When Everything You've Ever Said Can & Will Be Used Against You By Anyone... Forever

from the anonymity-suddenly-seems-a-little-more-interesting dept

Leave it to Rick Falkvinge to add a bit of perspective on the various debates going on in the world today concerning both data retention and anonymity, by telling people to think about how you might act knowing that anything and everything not only can, but will be used against you, by pretty much anyone at some point in the future. I'm sure some people will insist that they have no problem with this. But think about how many little things you do that could be taken out of context or used against you in some manner or another.

It’s the equivalent of a police arrest in the United States, where you are told — very seriously – that “Everything you say can and will be used against you in a court of law“. What happens? Well, most people take the hint and shut up completely.

Now, imagine if it wasn’t just a court of law as in the arrest scenario, but that anybody that could see anything you had ever said. Future employers, dates, law enforcement… not just in your own country, but also every country you’ll ever visit in the future. Also, imagine that this holds true for the rest of your life, with the laws undergoing change in the next 60 years or whatever number of years you have left, and imagine what you say today is going to be repainted in the light of 60 years from now. (There was nothing said in 1941 which was common knowledge and social glue then, but which would be terribly embarrassing and a complete block-out if found today, was there?)

It would become practically impossible to say… anything remotely challenging. At least if you wanted a future. You may still talk about the weather.

Many people are willing to share a lot of their life online. But I think almost everyone likes to keep at least some aspects of their lives private. Efforts to wipe out anonymity and to record data for as long as possible put the things you'd rather be kept secret at risk.

Filed Under: data retention, permanent record, privacy

How Data Retention Makes Us Less Secure

from the security-is-contextual dept

We've already discussed how Congress appears to be moving forward with a nasty data retention bill disguised as an anti-child porn bill. There are all sorts of problems with the bill, including the likelihood that it will be massively abused by the government (which is why bill opponent Rep. Zoe Lofgren offered an amendment to rename the bill from the misleading Protecting Children from Internet Pornographers Act to the more accurate "Keep Every American's Digital Data for Submission to the Federal Government Without a Warrant Act of 2011"). Julian Sanchez, (who's suggested bill renaming is "Forcing Your Internet Provider to Spy On You Just In Case You're a Criminal Act of 2011") separately highlights another issue: how much less secure this will make data.

While most people, who are worried about this law, are reasonably concerned about how the government will spy on your data, an equally problematic issue is that this will make all of our data less secure. If you're wondering how merely retaining data can make it less secure, Sanchez explains how context matters in security, and if you increase the value of the payload, even without changing the absolute security, you've decreased actual security, by making yourself a bigger target:

If I started storing big piles of gold bullion and precious gems in my home, my previously highly secure apartment would suddenly become laughably insecure, without my changing my security measures at all. If a company significantly increases the amount of sensitive or valuable information stored in its systems — because, for example, a government mandate requires them to keep more extensive logs — then the returns to a single successful intrusion (as measured by the amount of data that can be exfiltrated before the breach is detected and sealed) increase as well. The costs of data retention need to be measured not just in terms of terabytes, or man hours spend reconfiguring routers. The cost of detecting and repelling a higher volume of more sophisticated attacks has to be counted as well.

One very simple security measure a company can practice, then, is to simply avoid retaining enough data to attract the interest of the most skilled professionals (or, alternatively, those willing to hire out botnets to aid their attacks). Because the adequacy of a security system is always a function of the payoff of breach to the attacker, then, privacy is an important component of security, as well as a value worth respecting for its own sake.

This is a point that I fear many involved in this debate are totally ignoring.

Filed Under: data retention, privacy, security

Swiss Justice Minister Decides That ISPs Should Have To Retain Data Despite No Legal Basis

from the well-that's-one-way-to-do-things dept

There are big debates in both the US and Europe about the reasonableness and legality of requiring massive data retention by ISPs. However in Switzerland, the Justice Minister, Simonetta Sommaruga, has decided to dispense with all of that and has just told ISPs they have to start retaining all sorts of data even if there's no direct reason for it (link is a Google translation from the original French). Apparently various companies are now protesting this, but it takes a special sort of out of touch politician to simply declare such a thing without realizing the widespread legal debates in other countries about the legality and usefulness of this very thing...

