No New Surveillance Powers For The War On Drugs

At two hearings over the past month, including one yesterday, senior officials from the Department of Justice asked Congress to significantly expand its ability to monitor and investigate the online communications of Americans.

Law enforcement officials claim that it is too difficult to snoop on users of modern services like Skype, Blackberry, Facebook and Google, as the companies have not built wiretap capabilities into their services. The Department of Justice would also like wireless and residential Internet Service Providers to keep records that would make it easier to determine after-the-fact which particular customer visited specific websites.

These officials argue that technology companies should be required to build new surveillance capabilities in order to more effectively investigate child pornographers and terrorists. This is a politically savvy argument, as no member of Congress will want to risk appearing weak on terrorism or child pornography.

The reality is that most law enforcement surveillance powers are used in support of the war on drugs, not to investigate terrorists or pedophiles. As such, Congress should first demand reliable statistics on law enforcement’s existing Internet surveillance activities before even considering the FBI’s request for more powers.

The American public may be willing to give up their privacy and civil liberties in order to actually prevent terrorism and the sexual exploitation of children. This deal is far less attractive if the new surveillance powers will instead be used to to continue a failed prohibition opposed by millions of Americans.

Statistics are useful

Each year, federal and state law enforcement agencies obtain thousands of court orders that allow them to secretly wiretap the telephones of American citizens. We know this because Congress requires annual reports regarding the use of these surveillance powers.

The first documented instances of law enforcement wiretaps were used to investigate bootleggers during the prohibition. Decades later, as the wiretap reports confirm, the vast majority of intercepts are used to enforce our modern day prohibition: the war on drugs. For example, of the 2,376 wiretap orders issued in 2009, 86% (2,046) were obtained as part of narcotics investigations.

Similarly, of the 763 “sneak and peek” search warrants obtained in 2009, 474 were obtained in investigations of drugs, and only 3 were used in investigations of terrorism. These surveillance orders allow government agents to search a home without telling the owner or resident until weeks or months later. Law enforcement agencies were given this authority as part of the Patriot Act, after the Department of Justice claimed that the powers were necessary to allow “law enforcement to conduct investigations without tipping off terrorists.” However, a report published by the Administrative Office of the Courts in 2009 revealed that the powers are primarily used to investigate drugs, not terrorism.

Unfortunately, while accurate statistics exist for wiretaps, and for the sneak and peek authority granted as part of the Patriot Act, we are largely in the dark regarding most of the tens of thousands of requests made each year to phone companies and Internet service providers. There are no statistics that document law enforcement requests for email, instant messaging, social network profiles, search engine history, or geographic location information from mobile phones.

Not only do we have no way of knowing the total number of requests made by law enforcement officers each year, but we also do not know what kinds of crimes they are investigating. Instead, all we have are unverifiable anecdotes from law enforcement officials, who selectively reveal them in order to justify their push for increased surveillance powers.

If the statements of law enforcement officials are to be believed, most of their online investigations involve child pornography. However, the published statistics for other forms of surveillance suggest that they are likely in support of the war on drugs. The only way to be sure would be for Congress to require the collection and publication of statistics covering law enforcement agencies’ surveillance of Internet applications and communications. As Senator Leahy noted more than 10 years ago, surveillance statistics serve as a “more reliable basis than anecdotal evidence on which to assess law enforcement needs and make sensible policy in this area.”

Rather than granting the Department of Justice the sweeping new surveillance powers it seeks, Congress should first seek and obtain detailed reports on the use of modern surveillance techniques. There is no need to rush the passage of new authority; especially since, as the debate over the renewal of the Patriot Act has clearly demonstrated, rolling back powers is much tougher than granting new ones.

Which US cable providers have privacy preserving data retention policies?

The decision to not retain logs of its customers' IP addresses is one of the best ways that a company can proactively take a stand in defense of user privacy. Two of Sweden's largest residential ISPs have adopted such policies, with one even taking the additional step of routing all its customers data through an encrypted VPN service in order to anonymize the source of the traffic.

Here in the US, it is unfortunate that Internet Service Providers seem unwilling to embrace such aggressive, pro-user data deletion policies. Instead, firms like Google make full use of Doublespeak in order to justify their retention of user data (Those IP addresses we keep? Yeah, they're not really private information. Quick, look over there! We've created self-driving cars).

