Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
I Knew Snowden. And He’s Not The Story (medium.com/surveillance-state)
245 points by mncolinlee on June 25, 2013 | hide | past | favorite | 99 comments


Everything in this sums up my feelings on the matter.

It is impossible to get freedoms back, too easy to give them up. And if all seems well now, you have to understand that decades from now and many leaders later there is too much trust not to be abused.

If there is question of unconstitutional natures for systems like this, the authority and agencies need to prove themselves beyond a reasonable doubt in the open not in secrecy well over anyone calling it into question. You don't side with authority when freedoms are at risk, those don't come back.

Individuals are innocent until proven guilty, authority has to be guilty until proven innocent due to the sensitive nature of freedoms going away. It seems people have this flipped.

People think that the law or the Constitution will always provide a failsafe, but that is only a piece of paper if the people have no backbone and don't push back. It can happen here and is well on the way if we don't watch out. There are lots of patriots and good people in the CIA/NSA/FBI but it is not their job to contain overreach, it is the people.


I'm not particularly interested in the Snowden play-by-play and backstory, but I think it's probably good for his cause.

The story would already be dead if he was extradited or simply disappeared quickly after the leak. Instead the US is getting daily "Where's Waldo" stories in the New York Times along with stories about the relationships between the US, China, and Russia. Having all of these angles from which to write about the story is giving it legs; and the longer it stays in the public's mind, the better.


Definitely.

The best thing about these leaks is the discussion it's making. Hopefully people will become more informed from it (but the number of "ARGHHHH MY FOURTH AMMENDMENT" style comments instead of more specific comments is disheartening).

This is actually so surreal. I don't think the US is ever going to try that hard to get him back to try him, but the entire spectacle / Assange-style "THEYRE GOING TO KILL HIM FOR TREASON" around this guy, along with the supposed strain on relationships this is going to make is stranger than fiction. What is happening


Odd. I was actually somewhat relieved to see people actually caring about their fourth amendment rights in a way that they haven't in far too long.

In all honesty, I think that Snowden's continued media presence is actually hurting his cause. Between the smear campaign by the current administration (and press) and the casual comments he's made that has lost people on his cause, he might be keeping the story going, but the story is shifting more to one of ad hominem, and less of one on the issue at hand.

The populace at large is terribly bad at keeping issues like this in pragmatic focus. Too few realize that even if Satan himself had been the one to leak this information, that we're all better off for having known it; and I'd hope that it would give some Americans pause enough to consider the actual implications of the Constitution; whether or not the government can govern through the consent of the governed, for example, if they have secret governings, or whether or not the non-delegation clause of the Constitution should actually allow for the NSA (staffed with officials we can't vote in or out) to write laws, when the Constitution specifically enumerates that law-making power resides in Congress alone.

So while ultimately, all that boils down to is ARGHHHHH MY FOURTH AMENDMENT, it's also an opportunity to have a larger discussion on what that fourth amendment actually means, and what other parts of the Constitution might come into play, and whether or not it's fair that the government has extended its power to such the degree that we can have 300 different "agencies" like the CPPABSD (Committee for Purchase From People who are Blind or Severely Disabled -- they regulate how many coke and vending machines other government agencies should purchase from strictly blind or severely disabled sources), each of which is allowed to write laws that do not pass Congress, do not pass the house, and aren't subject to the oversight of the citizenry. The FTC, FDA, EPA, NTSB, etc., have all arguably affected each of our lives in some non-trivial ways, and those officials are just there, persisting, whether we like it or not.


Snowden's continued media presence is advancing his cause.

For common people to care, we need a victim. A victim creates a story that the media can report on. The moment we lose our victim, people stop caring. Discussions on what the fourth amendments mean will not capture the hearts of the people for a month or half a year to make changes possible.

For example: If you want to rally the gov to legislate a law to make people to seat belt on buses. Discussion of scientific reports or statistics of seat belts in the press will not go very far. In contrast, a story about a 5 year old that lost both her leg will go a long way.


> "the number of "ARGHHHH MY FOURTH AMMENDMENT" style comments instead of more specific comments is disheartening"

I'm put in mind of how the Federal Circuit always manages to put a pro-patent spin on even the Supreme Court decisions that are clearly intended to overturn what the Federal Circuit has done. Arguing against the details and trying to dismantle things piecemeal just doesn't seem like it will work. They've got their own resilient web of special definitions and interpretations that allow them to justify what we try to prohibit with plain language.


So far Snowden hasn't revealed much that wasn't already said by NSA whistleblowers Drake, Binney, et al. Yet most folks had never heard of them or much about the issues they were trying to raise.

Yet Snowden is an international superstar and the substance of his disclosures are, in fact, front page news on a regular basis. If it takes paying some attention to the fact that his girlfriend was a pole dancer, I guess that's OK with me.


...this is the first I'd heard of the detail that his girlfriend was a pole dancer. I'm profoundly amused to discover it like this.


Not that kind of pole. As far as anyone has said publicly she was not a stripper. She was part of a dance troupe while living in Hawaii and the about page on her blog she described herself as “a world-traveling, pole-dancing super hero.”

http://www.salon.com/2013/06/12/edward_snowdens_girlfriend_p...


So more like artsy acrobatic dancing that just happened to involve the occasional pole.

Got it. Glad we got this sorted out. :-)


I'm sorry!


