Hacker News Reader

Comment by jancsika | Hacker News Reader

We can't sensibly discuss this story here unless we know which definition of "collect" is being used in the story.

Normal definition: collect. For example: "Even collected all the data going to and from Bob's house by putting a splitter on the cable."

NSA's definition: not that, as cited in various stories sourced by the Snowden leaks from the Guardian.

I won't attempt to define exactly how the NSA defines "collect" because I don't have time to track down and read the relevant article. But the upshot is-- their definition is idiosyncratic and misleading for a piece that has a general audience like this one.

View on HN

It's not only a matter of definitions. It's also a matter of belief. The head of the NSA has lied directly to congress about data collection activities. We have absolutely no reason to believe they will have actually stopped collecting data even if they say so.

Right. It's prudent to assume that the NSA intercepts all Internet traffic, and stores as much as they can, for as long as they can, focusing on what seems most important. Everything is retained for a few days. Then they triage, based on names, addresses, keywords, and so on. Metadata and encrypted stuff, they reportedly retain indefinitely.

According to Russ Tice, the NSA has been conducting full-take domestic content collection on everyone.

In other words, not only metadata but full recordings and content of anything they can feasibly store—phone calls, text messages, internet conversations, video chat.

Collecting on Americans in such a manner satisfies legal requirements because the very definition of collection has been twisted to effectively mean accessing intercepted content present in storage.

The term metadata in particular was intentionally bandied about as a means of distracting from the fact NSA is getting everything. The metadata programs killed by congress amounted to little more than a dog and pony show, sacrificing deprecated programs for political ends. Personally I think it was a brilliant damage control measure.

Snowden arguably didn't help matters either, constantly using the term himself. The content he leaked was largely from JWICS, which wouldn't contain documents outlining the gory details of full-take domestic surveillance. Those likely are heavily compartmented, and reside on much more secure networks.

Yes, the NSA does do that. And they probably consider it to be their job, no matter what the damn civilians say.

EO12333 suspends the fourth amendment for everyone subject to a background investigation for clearance purposes. At the very minimum they will maintain their domestic collection ability just to exercise that power.

their definition (via secret interpretation of USSID 18, according to Bill Binney[1]) is roughly that it's only collected if they actually go back and look at it at some point down the line. your web browsing history (or whatever) sitting on a hard drive in utah doesn't fall under this definition until they look at it.

[1] https://youtu.be/r9-3K3rkPRE

Ah so that lends credence to my rationale for scraping websites. Until I actually look at the scraped data no scraping has taken place so no terms of use have been violated. When I look at the scraped data the terms of use come into effect but now I'm personally present so no robotic scraping has taken place.

That's what I do! I just download and store (but not collect!!) all those stupid Marvel comic films, just to piss off the MPAA (and for security purposes / the children). And this is fine because I don't actually watch them. Or can stand them. It's the rules, and I don't wanna break them!

Well, scraping has taken place, so you've violated a eula and potentially committed theft. But you haven't violated copyright, as long as you do not distribute the data either, (through any means) pretty sure that's fair "use."

Ymmv, not a lawyer and this is internet bullshitting, not legal advice.

Eureka! We make a class-action lawsuit, charging the government $X billion for violating our copyrights because of NSA surveillance!

The government can exempt themselves from IP laws. For example, the government has exempted itself and defence contractors for violating patents (to build top secret devices) in the past.

Yeah, not going to happen because of "the national security interest of the United States". A related concept is a contract contrary to public policy.

Alas! Sovereign immunity means you can't sue the government without their permission.

Where are you going to sue the government... in a government court?

...yes? Couldn't there be valid causes of action for government acts? Are we simply assuming bad faith on the part of the government for any possible scenarios?

Only in a revolution, I suspect. And revolutions are not to be undertaken lightly.

Is it illegal?,

https://www.quora.com/What-is-the-legality-of-web-scraping

The answer from Pablo Hoffman talks and provides some links regarding web scraping and US cases.

This isn't really a secret interpretation, I and a lot of people I knew noticed the same thing over a decade ago by reading the privacy policies of tech companies. Reading the data requires a warrant. Recording the data doesn't.

The important aspect for the NSA's interpretation is that algorithms can look at and process the data and create metadata or synopsis information from it.

Having an intelligence system ingest this metadata and synopsis is not considered "collection".

Essentially, if it can be automated, it isn't collection. If a human gets pulled into the loop to look at data, that's when it's collected. However, a human could be shown a synopsis or an inference about an American target and this could still not be collection, as the summary information being viewed isn't considered the person's private records.

Basically a loophole in a loophole. I'll be happy to keep databases of, and run software over, our national security records. I won't collect any of it, though. I won't even look at it. I'll just get summaries of the information contained in it from my algorithms - and if I want to look at a specific document I'll punch a rubber stamp on it first.

And what will you need to show to obtain said rubber stamp? This is not secret, either:

Search for "how FISA works" here: http://www.belfercenter.org/sites/default/files/legacy/files...

Curiously, a fair amount of genetic research is done this way: the genetic info is PHI, but the covered entity holds the data and the computer capacity. The researcher just pushes an algorithm to the cluster and gets aggregate results back.

That's the idea, but in practice GA4GH is still working on the API's and protocols to make this work in an automated and containerised fashion for modern genetic data. We do often send the algorithm to the data but mostly by way of granting an account to collaborators and them sshing into a remote cluster because copying 120 terabyte datasets is no fun.

well, it's a secret interpretation of a particular executive order (EO 12333 signed by reagan, if you're curious), in the sense that it's not obvious on its face from reading the order that one should come to the same interpretation as they have, and that they don't officially divulge that interpretation.

prior to snowden, almost everybody (you and your clever colleagues excluded, obviously) would think it was paranoid to believe this was the case. at least, there's no way i could make the leap from:

'EULA's state that recording activity on a company's servers by that company [i assume this is what you mean?] doesn't require a warrant but the government reading it does'

to:

'the government records incomprehensible amounts of domestic traffic but it doesn't count as warrantless surveillance because they don't read most of it'

EO 12333 doesn't redefine collection. Data collected abroad under 12333 is still "acquired" according to the definition in the NSA's documents leaked by Snowden. Do you have any documents that you can point to that say otherwise?

i should have been less ambiguous, sorry -- USSID 18 is derived from EO 12333, and USSID 18 nominally provides protections to US citizens from being spied upon; USSID 18 also is what has a secret interpretation by NSA lawyers that most people would probably feel is not in the spirit of the EO. here's a very nice writeup:

https://www.eff.org/deeplinks/2014/06/primer-executive-order...

section 4 outlines collection policy, beginning on page 6 of the pdf:

https://www.dni.gov/files/documents/1118/CLEANEDFinal%20USSI...

Section 9 of that document defines "collection" to mean what you would expect it to mean.

the issue is that there is a secret interpretation of it, as i explained in each of the above posts

edit: if the term' collection' is your major gripe, i apologize -- i rewatched the video i cited and the term is actually 'intercept', not 'collect'

Why don't any of Snowden's documents confirm that they're using this interpretation and instead show that they are interpreting it as everyone else does?

What bearing does a private company's privacy policy have on warrants? I think I see what you're getting at but what a private company consider warrant-worthy or not is irrelevant when discussing the governments position.

Ah, the old "Schrodinger Defense".

So they're taking a rather quantum take on this as a superposition of states that are unknown until measurement occurs and they collapse the wave function into being "collected". Cool.

Why are judges only focusing on the "search" part of the Fourth Amendment and not on the "seizure" part as well?

That kind of action should count as a seizure, no?

> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

If you still have the thing, it clearly hasn't been seized.

Therefore the only question left is whether it was a search.

That draws an interesting counterpoint: the RIAA's long standing attempt to have copying of non-physical things be perceived as theft.

It is right out of a comedian sketch. Then govt massively penalizes citizens for doing a thing. Turn around with a straight face and tell you, in the name of National Security, that it is okay for them to do it.

Scumbag Uncle Sam

And we have no idea if their idiosyncratic definition has changed since then.

So all it would take is for them to change their policy at any point in the future, even only for a few minutes, and instantly "collect" all current and historical emails from Americans.

No. Collection, unlike retention, of US Persons' data is governed via court decisions, not NSA policy.

If Congress doesn't like these retention / collection interpretation of their laws, they can clarify them in statute at any time. But they haven't and probably won't, because "retain everything for judicially approved retroactive collection" is incredibly useful e.g. when a bomb goes off at a marathon and a judge OKs the suspect's communications being reviewed.

So, they archive the data and promise not to collect it (look at it) unless they have a national security letter signed by a judge^H^H^H^H^H drinking buddy from the office.

Not only do they "promise" but they realize they'd be violating the legal boundaries placed on their organization if they do. Arguing they shouldn't have the capability for this is like arguing the army shouldn't be allowed to have tanks because then they have the capacity to perform a military coup.

No judge has ever signed an NSL. That's precisely the distinction between a "regular" judicial subpoena and an administrative subpoena [1].

