Comment by lern_too_spel | Hacker News Reader

Comment by lern_too_spel | Hacker News Reader

Parent Full thread

1) As I've already shown and will continue to show in this post, Snowden's own documents refute this. Snowden clearly didn't have time to look at what the documents he spidered actually say.

2) Xkeyscore is merely a database and does not constitute new surveillance. Snowden's documents show that it contains fewer sources under Obama (no more email metadata).

3) The NSA significantly reduced the scope of its upstream collection under Obama in April 2012. http://fas.org/irp/agency/doj/fisa/fisc0912.pdf&ved=0CB4QFjA...

4) A datacenter does not constitute new surveillance, whether it's built or not (not).

5) Your article says that Obama's DOJ found pre-Obama abuses, once again, the exact opposite of what you claim. Your claim that Obama lied about taking steps to fix this are unsupported by any of your links. Simply stating something does not make it so.

6) There is no proof that the overflights are recording data from anybody other than the targets. You're engaging in wild speculation here.

7) According to my link above, this claim is false. The NSA shut down any ability to assist in parallel reconstruction with upstream data in 2012.

8) There is no 8.

9) Again, false. No journalist has ever been prosecuted (or persecuted) with the espionage Act. http://blogs.reuters.com/alison-frankel/2013/06/24/journalis...

10) More unsourced claims. What expansion?

11) There is no evidence that the Stingray records data from anybody other than the target. http://m.wsj.com/articles/BL-DGB-23163

Where does this leave us? Three counts of reduced NSA powers (email headers and other upstream collection and phone records) and zero counts of increased powers.

1.) ...

2.) Isn't this like saying python doesn't add any new programming capabilities over hand written assembly? Having full-take data in a database, all in one place under the hands on one agency DOES constitute new surveillance.

Also to be clear the XKEYSCORE program uses metadata to search but will return full content in the query response. It is a database with full-take data.

3.) http://fas.org/irp/agency/doj/fisa/fisc0912.pdf&ved=0CB4QFjA... resolves to http://fas.org/404-not-found/ for me. From what I can tell, however, lots of upstream collection has happened during the Obama administration. Would you care to provide another link?

4.) Covered in 2.

5.) Agreed about his link. Let's talk about this one. http://www.theguardian.com/world/interactive/2013/dec/18/nsa...

6.) They are recording the data. But they presumably delete it if it isn't related to their case. It is known that there are no formal safeguards - the deletion of data is enforced merely by policy.

7.) Again we need a new link. But I don't understand how shutting down of upstream data collection could imply no assistance in parallel construction. Could you expand?

8.) ...

9.) You can use the threat to persecute journalists, which is what I believe the parent is talking about. Furthermore other laws are used in its place (e.g. Risen).

10.) > The Obama Administration continued to lie about the programs. The Obama Administration continued to refuse to admit their existence. This is all continuing right now.

Do you agree with these sentences?

> The Obama Administration massively expanded all surveillance programs.

I think the parent is speaking generally about the growth of the budget and capabilities of the NSA during the Obama Administration including the Utah Facility, the renewal of the spying programs and Patriot Act by the administration, and legislature that would have (had it passed) expanded the NSA's ability to look directly at content without having to make requests to corporations.

11.) Back to 6.

I remember you. You're the paranoid conspiracy theorist who shows up in every surveillance post making wildly inaccurate claims. I'll humor you again and stick to one of your stupendous claims: that the stingray devices record all the data sent from every connecting device. Where is your evidence? All the released documents show that it is used to home in on the location of a targeted subscriber, which can be done without recording anybody else's data. Why would they have added the extra technical and legal complexity of doing what you so nonsensically claim?

> I remember you. You're the paranoid conspiracy theorist who shows up in every surveillance post making wildly inaccurate claims.

I encourage anyone reading this thread to look up lern_too_spel and my previous encounters and decide for yourself.

I would suggest this one in particular (https://news.ycombinator.com/item?id=8513528). I would add the "Biden Bill" S.266 to the list of things in the top comment.

"It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law." - http://thomas.loc.gov/cgi-bin/query/F?c102:1:./temp/~c102y44...:

I would also add 18 U.S.C. § 2703(f): "Required disclosure of customer communications or records" - http://www.law.cornell.edu/uscode/text/18/2703

> I'll humor you again and stick to one of your stupendous claims

How about replying to all of them? In previous threads it was very common for you to pick one fact and fixate on it ignoring the others. I would much rather have a discussion about all of these points.

> All the released documents show that it is used to home in on the location of a targeted subscriber, which can be done without recording anybody else's data.

Please link to said released documents. The Wall Street Journal, which broke the story:

http://online.wsj.com/news/article_email/americans-cellphone...

"The technology is aimed at locating cellphones linked to individuals under investigation by the government, including fugitives and drug dealers, but it collects information on cellphones belonging to people who aren’t criminal suspects, these people said. They said the device determines which phones belong to suspects and “lets go” of the non-suspect phones."

"Also unknown are the steps taken to ensure data collected on innocent people isn’t kept for future examination by investigators."

"Within the Marshals Service, some have questioned the legality of such operations and the internal safeguards, these people said. They say scooping up of large volumes of information, even for a short period, may not be properly understood by judges who approve requests for the government to locate a suspect’s phone.

Some within the agency also question whether people scanning cellphone signals are doing enough to minimize intrusions into the phones of other citizens, and if there are effective procedures in place to safeguard the handling of that data."

Thanks for pointing people to that thread. It shows another one of your crazy claims thoroughly debunked by tptacek and myself that you couldn't be bothered to correct yourself about. That's why it's pointless correcting you. If another user cares to discuss these issues, I'll gladly take them up on the offer.

As for my documents, you linked to the canonical document that broke the story itself. You even quoted the part about how it most likely works. "They said the device determines which phones belong to suspects and 'lets go' of the non-suspect phones." The rest of the article consists of evidence-free speculation about data collection that is not necessary to perform the task that the device is required for.

I'm done. Thanks for the link to the previous conversation. I'll just repost that the next time you respond to one of my comments, so everybody will understand why I won't bother to correct your points.

You failed to link to documents (again), failed to reply to all items (again) and selectively quoted content (again).

"it collects information on cellphones belonging to people who aren’t criminal suspects"

"unknown are the steps taken to ensure data collected on innocent people isn’t kept for future examination"

"scooping up of large volumes of information, even for a short period, may not be properly understood by judges"

"Some within the agency also question whether people scanning cellphone signals are doing enough to minimize intrusions into the phones of other citizens, and if there are effective procedures in place to safeguard the handling of that data."

> If another user cares to discuss these issues, I'll gladly take them up on the offer.

@adventured, the ball's yours.

I don't know much about either of you but would like to add here that you were --- no harm, no foul --- comprehensively wrong about CALEA. The law itself refutes your claims about its impact on software companies, right up front in the "definitions" section.

Haha, thanks Thomas.

I'm half in agreement with you about CALEA, but think the thread missed the larger point. Forests and trees and all of that.

If one were to take my point as a specific claim about only CALEA and as a specific claim only about key (and not data) escrow under a strong letter of the law reading, then yes most certainly I was wrong.

However this interpretation of the thesis is/was an injudicious one. There are laws requiring plaintext access to communications records and computing services records upon lawful request. CALEA does have a section on this (focused on telecommunications, which have been expanded to include digital transport such as VOIP technologies), as does 18 U.S.C. § 2703(f) (which do apply to digital services such as cloud technologies), as do others.

The thread fixated on CALEA - yet from the beginning my thesis was about a constellation of laws and the interpretation of these laws under EO 12333 and the Third Party Doctrine, current political climate and the real world pragmatic implementation of policies in tandem with the private sector (e.g. telecoms in America today do not provide strong escrow-less crypto).

From what I can ascertain for large providers the Department of Commerce streamlines the process. Telecommunications have been streamlined since the late 90s. Internet services are still in the process of being streamlined - PRISM was one of said programs. For smaller providers requests/demands are run when the value of ends supersedes the cost of means. Lavabit is an extreme example of how leverage has been applied to acquire plaintext access to communications.

If a law exists that requires a software company to retain the capability to provide plaintext transcripts of encrypted messages, and to provide those transcripts on demand, you've been unable to provide any citation to it.

Lavabit is exactly the problem with your analysis. The core problem of Lavabit wasn't that that the government compelled Levison to retain the ability to decrypt messages. No, Levison chose to do that, because the market punished real secure message providers for forcing users to install software. (a) If you have the ability to decrypt messages, (b) the government is allowed under current law to exploit that. Now Levison's defenders want to point the finger at the DOJ and surveillance law, insulating him from the consequences of his own (frankly) terribly irresponsible decision to expose his users secrets in exchange for market share.

