The NSA's Lockbox Has No Lock
from the like-that-won't-be-abused? dept
One of the key points that officials have been making in defense of the NSA surveillance is this idea that even if they're collecting all this data on your communications, they can't actually do anything with it, because they keep it safely locked up in a lockbox, and only check it if they have some bit of data they want to find out about later. That was the crux of the claims made by former NSA/CIA boss Michael Hayden who seemed to think that "data mining" and "asking the database questions" were two different things. However, as William Saletan is pointing out at Slate, the lockbox is a lie. There is no lockbox. He quotes officials including NSA boss Keith Alexander and Congress's number one NSA apologist, Rep. Mike Rogers, both suggesting strongly that even if the NSA is collecting all your data, it's safe because it can't be explored without a "very specific court-ordered approval process."Except... what they conveniently left out, is that the court doesn't review any of this. It appears that it probably set some very basic rules up front when it gave the okay on collecting the data, which no one else gets to know about, and no one carefully checks up on the NSA later to see if they really follow any of those rules. What the claims most certainly do not mean, is that the NSA needs to get a court order to search the database. Senator Dianne Feinstein admitted as much directly:
Q: Is a court order necessary to query the metadata database?And yet, as the article notes, most of the defenders of the program strongly imply otherwise, highlighting the "court-approved" process that people need to go through to query the database. But if there's no real oversight, and no court reviewing each query, then, as Saletan points out, there is no lockbox.
Feinstein: Is a court order necessary to query—
Q: The metadata database under 215. An individual court order for each query.
Feinstein: A court order—well, I don't know what you mean by a query. A court order—
Q: To search the database.
Feinstein: To search the database, you have to have reasonable, articulable cause—
Q: Certified by a judge?
Feinstein: —to believe that that individual is connected to a terrorist group. You cannot—
Q: But does that have to be determined by a judge?
Feinstein: Could I answer? You may not like it, but I'll answer. Then you can query the numbers. The only numbers you have—there's no content. You have the name and the number called, whether it's one number or two numbers. That's all you have. Then you can get the numbers. If you want to collect content, then you get a court order.
Q: So you don't need a court order for the query itself.
Feinstein: That's my understanding.
There's no lock on the lockbox.If there's no public standard, and no official oversight or review process, then the probability that the database is being abused approaches one very, very quickly.
That hasn't stopped current and former government officials from repeating the lockbox line. Yesterday Rogers used it again on Face the Nation. Dick Cheney, appearing on Fox News Sunday, backed him up. On Meet the Press, Michael Hayden, the guy who ran the NSA when it began collecting phone records, assured Rep. Bobby Scott, (D-Va.,) "The only way you can access the metadata is through a terrorist predicate." When Scott asked, "Where is that written?" Hayden replied: "It's in the court order." Really? Where's the court order? When is it applied, and how?
If the court isn't screening data requests, that leaves two possibilities. One is that nobody's screening them. The other is that some other, unknown entity is doing it in a way that nobody has explained. Either way, the answers we're getting are unacceptable. They betray privacy, public trust, and national security.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: court order, lockbox, nsa, nsa surveillance, oversight
Reader Comments
Subscribe: RSS
View by: Time | Thread
No locks eh?
[ link to this | view in chronology ]
Re: No locks eh?
[ link to this | view in chronology ]
Re: Re: No locks eh?
SELinux was developed by the NSA.
Of course, they don't seem to be taking advantage of the features they designed, namely the strong access control features.
[ link to this | view in chronology ]
Re: No locks eh?
http://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/database_servers.sh tml
[ link to this | view in chronology ]
Re: Re: No locks eh?
[ link to this | view in chronology ]
Re: No locks eh?
[ link to this | view in chronology ]
Which means any hacker worth his salt will be able to ALSO use the massive NSA database for their own ends.
I'd like some reassurance of how few (or rather, how many) people actually have access to this supertrove of data.
What would it take to force the NSA to purge the thing and stop?
[ link to this | view in chronology ]
Re:
Login to the NSA database, (Il'l Bet the password is 12345), then type:
DROP `DATABASE`
Done!
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
Oh, wait.
[ link to this | view in chronology ]
Holy pfargtle. How do they put stuff into it?
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
This is what happens when you have someone incapable of understanding basic terminology behind the technology they're using.
[ link to this | view in chronology ]
Re:
That and browsing the data feeds, gosh, in pretty much real real-time, is not exactly a well formed query. I can see how some clarification on the usage of "query" may have been necessary.
[ link to this | view in chronology ]
If you can query a database, the only thing stopping you from making other queries is you not a judge and if there is nobody looking there is no lock, is the judge the one that gives some sort of digital key to open the query station for them?
I doubt it is done that way.
The analogue version of this would be locking someone in a warehouse full of documents collected from everywhere and leaving the guy in there only to come out and ask the judge to authorize his use of some piece of paper he found in there.
The government is not naive, they know not to allow access to sensitive information to anybody, they put several layers of protection and when you need something you need to go ask authorization to someone to unlock so there is a paper trail, but somehow they devised a scheme where there are apparently zero safeguards real safeguards in place and are telling people that it works the way they say because they say so.
