Hacker News Reader

Comment by toufka | Hacker News Reader

As Snowden stated, the data on nearly everyone alive's habits is kept 'safe and secret' by policy alone, and not by any technical or legal controls. There are few if any technical or legal limits to what the United States government collects about not only the world, but also its citizens. As policy changes, from period to period or president to president, the data too will be subject to ever-changing political controls. If no technical or legal safeguards are installed, then at some inevitable point along that pendulum swing, those in charge of keeping that data 'safe and secret' will not have your best interests in mind and will use it to harm your interests in pursuit of their own: "Turnkey tyranny."

View on HN

It isn't just government. Any company with your credit card or SSN or even browsing history is collecting loads of data about you. They have to take explicit steps to sanitize data between warehouses and they only undertake the effort for fear of being sued.

Is there any liability other than having PII data hacked?

There are government agencies that can give you a smack down for mishandling PII even if you're not hacked. They do do audits now and then although from what I've heard they are a little stone age in their methods and might not catch on if you're doing something shady unless it's obvious.

This just isn't true. You can't, on one hand, claim the NSA has everyone's data, and on the other hand claim Apple has a legitimate case against the FBI -- if the NSA had that data, they'd share it with the FBI, and Apple would be tilting at windmills.

Edit: A lot of speculation and guesses in the replies here. If anyone's got actual evidence that the NSA "has data on everyone" or "wouldn't share their intel with the FBI", please post it. Otherwise, why make the claim?

If you all really think the NSA can simply magic their way into an encrypted system, then why even bother? You're flying in the face of every security expert's opinion on the matter. No one with expertise in this area is going to agree that the NSA has data collection ongoing for every person in the US, that's patently absurd. The Snowden leaks showed us what they're capable of, and while it was substantial, it wasn't universal. Not by a long shot, and especially not after so many fixes were made as a result of those leaks.

Is parallel construction relevant to this?

As far as I can tell, parallel construction won't even be necessary in this new model. It's very troubling.

>if the NSA had that data, they'd share it with the FBI

No they would not. Different government agencies are tasked with different resources, different objectives, and different guiding laws. What is legal for some agencies is blatantly illegal for others. The NSA has no domestic mission and cannot generally operate on American soil - true of the entire US military [1]. This blurring of those lines is exactly the problem. By permitting the FBI to take on NSA-like capabilities, and giving the NSA FBI-like responsibilities one gives the military a role in monitoring its own citizens, and an adversarial law enforcement agency unlimited espionage powers - very dangerous precedents - digital or otherwise.

[1] https://en.wikipedia.org/wiki/Posse_Comitatus_Act

The FBI most definitely has access to intelligence databases and information:

http://www.nytimes.com/interactive/2015/04/25/us/25stellarwi...

A key part of the FBI's mission is "to protect and defend the United States against terrorist and foreign intelligence threats" after all:

https://www.fbi.gov/about-us/faqs

They have limited access to some intelligence databases and information. That doesn't mean that they can just pop random selectors through PRISM for the lulz though - nor does it mean that the FBI and NSA share everything they have on everybody, or at least they don't for now.

I don't think it is in anyway limited:

https://www.fbi.gov/news/testimony/facilitating-an-enhanced-...

As to the point about selectors, if a selector has an even remotely domestic terrorism related component, and is authorized by the FISA court, the FBI can and does see that information.

Edit: added qualifier about terrorism

NSA is an agency of the Department of Defense. CIA is an independent organization. FBI is counted among the set of US "Intelligence" organizations, but if there's one thing media and memoirs tell us, it's that organization in different Departments have a history of not playing nice. Case in point, all the finger pointing around organizations not sharing information pre 9/11.

DOD and DOJ in particular I don't think have such a close buddy-buddy relationship.

Information sharing greatly increased post 9/11. See my reply to the sibling comment.

They may not "have everyone's data", but they have data on most Americans in one form or another. Presumably pretty extensive data. You can claim the NSA has data on the majority of people and still recognize the FBI doesn't need to have access to the drives of whatever mobile devices they are able to convince a judge to let them into.

> They may not "have everyone's data", but they have data on most Americans in one form or another

Where did you hear that? It's not in anything that's been leaked, and the NSA surely didn't say it, so I'm curious where you got that information.

To be fair, I'm assuming you're talking about data collected clandestinely, not stuff like tax information or social security number (obviously the government has that data). If you're just talking about the data that gets generated as part of being a citizen of the US, then yes, the NSA, FBI, IRS, etc. probably does have that information.

