Snowden: NSA snoops on U.S. phone calls without warrants | Hacker News Reader

Snowden: NSA snoops on U.S. phone calls without warrants

news.cnet.com

149 pointsdeclan32 comments

This was almost admitted to outright by the NSA: http://news.ycombinator.com/item?id=5886686

The sad thing about this intense focus on the NSA story by HN in the past 2 weeks is that the sensational headlines stay on the top of HN for days, but when those headlines are later refuted it is not as widely seen.

http://thehill.com/blogs/blog-briefing-room/news/305855-hous...

Of course - it's "Hacker News" after all: you expect retractions not to be buried?'

Huh, a pithy joke about the tendency of news organizations to bury retractions is somehow my most hated comment ever? Color me confused - I still amuse me.

If you read this CNET article, you'll see why that statement doesn't actually refuse it.

Not "refuted." Nadler says he was reassured by the administration, but has refused to say by whom, or whether the reassurance was legally binding. Here's the transcript, so judge for yourself (remember warrants would only be required for content, not metadata): https://plus.google.com/u/0/112961607570158342254/posts/SBkR...

Isn't this second-to-last paragraph the nut of the issue though? It describes how things work under the FAA:

Section 702 of the FAA says surveillance may be authorized by the attorney general and director of national intelligence without prior approval by the secret Foreign Intelligence Surveillance Court, as long as minimization requirements and general procedures blessed by the court are followed.

If what they are doing is according to Section 702, then isn't the outrage what the law allows rather than what the NSA is doing according to it?

No, the nut is that Nadler asked Mueller about Patriot Act Sec. 215, but Clapper addressed the issue in terms of FAA 702. Tellingly.

EDIT: clarification, as all should be doing beforehand in light of the amount of misdirection possible on this topic. (I'm generally bouncing off of this, though: http://www.emptywheel.net/2013/06/17/james-clapper-throws-a-...)

Nadler switched to talking about "listen[ing] to the phone," which is FAA 702, not 215. 215 is only for stored records and has not been used, as far as I can remember, for content. (BTW the exchange was with Mueller, not Clapper.)

It's imprecise to say the exchange was only with Mueller, since Clapper responded to the questions raised in that conversation. Yet another strategy that is adding to the confusing narratives being sown by the government (and that can cause stories to be retracted).

I wouldn't call a statement four days later without a response an "exchange," though I suppose some people might.

You make a good point. There are a few different aspects worth separating here:

- First, oddly, we don't know what the law allows. The Obama administration's secret interpretation of FAA 702 and secret rulings they obtained from the FISC have not been made public. This is a continuation of the Bush-era penchant for secrecy that included a secret interpretation of the law to allow warrantless eavesdropping and torture. See the last page of: http://epic.org/FISC-NSA-domestic-surveillance.pdf/

- Second, Congress would almost certainly not have approved the FAA (2008) if they had known that a single analyst has access to Americans' confidential email, phone records, etc. Same with the Patriot Act (2001) that is used obtain a general warrant to vacuum up Americans' phone records on an ongoing daily basis. And Snowden said today it's not just NSA, but FBI, DNI, CIA, etc. analysts. Read 702 and see if you think you can predict how it would have been secretly interpreted: http://thomas.loc.gov/cgi-bin/bdquery/z?d110:h.r.06304:

- Third, U.S. intelligence officials have argued in the past that the president has the constitutional authority, no matter what the law says, to authorize domestic spying without warrants. So the wording of the law may no longer matter! See: http://www.nytimes.com/2007/05/02/washington/02intel.html

You have to read the FISA system in context. Surveillance under the Act is only authorized in cases where the 4th amendment doesn't apply and where no warrant would otherwise be required. Under those circumstances, it's not particularly outrageous to allow the AG or DNI to proceed without a FISA warrant under certain circumstances.

In fairness that's not very reassuring for the idea that an NSA analyst may decide to look at a U.S. citizen's traffic and then "whoops, let's minimize that".

I guess what I'm wondering is what are the supervisory controls that are put in place to catch and discipline an analyst who looks into warrant-required intercepts where it isn't a bona-fide innocent error? I.e. if you know the person is a citizen you shouldn't look at all (without getting a warrant), and if you don't know but find out in the middle of reading the data then you should stop and minimize immediately.

