure that was built and run just to sort through it all. The social costs were enormous as any infraction was targeted for no good reason. The economic costs in turn were insane and deprived the state budget of much of the money that might have been spent say building an infrastructure or feeding the population. No nation on earth had more complete information on its citizens and no nation on earth spent more obtaining it.
Ultimately crime was still committed and even the dissident groups grew because they a) hated the government that much, b) were often flooded with spies sent in by the Stasi, and c) could get away with it. None of the objectives of the Stasi were acheived and East Germany fell, it fell and noone misses it.
This "Law and Order" bull must be stopped, and it must be stopped now! We cannot sit back and think that this is okay or that it will "work its way out. Those of us with a technical mindset are in the best position to explain why this will not work and what a costly destructive system this will be, and we cannot put it off.
For those in the U.S. go Here [house.gov] to find your house rep and place a phone call or send a letter. Then for good measure go Here [senate.gov] and tell the Senate not to go there either. Following that try sending a letter to you local paper's letters to the editor. While many of us no longer read the dead-tree press it can and will make a big impact for those that do (read: most people over 35).
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
Re: Get the lawmakers to arrest themselves? (Score:3, Interesting)
Problem: "Attorney General Gonzales would be permitted to force Internet providers to keep logs of Web browsing, instant message exchanges, and e-mail conversations indefinitely."
Solution, from 3 stories down on Slashdot: "UK will start jailing the people who trade in email addresses, or any other personal data. The new regulations will result in a two year prison sentence for violating the Act."
Not counting the minor detail of countries involved, does anyone else read this as : "Attorney Ge
Bad Bad Bad (Score:2)
IP addresses aren't unique nor do they necessarily identify a user at a particular moment in time. If coming behind an AOL proxy, the only way to discover the actual user, is for AOL to log all outbound TCP & UDP connections. It can't be done...
Re: (Score:2)
Is the political system too broken to even bother writing to our congressthings?
If it isn't, what's the best way to get the point across?
If it is in fact too broken to do any good then what do we do?
99% of folks in the US don't know how to set up good crypto or would be intimidated about it. So then we ask is this a discussion we only want to have within the tech community or do we want the average joe to ca
You think this is bad! (Score:3, Informative)
Re: (Score:3, Insightful)
However, in the current political climate, I foresee i
This bill changes nothing (Score:2)
Remember that whether or not Big Government ends up forcing your ISP to spy on you, the ISP has the capability anyway. There's no new threat here, merely a new statement of malicious intent and contempt for citizens (which has been pretty implicit for quite some time anyway).
Also remember that Big Government isn't the only entity that may feel it has something to gain from spying on you. No matter what sort of legislation exists for limiting or opening government intrusion into our lives, regardless of a
By a strange coincidence... (Score:2)
Hmm.
FBI just wants the money.... (Score:2)
Funny the AG didn't want to do that... guess it didn't sound as g
reference to IM and chat records misleading (Score:3, Informative)
Re:reference to IM and chat records misleading (Score:4, Insightful)
Why are proposals like this even acceptable? (Score:2)
Can you imagine the uproar if smirking ass-face Gonzales (sorry, his first name escapes me right now) proposed that every letter sent through the U.S. postal system must be photocopied, indexed, and stored? Or if all telephone conversations must be recorded in case the Justice Department needs access to them at a later date? People would be livid, and justifiably so.
Yet the internet has
Serves Broader Agenda (Score:3, Insightful)
It still boggles my mind that this is somehow offensive behavior in the
Most of us have *no* clue about the scale and scope of data collection is like in the U.S. right now and I believe most would be very nervous if we actually knew besides what's already been leaked. What brings me some comfort is gov't agencies are not known for their effectiveness or ability to coordinate much beyond a luncheon.
Does the "in-home" ISP count? (Score:3, Interesting)
My hardware matches the description of Internet Content Hosting Provider and Internet Email Provider, but the record-keeping portion of the bill refers to "Internet Service Provider" which I presume is defined elsewhere (not in this bill.)
*sigh*.