> It's not in anything that's been leaked

Yes, it has been, though the exact nature of that "data" depends on your interpretation, and "everyone" is obviously only and approximate value. The NSA has even admitted to collecting most telephone records under the "phone metadata program".

They also keep a sliding-window capture of data that includes a "full take" of the backbone in some areas. This was still being deployed at the time the leaked documents were written, so the coverage is variable, but we can assume it's only increased. Note that this is covered by one of the NSA's "creative reinterpretations"; they pretend that the data isn't "captured" until someone actually looks the data up in XKEYSCORE. This is patently absurd.

Note that this is covered by one of the NSA's "creative reinterpretations"; they pretend that the data isn't "captured" until someone actually looks the data up in XKEYSCORE. This is patently absurd.

You're the NSA, trying to gather information foreign agents in the United States. You have access to some firehose of network packets, some of which may include communication between such agents and their home nations, but most of which is purely domestic. You also lack the technology to pull the needles out of the haystack in real time.

Why is it "patently absurd" to retain a window of such data for long enough to identify the communications of interest and discard the rest? Is there an alternative?

> Why is it "patently absurd" to retain a window of such data for

He said it was "patently absurd" to pretend that they haven't "captured" any data until someone searches for it.

> long enough to identify the communications of interest and discard the rest?

I have no reason to think that they wouldn't keep all of it, forever, period. Or at least retain a long enough window to render this statement pointless.

> Is there an alternative?

Old fashioned police work? Only gather data with a warrant?

He said it was "patently absurd" to pretend that they haven't "captured" any data until someone searches for it.

Fishing trawlers don't capture everything they catch: Most of it gets thrown back. This is all semantics, but without more context for the word "capture" (like, why it wouldn't be legal to capture data you'll never look at), I don't think it's patently absurd to read the term in a way that makes reasonable intelligence work possible.

What if they only buffered the data for a few seconds while picking out the "good stuff"? A few hours? Where is the line?

I have no reason to think that they wouldn't keep all of it, forever, period. Or at least retain a long enough window to render this statement pointless.

If you think the NSA has no effective oversight and is lying to the FISA court or the President about what it does and doesn't do, you have bigger problems.

Old fashioned police work? Only gather data with a warrant?

The NSA isn't a domestic law enforcement agency. You're thinking of the FBI.

That's the problem, where is the line? Because there barely seems to be one. Shuffle a few laws around and whoops, authoritarians in power have infrastructure to do as they please.

> What if they only buffered the data for a few seconds while picking out the "good stuff"?

That's not what they do. They keep it. Indefinitely. That's the whole point- If they find a terrorist, they can back-search and find everyone he has communicated with.

> If you think the NSA has no effective oversight and is lying to the FISA court or the President about what it does and doesn't do,

This is an outright fact, and if you think it's not true, then I don't know what I can do for you. Is there an opposite-of-conspiracy theorist, someone who believes any outlandish theory that supports the status quo? Just bizarre.

http://www.hasjamesclapperbeenindictedyet.com/

> It's not in anything that's been leaked

This is just false. It's literally the main reason Snowden went public.

https://en.wikipedia.org/wiki/PRISM_(surveillance_program)

Please, go back and read the Snowden revelations. It seems you are not aware of the fact that the NSA has been collecting data on everyone for years. Dig deeper.

They aren't saying they "have everyone's data" but that they have data on everyone's habits. First sentence.

Where did you get the idea that the NSA has all the data in your phone? They collect a lot of stuff that goes over the wire, but no one thinks they have all data stored on every device.

Folks here do, read the other comments. They think the NSA could give the FBI the data, but just won't.

some data grabbed from wherever they could hack data flows != every single bit out of phone memory

Incredulity doesn't pass as evidence around here.

Another point to consider: Even if the NSA had relevant data to the San Bernardino shooters, and even if the NSA was happy to share that information, that still does not guarantee that the FBI would not move forward with the request to conscript Apple into doing their bidding.

Prosecutors with agendas wait long and patiently for a case with the appropriate circumstances to make a request. If a prosecutor was waiting for a way in which to make sure that Apple wasn't able to eliminate the possibility of making requests that the government couldn't get access to, they would likely have to wait a long time for a better set of circumstances to make their case against.

In this case - the victims are unsympathetic, and dead - the victims are unambiguously terrorists - the victims themselves do not own the phone - there's no concern of having to get things done secretly (e.g., there's no imminent attack that the government has to keep under wraps)

A prosecutor who wants the All Writs Act to have the power they think it does would not allow this case to go unused, even if there was no material need for them to win the case.

Reply on news.ycombinator.com