Hacker News Reader

Comment by marknutter | Hacker News Reader

Arguing that these programs are effective by revealing a few foiled terrorist plots is entirely beside the point. Obviously monitoring every communication on the planet would help the government track down a few terrorist plots here and there. If they really want the debate to focus on the effectiveness of these programs then they should explain why they failed so spectacularly to prevent the Boston Marathon bombings, a plot carried out by two of the most careless and naive terrorists to date. Heck, even a direct warning from Russian officials fell on deaf ears. Perhaps the NSA was too busy listening to innocent people's phone calls to respond?

The effectiveness isn't what's at issue here, though. The problem is the loss of privacy for innocent civilians, to which Obama and other government officials respond to with wishy-washy arguments about "tradeoffs" between security and privacy.

View on HN

I would argue that even if these programs were effective in foiling some terrorist plots, that it's still not worth it. I mean, we could probably could prevent some mass shootings if we put everyone with a history of serious mental illness in an institution for the rest of their lives but that wouldn't make it right.

And perhaps the bigger risk to using the 'it prevented terorrist plots' argument is that it creates a convenient excuse for more surveillance and curtailing of rights. All that needs to happen is for a few more terorrist plots to slip through, then the argument will be, 'We need MORE power to stop these people' or, 'If you just allowed us to do this, this, and this, we could've prevented that'.

Then long after a significant threat of Jihadist terrorist attack is gone, we'll still be dealing with a uber-powerful police state.

By their measure we should wiretap everyone in government to prevent graft, corruption, revolving doors and regulatory capture.

I would also add to the argument that the following things are also happening and will happen:

1) More money being wasted to support certain corporations (Booz etc) in return for future plum jobs by these representatives/senators or heads of these agencies. Thus the cycle continues in favor of supporting these programs rather than analyzing whether we really need it or not.

2) Abuses by contractors or employees when they have this much access and power in seeing all the private data

3) Corruption of these committees due to the feeling of being "in" where others are not.

In other words, it's going to get worse.

Do you have any citations for any of these items? Or is it just time for wild speculation? I am pretty good at that:

And they'll listen to who is pregnant in the future, and force us to all get implants for the babies, thereby making a super race of Americans to rule the world! lightning flash MWAHAHAHA.

Please cite any proof you have.

It is well known by people who pay attention to Financial markets, that government officials from the Treasury often end up working at places like Goldman Sachs, Fannie Mae and a myriad of other "private" and quasi-governmental corporations. This is often a two way street... look up; Tim Geithner, Hank Paulson and more. These are the big notable cases. Go read http://zerohedge.com or the http://market-ticker.org they point this stuff out all the time.

There is ZERO reason to believe this doesn't happen for ALL sectors of government. So, I would say, the burden of proof would land on the shoulders of those who say that it DOES NOT happen.

It's called a revolving door and regulatory capture.

http://en.wikipedia.org/wiki/Revolving_door_(politics)

http://en.wikipedia.org/wiki/Regulatory_capture

This isn't exactly here say and speculation.

Anecdote: I interviewed at Booz Allen Hamilton when I was in school and got a bad taste in my mouth from the place. They talked about how you could work your way up but you could only get past a certain level by bringing in business. To get to partner, you need to be bringing in at least $x million a year for the company. They told us that no one is hired directly in at partner level except for a 3-star general they just hired in last month because of the connections he had.

This is commonplace in other business situations as well, including law firms. Partners at many large law firms can make $1.5M a year in profits (not salaries, because they're part-owners). You need to bring in far more than that to cover your take.

Generally, "partner" == Rolodex

Look up Thomas Drake, he was an NSA leaker who exposed a very high level of waste with the Trailblazer program as well as an incestuous relationship between contractors and those who awarded the contracts.

Look at Clapper. Where was he before going to DNI?

How about McConnell?

Lot of examples out there. Not hard to connect the dots if you spend less time reacting like a third grader.

You could summarize the entire hearing in one sentence.

"The 4th amendment doesn't apply under the Patriot Act."

In theory, the 4th Amendment trumps the Patriot Act. In practice, it doesn't.

