Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
NSA Response to XKEYSCORE allegations (nsa.gov)
98 points by md224 on July 31, 2013 | hide | past | favorite | 77 comments


Remember also that the NSA has several programs split up to hide and deny what they do:

Bruce Schneier: "The agency has been playing all sorts of games with names, dividing their efforts up and using many different code names in an attempt to disguise what they’re doing. It allows them to deny that a specific program is doing something, while conveniently omitting the fact that another program is doing the thing and the two programs are talking to each other."

http://blog.ted.com/2013/07/17/security-experts-on-the-nsas-...

http://www.schneier.com/blog/archives/2013/07/more_nsa_coden...


I find it fascinating that they are essentially corroborating everything Greenwald and Snowden have said, except just being nitpicky on tone and scope. Especially this:

"One feature is the system's ability to limit what an analyst can do with a tool, based on the source of the collection and each analyst's defined responsibilities. Not every analyst can perform every function, and no analyst can operate freely."

I seem to remember almost those exact words coming from the first Snowden interview:

"Any analyst at any time can target anyone, any selector, anywhere. Where those communications will be picked up depends on the range of the sensor networks and the authorities that analyst is empowered with. Not all analysts have the ability to target everything. But I sitting at my desk certainly had the authorities to wiretap anyone from you or your accountant to a Federal judge to even the President if I had a personal e-mail."


I'm going to file these paragraphs away, so the next time I need to bullshit someone, I'll have some great examples. Not only do they hire the best mathematicians and scientists, but I'm sure there's an English major or two.


"no analyst can operate freely" would contradict Snowden's assertion that he personally could target anyone


Where freely means...? Maybe many analysts can do almost everything, except access personal details of higher ranking NSA officials. Without a proper definition it's a meaningless statement.


Snowden wasn't an analyst


As a system administrator Snowden presumably had lower-level access to the systems than analysts.


Incorrect (former NSA system administrator here). We're "read on" to special compartments beyond the scope of our need to know due to the nature of our work. It would be quite difficult for me to correct an issue if I was unable to see and/or duplicate that issue.


What permissions low level analysts have or don't have is pretty low on the list of things to worry about. I'm a lot more worried about the people at the top who set up this horrifying system in the first place, have lied about it at every opportunity, have access to the full scope of the information, and can use it to enact whatever deranged schemes enter their deranged power-mad brains.


Quite right, I am less concerned about my nosy-neighbor who happens to be a low level NSA analyst and more concerned about a hypothetical J Edgar Hoover Jr.


Your neighbor's ex-wife, on the other hand...


I don't give a shit how much training these people get, the very fact that a gigantic database of potentially all Internet traffic exists is itself a threat to freedom, open society, and the rule of law.


The point at the beginning of the press release is that gigantic database doesn't exist. According to the government, they only collect data that has been authorized by a court, which includes large scale metadata collection like call logs or email headers passing through international cable landing sites in the US (collection that stopped in 2011 according to the leaked documents) together with full data with realtime monitoring from certain US-based internet companies for specific users under a surveillance court order.

Access to that data is severely restricted and audited according to this document.


I've got a bridge to sell you. Interested?


Judging by the history of the past 40-50 years, we Americans love being tricked, over and over again.


You're making yet another extraordinary claim without any proof.


I would say that specific statements by multiple whistleblowers constitutes evidence, if not proof.


It doesn't matter anyway, the burden is not on citizens to prove that the government is spying on them, the burden is on the government to prove to the citizens that it's no longer lying to the society.


As are you.

How many times are you willing to allow someone, or some agency, to repeatedly lie to you, before you decide to become skeptical?


p(The NSA is lying|we've already witnessed them lying to Congress)?


"according to the government ..."

I guess some of us can never get past that point. Remember the WMD's? No, I guess not.


I don't understand this argument. I know there were in fact no WMDs found in Iraq, but I believed the government when they said that they had reason to think there were.

So it turns out there weren't, and going in was a big mistake. Great, lets all viciously attack (I'm not saying you did this, but definitely many others with your same opinion have) the government for making a mistake.

And now we wonder why they try to lie and completely cover-up/distort reality. Because we as voting citizens are totally unwilling to forgive our elected officials for making mistakes.

Obviously that mistake was massive, tragic, and deadly. But it still was, I believe a, mistake. Maybe there's something to this issue that I don't know yet, but to me "according to the government" does not immediately correspond to "the government's blatant double-speaking lie".


There was plenty of evidence prior to the invasion that Iraq did not have weapons of mass destruction, or that if they did they would be almost unusable because of age.

