5 ms·

The transcript is a good read, too. The EFF explains how the NSA grabs data wholesale from fiber optic cables (step 1) and then filters it according to selector

The transcript is a good read, too. The EFF explains how the NSA grabs data wholesale from fiber optic cables (step 1) and then filters it according to selectors (step 2). This is the governments rebuke: > IN FACT, THE SUPREME COURT DELINEATED PRECISELY HOW > THE PROGRAM OPERATES. AND IT IS A TARGETED PROGRAM. IT IS A > PROGRAM THAT IS TARGETED AT SPECIFIC SELECTORS, THAT IS PHONE > NUMBERS OR EMAIL ACCOUNTS. This person doesn't have an understanding of how selectors work. He doesn't realize that you can't decide if something is a phone number or an email account until you have already taken a look at it. This is the level on which they argue. They trick people into thinking that you can put a bunch of selectors in one bag and have only matching communications magically appear in a second one, circumventing the obvious constutional issue of collecting everything. But gravity is still in effect, so anyone with a basic understanding realizes that you can't get to (2) without having taken step (1). > IT IS NOT BULK META DATA COLLECTION. > IT'S A TARGETED COMMUNICATION SURVEILLANCE PROGRAM > AGAINST NON U.S. PERSONS LOCATED OUTSIDE THE UNITED STATES. You're not sure if he is just ignorant or feigning ignorance. And the problem is that it might just work. It brings back memories to the Java APIs case where the career lawyer argued a trivial three line Java code Google copied verbatim constituted copyright infringement. He didn't know, of course, what he was talking about. There was no mental framework for him to realize the sheer stupidity on display.

dchichkov 12y ago
I think that both sides have perfect understanding that STEP TWO (filtering/targeting) is technically impossible without doing the STEP ONE (bulk traffic capture). And that bulk traffic capture (dragnet surveillance) is illegal under the existing rules. And yes, it is a very entertaining read: > WE'VE SAID THIS FROM THE BEGINNING, YOUR HONOR. > IT'S A SOMEWHAT AWKWARD POSITION FOR US TO BE STANDING > HERE TRYING TO ARGUE THE GOVERNMENT HAS TO KEEP > INFORMATION WE DIDN'T THINK THEY SHOULD COLLECT IN THE > FIRST PLACE. ... yet another $25 donation just went out your way, EFF. Keep it up ;) edit: > THE COURT: MY VACUUM THEORY THAT NATURE AND LAWYERS HATE A VACUUM WHEN GIVEN A CHANCE TO -- > MS. COHN: IT'S TRUE. MY CAT HATES THE VACUUM, TOO.
rtpg 12y ago
I really don't think the "pre-filter collection" question can be as non-ambiguously answered as you claim. If the gov't had a guy at the post office collecting specific people's mail, would the fact that he's looking at the address on all the mail be considered a search? Even if on a technical level at one point all traffic is on RAM on some machine of the NSA, if they're not actually keeping it or looking at it in any real sense (beyond specific meta-data stuff that isn't stored), then I find it hard to consider that equivalent to actually storing the trafic. The argument that they could easily switch it to do wholesale collection is pretty irrelevant in the courts.
- tanglisha 12y ago
  What do you mean it isn't stored? How do we know that?
  - rtpg 12y ago
    Sorry, I might not have been clear. I don't know if its being stored, I agree that it shouldn't be. But so many people in this thread seem to imply it is impossible to filter a stream of information without storing the entire stream. This is very disingenuous, and is about as true as saying that it's impossible to have cops camping out for a guy with a specific license plate because they'll have to look at every car, and so they'll have to memorise all of them. This obviously depends on the selectors, but we're talking about online filtering here, guys. Its possible to imagine a situation where not every single piece of data is stored.
    - couchand 12y ago
      Well, at the very least the data resides in memory and the CPU cache. We could discuss whether that constitutes "storage" but I do think it's significantly different than the personal memory of a police officer. A more appropriate analogy might be a traffic camera looking for the specific license plate. EDIT: Note that the purported benefits of these collections programs (according to many of the slides) is that the selectors can be determined after the fact. So they must be keeping data somewhere.
chatmasta 12y ago
When I presented TorCoin at HOTPETS 2014 (the workshop portion of "privacy enhancing technology conference) last month, I was lucky enough to listen to William Binney speak to us for an hour about the NSA bulk data gathering. Although I have my doubts as to his legitimacy as a whistleblower (wouldn't surprise me if he was an NSA shill, just like it wouldn't surprise me if Snowden was too), he gave an incredible talk, and accused the NSA of some pretty egregious civil rights violations. I can't find his talk online, so I'll just attempt to summarize one of his points. Basically, he said that in 2000-2001, he had developed SIGINT algorithms for selectively monitoring communications of the "bad guys", within some low n-degrees of separation. He also put in protections to make sure that the identities of all targets were encrypted, until proper legal process allowed the NSA to decrypt them (I was unclear who held the keys). He said that his superiors happily implemented his solution, but stripped it of all selective monitoring logic and identity encryption. That was the event that caused him to decide to become a whistleblower. (He also ridiculed the NSA's defense that it's too hard to separate domestic communications from foreign ones, since, after all, the IP addresses and phone numbers can be disambiguated by simply looking at the first couple digits.) So, in short, according to William Binney, the NSA is absolutely engaging in non-targeted, bulk data collection.
- talmand 12y ago
  I thought that was essentially the final admission, that they had to collect everything to be able to filter out what they were actually looking for. If they could target exactly what they wanted then there would be no need for any type of filtering system.
rdtsc 12y ago
> He doesn't realize that you can't decide if something is a phone number or an email account until you have already taken a look at it. I think they understand they are just pushing an alternate view of reality (and interpretation of surveillance, search and so on terms). The idea they run with is unless a human looks at the data, it is not a search or seizure so Constitutional protections don't take effect. The agency(ies) / DOJ developed a strategy to explain away the Constitutional protections. They can even store the data! and they do that, and it still doesn't count as "anti-Constitutional". Maybe later you do something suspicious, like participate in some protest -- then you are labeled a terrorist, i.e. person of interest. They get a warrant even (to be legit and all) and do a search for everything you ever did online since, well forever. Maybe you watched some bomb making video on youtube when you were in college. Aha so there you go, "terrorist with interests in building weapons of mass destruction". Congratulations, you've leveled up in the terrorist watch list. And so on. You get the idea. Notice this: > AND THAT THE FIRST STEP JUST DOESN'T MATTER OR DOESN'T COUNT OR SHOULDN'T HAVE ANY STANDING. Government lawyers are not stupid. They know exactly what they are doing. They are deliberately talking past the others' point. They don't want the other side to focus on what "shouldn't be focused on" -- the idea that bulk collection constitutes search. If it is, then billions of dollars of training, equipment, promotions, programs, etc etc disappear in a cloud of smoke. Bulk surveillance and sucking up of information (and definitely storage) must persist unchallenged at all costs -- that is their position.
- rtpg 12y ago
  >I think they understand they are just pushing an alternate view of reality (and interpretation of surveillance, search and so on terms). The idea they run with is unless a human looks at the data, it is not a search or seizure so Constitutional protections don't take effect. I think there's also the fact that realising something is a phone number of an email account might not be considered a search, in the "expectation of privacy" sense. If you send postal mail, you expect the contents not to be looked at by the mailman, but do you expect the fact that you sent a letter to be private? Now, "common sense" might dictate otherwise, but Smith Vs. Maryland is the precedent, and the Courts don't think the fact that you're calling someone (and even who you're calling) to be private. So looking at whether its a phone number or email might also not be expected to be "private" information, even if the contents are. >Maybe later you do something suspicious, like participate in some protest -- then you are labeled a terrorist, i.e. person of interest. They get a warrant even (to be legit and all) and do a search for everything you ever did online since, well forever. That's not how evidence works. The gov't isn't authorised to collect everyone's info, so even if they have it on hand (a point the gov't disputes in this case), they don't necessarily have the write to use it. One of the points of the gov't in the case is that the EFF is arguing that the filtering is a two step process : collect all data, then filter it. But the EFF doesn't know that's actually how things are happening, and it might not be. So the lawyers are actually refuting the plantiff's main line of reasoning. This case is not about the core of the law, it's about implementation details. Ones that we do not know.