Right.
[ link to this | view in chronology ]
So why should you think Google is any better?
http://gawker.com/5491756/six-delusions-of-googles-arrogant-leaders
Schmidt also said Google has been known to curb its own creepy impulses:
"There are many, many things that Google could do, that we chose not to do... One day we had a conversation where we figured we could just try to predict the stock market. And then we decided it was illegal. So we stopped doing that."
http://www.theregister.co.uk/2010/09/23/schmidt_on_colbert/
Schmidt: 'Google doesn't do data mining'
That last is EXACTLY what the NSA is saying here.
[ link to this | view in chronology ]
Re: So why should you think Google is any better?
Go back to 4chan you troll.
[ link to this | view in chronology ]
Re: So why should you think Google is any better?
You might as well have just asked for obama's long form birth certificate
[ link to this | view in chronology ]
2) a full candy jar
3) an easily opened lid
4) parents are out of the room
Yeah, that plan is flawless.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
BAWK! BAWK! BAWK! Let's milk this chicken dry!
[ link to this | view in chronology ]
Re: Re:
Sounds sexy.
[ link to this | view in chronology ]
Re: Re: Re:
BAWK! BAWK! BAWK!
[ link to this | view in chronology ]
Re: Re: Re: Re:
[ link to this | view in chronology ]
Re: Re: Re: Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
We all know what they're thinking about...
[ link to this | view in chronology ]
Re: Re: Re: Re:
[ link to this | view in chronology ]
Re: Re: Re: Re: Re:
Let our people go!
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: Re:
You sir, made me giggle so hard I peed a little.
PS - Just noting that cuz Joe likes watersports.
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: Re:
I just about died when I read that... I cant stop laughing...
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: Re:
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Just wait 5 or 10 years when people run for office
[ link to this | view in chronology ]
Re: Just wait 5 or 10 years when people run for office
[ link to this | view in chronology ]
Re: Just wait 5 or 10 years when people run for office
[ link to this | view in chronology ]
Damn Bureaucrats
Q: But does that have to be determined by a judge?
Feinstein: Could I answer? We see here a classic flaps step.
You may not like it, but I'll answer. This is another classic step called digs.
Then you can query the numbers. The only numbers you have—there's no content. This move is called the riff.
You have the name and the number called, whether it's one number or two numbers. That's all you have. Then you can get the numbers. This is a complicated step called the Shuffle bufflo.
If you want to collect content, then you get a court order.
Finally we end with yet another very complicated step called the pull backs single to double.
[ link to this | view in chronology ]
Why's he so desperate to censor this?
[ link to this | view in chronology ]
http://bit.ly/14gT9mc
[ link to this | view in chronology ]
Here you have no oversight, no public visibility for verifying the process, and the court supposedly responsible for oversight doesn't.
This sounds like a whole bunch of politicians who are in on it not wanting to be exposed and nearly everything you are hearing are lies.
Only the light of public scrutiny will now clear up this stain.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
Right now, there isn't. That's an even bigger problem than any individual program, as the lack of oversight is what allows these egregious individual programs to persist.
[ link to this | view in chronology ]
it's the police state you guys wanted
[ link to this | view in chronology ]
And now that you are paying attention;
' -- select concat('drop table if exists ', table_name, ' cascade;') from information_schema.tables; --
[ link to this | view in chronology ]
Mr. Freedom hates that his constituents even know this link exists.
More to come!
[ link to this | view in chronology ]
Mike hates this post so much that he's going out of his way to censor it: http://tr.im/44w44
the next edition will be out very soon.
How hard will he work to hide that from you too?
[ link to this | view in chronology ]
Re:
The last few days (could be over a week or more; I've not been paying sufficient attention to when it started), Techdirt has been lagging, & I've been getting "Techdirt is not responding due to a long script running" errors.
Today, I'm getting those script errors, & additional lagging, trying to uncollapse the Hidden posts (if I'm going to read the comments below them, I'd prefer to know what they're replying too... I do sometimes regret trying to read the IQ reducing stupid).
I've been considering reporting these lags, & so now I have.
I also will point out that I sometimes have to use IE10's Compatibility Mode a lot to get the Funny/ Insightful/ Report buttons to display (it's inconsistent, & sometimes even that doesn't work & an additional refresh is required).
I have noticed that the pop-up whatever those are lag again, as well. & one has to keep being closed every refresh/ with each new page opened.
Hopefully, this report is helpful enough to find out what the problems are.
[ link to this | view in chronology ]
no warrant: who you call
warrant: what you said
[ link to this | view in chronology ]
Then they say 9/11 could have been avoided if they had all that data. How do both statements fit together? The only possible way they could look at the data if available would be to have a court warrant which means they'd need to argue that there's a probable cause and this could only be done by normal police work which would have raised some data first.
Providing a warrant is given, the telcos store metadata as what was collected for a good while thus making such preemptive surveillance completely unnecessary. Their own arguments kill each other.
No really, just a peek.
[ link to this | view in chronology ]