On Sat, 13 Oct 2007 06:50:16 -0400, Warp wrote:

> Jim Henderson <nos### [at] nospamcom> wrote:
>> >   You mean some OS can stop someone from booting from a CD and wiping
>> > the HDs, for example?
> 
>> My brand-new HP Pavillion has settings in the hardware that do just
>> that,
> 
>   The hardware is not the OS.

No, really?  In the end, I don't care if it's the OS or the hardware, if 
I can restrict the usage in a corporate environment in that way, I don't 
particularly care which it is.

The end result is what *I'm* looking at.

>> in fact.  Password protect the bios and disallow booting from any
>> device other than the hard drive.
> 
>   Bios settings can be reset, and hard drives can be physically
>   transferred
> to other computers.

Sure, so what you do is lock it in a room where only authorized users can 
access it, bolt it to the desk, and lock the case.  Sure, they *could* 
come in with a sawzall and cut the lock, bolts, or case open, but they're 
likely to be seen.

Computer security ain't just about the OS, it's about the entire system.  
If you try to practice security using *only* the OS, you *will* fail.

>   Bios passwords are only a deterrent. They are not secure.

Again, depends on the level of physical access to the system.

Jim

Post a reply to this message

On Sat, 13 Oct 2007 09:09:35 -0700, Darren New wrote:

> Supposedly, the new Vista full-drive encryption prevents this, storing
> the password somewhere on the motherboard or some such, even if you
> chose not to have a USB key.

I'd heard that - there are some systems that implement this at the 
hardware level as well - I think my Thinkpad has an option like that that 
keys the drive to the hardware.

Jim

Post a reply to this message

Jim Henderson <nos### [at] nospamcom> wrote:
> Sure, so what you do is lock it in a room where only authorized users can 
> access it,

  Optimally only the person who knows the root password has direct access
to the computer.

  In which case it doesn't really matter if the root password can be
reset locally or not.

-- 
                                                          - Warp

Post a reply to this message

On Sat, 13 Oct 2007 17:23:37 -0400, Warp wrote:

> Jim Henderson <nos### [at] nospamcom> wrote:
>> Sure, so what you do is lock it in a room where only authorized users
>> can access it,
> 
>   Optimally only the person who knows the root password has direct
>   access
> to the computer.

This is certainly true for servers.  Unfortunately, we also have these 
things called "users" who use computers. ;-)

>   In which case it doesn't really matter if the root password can be
> reset locally or not.

Yes.

BTW, this was considered very standard practice for NetWare (still is, 
for that matter) - physical console access = access to everything.  It 
amazed me that some systems admins never understood that concept - and 
put their servers in, say, the middle of their office space.

Similarly with Windows, in a retail environment I used to work in a few 
years ago, the servers were put in the store managers office.  Guess 
where many store managers put shoplifters they catch while waiting for 
the police, frequently unsupervised....

Now make each of those servers a domain controller.  Yep, we had to plan 
our designs around the idea that someone could walk off with the hard 
drives from the system, compromising a domain of 500-1500 DCs.

"Not pretty" doesn't even begin to describe the amount of traffic 
generated by a global password change with that many DCs.  With the WAN 
in place, I estimated 4 months worth of traffic at 100% network 
utilization.

Jim

Post a reply to this message

Jim Henderson <nos### [at] nospamcom> wrote:
> >   Optimally only the person who knows the root password has direct
> >   access
> > to the computer.

> This is certainly true for servers.  Unfortunately, we also have these 
> things called "users" who use computers. ;-)

  Users should only use the computer remotely. Just give the users a
dummy "multimedia" PC with no valuable information stored in it and
which HD can be reset to default each night. (That's what they do at the
university here.)

  Networked file systems exist for a reason.

-- 
                                                          - Warp

Post a reply to this message

>> Law enforcement can get a subpoena or warrant for keys to a safe. I
>> suspect that in many countries they would treat a password the same.
>> Failing to turn over the password might have worse consequences, since a
>> contempt of court charge would just leave someone sitting in jail until
>> they turned over the password.
>
>  If the suspect simply claims that he forgot it, how can they prove he
> didn't?

