Which ISPs Hand Private Surfing Info Over To Secretive Private Group Who Monitors It For The Feds?

from the feeling-safe? dept

So this is just bizarre. I saw a Wired report about a talk by a guy named Chet Uber, who claimed he helped connect Adrian Lamo to the feds in order to turn in Bradley Manning (the Army intelligence analyst accused of leaking content to Wikileaks), but Uber’s little talk raised a number of other issues unrelated to Manning/Lamo. Specifically, towards the end of this Forbes piece about Uber and his organization, Project Vigilant comes a little shocker about how the firm spies on internet traffic for the US government:

According to Uber, one of Project Vigilant’s manifold methods for gathering intelligence includes collecting information from a dozen regional U.S. Internet service providers (ISPs). Uber declined to name those ISPs, but said that because the companies included a provision allowing them to share users’ Internet activities with third parties in their end user license agreements (EULAs), Vigilant was able to legally gather data from those Internet carriers and use it to craft reports for federal agencies. A Vigilant press release says that the organization tracks more than 250 million IP addresses a day and can “develop portfolios on any name, screen name or IP address.”

“We don’t do anything illegal,” says Uber. “If an ISP has a EULA to let us monitor traffic, we can work with them. If they don’t, we can’t.”

And whether that massive data gathering violates privacy? The organization says it never looks at personally identifying information, though just how it defines that information isn’t clear, nor is how it scrubs its data mining for sensitive details.

Uh… what? Given the uproar and then Congressional smackdown to ISPs that tried to monitor such information for advertising purposes, that doesn’t seem right at all. Sneaking a clause into an EULA saying that it’s handing all your info over to a private party who will monitor it for the feds (maybe) and whoever else they want doesn’t really seem aboveboard or legal despite the claims. It’s also highly unlikely that it “never looks at personally identifying information.” Nearly everyone who’s ever claimed that has been proven wrong later.

The whole thing seems really sketchy, and as Glenn Greenwald notes, it appears to be an attempt to skirt the law:

There are serious obstacles that impede the Government’s ability to create these electronic dossiers themselves. It requires both huge resources and expertise. Various statutes enacted in the mid-1970s — such as the Privacy Act of 1974 — impose transparency requirements and other forms of accountability on programs whereby the Government collects data on citizens. And the fact that much of the data about you ends up in the hands of private corporations can create further obstacles, because the tools which the Government has to compel private companies to turn over this information is limited (the fact that the FBI is sometimes unable to obtain your “transactional” Internet data without a court order — i.e., whom you email, who emails you, what Google searches you enter, and what websites you visit –is what has caused the Obama administration to demand that Congress amend the Patriot Act to vest them with the power to obtain all of that with no judicial supervision).

But the emergence of a private market that sells this data to the Government (or, in the case of Project Vigilance, is funded in order to hand it over voluntarily) has eliminated those obstacles. As a result, the Government is able to circumvent the legal and logistical restrictions on maintaining vast dossiers on citizens, and is doing exactly that. While advertisers really only care about your online profile (IP address) in order to assess what you do and who you are, the Government wants your online activities linked to your actual name and other identifying information.

So, since Uber and Project Vigilant won’t say who these 12 ISPs are, can anyone help us out? What are the 12 ISPs out there who, via sneaky language in their EULAs are simply handing over your private data to some company to sell to the US government?

Filed Under: , ,
Companies: project vigilant

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Which ISPs Hand Private Surfing Info Over To Secretive Private Group Who Monitors It For The Feds?”

Subscribe: RSS Leave a comment
38 Comments
Anonymous Coward says:

Names Aren't Personally Identifying Information?

First he says that they develop portfolios on names. Then he says that they never look at personally identifying information. In order for both of those statements to be true, it would have to mean that “names” aren’t considered “personally identifying information”.

Yeah, right.

Chris Maresca (profile) says:

Not sonic.net

From http://www.sonic.net/support/docs/policy.shtml#privacy

“Sonic.net does not actively monitor customer use of the Internet, customer email or other customer communications in the course of its regular operations. Sonic.net is also strongly opposed to the use of third-party information-harvesting strategies and technologies such as unlawful wiretapping.”

