FOIA release: Completely Redacted Document About Text Snooping | Hacker News Reader

FOIA release: Completely Redacted Document About Text Snooping

reason.com

161 pointsraverbashing106 comments

Everyone should assume that text messages are analyzed by a computer and flagged as necessary.

Only select people under investigation would have their entire text message conversations read by a human.

Does the NSA store all text messages? Yes, more than likely. Do their employees snoop on US citizens? Nope. Can other agencies have access to this data? Yes, Patriot Act.

There is a very easy way to test their capabilities. Send a text message with keywords involving bombs and political figures and see what happens. I'm not going to do it, but it would be an interesting experiment.

Information is critical in the world we live in. It's troubling that any secretive organizations would be able to have this much power over citizens, but the alternative is much scarier. The US has to maintain information dominance on the internet. Allowing other countries to dominate the internet could tip the scales of power. The US carries the big stick right now, if China gets the upper hand (and they are trying unimaginably hard) then what? What will the sleeping dragon do? I have nothing against China at all, but the unknown is scary and I simply would rather the US maintain indisputable dominance.

I believe the issue is what happens to all the other data that's not related to the intent of the surveillance. For example, if you're talking to your spouse about a health issue, your sex life, etc. If that's not the target of the surveillance, the government shouldn't be retaining it.

More than likely they are.

It is never read by humans though unless flagged.

And hopefully there are checks-and-balances in place to alert others if a government employee is accessing data about someone that he personally knows.

It's not as easy as "only save texts with the words bomb and weed in them". It's all saved, then analyzed, then retained a few years, then eventually deleted. Is that acceptable for the US government to do?

No, it's not. If a person isn't suspected of a crime the government shouldn't be searching or collecting any of their information. This isn't China or North Korea, we're supposed to be a free country.

It's also amusing how sure you seem about some things, while also adding in a few "hopefully"-s here and there. The truth is, you don't have any idea what they're doing because they don't tell anybody.

The truth is, you don't have any idea what they're doing because they don't tell anybody.

Well, the US government did grant immunity to the big TelComs for their participation in the "Domestic" surveillance program a few years ago...

That tells me all I need to know.

RedPhone anyone? http://www.whispersystems.org/

"It is never read by humans though unless flagged."

With the criteria for being "flagged" remaining secret. Are you a dissident? Now the government can make your life difficult by leaking information about your brief extramarital affair. Maybe the government will concoct a sexual assault case against you to shut you up.

Maybe there should be government whistle-blower laws to try to prevent these kinds of things from happening.

It's not just about whistleblowers or Wikileaks. What about the guy who is critical of US government policies and is gaining a large following? What about the guy who organizes a boycott against a well-connected corporation or industry? What about independent politicians? What about protesters and activists? Almost all adults have some embarrassing secret that might undermine their credibility in the court of public opinion.

> Do their employees snoop of US citizens? Nope.

I'm glad you're so certain.

> Information is critical in the world we live in. It's troubling that any secretive organizations would be able to have this much power over citizens, BUT the alternative is much scarier.

That's just scare mongering. As a country we got by for over 200 years without government surveillance, and nothing has changed to make it necessary now.

> That's just scare mongering. As a country we got by for over 200 years without government surveillance, and nothing has changed to make it necessary now.

I'd argue a lot has changed.

The U.S. has always militarily dominated everything that could hurt it. Soon after our independence, we were intervening in Latin America because in the 1800's, set off from the Old World by two huge oceans, Latin America is what could have hurt us. As the world became smaller, we built a bigger Navy, and by World War I we had the largest in the world. Ever since World War I we have maintained military supremacy in any domain that mattered (naval, air, nuclear, space, etc).

Arguably this is just a continuation of the trend onto the internet, now that the digital sphere matters.

Yep, Information Dominance is a real concept and we have to allow our government to maintain it.

There is a very delicate balancing act being preformed with peoples "rights" to privacy, but the US government is not going to stop monitoring because people want a false sense of privacy.

...and they especially won't stop just because people want a REAL sense of privacy!

I disagree. By that logic the government should have been reading our mail and recording telegraphs, phone calls, and faxes.

I'm also curious what "threat" this is supposed to protect us from.

There are enough communication mediums to choose from that it's pointless to monitor any of them. It's trivial to find or create one that isn't being monitored. It's not stopping criminals, it's just taking freedom from normal citizens.