Well I guess if they showed he had used it every day for the last 5 years 
then the jury wouldn't find it too hard to come to a decision...

Post a reply to this message

scott <sco### [at] laptopcom> wrote:
> Well I guess if they showed he had used it every day for the last 5 years

  Big Brother is watching? I'm not comfortable with where this is going...

  I see where this is going. Let's see which country is the first to make
all kinds of encryption illegal.

-- 
                                                          - Warp

Post a reply to this message

>> Well I guess if they showed he had used it every day for the last 5 years
>
>  Big Brother is watching? I'm not comfortable with where this is going...

If you've just been arrested (and had your PC taken away) on suspicion of 
downloading child porn (or whatever), then I think the police could quite 
easily get records of your activity online, they may have even been spying 
on you already.

It's then up to the jury what they think after all the facts have been 
presented.  It's not going to look good if you conveniently "forgot" the 
password to work your computer the day it was confiscated, but you managed 
to work it fine for the last few years.

Besides, the ISP will probably have records of what you did online, and I 
suspect some expert lab would be able to look at the PC and say how recently 
a lot of the data on the disc had changed (ie was the drive re-encrypted 
with a different key recently).

Post a reply to this message

scott <sco### [at] laptopcom> wrote:
> they may have even been spying on you already.

  Regardless of the suspected crime type, I'm still not very comfortable
if the police could legally spy on anyone they want.

  I suppose that's where the world is going. Hundreds of millions of people
will have to reduce their rights to privacy so that the few dozens of bad
criminals can be spied upon.

-- 
                                                          - Warp

Post a reply to this message

>> they may have even been spying on you already.
>
>  Regardless of the suspected crime type, I'm still not very comfortable
> if the police could legally spy on anyone they want.

How are they meant to catch people downloading illegal material without 
spying on you?  Don't ISPs already report suspected illegal activity to the 
police?

Post a reply to this message

scott wrote:
>>> Well I guess if they showed he had used it every day for the last 5
>>> years
>>
>>  Big Brother is watching? I'm not comfortable with where this is going...
> 
> If you've just been arrested (and had your PC taken away) on suspicion
> of downloading child porn (or whatever), then I think the police could
> quite easily get records of your activity online, they may have even
> been spying on you already.
> 
> It's then up to the jury what they think after all the facts have been
> presented.  It's not going to look good if you conveniently "forgot" the
> password to work your computer the day it was confiscated, but you
> managed to work it fine for the last few years.
> 

I don't think a jury would ever hear about it, in the USA. Quoting
lectlaw.com :
Civil contempt occurs when the contemnor willfully disobeys a court
order. This is also called indirect contempt because it occurs outside
the judge's immediate realm and evidence must be presented to the judge
to prove the contempt. A civil contemnor, too, may be fined, jailed or
both. The fine or jailing is meant to coerce the contemnor into obeying
the court, not to punish him, and the contemnor will be released from
jail just as soon as he complies with the court order.
http://www.lectlaw.com/def/c118.htm

What is glossed over in that nice quote is that, because it is not
'punishment' the court doesn't have to follow due process. That means no
trial by jury and no real chance to argue that you really did forget the
password.

Deniable encryption tries to get around this, but I'm waiting to see it
tested by an over zealous court. While it might be believable that the
person had turned over all of their keys, it could also be presented
that there is always one more key to turn over.

Post a reply to this message

scott wrote:
>>> they may have even been spying on you already.
>>
>>  Regardless of the suspected crime type, I'm still not very comfortable
>> if the police could legally spy on anyone they want.
> 
> How are they meant to catch people downloading illegal material without
> spying on you?  Don't ISPs already report suspected illegal activity to
> the police?
> 
> 

There is a difference between the ISP scanning their own traffic logs in
accordance with their own terms of service, and the police requiring
that the ISP scan, log, and report everything directly to them.

