Congress, at Last Minute, Drops Requirement to Obtain Warrant to Monitor Email
allgov.com
allgov.com
[1] http://www.law.cornell.edu/supct/html/historics/USSC_CR_0389...
If the government took one tenth of the money it spends on defense every year (which was $1.030–$1.415 trillion for 2012), or approximately $100 billion dollars, and invested it in driverless car research and the infrastructure changes necessary for it, a much bigger benefit could be wrought. But that won't happen, because it's the lobbying of the military-industrial complex that determines where money is spent.
Most of what you said is true enough, but this nonsense loses you credibility. It's like saying "it's the corporations, man."
The business of buying weapons that takes place in the Pentagon is a corrupt business - ethically and morally corrupt from top to bottom. The process is dominated by advocacy, with few, if any, checks and balances. Most people in power like this system of doing business and do not want it changed.
-- Colonel James G. Burton
A rose is a rose is a rose, and so is a turd; what labels you accept or don't is your personal thing, but otherwise irrelevant.
http://security.blogs.cnn.com/2012/10/09/army-to-congress-th...
A call to the CDC press office revealed that the number of
deaths from food allergies, as collected from 2.5 million
death certificates across the country, is miniscule. Only
eleven people died from food allergies in 2005, the last year
for which we have data available. More people died from
lawnmower accidents.People aren't afraid of choking on peanut butter or car accidents because they feel they have some control over those situations. Terrorism creates fear by removing that sense of control.
Many people would argue exactly the opposite
Since 2001, there has been no terrorist activity against the US. You are told about threats the war on terror has dealt with, but no actual action or actors can be pointed to yet the government is keeps the fear of terror alive. They have done far more to that end than any terrorist organization has. This causes the population in general to accept any course of action that they are told will deal with that looming threat, but it never seems to do so.
Once side of the government generates and keeps the fear alive, the other side uses the fear to do what they wish. Neither side wants the fear to go away.
The US Government is the largest group terrorizing the US population today. They use the war on terror to do it.
I've not heard many people seriously argue that the TSA's mandate is to alleviate fear, much less argue that the TSA carries out said mandate successfully.
1. Look at Breivik for example. Or the latest nutter shooting up a school.
Terrified people make stupid mistakes, sign away their rights with reckless abandon in the hope that it will allay their fears. No electorate is so easy to manipulate as one that is afraid.
Osama bin Laden would have killed more Americans by investing in Ford and GM+. And after the bailout, he would have made a profit too!
+ I'm not picking on Ford or GM here, they make fine cars. But automobiles kill far more people every year than terrorism has in the last decade.
Seems you rather missed the point of the whole thread; terrorism isn't about killing.
If humans were rational, terrorism wouldn't work. Driving your car to work is more dangerous than taking the subway to the world trade center, even if the WTC was demolished every year. But we are afraid of what we fear, not what will actually kill us. There are a lot of people who are eager to exploit that cognitive defect.
Doing "something", something which the security state crowd had ready in '96, is what got us the PATRIOT act and the TSA.
The strong anti-gun crowd is trying to wage a slow war against gun ownership that would result in an Australia-like confiscation of weapons and the repeal of the 2nd amendment. Don't let the "do somethings" win again.
/rare political post on HN
I think actual fear would have to come from injuries to someone you know and can feel empathy towards. Dunbars number suggests theres only very little of that based on the number of deaths due to terrorism.
Have you met the republican party? Their entire base lives off fear.
> I think actual fear would have to come from injuries to someone you know and can feel empathy towards.
It's not fear of death or injury, but fear of "other", of change, of being marginalized.
First off not all in the republican party can be characterized this way. You are painting with very broad strokes. Many turn the republican party because they are the closest they can get to their economic beliefs.
> It's not fear of death or injury, but fear of "other", of change, of being marginalized.
Do you honestly believe this? Do you get your views of republicans from reddit and articles you read about people talking about fox news?
Duh. Do I really need to preface every statement I make with "this is a generalization that doesn't apply to every single person" or can I just assume that you have some intelligence and don't assume everyone speaks in absolute terms and that when I said base, that quite obviously doesn't mean everyone.
> You are painting with very broad strokes.
That's rather the point of generalizing; it's useful.
> Many turn the republican party because they are the closest they can get to their economic beliefs.
Hopefully they're sobering up and realizing how ridiculous that choice was.
> Do you honestly believe this?
I observe this, it's not a matter of belief, I live in a red state and see it constantly.
