4 ms·

I don't know what numbers you are using but my calculations are different. I don't think it matters that there are 1 billion users worldwide. I think it's fair

I don't know what numbers you are using but my calculations are different. I don't think it matters that there are 1 billion users worldwide. I think it's fair to assume that a majority of local, state, and federal requests affected US users. That number is more like 165 million [1]. Which means the likelihood you are affected assuming a random distribution of requests and you live in the US is closer to one in a thousand. And that only accounts for Facebook requests. Consider if you regularly visit 10 websites. That might make the odds much closer to one in a hundred. [1] http://www.quintly.com/blog/2013/02/facebook-country-stats-february-2013-top-10-countries-lose-users/ http://www.quintly.com/blog/2013/02/facebook-country-stats-f...

abalone 13y ago
Why do you assume the NSA mostly targets US users? That's not a fair assumption at all.
- shadowmint 13y ago
  I was under the impression they only needed to get a warrant, or, broadly speaking, gave a *k about the privacy of American citizens. Anyone else, world wide, could have their data accessed without any need for special secret orders. Am I mistaken? I honestly thought that was the case.
  - abalone 13y ago
    They would still need to issue a National Security Request to compel Facebook to release data.
  - leoc 13y ago
    If you're a non-resident alien, they have to get the FISC court to review and approve a FAA 702 order targeting you. The bad news is that there's no standard of probable cause or anything remotely like it: more or less the only thing the FISC is actually even supposed to review and rule on is the likelihood that you are not a US citizen or in the US. The good news is that they still have to issue that FAA 702 order, and fewer than 2000 FAA 70* orders have been issued in any year prior to this one. (That number includes 702s along with other orders which can intentionally target US citizens or residents but involve a higher burden of proof.) That still leaves the possible loophole of having those 2000 orders cover a huge number of people in a manner similar to the Verizon metadata order (which is a FISA order, but isn't a FAA 70* order and isn't counted among the 2000 https://news.ycombinator.com/item?id=5879366 https://news.ycombinator.com/item?id=5879366 ). But this Facebook disclosure along with earlier statements from Google and others allows us to cautiously rule that out (though we probably don't have the same clarity on the situation of all 9 PRISM firms). Of course, none of this tells us much about what they're doing (or able to do) using "upstream collection" at the telcos. Or indeed through similar "direct collection" from non-US Web companies running non-US servers, which I'm guessing (IANAL) would probably be outside US law altogether.

abalone 13y ago

Why do you assume the NSA mostly targets US users? That's not a fair assumption at all.

shadowmint 13y ago
I was under the impression they only needed to get a warrant, or, broadly speaking, gave a *k about the privacy of American citizens. Anyone else, world wide, could have their data accessed without any need for special secret orders. Am I mistaken? I honestly thought that was the case.
- abalone 13y ago
  They would still need to issue a National Security Request to compel Facebook to release data.
- leoc 13y ago
  If you're a non-resident alien, they have to get the FISC court to review and approve a FAA 702 order targeting you. The bad news is that there's no standard of probable cause or anything remotely like it: more or less the only thing the FISC is actually even supposed to review and rule on is the likelihood that you are not a US citizen or in the US. The good news is that they still have to issue that FAA 702 order, and fewer than 2000 FAA 70* orders have been issued in any year prior to this one. (That number includes 702s along with other orders which can intentionally target US citizens or residents but involve a higher burden of proof.) That still leaves the possible loophole of having those 2000 orders cover a huge number of people in a manner similar to the Verizon metadata order (which is a FISA order, but isn't a FAA 70* order and isn't counted among the 2000 https://news.ycombinator.com/item?id=5879366 https://news.ycombinator.com/item?id=5879366 ). But this Facebook disclosure along with earlier statements from Google and others allows us to cautiously rule that out (though we probably don't have the same clarity on the situation of all 9 PRISM firms). Of course, none of this tells us much about what they're doing (or able to do) using "upstream collection" at the telcos. Or indeed through similar "direct collection" from non-US Web companies running non-US servers, which I'm guessing (IANAL) would probably be outside US law altogether.