Post a reply to this message

>> How are they meant to catch people downloading illegal material without
>> spying on you?  Don't ISPs already report suspected illegal activity to
>> the police?
>
> There is a difference between the ISP scanning their own traffic logs in
> accordance with their own terms of service, and the police requiring
> that the ISP scan, log, and report everything directly to them.

Can't the police demand info from ISPs if they suspect some customers (or 
users of a website they host) to be acting illegally?  I'm not an expert at 
the law in this area, but it seems like common sense says the police should 
(and do) get this information if they need it to help convince someone of a 
crime.

Post a reply to this message

> Deniable encryption tries to get around this, but I'm waiting to see it
> tested by an over zealous court. While it might be believable that the
> person had turned over all of their keys, it could also be presented
> that there is always one more key to turn over.

Oh ok, I hadn't heard of deniable encryption before, I will look it up.

Another possibility is that your decryption key is stored on a USB stick, 
and is far too long for you to possibly remember.  After your PC has been 
confiscated (before they realise it won't boot without the USB key) you can 
destroy the USB stick.

Post a reply to this message

scott <sco### [at] laptopcom> wrote:
> How are they meant to catch people downloading illegal material without 
> spying on you?

  How is the police meant to stop domestic violence without installing
surveillance cameras in all homes?

-- 
                                                          - Warp

Post a reply to this message

Warp wrote:
>   How is the police meant to stop domestic violence without installing
> surveillance cameras in all homes?

Kill all men?

-- 
Tim Cook
http://home.bellsouth.net/p/PWP-empyrean

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GFA dpu- s: a?-- C++(++++) U P? L E--- W++(+++)>$
N++ o? K- w(+) O? M-(--) V? PS+(+++) PE(--) Y(--)
PGP-(--) t* 5++>+++++ X+ R* tv+ b++(+++) DI
D++(---) G(++) e*>++ h+ !r--- !y--
------END GEEK CODE BLOCK------

Post a reply to this message

scott wrote:
>>> How are they meant to catch people downloading illegal material without
>>> spying on you?  Don't ISPs already report suspected illegal activity to
>>> the police?
>>
>> There is a difference between the ISP scanning their own traffic logs in
>> accordance with their own terms of service, and the police requiring
>> that the ISP scan, log, and report everything directly to them.
> 
> Can't the police demand info from ISPs if they suspect some customers
> (or users of a website they host) to be acting illegally?  I'm not an
> expert at the law in this area, but it seems like common sense says the
> police should (and do) get this information if they need it to help
> convince someone of a crime.
> 
> 

In the USA, no, they can not just demand the information. They can ask
the ISP any way they want, but without a warrant, the ISP is not
required to turn over anything. Without a warrant* a cop asking for
something is doing just that, asking. The requirements to get a warrant
is 'probable cause', which is another loaded term because it has a
pretty strict legal meaning. Basically, the cop would have to show a
judge that there was already some evidence that someone committed a
crime before they could get a search warrant to invade that person's
privacy. Getting a search warrant for an ISPs logs would involve showing
some evidence that someone using the ISP did something illegal, and
would probably need to be more specific like what person committed what
possible crime over what time frame.

The trick, though, is that the ISP really had no reason not to turn over
your information. Because they own the data, and the terms of service
usually allow them to, they can turn over the information to the police
with out your consent. But they are not required to. If the police
asked, on a daily basis, for all information regarding all customers,
how long would it take for the ISP to just start ignoring them until the
police brought a warrant? An ISP might even require a warrant before any
information is handed over.

*Not counting such nice modern laws like the Patriot Act and the option
to get a warrant after the search using the stuff obtained in the search
as justification.

