|
|
A WJR news report refers briefly to proposed legislation in Lansing to prohibit anonymous Internet access in Michigan. The Wayne County sheriff is promoting this as a necessary tool to fight child pornography. I don't have any further details. Such a law, if passed and upheld by the courts, would have an adverse impact on Grex -- at the minimum, "newuser" could no longer be run.
90 responses total.
(why do you leap to that gymnastic conclusion, esp. based on a brief audio news report?)
I don't see why "newuser" would be a problem, nor grex.. otoh, "newuser" would need an update, and places like the 203.197.98.6 wabbit-wingate would be a problem. On the Gripping Hand, it still depends, (as usual), on the bureacratese involved with this supposed "bill".
The effects would greatly depend on what is meant by "Internet access". Could people read items on Grex anonymously under this proposed law? Could they read e-mail? Send e-mail? Run "ping"? Run "ftp"? Run "telnet"? Read using lynx? Post using lynx? It's not clear from #0 that Grex would be affected at all, whether Grex would be allowed to exist at all, or any question lying between those two points. It's not clear that the Internet itself would be allowed to exist in Michigan.
A detailed story is in the Detroit Free Press: http://www.freep.com/money/tech/mwend8_20010208.htm There is a prominent link to it on the online front page. The proposal is from state rep Bob Brown, D-Dearborn Heights: from the Free Press story: "The legislation that Brown plans to sponsor would require all ISPs doing business in Michigan to obtain a valid and verified credit card or telephone number at the time of registration and to hold on to that data for at least one year."
Grex isnt really an ISP though
Based on the superficial coverage of the article, Grex would likely be required to verify accounts through obtaining a verified telephone number or credit card number. The issue is email exchange of illegal materials. The primary method that police investigators use, is to join suspect newsgroups, IRC groups, mailing lists, etc., and to try to get people to send (or exchange) illegal materials to them. The difficulty is not likely to arise in the exchange of illegal commodities (such as online drug sales), as money and the illegal product must change hands. It is not likely to arise in the cases where the police trick somebody into going to a motel to meet what they believe to be a minor, as the suspect must go to the motel. However, for the pure exchange of illegal electronic files - such as obscene .gif images - there may not be a way for the police to track the suspect except through the ISP's registration information for the suspect's account. Obviously, a suspect may presently use multiple anonymous throw-away accounts, accessing them through an anonymizing proxy or free dial-up service, making that task even more difficult. Requiring the verification information, and requiring that it be held for a year, will help law enforcement both identify suspects, and reduce the use of multiple throw-away accounts by suspects. However, it will put a very high burden (perhaps impossibly high) on operations like Grex or M-Net, which lack the resources and manpower to collect, verify, and maintain that information.
So it could mean no internet email access for folks with unverified accounts. That would suck but I think it wouldnt be a really big burden. Anonymous BBS accounts with local email could probably still exist.
I haven't read the news story. I don't know specifically what the law says. That said, Grex logs what IP address a user comes from, and ISPs generally log which IP addresses their users are assigned at what times, so as a practical matter if the intent of the law is to be able to trace people through ISP log files, and if the law is written to match that intent, Grex would only have to verify information through its dial-up users. Of course, I have no reason to believe the law is being written in any way that makes sense. It should be noted, though, that law enforcement really isn't lacking any ability that this gives them. Since ISPs exist to make money, ISPs generally don't go around handing out accounts without some way to bill for them, which would generally be either a credit card number or billing address. The real challenge for law enforcement in going from ISP biling records would be that it can be difficult to prove that the person using the account was the person being billed for the account. I assume that's the usual reason these investigations generally get handled by arranging to meet the person somewhere and seeing who shows up. Even without accurate ISP billing data, though, this sort of thing isn't impossible to track down. Even if all the ISP knows is what phone line the modem call came in on at what time, where the call came from should be available either from the ISP's own caller ID logs, or from the phone company's logs, with appropriate court orders. I'm getting the rather strong impression that child pornography is the new communism -- something that can generate enough hysteria to justify all kinds of civil rights violations, with anybody who challenges them considered immediately suspect.
Maybe next they'll require some form of identification when sending mail via the US Postal Service. After, all those eagle-painted blue boxes are just perfect for anonymously mailing child pornography...
