Metafilter Data Retention Policy? August 8, 2013 8:27 PM   Subscribe

What protocols does Metafilter have for dealing with a National Security Letter? (Inspired by this post.)

Are there any steps being taken on the backend to preemptively minimize user data retention, or to obfuscate data in such a way as to render it less useful to a third party? What kind of data retention policy would users like to see in place?

Finally, can the mods confirm that they have not received such a letter in the past? If you don't feel comfortable answering that, just close this up.
posted by anemone of the state to MetaFilter-Related at 8:27 PM (84 comments total) 1 user marked this as a favorite

There isn't really anything happening here that would prompt such action by the authorities.
posted by Chocolate Pickle at 8:29 PM on August 8, 2013


This has been discussed, most recently here.

Specifically, I'd refer you to this comment by cortex:
And as maddeningly stupid as this security state stuff is, it sort of puts us in a shitty position to make a "okay, winking's illegal but how about I ask you really, really publicly if you've got something in your eye" entreaty and then leave it up to us to decide just how to blink so that nobody gets the wrong idea.
posted by Lexica at 8:34 PM on August 8, 2013 [6 favorites]


Are there any steps being taken on the backend to preemptively minimize user data retention, or to obfuscate data in such a way as to render it less useful to a third party?

Everything that's posted here is publicly viewable, apart from stuff like memail, payment details and, I suppose, IP address info. What exactly are you worried about? Frankly (if you are US based) the NSA already got all that info via your ISP.

How can you even have a 'data retention policy' for a publicly viewable site that includes archiving of old threads as a core part of its functionality?
posted by His thoughts were red thoughts at 8:46 PM on August 8, 2013 [1 favorite]


What's public is public. Data retention in this case refers to non-user-facing data, whatever that may be.
posted by anemone of the state at 8:47 PM on August 8, 2013


What, you didn't know you could obtain a copy your mod notes with a FOIA request?
posted by planetesimal at 8:56 PM on August 8, 2013 [3 favorites]


It's a little interesting to think about things that might go down in the wake of an anonymous AskMe question a la "How can I anonymously distribute this info I have on U.S. troops hunting Iraqi teenagers for sport?" Even though all the answers would be "DELETE THIS QUESTION NOW!"
posted by nicebookrack at 9:00 PM on August 8, 2013 [1 favorite]


Which is why that question would never be approved.
posted by Night_owl at 9:06 PM on August 8, 2013 [1 favorite]


Yeah, I don't know what the issues are to worry about here, because almost everything is public that you post. The only things private are IP addresses, MeFi Mail, and paypal details.

If I got some sort of FBI goons knocking my door asking about details, I'd likely comply since I have very few resources to fight such a thing, but it's a pointless exercise because I can't possibly imagine a situation that would cause authorities to even pursue something like this.
posted by mathowie (staff) at 9:15 PM on August 8, 2013 [3 favorites]


Don't worry I won't tell anyone about the Kinder Egg ring.
posted by Ad hominem at 9:34 PM on August 8, 2013 [15 favorites]


I can't possibly imagine a situation that would cause authorities to even pursue something like this.

In fairness, that's about what I've been saying to myself for two months now.

MeFi being a site which some people visit with a regularity that could be called "obsessive", I could see IP logs being useful if you wanted to know where someone was. Still, there are undoubtably easier ways.
posted by ODiV at 9:42 PM on August 8, 2013


Don't worry I won't tell anyone about the Kinder Egg ring.

Ahem.

posted by Nonsteroidal Anti-Inflammatory Drug at 9:44 PM on August 8, 2013 [4 favorites]


You ditched your cellphone and your credit cards so they couldn't track you, but you made the mistake of logging in to check your Recent Activity and now you're busted.
posted by planetesimal at 9:44 PM on August 8, 2013 [2 favorites]


You have no idea how often I open a browser, type metafilter.com, and hit enter before I even realize it.
posted by ODiV at 9:46 PM on August 8, 2013 [12 favorites]


I check my favorites only thought 3 firewalls and 9 satellite relays. Not even Visual Basic can backtrack my Internet IP address.
posted by Ad hominem at 9:52 PM on August 8, 2013 [3 favorites]


Kiefer Sutherland slams his hands on the table.

