DailyDirt: Keeping Information For A Really, Really, Really Long Time

from the urls-we-dig-up dept

The problem of storing digital data usually involves transferring data from an older format to a newer one -- with the hopes that the newer one won't be replaced as quickly as the older format it just replaced. Maybe some archivists out there like to go through this periodic technology shift and verify that the data we've stored is still readable, but wouldn't it be nice if there was a "store it and forget it" format?

• A single gram of DNA can store up to 455 exabytes of data, and roughly four grams of DNA could store all of the world's collected information. It's not cheap to store arbitrary data on DNA yet, but the costs are coming down. [url]
• Stored data on DNA encased in glass at freezing temperatures could survive for a couple million years. The DNA of a woolly mammoth in Siberia was preserved for 40,000 in a tundra, so it's not unthinkable that we might want to keep a few backups of our data on ice. [url]
• Making large DNA crystals with precisely-controlled structures is something that can be done with a "DNA-brick self-assembly" method. Being able to do this could help fabricate all kinds of nanoscale designs and create a manufacturing process for complex, artificial DNA structures. [url]

If you'd like to read more awesome and interesting stuff, check out this unrelated (but not entirely random!) Techdirt post via StumbleUpon.

Filed Under: archive, backup, data, dna, nanotechnology, self-assembly, storage

Cars Are Delivering Tons Of Driving Data To Manufacturers With Minimal Security And Even Less Transparency

from the introducing-the-2015-Lexus-CI dept

Nothing's driving the acquisition of data faster than, well, driving. As new technology makes its way into vehicles, so does the apparent desire to harvest information about the vehicle itself. Between the outside harvesting (automatic plate readers that gather plate/location data, as well as photos of vehicle occupants) and the "inside" transmissions, there's very little any number of unknown entities won't know about a person's driving habits. And that's not even including what's transmitted and collected by drivers' omnipresent smartphones and their installed apps.

Sen. Edward Markey has expressed some alarm at the amount of data being collected (and distributed) by vehicle manufacturers. His office has produced a report [pdf link] showing that while many manufacturers are involved in collecting data, very few of them seem concerned about the attendant risks. Even worse, many respondents to his office's questionnaire seem to show very little understanding of the underlying technology and most have not made an effort to fully inform customers as to how much is being collected or how it's being distributed.

Drivers of today's connected cars aren't going to like the report's findings.

Nearly 100% of cars on the market include wireless technologies that could pose vulnerabilities to hacking or privacy intrusions.

While some basic security measures have been implemented, the fact remains that transmitting data always poses a risk. Three of the 14 manufacturers that responded to Markey's questions had actually let their security measures stagnate or decrease from 2013 to 2014, even as the amount of data transmitted rose. Worse, many of the respondents deployed security measures in a "haphazard and inconsistent" fashion, and nearly all respondents seemed unable to fully process the questions posed by Markey's office.

Of the 16 automobile manufacturers that responded to the letter, 13 of them addressed these questions in some way. Chrysler, Mercedes-Benz, and Mazda did not respond to the question at all, and five other manufacturers provided general responses that addressed the question as a whole instead of providing specific responses to the questions’ sub-parts.

[...]

Seven of the manufacturers stated that they use third-party testing to verify their security measures, while 5 stated that they do not and 4 did not respond to this part of the question.

[...]

The manufacturers were also asked about how they secure this type of software delivery [updates/patches]. Each manufacturer responded with descriptions of how they provide such software through authorized dealers with the appropriate tools. Automobile security experts consulted by Senator Markey’s staff said that all of the responses are similar in that they presume a malicious actor could not access or acquire the technologies that mechanics have. They state that software updates for systems should be cryptographically verified by the ECU being updated in order to effectively prevent intrusions.

These four-wheeled tracking devices are collecting and transmitting tons of data, including GPS location, sudden accelerations/decelerations, seatbelt usage, destinations entered into navigation systems, last location parked, distance and time traveled and a variety of information on other driving components. Almost all of this is transmitted back to the manufacturer for their own use.