There is no law - there probably isn't even a draft bill yet. At present, this may be no more than a legislator with an agenda. But it sounds good, and our legislator has liked this type of stuff in the past, so I would expect this to pick up some momentum.
Re #9: Good point. I wonder how this would affect the free internet access offered at public libraries. Would internet access be denied to indigent people with no phone number and no credit card?
The usual USPS *mailer* of child pornography is a government agency conducting a sting operation. They get around the anonymity requirement by requiring a signature from the recipient. The issue here really does seem to be focused on anonymous email accounts. That would mean, the library could offer access, as long as they didn't offer email. I am not sure what the proponent of this bill intends for companies like Microsoft/Hotmail, which are likely to argue that requiring them to collect and verify the phone/credit card information would violate the commerce clause (as an unreasonable burden on interstate commerce).
I read the URL. They once used the phrase "free ISP", and talk a number of time about free providers including netzero and bluelight. Bluelight apparently already has changed their policies - they now collect caller-ID information. The law reportedly requires that a valid "credit card number or telpehone number" be collected at the time of registration. The way I read this is, the law definitely *would* affect grex. They may not have had us specifically in mind, but we're definitely way within their target cone. Anyone who doubts this should read the article first. We *might* with some effort figure out how to collect caller-ID on dialup lines. It would require a major technical effort since our current infrastructure makes this almost impossible. (We'd likely have to buy new terminal servers, so that we can track physical lines vs. logical line usage, we'd have to install *something* that could collect caller-ID information, and we'd have to teach newuser how to query that *something* to get the caller-ID info & reject things that don't have valid caller-ID). There are definite problems with what we'd be able to do. No more web newuser, for instance. Users from India would probably be out of luck. It's not clear what we'd have to do with pre-existing accounts. An interesting technical problem is that caller-ID information itself is not that hard to fake. I'm not sure that's a problem for us, but I'm not sure it's not: I can think of quite large organizations (any phone at the University of Michigan) that provide caller ID information that is quite misleading. The alternative, which some people here seem to be suggesting, is that we somehow restrict what people could do. No remote e-mail, perhaps. I don't know if that would really buy us much or even be practical. Without looking at the law, it's hard to say if it would include providing lynx access to material, allowing people to post web pages with "objectional" material, local mail entirely within grex, or material posted in conferences.
From the Free Press article, and from Aaron's resp:6, I think the essential issue is: under this law, if the police come around asking where a piece of mail or a certain user came from, the answer, "We don't know, and the information doesn't exist," means that Grex has committed a crime. I think what Grex would have to do if this law passes and is upheld, is shutdown the dialins. To my mind, the definition of an ISP seems to be a black box with a physical location or the telephone system at one side, and the Internet on the other side. With the dialins gone, Grex would resemble Hotmail or other free email provider, web forum, what have you. I read no hint so far that such entities would be required to register their users. If the police came around, Grex could give them the IP address a user came from. I am not advocating this solution, but I think it may be forced upon Grex. I am not optimistic that this law will be defeated either in the Legislature or in the courts. A quote from an EFF lawyer I saw today seems to indicate that even they do not find an absolute right to anonymity.
EFF is not a civil rights organization, but I do tend to agree with that conclusion. However, if this succeeds with ISP's (or perhaps even as part of the same bill), I expect services like hotmail to be next on the list.
OK, so why not organize to defeat this *now*? At the very least, would someone like to draft a letter from the board to the legislator proposing the legislation making him aware of how possibly unintended consequences of his proposal would effect the community on Grex?
Absolutely, organize to defeat this now. Drafting a letter to your legislator is a nice step. An open letter to the governor, sent to the Free Press and Detroit News, would also be a nice step, particularly if you can get some prominent individuals to sign it.
Why don't people write their own letters?
That would be a good idea too. How are letters from non-Michigan residents likely to be received by the Governor or legislators? Are they also helpful, or should I leave this to those who still live in Michigan?
