DOJ Seeks Mandatory Data Retention For ISPs 247
Hugh Pickens writes "Computerworld reports that in testimony before Congress the US Department of Justice renewed its call for legislation mandating Internet Service Providers (ISP) retain customer usage data for up to two years because law enforcement authorities are coming up empty-handed in their efforts to go after online predators and other criminals because of the unavailability of data relating to their online activities. 'There is no doubt among public safety officials that the gaps between providers' retention policies and law enforcement agencies' needs, can be extremely harmful to the agencies' investigations,' says Jason Weinstein, deputy assistant attorney general at the Justice Department, adding that data retention is crucial to fighting Internet crimes (PDF), especially online child pornography. Weinstein admits that a data retention policy raises valid privacy concerns however, saying such concerns need to be addressed and balanced against the need for law enforcement to have access to the data. 'Denying law enforcement that evidence prevents law enforcement from identifying those who victimize others online,' concludes Weinstein." Think about how much evidence is denied to law enforcement by envelopes, opaque concrete, and criminals' failure to shout.
Another unfunded mandate (Score:5, Insightful)
Re: (Score:2, Insightful)
As an unfunded mandate it would effectively be a stealth tax. Either the firm eats the cost and lowers returns or they raise prices. No matter what the firm does someone will pay (either investors or customers). I doubt the politicians will support an effective tax increase in the current environment, especially given that it would not help with the deficit.
Re:Another unfunded mandate (Score:5, Insightful)
Re: (Score:2, Insightful)
You seem to be laboring under the delusion that politicians' support depends on the economic effects of a proposed measure, rather than on popular perception.
Most people will see this as "Yay, gonna get them child pronoguffers now!" and completely ignore the economic effects, so politicians will either stand for it, or use such excuses as "keepin' tha gubbermint out of your damn bizness" to oppose it. Nobody will talk about the economic impact, because most voters don't want to hear about it.
Re: (Score:2)
it won't pass.
companies will fight this bigtime, and it incurs a huge cost upon the companies (and a huge liability).
So unless government wants to pay for it I highly doubt the ISP's will be willing to do it.
Re: (Score:2)
Re: (Score:2)
Re:Another unfunded mandate (Score:5, Funny)
Why not send to /DEV/NULL? I
because my system is case sensitive and you would fill up the hard disk very quickly.
Re: (Score:2)
mkdir /DEV && ln -s /dev/null /DEV/NULL
I'm Winston Wolfe. I solve problems.
Re: (Score:3)
+1 creepy
Re: (Score:3)
It's supposed to be hard for the government to snoop on ${Random_User}. That is what prevents the government from going on fishing expeditions, which is definitely a Bad Thing.
As a simple example, I have been rather put off by the policies TSA put in effect last November, and have visited quite a few web sites protesting those measures in the last couple of months. I also have an interest in amateur model rocketry, and recently discovered that there were people
Re: (Score:2)
Re: (Score:2)
The problem isn't the storage. The problem is the retrieval. You've got to remember DHCP logs go by mac address. Finding out which customer was on a paticular pi
Re: (Score:2)
Is it 2Gigs after compression?
Re: (Score:2)
Re: (Score:3)
More so, logging via MAC address, which is a modifiable identifier is a moot point. For example, I have FIOS, I have long since replaced my actiontec router (three times actually), and use an openbsd box as my primary gateway/firewall, for the DHCP to function, I had to forge the mac address of the actiontec on the openbsd box.. easy enough to reset, and when they show up, the actiontec router I have will have a different mac address. Obviously, this will not remove all suspicion since the MAC is associat
Re: (Score:2)
Devils advocate - I do understand the cops (Score:3, Interesting)
Re: (Score:2)
Forcing companies to record what you do online just in case the police want to investigate you in the future is the ethical equivalent of forcing companies to record what happens in their bathrooms just in case the police want to investigate something in the future.
