Authorities Support IP Links to Aid Searches
Source: CNET News
Law enforcement needs only a search warrant to infiltrate an e-mail account but communication in getting to the warrant out and in the files is tricky.
But cybercrime investigators are frustrated by the speed of traditional methods of faxing, mailing, or e-mailing companies these documents. They’re pushing for the creation of a national Web interface linking police computers with those of Internet and e-mail providers so requests can be sent and received electronically.
CNET has reviewed a survey scheduled to be released at a federal task force meeting on Thursday, which says that law enforcement agencies are virtually unanimous in calling for such an interface to be created. Eighty-nine percent of police surveyed, it says, want to be able to “exchange legal process requests and responses to legal process” through an encrypted, police-only “nationwide computer network.” (See one excerpt and another.)
The survey, according to two people with knowledge of the situation, is part of a broader push from law enforcement agencies to alter the ground rules of online investigations. Other components include renewed calls for laws requiring Internet companies to store data about their users for up to five years and increased pressure on companies to respond to police inquiries in hours instead of days.
Data Delivery Times Shortened
What this means to the average user out there is that regardless of what law enforcement officials may be looking for, they would have a new system for requesting that information, including hard drive recovery records from IT solutions companies. They would also be able to access any file viewer programs to track old e-mail and online communications activity in an effort to track leads about everything from the way airline cargo companies are moving packages around to social networking sites among workers at an aerospace or insurance company. And, in a case of a cargo handling company, for example, the so-called “cybercrime investigators” would quickly have access to all records of e-mails and e-correspondence that may have a link to an ongoing terrorism case.
But the most controversial element is probably the private Web interface, which raises novel security and privacy concerns, especially in the wake of a recent inspector general’s report (PDF) from the Justice Department. The 289-page report detailed how the FBI obtained Americans’ telephone records by citing nonexistent emergencies and simply asking for the data or writing phone numbers on a sticky note rather than following procedures required by law.
Some companies already have police-only Web interfaces. Sprint Nextel operates what it calls the L-Site, also known as the “legal compliance secure Web portal.” The company even has offered a course that “will teach you how to create and track legal demands through L-site. Learn to navigate and securely download requested records.” Cox Communications makes its price list for complying with police requests public; a 30-day wiretap is $3,500.
The police survey is not exactly unbiased: its author is Frank Kardasz, who is scheduled to present it at a meeting (PDF) of the Online Safety and Technology Working Group, organized by the U.S. Department of Commerce. Kardasz, a sergeant in the Phoenix police department and a project director of Arizona’s Internet Crimes Against Children task force, said in an e-mail exchange on Tuesday that he is still revising the document and was unable to discuss it.
In an incendiary October 2009 essay, however, Kardasz wrote that Internet service providers that do not keep records long enough “are the unwitting facilitators of Internet crimes against children” and called for new laws to “mandate data preservation and reporting.” He predicts that those companies will begin to face civil lawsuits because of their “lethargic investigative process.”
“It sounds very dangerous,” says Lee Tien, an attorney with the Electronic Frontier Foundation, referring to the police-only Web interface. “Let’s assume you set this sort of thing up. What does that mean in terms of what the law enforcement officer and what they wWould they be able to fish through transactional information for anyone? I don’t understand how you create a system like this without it.”
Kardasz’s survey, based on questionnaires completed by 100 police investigators, says that 61 percent of them had their investigations harmed “because data was not retained” and only 40 percent were satisfied with the timeliness of responses from Internet providers.
It also says: “89 percent of investigators agreed that a nationwide computer network should be established for the purpose of linking ISPs with law enforcement agencies so that they may exchange legal process requests and responses to legal process. Authorized users would communicate through encrypted virtual private networks in order to maintain the security of the data.”
Some of the responses to other questions: “AT&T is very prompt.” “Cox Communications seems to be the worst.” “Places like Yahoo can take a month for basic subscriber info which is also a problem.” “AT&T Mobility does not keep a log at all.” “MySpace give (sic) me the quickest response and they have been very pro-police.”
Hemanshu (Hemu) Nigam, MySpace’s chief security officer, said in an interview with CNET on Tuesday that: “You can be very supportive of law enforcement investigations and at the same time be very cognizant and supportive of the privacy rights of our users. Every time a legal process comes in, whether it’s a subpoena or a search order, we do a legal review to make sure it’s appropriate.”
Nigam said that MySpace accepts law enforcement requests through e-mail, fax, and postal mail, and that it has a 24-hour operations center that tries to respond to requests soon after they’ve been reviewed to make sure state and federal laws are being followed. MySpace does not have a police-only Web interface, he said.
Creating a national police-only network would be problematic, Nigam said. “I wish I knew the number of local police agencies in the country, or even police officers in the country,” he said. “Right there that would tell you how difficult it would be to implement, even though ideally it would be a good thing.”
Another obstacle to creating a nation-wide Web interface for cops–one wag has dubbed it “DragNet,” and another “Porknet”–is that some of its thousands of users could be infected by viruses and other malware. Once an infected computer is hooked up to the national network, it could leak confidential information about ongoing investigations.
Jim Harper, a policy analyst at the free-market Cato Institute, says that he welcomes the idea of a police-only Web interface as long as it’s designed carefully. “A system like this should have strong logins, should require that the request be documented fully, and should produce statistical information so there can be strong oversight,” he says. “I think that’s a good thing to have.”
______________________________________
My Take: I’m all for an organized and thoroughly conducted system for Web interface cyber investigations. After all, if police have to wait six weeks for a response to a subpoena, that creates a pretty big window of opportunity for an investigation to go cold. Considering the speed at which a company can backup its files, conduct a cd duplication of all e-records, and track and then erase all call center software histories, the need for a timely response to investigatory e-policing is critical.
I wouldn’t want my company’s contact center solutions or data recovery provider to have to cough up information about my day-to-day operations without letting me know what’s going on and why. And I would expect the same from my Internet services provider.
———————————————————————-
Other Resources
Being Duped
One sure fire way to avoid losing your online data is through backup, whether you make a copy dvd California style, or employ any one of the growing number of online “cloud computing” companies out there who will store your data for you offsite. No hardware or files for you to manage.
Success Reporting
It is important to review all core data/metrics on a monthly basis and make changes to improve all active marketing campaigns. Without looking at the results of your search engine marketing campaigns, the rankings for any keyword phrases you have targeted, where traffic comes from, what keywords are driving traffic as well as conversion rates, your business will not grow. SEO companies can provide you with this and much more. One SEO service provides ranking reports, keyword reports as well as helping to improve your conversion/sales quotient. For a limited time, they are also providing call to action or CTA free with their entire search marketing campaign programs.
