3 ms·

Those are handled by reports via required experts. Or did you also need an architect on the policy board because it involved a building? They probably plan to p

by mhurron 13y ago

Those are handled by reports via required experts. Or did you also need an architect on the policy board because it involved a building? They probably plan to print the policy out, I guess we need the engineer who designed the printer on the board as well. Just because it uses something does not mean a subject matter expert on that thing needs to be involved in every part of the policy surrounding it. On top of that, this specific group is concerned with the legality of what the NSA is doing. This is the realm of lawyers and constitutional experts. The fact that they are using a computer instead of pads of paper doesn't change that. Or did they need representatives from the paper mill before? > in fact there's no technological enforcement of said policy Oh, and policy writers are often not policy implementers and never are in government, a review board of the policy won't change that.

msandford 13y ago
Do you really think that the NSA is going to allow non-NSA experts to review and audit their systems for what the access controls are? I'm not optimistic on the odds. We've seen before that the NSA can't be trusted to tell the truth about their systems. That means that their experts, reporting on their systems, also can't be trusted. Furthermore the legality does in fact hinge on the implementation. If the NSA records everything but encrypts it with something that they themselves can't crack and different judges are given the encryption keys for their respective regions of authority and better still there are multiple judges for each region and its randomly decided which judge gets the key on a given day, you might actually convince me that the NSA hasn't yet performed a search. So let's suppose for a minute that the NSA would claim exactly that. And let's suppose that the panel decides that given the system described, it is in fact constitutional. We would still need an independent auditor to examine the systems in question and ascertain if in fact the NSA is telling the truth. Because what matters isn't the WRITTEN policy, it's the ENFORCED policy. If all we're doing is finding out the legality of the written policy, it's a total joke.

by mhurron 13y ago

msandford 13y ago

Do you really think that the NSA is going to allow non-NSA experts to review and audit their systems for what the access controls are? I'm not optimistic on the odds. We've seen before that the NSA can't be trusted to tell the truth about their systems. That means that their experts, reporting on their systems, also can't be trusted. Furthermore the legality does in fact hinge on the implementation. If the NSA records everything but encrypts it with something that they themselves can't crack and different judges are given the encryption keys for their respective regions of authority and better still there are multiple judges for each region and its randomly decided which judge gets the key on a given day, you might actually convince me that the NSA hasn't yet performed a search. So let's suppose for a minute that the NSA would claim exactly that. And let's suppose that the panel decides that given the system described, it is in fact constitutional. We would still need an independent auditor to examine the systems in question and ascertain if in fact the NSA is telling the truth. Because what matters isn't the WRITTEN policy, it's the ENFORCED policy. If all we're doing is finding out the legality of the written policy, it's a total joke.