Which ISPs Are Spying On You?

firesquirt sends us an article from Wired about a survey they conducted to determine major ISPs' data retention and other privacy practices. Over a period of two months, four national ISPs would not give Wired the time of day; and another four answered some of their questions in a fashion not altogether reassuring.

All of them

[Anonymous Coward]

All of them (in the US) are spying on you, thanks to government data-retention requirements. Y'know, in case a turrist or pedophile happens to use the intarwebs.

in EU this is mandated by the government...

[Anonymous Coward]

Actually, in the European Union, such spying practices are _mandatory_.

Rogers Slogan is "Don't be not evil."

[CheeseburgerBrown]

My Canadian ISP, Rogers, is not on the list but if I were to hazard a guess I'd reckon they'd sell my tracks six ways from Sunday as soon as sneeze.

These are, after all, the goons who think just about any kind of encrypted traffic coming out of your box is a terrorist threat to the movie industry -- even if it's just a VPN connection.

Does anyone know what Rogers retention policies actually are?

Re:Noisy clickstream

[Anonymous Coward]

Already done (see here [nyu.edu])

Also see Bruce Schneier's opinion on the matter [schneier.com].

In short, it isn't a good idea.

Re:All of them

[crazy al's]

All of the United States' ISPs are MANDATED to have the ability to spy on you, at a moment's notice, and send the full stream they request off to FBI or whoever's data warehouse. and they (the ISP) must comply and must not tell you if they are doing so, courtesy of CALEA. Penalties start at $10,000 per day. Obligatory bow of the head: I, for one, welcome our new overlords.

Re:All of them

[logiclust]

HA

that was funny.

Re:VPN ISPs?

[cswiger]

Um, the point of a VPN is to set up a secure tunnel to get to your destination network with the traffic encrypted en route, so it doesn't matter whether your ISP is snooping on your traffic or not. Now, if you wanted to host your destination server or network somewhere like Canada or someplace with less intrusive government monitoring, that might well be a good thought.

The problem is that the US via CALEA is requiring things like Cisco routers used to terminate many VPN connections be wiretap-friendly, so using a VPN tunnel might not be as safe as it was before that law came about. Cisco has a page about this, but it doesn't actually give you much specific info:

http://www.cisco.com/wwl/regaffairs/lawful_interce pt/ [cisco.com]

Looks like it's time for...

[Anonymous Coward]

A whole lot more TOR servers to sprout up. When everyone switches to encrypted traffic on all the normal ports, your connections might be logged and the data transferred between you and the onion network copied, but how long would it take to sift through the internet's traffic if it were all encrypted?

Re:VPN ISPs?

[Anonymous Coward]

1) The router would be in the safe country anyway, therefore wouldn't be subject to physical wiretaps at the endpoint.

2) Don't waste your money on a Cisco router. It is MUCH easier and cheaper to just rent a Linux machine in a "safe country" and install OpenVPN [openvpn.net] on it.

3) Most of your traffic is going to be routed back through the US or EU anyway, where most of the world's servers (and backbones) are located.

4) Your "safe" routing node is still identifiable, even if your ISP refuses to give up your name/address. There are other ways of achieving the same goal through analyzing your traffic after it leaves the endpoint of your encrypted node.

Re:Noisy clickstream

[chrono13]

TrackMeNot isn't designed to hide your searches from your ISP. It is designed to muddy the profiling Yahoo, MSN and Google are performing. Recent versions of it seem to perform that job fantastically and address most of Bruce's concerns (word list, timing, etc). So while it would hinder, to a degree, it is the fact that it really does not erase or otherwise really hide my legitimate searches from my ISP or work proxy, that I do not use it. But most of Bruce's concerns are no longer valid.

Re:IRC logs

[ShaunC]

Anyone in any channel could be logging (and publishing) the conversation, even if not "officially." Much like Slashdot, don't say anything in IRC that you'd hate to have someone find via Google.

Re:All of them, DUH - NO. Some do the right thing

[RDaneel2]

"... All such orders will be reported to our entire customer base."

Ummm... dream on about this part (at least), as "Patriot Act"-backed demands (with or without a warrant) can forbid the disclosure of said demand.

And while an especially conscientious service provider might insist on dotting i's and crossing t's, it is doubtful any of their personnel (or bosses) will be willing to be jailed as a "terrorist". :(

Re:Rogers Slogan is "Don't be not evil."

[Anonymous Coward]

I have a coworker who used to work for Shaw. He tells me that they log every single connection made to/from their customers, including at least source/destination IP and the amount of data transferred. He says they don't log the data itself. He says they have a huge SAN, and migrate to optical media for off-site storage with Iron Mountain. Supposedly they keep 7 years of records. I'm curious what they'd say if asked about this, he's a new guy and may be BSing.

Take the SPY out of ISP-y

[talledega500]

We all saw this coming.
I prefer to do something about it.

http://www.mysecureisp.com/ [mysecureisp.com]

http://www.blackboxsearch.com/ [blackboxsearch.com]