"TELL ME WHERE THE LIKES ARE! I KNOW YOU HAVE THEM!"
posted by Ghostride The Whip at 9:52 PM on August 8, 2013 [4 favorites]


You have no idea how often I open a browser, type metafilter.com, and hit enter before I even realize it

Well, neither do you, though...
posted by aubilenon at 10:12 PM on August 8, 2013 [6 favorites]


but it's a pointless exercise because I can't possibly imagine a situation that would cause authorities to even pursue something like this.

Let me see what I can whip up!
posted by Brandon Blatcher at 10:52 PM on August 8, 2013 [4 favorites]



There isn't really anything happening here that would prompt such action by the authorities.


Everyone says that, but Something Awful got a visit from the Secret Service because somebody made a joke about assasinating the president. Steve Jackson Games got raided because of the Illumanti card game. Etc.
posted by Charlemagne In Sweatpants at 11:14 PM on August 8, 2013 [5 favorites]


I think we're good here.
posted by R. Schlock at 11:16 PM on August 8, 2013


but it's a pointless exercise because I can't possibly imagine a situation that would cause authorities to even pursue something like this.

wouldn't be too hard to imagine. they have an ip, and notice it looks at this website. they can't see memail or deleted comments, so they request that info about any user name that was associated with that ip.

another example: they have a paypal account, see that a payment was made to metafilter, and want to know all the content that was ever posted or transferred on the website.

so, there are two examples. what is the policy? or, are there only "guidelines"?
posted by cupcake1337 at 11:36 PM on August 8, 2013 [1 favorite]


The feds already got your PayPal account.
posted by planetesimal at 11:39 PM on August 8, 2013 [1 favorite]


The Feds might be regular readers, who would only pursue legal action if we they caught you pronouncing it Meh-fite.
posted by It's Raining Florence Henderson at 11:44 PM on August 8, 2013 [1 favorite]


Don't worry I won't tell anyone about the Kinder Egg ring.
Commenters outed themselves already - Schockoladespielzeugkombinationseier.
posted by unliteral at 11:49 PM on August 8, 2013


I think it would be fun, although government types are not known for their senses of humor. A couple of days of trying to decode posts in AskMe and find out what they REALLY mean, and the agents would surely beg for re-assignment.
posted by Cranberry at 11:54 PM on August 8, 2013


Pretty sure an 8-hour shift spent sifting through Human Relations would be enough to break the minds of even the most strong-willed NSA agents.
posted by mstokes650 at 12:00 AM on August 9, 2013 [7 favorites]


I left my private key out at room temperature for about eight hours. There are a couple of funny-looking bytes on one side that I don't think were there before. If I cut those off, can I still encrypt with it?
posted by one more dead town's last parade at 12:11 AM on August 9, 2013 [14 favorites]


WHAT DOES DTMFA MEAN? WHAT HAPPENS IF IT'S SAFE TO EAT? WHO ARE THE CABAL? IANAL, BUT SERIOUSLY, HOW CAN YOU EVEN THINK OF STAYING WITH HIM?
posted by It's Raining Florence Henderson at 12:14 AM on August 9, 2013 [7 favorites]


As long as no one on Metafilter expresses support for Snowden, Assange, Wikileaks, or Manning, everyone here is safe.

quit worrying everyone.
posted by el io at 12:21 AM on August 9, 2013 [5 favorites]


so, there are two examples. what is the policy? or, are there only "guidelines"?

I totally appreciated that.
posted by hal_c_on at 1:16 AM on August 9, 2013


t's a pointless exercise because I can't possibly imagine a situation that would cause authorities to even pursue something like this.