Information about this came out not only through organizations like the FAS (you may not have read about this in the NYTimes, but don't blame the opponents of the war for this), public statements by diplomats and civil servants (i.e. David Miller), the pressure to recall UN investigators (who were skeptical of the existence of such weapons), and evidence of deliberate fraud in pushing for war as in the yellowcake uranium setup, Colin Powell's presentation to the United Nations on "mobile weapons factories", or Dick Cheney's efforts to take control of intelligence work when the results were skeptical of his claims that WMD existed.

The only actual evidence in favor of the hypothesis that Iraq might have WMD was that the country had not accounted to the UN investigators for the disposal of some dual-use chemicals the United States had sold them during the Iran-Iraq war. They claimed these materials were already destroyed and so could not document their destruction, which seems - in retrospect - to have been the case. Either way, if I remember correctly, these materials would have been almost if not totally unusable given their age.


I believed the government when they said that they had reason to think there were.

They did not just say they had reason to think there were, they said they were there:

Dick Cheney, Speech to VFW National Convention (August 26, 2002): "Simply stated, there is no doubt that Saddam Hussein now has weapons of mass destruction."

Ari Fleischer, Press Briefing (January 9, 2003): "We know for a fact that there are weapons there."

Gen. Tommy Franks, Press Conference (March 22, 2003): "There is no doubt that the regime of Saddam Hussein possesses weapons of mass destruction. And . . . as this operation continues, those weapons will be identified, found, along with the people who have produced them and who guard them."

Donald Rumsfeld, ABC Interview (March 30, 2003): "We know where they are. They're in the area around Tikrit and Baghdad and east, west, south and north somewhat."


Was it a mistake, or did the USA conveniently expand their military presence?


I don't know and presumably neither do you. I'm not saying we shouldn't question the government, I'm just saying we shouldn't automatically assume ulterior motives. Coming up with theories of ulterior motives is easy. Proving them is hard, and preventing them is even harder.


The UK government didn't believe it, and didn't believe it was a mistake: http://downingstreetmemo.com/memos.html


Ah yes, they don't have the gigantic database...but do they have a shit-ton of databases that effectively comprise a gigantic database?


Threat to freedom, eh? Isn't that what we used to invade Iraq?


Forgive us for not trusting you when a few weeks ago you denied under oath that this capability even existed. We may have a short memory as a country, but not that short!


I think you'll find that most people in the USA still do not have any real concern about the NSA/Snowden/XKEYSCORE/etc. situation, other than perhaps amusement that a "traitor" who leaked classified information and is agitating for more freedom is now holed up in Moscow of all places.

Perhaps some parts of the NSA's programs will eventually be forbidden by the courts, but even then the vast majority of Americans won't care one way or the other. They want cat videos. They don't care if the NSA is monitoring their facebook chats. They think they're innocent of anything and everything. They don't understand the potential consequences, under this government or under some future government that gets to enforce even more laws even more aggressively.


I'm an American, and I am greatly concerned that our government has overstepped its mandate as well as abrogated the public trust by perpetrating this travesty.

I never considered Snowden to be a "traitor," I consider him to have made a great sacrifice in order to bring this situation to light, especially since the past revelations flew right under the radar, so to speak, regarding the AT&T revelations years ago.

Sure I like cat videos, and other inane content, but I also am abhorred by dragnet surveillance.

I completely understand the possible consequences of such surveillance, and am dismayed when people cite "Godwin's Law" whenever I draw parallels between the current spy atrocities and those of the Stasi.

I fully realize that our next president could have even fewer reservations than Obama about furthering this draconian system as well as ramping up the encroaching police state we see here today.

Thus I refuse to cease talking about this issue, as I want people to be aware of just how slippery this slope actually is.


Fine, great, terrific, sounds good, like we can trust the NSA.

Reading this about all the protections, now that we know at least some of what Snowden did, we're talking high comedy.

While all those internal checks, balances, controls, ethics, assurances, etc. sound good, they are all too easily just self serving BS.

We need to keep our eyes on the point, the main point, the crucial point which is: If they grab data on US citizens without a proper warrant, then lots of US citizens will conclude that the NSA is in violation of the Fourth Amendment, with all the NSA assurances irrelevant. Stop. Period. Guilty. Done.

I as one US citizen greatly prefer the Fourth Amendment to any contributions to my safety that might be provided by the NSA and however proper the NSA makes their activities sound. Did I mention I like the Fourth Amendment?


The problem with every explanation from any intelligence agency ever is that they are extremely motivated to keep everyone else uninformed. To that end, they have demonstrated their willingness to disinform everyone, including congress. Once faced with damning evidence that they lied, they conveniently redefined a universally understood verb, and said that they _had_ to mislead us. They also want us to know that they thought this whole incident was "cute".

If you can lie to congress, and suffer no meaningful consequences, how can any reasonable person have any meaningful level of confidence in the accuracy of any statement that you have ever made or will ever make?