An Affront On Privacy (Score:4, Informative)
Re: (Score:3, Insightful)
Of course it is! It's written by a technologically ignorant fuck. Also, it's not as if the US government has never passed ambiguous laws/rules. The burden placed on ISPs and possibly others is so onerous as to be laughable, if it wasn't so sad. To put it in a context some elected officials MIGHT understand, it's similar to telling the US government to document every work conversation for every government elected official and worker. I told my politically and
I am my own ISP (Score:3, Funny)
Oh, Congress won't pay for it. (Score:5, Insightful)
All in the name of "protecting the children" and "War against Terror".
The question will be, how much money will an ISP have to spend to record everything, in a secure fashion, for years and years? And at what point will the that expense be LESS than any fine that will be levied for non-compliance?
Re: (Score:2)
Re: (Score:3, Informative)
Re:Oh, Congress won't pay for it. (Score:4, Insightful)
A quick look at my Firefox history (which stores 9 days of info) shows that it's a little under 1 meg in size. That means that over a month I'd generate 3 megs of history. However, since most web page hits actually result in dozens of actual HTTP requests and most of my browsing is to pages I've already visited, it's reasonable to say that a complete log of my browsing would be at least 10x that, so let's say 30MB/month, or 360MB/year.
My email (which goes back 3.5 years) is about 1GB, but I'd say it's safe to assume that between spam and messages that I didn't need, I've only kept 1% of the email I've received in that time, so 100GB/3.5years would give us about 30GB/year.
I don't keep logs of my instant messaging, but let's just round up to an even 50GB/year for the whole thing. Of course, I'm probably an atypically heavy user of the internet, so for the sake of discussion let's say that the average user is really only 10% of that, or 5GB/year (which is probably very low).
5GB/year * 200Million U.S. internet users is 953 Petabytes of generated data every year. At a current storage cost of about $4M/petabyte, ISPs would (under this law) have to bear a combined total of almost $4 billion / year just to buy storage space for all of this data (which doesn't even begin to take into account the physical space to store the storage servers, the people to run them, the electricity to run them, the backups, etc., etc.).
Conclusion: This is completely infeasible, regardless of whether the law is passed. After all of the costs are factored in, you'd probably end up seeing a doubling (if not more) in the cost of Internet access just to support this.
Re: (Score:3, Interesting)
In my case, a whole lot. Because as soon as someone starts collecting IMs from my system, I'm going to set up a bot to entertain them. I think Chatterbot would like to read War and Peace. Then brush up on world events with the CIA World Factbook. And then maybe work the rest of the way through Project Gutenberg.
I'm not too worried about e-Mail, they already have to sort through all
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
Re: (Score:2, Insightful)
Re: (Score:2)
Light is an electromagnetic wave/particle/whatever.
It's still junk legislation.
Re: (Score:2)
Re: (Score:2)
Actually (Score:3, Informative)
Re:Useful only for abuse (Score:4, Informative)
I'm not quite sure you understand reality some ISP's delete customer login information hours after they are used, (which in reality may or may not be the truth as which information really gets destroyed diverges from the official company policy). It litterally takes days to weeks to months to track down a user to an originating IP who went through multiple servers in different countries, talking with different admins and end users who have a compromised box, working your way back to the source. The police don't have a movie style magic box, they can plugin that will tell them, hacker trying to break into bank , bounced through 10 different systems, 3 different countries but is actually sitting in Columbus, Ohio (of course as a proper nod to the movies, the hacker always knows they are onto him and disconnects right as the last line is being drawn to his house).
What I think it comes down to is there is such a wide varience to the rules, 8+ years ago when admined at an ISP we had conversations with FBI about retention policies: email, backup, authentication logs, etc. There statement to us was that we could do anything we wanted as long as the whole organization followed the same rules; if they would call up the secretary and she said that we never deleted backup tapes, and they call up the admin and he says they are deleted every days. That they would be flying in and getting all the equipment under court-order evidence protection (effectively putting us into a bind operationally having no equipment anymore).
Re:If this law can actually be feasably implemente (Score:3, Insightful)
There has been some hinting around - mostly at the state level - a couple years ago that open WiFi will be made illegal - the rationale was [from the published articles, which unfortunately I don't have a cite for at hand] to "protect" the owner of the back-haul connection from "liability". The context here was the state of Michigan, who - it was my understanding - had just become the first state to successfully prosecute war-drivers.