Someone could commit crimes in either locations. Spying on people preemptively is a violation of a fundamental human right to privacy. If there is a crime and a warrant for a specific incident, plant the cameras and taps to record activities. But
community mesh networks (Score:2)
closest thing I've found so far.
Re: (Score:2)
Those logs will be REALLY useful to a bunch of people, and not just LEOs.
Take lawsuits on a large scale. It would be trivial to get a litigation group together to demand ISP logs, riffle through them and build massive copyright lawsuits on the ISP's customers based on sites visited, and perhaps info downloaded. Remember: if it swings past a jury, it works, so it doesn't have to be CSI level of evidence for proof, just something to show it is more likely Joe Sixpack downloaded a movie than not likely. So
Re: (Score:2)
This'll end well... (Score:3)
Re: (Score:2)
Warrant? (Score:3, Funny)
Re:Warrant? (Score:5, Insightful)
I have a problem with it. The want to demand that my ISP increases their costs (which naturally will be passed on to me) to store data to be used against me, despite that I have done nothing illegal. And it will do nothing to catch criminals, because they can just pass all their data through an encrypted tunnel to a VPN provider in another country. Waste of my money.
Re: (Score:2)
Re: (Score:2)
They already catch the stupid criminals without this.
This is nothing but security theater, just like it is over in Europe.
Oh wait, it's the 10 year anniversary of 9/11 this year, coincidence? I think not.
Let them give the example, and record themselves. (Score:3)
Comment removed (Score:4, Informative)
were prosecuted (Score:2)
According to the article you linked to, most of them were charged. One fled the country & at least 1 died before he could be indited.
On the other hand, how exactly do you find child porn on a PC doing virus removal or hardware repairs? Unless the guy is stupid enough to leave the individual files on the desktop or label a folder child porn you shouldn't have any clue that it's there.
Re: (Score:2)
names in the most recently used files in the start menu is usually a good give away
Re: (Score:2)
Possible. But, hypothetically, if I were an internet pedophile, I'd look at Freenet first. Possibly Freenet via a VPN if espicially paranoid.
Re:Warrant? (Score:5, Interesting)
Most things that the government requires add costs: various forms of record keeping, emission controls on automobiles, workplace safety devices, etc.
Substitute accountant for ISP and you could make the same argument, including most of the "clever criminals can outsmart law enforcement" argument.
How is this really different?
Re: (Score:2)
It's a LOT of data and contrary to claims, much of it is not recorded at all now. At least with the accounting, it really is data that was already tracked so the new laws really just made them wait longer before shredding it.
Emission controls and workplace safety are internalizing externalities and in the case of safety, spelling out how to not be negligent.
In contrast, this is demanding new infrastructure to do something never done before so the police can conscript and deputize the ISPs.
I say we start wit
Re: (Score:2)
And it will do nothing to catch criminals, because they can just pass all their data through an encrypted tunnel to a VPN provider in another country.
This argument isn't correct. You assume that every criminal will circumvent this measure. That ignores all the criminals who don't (obviously). Given that there are a ton of great ways out there already to avoid getting caught doing bad things on the Internet and lots of criminals don't bother with any of them, it seems likely that lots of criminals also won't bother circumventing ISP logs.
Re: (Score:2)
The want to demand that my ISP increases their costs (which naturally will be passed on to me) to store data to be used against me, despite that I have done nothing illegal.
Yeah, man! Where does this end? Next thing you know they'll be taking money straight out of our paychecks to build prisons and shit!
Requiring warrants are not a guarantee of anything (Score:5, Insightful)
Re:Requiring warrants are not a guarantee of anyth (Score:5, Insightful)
It's not going to be just the police. If the data is there it will be available to civil suits. Things like showing your ex-spouse visits porn sites and is clearly not a suitable parent.
Re: (Score:2)
It's not going to be just the police. If the data is there it will be available to civil suits. Things like showing your ex-spouse visits porn sites and is clearly not a suitable parent.