>all of our analytic tools are aimed at information we collect pursuant to lawful authority

The use of the word "lawful" is slick and misleading. They "own" a rubber stamp court that never says no and re-interprets laws to their liking.

So, virtually whatever they want to do is "lawful" by definition.


Can't upvote this enough. They reprogram their language at their whim. #define lawful ..


Sometimes the law is wrong.


> This training not only covers the mechanics of the tool but also each analyst's ethical and legal obligations.

Which means, of course, that analysts can operate outside of their ethical and legal obligations. And to me, that is the foundation of the issue. Who pays what analyst in DC to dig up dirt?

And to the statement that access is audited... how many analysts were fired for overstepping their ethical obligations? Is that information collected or released?


I think you misread. They stated specifically that every search is fully auditable. In NSA speech, that means that no audits of any sort are ever performed; searches are only auditable, never audited. This works similar to the collection of domestic data, which is siphoned off, stored, replicated and indexed, but never actually accessed by anyone.

(Some of the screenshots suggest that the legitimation for every search is entered into a free text field, making any kind of automated analysis extremely difficult. This already suggests that no such statistics are collected.)


An audit is meaningless when conducted by the very organization being audited.


Who should do this kind of audit? The GAO is part of the legislative branch, not the executive branch, but presumably they wouldn't have enough "clearance".


That's the problem, and that's why these programs should be terminated. An un-auditable spy agency answerable only to the President is manifestly unconstitutional, dangerous, and wrong.


>An un-auditable spy agency answerable only to the President

i somehow think that its answerability to the President is overrated. Presidents come and go, the machine continues humming :)


I think the lack of faith in public officers to follow the law can be disconcerting. I don't think everyone will follow all the laws all the time, but if you just assume that laws will be broken consistently, then you enter into a loop of cynicism to where you basically cannot have any form of public structure.

Assuming that agencies will at least try to follow the law is rule of law 101. Passing new legislation concerning the audit procedure, for example, could solve a problem you mention.


Remember, these are the people who ran off to Ashcroft's hospital bed when the acting AG wouldn't sign off on their spy program.


> And to the statement that access is audited... how many analysts were fired for overstepping their ethical obligations? Is that information collected or released?

I wish it were public. Apparently analysts do get caught and fired for mundane things like looking up ex-wives so apparently someone is checking. But that doesn't mean everything is being audited either.


Under the NSA's definition of 'foreign', a 51% likeliness of foreignness (a coin flip plus 1%), they only target foreigners. Use tor, there is the 1%. Speak a language other than English, gosh that must be worth 10%.

This goes on word after word. The NSA statements are blatantly false. They can only even pretend it is true by twisting words so far they no longer resemble their actual meaning.


     Allegations of widespread, unchecked analyst access to NSA collection data are simply not true. Access to XKEYSCORE, as well as all of NSA's analytic tools, is limited to only those personnel who require access for their assigned tasks. Those personnel must complete appropriate training prior to being granted such access -training which must be repeated on a regular basis.
I call bullshit!

If what the professional liar's agency says is true, how do they explain an admitted low level analyst, working for a non governmental 3rd party corporation, gaining access to the alleged trove of NSA secrets claimed by Snowden?


Presumably statements about what is and isn't being "collected" are based on a twisted and non-intuitive definition of the word.


The NSA keeps saying that no one is abusing this program. That's completely beside the point--the point is that this program shouldn't exist at all.


Yeah, the program it's self is the abuse.


I like how the slogan at the bottom of the page looks like one of those "How useful did you find this article?" questionnaires on Microsoft's site:

http://www.nsa.gov/public_info/_images/slogan.jpg

"Four stars! Would trust again!"


My favorite slide from Greenwald's article was the justification field from the Search Email Addresses Query [1].

It's a one line field. With an addition one line field for "Additional Justification".

This press release is actually expansive by comparison to their typical justifications.

[1] - https://s3.amazonaws.com/uploads.hipchat.com/17859/77014/djo...


> Not every analyst can perform every function, and no analyst can operate freely. Every search by an NSA analyst is fully auditable, to ensure that they are proper and within the law.

Didn't Snowden specifically deny that this is true?


No, Snowden even mentioned that the audit rate was rather low. 2% or 8% or something like that, and elsewhere in this thread someone pasted a direct quote of his that analysts are indeed not given full permissions to do anything.

But the NSA is saying that all analysts don't have full powers; that doesn't mean that the permissions they do have are not still overly broad, or that programs like these don't need much more transparency.

You can't so much as send a nuclear ship to sea without their engineering department being audited (almost literally) up the ass to verify they won't break the reactor, so there's surely more that Congress and DoD can do to ensure proper oversight of the NSA.