However, even if US service providers have not embraced privacy, it appears that one or two firms have enacted policies that as a perhaps perhaps unintentional side-effect do significantly enhance their users' privacy.

At a data retention hearing in the House of Representatives last week, Jason Weinstein, a deputy assistant attorney general in the Department of Justice testified. Half-way through his written remarks is this interesting fact:

"One mid-size cell phone company does not retain any records, and others are moving in that direction. A cable Internet provider does not keep track of the Internet protocol addresses it assigns to customers, at all. Another keeps them for only seven days."

As I described in a blog post last week, the mid-size cell phone company he mentioned is most likely T-Mobile.

Unfortunately, I have no idea about the identity of the two cable companies he identified.

Since one of these firms keeps no logs at all, none of its customers have been targeted in filesharing lawsuits, and it will not have passed on a single DMCA complaint. Depending on how fast the media companies send out their complaints and lawsuit shakedown letters, it is quite possible that the customers of the second cable company may have escaped such harassment too.

My question to those of you who follow the copyright infringement space is this: Do you know of any cable company whose customers have escaped filesharing lawsuits? If so, it might be because the firm has embraced a zero IP data retention policy.

I'd love to know who this is -- and if I live in their service area, I'd love to give them my business.

Data retention push confirms DOJ hypocrisy

As I described in a lengthy blog post a couple days ago, the US law enforcement community is yet again pushing for mandatory data retention laws, which would require internet service providers to keep records detailing the IP addresses issued to their customers.

At the hearing last Tuesday, Jason Weinstein of the Department of Justice argued that the government needed this data to be able to effectively investigate serious crimes, such as terrorism and child exploitation.

In what truly is a bit of Orwellian doublespeak Mr. Weinstein told the Congressional committee that retaining this data would actually protect privacy:

Unlike the Department of Justice – which must comply with the Constitution and laws of the United States and is accountable to Congress and other oversight bodies – malicious cyber actors do not respect our laws or our privacy. The government has an obligation to prevent, disrupt, deter, and defeat such intrusions. The protection of privacy requires that we keep information from those who do not respect it — from criminals and others who would abuse that information and cause harm.

Investigating and stopping this type of criminal activity is a high priority for the Department, and investigations of this type require that law enforcement be able to utilize lawful process to obtain data about the activities of identity thieves and other online criminals. Privacy interests can be undercut when data is not retained for a reasonable period of time, thereby preventing law enforcement officers from obtaining the information they need to catch and prosecute those criminals. Short or non-existent data retention periods harm those efforts.

My absolute favorite bit of Mr Weinstein's testimony is the first sentence above:

Unlike the Department of Justice – which must comply with the Constitution and laws of the United States and is accountable to Congress and other oversight bodies

What I love, is the fact that Mr. Weinstein was able to repeat this complete and total lie, under oath, without ever once cracking a sheepish smile, or showing any sign of embarrassment.

From The Washington Post, January 19, 2010:

The FBI illegally collected more than 2,000 U.S. telephone call records between 2002 and 2006 by invoking terrorism emergencies that did not exist or simply persuading phone companies to provide records, according to internal bureau memos and interviews... A Justice Department inspector general's report due out this month is expected to conclude that the FBI frequently violated the law with its emergency requests, bureau officials confirmed.... FBI general counsel Valerie Caproni said in an interview Monday that the FBI technically violated the Electronic Communications Privacy Act when agents invoked nonexistent emergencies to collect records.

The Washington Post, January 21, 2010:

FBI agents for years sought sensitive records from telephone companies through e-mails, sticky notes, sneak peeks and other "startling" methods that violated electronic privacy law and federal policy, according to a Justice Department inspector general report released Wednesday.

The study details how the FBI between 2002 and 2006 sent more than 700 demands for telephone toll information by citing often nonexistent emergencies and using sometimes misleading language. The practice of sending faulty "exigent" letters to three telecommunications providers became so commonplace that one FBI agent described it to investigators as "like having an ATM in your living room."

