3 ms·

Let's say that I work at a bank and that the bank policy is to put all the money in the vault and as a result, the money will not be stolen. Then one day, the

Let's say that I work at a bank and that the bank policy is to put all the money in the vault and as a result, the money will not be stolen. Then one day, the money is stolen. Turns out that the reason the money was stolen is because the vault has no door. Just because the bank has a "money in the vault can't be stolen" policy on paper doesn't cause that vision of how the world SHOULD be to become REALITY. In order to winnow out the truth in this situation the review panel would need to have someone who knows something about security and vault construction on it. Also who perhaps would be allowed to inspect said vault to verify it's intact. This is 100% analogous to the NSA review panel as all the folks in government are crowing about how it's policy that you can't look at such-and-such without a reason, but in fact there's no technological enforcement of said policy. Analysts can look at whatever they want provided that they give (type into a text field) some kind of ostensible reason, but that reason is only for auditing purposes. A bad reason typed into a field doesn't prevent the search as there's no review of said reason prior to the search running. It's a bank vault with a door where the "lock" is a "sign in, sign out" sheet taped to the wall near the handle. And no security guard ensuring that people do in fact sign in and sign out. And definitely not checking to see that the money everyone's leaving with is in fact for the regular operations of the bank and not for their own personal gain.

mhurron 13y ago
Those are handled by reports via required experts. Or did you also need an architect on the policy board because it involved a building? They probably plan to print the policy out, I guess we need the engineer who designed the printer on the board as well. Just because it uses something does not mean a subject matter expert on that thing needs to be involved in every part of the policy surrounding it. On top of that, this specific group is concerned with the legality of what the NSA is doing. This is the realm of lawyers and constitutional experts. The fact that they are using a computer instead of pads of paper doesn't change that. Or did they need representatives from the paper mill before? > in fact there's no technological enforcement of said policy Oh, and policy writers are often not policy implementers and never are in government, a review board of the policy won't change that.
- msandford 13y ago
  Do you really think that the NSA is going to allow non-NSA experts to review and audit their systems for what the access controls are? I'm not optimistic on the odds. We've seen before that the NSA can't be trusted to tell the truth about their systems. That means that their experts, reporting on their systems, also can't be trusted. Furthermore the legality does in fact hinge on the implementation. If the NSA records everything but encrypts it with something that they themselves can't crack and different judges are given the encryption keys for their respective regions of authority and better still there are multiple judges for each region and its randomly decided which judge gets the key on a given day, you might actually convince me that the NSA hasn't yet performed a search. So let's suppose for a minute that the NSA would claim exactly that. And let's suppose that the panel decides that given the system described, it is in fact constitutional. We would still need an independent auditor to examine the systems in question and ascertain if in fact the NSA is telling the truth. Because what matters isn't the WRITTEN policy, it's the ENFORCED policy. If all we're doing is finding out the legality of the written policy, it's a total joke.

mhurron 13y ago

Those are handled by reports via required experts. Or did you also need an architect on the policy board because it involved a building? They probably plan to print the policy out, I guess we need the engineer who designed the printer on the board as well. Just because it uses something does not mean a subject matter expert on that thing needs to be involved in every part of the policy surrounding it. On top of that, this specific group is concerned with the legality of what the NSA is doing. This is the realm of lawyers and constitutional experts. The fact that they are using a computer instead of pads of paper doesn't change that. Or did they need representatives from the paper mill before? > in fact there's no technological enforcement of said policy Oh, and policy writers are often not policy implementers and never are in government, a review board of the policy won't change that.

msandford 13y ago
Do you really think that the NSA is going to allow non-NSA experts to review and audit their systems for what the access controls are? I'm not optimistic on the odds. We've seen before that the NSA can't be trusted to tell the truth about their systems. That means that their experts, reporting on their systems, also can't be trusted. Furthermore the legality does in fact hinge on the implementation. If the NSA records everything but encrypts it with something that they themselves can't crack and different judges are given the encryption keys for their respective regions of authority and better still there are multiple judges for each region and its randomly decided which judge gets the key on a given day, you might actually convince me that the NSA hasn't yet performed a search. So let's suppose for a minute that the NSA would claim exactly that. And let's suppose that the panel decides that given the system described, it is in fact constitutional. We would still need an independent auditor to examine the systems in question and ascertain if in fact the NSA is telling the truth. Because what matters isn't the WRITTEN policy, it's the ENFORCED policy. If all we're doing is finding out the legality of the written policy, it's a total joke.