22 ms·
I think it's pretty clear that we need both technical and legislative fixes to NSA surveillance. Just one of the two isn't enough: to get be even vaguely confid
by sinak 13y ago
I think it's pretty clear that we need both technical and legislative fixes to NSA surveillance. Just one of the two isn't enough: to get be even vaguely confident that surveillance ends, we need both. The technical fixes I can't speak to, but the legislative ones I've been thinking about for a while. In the last week, there have been two prominent bills announced to deal with surveillance:
- Bill 1: The FISA Improvements Act, from Feinstein and the Senate Intelligence Committee. In short it legalizes most of what the NSA has been done.
- Bill 2: The USA FREEDOM ACT, from Sensenbrenner and Leahy, currently being considered by the House/Senate Judiciary committees. It amends §215 of FISA to end bulk phone metadata collection and fixes some of the problems with §702 of the FISA Amendments Act (under which PRISM is run). But it doesn't fix §702 fully, does nothing to end BULLRUN (undermining encryption) nor the surveillance that happens outside FISA (MUSCULAR, for example, and god knows what else).
Obviously the Feinstein bill can't be allowed to pass. But some really big names (ACLU, CDT) have thrown strong support behind the Freedom Act. I'm wondering what we as the Taskforce(.is) should do. It's clear to me that it doesn't go nearly far enough. And there's some chance that if it passes, Congress will view this whole thing as "dealt with" and not revisit the issue for years to come. But unfortunately the Freedom Act barely has the votes to get out of the judiciary committee, and getting it to pass through both houses requires a lot of momentum.
We've been working on a campaign asking folks to call and oppose Feinstein, and potentially to support the Freedom Act. But I'm not sure if that's a right move. Unfortunately, the public doesn't understand why privacy is important, and Americans aren't nearly angry enough for Congress to do anything more substantial than the Freedom Act. We might be able to push for amendments, but it's a long shot.
tl;dr - We've got two bills in Congress. One is terrible, one is mediocre. But we don't have the political momentum to do anything better than the mediocre bill. What do we do? Tech advocate conundrum.
- deleted 13y ago[deleted]
- serge2k 13y agoTry to find a fix for the ridiculously broken system that is the US government?
- InclinedPlane 13y agoYes. It's fixable the moment the public realizes that it is within their power to fix.
- xradionut 13y agoHow? Voting and protesting haven't worked so far.
- adestefan 13y agoJust because people don't vote the way you want them to doesn't mean it's not working.
- rza 13y agoVoting is not working. As far as the media is concerned, there are always going to be only two candidates, both of which are in bed with corporate lobbyists. Without every voter doing significant research on their own to make meaningful third-party voting blocs, that will not change. Money determines the primary candidates, and that money comes from the same places year after year.
- dragonwriter 13y agoThe fundamental problem is not the media (for all the problems the media has and produces), it is the electoral system, as is demonstrated by the comparison with the greater number of competitive parties in all the democracies that also have profit-oriented corporate media but do not a national legislature elected by plurality or majority/runoff elections.
- davidw 13y agoItaly has one of those proportional parliaments. It's not exactly a utopia.
- diziet 13y agoThe legislative fixes need to create an environment where the technical capabilities and safeguards put in place are considered normal, and companies are not forced to do harm to users. That's the most important part, creating an environment that sets precedence for user's rights.
- jcc80 13y agoThere's no conundrum. You take what you can get, when you can get it - especially with how Washington functions today. The other big name groups recognize this. Perfect is the enemy of good here.
- Zak 13y agoBut it doesn't fix §702 fully, does nothing to end BULLRUN (undermining encryption) Nor should it. Undermining the encryption used by legitimate surveillance targets and intercepting their communications is what the NSA is for. The point of legislative solutions isn't to stop having a signals intelligence agency. It's to limit that agency to spying on people it legitimately believes to be terrorists, agents of hostile foreign powers and the like.