The New York Times, March 10, 2007:

Bipartisan outrage erupted on Friday on Capitol Hill as Robert S. Mueller III, the F.B.I. director, conceded that the bureau had improperly used the USA Patriot Act to obtain information about people and businesses...

The report found many instances when national security letters, which allow the bureau to obtain records from telephone companies, Internet service providers, banks, credit companies and other businesses without a judge’s approval, were improperly, and sometimes illegally, used.

Moreover, record keeping was so slipshod, the report found, that the actual number of national security letters exercised was often understated when the bureau reported on them to Congress, as required.

The Washington Post, October 24, 2005:

The FBI has conducted clandestine surveillance on some U.S. residents for as long as 18 months at a time without proper paperwork or oversight, according to previously classified documents to be released today.

These reports only detail violations of the law during the last few years. Such abuses are not a new phenomenon though - the Department of Justice has abused its powers to illegally spy on Americans as long as the agency has existed.

Furthermore, in spite of the numerous instances in which it was confirmed that FBI agents and DOJ officials violated the law and engaged in illegal surveillance, I can't think of a single instance where they (or the telecommunications carriers that collude in their crimes) have been arrested or prosecuted for doing so. Instead, they get a slap on the wrist, and then it is back to business as usual.

One rule for us, one rule for them

The push for data retention seems to be currently limited to IP address allocation records, but, if successful, it will almost certainly extend to non-content information associated with email, chat and instant messaging communications.

The hypocrisy of the government's push for such data retention is clear when compared to the extreme efforts that government agencies go to in order to shield their own communications, documents and other records from the American people.

Consider for a moment, that this president, like Bush and Clinton before him, does not send any emails. The reason for this? Because such emails would have to be retained under the Presidential Records Act. Rather than let the American people later see a record of his official communications, he simply avoids email, and instead does everything by phone or in-person.

Of course, in this day and age, most people do not have the luxury of going without email. Private citizens, corporations and government employees alike rely on email to go about their daily business. However, while the email accounts that consumers rely on increasingly keep their communications forever (due to essentially unlimited storage), companies and government agencies are increasingly embracing data deletion policies in order to limit the risk that their emails will later see the light of day, due to lawsuits or FOIA requests.

For example, starting in the spring of 2010, the Federal Trade Commission (where I worked until August of 2010) adopted a 90-day email deletion policy. Any email messages that employees did not specifically mark to be saved would be automatically deleted after 90 days. This policy creates a significant barrier for public interest groups wishing to learn about the activities of the agency.

At the FTC, all records about particular investigations are shielded from disclosure as long as the investigation is active. However, since most investigations take 6 months or more, by the time the investigation is eventually made public, many email messages will have already been deleted.

Quite simply, government email deletion policies are specifically designed to circumvent and neutralize open government laws, such as the Freedom of Information Act.

I am sure that the FTC is not the only government agency to embrace an aggressive data deletion policy, and at least right now, there is nothing that legally prohibits agencies from adopting such policies.

This would be a great issue for pro-transparency, pro-oversight House Republicans to tackle. Perhaps once the administration is forced to reveal its own official communications to the whole world, then maybe it'll be a bit more sympathetic to the efforts of privacy groups and corporations that wish to protect privacy of regular users.

DOJ's push for data retention & competing on privacy

On Tuesday, January 25, 2011, the Republican controlled House Subcommittee on Crime, Terrorism and Homeland Security held a hearing on the topic of data retention. Chairing the hearing was Jim Sensenbrenner, the author of the much-loved USA Patriot Act.

The video of the hearing is online as is the written testimony of Jason Weinstein of the Department of Justice.

Data retention is (for most people) an obscure and boring topic, even if it has a significant impact on end user privacy. As such, I want to try and analyze DOJ's latest attempt to kickstart the debate about this issue, in order to enable those watching at home to understand the politics at play.

A gentle introduction to the DOJ increased powers playbook

The Department of Justice is actually fairly predictable, and each time it calls for increased powers, it follows the same formula.

First, it will repeatedly mention one or two horrific crimes that everyone in society agrees are awful (usually terrorism and child pornography), and claim that those committing these crimes are not getting caught because of the issue at hand.

Second, the government will put out a couple examples, which have never before been disclosed to the public (even if they are several years old), in which horrible things happened because the government didn't have the information or power it now wants.