Nearly 100% of 2014 vehicles record and transmit driving history. Most of these manufacturers could not provide a satisfactory answer as to how they secure this data during transmission and more than half store this information "off-board" at their own data centers. Manufacturers seem to consider "on-board" collections as inherently secure.

In the case of on-board storage, no manufacturer described any security system to protect that data, and several of them noted that no security measure is needed since accessing data would require a hardwire connection.

But that doesn't mean they treat wireless transmissions with much more care.

Regarding security measures to protect data that is wirelessly transmitted outside the vehicle, only 6 responses were received. Of those, 5 provided vague responses naming encryption, passwords, or general IT security practices, and only 1 specifically mentioned that they designed their systems to limit the transfer of personally identifiable information.

Part of this is due to the fact that automakers' security measures are purely voluntariy at this point. But the fact that it would likely take a federal mandate to improve security is disappointing. Not only are manufacturers less than forthcoming about how much data they're collecting, but they're apparently uninterested in providing a minimal level of customer service, i.e., proactively assuring these data transmissions are secure.

As for the data harvesting itself, manufacturers can't seem to find a better justification for this than "improving the customer experience" -- a phrase pretty much synonymous with "selling customers more stuff" or "collecting for collecting's sake." Most manufacturers retain this data for one to ten years, with only one manufacturer offering the option for users to delete their data at any time. But that single nod to customer agency is far outweighed by the general indifference shown by the rest.

Markey's report finds that purchasers may be allowed to "opt out" of certain collections, but this often comes at the expense of certain functions. No manufacturer presents this information up front, preferring to hide it in owner's manuals and terms of service agreements. The default should be "opt-in," with upfront explanations of what, how and why data is collected. But that would lead to a dearth of information, and automakers, like many other private companies, prefer to gather data first and deal with the fallout later.

Although it goes unmentioned in Markey's report, there's also the question of how this data is handled when the government comes looking for it. Most of what's collected would presumably fall under the Third Party Doctrine (with drivers "knowingly" turning this information over because of page 173 in the owner's manual, etc.), which means it can be acquired by law enforcement/intelligence agencies with minimal effort/paperwork. There are also other government intrusions that need to be considered as well, like California's desire to tie state-enforced emission standards to driving information already gathered by a number of manufacturers. Not only are manufacturers not guarding against having their collections hijacked by criminals, they seem equally unconcerned about safeguarding this vast amount of data from the government itself.

Filed Under: cars, data, privacy, smart cars, transparency

Yet Another Report Showing 'Anonymous' Data Not At All Anonymous

from the what-privacy dept

As companies expand the amount of data hoovered up via their subscribers, a common refrain to try and ease public worry is that consumers shouldn't worry because this data is "anonymized." However, time and time again studies have highlighted how it's not particularly difficult to tie these data sets to consumer identities -- usually with only the use of a few additional contextual clues. It doesn't really matter whether we're talking about cellular location data, GPS data, taxi data or NSA metadata, the basic fact is these anonymous data sets aren't really anonymous.

The latest in a long stream of such studies comes from MIT, where researchers explored (the actual study is paywalled) whether they could glean unique identities from "anonymous" user data using a handful of contextual clues. Studying the purportedly anonymous credit card transactions of 1.1 million users at 10,000 retail locations over a period of three months, the researchers found they could identify 90% of the users' names by using four additional data points like the dates and locations of four purchases. Using three clues, including more specific points like the exact price of a purchase, allowed the identifying of 94% of the consumers. Intentionally trying to make the data points less precise didn't help protect consumer privacy much:

"The MIT researchers also looked at whether they could preserve anonymity in large data sets by intentionally making the data less precise, in order to examine whether preserving privacy would still enable useful analysis. But the researchers found that even if the data set was characterised as each purchase having taken place in the span of a week at one of the 150 stores in the same general area, four purchases would still be enough to identify more than 70 percent of users."