By the way, I should note that I'm a bit skeptical of the claims of how uncooperative NetZero was. Chances are, even if NetZero doesn't know who their users are, the companies they are buying dial access from at least have logs of when the person called in and on what line, which should be enough for a sufficiently determined investigator armed with the appropriate court orders to figure out where the person's been calling from. An e-mail message sent through one of the free ISPs certainly isn't any more anonymous than a phone call, and tracking the sources of phone calls isn't a new problem for police agencies. If NetZero is ignoring subpoenas or wiretap orders, that's not something that requires new law to deal with. I find it telling that the apparrent push for this is coming from local law enforcement, rather than Federal authorities. The Federal authorities are getting a pretty good grasp of Internet stuff at this point, I get the impression. The local authorities I dealt with in my days of working at an ISP, on the other hand, generally seemed extremely clueless, both on the technology they were dealing with and the procedures they would have had to follow to be able to legally use the evidence they were asking for. They would call wanting to know which of our users had done something, and I would tell them what information they needed to be looking for, confirm that I had the information, and then hand them over to management, who would tell them that we'd be happy to give them the information if they came back with the appropriate court orders. Not one of them ever did.
John - many people will copy, perhaps even slightly revise, a drafted letter, and actually mail it, where they would not draft a letter of their own from scratch. You have probably encountered many situations where you have been contacted by one organization or another, asking you to send letters to legislators, usually with a draft letter and the target's mailing address provided. scg - I think legislators are most likely to respond to the concerns of their constituents. However, if letters arrive from out of state in any significant quantity, I think it can have an effect. The federal sting operations tend to be focused now on exchanges of illegal materials where money changes hands. I was recently informed by somebody who tried to get the FBI to investigate a child pornography exchange, that he was essentially told that they aren't interested if money isn't changing hands. At present, there seem to be enough cases of that variety to exceed the FBI's ability to investigate, arrest, and assist with the prosecution of all of the offenders involved. Given that people seem willing to buy illegal materials from overseas vendors by credit card, identifying customers usually isn't difficult. Local authorities have different priorities. They know they aren't likely to be able to shut down a major supplier of illegal materials, situated in another state or country. They are more interested in finding people within their own jurisdictions who are willing to engage in self- identifying criminal behavior online (or by being lured to a hotel room in their jurisdiction, to 'meet' a minor). For that, it will help them to be able to tie an email address to a specific person.
I didn't think that my opinion of Bob Ficano could go any lower, but he has proved me wrong again. One possible benefit of a GWB Administration is a Republican U.S. Attorney who would be willing to bring Ficano to justice.
From the article at least, it was clear the people drafting this law were targetting people who provide "free e-mail accounts", not people who provide "dial-up internet access". I suspect if pressed they might claim an internet service provider is anyone who provides an internet based service; not anyone who provides a bank of modems. Regardless, unless the law is incredibly badly worded, it's unlikely to use the term "ISP" without definition, and it should be easy enough to decide whether we're likely to be included under the terms of that definition, and whether dropping dial-in lines will make any real difference. Presumably, it should be easy enough to get a draft of the current law, and we might even be able to influence the language of the final law, although I doubt that will be at all to our advantage given the claimed goal of this law.
I'm curious how you read that into the Free Press article, Marcus. The thrust of the article seemed to be that Bluelight is good and NetZero is bad. They're both free dial providers. Hotmail and various other free e-mail providers include an X-Originating-IP line in the headers, saying where the message came from, the implication being that if you want to track the person down you can go to the owner of that IP address.
The problem isn't 'child prono', its not 'terrorists' or 'criminals'.
The real agenda is a very real fear on the part of 'government' that
with an anonymous 'digital society' it runs the risk of being unable to
collect taxes. Its that simple. Now I'm not saying that this specific
talking about proposed legislation by this particular 'sucker at the
public teat' is motivated by that, he or she may be actually motivated
by the quaint notion that the 'solution' to that particular problem that
irritates them is to somehow 'restrict' the Internet. One should note
that even more real crime could be eliminated by eliminating public
telephones, but I don't recall that being talked about much. (Here in
chicagoland an alderman (politician) in my 'hood got hot about a bank of
four public phones used by drug dealers at the gas station about three
blocks east of my crib. The owner of the gas station on the south corner
was convinced to request that the phone company remove them even tho-
the owner got a 'taste' of the revenue generated. The phones were
'removed'. Two of the phones were taken away and the othe two were
'removed' to the north side of the same intersection gas station who's
owner had noted the traffic patterns. Probably determined could make as
much with two phones with folk lined up as four phones with always an
empty phone or two. Net result, the alderman (a female) 'cracked down
on crime', there are two fewer public phones for honest citizens to use,
and two fewer phones to tap for the cops...not sure of the net 'gain' to
society as a whole.)
