Comment by sinak | Hacker News Reader

Comment by sinak | Hacker News Reader

So according to the report, Obama is going to propose legislation that:

- Would end the NSA's authorization to collect bulk call records from telephony providers under §215.

- Would require the NSA to require court approval prior to every §215 call record request. Up to 2 hops worth of call records would be included.

- Won't require that telecoms maintain anything more than the 18 months of call records that they are already obliged to hold.

The devil's in the details, but it sounds like a big change from the existing call records program. If Congress passes something along these lines, it'd be a major win.

But the §215 call records program is just a very small component of the objectionable surveillance programs. Here's just a sampling of the others:

"Upstream" collection: The sort of thing that happens in AT&T's Room 641A - fiber optic cables intercepted, data captured (under program names Fairview, Blarney, Stormbrew, Oakstar). Auth'd under Executive Order 12333 and the various FISA laws [1]. Searched using the XKEYSCORE frontend. GCHQ has similar program called Tempora which the NSA has access to.

MUSCULAR: Jointly run by GCHQ and NSA, collects data as it passes between the backend servers of services like Yahoo and Google. [2]

PRISM: Auth'd under §702, allows NSA to request data from tech companies about anyone who might be "reasonably believed" to be outside the US.

BULLRUN: Various efforts to break encryption, including attempts to insert vulnerabilities into encryption standards. Snowden's security clearance wasn't high enough to get any real details on exactly what the NSA has achieved as part of BULLRUN [4].

I think the scariest of those is Bullrun. We don't (and likely won't) know to what degree the NSA has managed to break or circumvent encryption [5].

[1] http://en.wikipedia.org/wiki/Upstream_collection

[2] http://www.washingtonpost.com/world/national-security/nsa-in...

[3] http://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret...

[4] http://www.eweek.com/blogs/security-watch/nsa-bullrun-911-an...

[5] https://twitter.com/nicoleperlroth/status/376481848760606720

Perhaps the scariest thing is their plan to collect and store all data on all of your activities, then retroactively mine it. That is, from the moment you use the internet for the first time as a 9 year old until the day you die as an 89 year old, every text message you send, every email you write, every website you visit, and (if you're thinking of becoming a politician) every nude picture you send can potentially be used against you.

The reason this is scary isn't just because of the present social climate. The current social climate is actually pretty decent. The reason it's scary is because social climates can change quickly. A couple decades from now, what you did legally today may be illegal. If you're pursued and prosecuted, it's possible someone may dig through this vast trove of collected data and use it against you.

Clapper (the head of the NSA) has taken the stance that it's okay to collect everything, and that a "search" hasn't taken place until some human actually tries to look through that data. He frequently uses the analogy of a library: it's okay for the NSA to have all the books (everyone's data, everywhere) because a search hasn't taken place until they take one of the books off the shelf and look through it.

The temptation to use that library for purposes other than curbing terrorism must be pretty strong.

I'm going to speculate for the sake of example. It was often cited that one of the reasons for the 9/11 attacks was that the agencies weren't cooperating. As such, there has been a lot of pressure for the agencies to work together since then. I'm going to guess that if the FBI hadn't eventually tracked down DPR on their own, they may have tried to turn to the NSA for help. While it's not clear that the NSA has those kinds of capabilities, they're certainly more capable than the FBI at breaching the Tor network. There are slides out there which say something along the lines of "... we're able to deanonymize individual targets, not everybody at once."

That example is a little bit unrelated to "collecting all data about everybody and then mining it," but remember that if the agencies begin cooperating in that fashion, sharing that trove of data may be the next logical step.

I apologize for speculating, and my speculation should be treated as such. But please realize that just because they're not doing that to Americans yet doesn't mean they're not doing it to citizens of other countries with impunity today.

Here's another ancillary point. It should be no surprise that the NSA could probably find out the identity of Satoshi Nakamoto pretty easily. But my point in bringing that up is this: if Satoshi himself cannot stay anonymous, then what hope do any of us have? Anonymity may be dead at this point. It's pretty clear that humans will continue to live even if that's the case, but a world without privacy is going to be a very strange one.