China can't attack us via telegraph and phone the way it can via the internet.

I don't think the government needs to be reading our text messages. I do think it's silly to pretend nothing has changed in 200 years. Electronic warfare is going to be a thing, and I want to live in a world where the U.S. has the upper hand in it, not China.

We're going to have to figure out a way that accommodates U.S. dominance over electronic networks while reasonably protecting everyone's' privacy. We're not going to do that by burying our heads in the sand and pretending nothing has changed in 200 years.

Nothing that matters has changed. Principles are principles, not something that are subject to the changing whims of the government, or even some fleeting public zeitgeist.

Principles are principles, but they are interpreted in context. It's not about "fleeting public zeitgeist" but about recognizing that American principles have always been about balancing security with liberty. A lot of people would have us read the word "reasonable" out of the 4th amendment, but it's there and it is what implements that balancing. The question is how to find that balance in a world where China can attack important economic assets digitally instead of having to cross an ocean physically.

I should note that I'm not arguing that the government should read text messages. I tend to think that if you're sending something in clear text so some flunkie at AT&T can read it, its no problem if the government can too. My point is that you can't just ignore the real security concerns. The U.S. has never been about liberty at the cost of security.

The problem with spying on clear text messages is that there's no indication to the user that they have no privacy. When the average person is texting their friend, their phone makes it look like a private conversation. It doesn't say, "Send message to Joe, the NSA, AT&T, and your neighbor's pet dog." It just says, "Joe."

Also, this is one rare case where I would accept reasoning by analogy with a physical analog: mail. People have an expectation of privacy when sending letters, and they should rightly expect e-mail and text messages to be treated similarly.

Electronic warfare is not on the same level as real warfare. Nobody will die if the internet is down for a few weeks.

Watching funny cats on YouTube isn't so important that I should give up my privacy. Some mega-corp's website going down for a day or two is less worrisome to me than knowing the government is watching me.

What about the Chinese government having access to US govt systems for several years without anyone knowing? Could leaking nuclear, space, or strategic plans to a foreign government hurt anyone? Yes. All of a sudden the plans for bombs and ships we've spent billions to develop are handed over and free to use. That's not a good thing.

http://www.bloomberg.com/news/2013-05-07/chinese-cyber-spyin...

http://en.wikipedia.org/wiki/Logic_bomb

and of course:

http://en.wikipedia.org/wiki/Stuxnet

What about it? How will recording and data mining text messages fix that problem?

Furthermore, if the government has already screwed up their systems and made them publicly available in the first place, how can you be so sure they'll competently implement their surveillance systems?

Because for every spy program we know about, how many are out there that we don't know about?

Will an infinite number of spy programs solve the problem of the government putting critical infrastructure on the internet?

Just because you only use the internet to watch cat videos doesn't mean there isn't critical infrastructure that depends on the continued functioning of the internet.

Critical infrastructure shouldn't be connected to the public internet. Obviously some of it is, but I don't see how surveillance and spying on citizens is going to fix it.

I think you're wrong for a variety of reasons about how many people will die if the entire Internet becomes unavailable to North America for weeks at a time.

Maybe, but I'm willing to bet it's a very small number compared to how many could die if the electrical power grid went down or land line telephones or the water system. We didn't give up privacy and freedoms to protect those systems, why would we give them up for the internet?

Okay, I give up. Why is sacrificing privacy and freedoms a necessary condition of protecting the electrical power grid, land line telephones, or the water system?

I don't think it is. Just like I don't think it's required to give it up to protect the internet.

Actually, that's precisely the issue. If the entire internet goes down, it will start to impact things like the power grid and the water systems. Every year, utility companies put more and more of their infrastructure behind increasingly clever management infrastructure, and control it over the open internet. Hopefully none of it will fail-unsafe (though I bet something will), but if the management systems are offline for weeks?

And it will immediately, although not fatally, impact land line telephones, which I believe do significant backhaul over IP.

I'd imagine that taking a laptop to the control server and plugging in an ethernet cable would suffice to access the control panels if the internet is down.

> Electronic warfare is not on the same level as real warfare. Nobody will die if the internet is down for a few weeks.

The economic devastation would be huge. Banks could not process payments, utilities could not be managed in some areas, software companies would basically lose all productivity.

Heck even many hospitals would be unable to access medical records.

There would be serious wide spread repercussions that would leave a lasting impact on, if nothing else, our economy.

Have you ever been to China? I promise you it's not hordes of people saying "WE WANT TO DESTROY AMERICA" everywhere you go.

Can you please explain why "I want to live in a world where the U.S. has the upper hand in it, not China"?

I find it odd that many Americans tend to adopt this Us vs. Them mentality.

My personal perception is that China needs America to consume it's products and America needs China to cheaply produce the stuff it wants. So it's more give and take vs. outright rooting for the home team etc. etc.

> I promise you it's not hordes of people saying "WE WANT TO DESTROY AMERICA" everywhere you go.

Of course not. But like everywhere else it's full of people who see no problem using force abroad to further their own prosperity. The difference between Americans and Chinese is that Americans are in a much better position to do so.

> Can you please explain why "I want to live in a world where the U.S. has the upper hand in it, not China"?

Because China would be a far less benevolent world hegemon than the U.S. Because being a citizen of the dominant world power is, all else equal, better than being a citizen of a country that lives in the shadow of that power?

> I find it odd that many Americans tend to adopt this Us vs. Them mentality.

There has never been, in the history of the world, any sane population that thought: "gee, wouldn't it be great if some other country had military dominion over ours?" Now, most people have to resign themselves to that state of affairs, but Americans do not, which makes them particularly conscious of the fact that they do in fact enjoy many benefits from their place in the world.

> Because China would be a far less benevolent world hegemon than the U.S.

There are nearly a million Iraqi dead, killed in a war George W. Bush intentionally started, based on evidence he personally knew to be false.

> gee, wouldn't it be great if some other country had military dominion over ours?

You know, I rarely dream of military dominion over Denmark, or subjugation by. Maybe it's the civilization speaking.

The USA is a walking embodiment of a stereotypical second-amendment nut - "I need my gun in case someone else has a gun!". Better get two!

> most people have to resign themselves to that state of affairs, but Americans do not

You're trolling, right?

Because Switzerland is the example of a country that said "Don't tread on me".

The USA on the other hand has waged war on and committed horrible atrocities against its neighbors constantly. Quick, name two countries whose democratic government you haven't destroyed. (No seriously, you've destroyed many (ten? more?) peaceful democracies and attacked other countries for not being democracies.)

The USA is the bully. More than the bully, the murderers. The looters.

And you seem to have elected yourself their chief spokesman. What gives?

>Electronic warfare is going to be a thing, and I want to live in a world where the U.S. has the upper hand in it, not China.

It seems like "they're going to do surveillance so we need to do surveillance" is the wrong approach. All that does is increase the possibilities for abuse: By enemies and dictators, by corrupt bureaucrats, by foreign attackers who break into the domestic surveillance apparatus for their own purposes.

What we should be doing is to implement technology that will make surveillance harder for everyone. That leaves the U.S. at no disadvantage without invading everyone's privacy.

And it keeps us from having to fight an asymmetric war. If China has access to every U.S. company's trade secrets, the fact that the NSA has access to every Chinese company's trade secrets is a very poor consolation prize -- our trade secrets are more valuable. The economic damage that attacks on computer systems can do is greater against the U.S. than it is against its enemies. We don't need our government to do everything it can to exploit security vulnerabilities in order to conduct unconstitutional surveillance, we need it to help us (or get out of the way) in reducing the vulnerabilities.

And the two alternatives are pretty clearly opposed to one another. You can't have bureaucrats interfering with efforts to make the internet more secure in order to reduce the effectiveness of China's surveillance apparatus just because they're afraid it will reduce the effectiveness of the NSA's surveillance apparatus. You end up fighting a civil war instead of fighting the attackers.

Your approach is just so backwards.

The threat from the [insert latest bogeyman's name here] is no reason to limit the freedoms of US citizens or spy upon them. It calls for the administration to take decisive action to prevent unauthorized access to critics systems.

Systems can be easily isolated and access totally restricted to trusted persons only. The rest is for movies.

The real question is why is no one looking at the US administration and asking simply, "why are you not prepared for this?"

Solving these threats along with SPAM and DOS attacks is child's play if you are really serious, yet it is played out in he media as if we can't do anything about it other than restricting personal freedom and creating national citizen surveillance systems.

Blame the boogeyman not the admin.

This approach means that every US citizen is a potential threat the the system and is treated as such making total nonsense of the entire premise of keeping America safe by these means.