Filed Under: data retention, law enforcement, privacy, simonetta sommaruga, switzerland

House Committee Approves 'Keep Every American's Digital Data for Submission to the Federal Government Without a Warrant Act of 2011'

from the unfortunate dept

A few weeks ago we wrote about a ridiculously cynical attempt by some in Congress (mainly, Reps Lamar Smith, Bill Flores, Randy Forbes, Dutch Ruppersberger and Debbie Wasserman Schultz) to sneak through a massive data retention bill by pretending it was an anti-child porn bill. Of course, as we noted, the bill does almost nothing to stop or prevent child porn. Instead, it adds tremendously dangerous data retention requirements that will decrease user privacy, increase the risk of data being exposed, increase the value of certain hacking targets... all because some law enforcement folks want to be able to cruise through the data at will. Thankfully there was at least some criticism of the data retention aspect of the bill, and an attempt to remove the data retention pieces from the bill... but none of it succeeded and the bill was voted out of committee, meaning it will go to a full House debate. Lamar Smith defended the bill with this bit of ridiculous insanity:

"Every piece of prematurely discarded information could be the footprint of a child predator.... This bill ensures that the online footprints of predators are not erased."

If he actually believes that, he's a fool. First of all, those who are actually preying on children likely already know how to disguise their "footprints" online. Second, just because some criminals might use some technology doesn't mean we should give up all of our privacy and civil rights. I mean, it would be just as easy to say that every piece of prematurely discarded email written by Lamar Smith could be the footprint of a criminal. It might not be. In fact, it likely isn't... but by requiring that all of Lamar Smith's emails be made public, we ensure that such online footprints are not erased. See the problem with that logic? Tragically, Smith apparently doesn't recognize how he's selling out the privacy of pretty much the entire country.

Kudos, however, to those who pushed back against this aspect of the bill. Rep. Zoe Lofgren brilliantly pushed a proposal (seriously) to rename the bill the: "Keep Every American's Digital Data for Submission to the Federal Government Without a Warrant Act of 2011." She's right. If only there were some sort of "truth in advertising" law for Congressional bills that would require such bills to be labeled properly....

Filed Under: child porn, data retention, lamar smith, privacy, zoe lofgren

Congress Tries To Hide Massive Data Retention Law By Pretending It's An Anti-Child Porn Law

from the oh-come-on dept

We all know the cynical and obnoxious trick by politicians to get questionable laws passed by claiming that it's "for the children." The latest, however, is particularly nefarious. Some politicians (and lots of folks in law enforcement) have been pushing for the US government to adopt data retention laws for years. These laws would require online service providers to keep all sorts of data about users for many months, just in case law enforcement wants to come knocking later to get the details. Of course, data retention is controversial. You know what's not controversial? Being against child porn. We're all against child porn... so, rather than calling your bill a data retention law, why not refer to it as the Protecting Children from Internet Pornographers Act of 2011. Yes, that's the bill put forth by Texas Congressional Rep. Lamar Smith, and co-sponsored by Reps. Bill Flores, Randy Forbes, Dutch Ruppersberger and Debbie Wasserman Schultz. The bill actually has very little to do with stopping child pornographers, but a lot to do with requiring online service providers to retain certain information (mainly IP addresses) on users for 18 months. Of course, as Chris Soghoian points out, the bill exempts WiFi providers, so it's woefully ineffective at stopping child porn, since anyone who wanted to do that just needs to go to Starbucks.

But, for legitimate service providers, there are serious costs. On top of that, there are significant privacy issues -- and this is at the same time that we keep hearing about data leaks. You want to encourage more data leaks? Require companies hold onto data much longer than they need to do so. The really pernicious part in all of this is that it's really just a way for law enforcement to do an end run around the 4th Amendment. Julian Sanchez explains how this works:

Thanks to an unwise Supreme Court decision dating from the 70s, information about your private activites loses its Fourth Amendment protection when its held by a “third party” corporation, like a phone company or Internet provider. As many legal scholars have noted, however, this allows constitutional privacy safeguards to be circumvented via a clever two-step process. Step one: The government forces private businesses (ideally the kind a citizen in the modern world can’t easily avoid dealing with) to collect and store certain kinds of information about everyone—anyone might turn out to be a criminal, after all. No Fourth Amendment issue there, because it’s not the government gathering it! Step two: The government gets a subpoena or court order to obtain that information, quite possibly without your knowledge. No Fourth Amendment problem here either, according to the Supreme Court, because now they’re just getting a corporation’s business records, not your private records. It makes no difference that they’re only keeping those records because the government said they had to.

