{"id":12655,"date":"2020-05-22T08:29:13","date_gmt":"2020-05-22T15:29:13","guid":{"rendered":"https:\/\/blog.mozilla.org\/?p=12655"},"modified":"2020-05-22T10:12:39","modified_gmt":"2020-05-22T17:12:39","slug":"usa-freedom-and-browsing-history","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/","title":{"rendered":"The USA Freedom Act and Browsing History"},"content":{"rendered":"<p><a href=\"https:\/\/blog.mozilla.org\/blog\/author\/ekrmozilla-com\/\"><img decoding=\"async\" loading=\"lazy\" class=\"alignleft size-thumbnail wp-image-12587\" src=\"https:\/\/blog.mozilla.org\/wp-content\/uploads\/2020\/04\/header_blog_EKR_thumbnail_01_1400x770_200422-150x150.jpg\" alt=\"\" width=\"150\" height=\"150\" \/><\/a>Last Thursday, the US Senate <a href=\"https:\/\/www.washingtonpost.com\/national-security\/senate-passes-fisa-surveillance-reform-bill-paving-way-for-house-passage\/2020\/05\/14\/87e3e0b0-9536-11ea-82b4-c8db161ff6e5_story.html\">voted to renew<\/a> the <a href=\"https:\/\/en.wikipedia.org\/wiki\/USA_Freedom_Act\">USA Freedom Act<\/a> which authorizes a variety of forms of national surveillance. As has been reported, this renewal <a href=\"https:\/\/www.vox.com\/recode\/2020\/5\/13\/21257481\/wyden-freedom-patriot-act-amendment-mcconnell\">does not include<\/a> an amendment offered by Sen. Ron Wyden and Sen. Steve Daines that would have explicitly prohibited the warrantless collection of Web browsing history. The legislation is now\u00a0 being considered by the House of Representatives and today Mozilla and a number of other technology companies sent a<a href=\"https:\/\/blog.mozilla.org\/blog\/2020\/05\/22\/protecting-search-and-browsing-data-from-warrantless-access\/\"> letter<\/a> urging them to adopt the Wyden-Daines language in their version of the bill. This post helps fill in the technical background of what all this means.<\/p>\n<p>Despite what you might think from the term \u201cbrowsing history,\u201d we\u2019re not talking about browsing data stored on <i>your <\/i>computer. Web browsers like Firefox store, on your computer, a list of the places you\u2019ve gone so that you can go back and find things and to help provide better suggestions when you type stuff in the awesomebar. That\u2019s how it is that you can type \u2018f\u2019 in the awesomebar and it might suggest you go to Facebook.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone wp-image-12656\" src=\"https:\/\/blog.mozilla.org\/wp-content\/uploads\/2020\/05\/firefox-facebook-crop-300x97.jpg\" alt=\"\" width=\"625\" height=\"202\" srcset=\"https:\/\/blog.mozilla.org\/blogarchive\/files\/2020\/05\/firefox-facebook-crop-300x97.jpg 300w, https:\/\/blog.mozilla.org\/blogarchive\/files\/2020\/05\/firefox-facebook-crop-600x194.jpg 600w, https:\/\/blog.mozilla.org\/blogarchive\/files\/2020\/05\/firefox-facebook-crop-768x248.jpg 768w, https:\/\/blog.mozilla.org\/blogarchive\/files\/2020\/05\/firefox-facebook-crop-1000x323.jpg 1000w, https:\/\/blog.mozilla.org\/blogarchive\/files\/2020\/05\/firefox-facebook-crop.jpg 1155w\" sizes=\"(max-width: 625px) 100vw, 625px\" \/><\/p>\n<p>Browsers also store a pile of other information on your computer, like cookies, passwords, cached files, etc. that help improve your browsing experience and all of this can be used to infer where you have been. This information obviously has privacy implications if you share a computer or if someone gets access to your computer, and most browsers provide some sort of mode that lets you surf without storing history (Firefox calls this <a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/private-browsing-use-firefox-without-history\">Private Browsing<\/a>). Anyway, while this information can be accessed by law enforcement if they have access to your computer, it\u2019s generally subject to the same conditions as other data on your computer and those conditions aren\u2019t the topic at hand.<\/p>\n<p>In this context, what \u201cweb browsing history\u201d refers to is data which is stored outside your computer by third parties. It turns out there is quite a lot of this kind of data, generally falling into four broad categories:<\/p>\n<ul>\n<li><b>Telecommunications metadata. <\/b>Typically, as you browse the Internet, your<i> Internet Service Provider <\/i>(ISP) learns every website you visit. This information leaks via a variety of channels (<a href=\"https:\/\/hacks.mozilla.org\/2018\/05\/a-cartoon-intro-to-dns-over-https\/\">DNS lookups<\/a>), the IP address of sites, TLS <i>Server Name Indication <\/i>(SNI), and then ISPs have various policies for how much of this data they log and for how long. Now that <a href=\"https:\/\/letsencrypt.org\/stats\/#percent-pageloads\">most sites have TLS Encryption<\/a> this data generally will be just the name of the Web site you are going to, but not what pages you go to on the site. For instance, if you go to WebMD, the ISP won\u2019t know what page you went to, they just know that you went to WebMD.<\/li>\n<\/ul>\n<ul>\n<li><b>Web Tracking Data. <\/b>As is increasingly well known, a giant network of third party trackers <a href=\"https:\/\/en.wikipedia.org\/wiki\/Web_tracking\">follows you around the Internet<\/a>. What these trackers are doing is building up a profile of your browsing history so that they can monetize it in various ways. This data often includes the exact pages that you visit\u00a0 and will be tied to your IP address and other potentially identifying information.