4 ms·

So the Gaurdian appears to have done some very very shoddy reporting. But isn't this all a distraction? FTP or direct acces, it makes no practical difference i

So the Gaurdian appears to have done some very very shoddy reporting. But isn't this all a distraction? FTP or direct acces, it makes no practical difference if the employee on the other end rubber stamps the requests when they get them. The real question is how much data can the NSA get and what procedures do they have to prevent the targeting of US person? what checks does e.g Google actually run on the requests? If the procedure is email FISA@google.com and then some google employee rubber stamps it and sticks the data in an SFTP server, the NSA effectively has unfettered access. Its clear that you don't need a warrant for targeting a foreign person, so the employee can't check that it came for FISC. Even if they did, FISC seems to be willing to rubber stamp things themselves. So aside from maybe checking if the account is typically accessed from a US IP, whats Google going to do? I pick on Google here specifically only because they have a reputation for trying to automate everything including a lot of customer support and I suspect that if they don't have any discretion on these cases, they may well have automated it. Of course, maybe they didn't, maybe there are rigorous checks both at the NSA and at the receiving companies. But we don't know and we need to.

skwirl 13y ago
Google has directly contradicted what you are saying about rubber stamping requests. See http://googleblog.blogspot.com/2013/06/what.html http://googleblog.blogspot.com/2013/06/what.html and http://googleblog.blogspot.com/2013/06/asking-us-government-to-allow-google-to.html http://googleblog.blogspot.com/2013/06/asking-us-government-.... For example: "Our legal team reviews each and every request, and frequently pushes back when requests are overly broad or don’t follow the correct process."
- anologwintermut 13y ago
  That does seem to preclude dragnet requests. But what is google going to do when the NSA asks for all the mail from "foo@gmail.com"? Is NSA going to give some justification for why the need access? Now what happens if the NSA issues thousands of those requests? They are not broad, they are for specific people. As to following proper procedure, it appears rather strongly that secret procedures allows the NSA to request a hell of a lot legally and may not provide much safeguard for preventing abuse. We don't know because the procedures are secret. Again, the companies in question appear to have little choice in the matter and that probably absolves them of a lot, but that doesn't mean the situation is ok from the view of what they were compeled to do.
- emn13 13y ago
  They may be lying. If there's a gag order, they may be required to lie. Or they may consider "review" not to necessarily be human review. Or the person writing that may simply not know. We don't know what's going on at google, and with no transparency, it's hard to have a lot of trust, particularly since there are many examples of government overreach in the past. Sure, google and facebook and whatever should push back, but it's clear that if the government really wants to abuse its power, they won't stop it. Given the current witch-hunt on whistleblowers, it's clear that those in power do not appreciate being questioned. Trust is fine, but verification is better.
  - moultano 13y ago
    What would you consider transparency if your response to that is, "they might be lying."
    - emn13 13y ago
      Actual transparency, not just words? That could be free access to their internal architecture (not exactly likely), or more plausible, external, independent auditors. However, I think you're focusing on the wrong party here - I think it's a lot more reasonable to request this of the government than of companies. There's no reason not to require the government to publish the general structure of what they're doing in great detail, and to let others make up their own mind if it's overstepping its bounds. In short: I want an independent parties to have free access and be allowed to verify what's going on.
  - jacobparker 13y ago
    The FISA gag orders bar you from discussing them. They don't mandate that you lie. That'd be silly.
ghshephard 13y ago
It's a pretty significant difference. Even with the rubber stamp, the US Govt is limited to what they've asked for and received. With direct access, they could have pulled everything. In the case of Verizon/AT&T - the Government has everything, and, in the event of a new law/govt/executive branch - they would be able to do anything with the data they had already collected. I was very concerned that US Govt had access had direct access to Google/Facebook servers. I'm not particularly worried about their ability to do authorized requests for user information. Hopefully Verizon/AT&T will now transition to the same place as google/facebook are - having those entire databases of all telephone data is ripe for abuse, regardless of what claims they might make about safeguards are in place.

skwirl 13y ago

Google has directly contradicted what you are saying about rubber stamping requests. See http://googleblog.blogspot.com/2013/06/what.html http://googleblog.blogspot.com/2013/06/what.html and http://googleblog.blogspot.com/2013/06/asking-us-government-to-allow-google-to.html http://googleblog.blogspot.com/2013/06/asking-us-government-.... For example: "Our legal team reviews each and every request, and frequently pushes back when requests are overly broad or don’t follow the correct process."

anologwintermut 13y ago
That does seem to preclude dragnet requests. But what is google going to do when the NSA asks for all the mail from "foo@gmail.com"? Is NSA going to give some justification for why the need access? Now what happens if the NSA issues thousands of those requests? They are not broad, they are for specific people. As to following proper procedure, it appears rather strongly that secret procedures allows the NSA to request a hell of a lot legally and may not provide much safeguard for preventing abuse. We don't know because the procedures are secret. Again, the companies in question appear to have little choice in the matter and that probably absolves them of a lot, but that doesn't mean the situation is ok from the view of what they were compeled to do.
emn13 13y ago
They may be lying. If there's a gag order, they may be required to lie. Or they may consider "review" not to necessarily be human review. Or the person writing that may simply not know. We don't know what's going on at google, and with no transparency, it's hard to have a lot of trust, particularly since there are many examples of government overreach in the past. Sure, google and facebook and whatever should push back, but it's clear that if the government really wants to abuse its power, they won't stop it. Given the current witch-hunt on whistleblowers, it's clear that those in power do not appreciate being questioned. Trust is fine, but verification is better.
- moultano 13y ago
  What would you consider transparency if your response to that is, "they might be lying."
  - emn13 13y ago
    Actual transparency, not just words? That could be free access to their internal architecture (not exactly likely), or more plausible, external, independent auditors. However, I think you're focusing on the wrong party here - I think it's a lot more reasonable to request this of the government than of companies. There's no reason not to require the government to publish the general structure of what they're doing in great detail, and to let others make up their own mind if it's overstepping its bounds. In short: I want an independent parties to have free access and be allowed to verify what's going on.
- jacobparker 13y ago
  The FISA gag orders bar you from discussing them. They don't mandate that you lie. That'd be silly.

ghshephard 13y ago

It's a pretty significant difference. Even with the rubber stamp, the US Govt is limited to what they've asked for and received. With direct access, they could have pulled everything. In the case of Verizon/AT&T - the Government has everything, and, in the event of a new law/govt/executive branch - they would be able to do anything with the data they had already collected. I was very concerned that US Govt had access had direct access to Google/Facebook servers. I'm not particularly worried about their ability to do authorized requests for user information. Hopefully Verizon/AT&T will now transition to the same place as google/facebook are - having those entire databases of all telephone data is ripe for abuse, regardless of what claims they might make about safeguards are in place.