Fair game, so long as legit, verified data of the same kind is available on anyone and everyone upon judicial order, from the nerdy teenager all the way to everyone in the White House, DOJ, Wall St, Pentagon, your boss and his wife, etc. We'll see who has the most stuff to hide.
Re: (Score:2)
Or whose records were "lost" in a "freak backup accident".
Re: (Score:2)
So the balance of power the records will supply has to be equalized somehow.
We just have to throw enough chaff into the system to drown it in crap
Honestly if something like this were proposed and I actually thought the records on all officials would be kept and presented correctly, when investigations are requested by the public, I would vote for it. I think the public in general would have much less to hide than people in power.
Re: (Score:2)
Because they adhere to the strict letter of the law as it is, right? Warrantless wiretaps? Secretly funnelling all telecom traffic to the NSA? Bypassing FISA courts?
Seriously? You actually trust the government to adhere to the law?
Re:Warrant? (Score:4, Interesting)
Re: (Score:3, Insightful)
(In the US, the family would have been forced to watch as the police killed the guina-pig (because it tried to bite one of the officers), and then been forced to stand outside in the cold while the police tore the house apart looking for anything illegal. And when it was all over, there would definitely not have been any apology, and the family would be left needing a new door.)
Re: (Score:3)
Is that really any more outrageous than the police raiding a home and finding pot? In either case, the greatest threat to the public is the police.
Re: (Score:2, Insightful)
>>>Move along citizen or "you'll be in BIG trouble!"
Just because a cop orders you to do something, does not mean you have to comply:
"Open your trunk!"
No.
"Let us in your house!"
No.
"Stop camcording me!"
No.
"Let me search your bags and stick my hand on your breast!"
No.
Learn to say no to unconstitutional orders from the jackbooted officers. And if the cops lose control and beat you, well you just won a multi-million dollar lottery. Celebrate.
Re: (Score:2)
OK. You can record me if I can record you. (Score:5, Insightful)
Re:OK. You can record me if I can record you. (Score:5, Insightful)
See, you don't understand the rules right now. In the post-9/11 world, you have to remember that any attempt by the government to record you is justified until the crisis is over because it is needed to defend your freedom, and any attempt of you to record the government is serious espionage that will result in being locked up for months in solitary confinement without trial [wikipedia.org] until you turn on somebody else that the government wants to prosecute but doesn't have any evidence on.
Now, please show us your papers.
Re:OK. You can record me if I can record you. (Score:5, Informative)
publicly traded companies? (Score:5, Insightful)
Despite the misnomer, publicly traded companies are still private entities owned by individuals (or groups of individuals). What the heck gives you the right to see ANYTHING they are doing, aside from normal regulatory compliance?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Their corporate charter that requires their existence to be in the public interest. Note that most of the owners will end up better informed than they are now as well.
Note that the OP also offers that NOBODY be tracked in that way as an alternative.
Re: (Score:2)
"What the heck gives you the right to see ANYTHING they are doing"
Straight from the 'smells faintly of fascism' big business apologist jerk handbook..
When corporations influence over me becomes equal to my influence over them.. then I will no longer need such a right... Until then, while they lord it over us in a manner indistinguishable from a government, I will treat them with equal distrust as a government.
Re: (Score:2)
Oh, but law enforcement is above the law, of course. You ever seen a cop get pulled over for speeding?
Re: (Score:2)
Oh, but law enforcement is above the law, of course. You ever seen a cop get pulled over for speeding?
Right. So public vehicles must have GPS trackers with code analyzing abuses such as speed, slacking off, use for private purposes, etc. The public has a right to it.
Yes, let's collect evidence of crime at all levels (Score:2, Insightful)
Re: (Score:2)
Only if you want DC-area bathrooms to be flooded with, er, wide-stanced Republican congressmen.
Re: (Score:2)
Only if you want DC-area bathrooms to be flooded with, er, wide-stanced Republican congressmen.
I'm no fan of Bush's criminal party, but neither party has a monopoly on wrongdoing or is composed of 100% clean-record public officials. Investigate everyone and let the chips fall where they may.
envelopes (Score:4, Interesting)
,quote> Think about how much evidence is denied to law enforcement by envelopes, opaque concrete, and criminals' failure to shout.
I remember reading (several years ago) about a chemical that can supposedly make paper temporarily transparent .Also, seems to me that graphite and even pen ink might show up on an MRI scan. As for concrete, a portable neutron scanner should be useful to get some idea of what is inside. (No idea if such a scanner would be affordable to any but the very most important cases any time soon.)
Re: (Score:2)
Re: (Score:2)
X-rays won't, but there are other scans that might work on modern ink.
Monitoring capability is here. It will be used. (Score:2)
The good old "child porn" excuse (Score:5, Insightful)
especially online child pornography
There are 3 targets for every government intrusion on civil liberties:
1. Terrorists
2. Child porn
3. Drugs
The law enforcement agencies have determined that those are the issues that can be used to push absolutely anything through. For instance, trying to catch terrorists allows them to grope everybody with absolutely no suspicion of wrongdoing. Drugs allow them to break down your door at 2 AM, guns drawn, without identifying themselves as the government, and in some cases killing people. And of course child porn and terrorism allows them to watch absolutely everything you do online. That these are plainly illegal doesn't matter, because anybody who disagrees with them must be a terrorist, child pornographer, or junkie.
That doesn't mean those threats don't exist, but if they were serious about addressing the real risks around us they'd be focused on more mundane issues like traffic violations.
Re:The good old "child porn" excuse (Score:4, Insightful)
Re: (Score:3)
I work in the hosting business and can tell you flat out they only care about the low hanging fruit. If they were commercial and took CC payments in any way they were all over it as it was straight forward we hand them the evidence from the site (site contents logs etc) they got the info on everybody that paid them and arrested them all. I do not think they ever got the site owners they generally came in from countries (or were proxied in) that were not to friendly to the US. Ok fine and dandy they got t
Re:The good old "child porn" excuse (Score:4, Interesting)
Re: (Score:3)
You forgot drunk driving. [drunkdrivingdefense.com]
Child Pornography (Score:2)
adding that data retention is crucial to fighting Internet crimes (PDF), especially online child pornography.
Sorry, but what is this obsession with child pornography? I don't care that someone is looking at it. Sure I care that someone took the pictures / did whatever, but so what if people are looking at it. You can call them sick or whatever you want, but there is a huge difference between some perverse fantasy and acting on it. Have you been arrested for the random dream of killing your boss? I don't think so.
On this subject, is there anything else that is illegal to simply have possession of that can abso
Re:Child Pornography (Score:5, Informative)
Re: (Score:2)
The theory is that the production of child pornography fundamentally requires a child to have been abused. Thus by possessing such an image you are complicit in that abuse and create incentives to do so. I'm not convinced that it would be a sound theory in reality even if it weren't for the fact that the same laws criminalize non-abuse involved images produced by artists without the use of a model and fictional stories that include child sexuality. Overall the entire mass of 'child porn' laws are predica
Fixed IP(v6) addresses and end-to-end encryption (Score:3)
Re: (Score:2)
Re: (Score:2)
For now that is. If people start getting arrested left and right for stuff they did on their ISP, or their school suspends/expels them for activities done at home, people will start caring and start locking their business down.
I think it is only a matter of time before we start seeing some extremely large anonymous VPN services appearing, and an anonymous service provider will be as needed as an ISP.
Re: (Score:2)
This could be a drinking game (Score:2)
So, I'm curious... (Score:2)
Next, record all phone calls. (Score:2)
Stop "Cooperating" With Law Enforcement (Score:4, Insightful)
Provide the information they seek ONLY when they provide a valid warrant. ISPs should not "informally" cooperate with law enforcement. If there is reasonable suspicion of a crime, the law enforcement agency should be able to convince a judge of that and obtain a warrant. Checks and balances.