Personally, I think he's playing his side of the story pretty well. It's hard to demonize the nice geek kid, a least with the tech community.

The espionage charges reveal how awful Obama, really all of Washington, is on the Bill of Rights. I think this whole thing is going to backfire on them.


It's already started. Tonight, on stage at the Verizon center in DC, Mick Jagger said "I'm not sure if President Obama is here tonight, but I'm sure he's listening in."

Maybe it's just me, but this comes across as far more damaging than garden-variety mockery. It's like the authority and mystique of the office are just evaporating. And forget about "repairing relations with the rest of the world." Unlike the cock-up in Iraq, this effects everyone, everywhere, directly.

Backfire squared.


Heh. In all fairness, it's arguable the UK does even more spying that the US. But your point is well taken. The US is supposed to be a model for a free society. Mass surveillance could be imagined as "un-American". But the president thinks it's an acceptable practice. Obama followers: You've been had.


Update: Apparently Jagger's jab drew boos. I suspect there were a lot of people in the room who are deeply invested in the politics that were being mocked from the stage.


It is so disheartening to see the media bicker all day about Snowden and Greenwald. What can be done to steer the story back to the travesty at hand?


More leaks, this time something huge, which I certainly expect Greenwald and Snowden are sitting on


Agreed. The Snowden leaks to date have exposed programs whose outline we* guessed at years ago -- but details matter and written confirmation matters. The Patriot Act 215 order against Verizon is arguably illegal and unconstitutional; it exceeds the statutory authority and requires prospective data be divulged instead of merely retrospective. The FAA 702 orders, well, we'll see. Remember even the provider liability immunization is not unlimited.

But these are legal arguments. So far there has been no dramatic evidence that the NSA's sweeping surveillance powers have been abused in the way the IRS abused its authority -- examples would be snooping on politicians, blackmail, listening to sex chats, etc. We've learned more about abuses of this sort (politicians and sex chats, not blackmail) from scattered reports in the NYT half a decade ago then we have from Snowden so far.

* We == people who have been following these topics.


Snowden is a story too. As someone who considers him a hero, and one of the rare few who I can relate to, I'd like to know more about him views so that I can learn from him. That's not irrational, unless you think biographies are a waste.

In this regard, I wonder if any potential underhanded focus on character rather than message in the media might have the ironic effect of empowering more young people. "You can do good and be brave even if you play WoW".


The thing is, most of the stories are not him coming off as a a hero, but as a dropout, a weirdo, and generally someone who didnt fit in. They are not positive biographies but more subtle character assassinations.


A hierarchical organization that centralizes so much unchecked power as the NSA will attract a good share of sociopaths. Sociopaths seek power over others. Then it's a matter of time until a sociopath manages to climb to the top, and then you have a full-blown tyranny.

http://charleshughsmith.blogspot.com/2013/05/centralization-...



"The technology that the NSA now wields far exceeds Senator Church’s most excessive dreams of a surveillance state."

The author apparently thinks Senator Church didn't have much of an imagination or had never heard of the Soviet Union or China.


The Soviet Union, nor the notoriously efficient Stasi, had anything like our automation. You have to wonder if The Wall would have come down if they had our tools.


Surveillance has kept pace with technology. I doubt Mr. Church really imagined the Internet. Do you really think that China today has nothing like our automation? And do you actually think the way China acts on this information and the way we act on this information are comparable?


So the question is: Do we build an internet that is inherently private and secure and blinds the censors in the despotic regimes, or are we too afraid of that freedom now?


We've been able to build that Internet for years. The people didn't want it. They wanted GMail and Facebook and Flickr and Instagram and all the rest of the magic of the Cloud.

We could possibly start shifting to federated models but honestly I've quite enjoyed being able to easily talk with people from outside the U.S. and I worry it would be that much more difficult in such a scheme. We'd essentially all be going isolationist at the same time, building some digital Berlin Walls.

What I think would be most feasible is bilateral "Internet privacy" treaties that define what requirements are necessary to intercept traffic (which is something that every nation wants to do but none are able to easily ask for). But at the same time I don't think European countries would be happy with the idea that the NSA could even theoretically obtain their citizens' info from cloud providers, and I don't think the USA would ever completely get rid of FISA while they still have the KICK ME target painted on their backs.

I wish I had a good answer for this. :-/


It's basically been done (ish). Freenet's one, there are probably more, but you give up a lot in exchange. Freenet can be pretty slow and you need to find trusted people to bootstrap yourself into the network. You can't host dynamic content, either.


I think what this has all really indicated is that the law is not ready for the Internet.

I used to think that imbalance disadvantaged the government.

Now I'm not so sure. I wonder if the tech community will be ready to talk about regulation now that the NSA has shown what a nearly-unfettered government agency with a blank check can really do with TCP/IP.


Regulation of the NSA, sure. Regulation of themselves in the form of the FBI's build-in-backdoors-for-surveillance demands, definitely not. The NSA loves CALEA interfaces.

http://news.cnet.com/8301-1009_3-57428067-83/fbi-we-need-wir...


Well, built-in backdoors would be problematic for the same reason admin panel backdoors or Clipper-chip backdoors would be problematic.

But if the Congress end up extending 'reasonable expectation of privacy' to cover any "common carrier" (which I think is long overdue) I'd be very surprised to see them leave out any ability to surveil, wiretap, etc., at least from the major telecoms. That doesn't need to mean backdoors or warrantless snooping though.


