Which US cable providers have privacy preserving data retention policies?

The decision to not retain logs of its customers' IP addresses is one of the best ways that a company can proactively take a stand in defense of user privacy. Two of Sweden's largest residential ISPs have adopted such policies, with one even taking the additional step of routing all its customers data through an encrypted VPN service in order to anonymize the source of the traffic.

Here in the US, it is unfortunate that Internet Service Providers seem unwilling to embrace such aggressive, pro-user data deletion policies. Instead, firms like Google make full use of Doublespeak in order to justify their retention of user data (Those IP addresses we keep? Yeah, they're not really private information. Quick, look over there! We've created self-driving cars).

However, even if US service providers have not embraced privacy, it appears that one or two firms have enacted policies that as a perhaps perhaps unintentional side-effect do significantly enhance their users' privacy.

At a data retention hearing in the House of Representatives last week, Jason Weinstein, a deputy assistant attorney general in the Department of Justice testified. Half-way through his written remarks is this interesting fact:

"One mid-size cell phone company does not retain any records, and others are moving in that direction. A cable Internet provider does not keep track of the Internet protocol addresses it assigns to customers, at all. Another keeps them for only seven days."

As I described in a blog post last week, the mid-size cell phone company he mentioned is most likely T-Mobile.

Unfortunately, I have no idea about the identity of the two cable companies he identified.

Since one of these firms keeps no logs at all, none of its customers have been targeted in filesharing lawsuits, and it will not have passed on a single DMCA complaint. Depending on how fast the media companies send out their complaints and lawsuit shakedown letters, it is quite possible that the customers of the second cable company may have escaped such harassment too.

My question to those of you who follow the copyright infringement space is this: Do you know of any cable company whose customers have escaped filesharing lawsuits? If so, it might be because the firm has embraced a zero IP data retention policy.

I'd love to know who this is -- and if I live in their service area, I'd love to give them my business.

Data retention push confirms DOJ hypocrisy

As I described in a lengthy blog post a couple days ago, the US law enforcement community is yet again pushing for mandatory data retention laws, which would require internet service providers to keep records detailing the IP addresses issued to their customers.

At the hearing last Tuesday, Jason Weinstein of the Department of Justice argued that the government needed this data to be able to effectively investigate serious crimes, such as terrorism and child exploitation.

In what truly is a bit of Orwellian doublespeak Mr. Weinstein told the Congressional committee that retaining this data would actually protect privacy:

Unlike the Department of Justice – which must comply with the Constitution and laws of the United States and is accountable to Congress and other oversight bodies – malicious cyber actors do not respect our laws or our privacy. The government has an obligation to prevent, disrupt, deter, and defeat such intrusions. The protection of privacy requires that we keep information from those who do not respect it — from criminals and others who would abuse that information and cause harm.

Investigating and stopping this type of criminal activity is a high priority for the Department, and investigations of this type require that law enforcement be able to utilize lawful process to obtain data about the activities of identity thieves and other online criminals. Privacy interests can be undercut when data is not retained for a reasonable period of time, thereby preventing law enforcement officers from obtaining the information they need to catch and prosecute those criminals. Short or non-existent data retention periods harm those efforts.

My absolute favorite bit of Mr Weinstein's testimony is the first sentence above:

Unlike the Department of Justice – which must comply with the Constitution and laws of the United States and is accountable to Congress and other oversight bodies

What I love, is the fact that Mr. Weinstein was able to repeat this complete and total lie, under oath, without ever once cracking a sheepish smile, or showing any sign of embarrassment.

From The Washington Post, January 19, 2010:

The FBI illegally collected more than 2,000 U.S. telephone call records between 2002 and 2006 by invoking terrorism emergencies that did not exist or simply persuading phone companies to provide records, according to internal bureau memos and interviews... A Justice Department inspector general's report due out this month is expected to conclude that the FBI frequently violated the law with its emergency requests, bureau officials confirmed.... FBI general counsel Valerie Caproni said in an interview Monday that the FBI technically violated the Electronic Communications Privacy Act when agents invoked nonexistent emergencies to collect records.

The Washington Post, January 21, 2010:

FBI agents for years sought sensitive records from telephone companies through e-mails, sticky notes, sneak peeks and other "startling" methods that violated electronic privacy law and federal policy, according to a Justice Department inspector general report released Wednesday.

The study details how the FBI between 2002 and 2006 sent more than 700 demands for telephone toll information by citing often nonexistent emergencies and using sometimes misleading language. The practice of sending faulty "exigent" letters to three telecommunications providers became so commonplace that one FBI agent described it to investigators as "like having an ATM in your living room."

The New York Times, March 10, 2007:

Bipartisan outrage erupted on Friday on Capitol Hill as Robert S. Mueller III, the F.B.I. director, conceded that the bureau had improperly used the USA Patriot Act to obtain information about people and businesses...