Sonic has been a great ISP, highly recommended, esp. given their relatively low price.

My old ISP, Speakeasy, is slightly more ambiguous (from http://www.speakeasy.net/tos/msa.php#2)

“Speakeasy will not sell, rent, or lease Customer’s personally identifiable information to others. Except as may be required by subpoena, search warrant, or other legal process or in the case of imminent physical harm to a customer or others, Speakeasy will only share the personal data the Customer provided with business partners who are acting on Speakeasy’s behalf to complete the activities Customer requested. In that event, Speakeasy’s business partners will be governed by Speakeasy’s privacy policy with respect to the use of this data. Should a company not governed by Speakeasy’s privacy policy require Customer’s personal information, Customer’s permission will be initially obtained, unless seeking Customer’s permission is inconsistent with legal guidelines or legal requirements. The use of any shared data will be governed by the company’s respective privacy policy. “

Hulser (profile) says:

Re: Not sonic.net

Maybe this is just the cynic in me, but the two sentences from Sonic.net appear to be specifically worded to allow for loopholes…

Sonic.net does not actively monitor customer use of the Internet, customer email or other customer communications in the course of its regular operations.

Notice it only says that Sonic.net doesn’t do these things, not that it prevents other groups from doing so.

“Sonic.net is also strongly opposed to the use of third-party information-harvesting strategies and technologies such as unlawful wiretapping.”

And this statement doesn’t actually say that Sonic.net doesn’t allow third-party information harvesting, just that they’re opposed to it. I can just hear it now, “Well, we are opposed to it, but we can’t afford not to sell your personal information. Duh! What did you think we meant?”

Anonymous Coward says:

Re: Re: Not sonic.net

“Sonic.net is also strongly opposed to the use of third-party information-harvesting strategies and technologies such as unlawful wiretapping.”

And this statement doesn’t actually say that Sonic.net doesn’t allow third-party information harvesting, just that they’re opposed to it.

And even that they limit to the case of “unlawful wiretapping”. They’re apparently fine with other types of “third-party information-harvesting”. In other words, as long as it’s legal, they’re good to go with it.

Dane Jasper (profile) says:

Re: Re: Re: Not sonic.net

Hi there. Sonic.net CEO Dane Jasper here.

A few years ago we revisited our old privacy policy to clarify just these sort of questions. That was a time when slimy operations like NebuAd were coming along to try to do ad swapping, and it was the beginning of concerns about sale of things like clickstream data.

I had a hand in the writing of the policy, and it was written with the concerns of the day in mind. It goes beyond simply stating what we will or won’t do, and gives some information on our philosophy – “strongly opposed” and “does not actively monitor” are examples of this. The goal was to provide as much reassurance as we could that we won’t engage in these types of behaviors, because we abhor them.

As there does seem to remain some confusion here, I’ll try to state it as clearly as possible.

With the narrow exception of a lawful obligation (subpoena or warrant), we will not harvest, sell, snoop or share any data about your use of the Internet via our services.

I’ll also state that we are very careful about any subpoenas and warrants that we do get, and we reject roughly 50% of them as they are improperly executed. Also, in any case where we are allowed to do so, we always inform our customer prior to handing over any information. (Some ongoing criminal investigations incorporate a gag order which we must legally obey. This must be granted by a judge based upon justification provided by investigators in a criminal case.)

We structured this notice procedure so that customers who might be subject to a “John Doe” civil lawsuit would have an opportunity to retain counsel and object to any data hand-over BEFORE it happens. Most service providers don’t bother with this, as they have no obligation to do so.

Finally, note that we don’t log any actual Internet activity, so even under subpoena or warrant, we don’t know what you have done, so we cannot reveal it. Our logging is limited to IP allocation and authentication data, the minimum required to support our services.

I hope this clarifies our official position and my opinion on some of the items under discussion here.


