Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Why the ruling against NSA’s phone records program could have huge implications (washingtonpost.com)
121 points by Libertatea on May 12, 2015 | hide | past | favorite | 38 comments


Sorry but too many people are focused on just the NSA. Two administrations have defended these programs, as have the heads of the FBI, NSA, CIA, and the FISA court supposedly providing oversight. So the problem extends well beyond just NSA wordsmithing section 215, there are a lot of other agencies doing this with an executive who either actively supports it or tacitly accepts it.

Jim Sensenbrenner, who is the primary author of the Patriot Act (and therefore section 215,) has unequivocally said it doesn't authorize bulk collection. Two years ago he warned the heads of all of these agencies to change their policies or section 215 wasn't going to be renewed meaning any legitimate programs under section 215 become illegal. And it seems they've all been obstinately tone deaf, there's no evidence they've changed anything, they haven't even bothered to lie that they have changed their behavior in order to try and keep these programs.


I'm sorry, but Jim Sensenbrenner has no room to complain. After the Section 215 warrantless wiretapping program was first revealed back in 2006, he voted for the Protect America Act[1] to legalize it. Then he helped renew it in 2008 by voting for the FISA Amendments Act[2]. After the Snowden leaks began, Sensenbrenner suddenly became opposed to them. Later on in 2013, he admitted publicly that as a rule he avoids attending any classified briefings because he doesn't want to be burdened with the responsibility of protecting classified information and would rather find out about these things when they leak to the mainstream media.[3] So every time NSA came down and briefed the program to the intelligence and judicial committees, Sensenbrenner shirked his oversight responsibilities. Now he wants everyone to believe that he's hard at work protecting their civil liberties.

[1] http://clerk.house.gov/evs/2007/roll836.xml

[2] http://clerk.house.gov/evs/2008/roll437.xml

[3] http://www.lawfareblog.com/2013/11/the-shameless-revisionism...


This is a mischaracterization. For one Protect America Act addresses changes in technology that neither FISA nor AUMF directly address. Two, not section 215, not FISA, not any FISA amendments, and not AUMF permit bulk collection. And it's bulk collection that's in dispute, most Americans have far less of a problem with targeted wiretapping of likely terrorist targets even without warrants. Sensenbrenner, and others, have been quite clear the problem they have with current and previous administrations is the bulk collection policy, that there's no authorization anywhere for this.

That Sensenbrenner and others lacked sufficient concern or imagination that section 215 would be wordsmithed and construed to support something like bulk collection is fair criticism. If you are a Congresscritter wanting to have your cake and eat it too, you'd write a vague law that steers completely clear of authorizing what you don't like (bulk collection), and then act shocked when it ends up happening. And I don't think that's a big stretch considering the minority of legislation Congress puts an expiration date on, and section 215 is such, expiring next month.

So now the question is whether Congress lacks any stomach for bulk collection and just lets it expire including all of the far less controversial programs (i.e. they're considered legal, even if you may not like the law or the policy). I think at best they renew it as is, and let the full appeals court or SCOTUS look at it. But they might just scrap it and come up with a narrower replacement to reauthorize uncontroversial parts.


> For one Protect America Act addresses changes in technology that neither FISA nor AUMF directly address.

No, you're right; I'll concede that. Both PAA and FAA modify law established through the PATRIOT Act, but neither touch Section 215.

I was trying to make a point more about hypocrisy and failure to perform oversight. He voted to amend the PATRIOT Act multiple times after the bulk collection program was publicly disclosed[1], but didn't do anything back then. We shouldn't have to fault him for lack of concern or imagination - he should have been sitting in on the classified briefings. There's no excuse for him to not know about this or any other NSA program that was briefed to the Judicial Committee, and he shouldn't be voting to amend his own law without understanding how it's being applied. He's says now that he's opposed to bulk collection, but he could voiced his support to end to it a decade ago by just doing his job.

> just lets it expire including all of the far less controversial programs

It's my understanding that only 3 provisions of the PATRIOT Act are set to sunset: Section 215, Section 206 ("roving wiretaps") and Section 6001 (the 'lone wolf' provision).

[1] http://usatoday30.usatoday.com/news/washington/2006-05-10-ns...


I'm usually optimistic, but I have zero hope when it comes to the government self-policing their own surveillance programs. I think the government will interpret this ruling to a very strict practical application, and it will take separate challenges to similar programs in court to stop them.

And that's just for the programs we know about...


There does not seem to be any incentive for government to self-police or act within the scope and bounds of the constitution. It seems if we are going to have any sort of chance at pre 9/11 level of freedoms there needs to be more push back from citizens and non-profits. This reminds me of the American Civil Liberties Union slogan. 'Because Freedom Can't Protect Itself.' I am cautiously optimistic and giving monthly to those who are on the front lines of this protracted struggle.


Picture Congress grilling someone in hearings, and then demanding they be fired.

A few dozen times.

Then there's an attack, and the President gets to lecture us about weakening security. Then everybody hangs their heads and lets the agencies do whatever they want again.

I personally believe our representatives in Congress are terrified of being the one blamed for weakening our security.


This, of course, makes the assumption that such monitoring actually does make our security stronger. But there's a lot of reason to doubt this.

Most recently, the shooting at Garland, TX. It seems the FBI knew about this ahead of time, and did a spectacularly bad job of warning the local authorities. But the attack was averted anyway, and according to the police chief there...

What does this all mean? Not much says Police Chief Bates, "Please note that the contents of that email would not have prevented the shooting nor would it have changed the law enforcement response in any fashion."

http://www.npr.org/blogs/thetwo-way/2015/05/11/406025002/tex...


No, it makes the assumption that the public can be convinced that monitoring makes our security stronger.

There's an enormous world of difference between those two things.


Picture the attack being something agencies knew for months but decided to let happen to teach people a lesson and revamp their operations...

(Yeah, that would never happen...)


That's to be expected. The NSA/CIA/FBI/etc all have to meet expectations that are pretty much unreasonable. We basically tell them "You're not allowed to know everything but you have to prevent everything". And when they don't prevent things we haul them before the public and whip them. Of course they'll do everything they can to work around the law.


This might be a reasonable argument if there was any direct evidence that all of the billions spent on "collecting it all" had lead to the actual discovery of any plots that would not have been found by other means. But, as with "enhanced interrogation", I am not aware of any credible evidence to that effect, despite the incredible incentive for the government to manufacture some. We knew about the 9/11 attackers before their attack, but failed to put that information to good use.

Trying to know everything does not work. Targeted, traditional police investigation works. Money diverted from the latter to the former is wasted and reduces safety.


I don't believe their mandate is to prevent everything. Yet it seems many of my countrymen will sacrifice anything so that they can have the illusion that it is true. Thus empowering many of our civil servants to greatly overstep the bounds of their mandates and duties.


>"You're not allowed to know everything but you have to prevent everything"

These programs have been in place since at least the Clinton years, yet that didn't stop, say, 9/11. Nor did it stop the recent Boston bombers. Cases we do see stopped are often by lone nutters "buying" terror materials from law enforcement agents posing as terrorits. Kudos for catching these guys, but they are completely unsophisticated enemies. The sophisticated ones don't go on AOL chat asking for plastic explosives.

There are probably practical limits with SIGINT domestically. I think the argument that stopping crime is just like detecting a hacker on your network is fairly weak sauce. Our prevention outcomes will probably be the same if we started cutting these programs.


> "You're not allowed to know everything but you have to prevent everything".

The thing is, security agencies (not just in the USA) have failed, repeatedly, to act on information they did have. Part of if may have been due to inter-agency rivalries, part of it may have been the agencies drowning in data and being unable to draw any useful intelligence from it. But with this in mind, the demand to let them gather more and more data seems unlikely to solve any of these problems, even if one does not care much about privacy.


Even with the dragnet surveillance in place, the only thing they've prevented are their contrived "plots" that they orchestrated.

And the reality is, effectiveness is complete irrelevant: the search is unconstitutional, even if it demonstrably saved lives.

Americans are just too willing to throw their freedoms at the boogie man.


Precisely--this result only occurred here because of the combination of (1) an activity that is clearly* outside the express statutory authorization, (2) a whistleblower that provided indisputable evidence of the activity, and (3) an independent judiciary that (sometimes) doesn't kowtow to invocations of national security and state secrets doctrine.

Most of the other programs are missing these conditions and won't see effective challenges.

* yes, clearly. As others note above, the drafters of the statute have gone on record saying it was not intended to authorize bulk collection.


Just because it's illegal doesn't mean it has to stop.

The reality was it was pretty difficult to call it legal with a straight face even before this ruling on 4th amendment grounds (even if congress calls it legal, the constitution supercedes it).

For an authoritarian, the law is whatever they say it is.


This wasn't a 4th amendment ruling. It was based on the language of the applicable statute. Also, it was also very easy to call the program legal prior to the ruling.

From the perspective of the agency, they've got a Supreme Court case (Smith v. Maryland) that states that people don't have a privacy interest in phone call metadata. Monitoring the phone metadata of many people versus one person is just a matter of scale, and scale is not really a factor for the 4th amendment. I can't think of anything where the Supreme Court has said that something is legal under the 4th amendment for one person, but not for millions of people.


They've made other scale distinctions though, for example Terry, with limits on length and scope of the stop in relation to the lower suspicion level, and others, so its not a ridiculous proposition.


He didn't say it was a fourth amendment ruling. The initial statement is a little ambiguous, but the subsequent parenthetical makes his intent clear.


I tend to agree. From what we've seen so far, one has to assume the NSA does not really care about the legal status of its activities. As we say in Germany: Legal - illegal - Scheißegal.

They may rename the program, shuffle it to so other branch of their organisation, but I don't think they are going to stop. (Another problem, of course, is that they would have a very hard time proving they stopped, even if they did. If they just said, "yeah, we're sorry, won't happen again", who would believe them?)


> Another problem, of course, is that they would have a very hard time proving they stopped, even if they did. If they just said, "yeah, we're sorry, won't happen again", who would believe them?

This is a good argument for abolishing the NSA. As an institution it has completely lost credibility with any reasonable member of the electorate - it is hopelessly naive to believe what they say.

Perhaps it can be redeemed with a sustained program of vigorous oversight (over-vigorous, really), but failing that it needs to be abolished and replaced by a new organization with a different charter and most of the influential members of the NSA absent from the levers of power. Of course, neither of these things are likely to happen with the electorate in the state it's currently in.


> From what we've seen so far, one has to assume the NSA does not really care about the legal status of its activities.

To the contrary, what we have seen so far is that the NSA has structured its activities around well-defined legal principles:

No privacy interest in things crossing the border -> tapping cross-border fiber cables but not purely domestic ones.

No privacy interest in information held by third parties -> sending third-party subpoenas instead of directly tapping companies' networks.

No privacy interest in phone metadata -> collecting phone metadata.

Inapplicability of the 4th amendment to foreign nationals not on U.S. soil -> filtering out purely domestic communications.


> No privacy interest in information held by third parties -> sending third-party subpoenas instead of directly tapping companies' networks

really?

https://plus.google.com/+MikeHearn/posts/LW1DXJ2BK8k


If you follow the links in the article:

> We do not know exactly how the NSA and GCHQ intercept the data, other than it happens on British territory.


Please give me the url that contains that text string in the body, because I can't find it. I followed those links.

I did find this though(directly tapping companies networks in the past):

In 2011, when the FISC learned that the NSA was using similar methods to collect and analyze data streams — on a much smaller scale — from cables on U.S. territory, Judge John D. Bates ruled that the program was illegal under FISA and inconsistent with the requirements of the Fourth Amendment. [0]

[0] http://www.washingtonpost.com/world/national-security/nsa-in...



Thank you. It would appear that collection under the MUSCULAR program relies on UK fibre links.

Given previous, I'm going to assume they still do routinely collect data between US data centres on fibre links - but that's only an assumption. No supporting evidence.

For the same reason, and previous behaviour, given no evidence to the contrary - thinking that they don't is only an assumption too.


"... not purely domestic ones."

Doesn't room 641a fit that description perfectly?

https://en.m.wikipedia.org/wiki/Room_641A


The cables are AT&T's property, and it would be a violation of their rights if the NSA tapped the cables without their consent. But it appears that AT&T itself was operating the tap.


The loss of trust is what I think is most damaging.


Who would have guessed that approving a secret directive by a secret court could be against the law...


Only in free countries, in petty tyrannies it is probably very acceptable :(


Here is a case where having ALL records is claimed to have been relevant: pinning the 2005 assassination of Lebanon's PM to Hezbollah [1].

As we all start to internalize the value of metadata criminals will avoid using systems that expose it. This may reduce the value of this technique but I somehow suspect it will not remove it. So while arguing that the data isn't worth as much as claimed certainly sits well with me and other privacy advocates I wonder how long that argument will last.

[2] The panel noted that the government never “attempted to identify to what particular ‘authorized investigation’ ” the data of all Americans’ phone calls would be relevant.

I think this argument is also weak. That the act of collection has been limited to specific investigation has more to do with the physicality of historical communication mediums. At least I believe this has a greater influence over those limits than the idea of privacy. So I wonder how far this argument will hold. I will be happy if it holds in "public v. NSA" but suspect somewhere in the future, under some other constellation, it may not.

1. https://news.ycombinator.com/item?id=9498119

2. http://www.washingtonpost.com/world/national-security/appeal...


I'm mostly just curious about who would enforce the ban. Is there really any enforcement agency that will police the others, when they all benefit from surveillance? I just don't trust that we could ever really be sure that it's been shut down.


FBI. Not only is it a primary function, but they are always quick to downplay NSA contributions whenever the NSA tries to get credit for helping to stop something.


Why the ruling against NSA’s phone records program could have huge implications

...but probably won't. Because security.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: