5 ms·

Yes, minimization was one of his good points. But the architecture of the Internet also seems to make it very difficult to determine conclusively that a given

by mpyne 13y ago

Yes, minimization was one of his good points. But the architecture of the Internet also seems to make it very difficult to determine conclusively that a given communication has nothing whatsoever to do with someone outside the U.S. Consider a VPN/proxies for instance, or even an email from an American to AQ_Recruiter at gmail (where the owner of AQ_Recruiter logs in from Yemen via a series of proxies, the endpoint of which is wholly-domestic). I guarantee you that NSA wishes that problem was easy... they could pawn off the mere "domestic" stuff wholly on the FBI and focus on the "interesting" work of international spying and counter-terrorism (because again, in bizarro-world they aren't simply spying on people just because, but because they have a specific mission to attend to as directed by Congress and the DoD, which having to filter USPERS detracts from).

jacquesm 13y ago
> I guarantee you that NSA wishes that problem was easy... they could pawn off the mere "domestic" stuff wholly on the FBI and focus on the "interesting" work of international spying and counter-terrorism If that were true then http://en.wikipedia.org/wiki/Parallel_construction http://en.wikipedia.org/wiki/Parallel_construction would not be part and parcel of this whole story.
- mpyne 13y ago
  Parallel construction is much more relevant to things like DEA's SOD or the FBI itself though. In the NSA's heyday there was simply never a need for parallel construction as it wasn't as if they were going to be bringing up Soviet diplomats on indictments. They explicitly didn't touch people on American soil so the whole idea of 'chain of custody' was almost completely moot. Even now parallel construction is only a thing because it's that much easier for NSA to run across domestic communications commingled with international comms. Nowadays the analyst may see evidence of a major upcoming crime in the process of their actual duties, which puts you back in Churchill's Coventry quandry.
  - jacquesm 13y ago
    (1) Churchill's Coventry quandary is a myth. See: http://theweek.com/article/index/237427/history-detective-did-churchill-sacrifice-a-city-to-protect-a-secret http://theweek.com/article/index/237427/history-detective-di... And lots of other places. (2) The NSA is way out of line in this respect and no matter how much they do/did it that stands and you should not apologize for it. If you do you are essentially advocating for broadening the official reach of the NSA's powers rather than to rein them in because they clearly can not stick to their mandate. The balance here is not to get to perfect security without privacy, the balance point is to get to an optimal level of security with a maximum of privacy. Anything less won't do, lest we all end telling another generation how terribly sorry we were. Power corrupts, it's never been any different historically.
    - mpyne 13y ago
      > (1) Churchill's Coventry quandary is a myth. It's not whether it actually happened that's important or not, and I think you realize that. Prime Minister Churchill certainly did need to be careful about what actions he took based on ULTRA decrypts so as to avoid revealing the activities of Bletchley Park. Coventry is the quotable example despite not actually happening the way the story is told. However if you require an example that actually happened, consider when Adm. Nimitz received message intelligence pointing out Adm. Yamamoto's flight itinerary. In his case he ended up using a literal example of parallel construction (having a coastwatcher send a report of a Japanese flight) to generate a non-codebreaking reason for his staff to know about the flight, and then sent out his fighter planes to shoot Yamamoto's flight down. > (2) The NSA is way out of line in this respect and no matter how much they do/did it that stands and you should not apologize for it. With respect to things like DEA I would agree with you. But on the other hand if they came across a no-shit email from a hitman or something describing an upcoming murder I would expect them to report it. It may be that it's impossible to write a policy that straddles that border, in which case I'd say we should probably ban that type of information sharing and then rely on the idea that an analyst who sees that type of murder plot might still leave an anonymous tip. > The balance here is not to get to perfect security without privacy, the balance point is to get to an optimal level of security with a maximum of privacy. Hey look at that, we fully agree!
greenyoda 13y ago
I agree that you can't tell where a user behind a proxy is located, so I'm willing to give the NSA the benefit of the doubt on that issue. But the vast majority of domestic internet traffic does not go through a VPN or proxy, so you can tell just by looking at the originating and terminating IP addresses that the packet is going from one place in the U.S. to another. Also, you can probably assume that a VPN that's on a domain registered to a company inside the U.S. that is not selling VPN services to the general public (e.g., a bank) isn't being used by random terrorists outside the U.S. But the whole business of "parallel construction" where the NSA shares warrantlessly intercepted data with the DEA and keeps it secret from defense lawyers is pretty good evidence that "minimization" is a sham and the NSA is not honestly trying to keep itself within legal and constitutional bounds.
- anigbrowl 13y ago
  I live in the US, but I'm not a US citizen, so I'm definitely a foreign person. Now suppose that I were a spy or a supporter of terrorism, are you saying the NSA shouldn't be able to monitor my activities because I am inside the US? I've had occasion to think about this before, here and in other countries. I'm Irish, and as I'm sure you know there was a lot of anti-British terrorism originating in Northern Ireland for a long time. Terrorism was carried out within the UK, and for that mattter a good bit of it was funded from the US by people who considered that terrorism a noble cause (including, famously, Republican representative Peter King - http://en.wikipedia.org/wiki/Peter_T._King#Support_for_the_IRA http://en.wikipedia.org/wiki/Peter_T._King#Support_for_the_I...). But the whole business of "parallel construction" where the NSA shares warrantlessly intercepted data with the DEA and keeps it secret from defense lawyers is pretty good evidence that "minimization" is a sham and the NSA is not honestly trying to keep itself within legal and constitutional bounds. No dispute with that point. I just want to clarify that the NSA's legitimate scope is not defined purely geographically.
  - mpyne 13y ago
    Actually, by virtue of being on U.S. soil you are also fully protected by the 4th Amendment, despite not being a U.S. citizen. That's why the NSA is generally careful to refer to "U.S. persons" instead of "U.S. citizens" when they talk in technical terms about things like minimization.

