Anyone with an e-mail account likely knows that police can peek inside it if they have a paper search warrant.
But cybercrime investigators are frustrated by the speed of traditional methods of faxing, mailing, or e-mailing companies these documents. They're pushing for the creation of a national Web interface linking police computers with those of Internet and e-mail providers so requests can be sent and received electronically.
CNET has reviewed a survey scheduled to be released at a federal task force meeting on Thursday, which says that law enforcement agencies are virtually unanimous in calling for such an interface to be created. Eighty-nine percent of police surveyed, it says, want to be able to "exchange legal process requests and responses to legal process" through an encrypted, police-only "nationwide computer network."
The survey, according to two people with knowledge of the situation, is part of a broader push from law enforcement agencies to alter the ground rules of online investigations. Other components include renewed calls for laws requiring Internet companies to store data about their users for up to five years and increased pressure on companies to respond to police inquiries in hours instead of days.
But the most controversial element is probably the private Web interface, which raises novel security and privacy concerns, especially in the wake of a recent inspector general's report (PDF) from the Justice Department. The 289-page report detailed how the FBI obtained Americans' telephone records by citing nonexistent emergencies and simply asking for the data or writing phone numbers on a sticky note rather than following procedures required by law.
Some companies already have police-only Web interfaces. Sprint Nextel operates what it calls the L-Site, also known as the "legal compliance secure Web portal." The company even has offered a course that "will teach you how to create and track legal demands through L-site. Learn to navigate and securely download requested records." Cox Communications makes its price list for complying with police requests public; a 30-day wiretap is $3,500.
The police survey is not exactly unbiased: its author is Frank Kardasz, who is scheduled to present it at a meeting (PDF) of the Online Safety and Technology Working Group, organized by the U.S. Department of Commerce. Kardasz, a sergeant in the Phoenix police department and a project director of Arizona's Internet Crimes Against Children task force, said in an e-mail exchange on Tuesday that he is still revising the document and was unable to discuss it.
In an incendiary October 2009 essay, however, Kardasz wrote that Internet service providers that do not keep records long enough "are the unwitting facilitators of Internet crimes against children" and called for new laws to "mandate data preservation and reporting." He predicts that those companies will begin to face civil lawsuits because of their "lethargic investigative process."
"It sounds very dangerous," says Lee Tien, an attorney with the Electronic Frontier Foundation, referring to the police-only Web interface. "Let's assume you set this sort of thing up. What does that mean in terms of what the law enforcement officer be able to do? Would they be able to fish through transactional information for anyone? I don't understand how you create a system like this without it."
What police see in ISPsKardasz's survey, based on questionnaires completed by 100 police investigators, says that 61 percent of them had their investigations harmed "because data was not retained" and only 40 percent were satisfied with the timeliness of responses from Internet providers.
It also says: "89 percent of investigators agreed that a nationwide computer network should be established for the purpose of linking ISPs with law enforcement agencies so that they may exchange legal process requests and responses to legal process. Authorized users would communicate through encrypted virtual private networks in order to maintain the security of the data."
Some of the responses to other questions: "AT&T is very prompt." "Cox Communications seems to be the worst." "Places like Yahoo can take a month for basic subscriber info which is also a problem." "AT&T Mobility does not keep a log at all." "MySpace give (sic) me the quickest response and they have been very pro-police."
Hemanshu (Hemu) Nigam, MySpace's chief security officer, said in an interview with CNET on Tuesday that: "You can be very supportive of law enforcement investigations and at the same time be very cognizant and supportive of the privacy rights of our users. Every time a legal process comes in, whether it's a subpoena or a search order, we do a legal review to make sure it's appropriate."
Nigam said that MySpace accepts law enforcement requests through e-mail, fax, and postal mail, and that it has a 24-hour operations center that tries to respond to requests soon after they've been reviewed to make sure state and federal laws are being followed. MySpace does not have a police-only Web interface, he said.