Post a reply to this message

On Sun, 14 Oct 2007 20:19:00 -0400, Warp wrote:

> Jim Henderson <nos### [at] nospamcom> wrote:
>> >   Optimally only the person who knows the root password has direct
>> >   access
>> > to the computer.
> 
>> This is certainly true for servers.  Unfortunately, we also have these
>> things called "users" who use computers. ;-)
> 
>   Users should only use the computer remotely. Just give the users a
> dummy "multimedia" PC with no valuable information stored in it and
> which HD can be reset to default each night. (That's what they do at the
> university here.)

We could do terminal server - how about just dumb terminals?

That's not really the reality of how computers are used these days - I 
travel occasionally, not having files on my laptop would cripple my 
ability to do work.  A not insignificant amount of the population works 
that way.

>   Networked file systems exist for a reason.

Yes, mostly for recovery.  If a desktop is compromised, the network 
filesystem can also be compromised.  It's not as easy, but it's certainly 
possible.

Why?  Because users do stupid things with passwords.  They leave access 
cards in their desks, etc, etc, etc.

But even more significantly, social engineering attacks lead to more 
compromise of data than any technical hacking does.

I've only been working with data security for about 15 years, with my 
first environment being an academic computer lab at a university, 
though. ;-)

Jim

Post a reply to this message

Jim Henderson <nos### [at] nospamcom> wrote:
> We could do terminal server - how about just dumb terminals?

  VT100 rules.

  (Ok, I have never actually used a VT100 terminal. I have used a VT220 one,
though. Back then it was enough to do everything you had to do... :) )

> But even more significantly, social engineering attacks lead to more 
> compromise of data than any technical hacking does.

  I read recently about a test they did somewhere (I don't remember if
it was done in Finland or the US). It's surprising how many people will
write their account name and password on a paper questionnaire simply
because the questionnaire asks for them.

-- 
                                                          - Warp

Post a reply to this message

On Mon, 15 Oct 2007 12:30:42 -0400, Warp wrote:

> Jim Henderson <nos### [at] nospamcom> wrote:
>> We could do terminal server - how about just dumb terminals?
> 
>   VT100 rules.
> 
>   (Ok, I have never actually used a VT100 terminal. I have used a VT220
>   one,
> though. Back then it was enough to do everything you had to do... :) )

I think I have used a VT100 terminal.  Orange phosphor type screen, IIRC.

:-)

Jim

>> But even more significantly, social engineering attacks lead to more
>> compromise of data than any technical hacking does.
> 
>   I read recently about a test they did somewhere (I don't remember if
> it was done in Finland or the US). It's surprising how many people will
> write their account name and password on a paper questionnaire simply
> because the questionnaire asks for them.

Yep, but even worse than that is that help desk personnel will tend to 
reset passwords for anyone who says they are the person calling in.

Call one:

"Hi, I'm Joe Smith, and I can't seem to get in with my username - isn't 
it jsmith?"
"No, it's johnsmith, no spaces, all lowercase."
"Huh, I could've sworn it was jsmith, must've been thinking about a 
different system.  I'm in now, thanks!"

Followed by a second call to a different tech:

"Hi, I'm Joe Smith, just got back from vacation and I've forgotten my 
password, can you reset it for me?"
"Sure, no problem - it's now 'password', and you'll be forced to change 
it on your next login."
"Thanks, appreciate it."

Jim

Post a reply to this message

Jim Henderson wrote:
> On Mon, 15 Oct 2007 12:30:42 -0400, Warp wrote:
> 
>> Jim Henderson <nos### [at] nospamcom> wrote:
>>> We could do terminal server - how about just dumb terminals?
>>   VT100 rules.
>>
>>   (Ok, I have never actually used a VT100 terminal. I have used a VT220
>>   one,
>> though. Back then it was enough to do everything you had to do... :) )
> 
> I think I have used a VT100 terminal.  Orange phosphor type screen, IIRC.
> 
> :-)
> 
vt52, vt100, vt220 and vt240 (using its grahical modes to plot things 
IIRC) but I started on on a beehive terminal where you could edit one 
line locally and then use the 'send' button to send to the mainframe.
No fancy full screen editors like VI yet.
Output to be collected the next day at the front desk.

