Before Snowden, a debate inside NSA | Hacker News Reader

Before Snowden, a debate inside NSA

bigstory.ap.org

135 pointscgtyoder37 comments

This only shows that Snowden was correct that internal channels were not effective at providing real oversight.

Speaking of internal channels, even the external channels don't necessarily care more than Keith Alexander:

http://www.theguardian.com/us-news/2014/nov/18/usa-freedom-a...

"Senate Republicans block USA Freedom Act surveillance reform bill"

"Senators, mostly Republicans warning of leaving the country exposed to terrorist threat, voted to beat back the USA Freedom Act"

The actual bill was quite bad and should not have been passed.

For a decent write up: http://www.theguardian.com/media-network/2014/nov/19/how-usa...

I believe it would be a good start, and EFF too doesn't agree with you:

https://www.eff.org/deeplinks/2014/11/eff-statement-senate-a...

"We continue to urge the Senate to do so and only support amendments that will make it stronger."

EFF doesn't seem to comment on the provisions of Patriot Act that would be reauthorized by the bill. That is one reason to oppose it IMO. At least, EFF should give me reasons I should sell some liberties again in order to get some others back. I would view Patriot Act finally expiring in 2015 as "a step forward" just as its supporters claim this bill to be for NSA reform.

They did, in a separate article:

Update, Nov 18: The USA Freedom Act does not renew the entirety of the Patriot Act, which consisted of over 100 sections changing numerous electronic surveillance laws. The USA Freedom Act does extend three provisions of the Patriot Act: the "lone wolf" provision, the "roving wire tap" provision, and a reformed Section 215.

https://www.eff.org/deeplinks/2014/11/usa-freedom-act-week-w...

Thanks for the reference. Hmm, Section 215's "business records" provision, that little thing EFF told us the NSA is using "to collect the calling information of every American"?[0] It sounds like EFF prefers to use "Freedom Act" to put some plastic handcuffs on the program, instead of trying to starve it when its justification disappears. EFF has fought against the renewal of these exact same 3 provisions in the past[1][2]; why do they accept them now?!

I guess they project the 215 revisions will be extended in another bill if necessary anyway? So they supported a more minor reform they thought more likely to pass? I wish they'd be more open about the compromise, then. The 100 vs. 3 comparison seems a little oversimplified -- I would guess many of those >100 sections don't have an expiration date, or at least expire on a different date than these 3 (which were last renewed in 2011[3] against EFF's wishes.) I am making an assumption here about what the 100 sections means.

In any case, I'm rather upset they're on the record fighting these in the past, yet now they barely mention them at all, and only in what I see to be a hand-wavy "lesser evil" excuse. I know "perfect is the enemy of the good", but I don't think "Freedom Act" is even all that good.

[0] https://www.eff.org/document/215-one-pager-adv

[1] https://www.eff.org/deeplinks/2010/02/epic-fail-congress-usa...

[2] https://www.eff.org/deeplinks/2011/02/tell-your-representati...

[3] http://articles.latimes.com/2011/may/27/nation/la-na-patriot...

The Patriot Act is not going to expire in 2015, it's going to be overwhelmingly renewed, probably with broad bipartisan support, but mostly by the new Republican majority.

This bill isn't selling liberties, they're already sold, it's just trying to win some back.

Exactly. The freedom act was an opportunity to get at least the tiniest amount of reform. The White House even supported the bill.

There is no way the patriot act will not be renewed. Even a congress as dysfunctional the one coming in will come together to TAKE BACK TEH AMERICAS FROM ISIS.

I tend to agree it will be renewed somehow anyway, but I still can't quite bring myself to wholeheartedly support anything that will renew it. Let them renew it with "minutes to spare"[0] like last time, without the benefit of an Orwellian cover title that lets everyone think Freedom is back again and the NSA has been vanquished. EFF has even said one of these provisions that would be renewed actually supports NSA programs!; see my other comment for links.[1]

I would be open to hearing why the provisions that will be renewed are "not that bad" and worth trading. I'm guessing there are worse things in the Patriot Act that don't even have sunset dates. A lesser evil is still evil, though..