I feel lucky that I am NOT a US citizen after all...

By that logic, I suppose you agree with NYC's "stop and frisk" policy. Because, just in case.

It's like saying "There are lots of black people in prison, hence it's a good idea to stop and frisk them, just in case, because you know the track record". That sort of circular logic is why I feel my blood pressure go up every time I think about it.

The fact that you could get your blood pressure to go up over a civil liberties issue that isn't even the topic of the thread is as good an illustration as I can think of for why we shouldn't have HN threads talking about political and social justice issues like this.

I meant malicious snooping, like a husband reading texts from his cheating wife.

It's partial fear mongering, but that doesn't mean it shouldn't be discussed.

"Nothing has changed to make it necessary now."

That's pretty naive. If you don't want rampant terrorist attacks and criminal activity, then the government needs to stay one step ahead of the small percentage of citizens who do not want to follow the laws that keep us civil. Yes, some laws were created against the best interests of American citizens, but transparency will only help get those corrected.

> the government needs to stay one step ahead of the small percentage of citizens who do not want to follow the laws that keep us civil

These people who don't respect the rule of law.. why do you think they're not in government?

Wow, that's just unbelievable... You are saying:

"...some [US] laws were created against the best interests of [all] American citizens..."

because "...you don't want rampant terrorist attacks and criminal activity..."

defined as "...citizens who do not want to follow the laws that keep us civil..."

Reconstructed: US government has a system of laws that are against the best interests of all US citizens because some of those citizens don't like the laws the US government uses.

Really? That's deep.

I was implying that the majority of laws are reasonable and should be followed by all citizens. Monitoring unencrypted communications for dumb criminals who discuss acts that hurt society MIGHT be acceptable.

But, there are some laws that might be outdated or against the best interest of society. I'm not sure how those situations should be handled when it comes to monitoring.

I actually had drug and tax laws in mind and was hinting at the issue of politicians being paid and influenced by corporations against the best interests of humanity. Though tax laws obviously don't matter in the context of text message snooping, it's just an example to help reinforce the point that the legal system isn't perfect and neither are those who enforce it.

> As a country we got by for over 200 years without government surveillance, and nothing has changed to make it necessary now.

I'm glad you're so certain we had no government surveillance.

>There is a very easy way to test their capabilities. Send a text message with keywords involving bombs and political figures and see what happens. I'm not going to do it, but it would be an interesting experiment.

See how far "they" have gotten? They made us afraid of texting certain keywords to other people using a medium that's supposed to be usable for private one-on-one communications. In a country that values freedom of speech over nearly everything else.

Free to say what you want as long as no government has an issue with it I guess.

Of course we don't know whether SMSes are actually monitored. Of course it's very well possible that nothing might happen if you text your buddy something involving bombs. But the fact that something might happen was so convincing to you (and me, honestly and I don't even live in the US) that you decided not to do it.

To me, that's greatly concerning as it shows that the oppression is already happening and we are already censoring ourselves even over private media.

But even if the government does monitor all SMS messages and people do censor themselves out of fear, that does nothing to stop a determined terrorist from communicating over SMS: they just need to devise a code in advance, which is what criminals have been doing for ages. Instead of saying "go ahead and plant the bomb" they could say "my hamster has been feeling very ill".

Just text someone "Hey, so I'm going to get a pistol, and rob the US Bank on <street> in <my city>. Then I think I'll make a trip to Washington to bomb the white house, maybe send a few ricen-laced letters to US Senators on the way. Wanna tag along? Allahu akbar."

Pretty sure that trips a few flags. I feel sorry for the poor NSA guy having to read through all my texts. Worst. Afternoon. Ever.

Do their employees snoop on US citizens? Nope.

I find it highly ironic that you are making this statement today. Today, where it came out that the IRS leaked confidential infos on one political group to their political enemies [1].

I have no idea how you can make such a statement. Is it just naivety or what are your intentions? If information "is there" it is going to be used. No matter how sophisticated the flagging system is, the data is not stored in some secret vault only accessible to the great inquisitor.

The recent IRS events clearly demonstrate that government institutions are absolutely unafraid to abuse available data for intimidation if necessary. These are no just a rogue employee stalking his ex, but actions on a targeted, ideological level. The only data that can not be abused is the data that does not exist.

[1] http://www.propublica.org/article/irs-office-that-targeted-t...

Is that really a broken system or just a few bad apples?

Hopefully we can pinpoint the leaks, identify why they occurred, and develop safeguards to prevent abuses of highly confidential data in the future.

Send the assholes who used their government position for evil to prison and make THAT the top news story.

EDIT: The system will repeatedly be broken in an ever-changing environment. That doesn't mean that we should turn against our government as a whole. Patch the holes, prevent it from happening in the future, do our best to allow the right amount of transparency, and move on.

Its a broken system when that does not happen. So, I agree with you, its a broken system.

The problem is always bad apples taking advantage of the system. It feels like you're making the argument, "If you have nothing to hide, you shouldn't be worried."

just a few bad apples?

Yeah, 95% of them are making all the rest look bad.

"Is that really a broken system or just a few bad apples?"

The state was built to serve the interest of the general public and yet today does not produce the necessary signals to indicate it is functioning correctly to that purpose. We are experiencing asymmetric information:

* the state holds whatever privileged data it wishes for the length of time and purpose that it finds appropriate within the law and determines whether to reveal or withhold this data at present or some future date

* the state also determines the correct interpretation of the laws in court orders, position papers and executive orders -- and these orders can also be considered privileged data, so the same principle applies about whether to reveal or withhold this data from the public

* any indiscretions in the use of that privileged data by the state may or may or may not be detected by the state itself and, if detected and as it pertains to privileged information that may or may not be known to be held by the general public, the news of this detection and optional remediation may or may not be later revealed to the general public

* any successes by the state cannot be audited outside of the state itself, so the general public is reduced to the hope that the results were satisfactory and correct

Yes, I would argue that the current system is broken.

Anytime someone says, "...just a few bad apples" they show a complete misunderstanding of the roots of the saying.

The origin is that you should not let a few bad apples spoil a barrel, because if you pack a barrel of apples for the winter and leave a bad apple in it, it will spoil the barrel. Therefore any time you find a bad apple, INSPECT EVERYTHING CAREFULLY.

Today it has reversed meanings, "Oh just a couple of bad apples", and this version is almost always wrong. Where you've found one bad apple, there are likely to be more. Do not leap to make excuses, leap to investigate carefully. That is the healthy response.

As for spying, give people access, and incentives for accessing, and I guarantee that it will be abused. Oh, most Americans won't be targeted. But anyone running for office whose policies those in power don't like...?

Well said!

> recent ... events demonstrate ... actions on a targeted, ideological level.

You say that like it is a new development. It is not.

This is not to give it a pass or say it's okay. Just pointing out that there is nothing in recent events that signals a significant departure from what has been happening since the last century and beyond.

"It's troubling that any secretive organizations would be able to have this much power over citizens, but the alternative is much scarier. [...] if China gets the upper hand (and they are trying unimaginably hard) then what? What will the sleeping dragon do?"

I guess it would exert secretive power over its citizens? What point are you trying to make? America has finally realized the Maoist ideal it always wanted to achieve?

> Does the NSA store all text messages? Yes, more than likely.

If the NSA is already storing all of the things, why do we keep having scandals about government breaking rules to get records of things? Google publishes specific numbers of requests for records... There was a story a month or so ago about feds reprogramming a guy's smart card specifically to track him... AP just broke the story about the subpoena for two months of phone records... if the NSA already has all this stuff, why doesn't everyone in the government just secretly get it from them instead of going to all this extra trouble to get records from companies all the time? I'm concerned about all the above abusive surveillance stories, but doesn't the fact that we're having all these stories prove that they don't have total surveillance yet?

Partially because that kind of information can't be used in court.

The fact is that text messages are extremely insecure. If the US govt is willing to spend hundreds of billions on spy satellites and submarines, isn't it reasonable to assume that they would spend a couple million to gather all text messages? They're not supposed to spy on US citizens, but there are enough loopholes to allow it.

Just because the NSA has huge amounts of data doesn't mean that the FBI has unlimited access to that data.

The NSA historically doesn't share information with other agencies. Many claim that the NSA knew the details of 9/11 but were not allowed to share this information. Then the Patriot act and "secret patriot act" came along and more information is allowed to be shared between agencies, but not unlimited information, as far as the public knows.

Want to lay off the "Fuck Yeah, 'Murica!"?

Because you are laying it on just a little thick along with scaremongering.

Provide proof that China is evil. Different != evil.

