10 ms·

NSA broke privacy rules thousands of times per year, audit finds

416 points by glhaynes 13y ago

arh68 13y ago
> the agency’s internal definition of “data” does not cover “metadata” If I download terabytes of Wikipedia XML dumps, could I argue to my ISP I never actually downloaded any "data"?
0003 13y ago
NSA statements to The Post: http://www.washingtonpost.com/world/national-security/nsa-statements-to-the-post/2013/08/15/f40dd2c4-05d6-11e3-a07f-49ddc7417125_story.html http://www.washingtonpost.com/world/national-security/nsa-st... Be sure to read the bottom. Hilarious.
uptown 13y ago
via @AntDerosa: "To be clear, that was only an audit spanning 12 months, May 2011 to May 2012. There may have been more violations by NSA before and after. Also, this audit only covers NSA’s Fort Meade headquarters and other facilities in the Washington area."
- ianterrell 13y ago
  From the article: > Three government officials, speaking on the condition of anonymity to discuss classified matters, said the number would be substantially higher if it included other NSA operating units and regional collection centers.
ColinCochrane 13y ago
> “You can look at it as a percentage of our total activity that occurs each day,” he said. “You look at a number in absolute terms that looks big, and when you look at it in relative terms, it looks a little different.” I wonder if he realized what that implies.
- 001sky 13y ago
  Most of the infractions involve unauthorized surveillance of Americans or foreign intelligence targets in the United States, both of which are restricted by law and executive order. Aren't criminal counts per action? not per-percentage? WTF.
  - cheald 13y ago
    I like this defense. "Your honor, I only stole 0.00000512% of this bank's money. I should get off with time served." "Your honor, I was only distributing 0.00000125% of the city's weed. I should get off with time served." "Your honor, I only murdered 0.000000004695% of the population of the US. You look at a number in absolute terms that looks big, and when you look at it in relative terms, it looks a little different."
    - rhizome 13y ago
      It's not even, "time served," but "a promotion." Perish the thought that a prosecution would even be a possibility.
mkessy 13y ago
So with thousands of audited violations what power do the oversight committees actually have? I'm not sure of the timeline of this audit, but it seems apparent that the agency can do whatever it wants, regardless of whether it is breaking the rules and whomever is tasked with enforcing those rules has no power.
beedogs 13y ago
note to mkessy: your account appears to be hellbanned.
- nxn 13y ago
  Same is true for drivebyacct2
LoganCale 13y ago
> In one instance, the NSA decided that it need not report the unintended surveillance of Americans. A notable example in 2008 was the interception of a “large number” of calls placed from Washington when a programming error confused U.S. area code 202 for 20, the international dialing code for Egypt Considering their track record with honesty, why should we believe this was an accident?
- jonlucc 13y ago
  I was thinking this. I wonder if they also happened to get the 20 country code calls in addition to the 202 calls. Do they have any quality control on their code?
  - rhizome 13y ago
    you'd think they'd at least disallow three-digit area codes.
- dictum 13y ago
  Suppose you're a Foreign Terrorist. If you're planning an attack on the US, can you do it entirely from your country? At some point you have to contact some people in the US to carry out the attacks. But oh, the Americans you hired are very wily, and they know that, to be relatively anonymous and have their shenanigans hidden, they have to call from different phones, send emails from different accounts, use different identities, encrypt everything... Mr. American Terrorist Contractor can't have all his communications tied to a single identity that could be reassembled with Big Data. So he tries to keep very few traces of his activity, and confuse snoops with false leads and dead ends. Mr. American Terrorist Contractor called from many phones, used many addresses, etc. The dragnet to catch him must be large. It will include some innocent Americans. Tens who called a phone he called that same day. Hundreds who went to the same deli as he went last Friday. Add more situations, area codes, phone call graphs and quickly you have most Americans. That's by design, though: you can't have surveillance that's capable of catching domestic terrorists without surveilling innocent citizens, and you can't try to end terrorism with surveillance without spying on the people who will actually perform the terrorist acts in your land. EDIT: As it currently stands, the NSA is supposed to help end terrorism by spying on all foreigners. What I'm arguing is that surveillance of non-citizens always leads to surveillance of citizens. Some Americans are uncomfortable with the US government spying on American citizens, but comfortable with the USG spying on foreigners. They may be less comforted when they realize how, if the real intent of the surveillance is to prevent terrorism, only spying on foreigners won't help much.