No, he specifically said that not everyone can perform every function. He's also as far as I know not claimed the searches aren't auditable - I believe he even claimed that audits do happen, but that they're mostly along the line of "that excuse is flimsy, let's figure out how to make it sound less flimsy" rather than any real oversight.


Snowden wasn't an 'analyst'. And there may only be 13 analysts with FULL access. However, there are literally thousands of IT admins with ADMIN access. Which, most of us around here know, is actually a step above full access.


Lies, lies and lies... The sad thing is everything they have already done CAN be and could have been done by respecting laws. Its just easier to break them when you are nearly untouchable.


What caught my attention was the use of "analytic tools" as a euphemism for "surveillance tools." One could dismiss it as corporate-speak or techie-speak, but it rings in my head more like newspeak, and you know the purpose of that.

http://en.wikipedia.org/wiki/Newspeak


Over 300 terrorists!


For example, as of 2008, there were over 300 terrorists captured using intelligence generated from XKEYSCORE

This is so completely meaningless of a statement it should be a crime to have it on a government server. They give a number without any background to support it. I want the fucking names of these terrorists. Every single one. And I want to know what happened, how they were pursued/captured/convicted/terminated.

If I wrote shit like this in my career, it would be my ass. But when the government does it, I'm just supposed to accept it?!

This is Orwellian.


And even better, they make really sure that they will stay locked away: http://www.bbc.co.uk/news/world-asia-23493323

On one hand, they tell us that they need to monitor everything to catch terrorists, and on the other hand, they don't seem to care that they can walk away once they're caught.

I find that really strange.


As of 2008: "For example, as of 2008, there were over 300 terrorists captured using intelligence generated from XKEYSCORE."

Anyone have an idea why they'd give a 5-year-old figure? One would hope that the figure as of 2013 should be more impressive?


It's the same figure which was in the leaked documents from 2008 that points to some NSA/CSSM 1-52 document from 2007 as a basis. Perhaps they feel that this is the only justifiable piece of "statistics" they can provide at the moment. Though since the document was apparently OK to relay to foreign nations, this is likely another case of the "least untruthful" thing can say.

Reference 1st and 28th pages of: http://www.theguardian.com/world/interactive/2013/jul/31/nsa...


"...captured using intelligence generated from..." is another of those trick phrases.

It doesn't clearly imply that without the program they wouldn't have captured those terrorists.

It doesn't clearly imply that any reduction in scope of xkeyscore would have let some of those 300 terrorists escape capture.

All it means for sure is that data from xkeyscore is part of the picture they looked at of those 300 terrorists leading up to their captures.

I wonder how many bona fide terrorists the government captured from 2001-2008.


> "...captured using intelligence generated from..." is another of those trick phrases. > It doesn't clearly imply that without the program they wouldn't have captured those terrorists.

Those are excellent points, and I wish they were raised more often. I'd like to add one more: How many of those captured were terrorists only thanks to your own government setting them up for the task first? In other words, how much of this was the result of "manufactured terrorism", ála FBI? (ref: http://www.motherjones.com/politics/2013/01/terror-factory-f... and the earlier article linked from the story.)

After all, the actors in those programs still needed to communicate. Judging by the two articles the subjects weren't particularly bright either, so they probably would not have known how to protect their communications. Thus they were bound to generate material that would be scooped up the NSA programs. The fact that the plots were not only known in advance, but planned by your own government officials simply ensured that they would know with perfect accuracy where to look and what to look for.

A naked figure of "300 terrorists captured" is therefore meaningless, just like you said. Without a futher breakdown, the figure just feels like marketing.

As an odd side note - this makes manufactured terrorism look a bit like astroturfing. A scary thought.


oh god, how many billions did this program cost? I wonder what the dollar figure on cost per capture is, even assuming all 300 were legitimate. of course in reality they could just as easily have been thought crimes. no way to know.


I think that giving 2013 figure would imply they are still using it. They want to give as little information as possible


Depends on what "we" define a terrorist as.


OH WELL THEN. Everything's fine. Carry on!

eyeroll


Seriously, I thought there was like mass surveillance and all that stuff going on. But it's all clear now. This is about national security. And oh, thing about the kids!


Vimium shortcut: "HA". I'm amused, yet terrified, at their response.


NSA, short for:

Nope, not Saying Anything.


That's the NNSA. They're in the important business of nuclear stockpile management.


"Moxie Marlinspike ‏@moxie 8h

Gen Alexander says that we shouldn't worry about NSA collection because analysts have taken a pledge. Also, they took a class."


Pledge, oath, bullshit. I believe Clapper was under oath when he lied to Wyden about this stuff in the first place.


I pledged to abide the rules in my car, but somehow I still wound up with a speeding ticket. These assholes are doing 95 in a schoolzone during afternoon pickup, where the hell are the cops when you need them?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: