X

Congressional confusion on Internet privacy

CNET News.com's Declan McCullagh examines why a Republican supporter of online privacy wants to force Net providers to snoop on what Americans do online.

Declan McCullagh Former Senior Writer
Declan McCullagh is the chief political correspondent for CNET. You can e-mail him or follow him on Twitter as declanm. Declan previously was a reporter for Time and the Washington bureau chief for Wired and wrote the Taking Liberties section and Other People's Money column for CBS News' Web site.
Declan McCullagh
4 min read
When it comes to Internet privacy, Rep. Joe Barton embodies contradictions.

The Texas Republican, chairman of the House Energy and Commerce Committee, claims to be a steadfast supporter of online privacy. He's piped up at innumerable hearings about Social Security number misuse and data breaches and has pledged, as recently as May, to enact a sweeping law protecting Americans' privacy rights.

Barton
Rep. Joe Barton

He seems serious enough. "Whether Social Security numbers should be sold by Internet data brokers to anyone willing to pay, indistinguishable from sports scores or stock quotes...to me, that's a no-brainer," Barton said. Such a practice should not be allowed, he said. "Period. End of debate."

Which is why it's so odd that Barton is just as serious about forcing Internet providers to snoop on what Americans are doing online--which would create a much bigger privacy threat, after all, than a few bottom-feeding information brokers.

Barton said last week that he was going to push for a "comprehensive" child protection law that will probably include data retention.

ISP snooping timeline

In events that were first reported by CNET News.com, Bush administration officials have said Internet providers must keep track of what Americans are doing online. Here's the timeline:

June 2005: Justice Department officials quietly propose data retention rules.

December 2005: European Parliament votes for data retention of up to two years.

April 14, 2006: Data retention proposals surface in Colorado and the U.S. Congress.

April 20, 2006: Attorney General Gonzales says data retention "must be addressed."

April 28, 2006: Rep. DeGette proposes data retention amendment.

May 16, 2006: Rep. Sensenbrenner drafts data retention legislation -- but backs away from it two days later.

May 26, 2006: Gonzales and FBI Director Mueller meet with Internet and telecommunications companies.

June 27, 2006: Rep. Barton, chair of a House committee, calls new child protection legislation a "highest priority"

Data retention is, of course, an idea that the Europeans pioneered in a vote last December. Data retention laws vary, but generally say that user identities and Internet addresses must be recorded by Internet service providers, and perhaps logs of e-mail and instant-messaging correspondents and Web pages visited as well.

The privacy and security risks (click here for PDF) are likely to be immense.

Building massive electronic warehouses with details on what Americans are doing online would create an irresistible temptation for data thieves. Trial lawyers, divorce attorneys, and anyone else with a creative lawsuit would try to delve into those warehouses for their own purposes--it wouldn't be limited to child protection or terrorism investigations. And, of course, serious criminals would use anonymous Wi-Fi connections at a local coffeehouse or library anyway.

Nevertheless, Barton announced last Wednesday and Thursday that he was going to press forward. A child exploitation law is "one of the highest priority issues not just before this subcommittee, but the full committee," Barton said. "It is my intention to...see if we can't develop very quickly a comprehensive piece of anti-child-pornography legislation."

Barton's aide, David Cavicke, has said that his boss has made "a commitment" to address data retention legislation this year, an idea backed by Attorney General Alberto Gonzales, making the anti-child-pornography bill the most likely mechanism. (A spokesman for Barton on Friday said no details had been announced.)

The connection between keeping records on Americans' Internet activities and protecting children goes like this: There have been some instances of law enforcement investigations that have been hindered because IP address lists are routinely discarded after a few months. (An IP address is a unique four-byte address used to communicate with a device on a computer network that relies on the Internet Protocol. An IP address associated with CNET.com, for instance, is 216.239.113.101.)

Unfortunately, this is an election year. Instead of encouraging police to move more quickly and not drag their feet, politicians have decided to target Internet service providers. (Social networking sites may be swept up too.)

Barton's no technologist himself; he has degrees in industrial engineering and industrial administration. He's been on the government payroll for more than two decades, and before that was a consultant to Atlantic Richfield Oil and Gas, now part of BP Amoco.

But Barton does have a knack for determined politicking. He was the chief sponsor of the balanced budget amendment, trying year after year for the better part of a decade to get it enacted (and once coming reasonably close in the House of Representatives).

It's just a shame that this time Barton's formidable determination is misplaced.