I can't so much as release a military member's pay transaction without having it looked at by a supervisor and eventually audited (likely by 2-3 different groups when it's all said and done). Are there similar supervisory controls in place here? Those would be good questions to ask to ensure that any such usage of the FISA is kept in line with the already quite-expansive spirit of the law.

All very fair points. I'm not sure if it's even possible to get the kind of necessary supervision. I'm just pointing out that the law isn't facially ridiculous, even if it might create structures that are practically unworkable.

I think we can get "good enough" supervision using a combination of even just widely-known management controls. Technical controls would add icing to that cake but I don't think it would even be technically necessary.

Much like with vaccination regimes we're trying to ensure that a critical mass of malicious analysts are not able to form, so you don't necessarily have to catch them all but you do have to catch enough to ensure no damaging conspiracies can form.

- Combine an evidence review process where an analyst's products are routed for minimize/warrant compliance to ensure the data is sourced properly.

- Ensure the supervisors are trained and maintain proficiency so as to be able to support those reviews.

- Have trained NSA analysts take a career path (or at the very least a detail) as auditors whose function is to audit usages of these collected records (both in the past and currently in-use). Require a supervisor of some level to override an audit hold on a current investigation, and have that override automatically emailed to designated personnel (the idea being to ensure that multiple unrelated persons get their hands dirty if malicious activity is going on).

These are all just examples, I'm those with more brains on human systems engineering could think of something more appropriate.

But the point is that, even as serious as this issue is, we're not talking about things like life or death, severe damage to property, people not getting paid, people improperly getting paid, or any of the numerous other pressure points a government can use to create a police state. So surely there are administrative controls that can be emplaced, if we must choose to do this, to get the benefit without the risk to the rise of a police state. In fact I think such a thing could even be itself publicly documented without affecting the real need of the NSA (and other IC agencies) to maintain absolute secrecy about their tactical operations and policies.

The NYT reported in 2009 that an analyst was disciplined for snooping through former President Clinton's email (or attempting to).

Section 702 was written, and has been interpreted, to have very few restrictions.

1) It bars the NSA from collecting data on people unless "reasonably believed to be located outside the United States."[1] Data can be intentionally collected on any communication that has at least one foreign recipient or sender.[2] The wording of the warrants specifically contradict the fourth amendment, but as long as the target is "reasonably believed" to be a foreigner, it doesn't matter to the NSA.

2) The test of whether someone is located outside the US has been interpreted as a keyword-based system indicating that it is at least 51% likely. [3]

3) The NSA does not define "collection" as actually obtaining the data or metadata, but as a human analyst viewing the data.[4]

4) According to Snowden: "NSA likes to use "domestic" as a weasel word here for a number of reasons. The reality is that due to the FISA Amendments Act and its section 702 authorities, Americans’ communications are collected and viewed on a daily basis on the certification of an analyst rather than a warrant. They excuse this as "incidental" collection, but at the end of the day, someone at NSA still has the content of your communications." [5]

If they realize that it is actually an American, they have no obligation to delete the communications and will continue to store it indefinitely.

The NSA has been written a blank check to do whatever they want, existing checks and balances are simply insufficient. Whether that is due to their interpretation only breaking the spirit of the law (but not letter), or whether this is unconstitutional, is up for debate.

[1] FAA 702.g.1.B http://www.gpo.gov/fdsys/pkg/PLAW-110publ261/pdf/PLAW-110pub...

[2] FAA 702.b.4

[3] http://www.washingtonpost.com/investigations/us-intelligence...

[4] https://www.eff.org/nsa-spying/wordgames#collect

[5] http://www.guardian.co.uk/world/2013/jun/17/edward-snowden-n...

The administration told the Washington Post that they are in no way relying on interpretations of the word "collection", and that if they have the data, they have it, no matter whether or not analysts have looked at it.

Although Clapper told Andrea Mitchell something different -- that he was using the term 'collection' to mean actually looking at it.

That's not how I understood it at all.