<\/li>\n<\/ul>\n<ul>\n<li><b>Web Site Data. <\/b>Any Web site that you go to is very likely to keep extensive logs of everything you do on the site, including what pages you visit and what links you click. They may also record what outgoing links you click. For instance, when you do searches, many search engines record not just the search terms, but what links you click on, even when they go to other sites. In addition, many sites include various third party analytics systems which themselves may record your browsing history or even make a recording of your<a href=\"https:\/\/freedom-to-tinker.com\/2017\/11\/15\/no-boundaries-exfiltration-of-personal-data-by-session-replay-scripts\/\"> behavior on the site, including keystrokes, mouse movements, etc. so it can be replayed later<\/a>.<\/li>\n<\/ul>\n<ul>\n<li><b>Browser Sync Data. <\/b>Although the browsing history stored on your computer may not be directly accessible, many browsers offer a \u201csync\u201d feature which lets you share history, bookmarks, passwords, etc. between browser instances (such as between your phone and your laptop). This information has to be stored on a server somewhere and so is potentially accessible. By default, Firefox <a href=\"https:\/\/hacks.mozilla.org\/2018\/11\/firefox-sync-privacy\/\">encrypts<\/a> this data by default, but in some other browsers you need to enable that feature yourself.<\/li>\n<\/ul>\n<p>So there\u2019s a huge amount of very detailed data about people\u2019s browsing behavior sitting out there on various servers on the Internet. Because this is such sensitive information, in Mozilla\u2019s products we try to minimize how much of it is collected with features such as encrypted sync (see above) or <a href=\"https:\/\/support.mozilla.org\/en-US\/kb\/enhanced-tracking-protection-firefox-desktop\">enhanced tracking protection<\/a>. However, even so there is still far too much data about user browsing behavior being collected and stored by a variety of parties.<\/p>\n<p>This information isn\u2019t being collected for law enforcement purposes but rather for a variety of product and commercial reasons. However, the fact that it exists and is being stored means that it is accessible to law enforcement if they follow the right process; the question at hand here is what that process actually is, and specifically in the US what data requires a warrant to access &#8212; demanding a showing of \u2018probable cause\u2019 plus a lot of procedural safeguards &#8212; and what can be accessed with a more lightweight procedure. A more detailed treatment of this topic can be found in this<a href=\"https:\/\/www.lawfareblog.com\/senate-proposes-five-amendments-fisa-reform\"> Lawfare piece<\/a> by Margaret Taylor, but at a high level, the question turns on whether data is viewed as content or metadata, with content generally requiring a <a href=\"https:\/\/www.lawfareblog.com\/relative-vs-absolute-approaches-contentmetadata-line\">more heavyweight process and a higher level of evidence.<\/a><\/p>\n<p>Unfortunately, historically the line between content and metadata hasn\u2019t been incredibly clear in the US courts. In some cases the sites you visit (e.g., <a href=\"http:\/\/www.webmd.com\">www.webmd.com<\/a>) are treated as metadata, in which case that data would not require a warrant. By contrast, the exact page you went to on WebMD would be content and would require a warrant. However, the sites themselves reveal a huge amount of information about you. Consider, for instance, the implications of having <a href=\"https:\/\/en.wikipedia.org\/wiki\/Ashley_Madison_data_breach\">Ashley Madison<\/a> or <a href=\"https:\/\/en.wikipedia.org\/wiki\/Stormfront_(website)\">Stormfront<\/a> in your browsing history. The <a href=\"https:\/\/www.documentcloud.org\/documents\/6888545-DainesFISAAmendment.html\">Wyden-Daines amendment <\/a>would have resolved that ambiguity in favor of requiring a warrant for all\u00a0 Web browsing history and search history. If the House reauthorizes USA Freedom without this language, we will be left with this somewhat uncertain situation but one where in practice much of people\u2019s activity on the Internet\u00a0 &#8212; including activity which they would rather keep secret &#8212;\u00a0 may be subject to surveillance without a warrant.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last Thursday, the US Senate voted to renew the USA Freedom Act which authorizes a variety of forms of national surveillance. As has been reported, this renewal does not include &hellip; <a class=\"go\" href=\"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/\">Read more<\/a><\/p>\n","protected":false},"author":1590,"featured_media":12588,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,290369,847],"tags":[],"coauthors":[320790],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>The USA Freedom Act and Browsing History - The Mozilla Blog (Archived)<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Eric Rescorla\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/\",\"url\":\"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/\",\"name\":\"The USA Freedom Act and Browsing History - The Mozilla Blog (Archived)\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/blogarchive\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.mozilla.org\/blogarchive\/files\/2020\/04\/header_blog_EKR_thumbnail_02_1400x770_200422.jpg\",\"datePublished\":\"2020-05-22T15:29:13+00:00\",\"dateModified\":\"2020-05-22T17:12:39+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/blogarchive\/#\/schema\/person\/d7c6be5f71d0f9fe53dbf12167ba6722\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/#primaryimage\",\"url\":\"https:\/\/blog.mozilla.org\/blogarchive\/files\/2020\/04\/header_blog_EKR_thumbnail_02_1400x770_200422.jpg\",\"contentUrl\":\"https:\/\/blog.mozilla.org\/blogarchive\/files\/2020\/04\/header_blog_EKR_thumbnail_02_1400x770_200422.jpg\",\"width\":1400,\"height\":770},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/blogarchive\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The USA Freedom Act and Browsing History\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/blogarchive\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/blogarchive\/\",\"name\":\"The Mozilla Blog (Archived)\",\"description\":\"Dispatches from the Internet frontier.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/blogarchive\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/blogarchive\/#\/schema\/person\/d7c6be5f71d0f9fe53dbf12167ba6722\",\"name\":\"Eric Rescorla\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/blogarchive\/#\/schema\/person\/image\/c6482f6cac44a3b976245fffcf934e00\",\"url\":\"https:\/\/blog.mozilla.org\/wp-content\/uploads\/2020\/04\/eric-rescorla-high-res-96x96.jpg\",\"contentUrl\":\"https:\/\/blog.mozilla.org\/wp-content\/uploads\/2020\/04\/eric-rescorla-high-res-96x96.jpg\",\"caption\":\"Eric Rescorla\"},\"description\":\"Eric is CTO of the Firefox team at Mozilla.\",\"url\":\"https:\/\/blog.mozilla.org\/blogarchive\/blog\/author\/ekrmozilla-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The USA Freedom Act and Browsing History - The Mozilla Blog (Archived)","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/","twitter_misc":{"Written by":"Eric Rescorla","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/","url":"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/","name":"The USA Freedom Act and Browsing History - The Mozilla Blog (Archived)","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/blogarchive\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/#primaryimage"},"image":{"@id":"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.mozilla.org\/blogarchive\/files\/2020\/04\/header_blog_EKR_thumbnail_02_1400x770_200422.jpg","datePublished":"2020-05-22T15:29:13+00:00","dateModified":"2020-05-22T17:12:39+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/blogarchive\/#\/schema\/person\/d7c6be5f71d0f9fe53dbf12167ba6722"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/#primaryimage","url":"https:\/\/blog.mozilla.org\/blogarchive\/files\/2020\/04\/header_blog_EKR_thumbnail_02_1400x770_200422.jpg","contentUrl":"https:\/\/blog.mozilla.org\/blogarchive\/files\/2020\/04\/header_blog_EKR_thumbnail_02_1400x770_200422.jpg","width":1400,"height":770},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/blogarchive\/blog\/2020\/05\/22\/usa-freedom-and-browsing-history\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/blogarchive\/"},{"@type":"ListItem","position":2,"name":"The USA Freedom Act and Browsing History"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/blogarchive\/#website","url":"https:\/\/blog.mozilla.org\/blogarchive\/","name":"The Mozilla Blog (Archived)","description":"Dispatches from the Internet frontier.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/blogarchive\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/blogarchive\/#\/schema\/person\/d7c6be5f71d0f9fe53dbf12167ba6722","name":"Eric Rescorla","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/blogarchive\/#\/schema\/person\/image\/c6482f6cac44a3b976245fffcf934e00","url":"https:\/\/blog.mozilla.org\/wp-content\/uploads\/2020\/04\/eric-rescorla-high-res-96x96.jpg","contentUrl":"https:\/\/blog.mozilla.org\/wp-content\/uploads\/2020\/04\/eric-rescorla-high-res-96x96.jpg","caption":"Eric Rescorla"},"description":"Eric is CTO of the Firefox team at Mozilla.","url":"https:\/\/blog.mozilla.org\/blogarchive\/blog\/author\/ekrmozilla-com\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/blogarchive\/wp-json\/wp\/v2\/posts\/12655"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/blogarchive\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/blogarchive\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/blogarchive\/wp-json\/wp\/v2\/users\/1590"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/blogarchive\/wp-json\/wp\/v2\/comments?post=12655"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/blogarchive\/wp-json\/wp\/v2\/posts\/12655\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/blogarchive\/wp-json\/wp\/v2\/media\/12588"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/blogarchive\/wp-json\/wp\/v2\/media?parent=12655"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/blogarchive\/wp-json\/wp\/v2\/categories?post=12655"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/blogarchive\/wp-json\/wp\/v2\/tags?post=12655"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/blogarchive\/wp-json\/wp\/v2\/coauthors?post=12655"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}