5 ms·

Still arguing with the NSA over their own capabilities? I'm actually curious how you rationalize this worldview given the bizarre news over the last few days t

Still arguing with the NSA over their own capabilities? I'm actually curious how you rationalize this worldview given the bizarre news over the last few days that the Fed is insisting on burying NSA FISA requests among requests from every other law enforcement agency when reporting statistics? Leaving aside the point that aggregated and anonymized information seems to pose absolutely zero security risk and should not be classified in the first place, there seems a fairly obvious reason for the move that contradicts at least one if not more of your assumptions above.

tptacek 13y ago
See what I mean? This is the kind of comment that makes me think most HN people commenting on NSA think NSA has direct, unilateral access to Google Mail's servers --- as The Guardian (incorrectly) reported.
- trevelyan 13y ago
  I don't see how you can possibly jump to that conclusion. But if you don't want to analyze the question from the position of the NSA (as you should be doing), then you are welcome to personalize it. So reiterating the question, which of your assumptions listed above do you think I suspect are wrong based on the kerfuffle over statistics reporting? Put another way, why on earth does NSA seem to care so much about aggregating its FISA requests with other law enforcement agencies when reporting statistics to the public?
  - tptacek 13y ago
    I'm having a hard time parsing your question but can I ask a different one: do you disagree with any of the bulleted points in my comment above? I don't want to waste a lot of time petulantly agreeing with each other.
    - trevelyan 13y ago
      Yes. My suspicion is that your first two assumptions are incorrect, and that (1) FISA requests are not personalized under PRISM, and that consequently (2) there is no manual review or check against the abuse of power by providers on an ongoing basis. This is the only reasonable explanation I can think of for why the NSA would be trying to hide its request volume in the larger volume of overall requests from law enforcement: an attempt to massage the average user-accounts-compromised-per-request downwards when reported to the public. If there are any other explanations you can think of for why it matters how the aggregate statistics are reported, I would be curious to hear of them. And obviously, abuse of the FISA process renders splitting hairs about what constitutes direct/indirect access meaningless. FISA abuse plus an automated dropbox provides exactly the sort of data access that Snowden and the NSA repeatedly insist they have, while reconciling Google's claims with those of the NSA.
      - tptacek 13y ago
        I don't understand the (1) and (2) thing. What does it matter whether the requests are "personalized"? In fact, I think they probably rarely are; you can look at Facebook's numbers to see the aggregates suggesting that most requests are for sizable numbers of accounts, not just one. My point isn't that NSA's FISA directives are surgical; like you, I doubt that they are. My point is that upon receiving them, a lawyer at Google approves or rejects them, not a SQL query. If you read all my comments on this whole annoying story I think you'll find that I'm rarely (maybe never?) sticking up for NSA, but I am happy to stick up for Google anywhere that I can. Google is actually (in this instance) fighting for your privacy, and then getting shellacked on message boards like this; what's worse, they're prevented by the USG from explaining what's happening. They're being equated with companies like AT&T, companies that appear to be sharing bedding with NSA. That belief is wrong, it's unfair, and it's counterproductive.
        trevelyan 13y ago
        > If you read all my comments on this whole annoying story Your comments have repeatedly attacked the credibility of whistleblowers, derided their claims as factually and technically impossible, and asserted that NSA statements about NSA capabilities are wrong. > My point is that upon receiving them, a lawyer at Google approves or rejects them, not a SQL query. I don't think Google has much say in this, but what do I know? Only that your assertion otherwise is in open conflict with claims by Snowden and the NSA officials who have briefed Congress, both of whom tell us that authority over which targets to tap is in practice delegated to security analysts.

tptacek 13y ago

See what I mean? This is the kind of comment that makes me think most HN people commenting on NSA think NSA has direct, unilateral access to Google Mail's servers --- as The Guardian (incorrectly) reported.

trevelyan 13y ago
I don't see how you can possibly jump to that conclusion. But if you don't want to analyze the question from the position of the NSA (as you should be doing), then you are welcome to personalize it. So reiterating the question, which of your assumptions listed above do you think I suspect are wrong based on the kerfuffle over statistics reporting? Put another way, why on earth does NSA seem to care so much about aggregating its FISA requests with other law enforcement agencies when reporting statistics to the public?
- tptacek 13y ago
  I'm having a hard time parsing your question but can I ask a different one: do you disagree with any of the bulleted points in my comment above? I don't want to waste a lot of time petulantly agreeing with each other.
  - trevelyan 13y ago
    Yes. My suspicion is that your first two assumptions are incorrect, and that (1) FISA requests are not personalized under PRISM, and that consequently (2) there is no manual review or check against the abuse of power by providers on an ongoing basis. This is the only reasonable explanation I can think of for why the NSA would be trying to hide its request volume in the larger volume of overall requests from law enforcement: an attempt to massage the average user-accounts-compromised-per-request downwards when reported to the public. If there are any other explanations you can think of for why it matters how the aggregate statistics are reported, I would be curious to hear of them. And obviously, abuse of the FISA process renders splitting hairs about what constitutes direct/indirect access meaningless. FISA abuse plus an automated dropbox provides exactly the sort of data access that Snowden and the NSA repeatedly insist they have, while reconciling Google's claims with those of the NSA.
    - tptacek 13y ago
      I don't understand the (1) and (2) thing. What does it matter whether the requests are "personalized"? In fact, I think they probably rarely are; you can look at Facebook's numbers to see the aggregates suggesting that most requests are for sizable numbers of accounts, not just one. My point isn't that NSA's FISA directives are surgical; like you, I doubt that they are. My point is that upon receiving them, a lawyer at Google approves or rejects them, not a SQL query. If you read all my comments on this whole annoying story I think you'll find that I'm rarely (maybe never?) sticking up for NSA, but I am happy to stick up for Google anywhere that I can. Google is actually (in this instance) fighting for your privacy, and then getting shellacked on message boards like this; what's worse, they're prevented by the USG from explaining what's happening. They're being equated with companies like AT&T, companies that appear to be sharing bedding with NSA. That belief is wrong, it's unfair, and it's counterproductive.
      - trevelyan 13y ago
        > If you read all my comments on this whole annoying story Your comments have repeatedly attacked the credibility of whistleblowers, derided their claims as factually and technically impossible, and asserted that NSA statements about NSA capabilities are wrong. > My point is that upon receiving them, a lawyer at Google approves or rejects them, not a SQL query. I don't think Google has much say in this, but what do I know? Only that your assertion otherwise is in open conflict with claims by Snowden and the NSA officials who have briefed Congress, both of whom tell us that authority over which targets to tap is in practice delegated to security analysts.