- joshstrange 13y agoOk but to agree with that argument is to agree that the NSA and organizations like it are necessary. I'm still waiting for the proof that they are. Everything I see points to them compromising countless people's privacy and having nothing to show for it.
- untog 13y agoBut that's the core of the problem. By the nature of what they do, their successes are never clear. Not that this is a very robust intellectual defense, but the US is far from the only country to do this. Just two days ago the NYT had an article about Brazil spying on Americans within its borders: http://www.nytimes.com/2013/11/05/world/americas/brazil-acknowledges-spying-on-diplomats-from-us.html http://www.nytimes.com/2013/11/05/world/americas/brazil-ackn... If we shut down the NSA tomorrow we would be an an international disadvantage.
- zorked 13y agoCan we please try not to equate a diplomat's car being followed around a city's public areas with the indiscriminate collection of private communications from every man, woman and child on the planet? Look, my eyes are open. I'm spying on you. Everybody spies!
- lttlrck 13y agocan we please try not to equate reality with "indiscriminate collection of private communications from every man, woman and child on the planet"
- rayiner 13y agoLegislative fixes aren't going to buy you a lot, though they'll buy you something. The fundamental problem is structural: there are a lot of things the NSA is totally allowed to do, especially when it acts as an agency of the executive outside of the U.S. Technologists tend to ignore national and jurisdictional borders because networks cross those borders, but the powers of the NSA are defined in terms of those borders. Not just statutorily, but as an agency of the executive, Constitutionally. For example, Mike Hearn says: "Bypassing that system is illegal for a good reason." Illegal under whose law? Obvious things like the Wiretap Act simply don't apply outside the U.S. And this is by design: Congress and the courts are primarily domestic institutions. The executive, by design, has primacy when it comes to activities outside the U.S. Maybe this design made a lot more sense back in the day before the advent of trans-national corporations, but it's the design we have, and we're talking Constitutional-amendment level fixes to change that design. Internally, you might see fixes without a Constitutional amendment. E.g. the Supreme Court might at some point weaken the third party doctrine, which is what makes a lot of the NSA's data collection not a violation of the 4th amendment. But they won't touch the activities of the NSA internationally.
- Zigurd 13y agoLegal access to a document can't compel the owner of the document to hand over encryption keys. And if the existence of the document can be denied, you can't even prove it exists. This level of protection is within the reach of existing tools. Services like Google can make those tools accessible to the masses. The law has to observe physics. You can get a court order to "compel" someone to float off the ground, but that doesn't mean it's going to happen.
- rayiner 13y agoSure, there are certain things that can be achieved by technological means. My point is that when it comes to certain areas of NSA activity, you're dealing with more than just simple legislative fixes. The specific example mentioned by Mike Hearn, the NSA tapping into international leased lines, is really illustrative. Our whole government is structured around the assumption that the executive branch is supreme when it comes to activities outside the U.S. To make it illegal,[1] for the NSA to tap into foreign leased lines would require more than just legislation, it would require Congress to decide to regulate the NSA's activity abroad in the first place. And in doing so Congress would run up against separation of powers issues, because in our system, it's not really Congress's place to dictate to the President how he carries out foreign security activities. [1] I think as it is it might be a 4th amendment violation, but it's not contrary to any statute that I'm aware of, at least not any American statute.
