FBI seeks permission to surveil web browsing & email

Status
Not open for further replies.

Beethoven

member
Joined
Feb 23, 2005
Messages
404
http://news.com.com/FBI+Net-wiretapping+rules+face+challenges/2100-1028_3-5911676.html?tag=alert


FBI Net-wiretapping rules face challenges

By Declan McCullagh
http://news.com.com/FBI+Net-wiretapping+rules+face+challenges/2100-1028_3-5911676.html

Story last modified Mon Oct 24 16:35:00 PDT 2005




New federal wiretapping rules forcing Internet service providers and universities to rewire their networks for FBI surveillance of e-mail and Web browsing are being challenged in court.
Telecommunications firms, nonprofit organizations and educators are asking the U.S. Court of Appeals in Washington, D.C., to overturn the controversial rules, which dramatically extend the sweep of an 11-year-old surveillance law designed to guarantee police the ability to eavesdrop on telephone calls.

The regulations represent the culmination of years of lobbying by the FBI, the Justice Department and the Drug Enforcement Administration, which have argued that "criminals, terrorists and spies" could cloak their Internet communications with impunity unless police received broad new surveillance powers. The final rules, published this month by the Federal Communications Commission, apply to "any type of broadband Internet access service" and many Internet phone services.



What's new:
Rules demanding that Internet providers and universities rewire their networks for FBI surveillance are being challenged in federal court.

Bottom line:
Several groups are challenging the rules based on two broad arguments: that they are too expensive and that they are privacy-invasive.


"The concern is that what is being proposed is inordinately expensive to achieve the results that the FCC and the Department of Justice would like to secure," said Sheldon Steinbach, general counsel to the American Council on Education, which filed its legal challenge late Monday. The rules are set to take effect in April 2007.

Another legal challenge from businesses and nonprofit groups is set for Tuesday. "The FCC simply does not have the statutory authority to extend the 1994 law for the telephone system to the 21st century Internet," said Marc Rotenberg, director of the Electronic Privacy Information Center, which is joining the second challenge. Also participating are the Center for Democracy and Technology, Pulver.com, the Electronic Frontier Foundation, and the telecommunications trade group CompTel.

The 1994 law, called the Communications Assistance for Law Enforcement Act or CALEA, required telephone companies to rewire their networks and switches to guarantee ready eavesdropping access to police.

That prospect dismays privacy advocates and telecommunications providers who worry about the expense and argue that Congress never intended the law to apply to broadband links. A House of Representatives committee report prepared in October 1994 says CALEA's requirements "do not apply to information services such as electronic-mail services; or online services such as CompuServe, Prodigy, America Online or Mead Data; or to Internet service providers."

"Regulating the entire Internet"
The new regulations also are alarming Internet phone service providers.

Jonathan Askin, general counsel to voice over Internet Protocol(VoIP) firm Pulver.com, said that his company is not directly implicated by the regulations because it currently offers only peer-to-peer conversations rather than links to the traditional telephone network. The new rules cover VoIP services that provide a "capability for users to receive calls from and terminate calls" to the phone network.

But that regulatory forbearance may vanish in the future, Askin warned. "From a forward-looking policy perspective, I think the FCC has opened the door to regulating the entire Internet," he said.

Federal police agencies and the FCC did not respond to interview requests on Monday. Department of Justice spokesperson Charles Miller said, "If and when they file suit, I'm sure we'll respond accordingly in court."

The American Civil Liberties Union said it has not yet decided whether to join the lawsuit, saying it's a matter of having enough time for its lawyers to take a new case. "I think there's a very strong statutory argument that the FCC just overreached and doesn't have authority over the industry," said Barry Steinhardt, director of the ACLU's Technology and Liberty Program.

The Information Technology Association of America also said it has not decided whether to join an appeal of the FCC's ruling. "The limits of the authorization that Congress provided are fairly clear and the FCC seems to have gone beyond that," said Mark Uncapher, senior vice president of ITAA.

In an unusual twist, two of the four FCC commissioners who unanimously approved the wiretapping rules last month acknowledged that a court challenge was likely.



Previous Next Commissioner Kathleen Abernathy said: "Because litigation is as inevitable as death and taxes, and because some might not read the statute to permit the extension of CALEA to the broadband Internet access and VoIP services at issue here, I have stated my concern that an approach like the one we adopt today is not without legal risk."

Commissioner Michael Copps warned that if a court case leads to the rules being struck down, the regulations may have done "more harm than good." The FCC's logic, he said, was "built on very complicated legal ground."

The twin appeals being filed this week will follow a two-stage process. First, a very brief notice of appeal will be sent to the court. Then, after the judges decide on a schedule, a formal legal brief will be submitted and the Bush administration will be offered a chance to reply.

CNET News.com's Anne Broache contributed to this report
 
don't you need a warrent to tap into my phone service?