By the way, I should also mention that the GCHQ may be even more capable than the NSA. There are signs that the NSA are better at pulling off attacks (Stuxnet, Tailored Access Operations) but that GCHQ are better at collecting data (bypassed Google's encryption). It has also been hinted that whenever the NSA runs into roadblocks against investigating Americans, they enlist the help of the GCHQ since it's legal for them to do so (and vice-versa). So even if the NSA is reformed, there is still this spectre of this worldwide data collection and governmental collaboration hovering over society.

>what you did legally today may be illegal

In the United States, the Congress is prohibited from passing ex post facto laws by clause 3 of Article I, Section 9 of the United States Constitution.

  *In the United States, the Congress is prohibited from passing ex post facto laws by clause 3 of Article I, Section 9 of the United States Constitution.*

I don't know if you've noticed, but folks in Washington don't give a fuck about the Constitution any longer.

But if that hypothetical law were passed by Congress, people sued under that law would argue that the law was unconstitutional, and any competent court would agree, acquit the person, and strike down the law.

The problem is that laws and clauses of the constitution only provide protection if there is political will to allow it to do so.

The second that the people in power have no actual political will to follow them, the fact that laws exist provides no protection.

Even if there were no political will, the judiciary could enforce the protection, for eg by striking down unconstitutional laws.

Perhaps the scariest thing is their plan to collect and store all data on all of your activities, then retroactively mine it

This is the biggest grey area/ major issue. The issue is not just 4th amendment stuff (reasonable expectations of privacy), but selective disclosure and prosecution (ie, equal protection). The use of this for blackmail would be come ~irresistable to those seeking to cling to power. And this kind of stuff is why the bill of rights exists.

The problem is that the selective disclosure and prosecution are very easy to abuse without violating the text of the constitution; especially when the average American commits three imprison-able offences per day, because of the number of criminal laws, and their breadth.[1]

[1] http://online.wsj.com/news/articles/SB1000142405274870447150...

> Perhaps the scariest thing is their plan to collect and store all data on all of your activities, then retroactively mine it

I would even go to say that the NSA already has files on all major politicians in the US and therefore can threaten anyone (including the president) to release something the public would not like (extra-marital affairs, pretty common among politicians, but could be many other things too) and therefore easily coerce the politicians to avoid any significant reform of their mandate.

> and that a "search" hasn't taken place until some human actually tries to look through that data.

It's actually scarier than that; the term used was 'acquisition' rather than 'search'.

So they collect all the raw data, but don't 'acquire' intelligence until they search for specific information.

Since the legislation pertains to acquisition they are not, by their interpretation, bound by that legislation during collection.

| the stance that it's okay to collect everything, and that a "search" hasn't taken place

Anytime this argument is made, it must be held in contempt, and along with its wanton disregard for logic, be not allowed to stand.

Scenario 1: If Alice sends a letter to Bob unintercepted and Bob reads the letter then burns it, his privacy has not been violated and he has not been searched.

Scenario 2: If Alice sends Bob a letter and before delivery the postman opens the letter, photographs the contents in such a way as to not see the contents of the letter at the time, then sticks the photo in his pocket for a rainy day, then delivers the letter, Bob has been searched.

For any of a number of definitions for searched.

One of which being Bob no longer has control over his personal effects(information), cannot choose the manner in which they are presented to others, or if they are presented at all.

If your option of not being searched has been taken away, you've been searched.

In Scenario 2 Bob's option of not being searched has been taken away, so therefore he has been searched.

It's pretty obvious these bulk collection practices are 'seizure' as well as 'search,' though I've not heard anyone with the audacity to argue that it is somehow not seizure.

> PRISM: Auth'd under §702, allows NSA to request data from tech companies about anyone who might be "reasonably believed" to be outside the US.

What exactly does that mean? Is it literally just anybody they "believe" to be physically outside the US? Or non-US citizens?

I believe this is likely to use the NSA's definition of a "US Person"

According to the National Security Agency web site, Federal law and executive order define a United States person as any of the following:

a citizen of the United States

an alien lawfully admitted for permanent residence

an unincorporated association with a substantial number of members who are citizens of the U.S. or are aliens lawfully admitted for permanent residence

a corporation that is incorporated in the U.S.[1]

[1] http://en.wikipedia.org/wiki/United_States_person

Only for phone records...nothing even mentioned about the Internet collection, which I'm much more worried about.

Reply on news.ycombinator.com