Hacker News Reader

Comment by jonknee | Hacker News Reader

Interesting to get a look at what it's like to be inside the bubble. It's compartmentalized enough that the individual actors can justify their actions by the assumed competence and benevolence of the others.

> I didn't test it, but I'm sure there was automated analysis that prevented or flagged use of US selectors.

The mental leap here is subtle, but substantial. Since I have been told I can't use US selectors , I assume the system enforces this. As such, US citizens have nothing to worry about. However, in the immediately previous paragraph, he noted:

> one employee spied on a spouse

So much for automated analysis, besides not being able to filter out US citizens' data it can't even filter out an employee's direct family. But there's no need to worry citizen, the NSA has a very high-quality workforce.

In the NY Times this morning was a piece noting that the government has concluded they don't know what files Snowden took with him (http://www.nytimes.com/2013/12/15/us/officials-say-us-may-ne...). The most technologically advanced intelligence agency in the history of the world and they have no idea what files were electronically taken by one of their own. One of their own who passed the background check by the way--I don't know why the OP is so enamored with the polygraph.

View on HN

What's particularly interesting is that some of the recent disclosures don't seem to be visible inside the bubble. Take this assertion, for instance:

"The NSA copy of my emails won't be viewed by police or FBI investigating me about marijuana use, for instance. Law enforcement might get a search warrant and retrieve a copy from Google, but not from the NSA."

In fact, it's been known for months that the DEA receives intercepts from the NSA in such volume that they have an office devoted to handling them (the DEA's "Special Operations Division"). And as for search warrants, the manuals for that office describe a practice of "parallel construction" which involves, not to put to fine a point on it, lying about the ultimate source of the information they're using, with the clear intent of evading judicial scrutiny.

Details here: http://www.reuters.com/article/2013/08/07/us-dea-irs-idUSBRE...

It really depends on how widely it is reported. Government employees even those with clearance are prohibited from looking at the wikileaks cables. If it makes it into the NYT and they see it, then it is ok. But they can't actively dig for it. Direct from the mouths of government employees.

Again, an assumption that a magical unicorn guards the morality of being told what someone can or cannot do should be understood as a non-trustworthy system. Especially one that is referred to as the NSA in very general terms - as they have no control over employees or data dissemination / exfiltration. And, yes, the last statement is fact based on all of the supporting evidence in the public domain. If one thinks otherwise I politely redirect you back to aforementioned magical unicorns.

Outside of magical unicorns, what kind of unicorn should guard things? I'm afraid automated systems don't offer either the coverage or the flexibility to provide what you think should be provided.

Yes, but why can Loren Sands-Ramshaw use a blog, where he critics his employer and also use Kickstarter without getting fired? Not that I want him to get fired, but I worry that he risks his job in telling us this critical information!

Aren't those things, a spy shouldn't have? Is the working strategy, filling the web with disinformation about NSA employees, or is it to never use the web with a real identity for the period of contractual employment?

I mean, from a technological standpoint, every single HN member would love to work for the NSA. Because they have an extremely sophisticated set of technology that people would like to get their hands on. (Well, that's at least what we think they have). Keep in mind though, that in reality only a very small percentage of HN would actually like to work for the NSA! This is not because of the recent revelations, but because the government in general has not a positive image for most hackers.

He's no longer employed by the NSA. He left to play with a startup and some personal coding projects; the last paragraph of his post links to them. Any discussion of his employment there still gets reviewed by the NSA, but that's routine for anyone who does classified work. (And he does say up front that he sought that review, and that they had no problem with him posting what the rest of us read.)

Thank you :)

Then it's even more important that we read this blog post in the knowledge that it's the one that made it past NSA screening. We'll never know how many didn't.

What's the legal term? I think it's "double construction"? Where the prosecution knows it's you from illegal means (wiretap/NSA spying) but by that knowledge can go back and construct the legal case in reverse.

It's been rumored that Dread Pirate Of SilkRoad case was figured out that way.

It is parallel construction

http://news.ycombinator.com/item?id=6911150

The story around DPR getting caught started in him making posts that had personally identifiable information from his anonymous accounts in the very beginning, not from illegal searches.

That's just a really long scraping / pattern-matching exercise of publicly available data, and the reminder that even particularly clever people won't be on point 100% of the time.

Or they did find him illegally and found later on the public pattern-matching exercise to justify their findings. Which is exactly the point of parallel construction.

We cannot know.

> What's the legal term? I think it's "double construction"? Where the prosecution knows it's you from illegal means (wiretap/NSA spying) but by that knowledge can go back and construct the legal case in reverse.