Unlikely as this situation is, imagine if a breaking news thread about a fugitive hunt contained posts by someone claiming to be the fugitive. If the FBI got wind of that, and what that user was saying tallied with the FBI knew about the suspect, I expect they'd want as much user information as you had on the user.

In that situation I think it would be pretty well justifiable for them to ask, and for you to give it to them. Well, depending on the charges, I suppose.
posted by Jon Mitchell at 1:52 AM on August 9, 2013


t's a pointless exercise because I can't possibly imagine a situation that would cause authorities to even pursue something like this.

You can't imagine a situation where the government might want the real names and addresses (via paypal) of comments posted effectively anonymously?
posted by DU at 2:19 AM on August 9, 2013 [3 favorites]


so, there are two examples. what is the policy? or, are there only "guidelines"?
posted by cupcake1337 at 11:36 PM on August 8 [+] [!]


ugh jesus christ let it go.
posted by Marisa Stole the Precious Thing at 3:03 AM on August 9, 2013 [12 favorites]


so, there are two examples. what is the policy? or, are there only "guidelines"?

Their policy would be to do whatever their lawyer told them to do, just like anyone who has any sense would do in such a situation.
posted by double block and bleed at 3:11 AM on August 9, 2013 [1 favorite]


what is the policy? or, are there only "guidelines"?

Matt answered, and there's a FAQ entry; I don't know if you count either/both of those as policies or if they seem more like guidelines, but either way the important thing to know is that IP addresses are recorded, deleted comments still exist in the database and are visible to us, PayPal details are in the database, and so are Mefi mails (though not visible to mods; Matt or pb can access them if necessary). The site isn't safe for total anonymity. We don't give out info, but if we were legally required to, we probably would.
posted by taz (staff) at 3:46 AM on August 9, 2013 [1 favorite]


The latest revelation is that the NSA screens many communications between US citizens and foreign nationals. It's not outside the realm of possibility to imagine that they might request private activity from a website where they know a suspect of an investigation was active.

Your activity on this site isn't private. Not to a determined investigation. Asking mathowie to break US law and risk his business and the livelihoods of his employees and their families would be unfair and also unreasonable.

So it's probably a good idea to keep in mind that you are responsible for what you do and say online. Always. You may feel your internet provider or website owner has an obligation to protect you from law enforcement, but they don't.
posted by zarq at 4:28 AM on August 9, 2013 [4 favorites]


I can barely remember what I had for lunch yesterday, so I'm kind of glad I have MetaFilter acting as secondary storage for me.
posted by arcticseal at 5:01 AM on August 9, 2013 [1 favorite]


I thought twitter and instagram were the official archives for 'what I had for lunch'.
posted by rmd1023 at 5:39 AM on August 9, 2013 [1 favorite]


POSTED

THIS NOTICE INFORMS YOU THAT THE NSA
HAS NOT VISITED METAFILTER

PLEASE WATCH FOR REMOVAL OF THIS NOTICE

posted by slogger at 6:01 AM on August 9, 2013 [4 favorites]


Yeah, slogger, but one can only edit the post for five minutes, so you'll need to keep posting and reposting and reposting UNTIL WE ARE FREE!
posted by wenestvedt at 6:44 AM on August 9, 2013


There are ways of having an anonymous account here. They involve mailing me $5 to sign up from some random location, using a disposable email address to receive your sign-up link, and using Tor or some other mechanism to mask your IP address. We keep your PayPal and IP addresses. We don't keep access logs for very long if I recall correctly (this all happens on the dev side) but Google does our analytics and you know how they are.

We are not dedicated to the anonymous experience here and while we respect users' desire to remain anonymous from each other and try to enforce that, we have never tried to be a place where you could be anonymous from law enforcement. Any decision about what to do with a law enforcement edge case comes from Matt and Matt alone and he's commented in this thread.
posted by jessamyn (staff) at 7:02 AM on August 9, 2013 [6 favorites]


FLEE ALL IS DISCOVERED
posted by jquinby at 7:20 AM on August 9, 2013 [6 favorites]


they can't see memail or deleted comments, so they request that info about any user name that was associated with that ip.