Nobody (except the ACLU, if you phrase the question carefully) will say that court-authorized Title III wiretaps violate the 4A. The questions involve the process, standards, procedures, and scope. Telcos + CALEA == a lost cause. Not so with going up the protocol stack.


I was really digging the article until right near the end.

If you think all the NSA could do with extra information is add more "hay" you're not thinking creatively enough.

For example, if you had a system that could scour through essentially infinite amounts of hay and be able to spit out each brown needle that passed through (think keyword filters), then definitely you'd want all the hay you could find, and then even more hay. Of course, keyword filters are fairly easy to avoid if you know they're there, so perhaps we'd call that a wash or even negative overall, as all the false positives make it impossible to be selective to the actual needles.

But there's another use for hay, quite brilliantly demonstrated in Iraq (or maybe it was Afghanistan, or even both, I forget). The idea was that some roads were more likely to have IEDs emplaced than others. So what the Army eventually did was to blanket the area with drones and record along those roads, trails leading to the roads from the nearby cities, etc.

When an IED inevitably exploded, they would go back to the tapes, rewind them until they found the bomber. Keep rewinding (tracking on different feeds if necessary) all the way back to the staging point. Rewind further, all the way back to the cell's meeting site, and the bomber's home.

Repeat this for enough IEDs and you have a picture of where the cell assembles, where they stage out of, who they visit for support, etc.

And then you send teams in all at once to detain that cell, get more intel to piece together what they can of the rest of the network.

The sad reality is that you cannot prevent all terrorism from ever happening, but if you can "play back" a person's interaction with foreign agents you can use that to bootstrap intelligence seeding on that foreign agents other contacts within the U.S. to root out that terror network before they strike again.

Doing all of this requires a lot of hay. Obviously there is a very large risk to civil liberties in the wrong hands if that system is simply left as-is, but it is at least possible to put procedural, legal, and technical safeguards if the people decide that kind of system is worthwhile.

The other part of the article I was disappointed about was the mention of how the NSA (of all agencies) failed to prevent the Boston marathon bombing. Responsibility for domestic antiterrorism would properly fall with the FBI. Tamerlan Tsarnaev was a permanent resident, Dzhokhar Tsarnaev was a naturalized citizen. All indications that I've heard were that Tamerlan essentially self-radicalized (possibly while abroad). Unless one thinks that the NSA is able to read minds of people in Chechnya I'm not sure what the author thinks could have been done.

Russia did warn the FBI (again, not the NSA), that much is true. But in our land of the rule of law, we don't arrest people just because Putin said that they are unreliables. It is unclear exactly how many people Russia have 'warned' the FBI about anyways, or what their criteria are for making those warnings.

But either way, blaming the NSA for missing an attack by domestic terrorists is almost completely missing the point of why we have the NSA, CIA, and FBI all as different agencies. As far as I'm aware no one from any of those agencies has ever claimed that systems as strong as PRISM or even 641A-type arrangements would 100% prevent terrorism, just like our police don't claim to be able to 100% prevent crime.

That doesn't mean that we should simply never try to prevent terrorist attacks from occurring, just as it doesn't mean it's a good idea to fire all the police. You have to evaluate the risk/reward and ROI of each program, keeping in mind that some things are hard to measure in dollars.

For instance, keeping terrorism from becoming so prevalent that the people act for the police state we all want to prevent is a pretty big motivator by itself.


> Obviously there is a very large risk to civil liberties in the wrong hands if that system is simply left as-is, but it is at least possible to put procedural, legal, and technical safeguards if the people decide that kind of system is worthwhile.

No, it is not.

It is not the least bit possible to both collect and protect this massive amount of wide net and graph data for our lifetimes.

Even if you believe that our government is completely benign to you and your family, governments change. I want my kids to live to be 100 years old. It's not possible to have lived 100 years without having lived through either the Civil War or McCarthyism (or both).

> For instance, keeping terrorism from becoming so prevalent that the people act for the police state we all want to prevent is a pretty big motivator by itself.

I get your point but this is basically Battered Spouse Syndrome you're arguing.


> It is not the least bit possible to both collect and protect this massive amount of wide net and graph data for our lifetimes.

Then just don't retain it for our lifetime?

Put all the data for a given year on a given set of drives. Melt them with thermite after the retention period is up. Done.

Given that the data should be encrypted you could almost get away with just destroying the smartcards holding the master decryption keys, but it's probably best to be on the safe side with this.


> Melt them with thermite after the retention period is up. Done.

I get the feeling you've never done this before.

It's not possible to both leave data "on a given set of drives" and do anything useful with it too. If the data is going to be used for anything, ever, it's going to get copied all over the place.

Highly-connected graph data (such as this) is particularly impossible to handle in isolation. For example: http://www.zdnet.com/anger-mounts-after-facebooks-shadow-pro...

Personal data is like highly radioactive toxic waste. It's prone to spills, lives forever, and is much harder to destroy than it is to create.


It's OK if specific data gets copied out pursuant to a warrant. That's what I'd expect for law enforcement, counter-terrorism, etc., and that already happens with our current legal system for investigations. Somehow those don't seem to leak out all the time either.

The point is to ensure that wholesale illegal data mining would not occur.


> The point is to ensure that wholesale illegal data mining would not occur.