Third, the government will highlight companies that currently have particularly bad practices (but without naming those firms), and may also specifically identify one or two companies whose practices are excellent, and that should be models for the entire industry.

Fourth, the government will completely dismiss the concerns of the privacy community.

This formula has been used, just in the last couple years, to try and require emergency, warrantless disclosure of cell-tower data, mandatory registration of prepaid mobile phones, and back doors in encryption technology.

Why doesn't DOJ name names?

One of the most interesting things for me, is the practice of not naming names. That is, while the specific problematic practices may be discussed in some detail, the companies that are currently not doing what the government wants are rarely named by the government, either in testimony before Congress, or through the intentional leaks to the government-friendly journalists that are used to seed the debate.

Consider the following quote from yesterday's testimony:

"One mid-size cell phone company does not retain any records, and others are moving in that direction. A cable Internet provider does not keep track of the Internet protocol addresses it assigns to customers, at all. Another keeps them for only seven days—often, citizens don’t even bring an Internet crime to law enforcement’s attention that quickly."

Or, from a New York Times article last year:

Starting in late 2008 and lasting into 2009, another law enforcement official said, a "major" communications carrier was unable to carry out more than 100 court wiretap orders. The initial interruptions lasted eight months, the official said, and a second lapse lasted nine days.

This year, another major carrier experienced interruptions ranging from nine days to six weeks and was unable to comply with 14 wiretap orders. Its interception system "works sporadically and typically fails when the carrier makes any upgrade to its network," the official said.

The official declined to name the companies, saying it would be unwise to advertise which networks have problems or to risk damaging the cooperative relationships the government has with them. For similar reasons, the government has not sought to penalize carriers over wiretapping problems.

Even though the government could significantly increase the pressure on particular firms by naming them, it (wisely) doesn't do so. The reason is that the law gives companies a significant amount of flexibility in the way that they design their networks, the data that they voluntarily retain, and over the warrantless disclosures made to government investigators when they claim an emergency. The government knows that if it plays hardball with these firms, they are perfectly within their rights to stop voluntarily retaining data, and insist on a valid court order or other legal process whenever the government wants to investigate one of their customers.

Naming names

Even though the government won't identify the companies with "good" and "bad" data retention practices, there is nothing stopping me from doing so.

In his testimony, Mr Weinstein stated that "One mid-size cell phone company does not retain any records". If I had to guess, I would bet that Mr. Weinstein is speaking about T-Mobile, which is the largest carrier I know of that does not keep IP allocation logs.

At the ISS World surveillance conference in 2009, I made an audio recording of a panel which featured executives from several telecommunications companies speaking about their relationship with law enforcement agencies, and their own data retention practices (the audio recording of the panel is available here). At that event, a representative from Cricket Communications (a relatively small pre-paid carrier aimed at low income users) told the audience that:

"One of the challenges for Cricket, and a challenge for the law enforcement community, is that we now have broadband and internet access from the handset. And in both instances, the signal goes to our switch, and then is relayed to Level 3 Communications, which then is the conduit to the Internet. From the outside, from the point of capture of the IP address, it is the generic or regional IP address that is picked up. There is no way to come back through our firewall to see which subscriber had a per-session identification on that, and that is something that even if you go to Level 3, they’re not going to have any information either."

T-Mobile's director of law enforcement relations spoke next, and revealed that his company was largely in the same position:

"[T-mobile is] in the same boat that Cricket is, in terms of determining the IP address --- determining the subscriber attached to that IP address.”

Contrast this to the approach taken by Sprint:

Nextel’s system, they statically assign IP addresses to all handsets ... We do have logs, we can go back to see the IP address … On the Sprint 3G network, we have IP data records back 24 months, and we have, depending on the device, we can actually tell you what URL they went to ... If [the handset uses] the [WAP] Media Access Gateway, we have the URL history for 24 months ... We don’t store it because law enforcement asks us to store it, we store it because when we launched 3G in 2001 or so, we thought we were going to bill by the megabyte ... but ultimately, that’s why we store the data ... It’s because marketing wants to rifle through the data.