> Do you get your views of republicans from reddit and articles you read about people talking about fox news?
I see, it couldn't possibly be because I know a lot of republicans, it must be Fox news. I live in Arizona, practically the center of republican crazy these days; I don't have to make shit up.
So did you choose the word "Beliefs" intentionally to evoke an evidence-light position?
Because Republican Party economic reality is further from those stated beliefs than Democratic Party economic reality.
Supposedly based on an actual study - I'll let you vet the sources ;)
A lot of "true" conservatives have left the party.
FTR, I don't classify myself as either liberal or conservative; I've been a member of the Democratic party and the Republican party, and left them both. I can't stand either of them. And I really can't stand hypocrisy.
Good lord. How old are you that you haven't realize this "fear of other" stuff is just academia bullshit?
That's not to say Fox has a high quality broadcast. It doesn't. But it's no worse than CNN or CBS, and it's certainly better than MSNBC.
Yes, the half that want to be lied to because reality is too distressing for them; so distressing in fact that they call reality liberal media bias.
Nobody has yet 'officially' explained what Saddam did with the WMD we know for a fact he had. Shipping the weapons to Syria is the only logical explanation for their sudden disappearance.
Conservatives distrust the media because they don't like hearing things that don't jive with the belief system and reality is full of those things; it's as simple as that. Colbert nailed it when he said reality has a liberal bias, as did Stewart when he dubbed Fox bullshit mountain.
If it's false equivalence then the difference lands in my favor. Fox has never used obviously fake documents to try to throw an election like that. And there's reason to believe "Fox lies more than any other station", no matter how many times liberals tell each other that's the case. The lying from CNN and (of course) MSNBC has been epic over the last few weeks.
Oh, and by the way, Rathergate was CBS, not CNN. At least try to get your facts straight.
>Conservatives distrust the media because they don't like hearing things that don't jive with the belief system and reality is full of those things; it's as simple as that.
This is just projection. Leftists in the US are angry at Fox because they no longer control 100% of the narrative. The idea this has anything to do with objective reporting is just conceit on your part.
>Colbert nailed it when he said reality has a liberal bias, as did Stewart when he dubbed Fox bullshit mountain.
The reason people on the left find Colbert and Stewart funny is they tell you what you want to hear. What Colbert "nailed" was his audience, and if you had any capacity for self reflection you would realize this.
It might surprise you to know that, far from being a Fox news "junkie", I haven't watched broadcast television at all for years. But why would you be right about this when you're wrong about literally everything else? People like you are why the founding fathers thought a restricted franchise is a good idea, and I think they were right.
We haven't yet seen evidence of the head of CNN or CBS sending memos governing the angle under which the day's stories should be viewed (http://en.wikipedia.org/wiki/Fox_News_Channel_controversies#...).
However terrible CNN and CBS may be (take for example their outright cheerleading for the second iraq war), they remain organisations devoted to covering the news. Fox is devoted to controlling the news, which isn't the same thing.
Why didn't CBS fire Dan Rather immediately when Rathergate came to light? It's hard for me to imagine Fox easing out someone slowly after they'd left its reputation in taters.
>However terrible CNN and CBS may be (take for example their outright cheerleading for the second iraq war), they remain organisations devoted to covering the news.
I haven't seen much evidence of that, especially lately when they've used every possible angle after the Connecticut shooting in their full-throated advocacy of gun control.
Remember how the DOJ refused to prosecute? Wierd.
(Follow the links for a bunch of other relevant articles)
From an outsider perspective, this is very relevant of what US has became. I'm always surprised that a country which places freedom as the highest value tends to give away all its civil rights so easily.
Sounds to me like people behind 9/11 attacks have succeeded : US is not fighting fear, it's diving into it, more and more every year, hence the loss of freedom for its people.
That's a good one.
Then it is the greatest irony of all time that people have become more fearful of surveillance and persecution by their own governments than some terrorists who live overseas.
Not to say it's without merit, but this really doesn't preoccupy people's thoughts in other countries. I've tried to explaining to Japanese and British people that we have guns to prevent potential government oppression and to be able to take our personal protection into our own hands. They look at you ask if you're crazy/paranoid.
The whole slippery slope stuff doesn't resonate at all.
The whole thing basically boils down to: "If I were to potentially at some point in the indefinite future plot anti government activities through my email I want to be sure that big brother doesn't read it"
This just seems ludicrous to most people.
