5 ms·

Data acquisition methods in order of highest probability: 1. ^ This. 2. Was actually public information; story details lost in transmission or translation. 3

by rl3 13y ago

Data acquisition methods in order of highest probability: 1. ^ This. 2. Was actually public information; story details lost in transmission or translation. 3. Her phone was still logged into Facebook. 4. They gained access to Facebook via links in e-mail. [...] 10. Normal federal law enforcement powers. 11. Special federal law enforcement powers, e.g. Patriot Act. [...] 100. NSA data that requires TS/SAP + full-scope poly to access.

zmitri 13y ago
They do sometimes ask to see your phone.
- loup-vaillant 13y ago
  Do you recall any specific story where they ask you to unlock it?
  - cantos 13y ago
    All electronic devices are subject to search at the U.S. border. http://www.dhs.gov/sites/default/files/publications/crcl-border-search-impact-assessment_06-03-13_1.pdf http://www.dhs.gov/sites/default/files/publications/crcl-bor...
    - fnordfnordfnord 13y ago
      No. (Thank the stars for Alex Kozinski). http://www.techdirt.com/articles/20130308/13380622263/9th-circuit-appeals-court-4th-amendment-applies-border-also-password-protected-files-shouldnt-arouse-suspicion.shtml http://www.techdirt.com/articles/20130308/13380622263/9th-ci...
      - cantos 13y ago
        Let me be more specific. All that is required is "reasonable suspicion" in order to require access to all the files on your computer, unencrypted. "Reasonable suspicion" is a very weak requirement, as you can see from the document linked to in the techdirt article, and is exactly the same as what is needed for an extended physical search or an extended search of non-electronic property. In other words, there are no special considerations that apply to property just because it is electronic.
  - llamataboot 13y ago
    Israel regularly makes people log into email and social media accounts. http://www.huffingtonpost.com/2012/06/04/israel-airport-email-search_n_1569163.html http://www.huffingtonpost.com/2012/06/04/israel-airport-emai...
    - darklajid 13y ago
      Oh, don't get me started.. I still cringe about multiple 'turn on the computer' scenes in Tel Aviv, where 'turn it on' obviously (..) wasn't satisfied by pressing the button, nor by logging in: I had to 'open a file, just any file' (the clueless guys would be impatient by now, being annoyed by my failure to understand this useless requirement). Usually I chose a default windows wallpaper -> Done. Braindead, waste of time.
      - simonh 13y ago
        It's fairly easy to rig a laptop display to a micro controller just clever enough to run a login screen simulator, gut out the actual computer electronics and battery, and replace them with contraband or a bomb. Tel Aviv security, which I've been through several times, want to be sure the computer is of the kind it's supposed to be. Login screen simulators are old tech. Friends of mine used to run them on the terminals at the college I studied at in the 80s to harvest other student's account details. Nowadays they're a lot more sophisticated. If you think you know more about security than the Israelis you're sadly mistaken.
        jlgreco 13y ago
        I mean, if you were willing to invest that sort of effort, it might even be easier just to put the innards from a modern slim "ultrabook" laptop into the case of a 2000 era thinkpad monster. Throw on a "third party extended battery" for good measure... Actually, don't bother with that. There is plenty of air-space in many older laptops that you could pack with explosives if you don't worry about being able to run the computer for more than several minutes without it overheating... The entire "turn on the computer" check is idiotic security theater. Either they can tell if there is a bomb in the computer anyway through other means (in which case why are they bothering to do that check?) or they cannot (in which case, how can they possibly hope to catch anything?). My money is obviously on the first.
  - zmitri 13y ago
    Once I was looking for the number of the person I was going to stay with in the USA and they asked to have my phone. I said it's okay, I'll find it for you.
smartician 13y ago
They probably have a semi-automatic data collection system where you can type in a name, and it collects all sorts of public data in real time. To a non-technical person, this can look like they have a file on you, when in reality this crawler just compiled all the data in a few minutes.
- marcosdumay 13y ago
  I use one of those tools at work. It's called Google :)
  - smartician 13y ago
    Right... It's probably more sophisticated like that. Similar to what many HR departments use to screen future employees.
    - rdouble 13y ago
      HR departments just use Google...
      - smartician 13y ago
        There are subscription services that do all the dirty work for you. Like beenverified.com (However that explicitly "forbids" its users to use it for employment verification. Pinky promise!)
    - eru 13y ago
      Why would they? That's incredibly risky from a legal point of view.
      - fnordfnordfnord 13y ago
        So they like to say...
Amadou 13y ago
> 100. NSA data that requires TS/SAP + full-scope poly to access. You may be over-estimating the classification level here. The government classification isn't about protecting the secrets of private citizens, only government secrets. I have some experience in this field - handling fingerprints of non-criminals which were classified at the bare minimum for the agency. It would not surprise me if any non-specific NSA drag-net data itself was not classified any higher than CUI - controlled unclassified information.
- rl3 13y ago
  > The government classification isn't about protecting the secrets of private citizens, only government secrets. Using that logic, Facebook private messages supplied courtesy of the NSA would be highly classified, considering their collection mechanism would be PRISM or similar closely-held programs. > I have some experience in this field - handling fingerprints of non-criminals which were classified at the bare minimum for the agency. Fingerprint data is available to nearly every local law enforcement organization in the country. There's no mystery about the collection method. It's a foregone conclusion that it's aggregated up the chain. As other comments have said, if immigration officials were using NSA-supplied data, it would likely be in vague, aggregate form that did not hint at the underlying collection mechanism.
  - Amadou 13y ago
    That only flies if there is no other possible way for another agency to have acquired the information. An administrative subpoena would be one way to do it -- I expect there is a term for that sort of thing, although the obvious "warrant laundering" does not seem to pull up any meaningful hits in google. BTW, unless something has changed since I was last in west virginia, fingerprint info is not widely available in the general case. You take prints from an arrestee or latents from an object, you send them to IAFIS for matching and they return hits which may not even include a copy of the matched prints depending on the circumstances.
    - chc 13y ago
      Do you really believe they're getting administrative subpoenas to Facebook for every 18-year-old tourist who might do some side work?
darklajid 13y ago
I'm no friend of FB or the US. But the idea that somehow all FB messages are thoroughly searched seems .. unlikely. The German article says the girl 'found a nice family' and had 'a regular contact with her guest dad'. How unlikely is it, that the guest dad - or someone with access to his account .. - notified the border control? I refuse to believe in the Orwellian surveillance theory here and put my money on a jealous spouse.