Not only that, but I can imagine the number of false positives for a collection that large would have to be off the charts. Your assessment that they missed a direct warning from a tenuous ally because they were too busy listening (chasing down) domestic leads is probably even truer than you think.

It's always a tradeoff between privacy and security. The rules behind the use of the metadata are pretty stringent. For example:

    Metadata is JUST number + duration. Not localtion, cell phone tower...


    targetting cannot be done on citizens or permanent citizens, or people in the US. Permanent citizen in Madrid is safe.

    No "reverse" targetting(targetting foreigner but really interested in US nat'l)

    if citizen/perm. res accidentally targeted, info not used, FISA court signalled, house intel + judiciary signalled.

    If targeted person is initially out of US, but venture in, targeting stops IMMEDIATELY.

    Info accidentally gotten (for example, lag when stopping of the targetting mentioned previously), ineligible info is purged. All ineligible info is purged.

    All targeting is reviewed beforehand , both by DNI and judiciary. All targets are audited

Plus this was used on less than 300 numbers. 20 people in the world have access to the info. The justification procedures are stringent.

This hearing restored some confidence in checks and balances. And a good point by Deputy AG Cole: This is for foreign surveillance ONLY. There used to be no oversight for foreign surveillance. Now there is through FISA Court and this second court order with all these rules in it.

Also, NSA can't listen to the calls without fixed warrant, and the brothers were in the US at the time of planning their thing, so out of NSA jurisdiction anyways.

The issue isn't the use of this content, it's the collection of the content. I don't think anyone would have an issue with the NSA collecting and storing data on specific targets after receiving a court order to do so. What people are taking issue with is the collection and storing of data on innocent civilians without a court order, to be used in the event they receive a court order. What makes this collection worse is that apparently low-level government contractors like Edward Snowden can access this vast pool of data, whether or not approved to do so. It's the equivalent of having the US Postal Service open and photocopy every single piece of mail that goes through their system to be stored in a database and used later by NSA/FBI/CIA analysts who have received the proper court order to do so.

Snowden can't access the data , according to this testimony.

I don't have that much of a problem with this because the warrant is needed in order to actually do anything with the information. Also, to be precise, it's more as if the USPS scan the mail sender/receiver info (metadata after all). No content.

"Snowden can't access the data , according to this testimony."

How do they stop him? It sounds like "can't access the data" means "the rules say he cannot access it, and if he is caught he'll get in trouble." Given that the people we are talking about think in terms of "the least untruthful statement" they can make, I would demand as much detail as possible.

"I don't have that much of a problem with this because the warrant is needed in order to actually do anything with the information."

Today a warrant is needed. Tomorrow, maybe not. What if tomorrow, the law changes, and the government starts hunting down anyone with leftist leanings? The first thing they'll do is query the database.

Laws are not sacred. Laws can be ignored or changed at any time. When we have to worry that the list of people we speak with today might be used against us tomorrow, there is a chilling effect on free speech. That is the danger of these databases. It is not enough that the data is held but can only be touched with a warrant; the data should not exist without a warrant.

> What if tomorrow, the law changes, and the government starts hunting down anyone with leftist leanings?

If you think that's a possible reality you're living in a paranoid lala land - which isn't surprising given all the apocalyptic narratives we get from the media (gov't turning evil, zombies/robots taking over, evil agencies controlling the world).

The reality is that no wealthy democratic government in the past 50 years (some of which are less obsessed with protecting liberties) has slid back into tyranny. There are statistics that indicate that past a certain GDP threshold tyrannical governments become unsustainable.

This kind of thing is simply never going to happen.

McCarthy happened. So did Nixon. We will elect or appoint people like this again and we don't need to have a nightmare total collapse scenario in recent history to recognize the potential for abuse in a data archive like this.

It sounds like you think there could not possibly be any big changes that would open the doors to tyranny. In other words, you are naive.

You speak as if 50 years is a significant period of time. Tribalism, violence, and distrust are still very real forces in the world and there is nothing "simple" about granting historically unprecedented powers to a central authority.

The reason I use 50 years is because people are constantly thinking we're going to go the way of NAZI Germany. People bring up McCarthy and other examples from a completely different era that have a very different context.