Yeah, I could easily see "Were any of his deleted comments violent?"

Which means, guys, we should strive for less deleted comments, so that the mods have less to fork over to the feds.
posted by corb at 7:33 AM on August 9, 2013


Yes, of course, for that reason.
posted by box at 9:42 AM on August 9, 2013


As long as no one on Metafilter expresses support for Snowden, Assange, Wikileaks, or Manning, everyone here is safe.

So if I was one of Julian's chief inspirations back when we were friends 20 years ago, that'd be a problem?
posted by scalefree at 9:42 AM on August 9, 2013 [1 favorite]


I'm retaining data right now.
posted by Brandon Blatcher at 10:02 AM on August 9, 2013


corb: " Which means, guys, we should strive for less deleted comments, so that the mods have less to fork over to the feds."

Ye gods, I'm so screwed. :)
posted by zarq at 10:04 AM on August 9, 2013 [1 favorite]


If you google my address (and do a drive by on the map), you can see RedBud unloading some craft supplies from the back of her car. If you were NSA you would get the image before the plates got pixelized, so you'd know you had the right place. Nearby, sitting in the shade of our little apple tree, is one of the rescue cats, Bubba, who's watching her with what clearly is anticipatory pleasure. I bet the boys and girls and NSA could look at some of the stuff she already has unloaded onto the yard-cart, and figure out where she'd been that day, or else just tell their search engine to call up all her receipts and see how much she spent and on what. From there, some enterprising analyst could piece together what sort of projects she's working on.

I'm guessing all that info goes into some sort of Brownian slush pile. When the bots flag your ID designator, they'll come visit your file more often than they visit mine, just to see whether you merit a visit by one of the black helicopters.

Given all that, I'm not sure what the issue is about the NSA letter. Programs keys seem to be the only thing that slows them down, and even those are just sort like speed bumps. The only idea that resonates with me is that they are getting business managers on board with the custom of compliance. The are the ones who will make you sign those odd little (voluntary) clauses in your contracts as a condition of employment.

I am more annoyed by the way we are manipulated by data miners who feed our specs into their marketing schemes. Our tastes are being manipulated in a sort of Orwellian effort to make us not so much undisastified with the machine's status on the railroad tracks of life, as confused about who's driving. I'm sure it's all doubleplusgood, though.

We are frogs. The water only got a degree or so warmer, so we still have time before we croak.

ha ha. Croak. (get it?)

Go Snowden! Viva Wikileaks!
posted by mule98J at 10:06 AM on August 9, 2013


A frog will just hop out unless you put the lid on.
posted by planetesimal at 10:49 AM on August 9, 2013 [3 favorites]


Google does our analytics and you know how they are.

Ayup.
posted by flabdablet at 11:24 AM on August 9, 2013


It's really easy to avoid the NSA here on Metafilter - just never favorite a comment made by a user who may later commit a crime.
posted by antonymous at 11:31 AM on August 9, 2013 [1 favorite]


But in all seriousness, maybe redirect nsa.metafilter.com to a text file saying that no NSL has ever been served on Metafilter, then remove the redirect when that changes?
posted by antonymous at 11:33 AM on August 9, 2013 [1 favorite]


Alternately, maybe redirect nsa.metafilter.com to this comment.
posted by box at 11:39 AM on August 9, 2013


redirect nsa.metafilter.com to a text file saying that no NSL has ever been served on Metafilter, then remove the redirect when that changes?

I think this falls under the category of 'Not wanting to be imprisoned for violating the no-signaling portion of an NSL/gag-order'. Or ask[ing] you really, really publicly if you've got something in your eye".
posted by CrystalDave at 11:39 AM on August 9, 2013 [1 favorite]


In all seriousness, the idea that a blatant, willful figleaf workaround on a stupid and draconian law would be any less of a legal liability in practice were it to come to that than a blatant, willful figleafless violation of said stupid and draconian law seems pretty unreasonable.

It's a shitty part of our current government mechanisms, but being cute about that stuff has pretty much never worked out for anybody, ever. I think it's a lot more useful to just reiterate that Metafilter is not, for internet privacy purposes, a hardened island bulwark against the full force of the US government. We won't, as mods, go casually talking out of class about the stuff that's not user-facing on the site, but Metafilter is not and cannot practically become a paranoia-grade anonymous service provider.
posted by cortex (staff) at 11:41 AM on August 9, 2013 [11 favorites]


I've just decided to watch Hackers this evening.
posted by urbanwhaleshark at 1:00 PM on August 9, 2013


Because Screw You The Gibson!
posted by urbanwhaleshark at 1:01 PM on August 9, 2013

POSTED ...
THIS NOTICE INFORMS YOU THAT THE NSA
HAS NOT VISITED METAFILTER...
PLEASE WATCH FOR REMOVAL OF THIS NOTICE
Just for the record if a web site were to put something like this out there, then getting a National Security Letter would pretty much obligate them to never ever take it down under any circumstances, as they would be liable for criminal prosecution if that page ever went blank. The public notice becomes a public lie that must be maintained indefinitely.

Six years ago, in 2007, we first really heard a bit about these NSL beasties. That was a long time ago, halfway to September 11, 2011. They were being issued at a rate of about 70,000 per year back then, about 200 per day, and there's no reason to think that this has slowed down.

70,000 people each year that have to hide a part of their lives from their dearest loved ones, from everyone, in order to prevent themselves from going to jail. And all for something unrelated to their own activities, other than running a business or service. And many of these letters, like the one for the anonymous WashPo editorial writer, are just clear abuses of this ridiculously large privilege that has been granted to those who are supposedly protecting us.

70,000 people each year that need to close off a part of their life, never to be spoken about, alluded to, or mentioned, for fear of going to jail. 70,000. I just can't get that number out of my head. This is an atrocity on the level of thoughtcrime.

So asking about this stuff really does put the admins in a precarious position. If they've received these letters, they already need to hide away that fact from everyone they interact with. But if asked directly, they have to be able to lie, and lie convincingly. And they probably can't just remain silent, refusing to post, as that is also suspicious, and could be considered a tacit admission.
posted by Llama-Lime at 2:18 PM on August 9, 2013 [4 favorites]


I'm imagining government agents assigned to monitor MetaFilter who become obsessed with answering human relations questions in AskMe.
posted by Area Man at 2:23 PM on August 9, 2013 [8 favorites]


Man, now I want to write a novel with that plot. Imagine the questions you could post!
posted by box at 3:37 PM on August 9, 2013 [1 favorite]


"OP, I have a sense your partner is cheating on you and has been using his Yahoo Mail account to communicate with his mistress."
posted by Area Man at 4:02 PM on August 9, 2013 [11 favorites]


Mefi's own NSA. Love those guys. Sent me kinder eggs.
posted by Ad hominem at 4:06 PM on August 9, 2013


Brandon Blatcher: "I'm retaining data right now."

I'm retaining data water right now. FTFM!
posted by deborah at 4:09 PM on August 9, 2013


el io: "As long as no one on Metafilter expresses support for Snowden, Assange, Wikileaks, or Manning, everyone here is safe."

Peyton or Eli?
posted by Chrysostom at 5:00 PM on August 9, 2013


It turns out the NSA is conducting an investigation to discover if Joe in Australia is in fact in Australia as claimed.
posted by humanfont at 5:34 PM on August 9, 2013


Does it matter what Metafilter's policy is? The US intelligence community obviously considers itself above the rule of law, and if they really want something from this or any other site, they'll get it.
posted by threeants at 5:44 PM on August 9, 2013


It'd be like declaring you have a personal policy against being racially profiled. Ok, well, I wish, but good luck with that.
posted by threeants at 5:51 PM on August 9, 2013


Does it matter what Metafilter's policy is? The US intelligence community obviously considers itself above the rule of law, and if they really want something from this or any other site, they'll get it.