Lets consider the effect of a 'non-anonymous Internet'. The few
criminals that don't find ways around it are busted. The common
ordinary citizen who works at a company that is dumping toxic waste into
the drinking water now no longer reports ('whistle blower') it on
account he/she needs the job and recognizes that 'public approbation'
doesn't put food on table or send kids to college.
The way to police 'child prono' on the Internet is to give tax credits
to ISPs who have an active program to eliminate it - give them a
financial incentive to track down, document, and report the 'vendors' of
filth. Lord knows given the financial situation of the majority of them
it would be a far better way to spend tax dollars and keeps the cost to
the average consumer unchanged (encouraging everyone to get online.)
(Again, its a 'show me the money, honey' problem).
Back to the 'real agenda'. Imagine for a moment that I pay you to
'perform X task'. I pay you 10 bucks an hour in reported $US and
the equivalent of 60$US an hour in anonymous digital 'cash' over the
Internet. The amount of income tax you pay is based on that 10$US rate
and the amount of matching FICA/etc. stuff I pay is based on the same.
You go to person Y who has a horse for sale. You and he agree on terms.
He sells you a horse for 10$US and 60$US in 'digital cash' which is
anonymously transfered to him. You pay sales or VAT tax on 10$US horse.
The seller reports income of 10$US from the sale and has 60$US in
'digital cash' anonymously on the side. You see the problem for a
government?
(This is not a new problem. Long prior to 'Internet' for example there
was and is a 'chinese banking system' (aka 'Tongs', 'Triads', etc.) that
operates worldwide, immune from IRS/Revenue Dept. scrutiny. You go into
a 'chinese bank', give the clerk 'cash', get a 'ticket' (written in
'secret language' and 'chopped'), take the 'ticket' to any 'chinese
bank' in the world and redeem it how you negotiate. Of course, no FDIC,
no interest (indeed there may be a cost) and no recourse if you lose the
'ticket' - 'no tickey no washey' is no accident, and its no accident
that it is known as 'laundering'.))
While that was quite fascinating, beady, we're not speaking of the feds here, and we're not speaking about a police agency that collects taxes or enforces tax laws. Believe it or not, for a wide variety of reasons, it benefits local politicians to go after child pornography.
i dont beleive that all of the law's evil conterparts are out on anon internet access. this is just another attempt to destroy privacy because of one persons ill-founded fear. Descions such as this one should not be made by people who dont even understand technology. Why should the intelligent be rulled by the ignorent. even if anon internet is destroyed there will always be an work-around. Please forgive my poor spelling.
The problem described in the free press article was "people who use free e-mail accounts to send pornography", and the difficulty in associating those free e-mail accounts with humans. The solution described was to require systems hosting those free e-mail accounts to acquire either a "valid" telephone number or a credit card #. There was an underlying assumption that the same people providing the e-mail accounts were also providing dial-up access, and there was little if any discussion about web pages, downloads, IP connectivity, dial-up authentication, shell accounts, anonymous "kiosk" style walk-up internet access, hotmail, or any of the numerous other ways people might use the internet. Since that discussion was missing, and none of us has any real idea what the law actually might say, there's no way to prove or disprove whether it might apply to grex, or whether dropping dial-in lines will affect that. I'm sure any of us could draft a law that would apply to grex regardless, or a very similar law that would only affect sites offering dial-up access. Based on the "problem" described, I'm guessing that if the people who wrote this law will have tried very hard to write a law that will be as broad as possible, and will happen to include grex. If it's at all similar to past laws we've seen, it's likely to be written with multiple overlapping sets of definitions, some narrowly defined (and likely covering dial-up access), and others more broad & vague, but very likely elastic enough to cover grex. Several people here are apparently hoping for a much more narrowly defined law, possibly written by people who don't know of all the other possibilities and won't cover all those cases. This is certainly possible, and I definitely can't disprove it. Even so, I wouldn't care to bet on this necessarily being the case.
