Hacker News Reader

Comment by torbj0rn | Hacker News Reader

The paragraph you cite is worded ambiguously, the Guardian is NOT reporting that the intel the NSA is sharing with Israel is about officials in the US government.

Here is the first half of the following paragraph:

>It is not clear whether any communications involving members of US Congress or the federal courts have been included in the raw data provided by the NSA, nor is it clear how or why the NSA would be in possession of such communications.

Beware the sensationalism in this article. The only fact provided by the Guardian in this article is that NSA shares surveillance data with Israel. It is not known what kind of data is shared.

View on HN

The fact that the agreement calls for Israel to "destroy upon recognition" communications involving USG officials is an acknowledgement that it might happen, which is, itself, an acknowledgement that it will happen.

Any smart information sharing agreement would cover contingencies like this. Not because they know it _will_ happen, but because they know it _might_ happen.

Not making a statement on the information sharing, just pointing out that the existence of a clause within an agreement does not mean the situations that clause covers are going to happen. For example,the iTunes EULA prohibits the software from being used to build weapons of mass destruction < http://www.apple.com/legal/internet-services/itunes/appstore... >

"_might_"

is unacceptable in this case.

If it "_might_" happen, then this particular sharing agreement should be scrapped. When it comes to this sort of thing, we need to operate in an environment of guarantees not one of assurances.

And even if there are safeguards in place to prevent this from happening (and I'm sure there are) with 99.99999repeating% accuracy, you still want something in place to mitigate or control risk if the safeguards fail. Which is no doubt what this clause is supposed to do.

99.99999% is not good enough.

That's not the way OpSec works guy.

I realize my view is strongly informed by the military... but I view this as essentially OpSec for the civilian leadership, and the principles can't be that different. I may be wrong in my interpretation of this as OpSec, but I doubt it.

If you need that clause in an agreement, FOR ANY REASON... then you need to re-evaluate the agreement. Full stop.

Senator X accidentally sends an email Y from an alternate email address that the US doesn't have directly linked to them (maybe they just created it). This email gets filtered with no reason to assume it's from senator X.

Cooperating government Z gets email Y, and discovers it's from senator X because they look more closely and connect dots the US may not have. No process could have prevented this (except stopping the sharing entirely). It's a reasonable clause.

"... (except stopping the sharing entirely)..."

So the only secure path seems clear.

To me at least.

Again, maybe this information is not as critical as information you might be exchanging in the military. I don't know. But, to me, it seems a good example of information you don't want foreign powers being privvy to.

Wrong; there's one easy process that would prevent this: manual vetting of all shared information (or at least, all info that can't be automatically vetted with absolute confidence, or would not be that critical).

Of course that wouldn't scale to a system that shares a big firehose of data or does that in real-time. Easy to solve too: don't share the firehose, and don't share in real-time. Collaboration with allies is fine but that should come as a distant second to protecting your own [citizen's] interests.

> Collaboration with allies is fine but that should come as a distant second to protecting your own [citizen's] interests.

What makes you think the NSA is sharing data with Israel for any other reason? We have strategic and human interests where they are located.

Except for this: "and connect dots the US may not have."

A manual process could certainly do a better job, but no, it still isn't a guaranteed thing.

I will admit I'm not well versed in how OpSec works. Are there no OpSec policies for what happens if something accidentally leaks? Are there no policies for what happens if a Top Secret file makes it to someone with the wrong clearance?

My gut would tell me that you want as perfect OpSec as you can manage, but then have contingencies for the occasion when something fails. Otherwise you would get the kind of flailing we're seeing right now after the Snowden leaks.

Two points:

1) When classified information is accidentally moved to a computer with a lower classification it is a shit storm. Everything stops. All hardware involved is isolated and scrubbed. If it can't be scrubbed with certainty (e.g. deallocated sectors on the hard disk that might contain classified data but can't be scrubbed anymore because they are deallocated) then the equipment is destroyed (or classified to match the level of the information that was leaked).

2) All information on a classified system is considered classified at the level of the computer system it is stored on. When there is a need to move not-really-classified information off that system (like send a log file that a vendor needs to help debug software) then it is manually inspected by a SME (subject matter expert) to positively verify it does not contain classified information and then copied off to unclassified media. But if there is any doubt, like a binary core file, the file is forbidden from leaving the system.