- deleted 13y ago[deleted]
- pnathan 13y agoI'vw been thinking about this pretty hard this summer - I've been involved in some local tech activist stuff. My take on it is as runs: Fundamentally, what's needed here is the ability to have confidence that the intelligence system is not overstepping its bounds. The US founders' framework for building that confidence is to have multiple parts of power, whose interest is roughly aligned with countering each other. So in the case of the TLAs: * The judicial system for warrants needs to be open. No secret courts. Cases' contents might be sealed; the existence of cases should not be. Secret courts are not new, and they have been a bad idea for a long time. * The policies for data collection need to managed by Congress; no policy about this should set by the executive branch. The policies need to be open and debated. Should we take foreign intelligence on our own citizens? * Comprehensive reports to Congress. I believe Zoe Lofgren cited a report that was under a page about the NSA activity. That's entirely disingenuous and disrespectful of the representatives of the people. The other thing that needs to be done is in the polls: Legislators that seek to legalize snooping need to be replaced with ones that don't. And finally, the thought process needs to be that there's a 4th Amendment rights protection movement and organization, which will work over a long timeframe (generations). There's no band-aid act that will fix this once and for all, this entire thing is an upswelling from overprotective and anti-risk mindsets. It comes out of deep into the roots of what's considered acceptable risk. The privacy/4th amendment movement is going to have to plan for advocating higher risks, more freedom, more liberty, combined with more laws about privacy, along with determining how to build change in mindset over time (it's called propaganda or, more politely, marketing). Privacy implications need to be worked out, discussed, brought to light in fiction, philosophy, law, debates, etc. The mindset of fear and "never again" and "risk is unacceptable" has to be broken in order to make mass surveillance a non-starter. Worse - The reality is that privacy is going to be dead with the Internet of Things coming online. The question is, what is acceptable and legal to monitor and record? For myself, I believe that we need to have stringent personal data laws forcing deletion of consumer data unless required for a service, as well as requiring warrants for any data collection not already given to the government (i.e., irs filing). The 2nd Amendment groups are in this for the long run. I don't see how the privacy groups can afford to do otherwise. edit: I would enjoy discussing this with interested parties, particularly activists and activist-leaning people. My email is in my profile.
- 00rion 13y agoOn the legislative side, it seems that we need more transparency and the ability to curb abuses once detected. I don't really know what a working system that acts in this capacity would look like but I think it would include citizens as well as senators and congressmen. We don't really know what our government is doing and, although that might not have been an issue in the past, I feel that it's becoming an issue today as a result of everyone being spied on. If the government has nothing to fear, it has nothing to hide.
- DannyBee 13y ago"But some really big names (ACLU, CDT)" Just to point out, neither of these are actually big names to congress, or more importantly, particularly effective at getting things passed when push comes to shove. If you want these things passed, never rely on advocacy orgs to do the work of the people.
- declan 13y agoIn fact, there are many members of Congress that would be delighted to oppose whatever the ACLU is recommending (and perhaps even put out a press release announcing it!).
- declan 13y agoLeahy is the author of CALEA, a surveillance law that is one big reason we're in this situation to begin with. He introduced portions of the Patriot Act under the name EPPSCA a year before the Sep. 11 attacks (http://thomas.loc.gov/cgi-bin/query/R?r106:FLD001:S58859 http://thomas.loc.gov/cgi-bin/query/R?r106:FLD001:S58859). Leahy has sat on modest surveillance reform (requiring search warrants for email, cell phone location) for over three and a half years without advancing it to the Senate floor. One proposal he circulated a year ago included an exception allowing dozens of federal agencies to access email without a warrant (http://news.cnet.com/8301-13578_3-57552687-38/ http://news.cnet.com/8301-13578_3-57552687-38/). Then, after Snowden's revelations, when the political tide was moving toward significant reform, Leahy's first instinct was to handcuff companies from challenging NSLs (http://news.cnet.com/8301-13578_3-57592778-38/ http://news.cnet.com/8301-13578_3-57592778-38/). I suspect that, after all the likely political compromises and conference committees and markups, any bill principally authored by Leahy will follow the same pattern as CALEA and the Patriot Act. One obvious solution, of course, is to avoid limiting yourself to looking at a pair of existing flawed bills and find a politician willing to back real reform. Another solution, better for HN, is to work toward technical solutions that will work in the likely event that our esteemed leaders in Washington, D.C. get it wrong once again. Trust math, not laws.