I believe the point being argued is to ensure that wholesale illegal data collection does not occur. Especially when that collection is pursuant to questionable warrants issued by a rubber-stamp court and secret interpretations of statutes that are intended to have the widest latitude possible.

The programs at issue here are quite unlike targeted evidence collection that results from standard warrants, against which not many at all are arguing.


Well I'm kind of playing devil's advocate a bit. Mass data mining, though I feel that it could be done safely and would be potentially useful, just strikes me as something beyond what we should expect the government to be doing.

However, it might even be Constitutional. But even with that I don't think government needs to be doing that anyways, and if Congress does feel that's a useful ability to have they should have the major telecoms themselves do it and require a warrant.

But I think for this discussion to advance in Washington it's not good enough to say what we don't want. I mean, I don't want to pay taxes either, but I do. I think we need to move instead to determining what we do want to happen, and having actual reasons behind those wants instead of just "RAH RAH GUBMINT BAD".


Yeah, I realized after continuing to work through your comments what you were doing.

I think there are definitely some issues about which we cannot adequately make decision by defining in the negative. But every so often, a question arises for which it is good enough for the public discussion to be stopped with a resounding, "NO. We don't want that." These programs, I think, are such an issue.

I'm happy to pay taxes and consider it to be a rational burden one ought to fulfill as a responsible citizen of any society. I simply don't like tax dollars going into programs like this, which I do not find meaningfully improve my quality of life, and do find it to violate the Constitution and reasonable expectation of privacy.


The NSA has been caught secretly recording everyone's communication for years, violating the 4th Amendment. James Clapper was caught lying under oath to Congress. Yet politicans are defending them. Who's going to have the power to enforce a retention policy when they're dealing with an agency that potentially has dirt on them, their friends, or their family?


The US has a 95 year copyright term because of Mickey Mouse and entertainment industry lobbying.

Good luck asking the spying industrial complex to hold on to your data "for a limited time only".


Well the NSA claims (I'll stipulate "claims" as it's not as if I could check anyways) that they only hold it for 5 years.

Congress could enforce the matter by just not giving them money to build anything fancier though. Even the NSA has to obey information theory and physics.


Unless I am mistaken, that is only for a specific subset of data. The released policy also includes indefinite retention of encrypted data, even on Americans.

As far as budgets are concerned, when is the last time anything in the intelligence budgets was significantly cut that it affected their operating capabilities?


Do some reading. Congress doesn't actually vote on how much money the NSA gets.


Without answering whether the Iraq war is justified; justifiable tactics in a theatre of war != justifiable tactics at home.

The amount of intrusion and disappearing civil liberties is far too high a cost to pay to try prevent essentially unpreventable terrorist attacks.

I was surprised to read the other day that I have a better chance of dying from cancer caused by airport body scanners (1 in 60,000,000) than I do from dying in a terrorist attack (1 in 90,000,000). Lets "evaluate the risk/reward and ROI" of that program!


Where did 1/90,000,000 come from? Is that per-lifetime, per-person-yr, something else?

Going just from 9/11 a rough estimate give 1:75000 U.S. citizens died, which is significantly different.

But besides, you're looking only at body count... do you think that if major terrorist events were happening with regularity that people wouldn't eventually start to take matters into their own hands?

Even with just 9/11 we in the U.S. saw a wave of anti-Muslim violence, which never really fully stopped. Just ask the Sikh worshippers in Wisconsin.

So part of that risk evaluation needs to include the propensity of the people themselves to lapse either to vigilantism, or to erect the police state themselves, in response to high-frequency terror attacks. The problem being that such a thing will hopefully never have enough evidence to fully support one assumption or the other.


Going just from 9/11 a rough estimate give 1:75000 U.S. citizens died, which is significantly different.

This is cherry-picking. 1 in 75000 died on a given day, but there have been tens of thousands of days where no americans were killed.


That's why I asked for the units, especially as your example is itself a different form of cherry-picking. Most people aren't concerned about being killed by terrorists on each individual day, they're rather not be killed on any of the days. If you include ten years' worth of days in your cohort then you could conceivably kill all Americans in the nation on one bloody day and still be able to say that it only happens 1 time out of 3650.


No, that's exactly what cherry-picking means, because you select the most significant data out of a small, irrelevant sample.

If you want units you should compare risks at least on a yearly basis per person, or on a lifetime basis per person. Then you will see how ridiculously low are the figures for terrorism. But we all know terrorism is not about killing many, it's about generating fear and inducing political effects. And it's used precisely for that by both parties (the aggressor and the victim).


I'm guessing that figure came from Cato's comments on TSA body scanners[1].

[1]: http://www.cato.org/blog/cato-comments-tsa-nude-body-scanner...


You know you can opt out of those scans? I do it all the time. I'm sure you know, but in case, it's no big deal to opt for the pat down. Just show up fifteen minutes early (yet it has only taken at most an extra 5 minute for me -- many times faster e.g. when a false positive on the machine shows up and you're instantly considered a terrorist even if you're a 45 year old fat ass going to the beach).


Exactly. I remember reading about how 12 000 americans die from gun-related homicide every year(not trying to push anti-gun agenda, just thought it's an interesting perspective,as both guns and terrorism are subject to a lot of debate).


> For example, if you had a system that could scour through essentially infinite amounts of hay and be able to spit out each brown needle that passed through (think keyword filters), then definitely you'd want all the hay you could find, and then even more hay.