I think the technical term is either "perjury" or "fraud on the court".

The euphemism, though, is "parallel construction".

It is not necessarily illegal means, but simply means that the government do not want to expose in open court. Perhaps this is because they are illegal, or perhaps revealing the source of intelligence could compromise an active intelligence operation. The NSA does not want its methods exposed in open court. You will probably say that this is because they are illegal. But an equally plausible explanation is that revealing details of their capabilities is of benefit to their adversaries.

This is an interesting article, thanks for sharing. Your summary does not quite reflect the article though. You say "In fact, it's been known for months that the DEA receives intercepts from the NSA in such volume that they have an office devoted to handling them (the DEA's "Special Operations Division")", which to me created the impression that the NSA was funneling large amounts of information about US citizens to the DEA.

However, the article actually says: "...two dozen arms of the government working with the Special Operations Division, including the Federal Bureau of Investigation, the National Security Agency and the Central Intelligence Agency.", and later that "the Special Operations Division of the DEA funnels information from overseas NSA intercepts, domestic wiretaps, informants and a large DEA database of telephone records to authorities nationwide to help them launch criminal investigations of Americans. The DEA phone database is distinct from a NSA database disclosed by former NSA contractor Edward Snowden." [emphasis mine]

It's quite possible that the NSA passed only occasional information about non-US citizens - it's impossible to tell from that article - if that's the case, then to many people they're acting within their mandate.

I'm not trying to defend the NSA, and I'm deeply troubled by the implications of mass surveillance. But it's important I think to be clear about the claims we're making since otherwise it's easy for people to dismiss us.

Thanks for the close reading. I guess it depends what you think "no domestic intercepts" excludes, and how much you believe that everyone in the NSA follows the rules. Even if most of them do, a few have the tools to become a very big problem --- and the rest of the organization wouldn't necessarily know, since in an organization like the NSA, people aren't supposed to know what's happening in the office down the hall.

To start with the scope of what's available: it almost certainly includes data on US persons "incidentally" acquired in taps on an authorized target. I'm not aware of anything on DEA procedures there specifically, but as for the general rules, see here: http://www.emptywheel.net/2013/11/08/the-intelligence-commun...

Of course, even if NSA analysts know that they have DEA "customers" (as they apparently call the recipients of their intelligence), it might be a breach of the rules to select overseas targets which would be likely to have domestic contacts of interest to the DEA. But given that knowingly breaking the rules in pursuit of an authorized goal seems to count in NSA audits as mere "lack of due diligence", and not classed as "abuse", I'm not sure how much comfort to take from that.

Analysis of NSA audit data from Marcy Wheeler here: http://www.emptywheel.net/2013/08/16/lack-of-due-diligence-t...

... with further notes on the audit process, and narrow definitions of "abuse" here: http://www.emptywheel.net/2013/08/20/if-nsa-commits-database...

Yes, this stood out at me too. As soon as I read that statement, I knew the author was either lying or underinformed. Thanks for providing the article.

> It's compartmentalized enough that the individual actors can justify their actions by the assumed competence and benevolence of the others.

I've talked to this before but this denial and self delusion is an important defense mechanism. Sometimes people write blogs and get into apologetic because they feel an internal dull pain of an inconsistency. "Hmm it looks we NSA did all these pretty bad things. I worked for them NSA. Surely I couldn't have worked for the bad guys." and then <proceed rationalizing and defending NSA, might as well put it in blog form>.

That cognitive dissonance, I believe, is pretty powerful. A lot of dark secrets and past transgressions can be filtered so well throw it.

I'd rather intel analysts have some cognitive dissonance than have absolute certainty they are always justified in their actions.

Unlike a lot of HN commentators who blindly follow the herd (i expect to get a ton a dv's for that)

Seriously, you can't win. Here you have an actual former NSA employee giving a first-hand account of his time there -- and not only his account doubted for no reason other than failure-to-comply with known-biases and unverifiable journalism, but some guy is now providing psychological analysis of him as well!

Some know-nothing armchair psychologist who read the NYT is telling this guy -- who has made an honest effort to be utterly transparent -- that he's cognitively dissonant and that comment is going to receive a hundred votes because it makes people feel good about the things they think they know. It's not truth, just an exercise in mass delusion.

The most extraordinary thing about Snowden is not that he took the documents: it is that he sacrificed his whole life to make them public.

And this should make us scared. A guy like Snowden was extremely improbable, and yet he happened. So, what to think about the far more likely case of NSA employees taking extremely sensitive information and selling it privately? How many of those have there been already?