Current law already allows law enforcement to require retention of data about specific suspects—including e-mails and other information as well as IP addresses—to ensure that evidence isn’t erased while they build up enough evidence for a court order. But why spearfish when you can lower a dragnet? Blanket data requirements ensure easy access to a year-and-a-half snapshot of the online activities of millions of Americans—every one a potential criminal.

But, of course, if you complain about this or argue against the law, the title alone makes it sound like you're defending child pornography. How nice.

Filed Under: child porn, data retention, lamarr smith, privacy

Google, Facebook Go To Court In France: Claim Data Retention Rules Violate Privacy

from the american-companies-protecting-european-privacy dept

We've noted that, one by one, various European countries are realizing that Europe's "data retention" directive appears to be in direct conflict with EU privacy rules -- and when you put the two up against each other, privacy should win out. Germany, Romania, Cyprus, Hungary, the Czech Republic, Sweden, Greece, Ireland and Austria have all either ignored the data retention rules, or had courts rule against them. As we discussed last month, over in France, however, new data retention rules were recently published, which requires service providers to keep all sorts of info about their users -- including passwords in plain text:

According to the decree with immediate application (so in force since 1 March 2011), the data to be preserved include: the identifier of the connection at the origin of the communication, the identifier attributed by the information system to the content that makes the object of the operation, the types of protocols used for the connection and for the content transfer, the nature of the operation, the date and hour of the operation and the identifier used by the author of the operation, when provided. Moreover, the hosting companies must also preserve, for one year after the deletion of an account, even more sensitive data such as the date and time when an account is created and the identifier of the connection, his/her complete name, pseudonyms, associated post addresses, e-mail and associated addresses, telephone numbers and even password.

In case the service subscribed is a paid one, the hosting companies must also retain data related to the payment method, the amount paid and date and hour of the transaction. Furthermore, they must preserve, for one year after the contribution to the content creation, data including the connection identifier, the identifier attributed to the subscriber, the identifier of the terminal used for the connection, the date and hour of the beginning and end of the connection and the features of the subscriber's line.

If that seems like quite a lot of information (passwords? really?!?), you're correct and Google and Facebook find this requirement problematic. The two companies are taking the French government to court over this rule, saying that it violates other rules on privacy.

I find it somewhat ironic that Google and Facebook -- two American companies, quite frequently bashed in Europe for not respecting privacy, are standing up to a European government for privacy rights of their users...

Filed Under: data retention, france, passwords, privacy
Companies: facebook, google

Czech Court Says No To Data Retention Rules

from the good-for-them dept

There's been a big push around the globe, mainly by law enforcement but also with a helping hand from the entertainment industry, to force internet service providers to "retain data" for extensive periods of time, for various investigations. I've always been intrigued by the inherent conflict between data retention and privacy -- especially in Europe where they seem to be pushing quite strong for both conflicting concepts at the same time. Apparently, the two have come into legal conflict once again in a courtroom -- this time in the Czech Republic... and privacy has won out yet again.

In a ruling in the Czech Constitutional Court, the country's data retention rules have been ruled illegal, saying that it's a clear privacy violation. As the article notes, other countries, including Germany, Romania, Cyprus and Hungary have all run into similar problems trying to implement the European Data Retention Directive, and Sweden, Greece, Ireland and Austria have refused to implement the rules, because they don't see how it can be done and not violate privacy rules. Perhaps, at some point, the folks who wrote the original directive will realize that it can't be squared with Europe's privacy rules.

Filed Under: czech republic, data retention, privacy

France Goes Overboard In Data Retention: Wants User Passwords Retained

from the anti-privacy-laws dept

There have been plenty of stories about various governments, often at the behest of either law enforcement or the entertainment industry, pushing for data retention laws. It seems especially ironic in Europe, where privacy laws are a much bigger deal, that they would also push for data retention, which is the opposite of a privacy law. However, Andrew Swift points us to a new data retention law in France that goes way beyond your typical "keep the log files" data retention rule. Instead, it appears to require that ISPs and hosting companies retain all sorts of private information (Google translation from the original French). Swift summarizes for us the information that needs to be retained:

Information furnished when agreeing to a contract or opening an account, including first name, last name, business name, associated mailing addresses, and pseudonyms utilized, associated e-mail addresses and accounts, telephone numbers, and passwords as well as data permitting the verification or modification of the password.