"the unknown is scary"

That's just a stupid statement. If all you knew was Nazi Germany, would you maintain the status quo?

I have nothing against China. But if the balance of power evens out through electronic warfare, then real and very deadly war might be the end result.

The US doesn't spend half of our GDP on the military for shits and giggles.

Regarding your Nazi Germany comparison, I don't know enough about the holocaust to speculate on the reasons why it happened or what could have been done to prevent it. I wouldn't kill any innocent human, no matter their religion or race. Groupthink, racism, fear, and ignorance might be partially to blame but it would be difficult to be in a position to actually make a difference during those times. Electronic warfare is not comparable to the holocaust. But the potential of power changing hands after 50+ years of control isn't something that shouldn't at least be discussed.

War is more profitable than peace. Don't believe all the propaganda that war is always necessary.

But there's always the refrain that war is a job creation machine and any attempt to dial it down is met with accusations of being unpatriotic (case in point, whoever downvoted me). Not quite that simple.

One way that China is "different" is that the police in China can summarily sentence arbitrary Chinese citizens to "Rehabilitation Through Labor" for as long as a year without trial (trials are available as a formality but are apparently so delayed that their practical impact is negligible). You can be a Chinese citizen and plucked off the street and put into a labor camp for a year with no recourse.

Your call whether that's just a cultural difference. I don't know what "evil" means here.

Not putting a stop to traditional Chinese medicine, in my opinion, is evil.

Plundering the worlds oceans in attempt to feed the billion+ population is borderline.

Are those issues just cultural differences or seriously unethical?

Amazingly, I've actually seen Chinese medicine work (but of course this is the Internet and my own singular anecdote). Granted, a ton is snake oil but some remedies do work.

Starting wars because of oil is not? Concentration camps?

"Are those issues just cultural differences or seriously unethical?"

Point I'm trying to make is that America is not as lily white as you think it is.

Come now. "Stop and frisk"? I'm not saying that the Chinese don't do bad things, I'm saying that Western nations are culpable too.

Let's face it, the poor everywhere get screwed while the rich get away with it. It's just different shades.

http://www.slate.com/articles/news_and_politics/foreigners/2...

Western example... http://www.rollingstone.com/politics/news/everything-is-rigg...

dm2 was positing China as this fearsome bogeyman where the only option is China vs. US, winner takes all.

By all means, compare a system in which local police are empowered to imprison people in labor camps for a year to one in which an overreaching local police force frisks people based on racial profiles.

Seriously, are you defending stop and frisk as a trivial issue now?

How about internment camps then? Does that better suit your strawman?

Whereby Eisenhower's Executive Order 9066 caused Japanese American citizens to be plucked off the street and put into camp against their will for MULTIPLE years with NO recourse. All because of unfounded fear. Not so different is it?

http://en.wikipedia.org/wiki/Japanese_American_internment

I know people that this directly affected so I feel strongly about this issue.

While I can and do respect your skill and experience in security, this however is an area I doubt you have much actual experience or proper perspective in.

I would recommend visiting Manzanar or one of the other camps if you have not had the opportunity to do so. These are not nice places and caused severe hardship to the people imprisoned there.

Does the NSA store all text messages? Yes, more than likely. Do their employees snoop on US citizens? Nope.

Correct. Since the NSA is prohibited from operating within US borders, it's the FBI who snoops on US citizens.

>Does the NSA store all text messages? Yes, more than likely.

Do you have any evidence for this? The Wiretap Act clearly prohibits it, if they are doing it, it's definitely illegal.

https://www.google.com/search?q=NSA+wiretap

http://en.wikipedia.org/wiki/NSA_warrantless_surveillance_co...

http://arstechnica.com/uncategorized/2006/04/6585-2/

http://en.wikipedia.org/wiki/Communications_Assistance_for_L...

http://www.thenewamerican.com/usnews/constitution/item/13164...

Of course, smart criminals would not use unencrypted text messages that could be intercepted. But catching the low-hanging fruit is better than nothing.

Thanks for your helpful link to a google search for "NSA wiretap".

None of the links you post have anything to do with "storing all text messages". Exaggeration like this just turns people cold to bothering to read about genuine privacy concerns.

The issues you post are real and probably wrong and should be challenged legally, where evidence exists (a lot of the AT&T stuff is based on evidence from a single former employee), but when you confuse Warrentless Wiretapping with "storing all text messages", it makes me want to not listen to what you're saying.

