Hacker News Reader

Comment by tzs | Hacker News Reader

> the Protecting Children from Internet Pornographers Act of 2011 (AKA "the Spy on Everyone Always Act")

Add Cory Doctorow to the list of authors who write about legislation they haven't read. What it actually requires is the keeping of IP address assignment records and the mapping of them to custormer records. A few sites have claimed it requires keeping a log of all sites actually browsed and data downloaded and such, but that's completely made up. It's disappointing that Doctorow apparently gets his information from such sites and doesn't verify it.

The relevant parts of the legislation are only a couple of paragraphs. Why do bloggers find it so damned hard to read it for themselves instead of just repeating what other bloggers write?

View on HN

And this is bad enough. There are plenty of services that could make anonymity and privacy as part of their offer, and laws such as this make it a moot point.

Worse, it touches defaults. By default, most sites don't keep IP addresses (no point really, for most businesses). Changing this opens so many possibilities for law enforcement, and they are all the kind I'd expect the chinese government to be happy about.

The ISPs can, and in the UK there is one of our lovely 'voluntary agreements' that has the ISP retaining information about web sites visited, but only for 4 days. Police need to move quickly, as they did in the riots last summer.

http://en.wikipedia.org/wiki/Telecommunications_data_retenti...

> The relevant parts of the legislation are only a couple of paragraphs. Why do bloggers find it so damned hard to read it for themselves instead of just repeating what other bloggers write?

The same reason that most people run from the command line and other "Computer" stuff. Because someone, somewhere, convinced them that doing such a thing is beyond their capability.

You'll find elements of this in every field I reckon.

If you believe in the possibility of anonymity on the Internet, then you should probably oppose laws requiring "the keeping of IP address assignment records and the mapping of them to custormer records".

I've also heard that this law requires ISPs to turn this information over without a warrant. Is this not correct?

After there are data retention laws for IP assignment info, it's only one step away from requiring it of websites. "To protect the children" of course.

> I've also heard that this law requires ISPs to turn this information over without a warrant. Is this not correct?

That isn't correct, you could go and read the bill if you want: http://www.opencongress.org/bill/112-h1981/text

Calling it the "Spy on Everyone Always Act" is sensationalized no matter what your opinion is on the bill. Most ISPs wouldn't even have to change their current behaviors to comply with it. (To be fair, that's not saying much anyway...)

The more bills we shoot down because of misinformation, the less likely we can defeat bills with more serious problems.

> That isn't correct,

Fair enough. But don't ISPs and other commercial entities tend to share that stuff "voluntarily" already?

> you could go and read the bill if you want

I like the part about "the term ‘Internet’ has the same meaning given that term in section 230(f) of the Communications Act of 1934."

It says "the term ‘commercial provider’ means a provider of electronic communication service that offers Internet access capability for a fee to the public or to such classes of users as to be effectively available to the public, regardless of the facilities used"

Why wouldn't that apply to a coffee shop that offered free Wifi?

Wouldn't they then be required to collect and retain information which "enables the identification of the corresponding customer"?

Are coffee shops and libraries going to have to check photo IDs like Iran and China?

How Internet Companies Would Be Forced to Spy on You Under H.R. 1981

Excerpted from: https://www.eff.org/deeplinks/2012/02/how-internet-companies...

Because the actual language of the bill is somewhat vague, activists at Demand Progress have correctly noted that this legislation might force Internet companies to retain even more data just to be on the safe side. The proposed bill is an amendment to 18 USC § 2703, the law currently defining the circumstances under which companies that store electronic data on customers must disclose it to the government. H.R. 1981 is attempting to amend and expand this law in a way that “enables the identification of the corresponding customer or subscriber information under subsection (c)(2) of this section.”

So what is subsection (c)(2)? It requires a provider to turn over to the government without a warrant:

    Name
    Address
    Records of session times and durations
    Length of service (including start date) and types of service utilized
    Credit card or bank account number

> It requires a provider to turn over to the government without a warrant:

It does not require that a provider turn that over to the government without a warrant. It mandates that only the government can have access to it.

Providers still have the liberty of not complying with government requests for assistance, in which case a warrant would be necessary to obtain the information.

We can argue over whether providers will cooperate or not in practice, but it does not require providers to do anything but keep the information.

It appears that you're missing something. Read the act's reference to subsection (c)(2) carefully. You see, there is no subsection (c)(2) in the proposed bill. It's a part of the law this would have amended, 18 USC § 2703.

And 18 USC § 2703(c)(2) requires no more than an administrative subpoena (though there are other ways to get it as well). And an administrative subpoena is not a warrant at all. But don't take my word for any of this, read it for yourself:

"(2) A provider of electronic communication service or remote computing service shall disclose to a governmental entity the [long list of customer info skipped] of a subscriber to or customer of such service when the governmental entity uses an administrative subpoena authorized by a Federal or State statute or a Federal or State grand jury or trial subpoena or any means available under paragraph (1)."

Ref: http://www.law.cornell.edu/uscode/text/18/2703

It's like we have a software patch and everyone is reading only the patch, without considering what the existing code does.

It would appear there's more to the story than I was aware.

Certainly administrative subpoenas that are not based on a grand jury hearing would be susceptible to appeal?

It's easy to miss and it's been getting lost in all the noise, I fear. You don't appeal subpoenas, you try to quash them and prevent the information from being disclosed to begin with. I mean, you can't very well have them un-share your identity or personal information after the fact any more than you can un-ring a bell.

Here's one nice little article about how they work in practice:

http://privacysos.org/admin_subpoenas

You will note that they commend Twitter for giving the user notice of the subpoena, even though Twitter is not required to. That's an important point, too: companies may go above and beyond what they're required to. So, assuming you use services that do that, you might get notice even when the company wasn't legally required to provide it.

Finally, here's the Justice Department's own report to Congress on the use of administrative subpoenas:

http://www.justice.gov/archive/olp/rpt_to_congress.htm

Appendix A1 is probably the most relevant part of that, specifically the column labelled "Notification Req. and Privacy Protections."

To be fair, I'm not sure that "Spy on Everyone Always" is any more sensationalist than the original title, "Protecting Children from Internet Pornographers", is it?

To be fair, you're reading quite a bit into that statement.

EDIT: Also, because it's not very clear, why do you think that the requirement to enable identification under 18 USC § 2703(c)(2) is not that much of a concern?

Reply on news.ycombinator.com