Dane Jasper
CEO and Co-Founder
Sonic.net

Hulser (profile) says:

Re: Re: Re:2 Not sonic.net

Mr. Jasper, I know I’m a bit late in replying, but I’d like to say thanks for the clarification. As a frequent reader of TechDirt, I see so many instances of companies trying to twist the wording in laws, contracts, or other agreements beyond all recognition, it’s hard not to look at things like the excerpt from your privacy statement with cynicism. But as another poster pointed out, if you’d like to differentiate yourself from the other ISPs who don’t take privacy as seriously as you do, I would humbly suggest that you change the wording to be more definitive.

Anonymous Coward says:

Re: Not sonic.net

Recently I read a story about photos that convey a message of eco-friendlyness. Marketing slicks that use untouched pristine natural environments. The company’s that used the more visually beautiful scene tend to be the worst on the environment. The worst of the world polluters.

The more that ISP’s brag about not monitoring your traffic are the ones I’d be most skeptical of. Elaboration is fabrication anyone.

slacker525600 (profile) says:

all this seems really fishy to me

defcon people are known for pranking …
project vigilent https://www.projectvigilant.us/securedrupal/ and bbhc global https://www.bbhc-global.com/securedrupal/ are stupid drupal sites that look like they took five minutes to set up badly, going against any legitimacy associated with some of the big names being thrown around as associates of the organization/s.
as well as lots of conflicting information being bandied about. details of the lamo case, length of existence (as well as other information) about project vigilant. I mean, maybe they have done a good job of being secretive, but going public at defcon you would assume the organization would have something ready to present to the public given the way internet backlash over privacy works. … just saying

known coward says:

As Frank Zappa said

” This is the CENTRAL
SCRUTINIZER…it is my responsibility to enforce
all the laws that haven’t been passed yet. It is
also my responsibility to alert each and every one
of you to the potential consequences of various
ordinary everyday activities you might be
performing which could eventually lead to *The
Death Penalty* (or affect your parents’ credit
rating). Our criminal institutions are full of
little creeps like you who do wrong things…and
many of them were driven to these crimes by a
horrible force called MUSIC!

Our studies have shown that this horrible force is
so dangerous to society at large that laws are
being drawn up at this very moment to stop it
forever! Cruel and inhuman punishments are being
carefully described in tiny paragraphs so they
won’t conflict with the Constitution (which,
itself, is being modified in order to accommodate
THE FUTURE). . . . .

slacker525600 (profile) says:

all this seems really fishy to me

defcon people are known for pranking …
project vigilent https://www.projectvigilant.us/securedrupal/ and bbhc global https://www.bbhc-global.com/securedrupal/ are stupid drupal sites that look like they took five minutes to set up badly, going against any legitimacy associated with some of the big names being thrown around as associates of the organization/s.
as well as lots of conflicting information being bandied about. details of the lamo case, length of existence (as well as other information) about project vigilant. I mean, maybe they have done a good job of being secretive, but going public at defcon you would assume the organization would have something ready to present to the public given the way internet backlash over privacy works. … just saying

G Harper (profile) says:

Comcast's EULA allows it...

http://www.comcast.net/terms/subscriber/

Section 3b:
Monitoring of Postings and Transmissions.

Comcast shall have no obligation to monitor postings or transmissions made in connection with HSI. However, you acknowledge and agree that Comcast and its agents have the right to monitor, from time to time, any such postings and transmissions, including without limitation e-mail, newsgroups, chat, IP audio and video, and Web space content. Comcast may also use and disclose them in accordance with the Comcast High-Speed Internet Acceptable Use Policy and other applicable policies, and as otherwise required by law or government request. We reserve the right to refuse to upload, post, publish, transmit or store any information or materials, in whole or in part, that, in our sole discretion, is unacceptable, undesirable or in violation of this Agreement.

designerfx (profile) says:

Re: Comcast's EULA allows it...

not only that, but this part under 4b

“Some features of certain Software are provided by third parties, and those third parties may collect or transmit personally identifiable and non-personally identifiable information about you in the course of providing these features. These third parties are not authorized to use your personally identifiable information except for the purpose of providing their services to you through Software. Your use of Software is subject to the terms of the Comcast Customer Privacy Notice, the Comcast Acceptable Use Policy and other applicable terms and policies.”

