4 ms·

Cross reference with something from the Snowden Q+A yesterday: US Persons do enjoy limited policy protections (and again, it's important to understand that pol

Cross reference with something from the Snowden Q+A yesterday: US Persons do enjoy limited policy protections (and again, it's important to understand that policy protection is no protection - policy is a one-way ratchet that only loosens) and one very weak technical protection - a near-the-front-end filter at our ingestion points. The filter is constantly out of date, is set at what is euphemistically referred to as the "widest allowable aperture," and can be stripped out at any time. Even with the filter, US comms get ingested, and even more so as soon as they leave the border. Your protected communications shouldn't stop being protected communications just because of the IP they're tagged with. This implies they hoover all data direct from fibre, but with a 'front-end filter' that restricts what is hoovered based on IP address or some other (vague, often inaccurate) marker. source: http://www.guardian.co.uk/world/2013/jun/17/edward-snowden-nsa-files-whistleblower http://www.guardian.co.uk/world/2013/jun/17/edward-snowden-n...

brown9-2 13y ago
The existence of underseas cable taps has long been an open secret, you can find articles dating back to at least 2001 about it (http://cryptome.org/nsa-fibertap.htm http://cryptome.org/nsa-fibertap.htm). I think Snowden's distinction between "policy protection" and "technical protection" is ultimately meaningless and naive - technical protections can be changed at any point just as a policy can be. All checks on government power are "policy protections", whether that policy is set by the Constitution or law or just regulation.
- codeulike 13y ago
  I think his point is, when policy is your only protection, and the policy is "ask secret court in secret for permission to look at data" then you really have no protection at all because there is no oversight - no way to see what is going on. At least with a technical protection (e.g declare 'they are not allowed to tap into undersea cables') you have some method of oversight, because there is some physical evidence outside of the NSA.
  - brown9-2 13y ago
    But isn't that declaration merely policy? I get the impression that Snowden is referring to "technical protection" as in the software/hardware systems, for instance ones that would prevent any analyst from issuing any query they like.
    - codeulike 13y ago
      The technical protection he refers to is 'filter at [the] ingestion points' - in other words, its a technical protection that prevents some data from reaching the NSAs data centre in the first place. Once its in the NSA's data centre, your only protection is a (weak, changeable, unaccountable) policy one. So by technical protection he's talking about preventing the data from reaching the NSA in the first place - if you can achieve that, you're much better off. edit: here we're talking about indiscriminately hoovered data, rather than 'asked for nicely and specifically via court order' data.
      - brown9-2 13y ago
        What I find confusing or misleading about his differentiation between policy and technical protections is that he values the latter over the former, but it would seem that the technical protection he cites could just as easily be ratcheted in any direction if/when a new policy dictates it.
- grey-area 13y ago
  I think Snowden's distinction between "policy protection" and "technical protection" is ultimately meaningless and naive I think you should see this in the context of his other statements. He's not making a distinction between policy and technical protections (he just mentions them both together as equally ineffective) - he's making a distinction between policy/technical protections and law - policy can easily be changed - e.g. the filters in place are loosened periodically, whereas law (public law at least) can be policed and enforced, regardless of the particular policies in place (or in spite of them) - e.g. the filters in place are inadequate and thus exceed the NSA's mandate, therefore the program should be shut down. This is what he means by the rule of law as opposed to the rule of men in another response. All checks on government power are not policy protections, if they have the force of law and the judicial branch is not subverted (as it has been with FISA), they have a real force which policy protections (simple internal rules of an organisation) do not have. I think the difference in concepts is useful and productive, provided you believe in the rule of law of course.

brown9-2 13y ago

The existence of underseas cable taps has long been an open secret, you can find articles dating back to at least 2001 about it (http://cryptome.org/nsa-fibertap.htm http://cryptome.org/nsa-fibertap.htm). I think Snowden's distinction between "policy protection" and "technical protection" is ultimately meaningless and naive - technical protections can be changed at any point just as a policy can be. All checks on government power are "policy protections", whether that policy is set by the Constitution or law or just regulation.

codeulike 13y ago
I think his point is, when policy is your only protection, and the policy is "ask secret court in secret for permission to look at data" then you really have no protection at all because there is no oversight - no way to see what is going on. At least with a technical protection (e.g declare 'they are not allowed to tap into undersea cables') you have some method of oversight, because there is some physical evidence outside of the NSA.
- brown9-2 13y ago
  But isn't that declaration merely policy? I get the impression that Snowden is referring to "technical protection" as in the software/hardware systems, for instance ones that would prevent any analyst from issuing any query they like.
  - codeulike 13y ago
    The technical protection he refers to is 'filter at [the] ingestion points' - in other words, its a technical protection that prevents some data from reaching the NSAs data centre in the first place. Once its in the NSA's data centre, your only protection is a (weak, changeable, unaccountable) policy one. So by technical protection he's talking about preventing the data from reaching the NSA in the first place - if you can achieve that, you're much better off. edit: here we're talking about indiscriminately hoovered data, rather than 'asked for nicely and specifically via court order' data.
    - brown9-2 13y ago
      What I find confusing or misleading about his differentiation between policy and technical protections is that he values the latter over the former, but it would seem that the technical protection he cites could just as easily be ratcheted in any direction if/when a new policy dictates it.
grey-area 13y ago
I think Snowden's distinction between "policy protection" and "technical protection" is ultimately meaningless and naive I think you should see this in the context of his other statements. He's not making a distinction between policy and technical protections (he just mentions them both together as equally ineffective) - he's making a distinction between policy/technical protections and law - policy can easily be changed - e.g. the filters in place are loosened periodically, whereas law (public law at least) can be policed and enforced, regardless of the particular policies in place (or in spite of them) - e.g. the filters in place are inadequate and thus exceed the NSA's mandate, therefore the program should be shut down. This is what he means by the rule of law as opposed to the rule of men in another response. All checks on government power are not policy protections, if they have the force of law and the judicial branch is not subverted (as it has been with FISA), they have a real force which policy protections (simple internal rules of an organisation) do not have. I think the difference in concepts is useful and productive, provided you believe in the rule of law of course.