Judge: NSA doesn’t have to keep all data as part of key surveillance lawsuit | Hacker News Reader

Judge: NSA doesn’t have to keep all data as part of key surveillance lawsuit

arstechnica.com

56 pointssinak20 comments

So, "collect it all" ... unless you're in court, in which case it's okay to delete key evidence because it's "hard" to keep evidence?

Snark aside, this part made me curious:

the NSA may have to shut down all systems and databases that contain Section 702 information in order to preserve [it]

Is this really just a technical problem: a system design that failed to anticipate how legal proceedings would / could interact with the minimization feature? (Of course, they probably never expected the former.)

> Snark aside

Is it really snark? Cops pull the "missing evidence" stunt all the time and get away with it, why should we expect different from the NSA (now that they're playing at being a law enforcement agency)?

> Is this really just a technical problem

I wouldn't go so far as to say this happened by design, but at the end of the day does it really matter? Opportunistic evil is still evil, and this opportunity dangles the temptation of opportunistic evil in front of a group of people that don't exactly have a sterling track record of self-restraint in such matters.

EDIT (re:downvoters): I realize that the court order has more to do with the ongoing court case than ongoing retention policy. That doesn't make ongoing retention policy irrelevant.

It's a bit like the government using a whiteboard to track terrorists and the court has asked them to preserve what's on the whiteboard. The government considers this too burdensome because if they can't erase the whiteboard they have to stop all tracking of terrorists.

Unfortunately, scientists are still working on the ability to copy information. Perhaps some day they'll crack it.

Doesn't it make sense that the court tell the government to not only shut down the service to retrieve the data, but also keep it offline until they have made modifications to allow the court to inspect it? It would only be reasonable that such programs be, at a minimum, prepared for court oversight. If preservation of evidence cannot be guaranteed then the program should not be used to enforce the law. I find it particularly troubling that this system was not only never envisioned to be used to pursue a warrant from the courts, but also designed to make it impossible to do so by making the act of proving the legality of the evidence collected by making a chain-of-custody analysis deliberately conflict with national security interests. I believe this is clearly analogous to a defensive weapon which is designed to kill enemies of the country, but although it regularly also kills civilians the government refuses to allow it to be inspected (and potentially fixed) using the excuse that turning it off would harm even more civilians. I unequivocally support the defence and enforcement of our national security, political and economic interests. However, I find it entirely unreasonable to sacrifice the freedoms from which our nation sprung, political and economic systems included, in order to preserve it.

The NSA program is too big for due process.

Yes, having to preserve all that stuff is a big burden when you already have do a 72h rollover given the immense amounts of data being collected. It's as if the people designing this didn't exactly account for the possibility of judicial inquiry.

Or they did it on purpose, like how they're saying they can't offer e-mails of NSA employees because they don't have the proper search mechanism for it.

http://www.rawstory.com/rs/2013/07/23/nsa-rejects-reporters-...

You'd think that after the Snowden leaks they'd do everything in their power to log everything, so it doesn't happen again and/or they know exactly what the leaker took next time. But no, they prefer to be kept in the dark by what the people in their own agency are doing. And then they keep claiming to Congress and the population that they have "strict oversight" (by which they mean no oversight, just like with the meaning of the word "relevant" or "truthful/least untruthful"). The whole thing is a farce.

Do civilian webmasters or Dev/Ops personnel typically retain all the data they transmit or receive along with the metadata as well?

That's what I'm still confused about here; why couldn't the court order the NSA to retain some set of metadata on the 702 programs they are running? Why does this entire argument revolve around the binary decision of all possibly relevant data and metadata or none of it?

Even if NSA has to filter heaps and heaps of metadata (which is the "data" for their system), they could easily retain summary information of what data was filtered, whether it's filtered by subnet, identifier, etc.

As made clear in the past year by both NSA and EFF, metadata can reveal a lot about the activities of a person (or in this case, an Agency). I think it would make more sense for the EFF to push for specific items to be retained by NSA for civil discovery instead of "all NSA intake via 702".

Because Rule 26 of the Federal Rules for Civil Procedure, which governs discovery, specifically rule 26(b)(1) is quite broad in scope, and even sanitizing it of non-privileged information (most likely classified data in this context) could allow outside parties to make structural inferences that would compromise intelligence gathering activities.

As a cheesy example, suppose I have files that note the existence of Alice, Bob, Carol, and Donald, and suppose furthermore that I suspect Carol of being a spy. You object to my surveillance activities and ask discovery of same. My evidence that Carol is a spy may be obviously privileged, but if I give you my files on Alice, Bob, and Donald it's easy to guess that I view Carol as somehow different from the others.

