That Was Fast: Leahy Drops Warrantless E-mail Surveillance Bill

Presto Vivace writes "Under the right conditions, online activism can be very effective. U.S. Senator Patrick Leahy has already abandoned his warrantless e-mail surveillance bill we discussed this morning. 'The Vermont Democrat said today on Twitter that he would "not support such an exception" for warrantless access. ... A vote on the proposal in the Senate Judiciary committee, which Leahy chairs, is scheduled for next Thursday. The amendments were due to be glued onto a substitute (PDF) to H.R. 2471, which the House of Representatives already has approved. Leahy's about-face comes in response to a deluge of criticism today, including the ACLU saying that warrants should be required, and the conservative group FreedomWorks launching a petition to Congress -- with over 2,300 messages sent so far -- titled: "Tell Congress: Stay Out of My Email!""

Two sides to every story

[BinarySolo]

According to this [thehill.com], Leahy claims CNET was incorrect in its original article and that he never supported the warrantless wiretapping. When he tried to clarify this stance, CNET comes out with this article saying that he backtracked because of the backlash caused by their article. Not going to make the judgment call on which side is right, but it should at least be noted that there are two sides to the story.

Re:We could have fixed this, but didn't

[Obfuscant]

The issue could have been addressed by fiat from any one popular software package.

Thus solving it for users of one package.

2) Add a field to the protocol

Which protocol? SMTP? POP? IMAP? UUCP?

The protocol allows for experimental fields

Same question.

The mouseover for the button

Oh, this would solve the problem only for the people with GUI mail clients.

could have said "use encryption if the recipient has a compatible client".

Sorry. How does my email client know what email client YOU are using and whether it supports this? Is there a new protocol you are proposing where one client asks another prior to sending an email? What happens if the recipient is offline?

But for some reason we didn't do that,

Mainly because it is an intractable problem, much more difficult than simply having one GUI email client start doing it. Here's one big problem: how do I read those encrypted emails sitting in my mailbox when I'm not using the specific GUI email client that deals with them, or I don't happen to have the key and can't get it because I'm not online at the moment?

(I've often wondered if the browser could automatically encrypt/decrypt the content of specific named text blocks from specific sites such as gmail. Then the content could be encrypted online, but show cleartext to the user.)

If you are limiting yourself to defining "email" as "gmail accessed via a web browser", you simplify the problem considerably. Of course Google could store all your email in an encrypted form and send you a javascript (if you have a js enabled/capable broswer) applet that decodes it on your system. If you send them your public key, they could even encrypt the stuff they store on their disks as it came in for you, if it wasn't already. You still have the problem of how you make sure every system you use to access that email has the key kept locally, and what happens for people who have gmail forwarded to some place else.

So, yes, the problem is rather trivial if you force everyone and everything through one mail server and ignore the huge diversity in protocols used to transport email and the kinds and types of clients/servers used to do it.