Unfortunately, representatives from Verizon an AT&T didn't appear at that conference, and so I don't have an on the record statement from those firms describing their IP allocation policies. Luckily, a slide presentation for the law enforcement community detailing Verizon's data retention policies leaked onto the Internet.


From this, it is clear that Verizon keeps logs on the individual IP addresses given to users for a 1 year period, and, even more troubling, it appears that the company retains the "destination" addresses of all sites that its users visit from their mobile handsets for 30 days.

Finally, while we do not know AT&T's data retention policy, this 2009 study by a team at Microsoft Research confirms that AT&T wireless users are at least given individual IP addresses (as compared to the NAT-based scheme that T-Mobile and Cricket use). As such, the only question is if AT&T chooses to retain these IP address allocation logs (and given the company's repeated collusion with law enforcement and intelligence agencies, I think it is fair to assume that it does keep them.)

Competing on privacy

Over the last few years, firms in a few specific markets have begun to compete on privacy. For example, just in the last month, three of the four main web browsers have each announced privacy enhancing features designed to protect their users from online tracking.

Unfortunately, even though telecommunications firms' data retention policies differ in ways that significantly impact end user privacy, these companies do not compete on these differences, and often go out of their way to keep this information secret. Were it not for the work of activists and whistleblowers inside the firms who have leaked key documents, we would never know some of these details.

This widespread lack of public information about data retention policies poses a significant problem for consumers wishing to evaluate potential service providers on their respective privacy merits. Furthermore, differences among providers operating in the same market do vary considerably, which means that the decision to pick a particular service provider can have a significant impact on a user’s privacy.

As a result of these policies, for example, a Sprint Nextel customer can be later tracked down based on an anonymous comment left on a blog, or a P2P file downloaded over the company’s cellular network, while customers of T-Mobile and Cricket can freely engage in a variety of online activities without any risk of later discovery.

This lack of public information about key privacy differences would be bad enough if the firms generally kept quiet about the general topic of privacy. However, these companies actually proudly boast about their commitment to protecting user privacy, while simultaneously going out of their way to keep the substantive details of their practices (and often, their collusion with government surveillance) secret.

Consider, for example, the following statements by Verizon:

"Verizon has a longstanding and vigorous commitment to protecting its customers’ privacy and takes comprehensive steps to protect that privacy."

"At Verizon, privacy is a key priority. We know that consumers will use the full capabilities of our communications networks only if they trust that their information will remain private."

Strangely enough, the Verizon has also argued in court that it has a First Amendment right to voluntarily provide information about its customers’ private communications to the National Security Agency. This may be a valid legal argument, but it is not the kind of position that a company that has pledged to protect users’ privacy should take. Certainly, it is not an official position that the company advertises to its customers on its website or in its privacy policy. Likewise, nowhere on Verizon's website does the company disclose the $1.8 million dollars it has received per year to provide the FBI with "near real-time access to [two years of stored] United States communications records (including telephone and Internet records)."

Why the silence on data retention matters

The fact that most companies do not compete, or even publicly disclose their data retention policies means that the government has the upper-hand in any effort to get firms to retain more data, or keep it for longer periods.

Over the last year or two, multiple wireless carriers have extended the retention period for historical cell site location information. Retention periods of six months to one year for cell site data are now common across the industry, a significant increase over the 30 days or less that the data was retained two years ago.

These companies faced no push-back from consumers or privacy groups when they extended these retention periods, because consumers were never told that it happened.

Likewise, between 2007 and 2008, MySpace and Facebook both increased their data retention periods for user login IP session data. In 2006, MySpace logged IP addresses associated with account logins for 90 days. In 2007, the company expanded its logging of this data to 1 year. Facebook logged IP addresses for 30 days in 2007, but by 2008, the company had opted to keep the logs for 90 days.

Bringing this back to the current debate -- because T-Mobile doesn't compete on privacy, and because its customers are often unaware of the advantage benefit they receive from the firm's current IP network design, the firm has no real incentive to resist pressure from the government to retain data. The only real sticking point for the company, I suspect, will be cost of modifying its network to permit it to uniquely identify and track its users. As such, I fully expect T-Mobile (and any other companies that DOJ leans on) to quietly fold, and establish voluntary data retention policies that are long enough to keep the government happy.