dchichkov 12y ago

I think that both sides have perfect understanding that STEP TWO (filtering/targeting) is technically impossible without doing the STEP ONE (bulk traffic capture). And that bulk traffic capture (dragnet surveillance) is illegal under the existing rules. And yes, it is a very entertaining read: > WE'VE SAID THIS FROM THE BEGINNING, YOUR HONOR. > IT'S A SOMEWHAT AWKWARD POSITION FOR US TO BE STANDING > HERE TRYING TO ARGUE THE GOVERNMENT HAS TO KEEP > INFORMATION WE DIDN'T THINK THEY SHOULD COLLECT IN THE > FIRST PLACE. ... yet another $25 donation just went out your way, EFF. Keep it up ;) edit: > THE COURT: MY VACUUM THEORY THAT NATURE AND LAWYERS HATE A VACUUM WHEN GIVEN A CHANCE TO -- > MS. COHN: IT'S TRUE. MY CAT HATES THE VACUUM, TOO.

rtpg 12y ago

I really don't think the "pre-filter collection" question can be as non-ambiguously answered as you claim. If the gov't had a guy at the post office collecting specific people's mail, would the fact that he's looking at the address on all the mail be considered a search? Even if on a technical level at one point all traffic is on RAM on some machine of the NSA, if they're not actually keeping it or looking at it in any real sense (beyond specific meta-data stuff that isn't stored), then I find it hard to consider that equivalent to actually storing the trafic. The argument that they could easily switch it to do wholesale collection is pretty irrelevant in the courts.

