Poll: Would it be OK for the NSA to spy if the code was publicly available? | Hacker News Reader

Poll: Would it be OK for the NSA to spy if the code was publicly available?

22 pointsdsugarman51 comments

Is there some transparent system that would make it possible to identify potential terrorist threats and provide a comfortable level of privacy to US citizens?

EDIT I was wondering if there was a criteria we could agree upon and publicly uphold to make data collection OK. For example, immediately throwing out any piece of data collected unless the public agrees that that piece of data is likely to help counter-terrorism.

View on HN

The implications of having a giant mass of data that includes everything done by everyone is just too awful.

Will the phone metadata ever do anything other than provide guilt by association? I doubt it, because only the communication itself can prove that "it was a wrong number!" versus the old "Can I speak to Mr E. Plot?/Sorry Wrong Number!" code communications.

Will the phone metadata ever get dragged out to help prove innocence? Again, probably not, it will only get dragged out to help "law enforcement".

You might start by trying to define "terrorist" in a way that's independent of referring to authority. When you've got something that, say, I can use to determine who is and who is not a "terrorist", then see if you think you can identify those folks with phone data.

The implications of having a giant mass of data that includes everything done by everyone is just too awful.

Actually, the implications of having such a mass of data are complicated but not necessarily awful.

Let's speculate. Suppose a publicly accessible database of everything everyone does were available to everyone. Then the NSA could do all its ineffectual terror spying and you could watch the NSA people doing it in real time. Your brother in law could watch you watching the NSA and then switch to watching his favorite basketball team discussing its strategy for the upcoming game in their locker room because he finds your NSA obsession boring.

Is such a omnipanopticon world awful? It would be different, certainly. There would be little crime and terror but you wouldn't be able to keep private secrets, either. Nobody could be blackmailed because nobody could keep any embarrassing evidence hidden. Every intersection would be a red-light camera. The various drug laws would be overthrown by force majeure when there was found to be no space left to lock up half the population.

Yes, a social revolution with both good and bad effects would be complicated.

What the Anglosphere governments are doing is very different. They want to have all the information possible about us and for us to have less and less information about them. Obama and the other secrecy-and-police state governors of our world are working even more assiduously to put the public in the dark than they are to spy on us. And that is a very different thing.

The question seems to totally miss the point.

Whether the code is open or not is irrelevant. They shouldn't be spying in the first place.

Playing the devil's advocate. What if all the data collected was also publicly available?

No. From a corporate perspective there would be a ton of IP, potentially.

From a personal prospective, no. I consider who I call and when I call them private and not public.

Many laws are formed around the basis of "just in case," for example marijuana prohibition exists because there's a threat that criminal organizations might be beneficiaries from marijuana sales. What if we knew which sellers were contributing to crime and, more importantly, which weren't?

If we have the opportunity to reduce friction in society, then why not?

Insurance -- of all kinds -- is another area dominated by "just in case" policies. What if we really knew which insurance claims were fraudulent?

And I consider who you call and when you call them my private property. You can consider all you want, until your elected official changes the law, your consideration has no bearing on reality. Who owns calls made over a telephone network subsidized by the public?

Let's walk through this: if you send a letter in the mail from you to me, USPS can reasonably be expected to scan the envelope and record this fact.

If you go out into a public place and have a conversation with me while shouting, you can reasonably expect other people, some of whom might be working for the NSA to overhear.

Why are those things not problems, but listening in on phone conversations is? Because of the difference between a public and a private place. You "consider" phone networks to be private places and they are not. We often tell people that the internet is not private and that anything that ever touches the web will stay on the web. We just learned that that is true for the phone networks as well. It seems that you cannot have a private conversation with another person other then in a physical private place... Except even then you cannot. There exists technology that will allow someone with enough money and will power to listen in on the most private conversation (either by placing a mic near you or by listening in remotely). What happens with our society when we discover the technology that allows someone to listen in on your thoughts?

The problem is that anything that can be wiretapped, will be wiretapped. The solution to this problem is technological. The laws around it need to simply state two things: (1) you cannot use anything you obtain without a proper warrant against the suspect and (2) you cannot prevent someone from using encryption.

>The problem is that anything that can be wiretapped, will be wiretapped. The solution to this problem is technological.

I was against you the whole time until the point where you said

>The laws around it need to simply state two things: (1) you cannot use anything you obtain without a proper warrant against the suspect and (2) you cannot prevent someone from using encryption.