by rl3 13y ago

zmitri 13y ago

They do sometimes ask to see your phone.

loup-vaillant 13y ago
Do you recall any specific story where they ask you to unlock it?
- cantos 13y ago
  All electronic devices are subject to search at the U.S. border. http://www.dhs.gov/sites/default/files/publications/crcl-border-search-impact-assessment_06-03-13_1.pdf http://www.dhs.gov/sites/default/files/publications/crcl-bor...
  - fnordfnordfnord 13y ago
    No. (Thank the stars for Alex Kozinski). http://www.techdirt.com/articles/20130308/13380622263/9th-circuit-appeals-court-4th-amendment-applies-border-also-password-protected-files-shouldnt-arouse-suspicion.shtml http://www.techdirt.com/articles/20130308/13380622263/9th-ci...
    - cantos 13y ago
      Let me be more specific. All that is required is "reasonable suspicion" in order to require access to all the files on your computer, unencrypted. "Reasonable suspicion" is a very weak requirement, as you can see from the document linked to in the techdirt article, and is exactly the same as what is needed for an extended physical search or an extended search of non-electronic property. In other words, there are no special considerations that apply to property just because it is electronic.
- llamataboot 13y ago
  Israel regularly makes people log into email and social media accounts. http://www.huffingtonpost.com/2012/06/04/israel-airport-email-search_n_1569163.html http://www.huffingtonpost.com/2012/06/04/israel-airport-emai...
  - darklajid 13y ago
    Oh, don't get me started.. I still cringe about multiple 'turn on the computer' scenes in Tel Aviv, where 'turn it on' obviously (..) wasn't satisfied by pressing the button, nor by logging in: I had to 'open a file, just any file' (the clueless guys would be impatient by now, being annoyed by my failure to understand this useless requirement). Usually I chose a default windows wallpaper -> Done. Braindead, waste of time.
    - simonh 13y ago
      It's fairly easy to rig a laptop display to a micro controller just clever enough to run a login screen simulator, gut out the actual computer electronics and battery, and replace them with contraband or a bomb. Tel Aviv security, which I've been through several times, want to be sure the computer is of the kind it's supposed to be. Login screen simulators are old tech. Friends of mine used to run them on the terminals at the college I studied at in the 80s to harvest other student's account details. Nowadays they're a lot more sophisticated. If you think you know more about security than the Israelis you're sadly mistaken.
      - jlgreco 13y ago
        I mean, if you were willing to invest that sort of effort, it might even be easier just to put the innards from a modern slim "ultrabook" laptop into the case of a 2000 era thinkpad monster. Throw on a "third party extended battery" for good measure... Actually, don't bother with that. There is plenty of air-space in many older laptops that you could pack with explosives if you don't worry about being able to run the computer for more than several minutes without it overheating... The entire "turn on the computer" check is idiotic security theater. Either they can tell if there is a bomb in the computer anyway through other means (in which case why are they bothering to do that check?) or they cannot (in which case, how can they possibly hope to catch anything?). My money is obviously on the first.
- zmitri 13y ago
  Once I was looking for the number of the person I was going to stay with in the USA and they asked to have my phone. I said it's okay, I'll find it for you.

smartician 13y ago

They probably have a semi-automatic data collection system where you can type in a name, and it collects all sorts of public data in real time. To a non-technical person, this can look like they have a file on you, when in reality this crawler just compiled all the data in a few minutes.

marcosdumay 13y ago
I use one of those tools at work. It's called Google :)
- smartician 13y ago
  Right... It's probably more sophisticated like that. Similar to what many HR departments use to screen future employees.
  - rdouble 13y ago
    HR departments just use Google...
    - smartician 13y ago
      There are subscription services that do all the dirty work for you. Like beenverified.com (However that explicitly "forbids" its users to use it for employment verification. Pinky promise!)
  - eru 13y ago
    Why would they? That's incredibly risky from a legal point of view.
    - fnordfnordfnord 13y ago
      So they like to say...

Amadou 13y ago

> 100. NSA data that requires TS/SAP + full-scope poly to access. You may be over-estimating the classification level here. The government classification isn't about protecting the secrets of private citizens, only government secrets. I have some experience in this field - handling fingerprints of non-criminals which were classified at the bare minimum for the agency. It would not surprise me if any non-specific NSA drag-net data itself was not classified any higher than CUI - controlled unclassified information.

rl3 13y ago
> The government classification isn't about protecting the secrets of private citizens, only government secrets. Using that logic, Facebook private messages supplied courtesy of the NSA would be highly classified, considering their collection mechanism would be PRISM or similar closely-held programs. > I have some experience in this field - handling fingerprints of non-criminals which were classified at the bare minimum for the agency. Fingerprint data is available to nearly every local law enforcement organization in the country. There's no mystery about the collection method. It's a foregone conclusion that it's aggregated up the chain. As other comments have said, if immigration officials were using NSA-supplied data, it would likely be in vague, aggregate form that did not hint at the underlying collection mechanism.
- Amadou 13y ago
  That only flies if there is no other possible way for another agency to have acquired the information. An administrative subpoena would be one way to do it -- I expect there is a term for that sort of thing, although the obvious "warrant laundering" does not seem to pull up any meaningful hits in google. BTW, unless something has changed since I was last in west virginia, fingerprint info is not widely available in the general case. You take prints from an arrestee or latents from an object, you send them to IAFIS for matching and they return hits which may not even include a copy of the matched prints depending on the circumstances.
  - chc 13y ago
    Do you really believe they're getting administrative subpoenas to Facebook for every 18-year-old tourist who might do some side work?

darklajid 13y ago

I'm no friend of FB or the US. But the idea that somehow all FB messages are thoroughly searched seems .. unlikely. The German article says the girl 'found a nice family' and had 'a regular contact with her guest dad'. How unlikely is it, that the guest dad - or someone with access to his account .. - notified the border control? I refuse to believe in the Orwellian surveillance theory here and put my money on a jealous spouse.