1000 times this. If Snowden could do what he did and the NSA doesn't even know what he took, it is inevitable that a hostile foreign government will infiltrate the NSA. It is also highly probable that there are people in the intelligence apparatus that are abusing their power in some way or another.

There have already been about a dozen cases in the NSA of 'LOVEINT' where employees were spying illicitly on love interests. From what I recall, all of those people volunteered that they were spying illegally on their own, none of them were caught by any internal review process.

It all seems so sincere. Except when you see how closely this matches the talking points the NSA sent home with employees (https://s3.amazonaws.com/s3.documentcloud.org/documents/8445...)

Whoa. The above PDF link is very much worth clicking.

Almost all of those points (except maybe the very last one) are echoed by the OP.

Except that this hand-out is straight-out propaganda and the OP sort of tried to veil that.

Well, following his explanations, you can fail the polygraph and just do it again. The cost of failure is zero, so really just keep trying.

(I personally loved the bizarre mix between cyber war, nukes and North Korea. He seems to have the mindset of a paranoid Stalin, always wary of others when he's the one terrorizing.)

Definitely a bizarre mix, I thought it was a parody a couple of times. To combat the threat of nuclear war with the completely isolated totalitarian state of North Korea we must create and store copies of all global communication... (Of which approximately none will have originated in NK, our intelligence agencies still literally watch NK news broadcasts to find out what's going on in NK.)

North Korea surely has contacts with the rest of world, to deal with China, for instance.

Yes, but you don't copy all communications to try and find the astonishingly small number from the most closed-off country in the world. This is how the NSA gets smart people to build something they would never set out to build--an all powerful global snapshot of data.

They tell you about North Korea and your radioactive future. You like big problems and give it your best effort, perhaps thinking that you had a small part in saving the world. Then one day you read in the New York Times that your well intended project doesn't just scoop up communications from North Korean thugs, but what you helped make is collecting communications on everyone. It's helping the DEA illegally bust people. It's helping diplomats illegally snoop on our allies. It's helping keep US companies aware of what non-US companies are doing. Etc etc.

tl;dr Anyone could be a terrorist, everyone must be monitored.

I absolutely don't dispute that. I am merely pointing out that there is a small number of messages to intercept. The traffic with the AQ Khan network would be a good example. That said, no, it does not justify turning the world into a surveillance state.

> Yes, but you don't copy all communications to try and find the astonishingly small number from the most closed-off country in the world.

What would your collection proposal be then?

You can't determine data of interest until you have sufficient data to determine if it's of interest in the first place. Even the NSA doesn't have an Oracle computer that can look into the future and figure out what vanishingly small percentage of communications are just the ones they should be interested in. If they did, they could also solve the halting problem and rewrite the history of computer science and time-travel.

Remember, the standard the NSA is held up to is that it should not only be following known bad people who are/might be doing bad things, but to ferret out the unknown bad people. Every time there's a Boston or similar, everybody goes and climbs all over the NSA for "not knowing about these guys"

You can't do that until you have a sufficiently large enough collection of unevaluated data to start looking through.

I'm not saying it's right or wrong, only that it's the reality of the task spy agencies have before them.

TLDR Everyone IS a potential terrorist and ARE monitored.

At a certain point they're likely to cut you off and stop wasting their time watching you fail the poly.

> Well, following his explanations, you can fail the polygraph and just do it again.

He didn't say you had an arbitrary number of opportunities to pass, simply that the screening (of which polygraph was one of many he mentioned) is such that it's not as if NSA analysts are able to simply wander their way into the NSA so that they can then spy on the people.

That doesn't mean people can't make it through all the screenings (just ask Snowden), simply that it's one of many safeguards that are put in place to make it so difficult to land an NSA job for nefarious reasons that the many other layers of oversight and controls should be adequate to prevent gross abuses.

"Are we the bad guys?" http://www.youtube.com/watch?v=OpZ8EkK3eWY <---- that's inside the bubble

> The mental leap here is subtle, but substantial. Since I have been told I can't use US selectors , I assume the system enforces this. As such, US citizens have nothing to worry about.

I think it's fair to say most rank and file NSA employees are honest and actually do believe in their mission. The far scarier thought is how things may work at an extremely senior level (contractors included), where there's literally nobody there to watch the watchers, or at least challenge them without being fired and blackballed.