It doesn't work that way. In a big system with too much diversity, anomalies become indistinguishable from noise and you cannot eliminate noise. This translates in so many false positives that (1) the security agencies will end up spending their resources on investigating innocents and (2) a lot of innocents will suffer from being discriminated, investigated and even tortured.

And another thing - it's a commonly known fact that security agencies have the means to listen and to record phone conversations, ever since the phone was invented. If anything, a would-be bomber would have to be pretty dumb to speak about his actions on the phone or to send unencrypted messages over the Internet. If this stuff still happens only speaks to their level of sophistication, but training on the matter can render whatever "smart filtering" you have useless.


As a supercomputer software engineer, I was well aware of what the NSA could use the data for. I studied graph problems. However, that is not the point of the article. I wanted to focus on the constitutional infractions that deserve attention. I did not want to speculate about what I believe they're doing with the information. Public, informed guesses could harm the acceptable parts of the program.

My point about the Tsarnaevs was that the NSA publicly claimed their domestic-only intercepts were being used successfully to catch terrorists. The point of these whistleblower revelations was that the separation wall between domestic and foreign intelligence created by Senator Frank Church's committee had come down in some cases.


but it is at least possible to put procedural, legal, and technical safeguards

Seriously?


Yes, I sincerely believe that. Think about it. And please, think honestly about it and don't just dismiss it out of hand.

I can give you one example of where controls have been shown to work right off the top of my head: the U.S. military itself. What's to stop the Combatant Commander in charge of USNORTHCOM from taking over the government by force?

At least with this we can use technical measures as well, apply the best crypto modern literature (and, you know, the NSA) has to offer to keep data-at-rest safe from rogue analysts while requiring accountability controls for its use in an investigation.

The problem has been that there don't seem to be many such controls that aren't policy-based in nature. That's a problem. But it's not an insurmountable one either, if we decide to solve it.


You realize that the NSA is a branch of the military don't you?

When the NSA breaks the 4th amendment, goes before Congress and systematically lies about their activities, it is in a very important sense an extra-constitutional military coup happening before our eyes.


I'm well aware of where NSA falls in the government hierarchy.

What part of the 4th Amendment are you saying they broke? It's not PRISM.

It might be 641-A style interceptions, except that those aren't actually covered by the 4th Amendment.

The Verizon phone data might be close, but that's also considered fair game according to the courts. And besides, that has a separate court order anyways, doesn't it?

Remember when the Daily Show played and they ended with the idea that it was surprising that what the NSA was doing wasn't illegal (i.e. that it should be illegal)? Hard to call following the law as it's been explained to them a coup...


> What part of the 4th Amendment are you saying they broke?

The part about "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated"

and "no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized"

It is not OK to just "seize all the data" and "search it later if we feel it's relevant".

> Remember when the Daily Show played

No, I don't watch that show (or any TV really).

> Hard to call following the law as it's been explained to them a coup...

The US Constitution is the highest law in the US. If an action violates the Constitution, it is illegal, by definition.


Thank you for repeating the 4th Amendment to me. What program broke it? Because the courts have held quite consistently that information shared with a third-party is no longer private. Even the "reasonable expectation of privacy" phone booth case is quite different from "Hi Facebook, here's private message for you to send to my friend, oh and all of your advertiser networks and data mining algorithms"

Congress has normally patched that up as new technologies have been introduced by making privacy a legislative requirement (but still not a Constitutional right). But they haven't done that for the Internet yet.

ECPA is the closest thing, but it specifically exempts FISA surveillance (though it does still require a court order if I'm reading 18 USC 119 correctly). While I do agree that Internet usage should probably be considered as de facto reasonable expectation of privacy on the wires I'm not sure that the law is at that point yet.

"Reasonable expectation of privacy" itself was essentially invented by the Supreme Court, so it's not as if there's no precedent for adding restrictions on government surveillance, but I'm not seeing the shortcut around the Constitution here except for 641A types of activities (assuming those are not being done under FISA auspices).


Information shared to a third party that the first party could no longer deem under its control, that is what is no longer considered secret.

This means that yes, the government has perfectly readable access to everything I post on Twitter. That's fine. This does not mean that they have access to the contents of my Livejournal posts that are not shared. While it is a factual assertion that I have shared them to a third party, another, better interpretation is that I have shared them to a contracted vendor with whom I expect privacy, even where I know that they may not be able to access it.

There is case law on physical proxies. If I am the renter of a storage locker or facility that has a lock on it (password), then I have a reasonable expectation of privacy there, even though the storage facility is clearly a third party. Because I have a contract with them, and in that contract, I do not grant wide-open access to my belongings, the storage locker is an extension of my papers and effects.


I get that you and we all have different interpretations of what we would expect privacy to mean. But the government only has the one that it has to go by, the law, and the law was made much more expansive by the USA PATRIOT act and only brought back in a little bit by the 2008 Amendments. I could have sworn that the Supreme Court has had a chance to strike down part of the USA PATRIOT Act by this time and hasn't.

I like your analogy on physical proxies, but I didn't need convincing that information given to a third-party on the Internet deserves a "reasonable expectation of privacy" (up to the limits of the privacy policy itself, though...). I just don't think the law agrees at this point, which is why I'm pushing back against people with the idea that everything the NSA has ever done is illegal.