[0] http://articles.latimes.com/2011/may/27/nation/la-na-patriot... [1] https://news.ycombinator.com/item?id=8638143

I agree with you, but the "quality" of the Senate debate about the actual bill was so utterly low that I think we can reasonably infer that the Senate as a deliberative body doesn't care about Intelligence oversight. Only Wyden, Udall and a few others care at all.

If Udall cares so much, he can read whatever classified documents he wants from the Senate floor with absolute legislative immunity.

Yep, and here's hoping that when he's out he'll explain why he didn't in public.

We know from previous whistleblowers the most likely response to raising concerns is being sidelined or punished.

"The now-retired NSA official...says he argued to then-NSA Director Keith Alexander"

"The former official, who spoke only on condition of anonymity because he didn't have permission to discuss a classified matter"

and then

"An individual did bring us these questions, and he had some great points," Alexander told the AP."

So they know who it is. Isnt he going to get in trouble regardless?

CAREFULLY NOTE THE AUTHOR OF THIS PIECE: Ken Dilanian.

Ken Dilanian is at the very least, "friendly" with the CIA: http://www.politico.com/blogs/media/2014/09/ken-dilanian-sen... At least in the past, he's run drafts of stories past CIA PR people.

It's at least reasonable to consider the idea that this is a PR Hit for the NSA itself, therefore nobody will get in trouble. I concede that the "I argued with Keith and got ignored" angle is problematic if this is a PR Hit, but still, you've got to give the idea some credit.

Very good point.

Only two hops allowed, court order required each time, only 30 intelligence employees permitted access to the database, and only 300 searches a year - that sounds almost reasonable. It seems to me that the only thing left to make this totally clean is to take the database out of the hands of Government, put it in the hands of a private clearing house, and then require a ( necessarily confidential) court order to search the database. Just like any other court order. That would take the NSA out of the "Collecting American Phone Records" business.

Under a process known as "contact chaining," analysts examine the numbers that had been in contact with the "dirty number" and then the numbers in contact with those. Until this year the circle had sometimes been expanded to a "third hop" — a process that could include analysis of millions of American phone calls. Obama in January restricted it to two hops, and required a court order each time the database is searched.

Only 30 intelligence employees are permitted to access the database, officials have said, and it is done about 300 times a year.

"then require a ( necessarily confidential) court order to search the database"

This is where I have the biggest problem with our current government antics. They should be required to disclose all warrants and phone searches within 5 years by default. If there is an ongoing investigation then a second court order could keep it sealed for longer.

Without transparency there is too much wiggle room for bad behavior: http://www.reuters.com/article/2013/09/27/us-usa-surveillanc...

You are forgetting one critical fact: the NSA's language is entirely different from the language that you and I agree upon and understand.

If they are saying "only 30 intelligence employees are permitted access to the database, and only 300 searches a year", they could really mean "only 30 employees (and a multitude of contractors and military personnel) are permitted access to the database (of which they can make a copy of all remotely relevant information and then distribute to whoever), and only 300 searches a year (under our atomically narrow Byzantine definition of "searches" which completely misrepresents the real number of database queries)".

Additionally, people are really placing way too much faith in the warrant/court approval system. These courts are in the pockets of the people requesting authorization for searches; after all, the people with real information (power) can twist the arm of any judge to suit their needs.

We need to clean house from the bottom up and rebuild a system which does not permit for human corruption or human error.

NSA employees are so siloed from each other that it limits dissent and self auditing

I feel like being siloed would actually increase the probability of dissent happening. Leaving you all by yourself to question the rules you follow. Of course I suspect a certain IQ and/or education level is needed for this kind of self reflection.

Keep in mind that siloing increases the influence of management.

Also, it means that different people are telling themselves, "I'm making a better search tool!", "I'm making a better scraper!", "I'm making a better optical tap!", without putting it all together (https://www.youtube.com/watch?v=HoT-h0S1gkE).

The creators of the atomic bomb regretted having created it. I wonder how long before someone in a spying/miltary agency will regret making a big discovery. Maybe something like an exploit in electricity itself or a way to remotely explote any nuclear plant in the world.

> Maybe something like an exploit in electricity itself

What is that supposed to mean?

Gaining root privileges with it, like Tesla did. Duh.

I doubt the GP was thinking of this, but there exist some interesting side-channel information attacks using the electricity grid.

(disclaimer: I am not very knowledgeable about electricity/electronics, so forgive me if I'm a bit hand-wavy or wrong about the details)

The actual electricity output from a wall-socket fluctuates continuously by a tiny bit over time. I suppose this goes for both the exact magnitude of power output (is that voltage or amperes?) and the exact frequency being ever-so-slightly above or below the expected 50Hz. These fluctuations can be measured (or fingerprinted) by carefully measuring the output of electrical appliances, such as the crackles and pops in audio recordings or brightness of light bulbs, and in fact many other things.

The other important fact in this trick is that apparently these fluctuations are all the same over the entire grid (or subsections of it, I guess, depending on network layout). They are also pretty much random. This means that if you keep a log of these fluctuations over time, you can timestamp recordings of pretty much anything with extreme accuracy, by matching up the patterns of crackles or power fluctuations in the recordings to your logs.

This would then allow one to detect fake call logs, video/audio cuts and splices, stuff like that.

It's not a gigantic privacy risk (therefore probably not what the GP was thinking of), at least not from the applications I can think of the top of my head. I do love side-channel attacks like these, though. They're always so clever and out-of-the-box :)

This is a great observation.

One of the facets of the banality of evil lies in people's inability or unwillingness to integrate in their minds the purpose of their day to day production as it relates to the larger picture. In an intelligence agency, the larger picture is obscured by design.

> Of course I suspect a certain IQ and/or education level is needed for this kind of self reflection.

The NSA is full of intelligent people. Keith Alexander went to West Point. Indeed, one of the reasons he became DNI was his extensive education in telecommunications technologies/signals intelligence (he has a number of post-graduate degrees in that area).

>NSA employees are so siloed from each other

A chance encounter in the canteen:

"Oh, hey Bob! You don't know who I am, hi, I'm Steve McDougal here, from the OPHELIA project. Don't take this the wrong way but I've been reading your diary and I can't help but tell you that I feel the EXACT same way about our organization's spying on ordinary Americans as you do."

"Are you kidding, Steve! I know exactly who you are - I've been reading your diary for months, too!! The one you keep in : C:\Users\Steve\Documents\steves private thoughts.doc? You were writing in there just this morning about how even in Orwell's 1984 he could at least turn away from the monitoring TV!!"

"Oh wow Bob. Or that entry you wrote the other day about Quis custodiet ipsos custodes - I think this was where you were writing about your wife Sue getting banged by the FedEx guy"

"Yeah well ha-ha Steve, I could tell you never bothered to look at your wife's work Blackberry number!"

"What? You're kidding!"

"No, check it out. You got something to note this down with, I know it by heart: it's 505-234-9918. Didn't you ever hear Sue and I reading excerpts? That is some hot stuff."

"What - no, I only listen to you guys when you're actually fucking, and that hasn't happened for months. If you want to really hear something, try your home around 2 PM tomorrow, since your wife ordered something from Amazon again."

"Fedex?"

"Yep :). But so anyway, what were we talking about again?"

"Oh the diary stuff. Yeah your thoughts are like a mirror image of mine."

"Yeah I don't know how we never met before, I've been reading your diary ever since you filed a complaint about the lunchmeat. But what did you think about my thoughts on Director Alexander?"

"Well to be perfectly honest with you I think you should have kept them to yourself."

(LOL)

This is completely hilarious. Very Fry and Laurie.

Now I really want to see them play this out -- it would be great.

    Resolved by K. Alexander

    Status: Won't fix — by design

    K. Alexander has revoked read and write permissions.

How would having the phone companies store the records be better than having the government store them? If a warrant is required in either case, it seems like it would be best to go with the most secure storage option.

The various parts of government are usually better able to say no to each other, while a company may not be able to say no. What's Verizon going to do when some part of the government demands some records? How much time and money are they going to spend protecting those records?

Who's going to be held responsible when a phone company gets hacked and makes off with the motherload of records?

It just seems like having the phone companies store the records will make them less secure and more vulnerable to more requests from more agencies.

The phone companies store the records for at least some period of time already, why make unnecessary copies?

Nope. At all.

Lavabit was able to challenge the government. Even Yahoo! was able to try. And privacy protection can become a feature for which to choose which phone company to pick. Government agencies will cooperate.

Reply on news.ycombinator.com