The fact that the Islamists don't kill millions every year doesn't make it a "giant hoax". The fact that they haven't killed more isn't due to a lack of motivation, only to a lack of means. And they've been reaching for the means.
On the other hand, maybe it was all faked, right, like the WTC attack? Maybe you should keep it "quit" yourself. And while you're keeping it "quit", take an English class. I would advise keeping it "quit" during the class so the teacher doesn't realize you're not the sharpest tooth on the saw.
'Modern' legislation doesn't feel all that progressive when it comes to technology.
Don't say it's due to prohibitive expense unless you can prove this would be more expensive than Carpathia hosting Megaupload for free.
E-mail is different because the intermediaries are non-governmental third parties. The idea is that you do not give up your expectation of privacy by giving mail to the Post Office to deliver, because you know the Post Office is limited by the 4th amendment, while you do give up your expectation of privacy by giving mail to your e-mail provider, because you know your e-mail provider has no obligation to protect your privacy.
Unopened email left on a 3rd party server for longer than 180 days was considered discarded or abandoned property. Discarded physical property has never retained a reasonable expectation of privacy (for instance, the police are free to dumpster dive once your property is considered discarded). Similarly when you vacate an apartment and leave all your belongings behind, they become the property of the landlord. These are firmly established principles of common law. The waters become more grey when you are not using the 3rd party for communication but for storage, say for emails you have read and leave on the server for 180+ days. [1]
So in this case Congress wanted to establish a new right to privacy that required a warrant on rather vague and nebulous grounds. It was dropped and so the status quo remains.
All the people here complaining apparently have no idea what the law of the land currently is? Email communications residing on a third-party server for less than 180 days that offers services to the public can not be obtained without a warrant. Notification of the issuance of a warrant could be delayed by 90 days. This does not apply to 3rd party services that do not offer services to the public. They can voluntarily disclose content at their whim.
If you believe my understanding to be flawed I welcome the opportunity to be corrected.
[0]: https://www.eff.org/deeplinks/2010/12/breaking-news-eff-vict...
[1]: http://en.wikipedia.org/wiki/Stored_Communications_Act#Overv...
From Wikipedia [1]: "Property is generally deemed to have been abandoned if it is found in a place where the true owner likely intended to leave it, but is in such a condition that it is apparent that he or she has no intention of returning to claim it."
I'm winging it here, but Gmail could have an optional feature to prompt every three months "do you claim your mail from January 2005 to December 2012?", and just answer yes every time. Then Google could respond to be subpoena that the user has no mail that has not been claimed in 180 days.
Any lawyers here who can come up with something more solid?
[1] http://en.m.wikipedia.org/wiki/Lost,_mislaid,_and_abandoned_...
(Be nice if you had some contact info on your profile)
It's puzzling to think about why Warshak wasn't appealed to the Supreme Court (SC), where a decision would have federal instead of regional consequences. The Justice Department most likely felt such a move could easily end in the SC siding with the Sixth, ending the free lunch on electronic communications seizures that law enforcement currently enjoys.
Google unlike most other email providers is going through the content of every email (I assume prior to its being read by the user) and indexing its contents for the purposes of determining relevant advertising (and whatever else they do with that info about which I admittedly know very little).
I would wager that those indexes might fall under the "log" rather than "content" aspect and therefore their production would not be subject to warrant if they are keeping it stored somewhere; but, that's for someone receiving a higher pay grade to determine.
Cert for Warshak was not sought by either party most likely because the outcome of the appeal was largely in the govt's favor. Most of the convictions stood while only some were remanded. So I imagine it wasn't in either parties' best interest to roll the dice again. Finally, the precedent established in Warshak is applicable in the other horizontal jurisdictions. I would find it hard to believe any of the other appellate courts would go against its sound reasoning. But I guess the point stands that if you want to be safe you should ensure your servers reside in the jurisdiction of the Sixth!
The problem is 2703(f). It allows a government entity to request a snapshot of a user's account "pending the issuance of a court order or other process", meaning that 180 days later, the government can just issue a subpoena - they get their foot in the door and then come back later with the lowered bar, and only need a subpoena. Same effect as not having warrant protection. http://www.law.cornell.edu/uscode/text/18/2703
It's important to point out that the 90-day notification can be renewed indefinitely, pursuant to 2703(f)(2), which is probably a breach of what the 4th Amendment intended.
