Hacker News new | ask | show | jobs
by csoghoian 4745 days ago
Justin, have you read the recently leaked NSA rules outlining how they define a non-US person for the purpose of FAA surveillance?

See: http://www.guardian.co.uk/world/interactive/2013/jun/20/exhi..., page 4, paragraph 1.

If the NSA does not know whether someone is a US person or a foreigner, the agency assumes that the person is a foreigner. That matters a lot if, for example, you're using Tor.

You might also want to look at the recently leaked minimization rules, which permit the retention of purely domestic communications collected under the FAA, if that information can be used to develop and exploit security vulnerabilities. Given where you work now, and what you work on, that might be somewhat important.

See: http://www.guardian.co.uk/world/interactive/2013/jun/20/exhi..., page 5, paragraph 3.
1 comments
justinschuh 4745 days ago
Chris, that's one paragraph absent the surrounding context. Targeting must be validated and verified as outside the US, but beyond that it can be very hard to authoritatively guarantee what the nationality of the parties is. The best I can add is that I've done the job, and I know the cardinal rule is you do not collect on US persons except in the rare case that you have a FISA order. And the people I know still doing the job concur that hasn't changed. Violating it willfully or negligently means the end of a career and possible jail time.
link
csoghoian 4745 days ago
There appears to be a bit of a conflict between the cardinal rule you were taught when you worked at NSA of not collecting information on US persons with the current practices of the NSA.

The Section 215 program in which the NSA has been collecting metadata about every domestic telephone call would appear to violate that rule, even if, as we are told, only a couple dozen NSA employees can query the database, and even if they only use it for investigations related to terrorism.

Likewise, the non-us persons targeting rules leaked last week suggest that the NSA has ongoing access to GSM Home Location Register data for the entire United States. While this doesn't pinpoint someone's location to a house or street, we're still talking about the NSA getting city-level location data for hundreds of millions of innocent Americans.

See page 6 of: http://www.guardian.co.uk/world/interactive/2013/jun/20/exhi...

Given how compartmentalized NSA is, it seems quite reasonable that your former team (which, I assume, penetrated the computers of foreign targets) would have no contact at all with the teams tasked with collecting domestic communications.

link
justinschuh 4745 days ago
I don't know what was ambiguous about "except in the rare case that you have a FISA order." I'm dubious of the metadata thing (a bit less knowing that it is not part of the collection and A&P pipeline), but the fact is that it was approved by the FISA court and an order was issued.
link
lawnchair_larry 4745 days ago
You're clearly using the bullshit redefinition of "collect" here, because you know damn well that's a lie.
link