There's actually a very good reason for them to go after the dial providers instead of the free e-mail providers. A free e-mail provider with a bunch of servers in some other state, not charging money for their services, isn't doing business in Michigan. This was one of the grounds we were using to argue that the censorship law was too broad in Cyberspace v. Engler. The free dial providers actually have to put infrastructure in Michigan (or more likely rent somebody else's infrastructure in Michigan), meaning that they're actively doing business in Michigan.
It's a nice theory. Presumably, we'll get to see how close reality is soon enough.
I would really like to see the written out first, and not just what the newspapers have to say about it.
According to this article in hotwired: http://www.wired.com/news/politics/0,1283,41740,00.html?tw=wn20010210 The person who will propose the bill is state rep Bob Brown: http://www.housedems.com/reps/brown/news.htm I rthink a friendly call, fax, snail mail, or e-mail from Michigan residents letting him know your opinion on this issue may do a world of good.
The Wired.com story I see at an address mostly the same as raven gives above is pretty much the same as the original Free Press story, with the addition of some quotes in opposition to the proposal from Wendy Wagenheim, public education director of the Michigan Chapter of the ACLU. This proposal is such a direct threat to Grex's current operation that I would like to get the discussion period started now for a member vote to join with the ACLU in a suit.
( item:coop,231 )
See also this slashdot article today: http://slashdot.org/yro/01/02/11/1829225.shtml Post a response to slashdots and millions will be made aware of the problems with this law.
Now linked to cyberpunk your conf for social and legal issues in cyberspace.
ok, first of all, i am not here too pick up 12 year old girls, mainly im sticking to the 21 and over category and second of all, you wont get a phone number and credit card number out of me, and as for some government agency asking for it, there well be plenty of lawyers fighting it and even if it did pass and all that shit, by the time the attorneys wanted to prosecute any of us, id be married by then and probably wouldnt really all that much care
I just sent the following E-mail:
To: bbrown@house.state.mi.us
Subject: Internet Anonymity Legislation
Cc: janc@cyberspace.org
I have recently read reports that you are currently considering the
introduction of a bill to limit anonymous access to the Internet.
I would like to express deep concern about this legislation. It would
have a profound negative impact on one of the organizations I help run
and the Internet as a whole.
I am a volunteer staff member with Cyberspace Communications, a Michigan
non-profit, tax-exempt corporation that has been providing free public
discussion forums and Internet access for ten years. Our system, called
"Grex" after the Latin word for "group", is on the net at
http://www.cyberspace.org. We provide free accounts to all comers,
including basic E-mail, web access, and web sites. We are funded entirely by
user donations and are staffed entirely by volunteers. No advertising runs on
our site. Our annual operating budget is about $9000. We currently have over
30,000 users, with about 200 new accounts being created every day. Policy is
set democratically by an elected board of directors (I'm not a current board
member - term limits, you know).
Currently our system is accessible either through the Internet, or
through our dial-up modems in Ann Arbor (at 734-761-3000).
Though we do in some ways resemble "free ISPs" like NetZero, our mission
is fundamentally different. NetZero is a for-profit corporation, aiming
to make profits by selling advertising, and thus looking for customers
with money to spend. We are a charitable organization, aiming to serve
the broadest possible set of users, including some who are very poor.
This impacts everything we do. Thus, for example, a 15-year-old computer,
easily obtainable for free, is perfectly adequate to access our service,
but would probably not work with NetZero.
Though we don't consider ourselves an ISP in the usual sense of the term,
we do provide large numbers of people with anonymous access to the Internet.
I'm not entirely sure that we fully understand the proposed legislation,
having only read newspaper reports. If a draft version of the bill is
available, we would be very interested in seeing a copy.
As we understand it, this law would require that we either (1) allow
access to our dial-up lines only to users for whom we have credit card
information or some similar identifying information, or (2) record
caller-ID information on all our dial-up lines.
This raises both practical and philosophical problems for us.