I've posted about this before, but I'll post it again. A few months before the first Obama election, there was a thread on Slashdot about things you couldn't say on the Internet. I humorously contributed "I am going to kill the president" to the discussion. A few months later, the Secret Service showed up at my house, with guns, to question me about it. (The agents were quite reasonable about the whole thing, FWIW, but they did need to follow up after reading that comment.)

People are watching you, so be careful what you say.

I'd be worried if I were the president too, if perceived threats are dealt with a few months later.

What would that even mean? The title is "Guidance for the Minimization of Text Messages over Dual-Function Cellular Telephones." Any idea what minimization it is referring to?

EDIT -- Found the answer to my question: http://www.theatlantic.com/politics/archive/2010/02/minimiza...

Very informative link, thank you. I was likewise unaware. TLDR: minimization is the act of removing non-relevant personal data from foreign intelligence information.

From the article: "Minimiaztion [sic], in essence, is the legal term for the constraints placed upon the government's ability to retain non-relevant private information collected legally. Here is the technical definition of "minimization," as supplied by 50 U.S.C. 1806 (A):

    Information acquired from an electronic surveillance conducted pursuant 
    to this subchapter concerning any United States person may be used 
    and disclosed by Federal officers and employees without the consent of 
    the United States person only in accordance with the minimization 
    procedures required by this subchapter. No otherwise privileged 
    communication obtained in accordance with, or in violation of, the 
    provisions of this subchapter shall lose its privileged character. No 
    information acquired from an electronic surveillance pursuant to this 
    subchapter may be used or disclosed by Federal officers or employees 
    except for lawful purposes.

"So -- the saving grace for civil liberties is the requirement that the government get rid of the information it accidentally or incidentally collects on people that isn't considered foreign intelligence information."

So we are reaching a stage where government is not just dancing around hot issues but by now they apparently don't even pretend to give a crap anymore.

Unfortunately there are still enough people around whos' reaction to this is "let's start and online petition and beg the administration to declassify all the "and"s in the text".

The best way to beat the censors is for multiple parties to request the same data at different times.

Oftentimes the resulting FOIA documents will be redacted in differing ways, allowing the various parties to "compare notes" and hopefully piece together the complete picture.

However, in this case, literally the entire text was redacted (sans the title).

From a single source... Perhaps other parties will receive a less censored document? Perhaps the same party will receive such on a subsequent request?

We quickly need to reach a point where we encrypt everything we do on the client-side, during transmission and only readable by intended recipients.

We're working on this for text messages with TextSecure (http://www.whispersystems.org). If you've got the time and interest to help contribute, please check it out.

The FBI is already whining that default use of HTTPS by Google and Facebook is ruining their snooping:

http://www.washingtonpost.com/world/national-security/propos...

iMessage does this now. The problem is that the UI gives no control over the list of keys it encrypts to, so you can still be wiretapped.

Do you have further documentation of this? There doesn't seem to be anything other than hearsay which demonstrates that they do end-to-end encryption, and some anecdotal evidence that they don't (a new device brought online will receive messages from before it was initialized, for instance).

http://ios-rev.tumblr.com/

http://imfreedom.org/wiki/IMessage

https://github.com/meeee/pushproxy

I was curious, too. I had lunch with the guy who made the proxy (man, I love living in Berlin) and discussed his efforts to reverse engineer the iMessage protocol (which runs inside/on top of Apple's push notification system).

AFAICT, iMessage activation fetches a key from Apple that is either tied to or based on the hardware serial number. Based on Apple's history of rather excellent crypto implementations on iOS[1] I'm guessing that (on iOS) this key then gets signed by either the hardware key or somesuch to authenticate the device to the APNS. On OSX, the activation request includes the hardware serial number of the mac making the request, and the service rejects arbitrary SNs (though valid SNs are predictable so those can be used to get iMessage working on OSX inside a VM).

If I had the free time, I'd finish reversing the protocol.

I don't have proof, but preliminary observations suggest that iMessages are, indeed, end-to-end encrypted.

http://www.csoonline.com/article/731446/fbi-highlights-imess...

http://www.macobserver.com/tmo/article/apples-imessage-encry...

http://news.cnet.com/8301-13578_3-57577887-38/apples-imessag...

[1] http://images.apple.com/iphone/business/docs/iOS_Security_Oc...