Re:Stop "Cooperating" With Law Enforcement (Score:4, Interesting)
Remember how well this worked with the telcos? When the constitutionality of law enforcement's extra-judicial National Security Letter (NSL) program was called intto question and they (the telcos) were at risk of lawsuits for having turned over data, they went crying to Congress for amnesty. And they got it. So why shouldn't they cooperate? Their down side (pissing off dirty cops) is too great.
The NSL program continues to this day unabated. And some of these letters and the subsequent data collection isn't in support of criminal investigations. Its for political or even industrial espionage. Want some info on a competitor (particularly if its foreign)? Got a buddy in the FBI? No problem. They'll tap their phone/-email for you.
I say: All subjects (at least US persons) subject to monitoring shall be served with the warrant or NSL at some reasonable time following the investigation. And no amnesty for ISPs or telcos unless they can be forced to testify against corrupt law enforcement officials in court should those letters be abused by corrupt LE officials.
I have said it before and I will say it again... (Score:3)
Even if it was Osama Bin Laden brutally raping and murdering little kids and posting footage of same on YouTube it doesn't justify giving the government ANY right whatsoever to do wholesale data collection of telephone calls, bank account data, retail purchases, library borrowings or (as in this case) internet data (emails, web access etc).
I have no problem whatsoever with the FBI/cops/etc going to an ISP and saying "we have x IP address at y time, please find out which customer that was and set up a tap/trace on that customer so we can bust the guy" but wholesale data gathering is something I will NEVER support.
What we need is for someone to come up with something that shows why continued erosion of civil liberties is bad and wont do a thing to stop criminals (including Child Pornographers) or terrorists (including Osama Bin Laden). Something that even the most clueless person can understand.
If you can show people that what their government wants to do wont actually stop whatever criminal activity people want the government to stop (and more to the point, suggest an alternative that will be more effective in stopping the criminal activity in question) people might just listen.
Re: (Score:3)
All they ask for in this statement is exactly what you said you have no problem with: a reverse mapping of (IP address, time) to customer and customer information (e.g., address).
The problem, they claim, is that ISPs only store this data for short periods of time, which is insufficient. They specifically mention that they are not requesting that ISPs start storing data that they do not already store.
Re: (Score:2)
If you can show people that what their government wants to do wont actually stop whatever criminal activity people want the government to stop (and more to the point, suggest an alternative that will be more effective in stopping the criminal activity in question) people might just listen.
Your assumption is wrong: The Onion Router provides the proof you seek. [torproject.org]
You see, no matter how blatant, commonplace or accessible the proof is people just won't listen; People are stupid -- It's the Wizard's First Rule: Some people will believe anything if they fear it to be true.
Re: (Score:3)
If you can show people that what their government wants to do wont actually stop whatever criminal activity people want the government to stop (and more to the point, suggest an alternative that will be more effective in stopping the criminal activity in question) people might just listen.
I admire your optimism, but my experience suggests otherwise. When you bring someone face-to-face with an unpleasant truth, the tendency is to pull a Miracle Max (you know, fingers in their ears while loudly repeating, "nobody's hearing nothing, la la la la"). Why? Because people are generally lazy, and forcing the government to change requires effort. Typically, people are unwilling to expend that effort until things get so bad that they can no longer pretend not to see what's happening arou
Wow .... (Score:5, Insightful)
So, we should monitor everybody so that if in the future we need to monitor a specific person, we'll already have the data. Brilliant!
Welcome to the surveillance society. Wouldn't this run afoul of the whole "unreasonable search and seizure"? Hell, keep everybody's web history long enough and you'll likely find something you could use against them.
I completely disagree that ISPs should just track everything in case law-enforcement wants it at some point. It's a little Orwellian, and I fear that it is only going to get worse -- in their zeal, governments are really going overboard. This is just depressing.
Re: (Score:3)
All they're asking for is for ISPs to retain DHCP logs longer.
Re:Wow .... (Score:4, Insightful)
For now. But this snippet from the linked PDF is kind of scary:
Basically, "we find it inconvenient that by law we're only allowed to ask for specific information based on an on-going investigation, we would like some blanket powers so we don't need to bother with this".