These companies must also keep all user id's and passwords for any internet connection, the IP address of the terminal used to connect, the time and date of every connection, and...

Here's the kicker: for EVERY action of a user on the internet, these companies are now required to record the nature of the operation, whether it is writing an e-mail or downloading an image or video.

Just the fact that these companies would even have access to passwords should be problematic. Why aren't these services encrypting the passwords? I'm really curious how a law like this could possibly work in conjunction with European privacy laws?

Not surprisingly, it appears that pretty much every online service provider is planning to challenge this decree in court (Google translation of the original French).

Filed Under: data retention, france, passwords, privacy

Does Your ISP Care About Protecting Your Privacy?

from the seems-like-a-marketing-opportunity dept

We recently wrote about how Swedish ISP Bahnhof had announced plans to use a VPN to encrypt all traffic running over its network, thus making any log files it was required to store under data retention rules useless. Slashdot points us to the news that ISP Review, over in the UK, has asked a bunch of UK ISPs their thoughts on encrypting all traffic, and questioning whether they would do the same to protect user privacy.

The answers are pretty interesting. None of them seem interested going as far as VPNing all traffic, with some suggesting that it's just too expensive. One ISP, AAISP, says that there's a better solution than VPN, which is to just switch to a carrier grade NAT, for which there are no requirements to log those sessions. IDNet suggested that it might consider making such a service "opt-in," since some people might want it, but it creates other downsides that not all customers appreciate. The one response that struck me as questionable was from Entanet, who seemed to indicate that the only reason to encrypt traffic was if you were doing something wrong:

As a responsible communications provider, we don't advocate any steps to proactively create the ability to avoid the identification of parties who are deliberately committing acts of data piracy.

The focus is not to "avoid identification" of people involved in "piracy," but to provide privacy in general. Given just how many examples we've seen of governments spying on users' data habits with very little legitimate purpose, it seems like an ISP that actually protects its users privacy should be seen as a good thing.

It makes me wonder if we'll start to see more ISPs like Bahnhof pop up, with a focus on promoting the fact that they protect your privacy. In an age when so many people flipped out about Google's WiFi sniffing, you would think that these same people would celebrate ISPs that automatically encrypt traffic, as that would solve such problems. Yet, instead, it seems like the very same people are suggesting that such encryption is only for bad purposes.

Of course, here in the US, there are almost no choices among ISPs, and the ones that are available all have strong and close relationships with the government (hi, AT&T!), so it's not like they have any interest in protecting customer privacy. Though, this also explains why there's nothing serious in any US-based broadband plan around increasing competition. If there were real competition, perhaps some providers would look at better ways to protect user privacy. So, as long as the government can keep competition limited to a few entities who rely on the government, the government knows it can always get the info it wants, no matter how dubious the legal rationale.

Filed Under: data retention, digital economy act, encryption, ipred, privacy, vpns

Swedish ISP Will Automatically Encrypt All Traffic To Protect Privacy Under New Data Retention Laws

from the how-it-all-works dept

When Sweden first put in place its IPRED law, which required ISPs to hand over identifying info on people accused of file sharing, one of the first ISPs to respond was Banhof, who immediately put in place a new policy to delete all log files. Now that Sweden is pushing forward with a data retention law that would require ISPs to keep log files, Banhof has taken things up a notch by encrypting all traffic on their network via a VPN. That means that even if it keeps logfiles, the information will be effectively useless. Honestly, I'm surprised that more ISPs haven't done something similar and pitched themselves as focused on protecting privacy. It's difficult to see how Swedish politicians can really respond to this. They can't exactly order ISPs not to encrypt traffic. Just think of the mess that would cause. So, as the US starts looking (again) at data retention laws, they might want to consider what's happening in Sweden.

Filed Under: data retention, encryption, sweden, vpn
Companies: banhof