I'm sure the irony that such an important case is based on the illegal money laundering of a company peddling a penis-enlarging drug scam will not be lost. Remember Enzyte and the smiling Bob ads? I'm still amazed how easily they got so many merchant accounts given their chargeback rates but I guess that's what fraud will get you.
[0]: http://www.ca6.uscourts.gov/opinions.pdf/10a0377p-06.pdf (concurring opinion begins at page 95).
Oh? And what addresses the NSA getting a copy of all traffic on the Internet?
Do you really think some silly rules on "unopened e-mail" matter at all?
A period of time observing the sausage-making process of crafting and passing law may be quite a wakeup call for Jane Q. Public....
The way the media sensationalizes some of these shootings, it's like we have to live in a constant state of fear.
Ironically, I feel the same way about the US since 9/11: I'd rather freely run my yap about (politics of) the country on the internet and not ever set foot there, than visit it and risk my freedom. Which makes me sad, because I know it has many great people in it... but a lot of things would have to change rather drastically for me to revise this.
Worth separating the people from their government, although I would argue that in a democracy the government is the voter's fault. But it seems to me that the US government / establishment fears and hates its own population as much as it does foreigners.
I kinda wish Americans would wake up and see the monster, then do something about it. If the US establishment starts treating its own people better, that might fan out internationally for everyone's good. Not least, Americans.
But then, as I say, the US is supposed to be a democracy, so presumably they have what they want already. So, er, fair enough. Who am I to suggest otherwise?
Are there any useful options that encrypt email?
EDIT: As mentioned a few times elsewhere on this thread, the biggest barrier to encrypted email adoption is the network effect, ie. both ends need to be using it. That is the core problem we're trying to solve--making an email system that would be better than the rest even if it weren't encrypted, but that's the icing on the cake.
The reason it's 2012 and there's still no universal solution for encrypting email is that it's a hard problem. If you care about the security of your mail, you should use GPG.
We'll be posting more information about the whole thing soon, but if anyone has any questions I'm always happy to discuss what we're doing either by email (in my profile) or (at risk of derailing the thread) here.
EDIT: Also, Parley uses OpenPGP. People who are happy with their PGP/GPG setup should continue using it, but the goal is to create a compatible service which those people would feel comfortable recommending to less tech-savvy friends.
We would eventually like to offer multiple options for server location, but that isn't feasible in the short term.
I know you preach encryption, but there is a lot that can still be subpoenad outside of the encrypted message payloads, such as login IP addresses, destination email adresses, frequency of messages, etc.
Hopefully, we'll get to it, but if another startup gets there first we'd be much obliged ;) In the meantime we will focus on the big problem that's already right in front of us; I would encourage anyone who needs to operate outside of US legal influence to use a different mailserver (perhaps their own) and manage their own PGP keys.
The fact that your code will (?) be opensourced, is a big +1 The fact that it's secure by design is a big +1
Count me in, and go defeat gmail, icloud, and all those monstrosities,... one user at a time !
Edit: Send me a message if you get it running and I'll reply, BM-2nftGCPpQ9HtjwJgbZfSFhPHqiJbJK7pwvi
My suggestion would be to more or less ignore the sock puppet of the day and instead pay attention to interest groups and whatnot. Those don't change nearly as much as the faces or slogans that are put on stuff.
Does this also apply to email, that is stored on a server that I rented or bought?
Am I supposed to delete all email after I read it?
Is this just my impression? Is the pendulum ever going to swing back?
Use https://receiveee.com for all of your illicit emailing.
See https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2...
So, if that's the way you feel about it, the time to stop using free text email was 1986, when ECPA was first passed.
Maybe it's time we took a stand -- no communication unless it's encrypted or face-to-face.
A government that does those sort of things is bad in other ways too -- and can get your ass to wherever it wants at any time.
So, if you cannot trust the government not to do these things, then I suggest you try to change the government and the way things are done, instead of trying to hide from them with encryption or whatever.
If one doesn't respect personal privacy as official policy then all government organizations will ship their logs to that country for decryption/de-obfuscation/de-whatever -- just the same as tax policies and Cayman Islands et al being 'tax havens.'
As for encryption advocacy attracting unwanted attention: I don't give a damn.
He's invisible again.
Please, if anyone knows a simple, yet elegant solution, I'm all ears.
You could use a hosted email service in another country where the american authorities don't have easy access. Europe might be an option. However, as with hosting your own email server, that's only a partial solution: If you communicate with other people, your mail is not only stored in your inbox but also in their outbox. So they'd have to use a mail provider outside the US as well - see the first paragraph.