Ross Wolf says:

The FBI recently asked for the power to obtain without warrants, Citizens’ “electronic communication transactional records” including email addresses they used to send communications. If the FBI’s request for warrant-less Internet surveillance is granted, Citizens to avoid federal conspiracy charges will have to report to police (every email) they receive that might allude to anything illegal.

FBI’s request for no warrant Internet surveillance can’t be viewed separately: if pending bills in Congress pass, the FBI can then use its warrant-less Internet surveillance to arrest and indefinitely detain Americans on mere suspicion not evidence, based on their Internet Activity. Private information the FBI derives from warrant-less searches of emails and Internet Activity—could potentially be used by U.S. Government to blackmail, target anyone though government harassment, prosecution or civil asset forfeiture because he or she disagreed with government.

Will lawful Internet Activity, be used by Government to detain/arrest Americans without probable cause? On March 4, 2010, Sen. McCain introduced The “Enemy Belligerent Interrogation, Detention, and Prosecution Act of 2010.” McCain’s bill would eliminate several Constitutional protections allowing Government to arbitrarily pick up Americans on mere suspicion—with no probable cause. Under McCain’s bill, your political opinions and statements made on web postings and in emails against U.S. Government and others could be used by authorities to deem you a “hostile” “Enemy Belligerent” to cause your arrest and indefinite detention. U.S. activists and individuals under McCain’s bill would be extremely vulnerable to detention or prosecution, if (charged with suspicion) of “intentionally providing support to hostilities or an Act of Terrorism”, for example American activists can’t control what other activists might do illegally—they network by email domestically and overseas. The Government under McCain’s bill would need only allege an individual kept in military detention, is an Unprivileged Enemy Belligerent suspected of; having engaged in hostilities against the United States; its coalition partners; or Civilians or (has) purposefully and materially supported hostilities against the United States; its coalition partners or U.S. civilians. Detained Americans can be denied legal counsel.

Alarmingly the Obama Government recently employed a vendor to search Internet social networking sites to collect information about Americans that could potentially be used by this government to injure Americans, for example, if you apply for a federal job, your name might be crossed referenced by the Obama Government with comments you made at Websites against Obama; or if you make application at a bank for a loan the Government has control since the financial crisis, could your Internet comment(s) prevent you getting that loan? Obama’s monitoring of the Internet sites can too easily be used by Government to intimidate, coerce and extort Corporations and Citizens from speaking out.

See McCain’s 12-page Senate bill S.3081 The “Enemy Belligerent Interrogation, Detention, and Prosecution Act of 2010 at: assets.theatlantic.com/static/mt/assets/politics/ARM10090.pdf

Obama gave a speech in May 2010 that asked Congress to pass legislation to give the President power, to detain any person in the U.S. that government deems a “combatant” or likely to engage in a violent act in the future. President Obama wants the power to incarcerate U.S. Citizens not on evidence, but for what they might do. Obama wants the power to override the U.S. Constitution, to detain indefinitely any American based on conjecture her or she might do something violent in the future. If Obama’s proposal to detain Americans without probable cause is approved, and FBI is granted warrant-less searches of the Internet, it is foreseeable Government could use anyone’s Internet activity including emails to claim an individual or lawful organization might do something violent in the future to order their indefinite detainment. See: Obama Sound-Video asking for power to detain people without probable cause at:
http://www.brasschecktv.com/page/630.html

What the recent Washington Post Report, (Secret America) did not mention: in the U.S., government-private contractors and their operatives work so close with U.S. law enforcement, exchanging information to arrest Americans and or share in the forfeiture of their assets, they appear to have merged with police. Similarly in 1933 Hitler merged his private police the Gestapo with German national security. Before the Gestapo was consolidated with the German Government, the Gestapo arrested Citizens and confiscated private property with no legal authority. However U.S. Government has already granted that power to private U.S. contractors. In 1939 all German Police agencies including the Gestapo were put under the control of the “Reich Main Security Office” the equivalent of U.S. Homeland Security.

Can History repeat itself? Should there be a radical change of U.S. Government, history shows law enforcement is generally not replaced; that police will work for—e.g. a fascist U.S. Government; communist or other despot government—against the interests of Citizens. Note: The German police first worked for a democracy before Hitler; then worked for the Nazi Fascists; then joined the Soviet Union’s East German Police (Stasi) believed to be the world most oppressive police force until the German Wall came down. Consequently it should be expected U.S. Government security contractors and private mercenary corporations would work for a despot U.S. Government.