tanglisha 12y ago
What do you mean it isn't stored? How do we know that?
- rtpg 12y ago
  Sorry, I might not have been clear. I don't know if its being stored, I agree that it shouldn't be. But so many people in this thread seem to imply it is impossible to filter a stream of information without storing the entire stream. This is very disingenuous, and is about as true as saying that it's impossible to have cops camping out for a guy with a specific license plate because they'll have to look at every car, and so they'll have to memorise all of them. This obviously depends on the selectors, but we're talking about online filtering here, guys. Its possible to imagine a situation where not every single piece of data is stored.
  - couchand 12y ago
    Well, at the very least the data resides in memory and the CPU cache. We could discuss whether that constitutes "storage" but I do think it's significantly different than the personal memory of a police officer. A more appropriate analogy might be a traffic camera looking for the specific license plate. EDIT: Note that the purported benefits of these collections programs (according to many of the slides) is that the selectors can be determined after the fact. So they must be keeping data somewhere.

chatmasta 12y ago

When I presented TorCoin at HOTPETS 2014 (the workshop portion of "privacy enhancing technology conference) last month, I was lucky enough to listen to William Binney speak to us for an hour about the NSA bulk data gathering. Although I have my doubts as to his legitimacy as a whistleblower (wouldn't surprise me if he was an NSA shill, just like it wouldn't surprise me if Snowden was too), he gave an incredible talk, and accused the NSA of some pretty egregious civil rights violations. I can't find his talk online, so I'll just attempt to summarize one of his points. Basically, he said that in 2000-2001, he had developed SIGINT algorithms for selectively monitoring communications of the "bad guys", within some low n-degrees of separation. He also put in protections to make sure that the identities of all targets were encrypted, until proper legal process allowed the NSA to decrypt them (I was unclear who held the keys). He said that his superiors happily implemented his solution, but stripped it of all selective monitoring logic and identity encryption. That was the event that caused him to decide to become a whistleblower. (He also ridiculed the NSA's defense that it's too hard to separate domestic communications from foreign ones, since, after all, the IP addresses and phone numbers can be disambiguated by simply looking at the first couple digits.) So, in short, according to William Binney, the NSA is absolutely engaging in non-targeted, bulk data collection.

talmand 12y ago
I thought that was essentially the final admission, that they had to collect everything to be able to filter out what they were actually looking for. If they could target exactly what they wanted then there would be no need for any type of filtering system.

rdtsc 12y ago

> He doesn't realize that you can't decide if something is a phone number or an email account until you have already taken a look at it. I think they understand they are just pushing an alternate view of reality (and interpretation of surveillance, search and so on terms). The idea they run with is unless a human looks at the data, it is not a search or seizure so Constitutional protections don't take effect. The agency(ies) / DOJ developed a strategy to explain away the Constitutional protections. They can even store the data! and they do that, and it still doesn't count as "anti-Constitutional". Maybe later you do something suspicious, like participate in some protest -- then you are labeled a terrorist, i.e. person of interest. They get a warrant even (to be legit and all) and do a search for everything you ever did online since, well forever. Maybe you watched some bomb making video on youtube when you were in college. Aha so there you go, "terrorist with interests in building weapons of mass destruction". Congratulations, you've leveled up in the terrorist watch list. And so on. You get the idea. Notice this: > AND THAT THE FIRST STEP JUST DOESN'T MATTER OR DOESN'T COUNT OR SHOULDN'T HAVE ANY STANDING. Government lawyers are not stupid. They know exactly what they are doing. They are deliberately talking past the others' point. They don't want the other side to focus on what "shouldn't be focused on" -- the idea that bulk collection constitutes search. If it is, then billions of dollars of training, equipment, promotions, programs, etc etc disappear in a cloud of smoke. Bulk surveillance and sucking up of information (and definitely storage) must persist unchallenged at all costs -- that is their position.

rtpg 12y ago
>I think they understand they are just pushing an alternate view of reality (and interpretation of surveillance, search and so on terms). The idea they run with is unless a human looks at the data, it is not a search or seizure so Constitutional protections don't take effect. I think there's also the fact that realising something is a phone number of an email account might not be considered a search, in the "expectation of privacy" sense. If you send postal mail, you expect the contents not to be looked at by the mailman, but do you expect the fact that you sent a letter to be private? Now, "common sense" might dictate otherwise, but Smith Vs. Maryland is the precedent, and the Courts don't think the fact that you're calling someone (and even who you're calling) to be private. So looking at whether its a phone number or email might also not be expected to be "private" information, even if the contents are. >Maybe later you do something suspicious, like participate in some protest -- then you are labeled a terrorist, i.e. person of interest. They get a warrant even (to be legit and all) and do a search for everything you ever did online since, well forever. That's not how evidence works. The gov't isn't authorised to collect everyone's info, so even if they have it on hand (a point the gov't disputes in this case), they don't necessarily have the write to use it. One of the points of the gov't in the case is that the EFF is arguing that the filtering is a two step process : collect all data, then filter it. But the EFF doesn't know that's actually how things are happening, and it might not be. So the lawyers are actually refuting the plantiff's main line of reasoning. This case is not about the core of the law, it's about implementation details. Ones that we do not know.