Hacker News Reader

Comment by declan | Hacker News Reader

Not "refuted." Nadler says he was reassured by the administration, but has refused to say by whom, or whether the reassurance was legally binding. Here's the transcript, so judge for yourself (remember warrants would only be required for content, not metadata): https://plus.google.com/u/0/112961607570158342254/posts/SBkR...

View on HN

Your original claim -- the one in that's still the headline of the linked HN post -- is that the NSA admitted it listens to phone calls without a warrant. I don't want to get into a linguistics debate, but I think this has indeed been refuted. It's certainly unsubstantiated. I mean, that's why you changed the headline of your article on CNet, right?

For the rest, I don't see how it's possible to prove the negative: that the NSA isn't doing what you claim in your piece... but if the only evidence they are is second-hand from what Rep. Nadler says he heard in a secret hearing... and now he says he was wrong... Well, seems awfully weak to me.

The story was that they admitted this in a "secret briefing". I'm not sure if denying something in public refutes what you said in private.

Nadler seemed pretty sure on Thursday at the Committee meeting and when interviewed by CNET over the weekend but has now changed his story. The NSA released a very strangely worded denial. And in today's Q&A Snowden says this is exactly how it happens.

Not sure what to make of all this but is seems like we have been given a peek behind the curtain but not a long enough gaze to see exactly what is going on.

AFAIK, Rep. Nadler was not interviewed by CNET for the story and it was based entirely on the reporter's interpretation of his public remarks. (Please correct me if I'm wrong.) I think there's a good chance Rep. Nadler did not change his position and was simply misinterpreted. If you watch the video[0] of the exchange, it definitely seems like at least one of them is confused about what they're talking about.

Regardless, I think the implication that somebody must have "gotten to" Congressman Nadler and therefore we should continue to believe what we thought he said earlier rather than what he's saying unambiguously now is totally ridiculous.

[0] http://www.c-spanvideo.org/clip/4456140 (it's right near the start).

No, the story was that Rep. Nadler said something confusing and ambiguous in a public hearing that referred to a secret briefing and that some reporters ran with the statements and assumed the worst.

For what it's worth, from what I've seen of Rep. Nadler in the past, he doesn't seem like the kind of craven politician who would either equivocate or be scared into submission.

Isn't this second-to-last paragraph the nut of the issue though? It describes how things work under the FAA:

Section 702 of the FAA says surveillance may be authorized by the attorney general and director of national intelligence without prior approval by the secret Foreign Intelligence Surveillance Court, as long as minimization requirements and general procedures blessed by the court are followed.

If what they are doing is according to Section 702, then isn't the outrage what the law allows rather than what the NSA is doing according to it?

No, the nut is that Nadler asked Mueller about Patriot Act Sec. 215, but Clapper addressed the issue in terms of FAA 702. Tellingly.

EDIT: clarification, as all should be doing beforehand in light of the amount of misdirection possible on this topic. (I'm generally bouncing off of this, though: http://www.emptywheel.net/2013/06/17/james-clapper-throws-a-...)

Nadler switched to talking about "listen[ing] to the phone," which is FAA 702, not 215. 215 is only for stored records and has not been used, as far as I can remember, for content. (BTW the exchange was with Mueller, not Clapper.)

It's imprecise to say the exchange was only with Mueller, since Clapper responded to the questions raised in that conversation. Yet another strategy that is adding to the confusing narratives being sown by the government (and that can cause stories to be retracted).

I wouldn't call a statement four days later without a response an "exchange," though I suppose some people might.

You make a good point. There are a few different aspects worth separating here:

- First, oddly, we don't know what the law allows. The Obama administration's secret interpretation of FAA 702 and secret rulings they obtained from the FISC have not been made public. This is a continuation of the Bush-era penchant for secrecy that included a secret interpretation of the law to allow warrantless eavesdropping and torture. See the last page of: http://epic.org/FISC-NSA-domestic-surveillance.pdf/

- Second, Congress would almost certainly not have approved the FAA (2008) if they had known that a single analyst has access to Americans' confidential email, phone records, etc. Same with the Patriot Act (2001) that is used obtain a general warrant to vacuum up Americans' phone records on an ongoing daily basis. And Snowden said today it's not just NSA, but FBI, DNI, CIA, etc. analysts. Read 702 and see if you think you can predict how it would have been secretly interpreted: http://thomas.loc.gov/cgi-bin/bdquery/z?d110:h.r.06304:

- Third, U.S. intelligence officials have argued in the past that the president has the constitutional authority, no matter what the law says, to authorize domestic spying without warrants. So the wording of the law may no longer matter! See: http://www.nytimes.com/2007/05/02/washington/02intel.html

You have to read the FISA system in context. Surveillance under the Act is only authorized in cases where the 4th amendment doesn't apply and where no warrant would otherwise be required. Under those circumstances, it's not particularly outrageous to allow the AG or DNI to proceed without a FISA warrant under certain circumstances.

