NSA Rejection of Digital FOIA | Hacker News Reader

NSA Rejection of Digital FOIA

blog.jarrett.io

184 pointsjstreebin55 comments

If you are the sort of person who is surprised by this, you need to get out from under the rock you live under. This is what any self-respecting intelligence gathering organization is going to say. Not revealing whether or not information exists (let alone the actual information itself) has been a staple of the trade from the very beginning of the intelligence community. This response would be identical regardless of current events.

edit: typos

I'm no fan of the NSA, but you're right, the response made perfect sense to me. There's really no other way they could respond.

This isn't an exact parallel, but when I read their response and the reason for it, the first thought that came to mind was, "Oh, of course - it would be like a JavaScript timing attack."

I have gotten the same responses from the FBI many times for a FOIA request, though I have many associates questioned by the FBI, and I was detained in Ireland for possible hacking in the United States, so I assume I have a file. But anyway, same response of neither confirm nor deny from FBI about 4-5 times in last 10 years.

When applying for a foreign visa, they will probably require police records from your country of origin/citizenship. If you send in a request for records from the FBI, do they just send back a "Does Not Compute" answer, and then you're out of luck for preparing your visa application?

(assuming you're a US citizen)

Don't know the answer to that one, as I have never asked for a formal background check.

IIRC, it's $18 + submitting your fingerprints to the FBI in the US. Might be interesting to see what you get back if FOIA requests for their records on you return a "Huh? What records?" response.

Here's how I interpreted the letter: "We cannot confirm or deny the thing you requested exists because that thing you requested is classified". Unless all FOIA fail, it seems to me, in some broad sense, that they just confirmed the existence of the requested material.

I think it's more of "The information you requested, were it to exist, would be highly classified (due to its type), and therefore we can neither confirm nor deny its existence."

I'm pretty sure that actually means that even the knowledge of existence is classified, as per the "details about them remain classified and/or protected from release..."

Read as "We cannot confirm or deny the thing you requested exists because if it exists/existed it would be classified, and that includes your request of whether it exists."

I read it this way: "we are asserting our 5th amendment right to neither confirm or deny we violated your 4th and 5th amendment rights so you can't sue us and have some uppity judge make us follow the law."

It's sometimes worth doing something you know will fail, just to find out exactly how it will fail.

They could have just offered the least untruthful answer instead.

This what's known as a Glomar response: http://en.wikipedia.org/wiki/Glomar_response

That developed in law thanks to the press uncovering a secret, massive sunken-sub-raising boat built by Howard Hughes for the CIA to retrieve a lost Soviet sub (yes, the very thing that The Hunt for Red October was based on).

> Lower court precedent has thus far ruled the Glomar response to have potential merit, if the secretive nature of the material truly requires it, and only if the agency provides "as much information as possible" to justify its claim. Otherwise, the principles established in FOIA may trump claims to secrecy.

Is it required if they have no data collected and the subject isn't under investigation?

Is what required?

We can't tell you if we are monitoring you. Or what capabilities for monitoring we have. Despite you being a US citizen which we would have no reason to monitor.

Scary stuff folks.

You can't expect the secret police to divulge their secrets.

Ooh gestapit..

Just like you can't expect a scorpion not to sting? So far, the main argument for the continued existence of secret police A is the existence of antagonistic secret police B. Even the "bad guys".

Sounds like a great opportunity for an AI of the future: "find any group of people working together against everyone else, start subtracting members from the group until coherence reaches 0". That would deal with the spooks and the ones that create work for them in one swoop. Ahhh, I can dream, can't I.

If they are trying to avoid divulging capabilities to foreign agencies, what does your citizenship have to do with anything? "I know it's Top Secret, but I'm a citizen! It's ok, you can tell me"

Last week: We'd be happy to respond to requests submitted via the handy dandy online form - these paper copies are invalid.

Today: We're sorry, if we told you of the existence or non-existence of data about you it would help terrorists.

"I know," says spook1 to spook2, "We'll put up a web page where the rubes can enter their address, and have it automatically send them a FOIA_GLOMAR_GO_JUMP_IN_A_LAKE_HA_HA.pdf"

They responded. They just denied the request.