msg 13y ago
This is the tip of the tip of the tip of the iceberg. We were not paranoid enough. I was not paranoid enough. You were not paranoid enough. Reality outstripped our imaginations. How are we going to recalibrate our expectations? What's next?
- lukifer 13y ago
  Here's my answer: predictive Bayesian algorithms, run across the data-set of all human behavior, and algorithmically generated dossiers and smear campaigns for every human on the planet. All available for sale, for favors and influence if not for money. ...that is, assuming these aren't being done already.
  - j_baker 13y ago
    A part of me wishes all these dossiers would become public. If everyone's skeletons were out of the closet, we wouldn't care about skeletons so much.
    - adventured 13y ago
      I think most people would proceed to focus on everybody else's skeletons in a shallow judgmental fashion and continue to ignore their own flaws exactly as they do today. The net effect would be to put our rotting culture's worst aspects on steroids. What would occur is mass ostracizing and general social chaos from imploded relationships (friends, lovers, family). There would be shocking and boring skeletons, it would become a giant cultural witch hunt, pleasure would be taken in socially mocking and assaulting people with the most outrageous or abnormal skeletons. We live in a bankrupt culture that worships tabloids, gossip and low value entertainment (low value everything in fact, including food, just so long as it distracts for a moment). I see no reason to think people would suddenly change the way they go about the world: the averages for what is considered scandalous behavior would simply shift and there would be a new unlimited supply of people to be socially assaulted. Why just look at my boring skeletons compared to that guy! My scandal is nowhere near as bad as hers!
jonlucc 13y ago
>current operations rely on technology that cannot quickly determine whether a foreign mobile phone has entered the United States If only this kind of communication could have a known location, like say, its origin tower. Maybe I completely misunderstand the phone protocols, but I thought origin tower was hard to miss.
jister 13y ago
....and most people don't care with what the NSA is doing so let's move on with this NSA thingy and submit more interesting technology news so that we all can be happy, no?
- D9u 13y ago
  No! To allow these abrogations of our civil rights to go unpunished equates to tacit approval, and I, for one, absolutely refuse to let this matter rest until the violations cease and those responsible are duly punished to the full extent of the law. Secret courts handing down secret rulings regarding secret police is not something one would expect of a nation which claims "moral high ground" when justifying their breach of the public trust on multiple fronts. Some of us swore an Oath to uphold and defend the Constitution of the United States, and we take our vows with deadly seriousness. I'll see myself rot in some prison before I allow this situation to be shuffled off the collective radar.
  - davidw 13y ago
    > I, for one, absolutely refuse to let this matter rest So what are you doing about it? > I allow this situation to be shuffled off the collective radar. Voting up articles about the issue on a niche news site is not "doing something".
    - D9u 13y ago
      Implying that I haven't been firing off letters to my elected representatives is an erroneous assumption on your part. Keeping this issue alive and at the forefront of the collective mindset is doing something.
      - davidw 13y ago
        > Implying that I haven't been firing off letters to my elected representatives is an erroneous assumption on your part. I didn't assume that, I asked. > Keeping this issue alive and at the forefront of the collective mindset is doing something. Not really. Everyone here knows about the issue and has an opinion about it already. I would really hope that, like you, most of us have acted on it (I called mine rather than writing), but it's a pretty small group, all things considered, and basically an echo chamber for issues like this. To really do something, people need to "get out of the building", to borrow a phrase.
zeteo 13y ago
>James R. Clapper Jr., the director of national intelligence, has acknowledged that the court found the NSA in breach of the Fourth Amendment, which prohibits unreasonable searches and seizures, but the Obama administration has fought a Freedom of Information lawsuit that seeks the opinion. Are you fucking kidding me? Let's take this incident to the most die-hard scaremonger out there and ask them how the hell is it in the interest of national security to hide it when government institutions are found guilty of breaching the Constitution?
- deleted 13y ago
  [deleted]
- CoffeeDregs 13y ago
  Fully agreed. Further, let's assume that you were an every-man (as we all are) and had the ability to type anything into a magical console that spat out private details about US citizens. That would be an "unreasonable search and seizure", so you wouldn't do it, right? It's logged! How many of your fellow citizens would not do that search? But the NSA doesn't just hire anyone, so you have to assume the folks aren't exactly like your fellow citizens and they know they're being logged. But is your guess "0"? I've seen people delete ("sudo rm -rf /some-important-dir") critical bits of infrastructure when they knew logs were in place, so my guess is most certainly not zero. Note: I know some 3-letter-agency folks and they are very tight-lipped, so I don't want to suggest 3-letter-agency folks are not entirely trustworthy. But the NSA appears to have an incredible honey-pot and it't hard to imagine that no NSA analyst would have a taste. Note^2: the NSA should have internal honey-pots to catch analysts browsing their (girl|boy)friends and such, but I'd not be surprised to hear that they don't...
  - malandrew 13y ago
    The thing is that they don't even need to do anything as obvious as that. They could simply eavesdrop on the communications of some important executive of a foreign enterprise with ADRs trading on a US Stock Exchange. The potential for abuse extends well beyond personal intrusions. The NSA could literally fund itself entirely by simply trading against the information they have access to.
qwertzlcoatl 13y ago
Here you can find the classified slides in full : http://apps.washingtonpost.com/g/page/national/nsa-report-on-privacy-violations-in-the-first-quarter-of-2012/395/# http://apps.washingtonpost.com/g/page/national/nsa-report-on...
deleted 13y ago
[deleted]
jfoutz 13y ago
While 2500 may seem like a large number, it's actually a very tiny error rate given the millions of gigs of data obtained from server mirroring and phone tracking.
rosser 13y ago
The NSA appears to have mastered the concept of exploiting Outrage Fatigue.
- LoganCale 13y ago
  I was outrage fatigued before Snowden did his leak. I'm not tired anymore.
  - samstave 13y ago
    Second revolutionary-wind
malandrew 13y ago
"The most serious incidents included a violation of a court order and unauthorized use of data about more than 3,000 Americans and green-card holders." If these were willful acts that wouldn't pass an ethics committee, I sure hope people went to jail over this instead of getting an administrative slap on the wrist. We need to have moral hazard for those at the top pyramid. We've let bankers get away with crimes, I would hope that we aren't doing the same with these people as well. However I doubt anyone ever gets prosecuted for these violations. In another case, the Foreign Intelligence Surveillance Court, which has authority over some NSA operations, did not learn about a new collection method until it had been in operation for many months. The court ruled it unconstitutional. Wow. Just wow. You'd imagine that they wouldn't be able to implement any system before it has been deemed Constitutional and authorized by Congress. If there is any question, then they shouldn't even begin to seriously research and implement a new technique without first getting Congressional approval.
- davidw 13y ago
  > We need to have moral hazard for those at the top pyramid Actually, "moral hazard" means: > moral hazard is a situation where a party will have a tendency to take risks because the costs that could incur will not be felt by the party taking the risk. In other words, it is a tendency to be more willing to take a risk, knowing that the potential costs or burdens of taking such risk will be borne, in whole or in part, by others. We probably want less of that. ( http://en.wikipedia.org/wiki/Moral_hazard http://en.wikipedia.org/wiki/Moral_hazard )
  - malandrew 13y ago
    oops. thanks for the correction.
northwest 13y ago
Let's not get side-tracked. This article is "just" about a some details. The real issue that must be resolved and is still not being addressed is: As long as these NSA activities are not dismantled and the People do not have transparency over what the NSA/government does, everyone of us can still be "eliminated" by the push of a few buttons and democracy therefor no longer exists. Even if its decline happens slowly and behind our backs (https://en.wikipedia.org/wiki/Boiling_frog https://en.wikipedia.org/wiki/Boiling_frog).
splrb 13y ago
The NSA has gone rogue. This can't possibly have anything to do with our safety.
NicoJuicy 13y ago
If Obama is serious about not violating civilian rights. He should just fire the NSA boss WITHOUT giving him any other job opportunities or compensation! But be honest, he's never going to do that... Obama is just as involved as the chief of NSA.
mathiasben 13y ago
New program code word -DISHFIRE - google results bring up interesting open positions.