The main point here is that the SME positively identifies all the data as being unclassified. The assumption is that the data is classified and it must be pain-stakingly verified on a line-by-line basis. It is a real PITA.

Considering that these NSA programs are highly classified, at least TS and I'm thinking TS sci/codeword given the style of single-word names for the programs, the same sort of manual, positive identification process should be used when giving the data to another country.

Also, Israel is considered a major intelligence adversary by the US DoD. Israel and China are at the top of the list of countries they warn people with clearances to be careful of. Blithely handing over this raw SIGINT data is ridiculous given that context.

There are no guarantees. Ever. It's better to acknowledge that the best intentioned (which this is, admittedly, not) processes can screw up and plan for these screw ups.

It's why we have cops and a legal system instead of locking everyone in padded rooms.

But, in this instance, there IS a path to a guarantee.

If we don't share the information with them... then we guarantee they won't be given that information by us.

You need police and a legal system because, as a general rule, citizens have rights. Israel... has no inherent right to the data in question. Therefore, if we cannot share information with them without leaking the operational particulars of the civilian leadership... then we are free to not share data with them at all. And there you have your guarantee.

As another example, the Navy is full of procedures on how to cover the situation where a procedure wasn't followed properly.

You can order a command to ensure that evals are submitted on time as much as you like but in a Navy of 320,000+ active duty sailors eventually some command somewhere will screw it up, so the Navy has procedures for that case too.

The amount of apologism in comments like yours is stunning.

What do you mean, "there are no guarantees, ever"? The NSA employs some of the brightest minds in America, and has billions of dollars of funding and (we are just finding out) the influence and authority to do virtually anything.

There fucking MUST be guarantees. If guarantees are not possible, then information MUST NOT BE SHARED.

You're putting words in my mouth.

If you design a system based on guarantees, it's going to be brittle. It will fail, and it will be very unpleasant. If you design a system to handle contingencies, like elected official's data getting through, it's going to be more resilient. If you design a system that will handle contingencies and then spending as much money as you can on preventing those contingencies from needing to be used -- well, you're finally developing something useful.

Hell, the best guarantee a cryptographer can give you is a one-time pad, and they'll tell you that the human factors involved will be just as bad (and probably worse) than algorithms with weaknesses.

But, back to putting words in my mouth: this stuff shouldn't be shared because spying on American citizens is unconstitutional and giving the data to allied nations is backstabbing us in the name of national security -- not because it's impossible to build a perfect system to protect elected officials.

When the NSA is the group disseminating the information, it very much IS possible to guarantee that certain types of information are not shared. The most obvious solution being: don't share ANYTHING.

This is an argument of secrecy versus convenience, which you'd think for your National Security Agency, would be a pretty simple equation.

A more cynical view of this is that they've made an intentionally leaky ship to do a ring around domestic spying laws using a 'trusted' partner, but given the recent publicity, I'm not sure they care enough to have even that slim cover of legality.

> might is unacceptable in this case.

True. Manning is in jail for a very long time based on what might happen. Clearly, the USG feels might is unacceptable in the case of release of official sources to foreign agents.

> The only fact provided by the Guardian in this article is that NSA shares surveillance data with Israel.

Unfiltered data. The other fact shared is that Israelis are on the honor system with the data. As with any other spies, Israeli intel isn't known for its adherence to law or agreements.

I think it's safe to assume that Israelis have high access to the same intel the NSA has on American officials.

I think that what they actually have is probably access to the same systems (i.e. PRISM, Xkeyscore, etc.) as the NSA, with the same level of access.

You're probably wrong. The NSA analysts' database interface apps are probably only accesible inside NSA secure networks. They are designed for American espionage and have American legal limitations built-in.

After all this, you believe that? Sorry to say, that your level of naïveté is remarkable.

I'm saying that the NSA sends Israel the raw data, as this document says. Israel than probably processes the data using their own systems. There's no reason and no evidence for Israel to use American spy's database applications.

Snowden was able to access all the systems from his outsourced office in Hawaii. The NSA and the Israeli government colluded on creating Stuxnet and Duqu.