> and some anecdotal evidence that they don't (a new device brought online will receive messages from before it was initialized, for instance

I haven't seen that behavior, but it could be explained the messages being encrypted to a per-AppleID-key which is encrypted to each device's key. Time permitting I'd really like to learn more about the specific architecture.

I'd like to believe that Apple would build, at least initially, a system that's as secure as possible from snooping, waiting only until mandated by the feds to backdoor it with key escrow. Maybe I'm too idealistic. In either case I don't talk about anything sensitive on iMessage.

I just tried that and I didn't receive old messages. My guess is people who noticed this used iCloud Backup, restored the new device and once they logged in to the iMessage account, the Messages App showed the existing messages restored from the backup.

iMessage is not Free software so it can always be wiretapped

Ho ho ho, the gov't discovers blackfaxing! What a merry bunch of pranksters they are. So funny! Seriously though, I'm sure there's nothing to see. Whatever the gov't does they do for our safety, and I feel foolish for suspecting otherwise.

I'm not sure that the handling of a single document, especially one that happens to be about intelligence gathering procedures, should be THE standard by which we judge transparency.

The entire point of FOIA requests is to allow access to previously undisclosed documents that aren't legally considered secret.

The notably weird thing here is that they released a completely redacted document rather than just declining the request. Is there some minimum amount of text required to be considered a response?

Politics aside, this is certainly one of the strangest things I've seen in a while.

Just saying that a single example doesn't prove a pattern.

Yeah it's a little weird, but out of the context of other FOIA requests it doesn't make much of a point.

It's a pattern. This is the same kind of response the EFF got to its FOIA requests about NSLs (national security letters). They were sent back a pack of blank pages as all the text had been redacted. When the ACLU issued a request to the FBI on GPS tracking activity, they were sent back 111 blank pages.

You have three instances...that meets your hurdle for statistical significance?

I should hope so! The government is rather more regular than a particularly noisy lab experiment.

Now, as to what it meets the hurdle for statistical significance for . . . well, I personally prefer to avoid conspiracy theories when possible. So I'll just be keeping an eye open for more information.

It proves that they responded to this FOIA request by releasing a blank document. There are many different possible reasons why they released a blank document, but that's another question. (One which we can hopefully answer by examining the history of previous FOIA responses, but still another question.)

What level of proof do you require?

Out of curiosity, have you filed any FOIA requests?

For proof that there's a transparency problem, I'd want to look at hundreds of FOIA requests across 10-20 categories, content of news conferences and press conferences, level of press access to government officials, responsiveness to press inquiries, responsiveness to Congressional inquiries, and I could probably think of a few more things if I put more time into it. Then I'd want to compare that to data from previous administrations.

It's not strange when you are familiar with the behavior of large bureaucracies. In doing this they are able to say they replied to the FOIA request, and satisfied the letter of that law. The request was for a document, and the document was provided.

There was sensitive information in the document that happened to be 100% of the contents, this was redacted. They now cannot be sued for not responding.

"There was sensitive information in the document that happened to be 100% of the contents, this was redacted."

Is it a defensible position to assume that 100% of a document was excised as sensitive data? Since the subject of the memo itself is announced clearly, are we to believe that the presentation of the term "message" which almost certainly occurred one or more times in the body text was sensitive? What about harmless pronouns, conjunctions, articles, etc?

If a citizen were to reply to a government request of information from the government in the same manner, few would be surprised at legal consequences (penalties, incarceration) as a result. Actions such as this, in response to a legitimate request from the public allowed under law, can only serve the purpose of undermining confidence in the rule of law.

There's some information here. There was a policy sent out for what information to keep from cell phones, to all US Attorneys and Assistant US Attorneys, and it's 15 pages long. It would have been nice if they'd included a date.

Granted - even if it had been literally blank ;)

This is not a unique occurrence. Not long ago, the DoJ responded to a Congressional subpoena for "Operation Fast and Furious" documents by delivering some 7000 pages, mostly redacted.

Seems this isn't particularly unusual for the last few years.

This "most transparent administration in history" by far isn't.

It's like any other business. If they have a word in their name, or their motto or mission statement, or their talking points, they aren't.

Is there a direct link to the PDF available?

Here you go: http://www.scribd.com/doc/141222327/Totally-Redacted-FOIA-re...

Reply on news.ycombinator.com