Note they're not saying they can ascertain your personal identity from this data alone, but they (or a hacker that nabs this data) can identify you if they have just a smattering of other contextual clues as to who you are. In an age when cellular companies track and sell your daily location down to the minute, and your automobile, insurance companies and toll payment systems are all gathering even more precise data, that's not going to be a particularly difficult task. The gist of the study isn't going to be a shock to most of you: privacy in the modern age -- unless you're willing to go to extreme lengths -- is an illusion.

"We are showing that the privacy we are told that we have isn't real," study co-author Alex "Sandy" Pentland of MIT said in an email...The study shows that when we think we have privacy when our data is collected, it's really just an "illusion", said Eugene Spafford, director of Purdue University's Centre for Education and Research in Information Assurance and Security. Spafford, who wasn't part of the study, said it makes "one wonder what our expectation of privacy should be anymore."

That said, it's very important to remember that we can probably trust that companies rushing head first toward vast new revenue generation opportunities are spending the time and resources necessary to ensure consumer privacy is at the very top of their list of priorities.

Filed Under: anonymous, anonymous data, data

German Data Protection Commissioners Take Action Against EU Data Transfers To US Under 'Safe Harbor' Program

from the more-confrontational dept

We pointed out last year that one of the knock-on effects of Edward Snowden's revelations about massive NSA (and GCHQ) spying on Europeans was a call to suspend the economically-critical Safe Harbor program. Without Safe Harbor, it would be illegal under European law for companies like Google and Facebook to take EU citizens' personal data outside the EU, which would make it more difficult to run those services in their present form. Nothing much happened after that call by the European Parliament's Civil Liberties, Justice and Home Affairs (LIBE) committee -- not least because it does not have any direct power to formulate EU policy -- but the unhappiness with Safe Harbor has evidently not gone away.

Heise Online reports that two of Germany's data protection commissioners -- those for the cities of Berlin and Bremen -- have started proceedings against the transfer of data to the US under the Safe Harbor agreement (original in German.) This seems to represent a hardening of their position. The Heise article quotes another data protection commissioner, this time for the city of Hamburg, as saying that the mood among his colleagues was more confrontational now. Similarly, the commissioner for Berlin commented:

"In my view, Safe Harbor is dead if essential improvements aren't found."

Whether the US authorities will be willing to make of those improvements, or whether they might just hope the European public's dependence on Google and Facebook will prevent drastic action being taken by the EU, remains unclear. Complicating matters still further is a separate argument about whether data flows should be included in the various trade negotiations involving the US and the European Union. The latest move by German data protection commissioners is unlikely to make resolving these issues any easier.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data, data privacy, data protection, eu, fragmentation, german, localization, safe harbor, us

New TISA Leak: US On Collision Course With EU Over Global Data Flows

from the would-be-fun-to-watch-if-only-it-weren't-secret dept

Although most attention has been given to the Trans-Pacific Partnership agreement (TPP) and the Trans-Atlantic Free Trade Agreement (TAFTA), also known as TTIP, it's important to remember that a third set of global trade negotiations are underway -- those for the Trade in Services Agreement (TISA), which involves more countries than either of the other two. Like TPP and TAFTA/TTIP, TISA is being negotiated in strict secrecy, but earlier this year the financial services annex leaked, giving us the first glimpse of the kind of bad ideas that were being worked on. Now, another leak has surfaced, which reveals the US's proposals to free up data flows online.

For the European Union, that's a hugely sensitive issue. Under data protection laws there, personal data cannot be sent outside the EU unless companies sign up to the self-certification scheme known as the Safe Harbor framework. However, in the wake of Snowden's revelations about NSA spying in Europe, the European Parliament has called for the Safe Harbor scheme to be suspended. If that happens, the only way that US Internet companies could comply with the EU Data Protection Directive would be to hold personal information about EU citizens on servers physically located in Europe. But it is precisely that kind of requirement the leaked TISA position seeks to forbid:

Article X.2: Local Content

l. Subject to any conditions, limitations and qualifications set out in its Schedule, no Party may, in connection with the supply of a service by a service supplier, impose or enforce any requirement; enforce any commitment or undertaking; or, in connection with the supply of a service through commercial presence, condition the receipt or continued receipt of an advantage on compliance with any requirement:

(a) to purchase, use or accord a preference to:

...