The law needs fixed, once and for all. I think most of us agree at least in theory that there is a need to handle counter-terrorism and domestic law enforcement so we also need to decide what "features" (if any) are built-in for that.

And then we need to decide how far those laws extend to cover those from outside the U.S.


"But the government only has the one that it has to go by, the law"

Technically, the 'one thing' to go on is the Constitution. Any law that violates the Constitution, plainly read, is not a law at all. No citizen is obliged to abide it, no court is obliged to uphold it, and no agency is obliged to enforce it.

Obviously the world exists in far less black and white terms, but at least portions of "the law" that they are following have been deemed unconstitutional by the courts, which should cast a long shadow of suspicion on the rest of the provisions.

This is why we ought be thankful that Snowden spoke up. Too many people derive their morals from what is or isn't legal, and too many people would accept unconstitutional infringements to the constitution that makes them feel safer. To paraphrase Neil deGrasse Tyson, "I don't fault people for being willfully ignorant, as long as they know they're making a tradeoff for mental comfort - I don't want to be them, but I understand it whenever I can't fall asleep because I'm worrying about the state of things" -- what polls on this issue have shown is that far too many people just want to be governed kindly, which is either an indication of a dumb, complacent society that has lost its fierce American spirit, or is an indictment on all people unilaterally.

"A republic, if you can keep it," implied that there would be work involved. What we've shown over the past few decades is that, as a citizenry, we aren't willing to put that work in.


> What program broke it?

I'm not going to limit my view to an incomplete set of documents written by no-credibility liars and rubber stamped by secret courts. When multiple independent sources, people who actually worked there, come out and say "no it's far far more than even that, they're on a mission to collect everything", I tend to believe them.

So you tell me...

What was the "program" authorizing Room 641A?

How many other "fiber taps" are there? (as alluded to in the PRISM doc)

What data is being collected?

Or rather, what data is not being collected?

The fact that we don't know the answers to these questions because they are being deliberately withheld from us means that we are not "secure against unreasonable searches".


641A? Probably ECPA in conjuction with FISA. Likewise for fiber taps. The real "innovation" there is how much domestic data is allowed to be captured by accident and then minimized later. Might meet with the letter of the law, but definitely not the spirit!

> The fact that we don't know the answers to these questions because they are being deliberately withheld from us means that we are not "secure against unreasonable searches".

Well, the lack of an answer to this isn't what is violating the 4th Amendment. If they answered "we record everything" you'd have your answer but would presumably still feel that your rights are being violated.


If you don't know whether or not your rights are being violated, you're not "free".


Room 641A is in an AT&T facility in San Francisco, not Hanoi. The contents of the communications that have, according to the Klein testimony, been vacuumed up by the NSA in 641A are confidential communications made by Americans who have every reasonable expectation of privacy.

I'm surprised you think, without citing any authority, that 641A and its ilk fail to implicate the Fourth Amendment. The 9th Circuit ruled in December 2011 that a lawsuit against the NSA over room 641A could continue, and it's currently underway in federal district court.

There are also separate lawsuits underway against Verizon for the phone logs.


Well, San Francisco is right on our Pacific Coast, no? That would seem the perfect spot to place something dumping foreign traffic en route to the U.S. before it becomes domestic (assuming the San Francisco facility is the first domestic terminus for those international fiber links).

Obviously such links could include communications by Americans going overseas. This has always been an issue with law enforcement and national security investigations, intended to be solved by "minimization". This is a concession which has not been held to be illegal or Unconstitutional, to my knowledge.

Mind, the way the NSA is using that law at 641A is something I would strike down as being prejudicial to 'reasonable expectation of privacy' overall, but then if it was up to me any "common carrier" would imply a 'reasonable expectation of privacy' by definition.

So hopefully we'll see something concrete come out of the case against the NSA (assuming Congress fails to act first). But at it stands now I think even 641A might be meeting the letter of the law, via FISA (where all the gloves are off), but not the intent or spirit of the law.


It's remarkable that you think the NSA vacuuming up everything that flows through a domestic AT&T facility, per the Klein affidavit, merely "could" implicate Americans' private communications. Why not stipulate that it "will?" Also note that subsequent reporting has said that similar taps are in place at similar facilities, not just in San Francisco.

You might be right that 641A has been blessed by the Sec. 702 amendments to FISA. But the immunization for providers is not absolute; if requests go beyond what the law clearly permits, they're still vulnerable. Look for more litigation on this point.


The lawsuit you're referring to is Jewel v. NSA (http://en.wikipedia.org/wiki/Jewel_v._NSA) under Jeffrey White. I found it interesting that White initially shut down the ISP mirroring Wikileaks, and later reversed his decision less than a month later. From what I hear, it's very rare for federal judges to reverse their decisions. I think this has some potential.


Trust is the central issue, as you are correct that no Snowden leaks have demonstrated illegal activity. Without trust, it's just as easy to argue that the next president can use our secret weapons and will only be prevented from starting a nuclear war because of political policies. We trust the government with enormous power (including enough weaponry to destroy the entire planet and enough surveillance to defend our national interests).

@mpyne: Thank you for the dose of common sense in what has become an unrecognizable hyperbole circus over the last few weeks.


> What's to stop the Combatant Commander in charge of USNORTHCOM from taking over the government by force?

Are you serious?! The US armed forces are comprised of AMERICANS. They're hardly going to turn against their own democratically elected government, it completely goes against everything they believe so strongly enough as to take up arms to protect. That is what is stopping it, not some regulatory checks and balances.


