Leahy scuttles his warrantless e-mail surveillance bill | Hacker News Reader

Leahy scuttles his warrantless e-mail surveillance bill

news.cnet.com

82 pointsjsm38632 comments

He didn't "scuttle" it. CNet saw draft language being circulated among Senators and reported on it. Leahy issued a clarification, saying that he didn't support the draft language. Leahy's own language eliminates the 180-day rule for warrantless access to email, which is a huge step forward for email privacy.

Unless Leahy is directly lying in his statement, what CNet's reporter did was to play "gotcha" with draft senate language. While this may make us feel better, like we all played a role in ensuring that a terrible bill wasn't passed, what it really does is ensure that senators and their staffs will work even harder to make sure we don't see draft bill language until it is more or less a fait accompli and the only two outcomes are "pass" or "discard".

Patrick Leahy has one of the better reputations in the whole senate on civil liberties issues (check out the ACLU scorecard). But yeah, let's definitely eat our own to ensure ideological purity. That worked super well for the Tea Party.

> But yeah, let's definitely eat our own to ensure ideological purity.

"our"?

Leahy was the author of PIPA, so I'm not one to extend that umbrella. He has been a champion of civil liberties and other worthy causes, but that doesn't mean he gets a free pass on everything. If we blindly defend "our" side in two-party politics, we inevitably end up defending some pretty bad legislation. I'd rather assess each piece individually.

Who's talking about parties? I'm talking about ACLU voter scorecards.

I misread your use of "our own" followed by a reference to the Tea Party. I still stand by my opinion, though, that we shouldn't give legislators a free pass on bad legislation just because we support the positions they have taken on other issues.

FTA: But he also authored the 1994 Communications Assistance for Law Enforcement Act, which is still looming over Web companies, and the reviled Protect IP Act. An article in The New Republic concluded Leahy's work on the Patriot Act "appears to have made the bill less protective of civil liberties." Leahy had introduced significant portions of the Patriot Act under the name Enhancement of Privacy and Public Safety in Cyberspace Act (PDF) a year earlier.

He's far from a consistent supporter of Civil Liberties. Surely we shouldn't demonize him, but clearly could use some education and encouragement to do the right thing.

But, as I understand it, the draft language came from Leahy. There was immediate backlash so now he's distancing himself from it.

Then Leahy is directly lying in his statement, which says he never supported that language.

The language CNet reported on is also out of character for Leahy, and Leahy has ECPA amendment language ready that kills the 180-day rule for email. It doesn't add up.

This does seem remarkably out of character for Leahy, perhaps the draft language was from the the committee general.

I am giving him the benefit of the doubt since he is such a Batman supporter.

Based on the movies, I would think that a Batman supporter would be in favour of a warrantless surveillance bill.

I havent read the bill.

However, the commentary, and the bill (perhaps) assumes that email resides on a providers server - that the end user does not control it.

How does the bill address warrantless access (or access of any kind) to email hosted on the users own mail server ?

The police require a warrant to search your computers already, and there's no 180-day rule to that.

Does the law make a distinction between:

(1) Servers I own that are physically located in my house.

(2) Servers I own that are co-located at a hosting facility.

(3) (physical) Servers that I am renting from a hosting facility.

(4) Virtual servers that I am renting from a hosting facility.

I assume that most law enforcement officials feel that 2-4 shouldn't need a warrant because they are not located in my house, so therefore I don't get protection from unreasonable search/seizure.

Also, at what point do #3 or #4 start to encroach onto Dropbox-esque territory where I own the data, but they are holding it for me under contract?

In the first two cases, you are talking about your own property. Unless you have a contract with the colocation facility that says otherwise, the presence of your machine at such a facility shouldn't somehow make it searchable, just like if I put a closed briefcase full of papers down in a public library and walk away from it for 5 minutes, the police cannot suddenly search that.

As I understand it, things are shakier in case (3) and (4), because your provider absent a contract with you that says otherwise could choose to comply with subpoenas (providers commonly claim that they'll respond to LEOs only if they have a "subpoena or a warrant", as if that was a feature; you should assume that subpoenas are mere formalities and that any LEO can obtain one practically on demand). It's possible that your remedy in such a case would be civil, which would be cold comfort if your goal was to have evidence excluded from a trial.

There are a bunch of lawyers on HN now, and I'm sure one of them will jump in here to correct me.

> While this may make us feel better, like we all played a role in ensuring that a terrible bill wasn't passed, what it really does is ensure that senators and their staffs will work even harder to make sure we don't see draft bill language

If we just stick our heads in the dirt, congress won't have to do it for us! You're either a moron or a dick. People took action against invasive legislation, and you reflexively belittle them. And that's assuming that your beloved Leahy didn't lie about not supporting said measure. It's not like a politician would... lie

I'm enjoying the irony of this comment calling out another for being "reflexive".

I'm enjoying the irony of you proposing we give our congress critters privacy so they don't have to hide from us.

That is not what I proposed. That idea is dumb enough to explain the vitriol in your original response.

My emotions were driving on that one. My mistake.

Totally OK. That's what message boards are for. And for what it's worth, I'm being pretty unclear in my comments today. Someone else on HN wants to break my jaw for another poorly expressed opinion. :)

As the Internet we need to do two things, one start getting our sorry little asses in congress to stop this stuff where it starts.

Two, build better technology that is not such an easy target. If individual keys were required to decrypt messages, then it's hard to take the data without your permission because cryptography prevents that.

This might be a good enough reason to switch off of email, especially email like gmail.

As EFF reports, large email providers (one assumes this includes GMail) have a practice of demanding warrants for email, even though the FBI is in some circumstances technically entitled to email with just a subpoena. The FBI apparently (as far as we know) hasn't litigated any of these cases, and has simply obtained warrants.

It doesn't seem unlikely that we're converging in the short term on a legal terrain where all access by law enforcement to email is going to require a warrant.

Scary wasn't disclosed until today, it was scheduled for a vote this week.

Sadly this is the way non-partisan issues are legislated in the US system. But the system worked -- the vote was scheduled, the relevant interest groups noticed, the media reported it, the people contacted their representatives and the bill was pulled. We win. Note also that "the vote" was a committee vote. There were plenty of other chances to stop this.

This isn't the best system, obviously, but it does work. So don't despair, just be vigilant.

This isn't the best system, obviously, but it does work. So don't despair, just be vigilant.

It's just that most of us can't afford to outsource our vigilance, and the system works better for those who can.

Exactly. And given the relative difficulty of undoing bad legislation versus stopping it from passing (and even stopping it often takes a huge effort), whoever can afford the most persistence wins, by just waiting for the other side to slip up once.

But you can afford to outsource your representation?

There the cost structure is reversed: most of us can't afford to insource our representation -- that costs millions of dollars in campaign funds.

> This isn't the best system, obviously, but it does work

There is no question the system works - it's the biggest most powerful such in the world, possibly in all of known history.

The question is for whom [1] it works - the answer may depress you.

[1] hint: someone in the know once said: "corporations are people, my friend"

Even more scary was that it was a bill originally advertised as improving email security and then was quietly rewritten to damaging email security (but then wasn't advertised that it did a 180).

Hurray for the internet. Hard to screw people over by this shady business these days.

It's a better story when there's a looming deadline. A story about something that doesn't seem urgent isn't going to get many eyeballs.

Cockroaches scatter when you shine light on them.

Well, that was fast.

Reply on news.ycombinator.com