Should need the same if you want to tap my email.
 
Glad I keep my email on my own server... doesn't protect it on the wire though.
 
Nothing wrong with this. I hope they censor it for content too - I hate getting nasty mail. I wouldn't worry about this, they're on the front line of the struggle against global extremism. I'm glad the Bush administration is on top of this.
 
^^^^^ +1

If this becomes real watch for protocols and encryption methods like PGP to become even more popular. Some smart guy will come up with an uncrackable encryption method and make it public - then prompty get tossed into the dungeon - err jail by the feds.

What a world we live in...

The writings of Vin Suprynowicz get more and more prophetic as each day passes...
 
there is no such thing as an uncrackable encryption.

If it is a public program to encypt to make it practicle it also needs a way to decrypt and make it readable. Anything the public can get so can the feds, so there is really nothing that is uncrackable.

That said trying to monitor my email is bull. Next what? Monitoring my phone calls without a warrent? Should need a warrent to monitor my email jsut liek you need one for my phone.
 
What you bet their are watching now lol Some of you people must think we still have freedoms here
 
I always found it funny that the government dropped the criminal investigation against Phil Zimmermann (the developer of PGP). Rumors in the crypto world were NSA might have broken it - if so, then no need to prosecute him. It's also possible they realized the cat was out of the bag, and that prosecuting him wouldn't get the code back.

A well documented example of government mucking around to make ciphers weak is the story around DES. In the development of DES, NSA convinced IBM that a reduced key size was sufficient; indirectly assisted in the development of the S-box structures; and certified that the final DES algorithm was, to the best of their knowledge, free from any statistical or mathematical weakness. On 17 March 1975, the proposed DES was published in the Federal Register. Public comments were requested, and in the following year two open workshops were held to discuss the proposed standard. There was some criticism from various parties, including from public-key cryptography pioneers Martin Hellman and Whitfield Diffie, citing a shortened key length and the mysterious "S-boxes" as evidence of improper interference from the NSA. The suspicion was that the algorithm had been covertly weakened by the intelligence agency so that they — but no-one else — could easily read encrypted messages. Alan Konheim (one of the designers of DES) commented, "We sent the S-boxes off to Washington. They came back and were all different."
Whether or not they fiddled with the S boxes is questionable, but there is no doubt that they pushed for a short (56 bit) key. IBM submitted DES with a 64 bit key. The reason given by the NSA for reducing the key length from 64 bits to 56 was that the other 8 bits could serve as parity bits, which seemed somewhat specious. It is widely believed that NSA's decision was motivated by the possibility that they would be able to brute force attack a 56 bit key several years before the rest of the world would. Today it's possible to crack a 56 bit DES in less than 24 hours.
 
Last edited:
Rick, excellent post.

All the FIPS standard versions of submitted ciphers are extremely suspect in my eyes. Also, if they wanted the "strong" versions of DES (3DES) to have a longer keyspace, the "it would take too much computing power" argument seems specious in their final decision to just encrypt 3 times using the DES cipher and "call it good" or "strong". Its like putting your firearm into 2-3 (depending on how many keys were used in that 3DES implementation) gun cases instead of one safe. It's really no stronger.

there is no such thing as an uncrackable encryption.

If it is a public program to encypt to make it practicle it also needs a way to decrypt and make it readable. Anything the public can get so can the feds, so there is really nothing that is uncrackable.

I have to take issue with that. There are methods that will make your secure message survive the closest scrutiny (including untold computer cycles), regardless of transmission medium. I mentioned a couple in a previous similar thread, which I then couldn't find anymore. I'll refrain from mentioning anything like them again and be more terse.

I've sent letters to computer writers and even federal law enforcement on the matter, but I never received a reply from anybody. Seems everybody either knows it's futile, or NSA and FBI is kicking so much butt they don't appreciate any help... They WILL catch all the clowns, make no mistake, but the really savvy guys? They won't even get to interdict 5% of those, and of those, they may figure out that 30% actually have some content worth investigating. Then they will succeed in reducing some of those (a few) into some readable form. By the time those few are cracked, the information may be dated and worthless. I honestly believe they can "crack" symetric/asymetric encryption VERY rapidly once they realize what they're dealing with, but a discussion of how might not sit well on this board.

If the moderators will allow it, I'll elaborate. It's quite simple, really. It WILL change your view of PGP and other "secure" conduits (like SSL VPNs) pretty quick too...

Your mistake is assuming a publicly available piece of software, not something written by yourself precisely for this purpose. Even keyloggers running on your PC have their limits, and are defeated via the correct data creation methodologies.

There are SMALL systems, systems that a decent software developer could create in a couple days at most, that will provide "absolute" security (for all practical -and impractical- purposes), assuming both sender and recipient do their part, even if caught with most of the material necessary to recover the message. Since they are so easily created, they can be tossed after 1 or a few uses.