416 points by glhaynes 13y ago

arh68 13y ago

> the agency’s internal definition of “data” does not cover “metadata” If I download terabytes of Wikipedia XML dumps, could I argue to my ISP I never actually downloaded any "data"?

0003 13y ago

NSA statements to The Post: http://www.washingtonpost.com/world/national-security/nsa-statements-to-the-post/2013/08/15/f40dd2c4-05d6-11e3-a07f-49ddc7417125_story.html http://www.washingtonpost.com/world/national-security/nsa-st... Be sure to read the bottom. Hilarious.

uptown 13y ago

via @AntDerosa: "To be clear, that was only an audit spanning 12 months, May 2011 to May 2012. There may have been more violations by NSA before and after. Also, this audit only covers NSA’s Fort Meade headquarters and other facilities in the Washington area."

ianterrell 13y ago
From the article: > Three government officials, speaking on the condition of anonymity to discuss classified matters, said the number would be substantially higher if it included other NSA operating units and regional collection centers.

ColinCochrane 13y ago

> “You can look at it as a percentage of our total activity that occurs each day,” he said. “You look at a number in absolute terms that looks big, and when you look at it in relative terms, it looks a little different.” I wonder if he realized what that implies.

001sky 13y ago
Most of the infractions involve unauthorized surveillance of Americans or foreign intelligence targets in the United States, both of which are restricted by law and executive order. Aren't criminal counts per action? not per-percentage? WTF.
- cheald 13y ago
  I like this defense. "Your honor, I only stole 0.00000512% of this bank's money. I should get off with time served." "Your honor, I was only distributing 0.00000125% of the city's weed. I should get off with time served." "Your honor, I only murdered 0.000000004695% of the population of the US. You look at a number in absolute terms that looks big, and when you look at it in relative terms, it looks a little different."
  - rhizome 13y ago
    It's not even, "time served," but "a promotion." Perish the thought that a prosecution would even be a possibility.

mkessy 13y ago

So with thousands of audited violations what power do the oversight committees actually have? I'm not sure of the timeline of this audit, but it seems apparent that the agency can do whatever it wants, regardless of whether it is breaking the rules and whomever is tasked with enforcing those rules has no power.

beedogs 13y ago

note to mkessy: your account appears to be hellbanned.

nxn 13y ago
Same is true for drivebyacct2

LoganCale 13y ago

> In one instance, the NSA decided that it need not report the unintended surveillance of Americans. A notable example in 2008 was the interception of a “large number” of calls placed from Washington when a programming error confused U.S. area code 202 for 20, the international dialing code for Egypt Considering their track record with honesty, why should we believe this was an accident?

jonlucc 13y ago
I was thinking this. I wonder if they also happened to get the 20 country code calls in addition to the 202 calls. Do they have any quality control on their code?
- rhizome 13y ago
  you'd think they'd at least disallow three-digit area codes.
dictum 13y ago
Suppose you're a Foreign Terrorist. If you're planning an attack on the US, can you do it entirely from your country? At some point you have to contact some people in the US to carry out the attacks. But oh, the Americans you hired are very wily, and they know that, to be relatively anonymous and have their shenanigans hidden, they have to call from different phones, send emails from different accounts, use different identities, encrypt everything... Mr. American Terrorist Contractor can't have all his communications tied to a single identity that could be reassembled with Big Data. So he tries to keep very few traces of his activity, and confuse snoops with false leads and dead ends. Mr. American Terrorist Contractor called from many phones, used many addresses, etc. The dragnet to catch him must be large. It will include some innocent Americans. Tens who called a phone he called that same day. Hundreds who went to the same deli as he went last Friday. Add more situations, area codes, phone call graphs and quickly you have most Americans. That's by design, though: you can't have surveillance that's capable of catching domestic terrorists without surveilling innocent citizens, and you can't try to end terrorism with surveillance without spying on the people who will actually perform the terrorist acts in your land. EDIT: As it currently stands, the NSA is supposed to help end terrorism by spying on all foreigners. What I'm arguing is that surveillance of non-citizens always leads to surveillance of citizens. Some Americans are uncomfortable with the US government spying on American citizens, but comfortable with the USG spying on foreigners. They may be less comforted when they realize how, if the real intent of the surveillance is to prevent terrorism, only spying on foreigners won't help much.