So is Russia running the NSA or am I missing something then?


You are missing the limits that simple practicality has on each scenario.

There is an enormous difference between a military coup and the kind of risks the NSA databases create. A military coup requires tens if not hundreds of thousands of military to agree that potentially killing their neighbors and maybe even own family members is a necessity. For the NSA databases to be abused all it takes is a handful of motivated actors to quietly blackmail specific individuals. Not unlike the FBI tried to do with their surveillance tapes of Martin Luther King.


> For the NSA databases to be abused all it takes is a handful of motivated actors to quietly blackmail specific individuals.

This is a baffling comment. Are you aware of the background checks that NSA do on staff? And the audit-trails on access to various bits of data?


You mean like the background checks and audit trails that prevented Snowden from absconding with all those documents?

Background checks don't stop people who think they are righteous and audit trails are only as good as (a) the audit policies and (b) the auditors. Snowden was pretty explicit with his claims that putting down any half-assed justification was enough to satisfy the auditors.


> For the NSA databases to be abused all it takes is a handful of motivated actors to quietly blackmail specific individuals.

And what if it takes more than a handful? Would such a system be safe then?


Get it up to a couple of hundred and we'll talk. But if you think you can do that simply through process rather than physical design, we won't talk - process can not address the problem of turnkey tyranny.


And in your view, the US army hasn't already been asked, and complied, to shit all over those things, repeatedly? Some soldiers speak out, a whole lot kill themselves, but where is the resistance you speak of?

> it completely goes against everything they believe so strongly enough as to take up arms to protect

Of course this is true for many people. But for all? How many people go to the army because it's a job, or paid for education? How many people could make more in another way, but chose to join the army because they, as you say, so strongly believe in defending their countrymen and the constitution?

I don't mean to say there aren't many brave people who joined the army for all the right reasons. It doesn't even matter what the army is used for, I still respect those people even when they're misled. But exactly because of that I also have to acknowledge the sadists in their ranks, the people who want to be with the invincible team etc. Those exist, and with good enough indoctrination and good enough technology, those are all you need.

Also, the conscience can be routed around by deception just fine; yeah, there's all these idealistic people signing up for the army... and then they get drilled, and some of them start considering civilians as something else entirely pretty fucking soon.

And then there is the not minor fact of increased automatization and focus on robotics. In my worst expectations, the job of the American soldier of today is mostly to keep "the establishment" afloat for long enough until it can kick out the ladder under itself for good.


How do you propose to upgrade the standards from "least untruthful?" Our current safeguards are the butt of that particular joke. The reason you need to beg people not to dismiss the idea out of had is that dismissiveness is all we gave gotten regarding this matter so far.


Well you could make the system(s) themselves report the truth and take the human analyst or supervisor out of the loop completely.

For the rest, there's all sorts of possibilities; 2-man concept, independent review by a supervisor, randomized blind audits by auditors who are themselves double-checked by randomly assigned auditors, periodic audits & surveillances of the analysts themselves to ensure procedural and policy compliance, the list goes on and on. There's not exactly a shortage of government agencies that can be raided for "best practices".

But... I think the reason I have to beg people to not dismiss the idea out of hand is that the conclusion is already mostly formed for many of us. Certainly I would hope that our default reaction to hearing that a massive Internet surveillance program is going on would be WTF??!. But that doesn't stop me from wondering if it can actually be done in a way that does not endanger free society and still protects individual liberties.

And even if it can be done, it would still need to be shown that it's useful to do. But I think many of us have foreclosed on the very idea.


I do want to appreciate your attitude here. I'm sure all those things you mention can and would be gamed, but at least you try to keep fighting instead of giving up. Reading some comments about the PRISM case on HN makes me feel like we should just lay down and die while the world shreds itself apart.


>But either way, blaming the NSA for missing an attack by domestic terrorists is almost completely missing the point of why we have the NSA, CIA, and FBI

No, it isn't. Gov't officials have repeatedly made questionable claims about the efficacy of these programs in support for them, while they have yet to provide any proof of their actual utility.


The sad reality is that you cannot prevent all terrorism from ever happening, but if you can "play back" a person's interaction with foreign agents you can use that to bootstrap intelligence seeding on that foreign agents other contacts within the U.S. to root out that terror network before they strike again.

This is a weak and reactive strategy. The weakness is that you have to wait for an attack to occur. Once an attack occurs, you usually already know who is involved and that should be enough of a lead to go track down people through warrants. We knew Al Qaeda was behind the 1998 US Embassy bombings and the 2000 USS Cole bombing. The mistake we made was in not sharing information with the FBI and CIA after the NSA followed A.Q.

The other part of the article I was disappointed about was the mention of how the NSA (of all agencies) failed to prevent the Boston marathon bombing. Responsibility for domestic antiterrorism would properly fall with the FBI. Tamerlan Tsarnaev was a permanent resident, Dzhokhar Tsarnaev was a naturalized citizen. All indications that I've heard were that Tamerlan essentially self-radicalized (possibly while abroad). Unless one thinks that the NSA is able to read minds of people in Chechnya I'm not sure what the author thinks could have been done.