When you start looking more than 50 years into the past you need to realize that this was a time when people thought blacks were lesser people than whites, women couldn't vote, many people were illiterate, people didn't have access to information, and maybe most importantly people were much much poorer (just look at the GDP). Now a days people for the most part live comfortable lives, and what we think of as "hard times" now is not the same as before (where it would often mean starvation for a large segment of the population) So to think history will repeat itself seems to me very simplistic.

They confirmed that a court order is not needed to query the database, only the reasonable suspicion of an analyst.

which Snowden says is also barely audited

> Plus this was used on less than 300 numbers.

The metadata is still collected and presumably stored for all, they just escalated it to additional surveillance for 300 numbers.

> 20 people in the world have access to the info.

[citation needed] Keith Alexander today said they have 1000 sysadmins like Snowden, most contractors. Snowden said, and the other NSA whistleblowers confirmed, that a sysadmin at the NSA has access to all data with little to no restrictions.

> This is for foreign surveillance ONLY.

And how do they determine whether or not it's foreign or domestic? Surely they must analyze content in order to be sure?

What was said in the conference: they look at the number, if the number is foreign, it's good. If there's an error and the number is US (for example, a clerical error) the query results are IMMEDIATELY destroyed, and this event is reported to subcommittees and FISA court.

The metadata is collected, destroyed after 5 years, but cannot be queried except under the stringent circumstances. So it's basically if they could just go "back in time" on looking at certain phone numbers.

and the 20 people is in the conference. Alexander said that 20 analysts and 2 managers (himself and Inglis) are the only people with access to this database.

"the query results are IMMEDIATELY destroyed"

The data that was queried, however, is not -- so the query could be run again later if someone wanted to.

"The metadata is collected, destroyed after 5 years,"

An awfully big window for policies to change. Destroyed after 5 years can become destroyed after 10 years, or never destroyed at all, when the people in charge change their minds. How would we even know about the change, when everything is done in secret? The fact that members of Congress need to be told what the period of time is means that they did not know beforehand; will they be told when the period of time is lengthened (I have no hope for it getting any shorter)?

"Alexander said that 20 analysts and 2 managers (himself and Inglis) are the only people with access to this database."

Assuming everyone always follows the rules, which is a pretty stupid assumption.

>Assuming everyone always follows the rules, which is a pretty stupid assumption.

That's why there's oversight. What's the point of making rules if you assume no one follows them? This is Rule of Law 101.

What oversight would you be referring to here? Does someone (not chosen by the people in charge of the NSA, up to and including the President) come in to periodically audit the NSA and ensure that they are only spying on Americans when they have a warrant? Do their computers even keep logs to enable such auditing?

The problem here is that you have a secret agency that is saying, "Look, really, we have these policies and we promise that we follow them. Of course, you cannot come in and check to see if we are following them, because our operations are a secret." It does not help that whistleblowers are considered to be traitors in this situation. How exactly do you think the rule of law works?

> they look at the number, if the number is foreign, it's good. If there's an error and the number is US (for example, a clerical error) the query results are IMMEDIATELY destroyed, and this event is reported to subcommittees and FISA court.

They've also said they are not allowed to monitor U.S. citizens living abroad. What if they have a number outside the U.S. How do they detect that a number belongs to a U.S. citizen or resident? If a non-U.S. person has a phone number from the U.S. but they are not a citizen/resident and are not inside the U.S., is that protected or not?

> The metadata is collected, destroyed after 5 years, but cannot be queried except under the stringent circumstances.

That seems to contradict what they also said today, that no court order is required to query the database and it just requires reasonable suspicion on the part of the analyst.

> Alexander said that 20 analysts and 2 managers (himself and Inglis) are the only people with access to this database.

Is that technical access or legal access? In other words, are there technical limitations preventing anyone but those 22 people from accessing the data, or is everyone else just not supposed to? If they have sysadmins managing the databases, surely they have access too, as Snowden and Binney have both said?

Whats your source for those quotes? Is that from the hearing happening now?

This stuff sometime around like minute 45 or thereabouts.