The original citation to CALEA which people "fixated" on was yours. Your claim was that CALEA compelled software companies like Apple to backdoor encryption. It does no such thing.

No law exists preventing anyone from building a truly secure messaging service. TextSecure and Silent Circle are doing it out in the open right now. A disinformation campaign suggesting otherwise would be harmful to end-users.

What do you think about 18 U.S.C. § 2703(f)?

I think that it says nothing whatsoever about encryption. What am I missing? If you're going to claim something in here could be interpreted to apply to encryption, cite some authority that says so. In the unlikely event that you're right, a lot of big companies are in serious legal trouble.

I included this law in the discussion since it applies to digital services.

What you are missing is that unless encryption is used directly by the endpoints (not added by the provider) by definition (a) holds from your previous comment.

Skype is an example of a communications service (like TextSecure) that offered secure E2E communications but was stripped of that functionality.

Blackberry is an example of a company that has drowned because political pressure to backdoor communications was greater than the market incentive to provide real security.

Apple today stores electronic communication and service records, logs and artifacts from your phone encrypted in the cloud. But it will decrypt for law enforcement upon request. Are you suggesting they do this voluntarily or are they compelled to by law?

http://images.apple.com/privacy/docs/legal-process-guideline...

For the record I am a strong advocate of TextSecure/Silent Circle/others. To be a strong advocate, however, one must be a strong skeptic. So far I do not believe these two projects have been compromised ("CryptoCat" on the other hand...)

I do not believe that there are laws requiring all crypto implemented by every provider everywhere to be subverted. The laws that exist however do ensure that any encryption provided transparently are subverted. When E2E crypto becomes a problem (e.g. Skype) the intelligence community has other ways of dealing with it.

What this means for the surveillance state is that anything that becomes popular enough to represent a non-neglegible portion of traffic will be subverted. Mom and pop can't have secure communications. It's only us cipherpunks who get to have any short reprieve.

I'm lost. You claimed in the previous thread you linked to that CALEA (or, charitably, some other law) required US companies to backdoor their encryption schemes. I said you were wrong about that. You claimed I was merely fixating on the specific law you cited, to the detriment of the more general truth of your argument. I asked you to cite any authority anywhere backing that argument up. Your response is to cite examples of crappy software security, and then to sneakily reformulate your argument so that it applies only to encryption that isn't "end-to-end".

The saving grace of this unproductive conversation is that we at least agree that end-users should reject forms of encryption that don't require them to install anything.

> You claimed in the previous thread you linked to that CALEA (or, charitably, some other law) required US companies to backdoor their encryption schemes.

As a customer, encryption provided by a third party (especially in situations where it is difficult or impossible to provide my own encryption - like how would I provide my own encryption that goes over Skype?) which is designed to be removed upon request by the government is backdoored.

> I asked you to cite any authority anywhere backing that argument up. Your response is to cite examples of crappy software security, and then to sneakily reformulate your argument so that it applies only to encryption that isn't "end-to-end".

Neither Blackberry nor Skype were crappy software security solutions until they were subverted. They were subverted on purpose. It's disingenuous to call them crappy without digesting the context by which they came to remove strong security garuntees. Like the case with Apple (you didn't reply to that) either this subversion was done voluntarily or it was compelled.

My thesis is that the constellation of laws and their interpretation are such that the any products which become leading communication services will be subverted. Through mandatory data ecrow and the TPD as we spoke about earlier, and through financial and political pressures, incentives and (as we know in extreme cases from the Snowden docs) sabotage.

So perhaps it's a vocabulary issue? Companies that will sell in-transit encryption but remove it or store plaintext I would call a backdoor. We agree that this is required by law.

Where we seem to disagree most is the canonical case of Skype. Skype was purposefully subverted and I argue that the constellation of laws we've been discussing were used to do it. I can imagine two other stories one could tell:

1) E2E encryption was removed voluntarily; no compulsion (I would need a lot of convincing)

2) E2E encryption removal was a silly regression that has been noted but not fixed for years (I would need even more convincing)

I would agree wholeheartedly that when it comes to the Skype case there are technically, by letter of law, no laws that force companies to remove or backdoor E2E.

I think here is where we disagree: I think in practice, by the examples we've been able to witness, that broad interpretations of these laws, in conjunction with financial and political pressure are in fact used to leverage changes law enforcement and intelligence community members need.

Reply on news.ycombinator.com