Post a reply to this message

On Mon, 15 Oct 2007 22:40:44 +0200, andrel wrote:

> Jim Henderson wrote:
>> On Mon, 15 Oct 2007 12:30:42 -0400, Warp wrote:
>> 
>>> Jim Henderson <nos### [at] nospamcom> wrote:
>>>> We could do terminal server - how about just dumb terminals?
>>>   VT100 rules.
>>>
>>>   (Ok, I have never actually used a VT100 terminal. I have used a
>>>   VT220 one,
>>> though. Back then it was enough to do everything you had to do... :) )
>> 
>> I think I have used a VT100 terminal.  Orange phosphor type screen,
>> IIRC.
>> 
>> :-)
>> 
> vt52, vt100, vt220 and vt240 (using its grahical modes to plot things
> IIRC) but I started on on a beehive terminal where you could edit one
> line locally and then use the 'send' button to send to the mainframe. No
> fancy full screen editors like VI yet. Output to be collected the next
> day at the front desk.

Technically, I think my first terminal was a real teletype - I remember 
my dad bringing one home from the office for the IBM 305 they had, 
acoustic coupler and all.

Jim

Post a reply to this message

Warp wrote:
>   Regardless of the suspected crime type, I'm still not very comfortable
> if the police could legally spy on anyone they want.

In the USA, the police are *supposed* to go to a judge and convince the 
judge of the need to do this.  That this is being ignored is troublesome 
to me. But I don't have much of a problem with it when the judge is 
involved.

Of course, the bit of "let's watch everyone always who is in public, and 
record any data leaving or entering their private house" is also 
troublesome, but certainly easier to get around.

-- 
   Darren New / San Diego, CA, USA (PST)
     Remember the good old days, when we
     used to complain about cryptography
     being export-restricted?

Post a reply to this message

Tim Cook wrote:
> Warp wrote:
>>   How is the police meant to stop domestic violence without installing
>> surveillance cameras in all homes?
> 
> Kill all men?

You *are* aware that men are abused more often than women are, right?

-- 
   Darren New / San Diego, CA, USA (PST)
     Remember the good old days, when we
     used to complain about cryptography
     being export-restricted?

Post a reply to this message

scott wrote:
> After your PC 
> has been confiscated (before they realise it won't boot without the USB 
> key) you can destroy the USB stick.

That's called "destruction of evidence" and it's also illegal. Not that 
they could do much about it, but it's illegal.

-- 
   Darren New / San Diego, CA, USA (PST)
     Remember the good old days, when we
     used to complain about cryptography
     being export-restricted?

Post a reply to this message

Darren New wrote:
> Tim Cook wrote:
>> Warp wrote:
>>>   How is the police meant to stop domestic violence without installing
>>> surveillance cameras in all homes?
>>
>> Kill all men?
> 
> You *are* aware that men are abused more often than women are, right?
> 
It still works.

Post a reply to this message

On Tue, 16 Oct 2007 07:07:01 +0200, andrel wrote:

> Darren New wrote:
>> Tim Cook wrote:
>>> Warp wrote:
>>>>   How is the police meant to stop domestic violence without
>>>>   installing
>>>> surveillance cameras in all homes?
>>>
>>> Kill all men?
>> 
>> You *are* aware that men are abused more often than women are, right?
>> 
> It still works.

Arguably for the women abusers it sure does....

Jim

Post a reply to this message

>> How are they meant to catch people downloading illegal material without
>> spying on you?
>
>  How is the police meant to stop domestic violence without installing
> surveillance cameras in all homes?

Looking at IP logs of suspects is a bit different to having a camera inside 
your house.

By using the internet you are effectively agreeing that everyone else can 
see what you are doing.  By living in a house you are certainly not agreeing 
to that.

Post a reply to this message

>> After your PC has been confiscated (before they realise it won't boot 
>> without the USB key) you can destroy the USB stick.
>
> That's called "destruction of evidence" and it's also illegal. Not that 
> they could do much about it, but it's illegal.

Yeh I guess it depends on how bad the punishments will be relatively.  I 
mean if there was evidence on your PC that would incriminate you for murder, 
would it be beneficial to destroy the decryption device?  What if you just 
"lost" it ("i thought it was plugged into the PC when you guys took it 
away")?  They couldn't prove that you destroyed it.

Post a reply to this message

> Yep, but even worse than that is that help desk personnel will tend to
> reset passwords for anyone who says they are the person calling in.

At university we had to actually go to the IT place and show our photo-ID 
before they would reset the password.  They would stick the ID into the 
machine (after supposedly checking the photo), and then scan in the barcode 
on the outside of an envelope.  Inside the envelope was your new password 
:-)

I'm pretty sure that here I could just phone the IT guys and they'd reset my 
password - but saying that I think they pretty much know everyone's voice as 
we're quite a small outfit.

Post a reply to this message

> vt52, vt100, vt220 and vt240 (using its grahical modes to plot things 
> IIRC) but I started on on a beehive terminal where you could edit one line 
> locally and then use the 'send' button to send to the mainframe.
> No fancy full screen editors like VI yet.
> Output to be collected the next day at the front desk.

My dad got me a vt220 (IIRC) from work once when I was about 9 or 10.  I 
hooked it up to our BBC via serial link and would chat with my sister from 
room-to-room after we were meant to have gone to bed!  We even tricked a few 
of our friends by me hiding in another room and my sister pretending to chat 
to someone famous using this "amazing new technology".

Should have realised the potential of this usage and written an internet 
chat program!

Post a reply to this message

scott <sco### [at] laptopcom> wrote:
> By using the internet you are effectively agreeing that everyone else can 
> see what you are doing.

  I see no law specifying this.

-- 
                                                          - Warp

Post a reply to this message

Darren New <dne### [at] sanrrcom> wrote:
> Of course, the bit of "let's watch everyone always who is in public, and 
> record any data leaving or entering their private house" is also 
> troublesome, but certainly easier to get around.

  In Finland there are quite restrictive privacy laws.

  For example, it's prohibited to create (and especially distribute) lists
which link numbers (such as social security numbers, car license plates,
student numbers in universities, etc.) to the persons assigned to those
numbers. For example at universities when they publish course results,
they can only print out to public view either the student number or the
student name, but not both. (Most prefer printing only the student number
because it's more "anonymous".)

  Sometimes executing this law goes a bit to extremes. For example there
was a website which collected photographs of cars with amusing license
plates. It received a cease-and-desist order from authorities because
it effectively was a listing of license plates and photographs of the
cars they belonged to. This is a no-no.

  I'm quite certain that likewise it would be prohibited to photograph
people leaving their homes, because such photographs would effectively
be a list connecting people with their homes.

  I'm not sure what is the interpretation of the law with regard to the
police spying on internet traffic, though...

-- 
                                                          - Warp

Post a reply to this message

>> By using the internet you are effectively agreeing that everyone else can
>> see what you are doing.
>
>  I see no law specifying this.

It's not a case of law or not, it's the fact that you signed an agreement 
with the company that gives you access to the internet.  If you don't agree 
with their terms, then use another ISP, or if you can't find one that you 
agree with then make your own ISP or don't use the internet.

Post a reply to this message

scott <sco### [at] laptopcom> wrote:
> It's not a case of law or not, it's the fact that you signed an agreement 
> with the company that gives you access to the internet.  If you don't agree 
> with their terms, then use another ISP, or if you can't find one that you 
> agree with then make your own ISP or don't use the internet.

  That doesn't automatically mean that the police can go and do whatever
it wants.