(iii) computing facilities located in its territory or computer processing or storage services supplied from within its territory;

Another section would stop countries from imposing any restrictions on data flows:

Article X.4: Movement of Information

No Party may prevent a service supplier of another Party from transferring, accessing, processing or storing information, including personal information, within or outside the Party's territory, where such activity is carried out in connection with the conduct of the service supplier's business.

It comes as no surprise that the US is pushing for the unhindered cross-border flow of all data, including personal data: it's what both the USTR and US companies have been demanding for a while. But it's going to be hard to get the European Union to agree to such a direct attack on its privacy framework. The European Commission has publicly stated that TISA will not undermine the EU's data protection laws. Moreover, just a few hours after the TISA leak was published, the EU politician with responsibility for TISA in the European Parliament, Viviane Reding, tweeted as follows:

As @EP_Trade Rapporteur on #TiSA, I'll oppose any provision undermining right to data privacy: competition by the rules, not for the rules!

With such entrenched positions on both sides, it's hard to see how any kind of compromise will be possible. The imminent battle between the US and the EU on this key issue in TISA will doubtless be fun to watch; what a pity it will happen in secret, behind closed doors.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data, data protection, data storage, eu, local content, privacy, safe harbors, tisa

Google Helps To Use Big Data For Global Surveillance -- And That's Good

from the fishy-business dept

Techdirt writes plenty about the dangers of surveillance, and how big data is not the solution to everything, despite what PR companies would have us believe. Putting the two together is usually a recipe for very bad things, but not always. Global Fishing Watch, a new project involving Google, the environmental mapping group SkyTruth, and the conservation organization Oceana, shows how they can be used responsibly to tackle serious global problems that were hitherto intractable:

Global Fishing Watch is the product of a technology partnership between SkyTruth, Oceana, and Google that is designed to show all of the trackable fishing activity in the ocean. This interactive web tool -- currently in prototype stage -- is being built to enable anyone to visualize the global fishing fleet in space and time. Global Fishing Watch will reveal the intensity of fishing effort around the world, one of the stressors contributing to the precipitous decline of our fisheries.

The system works by analyzing data from the Automatic Identification System (AIS) network, which broadcasts a ship's location. Although AIS was primarily designed as a safety mechanism to avoid collisions at sea, information about the vessel's behavior can be derived by analyzing AIS data for the identity, speed and direction of broadcasting vessels. Global Fishing Watch uses that analysis to remove all the cargo ships and other non-fishing vessel activity. A lot of data is involved:

Global Fishing Watch started with 3.7 billion data points, more than a terabyte of data from two years of satellite collection, covering the movements of 111,374 vessels during 2012 and 2013. We ran a behavioral classification model that we developed across this data set to identify when and where fishing behavior occurred. The prototype visualization contains 300 million AIS data points covering over 25,000 unique vessels. For the initial fishing activity map, the data is limited to 35 million detections from 3,125 vessels that we were able to independently verify were fishing vessels. Global Fishing Watch then displays fishing effort in terms of the number of hours each vessel spent engaged in fishing behavior, and puts it all on a map that anyone with a web browser will be able to explore.

That openness is a crucial aspect of the project:

Global Fishing Watch will be available to the public, enabling anyone with an internet connection to monitor when and where commercial fishing is happening around the globe. Citizens can use the tool to see for themselves whether their fisheries are being effectively managed. Seafood suppliers can keep tabs on the boats they buy fish from. Media and the public can act as watchdogs to improve the sustainable management of global fisheries. Fisherman can show that they are obeying the law and doing their part. Researchers will have access to a multi-year record of all trackable fishing activity.