I cannot confirm or deny the existence or non-existence of a sense of humour, irony or shame on the part of the poor functionary who had to send out that response.

One of my favorite lines from Men In Black: "We at the FBI do not have a sense of humor that we are aware of."

I received pretty much the exact same response in the mail yesterday.

http://i.imgur.com/CFgQ0eM.jpg

http://i.imgur.com/yVEvptE.jpg

http://i.imgur.com/inUUStL.jpg

http://i.imgur.com/qVGtdTj.jpg

Absolute crap. Denied by an executive order, which is not legislated law and definitely does NOT supersede the law that put the FOIA process into place. This is garbage.

tl;dr:

Dear FOIA requestor,

You get nothing, by law. It's for your own protection.

Sincerely,

NSA

Jarrett, can you post higher res images or an OCRed version? Those images are so small the text is about 4pt on my screen.

Sure thing, gimme a sec

https://www.dropbox.com/sh/b8d4bb9pfgryj3t/mGBrXRzkkY

Lmk if this helps

I'm surprised they actually replied to you. A reply is admitting they exist, which they can not confirm nor deny.

A reply does no such thing. They can say that your request is denied without even looking to see if the information exists first.

They're not saying, "It's there, we're just not going to admit it." They're saying "We're not even going to begin looking for it."

I think gp was saying: to reply to your letter is to confirm the existence of the body, the NSA itself, who received and replied to your request.

Now we know they exist!!!

We always knew NSA existed. Some of the other guys, however...

I suppose at least this means they have yet to pull "the greatest trick the Devil ever pulled" ("convincing the world he doesn't exist")

When did the NSA start using Georgia? I always thought Times New Roman was more "official".

Just recently: https://news.ycombinator.com/item?id=5844063

Awesome. A comment on typography. :)

Well, it's not like there's any content in this letter to look at :p

NSA probably just wants to look more approachable /s

I hope that someone fights this. :) Just because the NSA determines that something is exempt from FOIA doesn't mean that their determination is lawful. I belive a court will rule that since it is entirely public that they've collected the information, as well as how they've collected it, and there have been government officials who have admitted to the program, their claim of exemption is improper.

Hmm what would happen if the entire (US) Hacker News readership sent in an FOIA request at the same time. Maybe we can destroy their photocopiers?

"Each agency may promulgate regulations, pursuant to notice and receipt of public comment, providing for the aggregation of certain requests by the same requestor, or by a group of requestors acting in concert, if the agency reasonably believes that such requests actually constitute a single request, which would otherwise satisfy the unusual circumstances specified in this subparagraph, and the requests involve clearly related matters."

They would just publish one response and send us all a link to it.

Taxes on American HN readers would increase accordingly to cover costs of buying & operating new copiers.

Debt, rather. Expenses and taxes are divorced: it’s the deficit!

Be careful! This might look in someone's eyes as subversive action.

The logic makes sense if you assume that the NSA is only using the data to target terrorists. In that scenario, the danger isn't that they will reveal to innocent civilians that they have your data. The danger is the precedent. Want to know if you are on their target list? File a FOIA. If they grant it, you're okay. If they deny it, you're in their sights.

But since we already know that they are collecting this metadata on absolutely everyone, I don't see what good it does to refuse to send it to you, whether you are a suspected terrorist or not. ...I suppose you could be fretting about whether you had slipped up and called Cousin Guido on your regular cell instead of a throw-away prepaid phone.

Ps, I've heard that apple will replace your iPhone for those purple specs in the pictures.

Oh sick! Thanks!

Yeah, my camera has gone to shit. I'll take it in next time I'm near a store

You missed a spot in p1 with the case number.

Oops, thanks

Surprisingly well-written response actually. Not too hard to figure out what they're talking about.

Were we to provide positive or negative responses to requests such as yours, our adversaries' compilation of the information provided would reasonably be expected to cause exceptionally grave damage to the national security.

simple as that: we can't tell you what you want to know, because we think you are a terrorist.

Reply on news.ycombinator.com