Thank you for you informative response. I've signed the whitehouse.gov petition. And here and
elsewhere, I encourage everyone reading to write to their Congresscritters and demand reform,
rather than posting here. Eventually, they'll get the message.

It's a lot more than just the ECPA that needs change and being added to our laws. The NSA seems to me
to be out of control. Let's reduce their budget in a major way!

It's data. It happens not to be complete - there's more, namely the audio of the call.

Intelligence agencies have been doing traffic analysis on this sort of data -- just who is
communicating with whom - for at least 70 years. For NSA to refer to it as "only metadata"
is the height of hypocrisy.

Note that IBM did the same thing with about 1000 of its patents, more than 10 years ago. And shortly
thereafter, followed up with another 1000 or so.

You want he shoulda said irregardful?

IANAL, and I don't play one on TV, but it seems pretty clearly a violation of a web site's copyright to do this. A web page
is a visual work, and at least for any country that is party to the Bern Convention (this includes the US and most or all of Europe),
a page is copyright even if it doesn't say so. So for the hotel or ISP to modify the page, especially when it is being paid to do so,
seems a clear violation. Some web site should make a big stink (lawsuit!) about this and put an end to the practice. I think it wouldn't
be a difficult case to win, particularly with all the other copyright enforcement actions going on (MPAA, etc.).

I wonder if a similar case can be made for organizations like health clubs that show TV programs at the wrong aspect ratio, making
people look as if they're 20% fatter (wider) than they actually are...

Here's an idea/meme: Create a way to describe both the password rules and storage policy for a web site in a few characters.
Then encourage sites to put those characters next to the "Enter Password" box on their site. The intended effect is to make users
aware of the rules of the site, and ultimately to force them to improve their policy. Here's an example of what I mean:

0 means "we store your password in the clear"
1 means "we encrypt your password using standard techniques"
2 means "we one-way encrypt your password and store only the encrypted value"
3 means "we one-way encrypt your password with salt, and store only encrypted, salted value"
4 means "3 and also we have an effective means in place to prevent repeated guessing by an external agent"
                                                  (some sort of time-delay for bad guesses, getting progressively longer, or something similar..)

(Any more needed?)

and maybe use a letter for the password policy:

A means "password has a short maximum length" (8?) and silly constraints on what characters must be present"
C means "No restriction on password length, but some constraints on characters" ....
Z means "Password can be arbitrarily long and include any character you can type."

So 0A would be a disaster, and the goal would be to move sites toward 4Z. And you'd see what the site does
every time you log on (assuming, of course, that they're honest, but this would be easily auditable..) Even people
who didn't understand what the specifics mean could be educated to know that closer to 4Z is better. (This is just
an example... I'm sure a better encoding is possible...)

It is hard enough to know if I should trust my child, and I raised him. He doesn't
tell me much. App developers tell me less, and some of them are devious. This is not
a good security model. And Google knows better.

The heading says 50,000, which is pretty crazy.. but all of the text refers to numbers more like 5,000....

I don't want to cast aspersions (or worse!) on your experts, but in my experience most of those
people (especially architects) never go back to see how what they built is working out, what they did
wrong, what could be improved in their next project, etc. I'm sure there are some who do, but it certainly
is not standard practice, so you're wise to ask the slashdot crowd for real experience.

.. from a company called Earth Class Mail. They receive your mail, send you an image of the envelope, and let you tell them what to do with it: shred it, recycle it, open and scan contents and send PDF, deposit check, etc. The company was the subject of a sort-of documentary last year.