8 ms·

> There is absolutely an audit trail, including non-repudation for the analyst who performed the query (They must use their smartcard or "PKI"). What do you m

> There is absolutely an audit trail, including non-repudation for the analyst who performed the query (They must use their smartcard or "PKI"). What do you make of Snowden's assertion that he could have eavesdropped on anyone he wanted? Was he failing to mention that his actions could be audited? Was he failing to mention that he had access to someone else's PKI with which to do the surveillance? Other? Assuming you have knowledge of how the intelligence agencies work: - Which agency is the process you described applicable to? - Are you certain it is the same in other agencies? - Are you aware of any loopholes (or might Snowden have been?) which would have allowed it to happen without consent from higher level officials? I do not have a belief one way or another about whether Trump was "wiretapped". My intent was to apply the logical consequence of the Snowden revelations to the issue being discussed, and flag the FISA warrant argument as a straw man.

squallviii 10y ago
Here's another perspective on Snowden's claims https://www.thecipherbrief.com/article/exclusive/first-cipher-brief-snowdens-boss-shares-lessons-learned-1095 https://www.thecipherbrief.com/article/exclusive/first-ciphe... He was a Sharepoint admin with access to Office type files. This is why you don't see raw intelligence from his leaks. From my own experiences working at the agency, GP is correct in that very few people can task FISA data.
- grandalf 10y ago
  > He was a Sharepoint admin with access to Office type filesHe was a Sharepoint admin with access to Office type files. I wish he were a participant on HN so he could chime in here and defend himself. My impression is that he held several jobs over a few years which gave him access to more of the breadth of what was going on. Surely after the revelations more security checks would have been implemented. But the other instances of large caches of leaked material suggest that there are not effective internal controls. As a thought experiment, I'd suggest that the small size of teams required to maintain security, combined with a 'need to know' rule, results in an environment where creating an internal audit trail puts operational security at risk, and so it is avoided. All the anti-Trump leaks suggest that this is true, since surely Trump would have asked who had access to the leaked information, and the list would have been small enough (b/c of need-to-know) that he could have made a spectacle of the leaker.
  - irishcoffee 10y ago
    > My impression is that he held several jobs over a few years which gave him access to more of the breadth of what was going on. This is your impression because it's the impression people want you to have.
    - grandalf 10y ago
      > people want you to have. Well, putting aside the observation that the documents speak for themselves, and ignoring the inaccurate claims made by leaders to the American people about surveillance, what impression should I have?
      - willstrafach 10y ago
        I believe that was a (not so nice) way of saying that Snowden had intentionally exaggerated his history in order to establish himself as more of an authority on these matters regarding things he did not actually have access to. Personally, even if I disagree with most of what he did, I think that specifically was an understandable move as he seemed to be genuine about his beliefs and desire to spread his message.
      - lern_too_spel 10y ago
        The documents agree with the person you're arguing with and disagree with you and Snowden.
        grandalf 10y ago
        examples? There was not really any press vetting of the information so it's been difficult to evaluate the claims. I do think it's troubling that major news orgs won't go near the details.
willstrafach 10y ago
> What do you make of Snowden's assertion that he could have eavesdropped on anyone he wanted? Was he failing to mention that his actions could be audited? Was he failing to mention that he had access to someone else's PKI with which to do the surveillance? Other? I think he was not really telling the truth. And I don't mean that he intended to be dishonest, but rather, he was trying to explain the issue as he understood it in a simplified manner. My understanding is that he did not actually have access to XKEYSCORE and other tools, so he did not known how they actually worked and the associated red tape. He could only go by what the presentation slides that he downloaded from NSA had said (I am assuming that those slides did not describe much regarding the associated red tape because it was meant for those who had already been read in and had access to the program so they would have already been fully aware of the legal and compliance side of things, along with continuous training and review of the Constitution). Snowden had to get the materials regarding programs he didn't have access to by authenticating with the smartcard/PKI of colleagues who did have access to those systems (Source: http://msnbcmedia.msn.com/i/msnbc/sections/news/NSA_Snowden_Memo.pdf http://msnbcmedia.msn.com/i/msnbc/sections/news/NSA_Snowden_...). > Which agency is the process you described applicable to? NSA. I don't think there would be another agency with access to this alleged wiretap. > Are you certain it is the same in other agencies? I am not certain. I do believe it is the case though, as my understanding is that DoD and IC IG have this authority not specifically NSA (If you are aware of an agency not properly protecting USPI as they should be, the IC IG would definitely want to hear about it, I am very serious). > Are you aware of any loopholes (or might Snowden have been?) which would have allowed it to happen without consent from higher level officials? I am not aware of any, so definitely cannot conclude that they do not exist. There could possibly be a case to be made there, as the "data" versus "metadata" debate awhile back demonstrated that some things are interpreted in a way that could allow for overreach. I personally don't think it is productive to assume that loopholes were utilized until there is evidence of that. Additionally, any loophole would be for accessing the information but the way the system is setup at least these days would not allow for that to occur without an audit trail ("tag the people, tag the data!"). > the FISA warrant argument If I understand correctly, the following still could have happened and I don't know if anyone has disputed it: 1. Trump associate spoke to someone who was subject to FISA collection or regular collection of a foreign target of interest. 2. Topic was discussed which specifically related to the US Person (Trump associate) which was serious enough to warrant de-minimization of the USPI. 3. The proper process was followed, and the evidence was solid enough to de-minimize the US Person's side of the conversation. This interestingly would mean that (1) it was serious enough to warrant de-minimization but not enough to be conclusive proof of malice, which is something that anti-Trump folks would not want to hear, and (2) it was a discussion of interest involving an intelligence collection target, which is something that pro-Trup folks would not want to hear. Therefore this potential exact scenario is not within the interest of either side and I have not heard it discussed much. There are many possibilities, some which are politically convenient to either side, others which are not convenient to either side. It might be mildly amusing to discuss but as far as I understand, an actual investigation into this is going to occur and either we will get answers to all of this based on a comprehensive audit of those who accessed the intercepts and/or was responsible for the tasking.

squallviii 10y ago

Here's another perspective on Snowden's claims https://www.thecipherbrief.com/article/exclusive/first-cipher-brief-snowdens-boss-shares-lessons-learned-1095 https://www.thecipherbrief.com/article/exclusive/first-ciphe... He was a Sharepoint admin with access to Office type files. This is why you don't see raw intelligence from his leaks. From my own experiences working at the agency, GP is correct in that very few people can task FISA data.

grandalf 10y ago
> He was a Sharepoint admin with access to Office type filesHe was a Sharepoint admin with access to Office type files. I wish he were a participant on HN so he could chime in here and defend himself. My impression is that he held several jobs over a few years which gave him access to more of the breadth of what was going on. Surely after the revelations more security checks would have been implemented. But the other instances of large caches of leaked material suggest that there are not effective internal controls. As a thought experiment, I'd suggest that the small size of teams required to maintain security, combined with a 'need to know' rule, results in an environment where creating an internal audit trail puts operational security at risk, and so it is avoided. All the anti-Trump leaks suggest that this is true, since surely Trump would have asked who had access to the leaked information, and the list would have been small enough (b/c of need-to-know) that he could have made a spectacle of the leaker.
- irishcoffee 10y ago
  > My impression is that he held several jobs over a few years which gave him access to more of the breadth of what was going on. This is your impression because it's the impression people want you to have.
  - grandalf 10y ago
    > people want you to have. Well, putting aside the observation that the documents speak for themselves, and ignoring the inaccurate claims made by leaders to the American people about surveillance, what impression should I have?
    - willstrafach 10y ago
      I believe that was a (not so nice) way of saying that Snowden had intentionally exaggerated his history in order to establish himself as more of an authority on these matters regarding things he did not actually have access to. Personally, even if I disagree with most of what he did, I think that specifically was an understandable move as he seemed to be genuine about his beliefs and desire to spread his message.
    - lern_too_spel 10y ago
      The documents agree with the person you're arguing with and disagree with you and Snowden.
      - grandalf 10y ago
        examples? There was not really any press vetting of the information so it's been difficult to evaluate the claims. I do think it's troubling that major news orgs won't go near the details.

willstrafach 10y ago

> What do you make of Snowden's assertion that he could have eavesdropped on anyone he wanted? Was he failing to mention that his actions could be audited? Was he failing to mention that he had access to someone else's PKI with which to do the surveillance? Other? I think he was not really telling the truth. And I don't mean that he intended to be dishonest, but rather, he was trying to explain the issue as he understood it in a simplified manner. My understanding is that he did not actually have access to XKEYSCORE and other tools, so he did not known how they actually worked and the associated red tape. He could only go by what the presentation slides that he downloaded from NSA had said (I am assuming that those slides did not describe much regarding the associated red tape because it was meant for those who had already been read in and had access to the program so they would have already been fully aware of the legal and compliance side of things, along with continuous training and review of the Constitution). Snowden had to get the materials regarding programs he didn't have access to by authenticating with the smartcard/PKI of colleagues who did have access to those systems (Source: http://msnbcmedia.msn.com/i/msnbc/sections/news/NSA_Snowden_Memo.pdf http://msnbcmedia.msn.com/i/msnbc/sections/news/NSA_Snowden_...). > Which agency is the process you described applicable to? NSA. I don't think there would be another agency with access to this alleged wiretap. > Are you certain it is the same in other agencies? I am not certain. I do believe it is the case though, as my understanding is that DoD and IC IG have this authority not specifically NSA (If you are aware of an agency not properly protecting USPI as they should be, the IC IG would definitely want to hear about it, I am very serious). > Are you aware of any loopholes (or might Snowden have been?) which would have allowed it to happen without consent from higher level officials? I am not aware of any, so definitely cannot conclude that they do not exist. There could possibly be a case to be made there, as the "data" versus "metadata" debate awhile back demonstrated that some things are interpreted in a way that could allow for overreach. I personally don't think it is productive to assume that loopholes were utilized until there is evidence of that. Additionally, any loophole would be for accessing the information but the way the system is setup at least these days would not allow for that to occur without an audit trail ("tag the people, tag the data!"). > the FISA warrant argument If I understand correctly, the following still could have happened and I don't know if anyone has disputed it: 1. Trump associate spoke to someone who was subject to FISA collection or regular collection of a foreign target of interest. 2. Topic was discussed which specifically related to the US Person (Trump associate) which was serious enough to warrant de-minimization of the USPI. 3. The proper process was followed, and the evidence was solid enough to de-minimize the US Person's side of the conversation. This interestingly would mean that (1) it was serious enough to warrant de-minimization but not enough to be conclusive proof of malice, which is something that anti-Trump folks would not want to hear, and (2) it was a discussion of interest involving an intelligence collection target, which is something that pro-Trup folks would not want to hear. Therefore this potential exact scenario is not within the interest of either side and I have not heard it discussed much. There are many possibilities, some which are politically convenient to either side, others which are not convenient to either side. It might be mildly amusing to discuss but as far as I understand, an actual investigation into this is going to occur and either we will get answers to all of this based on a comprehensive audit of those who accessed the intercepts and/or was responsible for the tasking.