The best is probably a hybrid solution: Try to educate as many people to use encrypted mail as you can and use a mail server that's located outside the US. It doesn't provide 100% protection, but at least you're not part of the dragnet search.
Using a mailserver in a foreign jurisdiction makes it more open to legal interception by the US government; not less.
To receive mail, you could setup Haraka (a very simple NodeJS smtp server)[1] on any unix instance (such as AWS micro). You'll need to set proper MX records for your domain and a few simple configurations. If Heroku would let you specify a port (specifically, 25), you would be able to host on Heroku's free plan. This may put you back at odds by hosting your data on AWS (third-party). Also, you would likely need to setup a POP server to download your messages from the server.
I would call it a server under your control, the same as a store in a strip mall is under your control, not the mall owner.
But which way does anyone think that's going to go? Not the right way is my assumption.
However, if all your data is encrypted once it rests on the box, you'll at least know you're being probed when they subpoena your keys.
I'm all ears too.
Edit:
Here are the docs for the latest 7.1 branch: http://doc.zarafa.com/7.1/
And here is the link to the community (open source) section of their site: http://community.zarafa.com/
The webmail interface is the best opensource one I've come across (easily beats redcube) and active sync works fine with iphone 4/5 and android.
You have expressed your contempt for people who don't run their own mailservers; but your contempt is only an ego assertion. Your contempt, unless based on facts, and rational arguments taking into account the reality of people who have other things to do than learn whatever esoteric skills you've chosen to base your self-worth around; is of no interest to the rest of the people reading HN.
I run my own mailserver; therefore you should listen to me.
if the above statement seems ridiculous (which it is), it is merely the mirror of your original assertion.
Second, there's nothing I'm asking you to "listen to". My point was that a lot of the wringing of hands and gnashing of teeth has no legitimacy without having taken the simplest, most elementary, first order step towards fixing this problem.
Come back and complain about your bad roast after you've actually ... you know ... turned your oven on.
As I and others pointed out your most basic step does not solve the problem and you can just move to a different provider that is not subject to American laws to have the hsame effect.
You're also not required to have any technical skills at all to gnash your teeth about a government that tries to expand surveillance in every possible place. For some places you might have a technical solution such as running your own mail server at home, but what are you going to do once hacking of mail servers without a warrant is permitted and common place? Counter-Hack? As hackers we try to find technical solutions to social problems, but that's not going to work out in every place.
As I said, Joe 6 pack has an excuse (just like Joe Startup has an excuse not to be cultivating his own heirloom seeds).
And yes, I'm aware that email as a whole is just a mess, and that running my own mail server does nothing to combat a global observer that can just intercept all traffic anyway... but the big, big win is that my entire existing email history cannot be extracted by any LEA in the country (and possibly foreign) without my even knowing about it. The local sheriff cannot subpoena my entire email history. They have to come to me.
Another huge win is that you can communicate with others that share your mailserver without the email leaving the system - which thwarts even a global observer. It may interest you to know that no piece of rsync.net intra-company email has ever traversed any network.
Where can I get a pair of size 47 shoes, a banana-yellow suit, and a lime-green wig? I am a programmer, not an IT administrator. I know nothing about which patches are required to keep a server secure, nor should Ihave to.
Being familiar with the technology for making programs has the same relationship to maintaing a publicly facing server as being familiar with the technology for making buildings has with operating a property-management, real-estate leasing, and property security firm all in one.
It's great that you and many others have these skills, it's not a dichotomy, but they are loosely related.
Yes, Google-Yahoo-MSN, they have the best spam filters because they receive more spam than anyone--that allows them to identify it faster and more accurately. I doubt SpamAssassin will ever match them. Wasn't very effective for me, false-positives are the worst. And seems to me a mail server is just another open door for hackers and spammers to walk in and use your memory and CPU 99.99% of the day. So call me a clown-person. Like someone already said, mail servers are cryptic, complex and unwieldy and I think that's been true since at least the 90s. Not to mention, webmail is really convenient and fast and reliable. Last time I used an email client was the time I had to download 200 worms from POP before I could see my real email.
And unless you host the server in your residence (disallowed on most residential ISPs), you're still not going to have control over whether someone has a warrant or not when they look at your mail.
The answer is "encrypt all messages". Every other day I could comment on a post to which the answer is "encrypt [thing]". PGP is so important and yet it's nearly impossible to get anyone to use it.