I wholeheartedly agree with (2). (1) needs further elaboration. Can you use what you've collected to get a "proper" warrant? Can you go on a fishing expedition to assassinate someone's public image? What protection will we have against that?

I do not think this is a technological problem. I find it very scary how much leeway prosecution has in whether or not to press charges.

It is also very sad to see the people who I'd consider on my side to cheer for the IRS to go after tea party groups.

oh how the black hats would love this!

It think that this is, on balance, a good idea.

It would even out the information imbalance and provide equality-at-arms between the individual and the state (which is an unabashedly good thing).

On the other hand, it would entail a huge cultural shift, which many people would be uncomfortable with, and would take a while to get used to. However, once the shift is complete, I think we would be more honest about ourselves, more at home in our skins, with all of our flaws and weaknesses made public. We might expect a little less (false) perfection from each other as well, which can only be a good thing.

> They shouldn't be spying in the first place.

Should the U.S. spy agency (one of them, anyway) stop spying?

Should the U.S. disband its spy agencies?

Is there a role for "spying" in this age?

The wide net that they wish to cast isn't necessary. They didn't have agents investigating every person in the US, looking for spies prior to the Internet.

Should the U.S. spy agency (one of them, anyway) stop spying?

Should the U.S. disband its spy agencies?

Is there a role for "spying" in this age?

Absolutely

----

The questions are: "Should a U.S. spy agency be allowed to violate our constitution?"

"Should a US Spy agency destroy the future competitive nature of US internet companies abroad to save a few lives via stopped terrorist attacks?"

Probably not, but the implications of such a discussion are extremely complex and definitely not black and white.

"If this technology was preventing terrorist attacks, how do we replace it with something less invasive which follows the constitution?"

I have no idea.

The reality is, for those of us on HN who are American Citizens, we probably benefit from our nation having global power. For those who are not American citizens, it is almost definite that you do not benefit from the US government from having global power.

How the US exercises its power could potentially lead to negative butterfly effects. I don't agree with the NSA spy program, but I also have no idea how to stop people from coming here and causing terrorist attacks.

Those that say we can stop them via being nice to other countries have no way of truly knowing that, and those that say we can stop them with the NSA spy program are just as clueless.

Maybe my question was a little indirect. I was wondering if there was a criteria we could agree upon and publicly uphold to make data collection OK. For example, immediately throwing out any piece of data collected unless the public agrees that that piece of data is likely to help counter-terrorism. Of course the NSA would then lose the history of data that would be useful after a known terrorist was found, but the system would greatly help with privacy concerns.

No.

I'm not convinced "terrorism" cases should be handled any differently than any other criminal cases.

It's such a vague term, I'm not even sure it should be possible to prosecute it. What does it even mean for a person to "be a terrorist"? Clearly if a person has blown up a building or plane they should be prosecuted for that. But trying to prosecute before the fact in the name of counter-terrorism seems a little too much like thought crime, IMO.

They shouldn't be spying on American citizens in the first place. That protection could possibly be extended to civilians in other countries as well, but there's nothing in the Constitution about the rights of non-citizens.

However, spying on foriegn governments and militaries is okay. Non-governmental terrorist organizations like Al-Qaeda are also fair game for spying. However, if the Al-Qaeda members that you are spying on are American citizens, then you need a warrant, preferrably one granted by a reputable court and not a secret rubber-stamp court.

"there's nothing in the Constitution about the rights of non-citizens." - you are wrong. Just read the text of the Fourth Amendment and try to find the word "citizen" there.

You're right about the citizens thing, but multiple court cases over the years have asserted that constitutional protections only apply to "US persons". So, citizens, legal residents, non-legal residents, visitors, anyone physically in the US.

Visitors will be kind of a stretch, as they might not have any substantial ties with the US "community" to be protected by the Fourth. The opposite thing goes for the legal temporary worker who went to visit home country for a couple of weeks - he should be protected. In any case I do not think NSA takes all those things into account when they figure out who is a "US person" and who is not, if they ever do that, of course.

Does it apply to diplomats visiting the US? What about their families?

> They shouldn't be spying on American citizens in the first place.

Neither should they be spying on citizens and industries of friendly states and allies.

Surveillance, including just data collection and storage, without probable cause, is unacceptable, period. Any sort of dragnet surveillance must occur without probable cause, because they're collecting data on everyone.

The code IS publicly available, at least the code for how they access it. For instance, there's a version of Hadoop that restricts what you can see based on your role, so that some Analysts with less clearance may see less.

One problem is that a contract employee of the government had superuser access, probably higher access than some ranking intelligence officials, including access to target people.