Creating a national police-only network would be problematic, Nigam said. "I wish I knew the number of local police agencies in the country, or even police officers in the country," he said. "Right there that would tell you how difficult it would be to implement, even though ideally it would be a good thing."
Another obstacle to creating a nation-wide Web interface for cops--one wag has dubbed it "DragNet," and another "Porknet"--is that some of its thousands of users could be infected by viruses and other malware. Once an infected computer is hooked up to the national network, it could leak confidential information about ongoing investigations.
Jim Harper, a policy analyst at the free-market Cato Institute, says that he welcomes the idea of a police-only Web interface as long as it's designed carefully. "A system like this should have strong logins, should require that the request be documented fully, and should produce statistical information so there can be strong oversight," he says. "I think that's a good thing to have."
11 comments:
I think that for matters of child protection this idea could be very beneficial to police and the children involved. However I do worry about the point presented in the article about the viruses that could possible leak into the national system thus releasing information. I guess I am a little torn on this subject and would have to see more information on it before I had a true opinion. Right now I see this idea as having some very promising pros with a few devastating cons.
I think this concept seems a little risky regarding the leakage of confidential information. There are a lot of potential holes in this proposal that possibly outweigh any benefit.
I can see how an online connection between police officers will be more efficient, but what about cyber criminals? how will they take precautions to prevent them from illegally accessing those files?
I think that there should not be a national web interface for police because anything is hackable and and someone would eventually get into it. I do not think that internet companies should have to store data about their customers because I think that that is a violation of privacy.
Marissa Castillo 3 ----> Its understandable why they want this so badly, especially with how technology is used to manipulate these days. It would be beneficial to get info faster but it may be pushing boundries a bit.
I agree with Jim Harper that a system used for the creation of a national web interface would only be successful if the web page was created carefully with strong security features. This webpage brings modern technology to solving crimes and if used properly, it can be very helpful to the justice system.
I am not in favor of establishing national police only network or nation-wide web to be used by police. The concerns I have include misuse of information obtained under the guise of preventing crime or the information getting in the “wrong hand” when the system is hacked by unauthorized personnel. In addition to above, I think it may violate our rights granted under the Bill of Rights. It could infringe on freedom of speech protected by the first amendment and take away our protection from unreasonable search and seizure as given to us under the fourth amendment. Laws need to be created that would provide information and access such as to e-mails to investigative and prosecutorial divisions with appropriate search warrant without delay. We must balance safety of every citizen and the freedom that our forefathers fought for before establishing and instituting such a program.
There are definite up and down sides to this. I honestly don't care about people going through my stuff, especially if i don't, and never will, know them. From what I understand, the idea is to have a way for police to get whatever information they want or need. That's a little shady, in my opinion, as I don't think every policeman deserves that sort ability- I won't assume they are ALL honorable- not to mention the ability of hackers to access this information could completely turn this around and make it a very dangerous tool. I also think the potenial spread of viruses is alarming. I've gone through a couple of computers already, and it would be extra lame if it were to happen without any control on my part. All that aside, I feel that there are definite pluses to this as well. Internet crimes can be terrible whether it's identity theft or child exploitation and abduction or what have you, and maybe saving others from these crimes is worth the disadvantage to others. I think that this network could be a useful tool in it's time.
I have mixed emotion on this. This police only interface could help open up communication between state-to-state wide police enforcement, for criminals that have traveled around the country, example the amber alert. I also agree with Kardasz, that Internet service providers do not keep records long enough. If they did im sure that the data preservation and reporting could sufficiently help. Although im still iffy about the privacy issue i still think that the amount of assistance that this could bring would be substantial.
I think this is a wonderful idea. Who know's how many crimes could be thwarted through information by email?
It's like everything, there is a positive and a negative to this. On one part, it will be good for the police because they would have something that legitimize them as police and could get information needed faster. But, the negative would be that some people could hack into this and that could cause more trouble than it should because it would be known throughout the US that it is the site officers use. So, I really don't know if this is the best idea.
Post a Comment