Comment by rtpg | Hacker News Reader

Comment by rtpg | Hacker News Reader

Parent Full thread

It's always a tradeoff between privacy and security. The rules behind the use of the metadata are pretty stringent. For example:

    Metadata is JUST number + duration. Not localtion, cell phone tower...


    targetting cannot be done on citizens or permanent citizens, or people in the US. Permanent citizen in Madrid is safe.

    No "reverse" targetting(targetting foreigner but really interested in US nat'l)

    if citizen/perm. res accidentally targeted, info not used, FISA court signalled, house intel + judiciary signalled.

    If targeted person is initially out of US, but venture in, targeting stops IMMEDIATELY.

    Info accidentally gotten (for example, lag when stopping of the targetting mentioned previously), ineligible info is purged. All ineligible info is purged.

    All targeting is reviewed beforehand , both by DNI and judiciary. All targets are audited

Plus this was used on less than 300 numbers. 20 people in the world have access to the info. The justification procedures are stringent.

This hearing restored some confidence in checks and balances. And a good point by Deputy AG Cole: This is for foreign surveillance ONLY. There used to be no oversight for foreign surveillance. Now there is through FISA Court and this second court order with all these rules in it.

Also, NSA can't listen to the calls without fixed warrant, and the brothers were in the US at the time of planning their thing, so out of NSA jurisdiction anyways.

The issue isn't the use of this content, it's the collection of the content. I don't think anyone would have an issue with the NSA collecting and storing data on specific targets after receiving a court order to do so. What people are taking issue with is the collection and storing of data on innocent civilians without a court order, to be used in the event they receive a court order. What makes this collection worse is that apparently low-level government contractors like Edward Snowden can access this vast pool of data, whether or not approved to do so. It's the equivalent of having the US Postal Service open and photocopy every single piece of mail that goes through their system to be stored in a database and used later by NSA/FBI/CIA analysts who have received the proper court order to do so.

Snowden can't access the data , according to this testimony.

I don't have that much of a problem with this because the warrant is needed in order to actually do anything with the information. Also, to be precise, it's more as if the USPS scan the mail sender/receiver info (metadata after all). No content.

"Snowden can't access the data , according to this testimony."

How do they stop him? It sounds like "can't access the data" means "the rules say he cannot access it, and if he is caught he'll get in trouble." Given that the people we are talking about think in terms of "the least untruthful statement" they can make, I would demand as much detail as possible.

"I don't have that much of a problem with this because the warrant is needed in order to actually do anything with the information."

Today a warrant is needed. Tomorrow, maybe not. What if tomorrow, the law changes, and the government starts hunting down anyone with leftist leanings? The first thing they'll do is query the database.

Laws are not sacred. Laws can be ignored or changed at any time. When we have to worry that the list of people we speak with today might be used against us tomorrow, there is a chilling effect on free speech. That is the danger of these databases. It is not enough that the data is held but can only be touched with a warrant; the data should not exist without a warrant.

> What if tomorrow, the law changes, and the government starts hunting down anyone with leftist leanings?

If you think that's a possible reality you're living in a paranoid lala land - which isn't surprising given all the apocalyptic narratives we get from the media (gov't turning evil, zombies/robots taking over, evil agencies controlling the world).

The reality is that no wealthy democratic government in the past 50 years (some of which are less obsessed with protecting liberties) has slid back into tyranny. There are statistics that indicate that past a certain GDP threshold tyrannical governments become unsustainable.

This kind of thing is simply never going to happen.

McCarthy happened. So did Nixon. We will elect or appoint people like this again and we don't need to have a nightmare total collapse scenario in recent history to recognize the potential for abuse in a data archive like this.

It sounds like you think there could not possibly be any big changes that would open the doors to tyranny. In other words, you are naive.

You speak as if 50 years is a significant period of time. Tribalism, violence, and distrust are still very real forces in the world and there is nothing "simple" about granting historically unprecedented powers to a central authority.

The reason I use 50 years is because people are constantly thinking we're going to go the way of NAZI Germany. People bring up McCarthy and other examples from a completely different era that have a very different context.

When you start looking more than 50 years into the past you need to realize that this was a time when people thought blacks were lesser people than whites, women couldn't vote, many people were illiterate, people didn't have access to information, and maybe most importantly people were much much poorer (just look at the GDP). Now a days people for the most part live comfortable lives, and what we think of as "hard times" now is not the same as before (where it would often mean starvation for a large segment of the population) So to think history will repeat itself seems to me very simplistic.

They confirmed that a court order is not needed to query the database, only the reasonable suspicion of an analyst.

which Snowden says is also barely audited

> Plus this was used on less than 300 numbers.

The metadata is still collected and presumably stored for all, they just escalated it to additional surveillance for 300 numbers.

> 20 people in the world have access to the info.

[citation needed] Keith Alexander today said they have 1000 sysadmins like Snowden, most contractors. Snowden said, and the other NSA whistleblowers confirmed, that a sysadmin at the NSA has access to all data with little to no restrictions.

> This is for foreign surveillance ONLY.

And how do they determine whether or not it's foreign or domestic? Surely they must analyze content in order to be sure?

What was said in the conference: they look at the number, if the number is foreign, it's good. If there's an error and the number is US (for example, a clerical error) the query results are IMMEDIATELY destroyed, and this event is reported to subcommittees and FISA court.

The metadata is collected, destroyed after 5 years, but cannot be queried except under the stringent circumstances. So it's basically if they could just go "back in time" on looking at certain phone numbers.

and the 20 people is in the conference. Alexander said that 20 analysts and 2 managers (himself and Inglis) are the only people with access to this database.

"the query results are IMMEDIATELY destroyed"

The data that was queried, however, is not -- so the query could be run again later if someone wanted to.

"The metadata is collected, destroyed after 5 years,"

An awfully big window for policies to change. Destroyed after 5 years can become destroyed after 10 years, or never destroyed at all, when the people in charge change their minds. How would we even know about the change, when everything is done in secret? The fact that members of Congress need to be told what the period of time is means that they did not know beforehand; will they be told when the period of time is lengthened (I have no hope for it getting any shorter)?

"Alexander said that 20 analysts and 2 managers (himself and Inglis) are the only people with access to this database."

Assuming everyone always follows the rules, which is a pretty stupid assumption.

>Assuming everyone always follows the rules, which is a pretty stupid assumption.

That's why there's oversight. What's the point of making rules if you assume no one follows them? This is Rule of Law 101.

What oversight would you be referring to here? Does someone (not chosen by the people in charge of the NSA, up to and including the President) come in to periodically audit the NSA and ensure that they are only spying on Americans when they have a warrant? Do their computers even keep logs to enable such auditing?

The problem here is that you have a secret agency that is saying, "Look, really, we have these policies and we promise that we follow them. Of course, you cannot come in and check to see if we are following them, because our operations are a secret." It does not help that whistleblowers are considered to be traitors in this situation. How exactly do you think the rule of law works?

> they look at the number, if the number is foreign, it's good. If there's an error and the number is US (for example, a clerical error) the query results are IMMEDIATELY destroyed, and this event is reported to subcommittees and FISA court.

They've also said they are not allowed to monitor U.S. citizens living abroad. What if they have a number outside the U.S. How do they detect that a number belongs to a U.S. citizen or resident? If a non-U.S. person has a phone number from the U.S. but they are not a citizen/resident and are not inside the U.S., is that protected or not?

> The metadata is collected, destroyed after 5 years, but cannot be queried except under the stringent circumstances.

That seems to contradict what they also said today, that no court order is required to query the database and it just requires reasonable suspicion on the part of the analyst.

> Alexander said that 20 analysts and 2 managers (himself and Inglis) are the only people with access to this database.

Is that technical access or legal access? In other words, are there technical limitations preventing anyone but those 22 people from accessing the data, or is everyone else just not supposed to? If they have sysadmins managing the databases, surely they have access too, as Snowden and Binney have both said?

Whats your source for those quotes? Is that from the hearing happening now?

This stuff sometime around like minute 45 or thereabouts.

I'm frustrated by them asking the wrong questions to the wrong people. They should be asking FBI about listening to Americans' phone calls. They're not dong it, in the bits I've heard, yet.

Edit: FBI did chime in on reading emails in real-time, indicating FISA court as the means for doing so, but nothing else I heard. (~1:28?) Edit2: Grunt. I clearly don't understand what's going on here. (~1:42). I'm just going to shut up for another couple days and see what the Guardian releases in response.

I haven't been able to follow the hearing from my desk, but I'm curious if anyone asked why the NSA director lied to Congress. Moreover, there were many questions prefaced with "Under these two programs..." These are the programs that have been made public. Who knows what they're running that is not public.

Correct. This is the same kind of very narrow denial that we saw under the Bush-era warrantless wiretapping programs as well. There are multiple programs.

All this info is stuff I wrote down during the presentation, yeah. It'll probably show up in a condensed form soon after the end of this.

Reply on news.ycombinator.com