Now, I could in theory furnish minimal information on Carol that would not clearly distinguish her from the other three, but that puts the Executive Branch in the awkward position of making judgments about what degree of truth it is appropriate to provide, which is the sort of thing that is properly the province of the Judicial Branch. So the Executive Branch argues that compliance would necessarily mean an abrogation of Judicial Branch functions if it is not to impair he Executive Branch's lawful security function, and now you've got a separation-of-powers problem.

What happens in many cases and may happen in this one, is that if there isn't a clear legal principle which guides the balance of the interests the Court may review the material in question and decide exactly what should be handed over and what can be retained, which decision might then be appealed to higher court by one party or the other.

Good points, all. It would probably be easier to argue about particulars if EFF had suggested any (though maybe they've made such feelers already in private).

It's not the preservation of the data that's the problem, it's the collision of civil procedure discovery rules with natioanl security issues: The EFF had wanted the NSA to preserve all data collection in bulk, regardless of what legal authority it was collected under — that way, the government would be forced to hand it over as part of the discovery process as the case moves forward.

In general, disputants in civil litigation have to provide complete transparency. If I sue you over a business matter, for example, you have to provide everything that you might have on record in relation to that business matter, not just those documents which are responsive to my initial complaint. My lawyers will then pore over those records and file an amended complaint that makes maximum use of your information against you. In turn, your lawyers will almost certainly counter-sue me and make a similar request for my documents on the matter, to find out whether I know something that you don't. This is completely different from a criminal warrant, where the state has to articulate in advance waht it's looking for (although such requests can be fairly broad).

The reason it works this way is because civil itigants are ofen at a severe disadvantage. If I have a bad experience with BigCorp and sue, I don't know in advance what specific documents or records to request for evidence, because I'm not privy to BigCorp's inner workings, have no insight into which BigCorp employees or managers were involved with the situation or what actions they took, and so it would be very easy for BigCorp to give me the runaround - an experience most people are familiar with if they've ever had a problem with a bank or received poor customer service from a large organization. So the civil discovery process is designed to correct that imbalance by giving a plaintiff's attorney access to all the same information as the defendant's attorneys, and allowing plaintiffs to amend their complaint for greater specificity after the discovery process. (Of course this system can be abused too; some defendants will deliberately swamp a plaintiff with far more information than actually requested, in order to leave the plaintiff's attorney's looking for a needle in a haystack. Attorneys usually contract out that research task and after the verdict is passed down there is often further litigation about the appropriate assignment of expenses.)

Now, of course the discover process can involve a defenedant having to hand over a great deal of information that is not relevant to the actual dispute, with negative implications for privacy and business confidentiality. But since attorneys are all officers of the court, they are bound as part of their license not to make public any information they receive which is not responsive to the matter being litigated. For example, suppose a plaintiff's attorney discovers that the CEO of BigCorp is having an extramarital affair, but that fact isn't germane to the litigation. The plaintiff's attorney would be subject to severe sanctions, maybe even disbarment, for leaking or threatening to reveal that information at trial in hopes of causing embarrassment or jury bias towards BigCorp.

So here the EFF is saying (as is normal) 'give me everything you've got, our lawyers will sort through it and cherry pick it for relevance.' The NSA is arguing in turn that it can't do so because the EFF's legal team doesn't have the relevant security clearances, and that the public's security interest eclipses the public's transparency interest - which may well be true, in Constitutional terms. A lto of people liek to argue that the Constitution, or more specifically the Bill of Rights, exists to protect the people from government tyrrany, but the BoR is only part of the constitution and doesn't automatically trump other parts. The Constitution also grants a large number of powers to government and the legal authority derived from that stands on an equal footing with the public's interests that are articulated in the Bill of Rights.

I respectfully disagree with your comment on the Bill of Rights. The Bill of Rights is the collection of the first 10 amendments to the Constitution, and made so under the power conveyed by Article 5 of the Constitution. Article 5 clearly allows for amendments to the Constitution, and a clear instance of when this is the case is in Article 1 Section 9 Paragraph 4 being amended by contrary language in the 16th Amendment. However, not all amendments are clearly contrary to, or magnifying the verbiage of the original text. In these cases, it is up to the courts to decide. One could argue that calling the discovery process "unduly burdensome" and "conflicting with national security interests" is absolutely not to trump "free speech" and "due process." Are these constitutional issues clear-cut? Not at all. We need the courts to make careful legal decisions which err on the side of freedom instead of caution IMHO.

