The MercuryNews has a good article on the subject of the new federal push for data retention policies at ISPs. As I have written in the past on the subject, there are a lot of security and privacy implications because the data that can be gleaned from raw packet dumps or proxy logs is enough to attract unscrupulous cops and criminals. It would be the ultimate repository of information for identity thieves.
It's not hard for your ISP to keep a record of all of the HTTP (web) traffic that goes through it. The logs would not be too big, and a 50GB-100GB hard drive would be more than enough for them to use for storing the logs for at least a few months in between backups. One of the problems is that unless you send a username and password to a website that is using SSL, your username, password and all other personal information will go unencrypted into that log file.
One of the security risks here is that the police could potentially in the name of national security or "emergency" do the Internet equivalent of a no-knock raid on your accounts using this information. If your webmail provider doesn't use SSL, they could read all of your email without having to get the provider to comply with their demands. There would be simply no way for them to get caught unless somehow the provider notices something funny while checking access logs for errors or something like that.
The slippery slope gets very steep here, very quickly because log files are not very difficult to parse and do simple, regular analyses on a regular basis. In fact, a 50GB HTTP proxy log that is stored in plain text could be processed on a weekly, or even daily, basis with a ten year old computer running Linux using a simple Python script.
As long as the DoJ does not ask for packet dumps, I have a suspicion that they will be able to make headway with this. Packet dumps would cause them to record everything that goes through their networks, and would give the ISPs basic business grounds to complain to Congress. Simply logging HTTP transaction data, IM protocols, email and usenet would not be such a burden on the average ISP that the DoJ would face an insurmountable obstacle in getting what it wants.
Leave a comment