-- 
                                                          - Warp

Post a reply to this message

On Tue, 16 Oct 2007 09:01:15 +0200, scott wrote:

>> Yep, but even worse than that is that help desk personnel will tend to
>> reset passwords for anyone who says they are the person calling in.
> 
> At university we had to actually go to the IT place and show our
> photo-ID before they would reset the password.  They would stick the ID
> into the machine (after supposedly checking the photo), and then scan in
> the barcode on the outside of an envelope.  Inside the envelope was your
> new password :-)

Yeah, some places are saavy enough to do this, but sadly not enough of 
them.

> I'm pretty sure that here I could just phone the IT guys and they'd
> reset my password - but saying that I think they pretty much know
> everyone's voice as we're quite a small outfit.

Here they require you to show up in person to the security office (or the 
help desk area, I don't know which) with your access card; but we also 
have the ability to change our own passwords using a secret question/
answer and a PIN; the PIN is used by the phone system for voice mail 
access as well, so most people remember that easier than their password.

Just don't lose your badge. ;-)

Jim

Post a reply to this message

Warp wrote:
>   In Finland there are quite restrictive privacy laws.

That's one of the areas in which the USA is rather backwards. :-?

-- 
   Darren New / San Diego, CA, USA (PST)
     Remember the good old days, when we
     used to complain about cryptography
     being export-restricted?

Post a reply to this message

On Tue, 16 Oct 2007 16:56:51 -0700, Darren New wrote:

> Warp wrote:
>>   In Finland there are quite restrictive privacy laws.
> 
> That's one of the areas in which the USA is rather backwards. :-?

Yeah - actually, been wondering what you think of the Governator's 
reversal of the data protection laws in CA...?

Jim

Post a reply to this message

Jim Henderson wrote:
> Yeah - actually, been wondering what you think of the Governator's 
> reversal of the data protection laws in CA...?

I fear I've been an Actioneer for the last couple of months. I haven't 
really been keeping up with the news that doesn't directly affect me.

However, glancing thru a couple of news articles, and considering I've 
worked in the payment processing arena for 15 years, I have to say I 
agree with him.  From the little I see, it's the payment processing 
stuff he doesn't want to change. That's very different from the other 
information.

I don't really care if someone steals my credit card info. It's not my 
card. It's the bank's card.  What I don't want is people selling all my 
personal information without my consent.  I can already stop people from 
getting my payment history that don't need to know it. The payment 
processing laws in the US are stronger (i.e., more consumer friendly) 
than most of Europe, as I understand it. It's just the stuff that people 
collect independent of actually payment information that's loose.

-- 
   Darren New / San Diego, CA, USA (PST)
     Remember the good old days, when we
     used to complain about cryptography
     being export-restricted?

Post a reply to this message

Interesting, looks like you know more about it than I do - does it just 
then relate to payment information and not personal data?

Jim

Post a reply to this message

>> It's not a case of law or not, it's the fact that you signed an agreement
>> with the company that gives you access to the internet.  If you don't 
>> agree
>> with their terms, then use another ISP, or if you can't find one that you
>> agree with then make your own ISP or don't use the internet.
>
>  That doesn't automatically mean that the police can go and do whatever
> it wants.

If the ISP agrees to it they can - the key point is that *you* don't have to 
agree, because you've already handed over that responsibility to your ISP 
when you signed up.

Post a reply to this message

scott <sco### [at] laptopcom> wrote:
> If the ISP agrees to it they can

  I would like to see the law which says this.

-- 
                                                          - Warp

Post a reply to this message

Why do you need a law to allow a company to voluntarily supply data to the 
police?  If the police wanted to force data unwillingly from the company, 
then sure...

Post a reply to this message

Warp wrote:
> scott <sco### [at] laptopcom> wrote:
>> If the ISP agrees to it they can
> 
>   I would like to see the law which says this.

It's the law that says something along the lines of 'legally binding 
business contracts are legally binding'.  Unless specifically stated 
otherwise to the contrary, you can in theory agree to anything and it's 
legal.  It doesn't need a law to say 'you can do this', it needs a law 
to say 'you CAN'T do this'.