That's pretty much a win for everyone. Nations gain better control over their territorial waters and the resources they contain. It will be easier for food suppliers, journalists and the public to track which ships are fishing legally and sustainably. That will make it easier to identify and penalize those that aren't -- and reward those that do. Better control of illegal fishing should mean that quotas are adhered to, allowing fishing to stocks to recover. Detailed record-keeping will improve the science behind those quotas, making them more realistic and thus sustainable in the long term. In other words, Global Fishing Watch is an example of surveillance and big data analysis that even fish can love.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: big data, data, fish, global fishing watch, surveillance
Companies: google, skytruth

DailyDirt: In The Long Run, We're All Dead

from the urls-we-dig-up dept

If you're looking for some good data to put into an infographic, it's not too hard to find statistics on death. Reliable stats of how people died go back quite a ways, too. Sure, it's a bit morbid, but most people don't think about dying until they're close to doing it. So if you're curious, check out a few of these visualizations on how we die.

• The leading causes of death have changed significantly since 1900, so the flu (or pneumonia) isn't killing off as many Americans as it used to. Instead, heart disease and cancer have replaced the flu/pneumonia and tuberculosis. [url]
• What are the odds? Dying of heart disease has relatively common 467:1 odds -- compared to dying from cycling (340,845:1) or an asteroid impact (74,817,414:1). [url]
• Another infographic on how the world died (in the 20th century) shows non-communicable diseases and infectious diseases are obviously really deadly, but so are wars and drugs. It could be difficult to change these stats. Medical technology could wipe out some diseases, but we haven't cured old age.... [url]
• Is it worth it to try to minimize your risks of dying? If you want to try, remember to focus on the activities that are actually high risk, not the spectacular deaths that don't kill that many people (eg. stepladders vs terrorism). [url]

If you'd like to read more awesome and interesting stuff, check out this unrelated (but not entirely random!) Techdirt post via StumbleUpon.

Filed Under: accidents, cancer, data, death, flu, health, heart disease, infographics, non-communicable diseases, pneumonia, risk, statistics, tuberculosis

Not Just Consumers Cutting The TV Cord: Small Cable Companies Dropping TV Also

from the internet-is-where-it's-at dept

For years now, we've been talking about TV watchers cutting the cord and preferring to go internet-only. There are a variety of reasons for this, such as the price of cable TV these days, which keeps rising at a rapid pace, and also the simple fact that the internet provides a much better value for many people. But it turns out it's not just the viewing pubic that is cutting the cord. A bunch of smaller/regional cable companies are dropping TV from their offerings as well -- and the reasons are similar: the cost to offer TV channels keeps going up and up, and focusing on just internet service is a better deal all around. In some cases, cable companies are simply dropping expensive channels, and in other cases, they're giving up on TV altogether. From the WSJ:

The latest is Suddenlink Communications, an operator that serves about one million customers, which says it plans to drop Viacom Inc.'s TV channels, including Nickelodeon and MTV, at midnight Tuesday. Suddenlink says it has already signed long-term contracts with other channels to fill the Viacom channels' slots.

[....]

After seven years of selling customers cable-TV services, BTC Broadband got out of that business late last year and now provides just broadband and phone services. The Oklahoma company, which had been serving about 420 TV subscribers, decided it simply couldn't afford to keep paying rising fees to carry a basic lineup of channels including ESPN, TNT and MTV.

The article notes that companies offering cable TV to about 5 million current customers probably will no longer be offering such video services, almost entirely due to cost. Those companies are finding that it's just a better deal for them to focus on offering internet services as well.

We've been arguing for years that the TV business is unsustainable, but the big media companies still see it as a last beacon of hope as other parts of their business have been chipped away. Because of that, they're increasingly relying on it (hence the rapidly increasing fees). But it's unsustainable, in large part because the internet undermines the whole thing.