If you think that israel doesnt have access to NSA systems because they are on a "secure" network, then you're not really paying attention.

> you're not really paying attention.

Keepin' it classy.

Snowden was able to access all the systems from his outsourced office in Hawaii.

You aren't the first person I've seen make this erroneous assertion. Snowden worked at an NSA site, the Hawaii Regional Operations Security Center at Naval and Telecommunications Area Master Station Pacific. http://www.navy.mil/submit/display.asp?story_id=31660

Furthermore, Snowden was only "outsourced" in the sense that the division of Booz Allen that employed him is essentially an employment agency for the DoD. They aren't significantly different from the bodyshops that proliferate in the tech industry. Other parts of Booz Allen (which are now practically an entirely separate company) do operate like mini spy agencies of their own, but that is not who Snowden worked for or reported to.

You are correct - and I was too liberal in my meaning.

Also, while it is partly hyperbolic to think that Israel has direct access to NSA systems, they have 1) far less scruples than even our NSA (they send assassins into hotels to take out enemies in foreign countries in broad daylight) 2) they've been directly building cyber weapons WITH the NSA 3) they are being directly handed raw intelligence BY the NSA.

For me - the most worrysome piece is that if you look at this revelation - whereby Israel is "politely asked" to respect the privacy of USG officials, who is to say they cannot use the information within this raw data to blackmail/usurp non USG assets in lobbying, defense, civilian-intelligence-contracting positions.

We basically have zero privacy, we also have zero security, as a nation, due t the actions of the NSA.

We are now in a position where it is literally every Human being against the intelligence community.

Raw intelligence, gathered by the NSA, in bulk, is being sent to a foreign state. Where is the sensationalism? That is about as clear cut as you can get. If you own a company, in the US or otherwise, and you have competitors in Israel you should be concerned.

Sometimes the level of convoluted arguments and rhetorical gymnastics people go to justify anything Israel related is remarkable.

If this was Chile or Brunei you bet there would be 0 apologists here justifying it. "You know I don't condone it wholeheartedly but ... blah blah sensationalized, let's all keep our cool ..." etc etc.

The article is pretty specific that the data shared is raw and unfiltered, that by itself is troublesome. Of course you and I will never know exactly what kind of data or whose data is being shared, but it is very troubling that apparently the NSA CAN'T GUARANTEE that the data shared doesn't include that of American citizens (including US officials), and asks the Israeli intelligence services to respect privacy rights without anyway of enforcing that they do.

Remember, Israel is a foreign country not bound by the US Constitution.

The very existence of this data would imply the U.S. government isn't really bound by the constitution anymore, either.

Exactly. We are sort of beyond that point. And one kind of wonders. Alright, we know how bad it really is. And then another blow comes.

What is remarkable is that quite often these revelations come after government officials have revved up their PR machine and have lied about some fact. Before they would tell lies and it was all "Yeah this is rumors, unfounded, disgruntled employee, traitor, communist homosexual etc etc wanted revenge". Now they spew a lie and bam! a new proof of contradiction follows it from Snowden's documents.

This must be very infuriating for them. World top intelligence apparatus got its pants pulled down in front of the whole world to laugh at.

I wouldn't be surprised if someone out there in Langely, VA is not planning a fatal accident involving Snowden by now. Piano falls on him from 5th floor, hmm, or something ridiculous like that. Something that might "teach" others a lesson perhaps too.

I used to think this government wasn't operating like that (obviously through my own naivete) but these days I just don't know.

This is a bit of a naive statement in light of the other information we have about the scope of collection of raw "SIGINT," as well as the errors that have been admitted to the FISC in targeted collection. And you're also selectively quoting that paragraph, too.

> In 2009, however, the New York Times reported on "the agency's attempt to wiretap a member of Congress, without court approval, on an overseas trip".

Read the primary source if you prefer...

http://www.theguardian.com/world/interactive/2013/sep/11/nsa...

These are the same guys that "accidentally" wiretapped the entire 202 area code (Washington, DC) in an election year.

Please point to what is sensationalized and what other sources better than your own hunch and agenda you have that what is presented is not true. Raw leaked Israeli, NSA, or CIA documents are best if possible.

Reply on news.ycombinator.com