Hell, in my book, anybody who is quoting Alberto Gonzales is not to be trusted ... Gonzales routinely made awful decisions like "it's legal because we say so" and "who needs habeus corpus?". From the PDF again ... "Former Attorney General Gonzales similarly testified about “investigations where the evidence is no longer available because there's no requirement to retain the data.”"
Looking at this section:
they're pulling out pretty much all of the bogey-men to say "we need to be able to monitor everything just in case". They cite child abuse, drugs, terrorism ... harassing calls. While these are legitimate law enforcement targets, it's definitely stating the case that they'd really like to be able to monitor everything.
Hell, even the wording they use is charged "Most responsible providers are already collecting the data that is most relevant to criminal and national security-related investigations." ... meaning those who aren't actively helping the government monitor everything are irresponsible and therefore evil.
This just sets them up for way too many fishing trips as far as I'm concerned. You can't just simply apply surveillance and monitoring against an entire society "just in case". This is just plain bad, and it's more like something Iran or Stalinist Russia would do.
Time Warner (Score:5, Interesting)
If any expansion of power is needed it should be the ability to have a request to hold data while a subpoena is processed. That is a simple answer, but the government isn't interested in simple answers its intent is to chip away at privacy so it can do whatever it wants whenever it wants.
How about law enforcement prioritization? (Score:5, Insightful)
My sense is that the "need" for ISPs to do their work for them indicates that law enforcement could better utilize their limited resources.
Maybe spend fewer resources on enforcing, say, drug laws, marijuana specifically, and more time and resources on other crimes that actually hurt people?
And I don't necessarily mean physical crimes (assault, murder) -- how about simple burglary or breaking and entering?
A neighbor's house got broken into; the daughter's laptop was stolen and the window to her room was damaged beyond repair. She needed a laptop for school and, obviously, the window needed replacement. So they're out $3k they don't necessarily have and/or she falls behind in school or they can't close the window to her room, none of which are very palatable choices, especially in a Minnesota winter.
Yet, when they called the cops they got two nice guys who gave them a case number and took the laptop S/N "on the very slim chance it turns up."
So, basically there's no resources to do extra patrols or extra investigators but plenty of guys to take down pot dealers. Yay.
Re: (Score:2)
No sheriff or police cheif is going to get serious publicity going after burglars and scam artists. If you want to win Chuck Norris style accolades then you have to bust the drug dealers, and most people associate the dealers with organized crime and street violence. People from affluent neighborhoods have good security systems and insurance policies, so if they are a victim of theft it's just a minor inconvenience, but they will do everything to protect little Johnny from the drug dealers.
Re: (Score:2)
Balance (Score:2)
Just as long as politicians are exempt.
And Just how are they Identifying my traffic? (Score:2)
Who qualifies as an ISP? (Score:2)
One of my clients is a coffee shop that offers 3 hours of wifi with purchase. I built the software that allows people to log in using their rewards card or by typing their name and an employee granting access. It's been working well for over 5 years on a FBSD box.
The question then becomes, do they count as an ISP? Will they have to maintain records and if so, for a small business like theirs is it going to be worth the hassle?
Mandatory data retention for bars and restaurants (Score:4, Insightful)
We need mandatory data retention for bars and restaurants. Bars and restaurants should be required to retain audio and video surveillance data for six months, in case it's needed by law enforcement.
Implementation should begin with Washington, D.C., to retain evidence of political corruption.
Re: (Score:2)
man, i've seen people say "1984 is not a manual" in their sigs, you yanks* must have read that and thought "Fine, we'll use mein kampf instead"
*the govern-mental types anyway
But good god, that is fucking scary right there...
Re: (Score:2)
Re: (Score:2)
Which behaves just like BushCheney's "justice" department, which acted just like Clinton's "Justice" department, which acted just like Bush40's "Justice" Department, which acted just like....
The DOJ stopped 'belonging' to a president long, long ago.