While we don't hear it that much any more, a decade ago, the talk of the industry was the vaunted "triple play" offering: "voice, video and data." Some analysts would add in a fourth item of "wireless" to make a "grand slam" (mixing up their baseball metaphors). But as we've been saying for a decade, that was always misleading: "voice and video" are data. You don't need "voice, video and data." You just need "data." Wireless is just a way to deliver the data. But the internet enables all of those things. The greater access that can be offered at greater speeds, unencumbered, the less specialized services for "voice and video" matter. The traditional phone business is already on the way out. Video is next. These small players leaving the video business are just an early warning shot, just like the cord cutters.

It's all data.

But this is also why the net neutrality fight is so important -- and why the big players like Comcast (while pretending otherwise) are so desperate to control things and block true net neutrality. The longer the big old media companies can keep the highly inefficient system of cable TV alive, the more money it can squeeze out of it -- and there's a LOT of money being squeezed. It won't die any time soon, but it will die off. That's just the natural progression of things when you realize that it's all just data, and a pipe that is optimized just to "deliver data" is always going to win out in the end.

Filed Under: data, internet, net neutrality, tv
Companies: btc broadband, suddenlink communications

DailyDirt: Data Is Everywhere, Let's Use It

from the urls-we-dig-up dept

If you've been reading Techdirt for a while, you probably know that we're not big fans of this myth: "If you're not paying for the product, you are the product." Regardless of whether or not you pay for something, some companies will still treat their customers horribly. Likewise, there are also some corporations that try to treat customers (or users) with respect without expectation of payment for the favor. That said, it's easy to make mistakes that get mis-interpreted when it comes to analyzing consumer behavior. An unintentional email message to a targeted (or even un-targeted) group of customers can enrage a whole community. Consumer data is available to a lot of companies, but it might be wise for these companies to tread lightly with their data scientists. Here are just a few cases that data miners might want to check out.

• Facebook participated in some social experiments, but creating an "emotional contagion" resulted in some unwanted public attention. The actual ability for a social network to measure or effect various emotions is far from proven, but the potential to cause widespread distress through a social network is probably something users should be concerned about. [url]
• Shutterfly made a seemingly small mistake in mass-emailing a bunch of its customers a congratulatory message about an upcoming newborn. The photo printing service wasn't even using data mining techniques (eg Target) to try to figure out who might be pregnant, but in this data-driven world, folks are trained to expect that companies may be trying to pry into their personal lives. [url]
• Social psychology has had some problems with scientific fraud, and thankfully, there are some investigators who are developing methods to find fake or massaged data. It's hard enough to actually design psych experiments that have conclusive results, but sometimes the data can't lie. [url]
• OKCupid admits to experimenting on its users, too. The difference with dating sites is that the people using them seem to be tacitly agreeing to be experimented upon. [url]

If you'd like to read more awesome and interesting stuff, check out this unrelated (but not entirely random!) Techdirt post via StumbleUpon.

Filed Under: advertising, consumer behavior, data, data mining, emotional contagion, marketing, psychology, reputation, social experiments
Companies: facebook, okcupid, shutterfly, target

'Trusted Third Parties' Add One More Link In The Supply Chain Between Your Data And Government Requests

from the a-new-wave-of-data-brokers dept

Just how many entities have their hands on your data when the NSA makes requests? Well, it's not just the service providers and any number of analysts at the NSA. There's a whole industry subset of third parties that actually handle requests, implement wiretaps, direct searches for communications/data and deliver this information to the intelligence agency.

ZDNet's Zack Whittaker has the details.

With permission from their ISP customers, these third-parties discreetly wiretap their networks at the behest of law enforcement agencies, like the Federal Bureau of Investigation (FBI), and even intelligence agencies like the National Security Agency (NSA).

By implementing these government data requests with precision and accuracy, trusted third-parties — like Neustar, Subsentio, and Yaana — can turn reasonable profits for their services.