Non-software (handwritten or hand-passed) codes are even easier to use, and ostensibly safer (by a degree, not an order of magnitude) since they can be passed or shipped without much scrutiny, even though their travel time is far greater. They are far less convenient when message recovery is done though.

Bottom line: If you are determined to get a message across for somebody's eyes only, you can succeed, and succeed repeatedly, and enjoy safety doing it, super-duper FBI/NSA computer labs notwithstanding. It just takes a little skill, and a bit of imagination. If I can do stuff like this for a living, anybody can do it as a hobby, or (unfortunately) something more nefarious.
 
Last time I looked, there was no such word as "surveil". It's a back-formation from the real word "surveillance", which is the act of surveying, or looking at, somebody.

Sorry, back-formation is a pet peeve of mine.
 
Y'all are missing the next step ... first step is to get permission to set up the survelience of email and web traffic 24/7/365 ... then all we need is a raid on a known terrorist's hiding place and they find a computer with PGP on it and all the thugs (both jackbooted and Armani suit wearing) start hitting up congress for laws against "civilian" use of encryption software.


Then the mere detection of encryption in your email is grounds for arrest under the patriot act (because only a terrorist would want/need to encrypt a letter to Grandma). And you get to be treated to the Fed.Gov's hospitality indefinitely without being charged.

We are so screwed :(
 
Some in FBI have skirted oversight of surveillance

By Kevin Johnson, USA TODAYTue Oct 25,11:08 AM ET

FBI agents have violated government policies by secretly conducting surveillance on U.S. citizens for more than a year without notifying Justice Department officials, according to declassified government documents released Monday.

FBI spokesman John Miller said Monday that the precise number of violations by agents could not be disclosed because some information on the bureau's surveillance activities in this country remains classified. However, the documents released by the Justice Department indicate that there have been several instances in which FBI agents have not informed their superiors at Justice about secret surveillance operations.


In one case documented in 2002, an unidentified target had been watched for nearly two years by agents in Indianapolis without the required oversight of Justice Department executives, the papers say. In a separate case in 2002, the documents say, agents' 15-month delay in reporting the status of their surveillance of a person in Detroit kept the department "from exercising itsresponsibility for oversight and approval."

The records were released Monday as part of a federal Freedom of Information Act request by the Electronic Privacy Information Center (EPIC), a civil liberties advocacy group. The findings were first reported by The Washington Post.

Since the Sept. 11, 2001, terrorist attacks, the FBI has dramatically increased its surveillance on people in this country, including U.S. citizens, as part of the bureau's new mission to prevent further attacks. Warrants that allow such surveillance of U.S. citizens are overseen by a secret court and a presidential panel whose activities are not made public. After obtaining such a warrant, FBI agents are supposed to follow Justice procedures designed to prevent abuses of such authority.

The release comes as Congress is considering restrictions to the USA Patriot Act, the post-9/11 law that made it easier for U.S. agents to conduct secret searches and surveillance. Miller said the papers reflected violations of long-standing Justice rules, not abuses of any authority granted by the Patriot Act. In a letter Monday to the Senate Judiciary Committee, EPIC called for more congressional oversight of secret surveillance.

http://news.yahoo.com/s/usatoday/20051025/ts_usatoday/someinfbihaveskirtedoversightofsurveillance
 
Interesting. I've talked to Phil. I was going to port PGP to the IBM AS/400 platform. But never got a chance to complete that. IIRC, there's a difference between the PGP that's available in the States and that in Europe. There's something about a hook or backdoor in the encryption methods that allow LE to decript the message. In Europe this backdoor isn't there. I don't know if it's true, but I know I've pulled my PGP from servers in Germany.
 
I was thinking, acutally there's nothing to stop them from doing this now. Think bout this idea. We have friendly countries like the UK which aren't bound by our laws. They can spy on US citizens right? Now, what's to stop MI6 from passing along information to the US. After all this information wasn't gathered by a US agency right?
Perhaps I'm a bit over concerned.
 
dpesec said:
Interesting. I've talked to Phil. I was going to port PGP to the IBM AS/400 platform. But never got a chance to complete that. IIRC, there's a difference between the PGP that's available in the States and that in Europe. There's something about a hook or backdoor in the encryption methods that allow LE to decript the message. In Europe this backdoor isn't there. I don't know if it's true, but I know I've pulled my PGP from servers in Germany.

Before I retired 6 years ago the firm I worked for did a line by line review of the source code - there were no backdoors. We couldn't run SW we didn't have source code for and had reviewed, it was a very paranoid place to work.
If there was a backdoor, PGP would have no market. There are some well documented bugs/problems in PGP but there has been no problem found in the encryption after substantial public review.
 
Status
Not open for further replies.
Back
Top