That said, "US selectors" shouldn't return the results that they do in the first place. Obviously there's incidental collection, which is unavoidable. But the notion of incidental collection, as with metadata collection, was hijacked and used in public relations messaging as a cover for actual domestic collection programs that intentionally capture the full contents of nearly all domestic communications within the United States.

http://www.pbs.org/newshour/bb/government_programs/july-dec1...

Despite exceptions such as the article above, this messaging has largely been successful. Even The Guardian and The Washington Post---organizations who publish stories directly sourced from documents leaked by Snowden---routinely fail to underscore the critical difference between actual collection, and "collection" in the sense of mere authorized access to data that's already intercepted and stored. The two have been intentionally conflated as part of a semantics game, and it's working beautifully to mislead the American public about what's actually happening.

> That said, "US selectors" shouldn't return the results that they do in the first place.

Determining if a "selector" is tied to a U.S. person is actually a very subtle and very hard problem.

Let's take a phone number +1 (212) 555-1234

Is this a US selector? It's a selector for a phone in the US, but that's not the same thing as a phone number tied to a US citizen. Let's say I'm following a senior North African pirate with a Maltese mobile +356 2010-1234 and he calls/is called by my number above?

- Should I follow it? Or is it absolutely off limits for me because it happens to be a U.S. number?

- How do I determine if it's tied to a U.S. person?

- What if it's a shared number between a group of associates, all of whom are not U.S. persons except for one?

- Is that number off limits now?

- If it is a U.S. person what should I do with it?

- Pretend it doesn't exist? Turn it over to U.S. Federal law enforcement? Who should I turn it over to? DEA? FBI? ATF? DHS? The Coast Guard? U.S. Customs and Border Patrol?

It's actually a significant intelligence task to figure this out.

I agree completely.

However, my statement was not intended to be read in isolation, but in context of "domestic collection programs that intentionally capture the full contents of nearly all domestic communications within the United States." I was referring to the bulk interception and subsequent long-term retention of data on US persons.

The implication of my statement was: assuming this type of collection didn't exist, selectors related to potential US persons (for whatever reason) would simply return intercept data beginning from the time said selector was invoked.

Contrast that to the present, where selectors are capable of retroactively returning the sum total of a US person's digital (and by some extension physical) life for the past 5+ years.

It's commendable that the procedures for accessing the data of potential US persons are so stringent, but at the end of the day there is still an incredibly intimate and detailed picture of almost every single US citizen's private life being retained on a long-term basis.

> The mental leap here is subtle, but substantial. Since I have been told I can't use US selectors , I assume the system enforces this. As such, US citizens have nothing to worry about.

For the life of me I cannot figure out why people refuse to accept the concept of training and policy as being relevant to proper civil liberties safeguards in addition to technical ones.

Imagine applying that idea to any other field, and keep in mind the unintended consequences.

For instance consider from a soldier's perspective "Since I've been told I can't shoot citizens or non-combatants, I assume the system enforces this. As such, US citizens and non-combatants have nothing to worry about." And yet our troops do have issued firearms (at least during things like field exercises and training), and the republic has not fallen to a coup. There are missile siloes dotted throughout the Midwest, yet no rogue junior officers or missileers have launched ICBMs at people.

You're missing his greater point, which seems to be that it didn't even occur to him to "test the interlock" since he knew that by law and by policy, it was wrong to even try. He also made quite clear (if you'd bother to read to the end instead of cherry-picking quotes to declaim) that this doesn't mean such technical controls can't or shouldn't be strengthed, merely that there is indeed a "culture of compliance" among the analysts instead of a bunch of voyeurs.

> > one employee spied on a spouse

> So much for automated analysis, besides not being able to filter out US citizens' data it can't even filter out an employee's direct family. But there's no need to worry citizen, the NSA has a very high-quality workforce.

Is it really your claim that a workforce must be 100% perfect in every way for an organization to be legitimate? Even the anarchists don't try to claim that there won't eventually be murderers amongst them, nor is there anywhere else in the real world where spouses are always exceptionally nice to each other in everything they do. Just ask Ashley Madison.

> The most technologically advanced intelligence agency in the history of the world and they have no idea what files were electronically taken by one of their own.

They also haven't solved the Halting Problem.

But anyways I know I'm going to be speaking to an uncooperative crowd but perhaps you all should consider the high-level points of his "peek inside" and then discuss the ramifications of that, instead of always drilling down into the weeds. Many of the same arguments used here could be used with equal logic toward every large civilian IT concern, which would tend to devastate the need for things like YC capital. :P

> Imagine applying that idea to any other field, and keep in mind the unintended consequences

The difference from other fields, is that the consequences in other fields are public. If a soldier shoots someone, that someone is dead and can prompt an investigation.