If FBI warrant-less Internet Spying is approved, it is problematic the FBI will share its spying with law enforcement, government contractors and private individuals that have security clearances to facilitate the arrest and forfeiture of Americans’ property—-to keep part of the bounty. Police too easily can take an innocent person’s hastily written email, Internet fax, phone call or web activity out of context to allege a crime or violation was committed to cause an arrest or confiscation of someone’s property. There are over 200 U.S. laws and violations mentioned in the Civil Asset Forfeiture Reform Act of 2000 and the Patriot Act that can subject property to civil asset forfeiture. Under federal civil asset forfeiture laws, a person or business need not be charged with a crime for government to forfeit their property.

Rep. Henry Hyde’s bill HR 1658 passed, the “Civil Asset Forfeiture Reform Act of 2000” and effectively eliminated the “statue of limitations” for Government Civil Asset Forfeiture. The statute now runs five years from when police allege they “learned” that an asset became subject to forfeiture. With such a weak statute of limitations and the low standard of civil proof needed for government to forfeit property “A preponderance of Evidence”, it is problematic law enforcement and private government contractors will want access to FBI, NSA and other government Internet surveillance, including wiretaps perhaps illegal to arrest Americans and to seize their homes, assets and businesses under Title 18USC and other laws.

Of obvious concern, what happens to fair justice in America if police and government contractors become dependent on “Asset Forfeiture” to pay their salaries and operating costs?

out_of_the_blue says:

Re: @ Ross Wolf: a most excellent post.

Sorry to have missed it when current — only yesterday! One of the bad aspects of sites such as this (note no specific criticism), is the transient attention to topics, then everyone hurries along to the next, usually to drop a mere one-liner. So, appreciate your effort, read it all, and agree.

David Muir (profile) says:

Rogers

In Canada, Rogers has this scary line in their T’s and C’s:

“We have the right, but not the obligation, to monitor or investigate any content that is transmitted using the Services (other than voice Services) or the Equipment. We may also access or preserve content or information to comply with legal process in Canada or foreign jurisdictions, operate the Services, ensure compliance with the Service Agreement or any Policies, or protect ourselves, our customers or the public. We may move, remove or refuse to post any content, information or materials, in whole or in part, that we decide are unacceptable, undesirable or in violation of the Service Agreement.”

Spaceman Spiff (profile) says:

Not surprised

I’m not surprised that Comcrap and Togers reserve the right to pwn your internet traffic. But then, I wouldn’t use either of them if my life depended upon it… In any case, it just goes to show that one needs to read and understand the fine print in many of these EULA’s.

Finally, my hat’s off to Sonic.net for their policies, at least as stated. Too bad other ISP’s aren’t as clear and ethical in the treatment of their customers.

josephW grant (profile) says:

Information gathering

It’s common knowledge that all information transmitted in the U.S. and all information going out or arriving in the U.S. is intercepted and stored. The government doesn’t read everything, but they have everything. And this is just one reason the transparency demands by Wikileaks is so important. We have the right to know what’s going on. Just look where we are as a result of a few dragging us into wars, paying corporations to move their factories to foreign countries to take advantage of cheap labor and dumping their U.S. workforce, I think it’s clear that secrecy – no transparency – has really screwed things up. Can’t let this go on.

Ben Gardner (profile) says:

Rogers

I am also in Canada, but I use Bell Canada. I dumped Rogers because of this clause. Because Bell/ca is a brother to Bell.us, I encrypt everything that goes through them. I use a proxy located in the former Soviet Union that will decipher communication before passing it on to the final destination. It also encrypts everything sent back to me. Using a 256-bit key will make it difficult for NSA and homeland security to figure out what I’m doing.

Leave a Reply to Chris Maresca Cancel reply

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Ctrl-Alt-Speech

A weekly news podcast from
Mike Masnick & Ben Whitelaw

Subscribe now to Ctrl-Alt-Speech »
Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...