Hacker News Reader

Comment by MisterWebz | Hacker News Reader

It's obvious he's not really taking this seriously. These are empty promises with only one goal, and that's restoring the public's trust without hampering the NSA's abilities too much (if at all).

EDIT: After having very quickly skimmed the PPD, here's something interesting:

The collection of foreign private commercial information or trade secrets is authorized only to protect the national security of the United States or its partners an d allies. It is not an authorized foreign intelligence or counterintelligence purpose to collect such information to afford a competitive advantage to U.S. companies and U.S. business sectors commercially.

Bascially what they're saying is that, in the name of security, we can do whatever the fuck we want. Good luck trying to stop an agency operating in total secrecy from abusing these powers.

View on HN

Not really. He is addressing the concerns of the majority of people, not the .00001% of America that comprises HN, where the only acceptable speech would be that the NSA is being shut down tomorrow.

Well, that's being a little flippant. I think there's plenty that could be done to improve the situation. Mainly, we need to be able to discuss whether 50,000 contractors should have full search access to all these records that are too secret to discuss with congress.

1) Congressional oversight, even if it's a special committee. NSA can't be completely outside of elected governance. There should be NO level of access that is "too classified" for this committee. If "super access" like that needs to exist in some fashion it should NOT be under the jurisdiction of the NSA. As it stands, that excuse is a loophole that undermines the concept of oversight and the NSA is way too big of an organization to have that power. Just moving "super secret" stuff to a smaller, more concentrated organization would improve things immensely.

2) Clear and open communication over access rights. The structure of which roles have what access should not be considered a secret. If this somehow weakens our security, so be it - that's the price of democracy.

3) Better access control. From what has been leaked, it's clear the NSA is putting a lot of value in security through obscurity. As we all know, this isn't a great approach. At the same time, contractors are given access to actually get stuff done. The terms of access, tracking of usage, etc. need to be discussed in a more open way because right now that's the biggest problem of the NSA.

50,000 contractors may have clearances, but they don't all have access to those records. Remember, the whole point of Snowden going in with sysadmin access, and then stealing credentials and otherwise impersonating 20 other people, is precisely because the stuff Snowden wanted to leak was so compartmentalized.

Your 1) has already happened, AFAIK. Perhaps we need to have different (i.e. more active and intrusive) Congressmen on the subcommittee so that they don't act so shocked when details come out, but that's a different issue.

Another key note is that unlike almost every other subcommittee, these Congressional overseers don't get the ability for political patronage out of what they do. The Chairman of the House Armed Services Committee, for instance, can be greatly influential in drawing massive DoD dollars to their district, but there's not much the Intelligence committees can do in the same vein, aside from random data centers perhaps.

Even then, I know there was a determination by Sen. Feinstein earlier that EO 12333 collection was not in their oversight bailiwick. That wasn't NSA refusing to discuss it, it was the subcommittee deciding it was out of their jurisdiction.

There are many Federal agencies and groups that do monitor EO 12333 (though it is certainly unclear what type of oversight they are providing across the totality of programs).

Beyond all that, I do agree that nothing going on within NSA should be out-of-scope for oversight (including Congressional oversight, if it comes to it). From the nuclear propulsion perspective, we had routine audits of essentially every major program, institutionalized. I don't know how the Congressional subcommittees do their business but it would be a good idea to institute the same there, and also ensure that NSA/IC staff (contractors too) can always feel comfortable coming to a staffer from that Congressional subcommittee with details of abuses.

I'd give the NSA some credit on security through obscurity because you're talking about intelligence programs, not computer code or algorithms. A rule of thumb from crypto research does not necessarily directly apply to anything with the word "communications" in it. ;)

In fact the only real problem I see in 3) is that (assuming you're talking about public discussion) the people who most need to care (the American public) are going to have their eyes glaze over immediately, the people who might actually be able to craft countermeasures would be intensely interested, and it wouldn't even prevent government abuse; how easy is it to craft a good system of access controls for public approval but then add workarounds as needed in practice?

