February 08 2010
FBI Proposes Subjecting Web To Black Hat Tactics
CNET is carrying a story today about a recurring FBI proposal that Internet Service Providers retain usage data for 2 years. Privacy advocates are up in arms over this proposal, which the FBI has made in years past.
Unfortunately for the privacy community, they lost the battle fourteen years ago when Congress passed the Communications Decency Act of 1996. Most people naively believe the courts struck down this statute, but the most devastating part of the law remains intact. That is section 230, which grants the status of telephone service providers to Internet service providers.
Large ISPs like AOL and Prodigy (neither of whom is the Internet power it once was, btw). Prodigy doesn’t even exist any more — it’s now a part of AT&T (which used to be a real telephone company before it was run out of the business by the U.S. court system). AT&T of course provides wireless and long distance telephone service in addition to Internet service.
What Congress did not understand (or chose to ignore thanks to the high-paid lobbyists who represented the interests of AOL and Prodigy back in the 1990s) is that Internet Service Providers DO NOT ACT LIKE TELEPHONE PROVIDERS.
The telephone company facilitates a transient transaction. Once you hang up the phone your phone call is gone. That is not what happens when you surf the Web or send out email messages. In fact, whereas the phone companies don’t listen in on your conversations Internet service providers regularly filter your email, block or restrict user access to certain sites, take Web sites down, and otherwise participate in the online usage experience.
There but for a lie codified by Congress is a huge engineering distinction between telephone service providers and Internet service providers.
The codification has also withstood at least a few legal challenges, so don’t even hope someone will come along and get it struck down. That ship has sailed and the U.S. courts — ignorant of how Internet services differ radically from the way telephone services function — have ensured that CDA 230 will be around for a long, long time.
So now the FBI is saying they need to be able to track our Web usage for up to 2 years to see if we’ve been visiting child pornography sites. And CDA 230 strengthens their legal reasoning. BUT let me clue everyone in on something: with a few lines of code I can ensure that many thousands of people visit child pornography sites on a frequent, regular basis without their ever knowing it.
You could be rounded up and hauled in to jail because your Internet service provider will show the FBI that your computer visited child pornography sites multiple times. All I have to do is embed some code on a popular Web site that takes the user to the child pornography.
You’ll never see it, but your browser will. There will be no popup windows. Nothing left behind when you close your browser window.
HTML is that powerful and it is capable of making you look like you’re visiting a thousand Websites a day.
A few years ago I worked for a company that had a staffing issue. One of the people who needed access to the Internet was abusing his access to visit pornographic sites at work. The company raked him over the coals, monitored his access, restricted his privileges. He was so persistent that finally the company began monitoring everyone’s Internet usage.
And that was when I was hauled into my boss’ office every month for several months and chewed out for visiting hundreds of Websites a day when I should have been working (never mind the fact I was the most productive employee he had ever hired). He knew I wasn’t sitting there surfing the Web but he couldn’t explain all the Websites showing up under my account.
After a while it sank in to me what was happening: I would frequently leave a browser window open on a major news site. The news site, unbeknownst to me, began refreshing its pages every ten minutes or so, thus reloading all its on-page advertising. When I looked more closely at the tracking reports I began to recognize the domains from my own Internet marketing experience as ad servers and related resources.
My heavy usage was legal and mostly benign (although it used up company bandwidth in the most slothful way). I solved my problem by closing my browser window.
But that experience taught me that user logs don’t tell the whole story. And since becoming more deeply involved with the Internet I’ve learned things that would scare a drunken sailor sober. You have no idea of how easily your Web surfing can be managed and manipulated remotely.
So when the FBI tells Congress they need access to 2 years’ of our history, that tells me the FBI is not ready to police the Internet. They have absolutely no clue as to what they are doing or talking about.
In order to mask their activities child pornographers could easily flood their sites with unknowning traffic from tens of thousands, perhaps millions of innocent people. Instead of strengthening its investigative powers the FBI is proposing the virtual dilution of those powers.
I don’t know how Web-savvy the child pornography community are. But I read the occasional news story about the people who get arrested. They include judges, police officers, lawyers, prosecutors, doctors, and even some state and local lawmakers. They also include people who have been hanging around the Internet for years.
To blithely assume that these people have no knowledge or skill in setting up Websites that are sneaky and malicious is to put the public good at risk, and that is (in my opinion, which is not necessarily shared by my employer or co-workers) extremely irresponsible.
On the Internet there are NO simple tasks and solutions. We are STILL feeling the repercussions of “simple” things that happened in the 1990s. We have absolutely no business enacting new laws that threaten to drag multitudes of innocent people into legal quagmires that will destroy their personal, social, and work lives.
This is NOT the way I want my tax dollars to work.
Written by Michael MartinezDISCLAIMER: The views expressed in this article are strictly those of the author and do not reflect the views or opinions of any other person, party, or entity.