- chris_mahan 13y agoThere is no technical solution that works when the federal government can seize/inspect/hack into any computer located in the United States or in friendly countries, as well as hack into computers anywhere in the world. They can then access the decryption private keys of anyone, and thus all encryption can be defeated, along with any other means of attempting to hide information from prying eyes. If Google itself is unable to protect its own network from NSA intrusion, what makes you think anyone else is able to? Remember, the NSA is tasked with spying on Russian, Chinese, (and everybody else's) systems, and given that the Russians and Chinese have great mathematical and computing minds, is should be assumed that the NSA is employing equally great minds in the USA in order to penetrate the military (including nuclear and biological weapons systems), government, commercial, and individual systems of these foreign powers. That the NSA turned the sophisticated looking glass inward to spy on the citizenry, in such an insecure manner, is the problem. The other problem is that, well, citizens of the United States can be terrorists. If the NSA is tasked with stopping terrorism, then they, of necessity, need to monitor everyone, including US citizens. So the answer lies in the terrorism part: Everyone went bonkers wondering why the government agencies were not able to stop the Boston bombers, yet when they do try to collect information and analyze it in a manner consistent with stopping this threat, they are then denounced as violators of the Constitution. I have a sobering proposal: We tell the NSA to not worry about terrorism. On the other hand, we come to terms with the notion that terrorists do what they do because it does terrorize us, and we make a conscious decision that we are going to not care anymore and accept a certain amount of casualties in exchange for the government not spying on us. We accept that 30,000 Americans die on our roads each year in car accidents. We accept that another 30,000 Americans die of gun violence every year. Could we not accept that 30,000 Americans die of terrorism related incidents every year? I lived in France in the 1980's. We had a lot of terrorism. Bombs in malls, bombs in restaurants, bombs in the street in front of synagogues. After a while, callous as this may seem, the French just stopped caring anymore. It had become routine. Then the terrorists stopped. There was no reason for them to keep doing this, because the French would just put it on page 4 of the paper, next to the political scandal section. The police would close the street, clean up, etc. Yes, these were tragedies for the families, but not more than the tragedies for victims of gun violence, drug overdose, and horrible car accidents that mangled the bodies of children beyond recognition. Taking away everyone's car is not the solution to car accidents. Taking away everyone's guns, swords, pick-axes, chainsaw, power drill, kitchen knives, and banning boxing, wrestling, and martial arts is not the solution to murder. Likewise, taking away everyone's freedom is not the solution to terrorism. Because taking away everyone's freedom's been tried before, and the human spirit of freedom asserts itself, and people die on both sides as they rebel and attempt to overthrow the oppressors. And that is why the NSA and other agencies that spy on Americans must be muzzled.
- metaphorm 13y agoFeinstein is a villain. Time to get her out of office.
- wonderyak 13y agoShe's always been a villain. Its just that the other Senators are so much worse she looks good in comparison.
- dllthomas 13y agoGood luck with that. She's not up for re-election until 2018, and so far as I'm aware there are no allegations of crimes of the sort that would get her expelled from the senate (in practice, looking at previous examples).
- deleted 13y ago[deleted]
- arkj 13y agoWe've always been spied on and we will be. Just be honest souls. And let them spy or do whatever; This talk is kinda tiring now. I'll not worry as long as there are checks in the system that someone inside is not misusing this information.
- rmc 13y agoYou'll need to change the us constitution so that us foreigners are covered by the 4th amendment ban on warentless searches.
- chris_mahan 13y agoAs a dual citizen (US, and French) am I protected by the 4th amendment, or not?
- rmc 13y agoI dunno. Ask a lawyer...
- chris_mahan 13y agoSad that one would have to ask a lawyer for something as simple as this.
- samstave 13y agoIf HHS Feinstein bill passes, then it should be assumed to make all surveillance legal, thus any following of her personal actions: location, where-abouts, transactions, conversations etc are fair game. We should post cameras outside her Presidio Terrace San Francisco home watching every ingress/egress action by anyone visiting the place.