msg 13y ago

This is the tip of the tip of the tip of the iceberg. We were not paranoid enough. I was not paranoid enough. You were not paranoid enough. Reality outstripped our imaginations. How are we going to recalibrate our expectations? What's next?

lukifer 13y ago
Here's my answer: predictive Bayesian algorithms, run across the data-set of all human behavior, and algorithmically generated dossiers and smear campaigns for every human on the planet. All available for sale, for favors and influence if not for money. ...that is, assuming these aren't being done already.
- j_baker 13y ago
  A part of me wishes all these dossiers would become public. If everyone's skeletons were out of the closet, we wouldn't care about skeletons so much.
  - adventured 13y ago
    I think most people would proceed to focus on everybody else's skeletons in a shallow judgmental fashion and continue to ignore their own flaws exactly as they do today. The net effect would be to put our rotting culture's worst aspects on steroids. What would occur is mass ostracizing and general social chaos from imploded relationships (friends, lovers, family). There would be shocking and boring skeletons, it would become a giant cultural witch hunt, pleasure would be taken in socially mocking and assaulting people with the most outrageous or abnormal skeletons. We live in a bankrupt culture that worships tabloids, gossip and low value entertainment (low value everything in fact, including food, just so long as it distracts for a moment). I see no reason to think people would suddenly change the way they go about the world: the averages for what is considered scandalous behavior would simply shift and there would be a new unlimited supply of people to be socially assaulted. Why just look at my boring skeletons compared to that guy! My scandal is nowhere near as bad as hers!

jonlucc 13y ago

>current operations rely on technology that cannot quickly determine whether a foreign mobile phone has entered the United States If only this kind of communication could have a known location, like say, its origin tower. Maybe I completely misunderstand the phone protocols, but I thought origin tower was hard to miss.

jister 13y ago

....and most people don't care with what the NSA is doing so let's move on with this NSA thingy and submit more interesting technology news so that we all can be happy, no?

D9u 13y ago
No! To allow these abrogations of our civil rights to go unpunished equates to tacit approval, and I, for one, absolutely refuse to let this matter rest until the violations cease and those responsible are duly punished to the full extent of the law. Secret courts handing down secret rulings regarding secret police is not something one would expect of a nation which claims "moral high ground" when justifying their breach of the public trust on multiple fronts. Some of us swore an Oath to uphold and defend the Constitution of the United States, and we take our vows with deadly seriousness. I'll see myself rot in some prison before I allow this situation to be shuffled off the collective radar.
- davidw 13y ago
  > I, for one, absolutely refuse to let this matter rest So what are you doing about it? > I allow this situation to be shuffled off the collective radar. Voting up articles about the issue on a niche news site is not "doing something".
  - D9u 13y ago
    Implying that I haven't been firing off letters to my elected representatives is an erroneous assumption on your part. Keeping this issue alive and at the forefront of the collective mindset is doing something.
    - davidw 13y ago
      > Implying that I haven't been firing off letters to my elected representatives is an erroneous assumption on your part. I didn't assume that, I asked. > Keeping this issue alive and at the forefront of the collective mindset is doing something. Not really. Everyone here knows about the issue and has an opinion about it already. I would really hope that, like you, most of us have acted on it (I called mine rather than writing), but it's a pretty small group, all things considered, and basically an echo chamber for issues like this. To really do something, people need to "get out of the building", to borrow a phrase.

zeteo 13y ago

>James R. Clapper Jr., the director of national intelligence, has acknowledged that the court found the NSA in breach of the Fourth Amendment, which prohibits unreasonable searches and seizures, but the Obama administration has fought a Freedom of Information lawsuit that seeks the opinion. Are you fucking kidding me? Let's take this incident to the most die-hard scaremonger out there and ask them how the hell is it in the interest of national security to hide it when government institutions are found guilty of breaching the Constitution?