I think the NSA is increasingly going to be held to a higher standard of working more closely with the FBI and CIA. I don't think moving forward it's going to be a black and white "NSA only does foreign intel, FBI only does domestic intel." That was the Achilles' Heel of 9/11. The NSA was wiretapping, following the hijackers around, and taking photos of them. That's the upper limit of surveillance and we already hit that, yet still failed to prevent it from happening because our intel was lacking the equivalent of a Corpus callosum.

But either way, blaming the NSA for missing an attack by domestic terrorists is almost completely missing the point of why we have the NSA, CIA, and FBI all as different agencies. As far as I'm aware no one from any of those agencies has ever claimed that systems as strong as PRISM or even 641A-type arrangements would 100% prevent terrorism, just like our police don't claim to be able to 100% prevent crime.

You don't exactly know how much we've gained by giving up our privacy, either. So you can't say it's worth it, and even if you could, that's a very subjective thing, so it's whatever people are comfortable sacrificing for some perceived value of security. I'd like to know details about the supposed attacks that have been prevented.


The purpose of the Constitution, at least in theory, is to prevent an uninformed citizenry from having to relinquish its rights, even when they feel it is okay to do so.

That same protection exists to keep the whims of a majority from taking away the rights of a minority. America doesn't have the best track record there (specifically referring to the Japanese Internment), but that doesn't mean that we should allow part and parcel sacrifices of liberty just because the citizenry is okay with it.

If the government is going to violate the fourth amendment, and the people are really that okay with it, then there's a constitutionally defined process for ratifying the Constitution. The bar for that is deservedly high.


I agree Snowden or Greenwald or whoever has the classified stuff needs to tell a compelling story, with a chronology.

Mr. Lee is absolutely spot on when he reminds us that the media and the White House are stealing the narrative. We're now totally focused on a random sysadmin trying to guess what makes him tick. Who cares? What about the criminal activity by the US government he's laid bare for all to see?

I kept hearing all this talk of "free speech" and the 1st Amendment today (thanks Carney), as it is supposed to exist in other countries, even when they lack anything like a US Constitution... good luck with that, and that Snowden's choice of destination is somehow symbolic of his motives. Maybe he's just trying to stay out of jail. Is that so hard to understand?

So I guess we're forgetting all about the 4th Amendment, which is the whole reason he's putting his life on the line in the first place. We need more details from those classified docs, we need a narrative and we need to bring the focus back to mass scale pen registers and warrantless searches. Snowden's case is boring. He's guilty. He committed a felony by disseminating redacted classified material to expose illegality on a much larger scale. Most Americans would be too frightened to do this. He's not the usual. Get over it.

On the other hand, the case of the US government, their conduct and whether it breaks US laws or the spirit of US law, is far more interesting.

Stop worrying about the rights of people in other countries and start worrying about the rights of Americans, who are extremely lucky to have an amazing Constitution, which used to be a model and the envy of the world.


This reads like an essay from a freshman poli-sci class. The only unique thing about this post is the lame humblebrag or whatever about the author playing videogames with Snowden. But of course it's besides the point. It's so irrelevant that it has to go in the headline and link title.

A software dev speaking outside of his area of expertise to amplify the echo chamber while getting hits for his blog isn't enriching the debate.


Not that my own comment here is helping anything. I'm just weirded out by the fact that people aren't being critical of these empty echo-chamber posts that keep popping up. They make this place feel like it's just reddit's politics section being paraphrased by web developers trying to self-promote.


"I have learned that people decide what they think based upon narratives. A good story always has better results than merely listing out facts. Every good narrative has both characters and a plot."

I was listening to a podcast the other day where one of the people said that if people were solely interested in facts the phone book would be the most interesting book in the world.


Sorry, the phone book contains data (witch should also be facts), but I'd consider it more data, then facts.


Is "fact" not in some cases a synonym of "data"?

"Qantourisc; 144" might be read as data while "Qantourisc registered on HN 144 days ago" might be read as a fact.


I personally won't be happy until I see all fiber splitters installed by the NSA completely removed (such as the one at 611 Folsom Street in San Francisco). Move it back to San Luis Obispo.

I liked the reference to The Spy Factory (http://www.youtube.com/watch?v=RyoeOM22WCc) in this article, and I find it interesting that the NSA had been surveilling Al Qaeda for 3 years leading up to 9/11, and had more than enough data gathered on them. They were taking photographers and following two key hijackers--that's like the upper limit of surveillance, and they hit it. The mistake was not that they needed more, it was that they intentionally did not communicate any of those details to the FBI or CIA once two key hijackers were in the U.S. Fix the communication, not the collection.


I see a lot of articles about who is or isn't Snowden, what he did, where he was and where he'll go. But I don't see anything about the NSA and what's going to change with PRISM. A lot of noise about him just to hide the fact that in the end nothing will really change?


> I Knew Snowden. And He’s Not The Story

And yet this article seems to add nothing new to the discussion other than some nice anecdotes about how Snowden played video games and was an everyday person like us. Not much substance here.


I recalled the dialogue from the film The Watchmen.

> The Comedian: What happened to the American Dream? It came true! You're looking at it!


I am sorry, I know that it's not that important, but I just find Where Is Snowden Adventures so exciting to watch. It's like reading an adventure novel, only in real time, real life and with larger-than-life characters like Assange and that NSA general.


Somewhat irrelevant but anyone else think Medium's URLs are really ugly? Why can't you just get a plain pretty subdomain? I'd use it if it were that.


Are you working for the government?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: