Comment by sneak | Hacker News Reader

Comment by sneak | Hacker News Reader

US military intelligence already believes that they don't need warrants; they've decided (in a secret, internal opinion) via the (again, secret) FISA court that the FISA Amendments Act, section 702, permits them to retrieve data on anyone they like directly from the service providers, even if those people are suspected of no crime, and are citizens/residents of the US. This has been going on for fourteen years, since Microsoft became the first partner in the program on (lol) 11th September, 2007, and started giving them dumps of people's hotmail email boxes and such.

It's the #1 source for NSA reporting, eclipsing even their bulk cable wiretaps. They can hit a button and get Google Takeout, but for all major US online services, for anyone they choose, no warrant required.

These sorts of headlines pretend that their "normal" way of spying does require warrants. It absolutely does not.

A lot of people seem to still carry the misconception that the FISA orders (again, not warrants, no probable cause, issued by a classified court (also run by US military intelligence) that never denies a request) are only for foreigners ("foreign" is right in the name). That's also not true: they use it to target US citizens too.

This specific circumstance was cited by Ed Snowden as one of the main reasons he came forward and told everyone that this was happening.

https://www.eff.org/702-spying

The participants in this system as of 2013: Microsoft, Yahoo, Google, Facebook, PalTalk, YouTube, Skype, AOL, Apple.

https://www.theguardian.com/world/interactive/2013/nov/01/pr...

> Make no mistake: the bill he eventually signed — S. 139 — very much affects American citizens. That bill reauthorized Section 702 original enacted as part of the FISA Amendments Act — a legal authority the NSA uses to justify its collection of countless Americans’ emails, chat logs, and browsing history without first obtaining a warrant. The surveillance allowed under this law operates largely in the dark and violates Americans’ Fourth Amendment right to privacy.

https://www.eff.org/deeplinks/2018/01/state-union-what-wasnt... link found at https://www.eff.org/702-spying

Why should they need a warrant for information that's being sold or public?

The contents of your Gmail inbox or Facebook DMs are neither.

Because of this:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

Well... no warrants were issued, no search conducted, and nothing seized.

Where is the violation?

Not saying this is good, just that it isn’t against the constitution. If the data is publicly available for purchase, nothing in the constitution says the government can’t buy it.

Can you clarify why you think that no search is conducted when using this data? My understanding of your question is that you think that dragnet operations don't involve searching, which doesn't match reality.

The data is handed over willingly to a third party. You agreed to this by accepting the fine print in the contract. In the US, your rights end when another other party takes possession unless it's health data.

I know what my rights are. My question for clarification is in spite of the fact that signed agreements give companies the effective ability to share with gov agencies. It still doesn't answer the question of how it's any different from a search.

Heh, re: health data. HIPAA considers the name of hospital to be private information (try FOIAing the hospital names where people have died from COVID). But, if I go to a hospital with my phone on, then that fact will be available in location data that's bought by gov agencies. Through your qualification, have my rights ended by this fact?

I think I'm not secure, when people in the military or police etc can get my exact location that easily.

I could get arrested too easily, by law enforcement who skipped some steps in the process and got the wrong person? Maybe LEOs more eagerly do SWAT raids when they know the person's exact location? (I'm guessing)

So, could it be a partial violation of "secure"?

"The right of the people to be secure in their persons, houses"

It’s not any different than a criminal taking evidence to a pawn shop, and then expecting that the pawn shop couldn’t say anything about it to the police.

The problem is that we’ve all become accustomed to agreeing to give away our data, while pretending that we didn’t.

Sounds like you want something like GDPR. Without that entities can collect and sell data about you like this, and the government can buy it.

> Well... no warrants were issued, no search conducted, and nothing seized.

The violation is that they were able to sidestep legal processes like warrants by buying the data. If you don't see the issue with that, then I'm not sure what to tell you. It doesn't become okay just because they're purposefully avoiding legal scrutiny. It's like saying HSBC's money laundering is totally fine because they're successfully avoiding legal or law enforcement action.

But it's not your data. It's data from Google, AOL, Skype and so forth. Also the 4th existing in a world of Civil Forfeiture shows how weak it is when the rubber meets the road.

Note that, under the GDPR, data that is collected from you and pertains to you is considered your property. America doesn't have a similar stance on the books, but it probably should.

The recent Carpenter decision means that cellphone data held by a third party still needs a warrant to seize.

The USG argues that since the same data is already being sold commercially, they can buy it on the open market without a warrant.

For the curious, the SCOTUS opinion on Carpenter v United States is here (PDF warning):

https://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf

If the government would need a warrant to collect that data it should be illegal for any company to collect, sell, or in any other way utilize that same data.

That is basic consumer protection common sense; but even without the pandemic and the other four horseman of the apocalypse crisis of democracy facing the US, and most if not all other nations on the planet right now, don't expect any such consumer goods to be on the agenda.

> If the government would need a warrant to collect that data it should be illegal for any company to collect, sell, or in any other way utilize that same data.

I think you just banned email hosting.

Email hosting does not share your inbox with 3rd parties.

I meant the "collect" part.

Probably not right there. There is little reason to take it to an extreme as such when your goal might be defending an even lesser issue.

It's not public. I can't go to Microsoft and pay them to send me your emails.

They aren’t buying emails, they are buying location data. And yes, disturbingly, you can go and buy the location data of anyone you want.

> The bill that was most recently passed, S. 139, endorses nearly all warrantless searches of databases containing Americans’ communications collected under Section 702.

I think you might be a little lost. Whilst yes, they are buying location data. However, providers are _also_ supplying them with emails. And everything else they could want. And that isn't something that you can go and buy.

Really? How?

Googling, I found this https://nymag.com/intelligencer/2019/01/report-demonstrates-... , which seems to say it involved someone with access to the data selling it in an unauthorized way that's supposed to be against the rules of the company but is maybe not enforced much.

Have a lot of money and call a data broker. In 49 states, this data is almost entirely unregulated. The only reason they self enforce some restrictions on selling it to small potato customers, is because they don’t want any public attention.

For the last 14 years, the US military intelligence community has done precisely that: from Microsoft specifically.

It seem to be quite obvious. If law enforcement need a warrant to do something or get something but can circumvent the law by paying someone else they are, well, circumventing the law which obviously is or at least should be illegal. I can't see why it is even a discussion.

Reply on news.ycombinator.com