deleted 13y ago
[deleted]
CoffeeDregs 13y ago
Fully agreed. Further, let's assume that you were an every-man (as we all are) and had the ability to type anything into a magical console that spat out private details about US citizens. That would be an "unreasonable search and seizure", so you wouldn't do it, right? It's logged! How many of your fellow citizens would not do that search? But the NSA doesn't just hire anyone, so you have to assume the folks aren't exactly like your fellow citizens and they know they're being logged. But is your guess "0"? I've seen people delete ("sudo rm -rf /some-important-dir") critical bits of infrastructure when they knew logs were in place, so my guess is most certainly not zero. Note: I know some 3-letter-agency folks and they are very tight-lipped, so I don't want to suggest 3-letter-agency folks are not entirely trustworthy. But the NSA appears to have an incredible honey-pot and it't hard to imagine that no NSA analyst would have a taste. Note^2: the NSA should have internal honey-pots to catch analysts browsing their (girl|boy)friends and such, but I'd not be surprised to hear that they don't...
- malandrew 13y ago
  The thing is that they don't even need to do anything as obvious as that. They could simply eavesdrop on the communications of some important executive of a foreign enterprise with ADRs trading on a US Stock Exchange. The potential for abuse extends well beyond personal intrusions. The NSA could literally fund itself entirely by simply trading against the information they have access to.

qwertzlcoatl 13y ago

Here you can find the classified slides in full : http://apps.washingtonpost.com/g/page/national/nsa-report-on-privacy-violations-in-the-first-quarter-of-2012/395/# http://apps.washingtonpost.com/g/page/national/nsa-report-on...

deleted 13y ago

[deleted]

jfoutz 13y ago

While 2500 may seem like a large number, it's actually a very tiny error rate given the millions of gigs of data obtained from server mirroring and phone tracking.

rosser 13y ago

The NSA appears to have mastered the concept of exploiting Outrage Fatigue.

LoganCale 13y ago
I was outrage fatigued before Snowden did his leak. I'm not tired anymore.
- samstave 13y ago
  Second revolutionary-wind

malandrew 13y ago

"The most serious incidents included a violation of a court order and unauthorized use of data about more than 3,000 Americans and green-card holders." If these were willful acts that wouldn't pass an ethics committee, I sure hope people went to jail over this instead of getting an administrative slap on the wrist. We need to have moral hazard for those at the top pyramid. We've let bankers get away with crimes, I would hope that we aren't doing the same with these people as well. However I doubt anyone ever gets prosecuted for these violations. In another case, the Foreign Intelligence Surveillance Court, which has authority over some NSA operations, did not learn about a new collection method until it had been in operation for many months. The court ruled it unconstitutional. Wow. Just wow. You'd imagine that they wouldn't be able to implement any system before it has been deemed Constitutional and authorized by Congress. If there is any question, then they shouldn't even begin to seriously research and implement a new technique without first getting Congressional approval.

davidw 13y ago
> We need to have moral hazard for those at the top pyramid Actually, "moral hazard" means: > moral hazard is a situation where a party will have a tendency to take risks because the costs that could incur will not be felt by the party taking the risk. In other words, it is a tendency to be more willing to take a risk, knowing that the potential costs or burdens of taking such risk will be borne, in whole or in part, by others. We probably want less of that. ( http://en.wikipedia.org/wiki/Moral_hazard http://en.wikipedia.org/wiki/Moral_hazard )
- malandrew 13y ago
  oops. thanks for the correction.

northwest 13y ago

Let's not get side-tracked. This article is "just" about a some details. The real issue that must be resolved and is still not being addressed is: As long as these NSA activities are not dismantled and the People do not have transparency over what the NSA/government does, everyone of us can still be "eliminated" by the push of a few buttons and democracy therefor no longer exists. Even if its decline happens slowly and behind our backs (https://en.wikipedia.org/wiki/Boiling_frog https://en.wikipedia.org/wiki/Boiling_frog).

splrb 13y ago

The NSA has gone rogue. This can't possibly have anything to do with our safety.

NicoJuicy 13y ago

If Obama is serious about not violating civilian rights. He should just fire the NSA boss WITHOUT giving him any other job opportunities or compensation! But be honest, he's never going to do that... Obama is just as involved as the chief of NSA.

mathiasben 13y ago

New program code word -DISHFIRE - google results bring up interesting open positions.