Subpoenas have nothing to do with NSA interception, and everything to do with ordering businesses to produce evidence or individuals to testify pertaining to a crime. The case law setting the "expectation of privacy" test is from the 70s, and the electronic wiretapping laws from the 80's. The only recent development is that SCOTUS decided people don't have a reasonable expectation of privacy when their cell phone connects to cell towers because that's obviously how they work [2].

You don't need a law degree nor security clearance to understand this. Stop finding reasons to justify your anger and start getting informed.

1. https://en.wikipedia.org/wiki/National_security_letter

2. https://en.wikipedia.org/wiki/Third-party_doctrine

Maybe I should have ended with a smiley, because I don't feeel tardy^H^H^H^H^H angry. I was just trying to point out that there is a way that "retroactive collection" can take place that isn't "judicially approved."

I do think the US could use some legislative work on privacy. I'm glad there are FISA courts issuing search warrants, but don't think national security letters should actually be a thing.

Yeah, and cops can murder people. The solution isn't to take away their guns.

Good call re: NSL. I don't quite understand why investigators need NSL instead of a court order. Avenues for abuse seem relatively clear with no obvious ways to recourse or even know when it occurs!

This seems like such an obvious violation of the fourth amendment to me.

> no warrants shall issue, but upon probable cause

When the data is retrieved and stored (note I did NOT say "collected") seems to me to be an important part of the fourth amendment. Under the NSA's definition of "collect", the police could -- without warrant -- come to your house every day to scan all documents and take pictures of everything and keep it as long as they "promise" to not review it until they do get a warrant. Does that sound like a reasonable interpretation of the fourth amendment to you?

There are so many laws that it's unknowable to be sure that you're not violating one at any moment, and in fact it's been estimated that you break three federal laws every day [1]. With the amount of information the NSA stores it's likely they could legally put away any citizen in the country. This gives them absolute power, since all they have to do is invent a story about how they legally "collected" the information, aka Parallel Construction [2].

Now lets add in arbitrary, secret laws (which completely undermine the purpose of laws and democratic/representative government, btw) and their necessary secret trials. This turns the "unknowable" in the previous paragraph from "practically true because it's untenable" to "literally true" because you're not allowed to know it. This means on top of all of the above, there can be no oversight or public accountability of the actions of the government against citizens.

This is a mindbogglingly omnipotent combination: Retroactive "Collection" + every citizen could be tried as a felon + Parallel Construction + no accountability.

I don't understand how this wouldn't concern you.

[1]: https://mises.org/library/decriminalize-average-man

[2]: https://en.wikipedia.org/wiki/Parallel_construction

No, because they'd be entering my house. If I send an SMS, however, it goes out of my house, you see?

Discretion of investigators, prosecutors, and judges means that the "you break federal laws every day" is a no-op argument, and repealing laws takes a lot of work. I'd rather Congress focused on e.g. fixing healthcare.

Parallel construction has existed at least as long as the USA, i.e. since there have been non-public data sources. Parents, do it too. If you're upset about it you're a child.

"Arbitrary, secret laws"? What a load of nonsense. Congress passes and debates every federal law in public (albeit sometimes a bit quickly). You mean secret interpretations of laws by FISA? Yeah, not exactly news and relatively public and subject to review by elected lawmakers. How, exactly, do you suggest counterintel should work, sans secret courts?

It doesn't concern me because this combination stems from ignorance and an overactive imagination that wants to see evil where there is no evidence of evil. I imagine the systems you mention has avenues for abuse and also checks to make sure they are not abused. We should absolutely be vigilant for signs of abuse and talk about them.

Given the concrete issues facing our society right now, abuse by lawless investigators colluding with a court appointed by SCOTUS to... do what, exactly?

I see, so you'd be fine with them scanning and storing a copy of every piece of mail that ever crossed your mailbox in the same fashion.

If you're ok with having to rely on their discretion we may already be talking past each other. A bedrock principle of the constitution and amendments are that the government's discretion can't be trusted, so discretion must be limited and controlled and standardized. My point is that discretion to use a power is no different from just having the power outright.

Appeal to tradition, a strawman, followed by an ad hominem. I hope you're saving a better counter for later. Parents don't need parallel construction, they already have absolute power and can investigate however they wish. Are you sure you understand what parallel construction is? A simplified example: A prosecutor wants to convict a citizen (for whatever reason) but they don't have any evidence, so they use illegal means to find evidence that they couldn't have practically found otherwise. But this is inadmissible in court, so they fabricate an "investigation" that -- through the prosecutor's superior "intuition" and uncannily accurate "hunches" -- ends up producing some of the same evidence, enough to make a conviction. I don't understand your goal here, are you saying that parallel construction is fine and the source of evidence doesn't matter? It sounds like you're trying to throw out the exclusionary rule altogether.