If someone in the NSA abuses his powers, it is very likely that nobody will ever know. Or be able to know. No investigation will be triggered, and even if one is, it cannot possibly gather any evidence.

> If someone in the NSA abuses his powers, it is very likely that nobody will ever know.

But this claim is only a concern if an analyst can unilaterally abuse his power and never be caught. Are you saying this type of surveillance capability would then be acceptable if proper accountability and oversight safeguards can be emplaced?

If anything this should be one of the easier things in the world to do, putting audit trails on computerized systems is hardly "pro league" stuff.

But either way, you say that the consequences will at least be public in other scenarios. But that's not really true either. People get shot every day in this country; how do you know that any given shooting wasn't from a soldier? How do you know when the government lets a contract that they actually fully complied with the Federal Acquisition Regulations? How do you know that when a Congressman votes against his normal voting habits, whether that vote was due to his conscience or due to someone else's wallet? How do you know that when the NSF gives one scientist a grant and refuses another, that it was done in the public interest?

You don't know any of this, as a rule, and yet many of those are much more impactful on the average citizen, even if we assume the existence of lapses in oversight.

As far as I can tell with government IT, your data will always be at more risk of being leaked to cybercriminals via hacking or stupidity (the latter has happened to me already!), than be at risk of being looked at by a rogue NSA agent.

I thought the track record of the US Government on the matter was pretty clear:

1) Write down the law

2) Break it

3) Retroactively make the violation legal

Wrt to what oversight exists, well... the fact that they have no idea what material Snowden took with him is telling. But that's not what I'd be the most worried about. How hard would it be for the White House to ask information about a specific individual for "national security" reasons?

> But either way, you say that the consequences will at least be public in other scenarios. But that's not really true either. People get shot every day in this country; how do you know that any given shooting wasn't from a soldier?

I'm not a US citizen, but I would think murders are investigated by the police. It's usually difficult to hide.

> How do you know when the government lets a contract that they actually fully complied with the Federal Acquisition Regulations?

I suppose there are audits? Not to suggest that abuse does not exist, but I assume there is some oversight.

> How do you know that when a Congressman votes against his normal voting habits, whether that vote was due to his conscience or due to someone else's wallet?

You certainly don't, but you can make an educated guess.

I'm not sure what you're trying to say here. That the NSA doesn't need any form of oversight, and can be 100% trusted with the power to snoop on everybody belonging to any country (knowing - in case you thought "I don't care about these dirty foreigners as long as they promise not to look at US data" - that nothing prevents them from asking another Five Eyes member about your whereabouts without breaking the rules)? From the same government which gave you Guantanamo, extraordinary rendition, warrantless wiretapping and extrajudicial executions-by-drone? Their definition of legality is terribly elastic.

> I'm not sure what you're trying to say here. That the NSA doesn't need any form of oversight, and can be 100% trusted with the power to snoop on everybody belonging to any country

That's not at all what I'm trying to say. In fact I would argue very strong oversight is needed, but I'd also argue that very strong oversight is possible in the first place, which means that oversight (or not) is not the proper reason to argue about the very existence of the program in the first place.

In other words, the program(s) are either required or not. If they are required, determine the needed level of oversight and install it. If it's not required, then it's not required and discussions about oversight are simply redundant.

>If someone in the NSA abuses his powers, it is very likely that nobody will ever know.

You mean, besides his family, friends, and loved ones when he loses his job and potentially ends up in prison. You're underestimating the amount of training and internal oversight that occurs.

... because this has happened how many times?

Folks have lost clearances and jobs. I don't know about prison time. But I do know the fear of these things happening is a motivating factor not to cross the line. But I'm just some guy...

The problem here is that you trust the organization to police itself, whereas it has little incentive to actually do so effectively.

The cases of caught individuals seem to have gone under-punished, as they sound worthy of prison time.

Also, even if the NSA polices against personal abuses, why would it police against systematic abuse for government's purposes against the constitution?

Self-policing does not work well, especially without elaborate mechanisms to enable it to work, and especially with a combination of secrecy and lack of oversight.

I'm not saying I trust it to police itself. I'm trying to suggest that the environment in which NSA analysts work does have a (positive) material effect on their behavior. Non-systemic transgressions are not common. When Snowden said he was able to check Obama's email, that angle was lost.

Now, systemic problems are a different issue. But the article we're all talking about here is written by an analyst from his own perspective.

So, you're claiming this, despite 0 people having ever been sent to prison due to this?

Reply on news.ycombinator.com