In fairness that's not very reassuring for the idea that an NSA analyst may decide to look at a U.S. citizen's traffic and then "whoops, let's minimize that".

I guess what I'm wondering is what are the supervisory controls that are put in place to catch and discipline an analyst who looks into warrant-required intercepts where it isn't a bona-fide innocent error? I.e. if you know the person is a citizen you shouldn't look at all (without getting a warrant), and if you don't know but find out in the middle of reading the data then you should stop and minimize immediately.

I can't so much as release a military member's pay transaction without having it looked at by a supervisor and eventually audited (likely by 2-3 different groups when it's all said and done). Are there similar supervisory controls in place here? Those would be good questions to ask to ensure that any such usage of the FISA is kept in line with the already quite-expansive spirit of the law.

All very fair points. I'm not sure if it's even possible to get the kind of necessary supervision. I'm just pointing out that the law isn't facially ridiculous, even if it might create structures that are practically unworkable.

I think we can get "good enough" supervision using a combination of even just widely-known management controls. Technical controls would add icing to that cake but I don't think it would even be technically necessary.

Much like with vaccination regimes we're trying to ensure that a critical mass of malicious analysts are not able to form, so you don't necessarily have to catch them all but you do have to catch enough to ensure no damaging conspiracies can form.

- Combine an evidence review process where an analyst's products are routed for minimize/warrant compliance to ensure the data is sourced properly.

- Ensure the supervisors are trained and maintain proficiency so as to be able to support those reviews.

- Have trained NSA analysts take a career path (or at the very least a detail) as auditors whose function is to audit usages of these collected records (both in the past and currently in-use). Require a supervisor of some level to override an audit hold on a current investigation, and have that override automatically emailed to designated personnel (the idea being to ensure that multiple unrelated persons get their hands dirty if malicious activity is going on).

These are all just examples, I'm those with more brains on human systems engineering could think of something more appropriate.

But the point is that, even as serious as this issue is, we're not talking about things like life or death, severe damage to property, people not getting paid, people improperly getting paid, or any of the numerous other pressure points a government can use to create a police state. So surely there are administrative controls that can be emplaced, if we must choose to do this, to get the benefit without the risk to the rise of a police state. In fact I think such a thing could even be itself publicly documented without affecting the real need of the NSA (and other IC agencies) to maintain absolute secrecy about their tactical operations and policies.

The NYT reported in 2009 that an analyst was disciplined for snooping through former President Clinton's email (or attempting to).

Section 702 was written, and has been interpreted, to have very few restrictions.

1) It bars the NSA from collecting data on people unless "reasonably believed to be located outside the United States."[1] Data can be intentionally collected on any communication that has at least one foreign recipient or sender.[2] The wording of the warrants specifically contradict the fourth amendment, but as long as the target is "reasonably believed" to be a foreigner, it doesn't matter to the NSA.

2) The test of whether someone is located outside the US has been interpreted as a keyword-based system indicating that it is at least 51% likely. [3]

3) The NSA does not define "collection" as actually obtaining the data or metadata, but as a human analyst viewing the data.[4]

4) According to Snowden: "NSA likes to use "domestic" as a weasel word here for a number of reasons. The reality is that due to the FISA Amendments Act and its section 702 authorities, Americans’ communications are collected and viewed on a daily basis on the certification of an analyst rather than a warrant. They excuse this as "incidental" collection, but at the end of the day, someone at NSA still has the content of your communications." [5]

If they realize that it is actually an American, they have no obligation to delete the communications and will continue to store it indefinitely.

The NSA has been written a blank check to do whatever they want, existing checks and balances are simply insufficient. Whether that is due to their interpretation only breaking the spirit of the law (but not letter), or whether this is unconstitutional, is up for debate.

[1] FAA 702.g.1.B http://www.gpo.gov/fdsys/pkg/PLAW-110publ261/pdf/PLAW-110pub...

[2] FAA 702.b.4

[3] http://www.washingtonpost.com/investigations/us-intelligence...

[4] https://www.eff.org/nsa-spying/wordgames#collect

[5] http://www.guardian.co.uk/world/2013/jun/17/edward-snowden-n...

The administration told the Washington Post that they are in no way relying on interpretations of the word "collection", and that if they have the data, they have it, no matter whether or not analysts have looked at it.

Although Clapper told Andrea Mitchell something different -- that he was using the term 'collection' to mean actually looking at it.

That's not how I understood it at all.

Reply on news.ycombinator.com