by mpyne 13y ago

jacquesm 13y ago

> I guarantee you that NSA wishes that problem was easy... they could pawn off the mere "domestic" stuff wholly on the FBI and focus on the "interesting" work of international spying and counter-terrorism If that were true then http://en.wikipedia.org/wiki/Parallel_construction http://en.wikipedia.org/wiki/Parallel_construction would not be part and parcel of this whole story.

mpyne 13y ago
Parallel construction is much more relevant to things like DEA's SOD or the FBI itself though. In the NSA's heyday there was simply never a need for parallel construction as it wasn't as if they were going to be bringing up Soviet diplomats on indictments. They explicitly didn't touch people on American soil so the whole idea of 'chain of custody' was almost completely moot. Even now parallel construction is only a thing because it's that much easier for NSA to run across domestic communications commingled with international comms. Nowadays the analyst may see evidence of a major upcoming crime in the process of their actual duties, which puts you back in Churchill's Coventry quandry.
- jacquesm 13y ago
  (1) Churchill's Coventry quandary is a myth. See: http://theweek.com/article/index/237427/history-detective-did-churchill-sacrifice-a-city-to-protect-a-secret http://theweek.com/article/index/237427/history-detective-di... And lots of other places. (2) The NSA is way out of line in this respect and no matter how much they do/did it that stands and you should not apologize for it. If you do you are essentially advocating for broadening the official reach of the NSA's powers rather than to rein them in because they clearly can not stick to their mandate. The balance here is not to get to perfect security without privacy, the balance point is to get to an optimal level of security with a maximum of privacy. Anything less won't do, lest we all end telling another generation how terribly sorry we were. Power corrupts, it's never been any different historically.
  - mpyne 13y ago
    > (1) Churchill's Coventry quandary is a myth. It's not whether it actually happened that's important or not, and I think you realize that. Prime Minister Churchill certainly did need to be careful about what actions he took based on ULTRA decrypts so as to avoid revealing the activities of Bletchley Park. Coventry is the quotable example despite not actually happening the way the story is told. However if you require an example that actually happened, consider when Adm. Nimitz received message intelligence pointing out Adm. Yamamoto's flight itinerary. In his case he ended up using a literal example of parallel construction (having a coastwatcher send a report of a Japanese flight) to generate a non-codebreaking reason for his staff to know about the flight, and then sent out his fighter planes to shoot Yamamoto's flight down. > (2) The NSA is way out of line in this respect and no matter how much they do/did it that stands and you should not apologize for it. With respect to things like DEA I would agree with you. But on the other hand if they came across a no-shit email from a hitman or something describing an upcoming murder I would expect them to report it. It may be that it's impossible to write a policy that straddles that border, in which case I'd say we should probably ban that type of information sharing and then rely on the idea that an analyst who sees that type of murder plot might still leave an anonymous tip. > The balance here is not to get to perfect security without privacy, the balance point is to get to an optimal level of security with a maximum of privacy. Hey look at that, we fully agree!

greenyoda 13y ago

I agree that you can't tell where a user behind a proxy is located, so I'm willing to give the NSA the benefit of the doubt on that issue. But the vast majority of domestic internet traffic does not go through a VPN or proxy, so you can tell just by looking at the originating and terminating IP addresses that the packet is going from one place in the U.S. to another. Also, you can probably assume that a VPN that's on a domain registered to a company inside the U.S. that is not selling VPN services to the general public (e.g., a bank) isn't being used by random terrorists outside the U.S. But the whole business of "parallel construction" where the NSA shares warrantlessly intercepted data with the DEA and keeps it secret from defense lawyers is pretty good evidence that "minimization" is a sham and the NSA is not honestly trying to keep itself within legal and constitutional bounds.

anigbrowl 13y ago
I live in the US, but I'm not a US citizen, so I'm definitely a foreign person. Now suppose that I were a spy or a supporter of terrorism, are you saying the NSA shouldn't be able to monitor my activities because I am inside the US? I've had occasion to think about this before, here and in other countries. I'm Irish, and as I'm sure you know there was a lot of anti-British terrorism originating in Northern Ireland for a long time. Terrorism was carried out within the UK, and for that mattter a good bit of it was funded from the US by people who considered that terrorism a noble cause (including, famously, Republican representative Peter King - http://en.wikipedia.org/wiki/Peter_T._King#Support_for_the_IRA http://en.wikipedia.org/wiki/Peter_T._King#Support_for_the_I...). But the whole business of "parallel construction" where the NSA shares warrantlessly intercepted data with the DEA and keeps it secret from defense lawyers is pretty good evidence that "minimization" is a sham and the NSA is not honestly trying to keep itself within legal and constitutional bounds. No dispute with that point. I just want to clarify that the NSA's legitimate scope is not defined purely geographically.
- mpyne 13y ago
  Actually, by virtue of being on U.S. soil you are also fully protected by the 4th Amendment, despite not being a U.S. citizen. That's why the NSA is generally careful to refer to "U.S. persons" instead of "U.S. citizens" when they talk in technical terms about things like minimization.