All good points. It's easy to be a backseat driver to all of this, especially with the half-information we get.

how about nothing to access? give these cretins an inch, and next week you'll wake up in a police state. Crazy? No, just tired of seeing this stuff waved away.

I can't believe this got down-voted. This is absolutely true. To the extent that Americans have a problem with what the NSA is doing, it's with the fact that NSA's collection of phone records doesn't try hard enough to filter out information from Americans. Their opposition to this does not mean they embrace the leftist/globalist ideas that are so common on HN (e.g. foreigners should have the same rights as Americans!)

If the reform is actually just:

1) We stop spying on prominent politicians in heavily allied countries; and

2) We shut down the mass collection of call records and implement a new system that only does mass collection of international calls and traffic;

That would make the vast majority of people perfectly happy.

I think you overestimate the requirements of most Americans.

Most of them just want to hear "I will fix this" and "we won't spy on YOU". Many could care less if you spy on the other guys, let alone other world leaders.

I'm not talking about the people who really don't care, I'm talking about the (broad) subset of Americans that care about the issue and oppose the NSA's current activities. My point is even within that group, the meat of the opposition is to those specific issues, not the fundamental mission of the NSA.

The gp certainly deserved downvoting. It was more or less Nixonian "silent majority" propaganda with no substance behind it.

In any given scandal that's not of truly titanic proportions, "addressing the concerns of the majority of people" inherently is papering-over any problems without addressing them - since the majority is going to be concerned with other stuff and no have that much of an opinion.

And your claims of the reactionary-ness of the majority hasn't been born-out by polls. The majority may indeed be satisfiable by simple thing but the rhetoric of that is not so much democratic as demagogic.

Do you think Obama is appealing to non subject matter experts because they're reasonable, or ignorant?

I'd say the difference in view between subject matter experts and others has a number of causes. Some are pure ignorance: for example, most people do not know how tenuous the security of the Internet already is, and thus how harmful it is to try to actively subvert it. But those can only really be part of the story; security protocols seemingly haven't been affected all that much in practice (c.f. Dual EC's brokenness in OpenSSL), and the core question of whether it is acceptable to spy on private communications doesn't really depend on technical details (indeed, there was plenty of anger over just spying on plain-old-telephone-service records, which most of the people here don't know those details about). So I would also nominate...

- More technically inclined people have more (for some, I'd say an order of magnitude more, however you want to define that) of their life online, so they (a) have more data online and thus more to lose, and (b) tend to care much more about anything which affects their activities, since it is more important to them.

- Having a connection, direct or broad, with the technologies and the people responsible for securing things can make their subversion feel more violating; so can knowing that many things (email, Google's backend) could have been secured better but weren't, partially due to a false belief that the US Internet didn't need to be treated as an adversary.

- Connections in the "tech community" causing a bandwagon effect in topics that spread well beyond technology itself. In the context of one forum, such as this one, this is quite clear (the political norm here is very far from the mainstream in areas that have nothing to do with tech); less so the more broadly you define the community, but I think there is some group bias to be found even if you include every programmer in the US.

The people he's appealing to are the majority, SME's or not.

Don't have the transcript but to paraphrase the bit about NSA reform it was basically "We can set up a shell operation to do all the dirty work, we can't guarantee that it won't be even dirtier and less under congressional control, but we can definitely do that if you want us to"

Does that mean we can sue the company and the individuals involved, for tresspassing and vandalizing equipment to enable sigint for internal corporate data? Will they be subject to the Computer Fraud and Abuse Act the same as everyone else? Can we catch and prosecute individuals participating in operations that involve crimes (vandalism/b&e/sabotage) by enabling sigint on corporations' servers and networking equipment? And if such individuals are armed during an occasional physical incursion into corporate infrastructure, can they be shot in self defense?

More fundamentally, let's follow the money.

Who is going to fund this corporation? If they take money from the USG, money which is then paid to corporations to persuade those corporations to give up personal data or allow network taps and collocated spying equipment, that is no different from the current situation.

I think people forgot that the original reason there was a FISC order to turn over the phone records was because the telecom companies had already been doing it, and were quite happy to cooperate.

But they felt there would be recrimination if the fact that it was voluntary on their part came out and so requested to be ordered to do so (if that makes sense).

But you're right, at best there will be a third-party private company setup to hold the records and act as an "independent" review of the request, since none of the telecoms want to maintain the records themselves, since now that it's public it would risk discovery motions in every random case until the end of time.

And now that we would have an "independent" third party watching the NSA, who watches the watchers? At least NSA analysts are trained from Day 0 about the Constitution, USSID 18, FISA, etc. Who monitors the shell company to verify that they're not doing evil things with the database? Perhaps we could have FBI constantly monitor their comms and at least spread the risk around.

" At least NSA analysts are trained from Day 0 about the Constitution, USSID 18, FISA, etc." And we all know how well that worked out. What's your point? The NSA is currently not doing it's job.

> And we all know how well that worked out. What's your point? The NSA is currently not doing it's job.

AFAICT the NSA analysts have been operating under the assumption that they are following the law as written and interpreted by the Courts (Supreme and FISC), and handling incidental abuses that they discover via the same types of procedures (albeit more strict) used in other branches of government.

The fact that the lawyers and courts happen to disagree on your personal interpretation of the law and Constitution doesn't mean they weren't trying to follow it.

And however bad their actions are, there's no telling how bad it will get when you introduce profit motive.

> Basically what they're saying is that, in the name of security, we can do whatever the fuck we want.

That's not an accurate paraphrasing. Of course when it comes to "foreign private commercial information or trade secrets" it is the sovereign right of the U.S. to "do whatever the fuck we want." The paraphrased language actually makes a concession: we will only use this information for security purposes as opposed to commercial purposes.

> we will only use this information for security purposes as opposed to commercial purposes.

They obviously wouldn't lie, would they? And I guess abuse also never happens.

I thought the point of this was to implement mechanisms that would make occurrence of abuse less likely, instead they're just trying to calm people down.

> They obviously wouldn't lie, would they?

The only lie would be if they said they were going to stop monitoring foreign Internet comms completely.

Beyond that, if you're assuming the government will lie as a matter of course then it doesn't matter what Obama said in his speech, as there's nothing he could have said to conclusively guarantee anything you'd want.

I think granting "do whatever we want to citizens of other countries when they are in their home country" as a part of sovereignty is bizarre. We are not sovereign over that territory.

Sovereignty means total freedom of action except perhaps what you bargain away. And even then, in the absence of some higher jurisdiction to enforce them, agreements between sovereigns are only binding out of politeness and convenience.

In other words, to say that the U.S. can't say tap international fiber cables and record all French traffic, you must be able to point to a treaty where we agree not to do that. And even then, since nobody can enforce that treaty against us, we follow it only to the extent we find it convenient. Sovereign nations exist amongst themselves in a state of nature, and those are the rules of nature.

> total freedom of action except perhaps what you bargain away.

Sovereignty and the lack of some treaty preventing some behavior X does nothing to prevent other sovereigns from becoming angry and or retaliating in kind. Doing something 'because we can' does not make it wise.

Sure, the other sovereigns are welcome to retaliate, mope, etc. But there is a huge difference between "should not" and "can not." It's also fundamental that "should" is determined by democratic process, while "can" may be subject to legal constraints that override democracy.

But we were discussing "should not". If all sovereignty means is, effectively, "you can do whatever you can get away with" then "it's our sovereign right" conveys no moral force. We can and should curtail our "sovereign rights" and everyone else's whenever it aligns sufficiently with our interests and ideals.

You could say that the US government can do whatever with the data of citizens of other countries that flows through US networks, but that still wouldn't justify the NSA tapping on foreign-only networks on grounds of do-whatever-we-want sovereignity, would it?

Reply on news.ycombinator.com