It's Time To Update Our Privacy Laws: Tell Your Elected Officials To Reform ECPA Now

from the about-time dept

We've written a few times about the urgent need to reform ECPA -- the Electronic Communications Privacy Act, which is woefully outdated, having passed in 1986. Of course, every time there's an attempt to reform it, it seems to fail, often because folks in law enforcement like the outdated law that lets them easily spy on others without a warrant. The latest attempt at ECPA reform is a mostly good proposal from Senator Leahy that (as expected) has law enforcement types livid. The crux of the reform is that law enforcement would need to get a warrant for most situations if they wanted to peer into your electronic lives. That seems entirely consistent with that quaint concept sometimes referred to as the Fourth Amendment.

Last week there was some buzz about a possible manager's amendment from Leahy that would open the door to various federal agencies being able to issue subpoenas without having to get warrants, but Leahy has since insisted that he will introduce no such amendment. Whether it was because of the outcry about it, or if it was never really intended, is a point of some debate. But, either way, the outcry did make some impact -- though not enough. There are still rumors of similar privacy destroying amendments from other Senators at the markup, which is slated for this upcoming Thursday.

In particular, it is expected that Senator Chuck Grassley is planning to sell out the 4th Amendment by offering an amendment even worse than the one discussed last week. It would take away the requirement for a warrant for many more federal agencies. Apparently, Senator Grassley thinks that the whole requirement of warrants based on probable cause before searches can take place is a recommendation, rather than the law of the land.

Given that, a bunch of groups and organizations have teamed up to set up VanishingRights.com, a site asking people to contact your Senator today, especially if they're on the Senate Judiciary Committee (list, with phone numbers, is on the website), to let them know that (a) you support ECPA reform that requires a warrant and (b) you oppose any amendment, such as Senator Grassley's that would take away that warrant requirement. The website has tools for emailing, but also phone numbers and a possible script for calling. If you can, I highly recommend that you call rather than email, as it has a much stronger impact.

If you believe that privacy matters, and that your electronic documents deserve the basic privacy that a warrant provides, rather than just letting law enforcement sniff through your emails freely, now is the time to speak up.

Filed Under: 4th amendment, chuck grassley, ecpa, ecpa reform, pat leahy, privacy

LinkedIn Passwords Leaked... Congress Immediately Wants To 'Do Something!'

from the grandstanding... dept

As you hopefully have heard already, a ton of Linkedin passwords were leaked online. They were leaked in encrypted forms -- and without associated usernames -- leading some to suggest there was no real threat for users, unless someone also had the full list of usernames as well. However, that doesn't seem quite accurate. Since the passwords were hashed but not salted, it's made it relatively easy for the passwords to be decrypted. Yes, the usernames haven't been released, but some are suggesting that whoever leaked the data probably only released this subset, because they had already decrypted a bunch of easier passwords (and probably had the usernames) and just needed "the crowd" to help decrypt the rest.

Linkedin took its time, but did admit that there was a breach, and reset those passwords. However, Congress is never one to miss an opportunity to grandstand. Rep. Mary Bono Mack was quick to jump up and announce that something must be done!

"How many times is this going to happen before Congress finally wakes up and takes action?" said Rep. Mary Bono Mack, R-Palm Springs, who heads a House Energy and Commerce subcommittee that has looked at online-privacy issues, in a statement. "This latest incident once again brings into sharp focus the need to pass data protection legislation."

Similarly, Senator Pat Leahy jumped in with a similar statement:

"Reports of another major data breach should give pause to American consumers who, now more than ever, share sensitive personal information in their online transactions and networking," Leahy said in a statement provided to The Hill. "Congress should make comprehensive data privacy and cybercrime legislation a top priority.”

First of all, it does appear that LinkedIn wasn't using particularly smart security techniques (no salting? really?). But would a law really change things? And Leahy's claim that we need "cybercrime" legislation, again doesn't seem likely to help "fix" anything. If anything, the "cybersecurity" legislation that's out there might make such data even more vulnerable, by making companies more encouraged to share information.

Yes, these kinds of data breaches are bad. And we should be concerned when we find out that a company as big as LinkedIn still uses such weak security practices. But does that really mean we need a law?

Filed Under: congress, data breach, mary bono mack, passwords, pat leahy, security
Companies: linkedin

Don't Be Fooled: Leahy Is NOT Removing DNS Blocking Provisions, Merely Delaying Them

from the bad-reporting dept

We've already written about Senator Leahy's decision to delay the implementation of DNS blocking in PIPA. Unfortunately, despite the clear words in the announcement, it appears that Leahy's staff is going around suggesting to the press that this means he's dropping DNS. Thus you get reports in Wired and in ReadWriteWeb saying that Leahy is offering to remove the DNS blocking provisions. That's exactly what Leahy's staff would like people to believe, in the hopes that this makes the bill palatable. First, it wouldn't actually make the bill palatable, but it's important to read what Leahy actually said:

As I prepare a managers' amendment to be considered during the floor debate, I will therefore propose that the positive and negative effects of this provision be studied before implemented...

That is NOT removing the DNS blocking provisions. It is merely delaying them.

Furthermore, since the DNS blocking was such a key component of the bill and, at the very last minute, Leahy is suddenly claiming that we can all ignore that section for the time being, isn't that reason enough to stop and wait, rather than rushing this bill forward? Leahy is admitting that he did not and still does not understand a key provision in his bill. Do we really think that's the only provision he did not understand? Shouldn't this, alone, be evidence that this bill needs to be rethought entirely? This isn't a reason to move forward. It's the opposite. It's a reason to put this bill aside and spend some time actually understanding the issues at play.

Filed Under: dns, dns blocking, dnssec, pat leahy, pipa, protect ip, sopa