Little is known about these types of companies, which act as outsourced data brokers between small and major U.S. ISPs and phone companies, and the federal government. Under the 1994 law, the Communications Assistance for Law Enforcement Act (CALEA), any company considered a "communications provider" has to allow government agencies access when a valid court order is served. No matter how big or small, even companies whose legal and financial resources are limited do not escape federal wiretapping laws.

Subpoenas, search warrants, court orders -- even those from the FISA court -- run through these trusted third parties. From the information Whittaker has gathered, this market seems to have evolved out of limited legal resources retained by smaller ISPs and service providers. Incoming requests are forwarded to these companies, which vet them for legal issues and determine what exactly needs to be done to satisfy them. Some of this is just CYA -- an extra insulating layer to serve as a buffer between the service provider and the possibly aggrieved customer(s). Some of it is due to practicality. Smaller ISPs and service providers do not retain lawyers with the security clearance needed to inspect/challenge certain orders.

One of those attorneys, who declined to be named for the story because the person holds top-secret security clearance, explained that although hundreds of lawyers have the same clearance — including those serving terror suspects in Guantanamo Bay — very few have been in front of the FISA Court to defend their clients. These clearance-holding lawyers have been in high demand over the past year representing major Silicon Valley companies implicated in the NSA's surveillance programs.

For the majority of smaller companies (as well as larger ones, who have refused to comment on challenging such warrants), complying with data demands may be their only option. The vast majority, however, do not have the resources to handle such requests.

"If they don't have an internal lawyer [reviewing FISA warrants], they could use a third-party service. That third-party can't provide legal advice, but it can create a system for reviewing the data, pulling, and processing the data," the security clearance-holding attorney said.

Because these companies have the sort of clearance the ISPs lack, smaller ISPs are often nothing more than dumb terminals for government agencies to manipulate. The trusted third parties are often the only entities that see certain court orders and requests, and ISP participation in the approval and response processes is often non-existent. In many cases, the ISP cannot even see the court order it's being directed to comply with.

"Of what worth is our permission when we don't even know what we're being asked to give access to?" a senior staffer at [ISP] Cbeyond admitted.

In the unlikely event that a request is rejected, it's usually done by the third parties, again without the participation of the ISP itself. The trusted third parties are better equipped -- in terms of legal team security clearance -- to do this than smaller ISPs are, but that additional expertise is of little use should ISPs decide to directly challenge a court order.

If the ISP or phone company decides to fight a warrant, the third-party can stand back and wash its hands of it.

Burr said Neustar "has and will" reject subpoenas that are inadequate for one reason or another. But should its clients choose to fight a FISA warrant or court order it believes to be overbroad, Neustar will not join the battle in court.

Other trusted third-parties take a similar approach.

"We're out of the picture," said Marcus Thomas, chief technology officer at Subsentio, another trusted third-party company, founded in 2004, and based out of Littleton, Colorado.

While the third parties may be collecting money from ISPs for handling data and intercept requests, their desire to stay in the government's good graces appears to outweigh any loyalty to the businesses that retain their services.

"It's the provider's problem," [Yaana Executive VP Tony] Rutkowski said. "The nice part about the trusted third-party business is that just from a liability standpoint, we don't want to be left holding the bag here." [Yaana CTO David] Grootwassink agreed. "We provide the gears. We don't get involved in fights between the governments and our clients."

And therein lies part of the problem. While it may be easier to turn over what is largely a compliance function to third parties, there's very little oversight into these companies' actions and processes. Even the ISPs that hire them seem to have limited insight into what's actually being done. These go-betweens have carefully dodged liability by refusing to be involved in legal challenges, leaving underequipped ISPs to fight their own battles. While some trusted third parties have issued transparency reports detailing the requests they've facilitated, this basically leaves the public to perform the oversight, something of very limited use. About all the public can do is switch providers, which, if even an option, only puts them in the hands of another company using the same practices.

Filed Under: 4th amendment, data, isps, phones, records, surveillance, third parties