Practically speaking, it would be difficult for us to comply with this
law. Collecting credit card data for users is impractical. First to
do so would require charging a fee. We are trying to make the Internet
accessible to the widest possible range of people, including poor people,
who often don't even have credit cards, and distrustful people, who
are nervous about giving their credit card numbers to strangers, even
if the fee is nominal. Clearly, requiring any payment at all for our
dial-up lines would scare away exactly the set of people our charitable
organization is most concerned with serving. Second, if we asked only a
token fee of a dollar or so to validate our users, the credit card transaction
fees would bankrupt us. We have never been able to find a credit card
merchant account we could afford and larger number of smaller transactions
would only make it more expensive. Collecting caller ID information would
obviously be the more appropriate solution, but the equipment required to do
so would also be beyond our reach financially.
Thus, in practice, the only way we would be able to comply with this law
would be to disconnect our dial-up lines, making our system accessible
only through the Internet. This would be a financial boon for us - the
dial-in lines consume a large portion of our annual budget - but it would
be a major step backward in terms of our mission as a charitable and
educational service, because it would cut us off from the users who most
need what we have to offer.
Quite simply, this legislation would substantially raise the cost bar to
providing Internet access, driving small charitable services like ours out
of the business, leaving it entirely in the hands of large, profit-driven
corporations. However small a part of the Internet groups like ours may be,
their existence makes the Internet a very different place than it would be
if access to the net were fully controlled by a few large corporations.
Even if the practical difficulties could be surmounted, there remain
serious questions about this legislation from a free speech viewpoint.
People seek ways to speak anonymously because they fear the consequences
if their comments are traced back to them. But in our experience, the
consequences they fear are not usually legal consequences. Some people fear
reprisals from their employers if they are seen to make statements not
in that company's interest. Some people are avoiding on-line stalkers.
People with political ambitions are often reluctant to speak freely in
on-line forums where permanent records of their comments are kept, because
those comments might someday come under media scrutiny. Some people are
paranoid about government surveillance (we like to think unjustifiably
so - but even paranoids have a right to say their piece). I believe that
in most people's lives there are times when they would prefer to be able
to speak anonymously. I believe that without the right to anonymous speech,
there cannot be free speech in the fullest form.
It might be argued that the information about the identity of the
users of our system would be safely held by Cyberspace Communications,
protecting the anonymity of our users from anything short of a legal
search warrant. This would probably reassure many, if not all, of
those who want anonymity for legitimate reasons, if we could make such
a guarantee. However, we can not, and neither can any other service
provider. Our system security is excellent - with several new people
trying to crack it every day it has to be - but perfect security is
unachievable. We could never exclude the possibility that this information
might be compromised.
In conclusion, I believe that this law would restrict free speech on the
Internet by eliminating the right to speak anonymously and by raising the
cost of providing internet service enough so that only large corporations
could do so. It would also reduce access to the Internet by economically
disadvantaged classes. I believe that this broad social costs would out-
weigh the narrow gains in criminal prosecution of pornographers.
When a draft version of this law is available, then we would appreciate a
chance to see it. If you or any of your staff would like to observe or
participate in our current discussion of this bill, it can be found at
http://www.cyberspace.org/cgi-bin/backtalk/peek:agora:126. You'll find
considerable concern and confusion there. For ten years now we've been
working to build the Internet's best example of a public system run on
principles of democracy, free speech and openness. This proposed legislation
appears to directly threaten our ability to continue operating.
Thanks,
Dr. Jan Wolter
staff member, Cyberspace Communications
607 Ross St, Ann Arbor, MI
(734) 995-6716
janc@cyberspace.org
I do think it is useful for lots of people to send mail about this. The legislator's address is Bob Brown N0695 House Office Building P.O. Box 30014, Lansing, MI 48913 Phone: 517-373-0857 Email: bbrown@house.state.mi.us In some ways I think it is better for various individuals to write letters rather than to send an "official Cyberspace Communications" missive. It would take a month just to write and approve such a thing, and it's not really the way we work. We're a cacophony, not a symphony. I think a cut-and-paste letter would be a fine idea, but the letter above isn't really well suited to the job - too long.
| Last 40 Responses and Response Form. |
|
|
- Backtalk version 1.3.30 - Copyright 1996-2006, Jan Wolter and Steve Weiss