Well that's why the data retention part is relevant. No matter how powerful you are, if you ask someone for information they don't have, you aren't going to get it.
posted by aubilenon at 5:54 PM on August 9, 2013


Mefi's own NSA. Love those guys. Sent me kinder eggs.

But they opened them first to see what the toy was, right?
posted by His thoughts were red thoughts at 6:46 PM on August 9, 2013 [2 favorites]


If you dislike security theater, and I do, please understand that these kinds of questions reinforce that drama and do not diminish it. The bulwark against oppressive, inexorable procedure is not to determine with certainty what unbeatable procedures exist in opposition. You cannot defeat the usurping mechanism with protective practice. You can only dehumanize yourself, which is the only thing the system requires. Use your fucking analog head and make choices. The only defense against human-generated automation is human judgement.
posted by Errant at 1:38 AM on August 10, 2013 [1 favorite]


Peyton or Eli?

The third brother.
posted by Night_owl at 1:43 AM on August 10, 2013


Archie Manning said to me in a dream that he is proudest of his third son, even though he will never win a Super Bowl in the NFL, he won the Superbowl of FREEDOM!!!!!!
posted by humanfont at 10:58 AM on August 10, 2013 [1 favorite]


'Cooper Manning' would be a good name for a company that made bespoke artisanal wooden barrels.
posted by box at 11:37 AM on August 10, 2013


Mefi's own NSA. Love those guys. Sent me kinder eggs.

They just sent me the cruel eggs of widespread surveillance, sadly.
posted by Jon Mitchell at 4:05 PM on August 10, 2013


Well, you can't make an omelet while walking on eggshells.
posted by box at 8:05 AM on August 11, 2013


That actually sounds kind of therapeutic. Mmm, reflexology and big meaty omelets.
posted by planetesimal at 12:25 PM on August 11, 2013


I'm about to change the whole eggshell game as you know it.
butter
posted by clavdivs at 8:26 AM on August 12, 2013 [1 favorite]


I could totally go for a kinder egg omelet.
posted by aubilenon at 9:09 AM on August 12, 2013


I won't tell anyone about the Kinder Egg ring.

The only Kinder Eggs I ever had, were received from a MeFi member.
posted by mrbill at 1:17 PM on August 12, 2013


Holy Toledo. I didn't realize until this minute that there's a link between Ulcerative Colitis and suicide! The New Yorker blog post in the original post let me to Larissa MacFarquhar's piece on Aaron Swartz. I wonder if that's really true... Maybe our doctors don't tell us because they think that will encourage a predisposition? Weird.
posted by janey47 at 1:31 PM on August 12, 2013


Matt says he can't envision a situation in which the NSA ever pressures him to do something, but when the soon-to-be a Metafilter user account known as "NSA" wants to post a second AskMe question within the space of a week, you just know he/she is gonna be allowed to.
posted by Effigy2000 at 2:22 PM on August 13, 2013 [2 favorites]


The NSA does not have questions. Only answers.
posted by NSA at 10:55 PM on August 15, 2013 [2 favorites]


It also has 5 less bucks now.
posted by unliteral at 11:01 PM on August 15, 2013 [5 favorites]


unliteral: "It also has 5 less bucks now."

SAME AS IN never mind
posted by jquinby at 3:07 PM on August 16, 2013


mathowie: "I don't know what the issues are to worry about here,"

Why does anyone track what people are looking for in a library?

Think of mefi and associated askmefi etc as knowledge sources or a proxy for a library.

For example, I would like to know what type of questions someone has been asking on askmefi, especially if I can use that to create patterns between questions/discussions related to those related to depressing, loneliness, anger, technical know-how of how hidden cameras work etc.
posted by TheLittlePrince at 10:36 AM on August 22, 2013 [1 favorite]


« Older What do you call this particular type of post?   |   Online ‘Likes’ Herd Others to Similar Views, Study... Newer »

You are not logged in, either login or create an account to post comments