So, you can say, OK, open-source the access controls, the access controls are sound, they're audited, they make sense, they fit the narrative.

Mr. Snowden says they are configured in a manner that is euphemistically referred to as the 'widest possible aperture' or something like that.

Basically, everyone has as much access as possible so that noone is unable to perform their job tasks due to misconfiguration.

This is pretty similar to the fact that most tech startups require all developers to have root on production. It's a poor practice for a company that has social games or web discussions or whatever, but it's a horrid task for an organization with a massive store of secret history about lots of individuals.

I'm sure there IS open source software being used. (Responding to question as written - was "data" rather than "code" intended?)

Of course, that means that as an open source author it's possible your code is used in what you might consider to be horrible ways. I guess this is true no matter what - say you come up with the world's next great web framework. You're a staunch atheist, but a Baptist church uses your code to launch a website to evangelize. Your code is changing the world in a way you oppose.

So... is there a place for a license with idealogical restrictions on use? Would this promote censorship, or would it restrict attacks on it?

Such software would be non-free - an example of software which does this can be found with the JSON License[0]. The IBM team infamously sought (and received) a special exemption to do evil with that license.

The story is amusing, but the reasoning is simple: ideological restrictions are difficult to pin down legally, because they're murky to define. From a practical standpoint, this means that any company with a legal team that knows what it's doing will avoid using the software, even if their ideologies are in accordance with yours - the restrictions simply expose them to more liability than they're willing to take on.

[0] http://tanguy.ortolo.eu/blog/article46/json-license

As with many aspects of this issue, there would be no way to verify that their spying is using the publicly available code. If they demand secrecy about the individuals who have access, the individuals who are being targeted, the organizations providing the data, the court orders that oversee it, and in general carte blanch to do whatever they deem necessary to ensure "national security" - what on earth would be achieved if they showed us some source code? They've proven they have no discipline or restraint - they could show me all the source code they want I still wouldn't trust them.

Would it be okay for me to shoot you if I gave you the design of the gun?

Have any of you seen the show Person of Interest?

I think there is a pretty good argument for domestic spying. But its a very fine line, the human element is the part of the system that I dislike the most.

I would be totally okay with a Completely Impartial and Unbiased body observing everything I do. Because for me my actions and for the majority of people their actions are completely irrelevant to crime fighting and prevention.

But as we all know there is no such thing as unbiased, or impartial so I don't think it could ever work.

Impartial and unbiased observation of everyone would result in everyone in prison.

I wouldn't trust any code they published to be real.

What if it was audited by 1 or more third party organizations you did trust?

Sure an audit could confirm that there is no "malicious" data collected, but it still won't prevent the use of that data in a malicious manner.

It would be much better, but it would be terrible.

Would it be ok for the NSA to put cameras in everyone's home if the schematics were freely available?

No, They lie, and it's been proven. They say they only spy on foreigners, but they only have to be 51% sure of that. So, 49% of the people they spy on are potentially americans... yet they still claim that we only spy on foreigners!

We would have to think very very carefully about the criteria that are used. It is worth bearing in mind that the agencies in question are essentially police, investigating past crimes and trying to prevent future ones.

What must be transparent is the system that uses that data... and I don't mean the code, but people, organizations behind, in general the government. If above that the code is also open and available, the better.

What about a system that provides a comfortable level of privacy to ALL people.

The only possible such system is one where each individual can set his own privacy level. This does not seem practicable.

They could publish the code , but how do you know the binaries that they are using are compiled against an unmodified version of that source and that they are not using any other software?

Doesn't matter. It's always been known that the NSA is a spy agency. Thats what they do. However, they shouldn't be doing it in the manner that they are.

The problem isn't with the code, it's with the people. Publish, don't publish, makes no difference. That much information is designed to be abused.

No. Because the public would still be generally against it, and many congressmen would be voted out of office over this issue if they had an honest vote over it.

Data is the valuable thing here. Code is not.

And what guarantee would the public have that the published code is the same that's running on the servers?

I would rather have the hardware they use be publicly available.

Holographic storage and 3D diamond processors. Hhnnnnnggg.

No one asked the USA to systematically collect data about every citizen on this little blue planet.

I guess they already use open source tools.

HA no, then anyone would have access to specialized software used for spying, that doesn't even make sense to just give it to the public

Any well designed Crypto algorithm is publicly available

That doesn't matter. It's not like the software magically obtains data. Data has to be input into it from their intercept points, etc. It's not like they'd be giving out API keys to the database along with this.

Reply on news.ycombinator.com