I'm frustrated by them asking the wrong questions to the wrong people. They should be asking FBI about listening to Americans' phone calls. They're not dong it, in the bits I've heard, yet.

Edit: FBI did chime in on reading emails in real-time, indicating FISA court as the means for doing so, but nothing else I heard. (~1:28?) Edit2: Grunt. I clearly don't understand what's going on here. (~1:42). I'm just going to shut up for another couple days and see what the Guardian releases in response.

I haven't been able to follow the hearing from my desk, but I'm curious if anyone asked why the NSA director lied to Congress. Moreover, there were many questions prefaced with "Under these two programs..." These are the programs that have been made public. Who knows what they're running that is not public.

Correct. This is the same kind of very narrow denial that we saw under the Bush-era warrantless wiretapping programs as well. There are multiple programs.

All this info is stuff I wrote down during the presentation, yeah. It'll probably show up in a condensed form soon after the end of this.

Well, to be fair, the boston bombers' carelessness and naiveté might have been what helped them pull it off.

Heck, even a direct warning from Russian officials fell on deaf ears.

You're also the kind of person that would be up in arms when the FBI takes someone into custody because Russia says he's trouble.

You missed the point.

AFAIK the NSA was not informed, the FBI was. They investigated and concluded that there was no firm evidence of intent, case closed. Due process at work in our police state, strange.

Also, a student with a naturalized American brother who travels to visit family and speak with radical Islamists at his old home is not the kind of thing that either collecting phone call information or using Facebook Open Graph^W^W^W Prism is going to work well against. There are other types of terroristic threats, Prism/phone watch lists will work better against those.

If anything Maj. Nidal Hasan would almost be a better example, except that the NSA system worked perfectly... it was only in the follow-up investigation that it was decided that Hasan was just making innocent probes, so it was the investigation that failed and not the NSA system.

Arguing that monitoring every communication on the planet makes no sense... even with contractor augments there are not enough U.S. citizens to monitor all world communications, and the pool of available analysts quickly drops when you consider security clearance issues, training required, pay available, the qualifications needed, etc.

So no, it doesn't follow that you could perfectly foil terrorist plots even with interception and monitoring of worldwide communications, so the fact that NSA is as successful as they are can't be waved away by saying "anyone could do it". They can't monitor everyone even with their Utah data center, so apparently they've been doing a good job at focusing their resources at the mission at hand.

Any either way there's always a tradeoff. You wouldn't accept a 9/11 in your country every day to ensure absolute privacy as soon there would be no one left to be private from, so let's not act like the priority value is ∞. The staggering success of Twitter, Facebook and Google reveal how much people truly value their privacy.

Even the Constitution is in on the act, as both warrants and "reasonable searches" are explicitly mentioned as limits to Fourth Amendment rights, and people don't seem to freak out about those.

So while people may have different answers about where they fall on privacy <==> security (where a given program has a tradeoff between the two), don't act like the extreme choice is the only one; even the Framers didn't think that.

You know what? The fact that a person uses Facebook, Google, etc. is in no way a declaration from that person that they do not value their privacy, especially privacy from the government. The 4th amendment makes participation in those things possible.

Absolutely using Facebook and Google is a declaration of that. At least the government is incompetent, by sending that information to Google and Facebook you're leaving yourself up to their good graces (which change with little to no notice which each modification to their privacy policies). That is a person's own choice to make, but they've definitely made it.

The 4th Amendment covers the relationship between you and the government. It does not cover the relationship between the government and a third-party, unless Congress passes additional legislation to add that protection.

Congress has done so for the mail, for landline telephone, beepers, and cellular telephones. They have not done so in the general case for email or other electronic data hosted by a third-party, and yet email and other electronic services somehow have become incredibly popular.

A person can revoke Facebook's and Google's access. A person at least gets to read the TOS of fb and Google, we both know that rarely happens, but the possibility exists where it is completely absent in the case of the gov't.

>The 4th Amendment covers the relationship between you and the government.

Yes, of course it does. And it's because the gov't cannot scan and fish facebook for crimes to solve that people feel comfortable enough to share such information.

Reply on news.ycombinator.com