Your original claim -- the one in that's still the headline of the linked HN post -- is that the NSA admitted it listens to phone calls without a warrant. I don't want to get into a linguistics debate, but I think this has indeed been refuted. It's certainly unsubstantiated. I mean, that's why you changed the headline of your article on CNet, right?

For the rest, I don't see how it's possible to prove the negative: that the NSA isn't doing what you claim in your piece... but if the only evidence they are is second-hand from what Rep. Nadler says he heard in a secret hearing... and now he says he was wrong... Well, seems awfully weak to me.

The story was that they admitted this in a "secret briefing". I'm not sure if denying something in public refutes what you said in private.

Nadler seemed pretty sure on Thursday at the Committee meeting and when interviewed by CNET over the weekend but has now changed his story. The NSA released a very strangely worded denial. And in today's Q&A Snowden says this is exactly how it happens.

Not sure what to make of all this but is seems like we have been given a peek behind the curtain but not a long enough gaze to see exactly what is going on.

AFAIK, Rep. Nadler was not interviewed by CNET for the story and it was based entirely on the reporter's interpretation of his public remarks. (Please correct me if I'm wrong.) I think there's a good chance Rep. Nadler did not change his position and was simply misinterpreted. If you watch the video[0] of the exchange, it definitely seems like at least one of them is confused about what they're talking about.

Regardless, I think the implication that somebody must have "gotten to" Congressman Nadler and therefore we should continue to believe what we thought he said earlier rather than what he's saying unambiguously now is totally ridiculous.

[0] http://www.c-spanvideo.org/clip/4456140 (it's right near the start).

No, the story was that Rep. Nadler said something confusing and ambiguous in a public hearing that referred to a secret briefing and that some reporters ran with the statements and assumed the worst.

For what it's worth, from what I've seen of Rep. Nadler in the past, he doesn't seem like the kind of craven politician who would either equivocate or be scared into submission.

Do you really believe that after all the political lies we as a country have heard in the past 3 months, any thing a person on the hill says would carry more than 2 cents?

I wonder what I would have done if I were in Snowden's shoes. I've seen something that is personally troubling, ambiguously legal, and possibly abused by analysts without oversight. That something is ostensibly the recording of phone calls and other electronic communications without warrant. The abuses could simply be employees viewing communications without instructions (e.g. for voyeuristic purposes or personal gain.)

If those assumptions are correct, then I can't help but think that I would have taken a few phone calls with me on my way out. A few mp3s featuring Dick Cheney and his family would make quite a point if released now for example.

> If those assumptions are correct, then I can't help but think that I would have taken a few phone calls with me on my way out. A few mp3s featuring Dick Cheney and his family would make quite a point if released now for example.

He obviously has more than he has shared (and has shared to the Guardian and Washington Post more than we have been privy to). The fun thing is that the Feds have a high certainty of what he has and can't say or even use it as evidence lest they do the leaking for him.

Yes, I wonder about that too. Greenwald seems to be very eager to tell us that Snowden has more than has been released. The implication is that the rest of the information is too dangerous to release.

Apart from the two immediate questions: "Does that information actually exist?" and "Why is it too dangerous?" We must ask ourselves why Snowden isn't forthcoming with some less sensitive proof to bolster his claims. It presumably would have been possible for him to have foreseen the reluctance news organizations had to publish the information. Why not have something more along the lines of a proof-of-concept to dispel the doubt that comes with incomplete information? Having a recording of some peoples' phone records would be just that kind of proof (provided he couldn't have reasonably gotten their records any other way.)

Revealing such a recording would enable the government to prosecute him for "targeting" such information without a warrant. Of course he has bigger worries than whether they try to tack on such a trumped up charge...

> The implication is that the rest of the information is too dangerous to release.

Is it? I thought the implication was that Guardian will publish further stories on it and drag it out rather than dump it all at once.

If I were Snowden and if I had that power. I would first release all this information to the public. And then to hear what the 3 letters had to say. And then, release emails for 1 month of each and every Senator and representative. That in it self I believe would have caused the most change.

completely theoretical, but would have caused the most change for the better.

Reply on news.ycombinator.com