More details on MAINWAY and MARINA | Hacker News Reader

More details on MAINWAY and MARINA

theweek.com

39 pointsbrown9-218 comments

Individually analyzing each incoming email is impossible. So the NSA automates the minimization procedures as much as it can. Based on dynamic link analyses done by computers, scores are assigned to emails and associated profiles inside the system. Every bit of data associated with an email address that might belong to a U.S. person "updates" the score. Analysts can query the system for individual names, and email addresses, and even subject lines. They can add, if they want, the place and time that the email was collected, too. If the "score" associated with the email indicates that there is a 51 percent chance or higher that it belongs to a person overseas, the analyst can start monitoring content right away and not do anything further. If that score is less than 51 percent, the analyst can, if directed by a superior, start to access the content, if it's available, but the large team of lawyers the NSA has will be instantly notified, and a FISA order will be sought.

As I interpret this:

1) analysts are able to access email metadata without a specific court order or warrant

2) analysts are able to access email content without a court order or if there's a 51%+ chance it's a non-US person

3) analysts with the approval of supervisors are initially able to access anybody's email content without a court order, although the FISA court then has to approve it

Julian Sanchez has some thoughts on this at [1]:

Legally speaking, the analysts don’t have carte blanche. In other words, this isn’t “warrantless wiretapping” so much as “general warrant wiretapping.” They can’t just tap any old call or read any old e-mail they strikes them as “suspicious.” They’ve got to be flagging content for interception because they believe it’s covered by a particular §702 authorization, and observe whatever “targeting procedures” the FISA Court has established for the relevant authorization....

None of that would be too surprising in principle: That’s the whole point of §702! It means analysts get discretion to decide what particular accounts fall under a very broad order. A key question, of course, is just what the checks in the process are. Can an analyst technically (if not legally) plug in any selector to start collecting on and just start getting material? Does anyone check their work before call and e-mail content starts flowing in? How closely are their error rates checked after it does? Again, legally, they don’t have a blank check, but it’s the details of the system architecture that determine whether you’d be able to tell the difference in practice.

[1] http://www.juliansanchez.com/2013/06/15/nadler-and-mueller-o...

Julian Sanchez has been doing great work covering this stuff. I think the evidence strongly suggests the answer to his question about analysts "[plugging] in any selector and start collecting on and just strt getting material" is no:

* Google and Yahoo have categorically denied that it's so

* The Guardian has released a follow-up story recategorizing the NSA's access

* The full court order linked by the NYT in the Yahoo FISA case shows the court having to demand Yahoo turn over material, which wouldn't have been necessary if NSA had direct access

Jump to conclusions much? Perhaps they can't pull user data at will from Google and Yahoo without a bit of legal process and human intervention at the company. I imagine we'll find out soon. But that only applies to Prism.

It looks like email they catch on the wire, which is probably their main source of email, as well as phone calls, may well be fair game for the "plug in any selector...".

I'm not sure what conclusion your comment suggests I've jumped to.

You've jumped to the conclusion that if user profiles that haven't yet been delivered through Prism can't be reached with "plug in any selector..." that "plug in any selector..." has been debunked.

However, it appears that in the telephone and over-the-wire email interception programs, "plug in any selector" is quite possible.

I'm only interested in and commenting on email and Google/Facebook's supposed (but false) entanglement with NSA. I'm right there with you on the over-the-wire stuff.

I realize you're interested in defending these companies' involvement. That's fine when it's on topic.

However, you've just replied to an article and comments that focus on the content that's being intercepted outside of Prism. You don't even mention in your comment that what you're saying applies only to Prism. I know you're sensitive to the Google-bashing, but that's not going on here. It's important we discuss the other aspects of this story and not get too caught up on Prism until we have all the details.

If you reread the Julian Sanchez quote above, you'll see I'm responding to it.

(You're right that the Sanchez piece this is taken from concerns itself primarily with telephonic surveillance; I take your point. Thanks.)

So in other words, the CNet article that has been on the front page for 17 hours with over 650+ points is likely based on an incorrect interpretation of this exchange.

Somehow I doubt a clarification is going to get as much attention on here.

From http://www.buzzfeed.com/andrewkaczynski/video-congressman-cl... :

Update Rep. Nadler in a statement to BuzzFeed says: “I am pleased that the administration has reiterated that, as I have always believed, the NSA cannot listen to the content of Americans’ phone calls without a specific warrant.”

Regarding 3), FISA allows, as of the 2008 amendment, a period of 7 days surveillance before obtaining a warrant. Failure to then obtain a warrant means the information obtained cannot be used as evidence (unless "the United States Attorney General believes the information shows threat of death or bodily harm") but that's more than enough time to dig through their email/phone content.

Do you think maybe you could, by sending enough foreign-language spam, push the algorithmic determination of foreignness over 51%?

How about if another ally already possesses or 0wnz another 'hot' (suspicious/tracked) phone, and uses that phone to call another phone of interest, to increase its 'taint'?

I'm also struck by how much this article's description of the progressive process of peeking at already-collected communications using a variety of permissions resembles my speculative interpretation of a few days ago:

https://news.ycombinator.com/item?id=5872125

Why would you want to do this?

And how would you know which addresses are being targeted?

And if you could do this on a large scale, what makes you think it would go undetected?

You would want to try this because there are often large benefits from surveilling the totality of a person's communications. Those benefits to the surveillor might be professional, personal, financial, or political. And as liberal as the standards for spying apparently are, sometimes the limits are constraining... so hacks like these would effectively remove the limits.

Not sure I understand your second question. I wouldn't know how much such abusive targeting might happen; that's the concern about it happening in secret with only "trust us"/"scout's honor" review.

Why would it have to go on at a 'large scale'? Even a few incidents of this being used to gather dirt on political opponents, or collect financially-enriching inside information, would be too much, and very dangerous. The value of being able to do this sort of thing is so large, abusers could potentially shield themselves from, or corrupt, the entities which are supposed to detect misuse.

It's already known that analysts can access metadata without a specific court order; that's how the system is designed.

In the FAA 702 process, the DNI and AG first sign off on a "Certification" that designates a target; that Certification is confirmed by a federal judge.

Once the Certification is obtained, NSA analysts can cause FAA 702 "Directives" to be issued. Directives are pursuant to 702 Certifications, which are court-ordered, but the Directives are not themselves individually confirmed by a court.

Directives are what providers see. The counterbalance on the fact that FAA 702 Directives aren't individually approved by a court is that providers can (and as the NYT reports, have) refuse to comply with the Directive; at that point, everyone sends lawyers to the FISC and the Directive becomes a court order.

Target -> Certification -> (Many) Directives -> (Possible) Refusal -> FISC Hearing -> Court Order

>If the "score" associated with the email indicates that there is a 51 percent chance or higher that it belongs to a person overseas, the analyst can start monitoring content right away and not do anything further.

As a non-US citizen, this hits me hard. Basically, the NSA can read all my emails without a single warrant, if I'm reading this correctly. Is my interpretation correct?

Yes. It's one of few things nobody has disputed.

The 51% determination is one of the most ridiculous aspects of this.

1) 51% is a very low bar to meet

2) How detailed could this confidence algorithm be?

If a message is intercepted from overseas, and no other data is know, is there automatically at least 51% confidence that it is from a non-U.S. person? I'm sure other factors go into the calculation, but whatever factors they are, I'm sure a lot of American data is being sucked into this thing.

Given not only that Americans travel, but that VPNs are common, I find it very difficult to see how the NSA could be justified in conducting this sort of program within their "foreign-only" mandate.

Reply on news.ycombinator.com