What we need is the Transparency Amendment. After X many months (not years) information the PEOPLE's government collects, and the rational behind collecting it, must be made public. NO MATTER WHAT. You can't have your cake and eat it too; it's simply not the way this universe works.

I'm in favor of formalizing such a rule, but a period of months just isn't realistic. As a very simple example of why, consider how easily this would enable financial fraud; you could lay the groundwork for a fraudulent scheme early in the fiscal year, wait for a six-month 'transparency window' to close, and observe whether your prior activities had attracted official notice or not - if not, you could proceed with impunity.

I'm not saying this to pour cold water on the idea; it's one that I think should be explored and refined, as part of a general framework of privacy protection for the individual - that is, I'd like some degree of sovereignty over my personal data as regards commercial as well as government uses. I think the EU is a good way towards this.

"6-months" isn't a statute of limitations in this idea. The govt could still investigate later.

Alternately you could make all your data available publicly at a price set in Bitcoin units. Gathering all that data from everyone would be extremely expensive.

I feel the same way (that these are very complex issues in which the appropriate balance is best determined by the courts). I'm trying to pre-emptively address the populist arguments which are often articulated here in which only the BoR is given the time of day.

'Secur[ing] the Blessings of Liberty' is certainly a key constitutional imperative, but so is 'provid[ing] for the common defence'; failure of the latter arguably results in a de facto abridgement of the former. My more utilitarian side would like to always resolve such balancing problems in favor of greater liberty and rely on the emergence of self-organizing political structures, since we are clearly not governed by angels; on the other hand I'm increasingly in sympathy with Madison's corollary that 'if men were angels, no government would be necessary.' Between a sad misanthropy and the limitations of foresight, these days I more inclined to a reluctant deontology which puts greater trus tin institutions than individuals.

'Secur[ing] the Blessings of Liberty' is certainly a key constitutional imperative, but so is 'provid[ing] for the common defence'; failure of the latter arguably results in a de facto abridgement of the former.

I will argue that the inverse of that is equally true. If we don't have Liberty, what exactly is left that's worth defending?

If it were such a simple decision, to put your trust in institutions versus individuals, we wouldn't have an issue. Unfortunately, the interests of any institution are driven by the clique that controls it, effected by those that encompass it, supported by those that fund it, and opposed by those it disturbs. The institutions themselves are interdependent and so the placement of trust onto one institution without checks and expecting any other outcome than the monstrosity our surveillance infrastructure has become is a grave error; one that has already been committed.

It is inarguably not the fault of the NSA directly that their information systems were used in other, potentially illegal ways. It's hard to blame anyone when a local county police officer gets an order from the state drug enforcers to pull over a car for any possible reason. It's hardly the fault of the state police for following the instructions of the local DEA office. And it's hardly the DEA's fault that their information about drugs coming from foreign countries, information that came directly from the NSA, is accurate and actionable. Furthermore, it's none of their responsibility to question the legality of how the information was acquired. They have it and are able to use it in conjunction with a drug-sniffing dog to detect the drugs without, in theory, breaking any laws.

However, this situation can only exist because our rights were traded for security. One could argue that stopping this car is absolutely necessary, and that if the information that "a black SUV is travelling east on the highway around 8pm and carrying narcotics" is available, that it should be actionable. However, this makes for a lot of upset middle-aged mothers and their children being pulled over at gun-point and approached with the "extreme prejudice" mentality because the situation was pre-empted by intelligence information. Reliance on trust in eavesdropping on everybody effectively leads to living a life of terror where it is common-place to be considered a suspect before being clearly identified as one.

This is so common that just in the past 5 years we've had numerous reports of tactical assaults on the vehicles and homes of unsuspecting citizens. Surely, all of us would react to such a situation with an intention to defend ourselves; it is expected and entirely justified. However, it is equally justified for a police force to react with deadly force to a criminal they have been following and know to be dangerous. It is completely inappropriate for the police to approach someone whom they only suspect of being a criminal because of "intelligence information," and attempting to settle the situation with deadly force.

No, we cannot have our entire trust in institutions. Sometimes, we must count on the people that constitute them to make the right choice. It is clear that the abuses to the people that came as a windfall from the lack of oversight in the intelligence community were planting seeds for many Snownden-type actors. We are only left to wonder how many of them were detected in the past year and neutralized surreptitiously. If we can't trust our government to establish internal checks, then we must rely on individuals to alert us of its failures. They most certainly will not do so themselves.

Oceania here we come.

so... the government can force carpathia to spend thousands of dollars a day, but can't manage to keep its own data intact?

Reply on news.ycombinator.com