-- 
Tim Cook
http://home.bellsouth.net/p/PWP-empyrean

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GFA dpu- s: a?-- C++(++++) U P? L E--- W++(+++)>$
N++ o? K- w(+) O? M-(--) V? PS+(+++) PE(--) Y(--)
PGP-(--) t* 5++>+++++ X+ R* tv+ b++(+++) DI
D++(---) G(++) e*>++ h+ !r--- !y--
------END GEEK CODE BLOCK------

Post a reply to this message

Warp wrote:
> scott <sco### [at] laptopcom> wrote:
>> If the ISP agrees to it they can
> 
>   I would like to see the law which says this.
> 

Check your User Agreement and search procedures in your country. The
agreement, at least the ones from ISPs I've used, allows them to do what
ever they want with the data as long as it is not identifiable, or to
turn the data over to law enforcement. Search procedure in the USA
allows the 'inhabitant' to authorize a search. Inhabitant might be a bad
word for this, but a house sitter can allow the police to search a house
not owned by them because they are the current guardian of that house. A
renter or a land lord can authorize the search an apartment. Since the
ISP is the guardian of the data on their servers, they would have the
option of turning it over to police within what ever terms they set up
in their user agreement.

Post a reply to this message

On Wed, 17 Oct 2007 08:56:33 +0200, scott wrote:

> the key point is that *you* don't have to agree,

Actually, the ISPs I have dealt with may even have explicitly included 
that in their terms of service - that the ISP will comply with legal 
requests from law enforcement, and that your use of the service 
constitutes agreement with this policy.

Jim

Post a reply to this message

scott <sco### [at] laptopcom> wrote:
> Why do you need a law to allow a company to voluntarily supply data to the 
> police?  If the police wanted to force data unwillingly from the company, 
> then sure...

  Because the data is used without the person's consent.

-- 
                                                          - Warp

Post a reply to this message

Sabrina Kilian <"ykgp at vtSPAM.edu"> wrote:
> Warp wrote:
> > scott <sco### [at] laptopcom> wrote:
> >> If the ISP agrees to it they can
> > 
> >   I would like to see the law which says this.
> > 

> Check your User Agreement and search procedures in your country. The
> agreement, at least the ones from ISPs I've used, allows them to do what
> ever they want with the data as long as it is not identifiable, or to
> turn the data over to law enforcement.

  I wasn't asking what the ISP can do. I was asking what the police can do.
In most countries there are limits on how the police can spy on people (so
that the evidence is valid in court).

-- 
                                                          - Warp

Post a reply to this message

Jim Henderson <nos### [at] nospamcom> wrote:
> and that your use of the service 
> constitutes agreement with this policy.

  No agreement can go against the law. At least not here.

  For example, if a license agreement of a software says that you cannot
make backup copies of it, that's just not valid. You can accept the license
agreement and still make backup copies. They have nothing against you.

-- 
                                                          - Warp

Post a reply to this message

On Wed, 17 Oct 2007 14:36:03 -0400, Warp wrote:

> Jim Henderson <nos### [at] nospamcom> wrote:
>> and that your use of the service
>> constitutes agreement with this policy.
> 
>   No agreement can go against the law. At least not here.

It's legal AFAIK in the US to permit a TOS or EULA to require users give 
up some of their rights in exchange for services or products.  Of course, 
shrink-wrap laws like that haven't been fully tested in the US courts, so 
it's possible it's not legal to do so, but it would take someone actually 
challenging it court to invalidate it.

It's not automatically invalidated over here.

>   For example, if a license agreement of a software says that you cannot
> make backup copies of it, that's just not valid. You can accept the
> license agreement and still make backup copies. They have nothing
> against you.

Is it written into Finnish law that you can make backup copies of 
software?  That would seem to me to be a case of "management by 
exception" - I'd be interested in how that's codified in the laws over 
there.

Jim

Post a reply to this message