I'm sorry you're not aware about the existence of secret laws. Please read up on it [1], it may be enlightening. If you take issue with my use of the adjective "arbitrary", I'll give you that. (But if they're secret how is that really so different from arbitrary?) If you take issue with my colloquial use of "law" that includes regulations, executive branch pronouncements, and secret interpretations that fundamentally change the plain reading of statutes, I'm not sure what to tell you other than to stop being pedantic and think of the bigger picture. "Couterintel" is an overused excuse employed to dodge accountability, most of the time it doesn't need to be secret. "Subject to review". Yeah, sure [2].

What you see as "overactive imagination" I see as a healthy distrust of the government, because "all men having power ought to be distrusted to a certain degree" [James Madison, 3]. Yes the checks exist, but the systems I mention are the circumvention of these same checks. What I see from you is sticking your fingers in your ear, burying your head in the sand, and singing LALALA as loud as you can when presented with evidence of the very abuses for which you say we should stay vigilant.

[1]: http://www.brennancenter.org/publication/new-era-secret-law or https://www.nytimes.com/2016/10/18/opinion/the-governments-a...

[2]: https://www.theguardian.com/commentisfree/2013/jun/19/fisa-c...

[3]: http://avalon.law.yale.edu/18th_century/debates_711.asp

The NSA calls getting the data "interception". It calls LOOKING AT THE DATA BY A HUMAN WHO IS AN NSA EMPLOYEE "collection". It considers there to be no limits whatsoever on "interception" and permanent storage of communications data. It considers there to be some minor legal limits on "collection".

We can assume the NSA will continue to intercept approximately 100% of the world's communications, and store them in Utah, and "collect" them when legally feasible or desirable.

This story is, at best, a trivial change in NSA operations, and more likely, zero change in NSA operations. (The NSA is permitted to lie to you or the press about its operations.)

The Times really did a crap job of explaining that.

The headline is so unequivocal but a close reading of the article implies the opposite is true.

Indeed, congratulations on their great PR work.

General Hayden was recently on Sam Harris' podcast and he briefly explained the 'retroactive collection' concept-

https://www.samharris.org/podcast/item/privacy-and-security

I'd say his arguments appear clear and convincing, even to a skeptic like myself. I wonder what can be done to counter his seemingly perfect narrative so Americans can be rightfully concerned about what's happening.

To be clear, I don't believe Hayden, he is likely lying about aspects of it, these systems will inevitably be used in the future for regular law enforcement purposes and the previous abuses by NSA staff is understated. Plus, it is unequivocally illegal and a violation of natural rights. And just a bad idea which will lead to a dangerous future.

> I wonder what can be done to counter his seemingly perfect narrative so Americans can be rightfully concerned about what's happening.

I think that a) redefining common terms to mean idiosyncratic things and b) using the idiosyncratic terms in public to imply their original common meaning is enough to trigger a warning to the layperson against putting too much stock in a particular speaker's narrative. I can say from experience that people tend to perk up when you give them such a warning.

Also, Sam Harris isn't particularly well-versed in the issues surrounding wide-net surveillance. Add Bruce Schneier or Dan Bernstein to the discussion and that "seemingly perfect narrative" will start to look very different.

Any transcripts / summaries?

Good call. This is the country for which loopholes exist that basically allow any processed food product to claim being 'made with 100% chicken' [though not 100% of this product is that '100% chicken'] or 'Made with [a company called] 'Real'['s] cheese" or whatnot...

> 100% grated parmesan cheese. It's 100% grated. And there is parmesan cheese in it. Just not 100% cheese.

etc etc (via reddit this morning).

Can't really trust words that are picked to imply conclusions that are not legally being declared rigorously (and audited by some lawyer of an independent entity).

Not wittingly idiosyncratic, though, right?

this deserves more upvotes

This isn't the only time something silly like that is in law. In New York, a loaded gun is any gun that you possess at the same time as ammunition suitable for it.

The NSA doesn't define "collect." It defines "acquisition" of data, and their definition matches the definition you or I would use. https://www.aclu.org/files/assets/minimization_procedures_us...

There were some conspiracy theories about the NSA's definition of "collect" around when the first Snowden documents were published, but those were never substantiated in the documents, while the normal definition was confirmed in Snowden's documents (above).

Reply on news.ycombinator.com