The report found many instances when national security letters, which allow the bureau to obtain records from telephone companies, Internet service providers, banks, credit companies and other businesses without a judge’s approval, were improperly, and sometimes illegally, used.

Moreover, record keeping was so slipshod, the report found, that the actual number of national security letters exercised was often understated when the bureau reported on them to Congress, as required.

The Washington Post, October 24, 2005:

The FBI has conducted clandestine surveillance on some U.S. residents for as long as 18 months at a time without proper paperwork or oversight, according to previously classified documents to be released today.

These reports only detail violations of the law during the last few years. Such abuses are not a new phenomenon though - the Department of Justice has abused its powers to illegally spy on Americans as long as the agency has existed.

Furthermore, in spite of the numerous instances in which it was confirmed that FBI agents and DOJ officials violated the law and engaged in illegal surveillance, I can't think of a single instance where they (or the telecommunications carriers that collude in their crimes) have been arrested or prosecuted for doing so. Instead, they get a slap on the wrist, and then it is back to business as usual.

One rule for us, one rule for them

The push for data retention seems to be currently limited to IP address allocation records, but, if successful, it will almost certainly extend to non-content information associated with email, chat and instant messaging communications.

The hypocrisy of the government's push for such data retention is clear when compared to the extreme efforts that government agencies go to in order to shield their own communications, documents and other records from the American people.

Consider for a moment, that this president, like Bush and Clinton before him, does not send any emails. The reason for this? Because such emails would have to be retained under the Presidential Records Act. Rather than let the American people later see a record of his official communications, he simply avoids email, and instead does everything by phone or in-person.

Of course, in this day and age, most people do not have the luxury of going without email. Private citizens, corporations and government employees alike rely on email to go about their daily business. However, while the email accounts that consumers rely on increasingly keep their communications forever (due to essentially unlimited storage), companies and government agencies are increasingly embracing data deletion policies in order to limit the risk that their emails will later see the light of day, due to lawsuits or FOIA requests.

For example, starting in the spring of 2010, the Federal Trade Commission (where I worked until August of 2010) adopted a 90-day email deletion policy. Any email messages that employees did not specifically mark to be saved would be automatically deleted after 90 days. This policy creates a significant barrier for public interest groups wishing to learn about the activities of the agency.

At the FTC, all records about particular investigations are shielded from disclosure as long as the investigation is active. However, since most investigations take 6 months or more, by the time the investigation is eventually made public, many email messages will have already been deleted.

Quite simply, government email deletion policies are specifically designed to circumvent and neutralize open government laws, such as the Freedom of Information Act.

I am sure that the FTC is not the only government agency to embrace an aggressive data deletion policy, and at least right now, there is nothing that legally prohibits agencies from adopting such policies.

This would be a great issue for pro-transparency, pro-oversight House Republicans to tackle. Perhaps once the administration is forced to reveal its own official communications to the whole world, then maybe it'll be a bit more sympathetic to the efforts of privacy groups and corporations that wish to protect privacy of regular users.

US Treasury fudges truth on financial privacy

From the New York Times today:

In May, the government will no longer pay someone eligible for benefits with a mailed check. Instead, the money will be electronically deposited directly into a bank account or made accessible by a debit card. And by March 2013, the 10 million people who receive checks, out of 70 million people in all, must switch over to direct deposit or use a card.

...

Some see the decision as government meddling and say they fear their spending habits may be traced. But [David A. Lebryk, commissioner of the Treasury department’s Financial Management Service] said that information could be obtained only with a court order in a "rare exception."

That quote caught my eye, because I don't think it is correct.

In 1976, the Supreme Court ruled in United States v. Miller that bank customers have no legal right to privacy in financial information held by financial institutions. Responding to this ruling, Congress passed the Right to Financial Privacy Act (RFPA).

The RFPA requires that "no Government authority may have access to or obtain copies of, or the information contained in the financial records of any customer from a financial institution unless the financial records are reasonably described" and

1. the customer authorizes access;
2. there is an appropriate administrative subpoena or summons;
3. there is a qualified search warrant;
4. there is an appropriate judicial subpoena; or
5. there is an appropriate written request from an authorized government authority.

Administrative subpoenas are not court orders, and are not reviewed by a judge.

As for the government's claim that such requests will be infrequent, occurring in "a rare exception", as I described at length in a blog post just a couple months ago, the Department of Justice has argued in court that its prospective real-time surveillance of financial transactions is "routine". How exactly can something be both routine and a rare exception?

The truth is that warrantless financial surveillance likely occurs on a massive scale. The American people (and Congress) have no idea that this happens, because the courts are largely not in the loop, and the government is not required to compile or publish any aggregate statistics on the use of such surveillance methods. That is, although there are detailed annual reports on the use of wiretaps and other electronic intercepts by law enforcement agencies, we have no similar orders for the surveillance of our financial transactions.