NSA Chose Invasive Phone Analysis Option

Encrypted Anonymous Coward writes "The Baltimore Sun reveals the existence of an interesting experimental NSA program codenamed ThinThread from the late 90`s. The program involved link analysis of traffic data, with a twist; The phone numbers from the U.S. would only be analyzed in an encrypted form. This way the analysis would potentially be possible under existing privacy laws, according to the people behind the program. The NSA could gather further unencrypted details if there was evidence of a threat. Political infighting seems to have dropped an interesting and respectful program from the books."

Comments

Privacy Issues

[alx5000]

Well, if that is legal, I recommend you to change your laws...

Anonimity isn't really privacy. When I say "I love you" or "I'm going to kill you" I want to know it's ME saying THAT to THAT PERSON who is meant to receive it, and to no one else. I don't wanna be an anonymous coward sending my thoughts over to the NSA and get busted because they can look up my IP if I've been a bad boy...

Re:Privacy Issues

[Enderandrew]

For better or worse, there really isn't a real "Right to Privacy" in the Constitution. The fifth amendment means you can't be forced to incriminate yourself, and we have laws about the collection of evidence.

However, people demand security. Often security and privacy conflict with one another and we as a society need to decide where that line needs to be drawn. If we don't want the government to look over our shoulders, then we can't bitch when they didn't see something coming.

Re:Privacy Issues

[mausmalone]

But the "right to privacy" in the sense of a right not to have unwarranted searches and seizures definitely extends into the realm of wiretapping and phone records. The government wants these records specifically to see if you're doing anything illegal, not for a benign purpose. In that respect it should fall under the fourth ammendment.

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

Obviously at the time of writing, phone lines didn't exist, but it's reasonable to see that as an "effect" belonging to an individual.

Re:Privacy Issues

[Jim_Maryland]

Having done some evaluation of products like Centrifuge for data analysis, showing patterns of calls alone is likely not enough. You really want to tie additional associations (person_to_organization, person_to_person, person_to_building, person_to_events, etc...) in order to derive intelligence. If they are looking for patterns without additional information, I'm not sure what NSA hopes to accomplish. I'm sure if they tracked calls from my cell phone, they'd find odd patterns when my kids get a hold of it (repeated calls to my wife's phone in order to annoy her).

Re:Privacy Issues

[MojoRilla]

For better or worse, there really isn't a real "Right to Privacy" in the Constitution. The fifth amendment means you can't be forced to incriminate yourself, and we have laws about the collection of evidence.

Uh...what about the fourth amendment?

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

I would consider monitoring my phone calls to be an unreasonable search, without probable cause.

Re:Privacy Issues

[Ohreally_factor]

Thank you!

One of the scariest/funniest things out of the Attorney General's mouth in response to the revelations back in December, was that the searches* "weren't unreasonable", and thus didn't need warrants.

*phone taps

Re:Privacy Issues

[Total_Wimp]

I think you're misunderstanding. The proposed program would look at phone call records only, not actual phone calls.

So what? Sorry, I don't mean to be flipant, but gathering my confidential call data and looking for criminal activity in my mind is as much a search as a pat down. The fact that they're not actually listening to me talk sexy with my girlfriend is nice, but it doesn't correct the problem that a the state would be analysing the time and phone number of every call I participate in then they'd be making a determination of whether or not I was probably a criminal. When the government conducts routine searches of our routine daily activities then that, in my mind, is both unreasonable, and, as a result, unconstitutional.

TW

Re:Privacy Issues

[EvolveFuzzy]

The, "there is no right to privacy in the constitution," argument requires a strict interpretation of the constitution and it's amendments, and that you completely ignore the 9th amendment which specifically addresses the concept of unenumerated rights. I'm so tired of this myth.

Re:Privacy Issues

[TheCarp]

I don't care.

The problem here is and always has been the potential for abuse.

The FISA court exists for a reason you know. Why? Not because of some theoretical use of wiretaps to infringe on privacy.... because they were activly tapping the phone calls of people like Dr Martin Luther King in every hotel that he visited trying to dig up dirt on him.

This isn't conspiracy theory, its conspiracy fact. It is a matter of congressional record that wiretaps were indeed used to follow innocent people for political reasons.

Besides, sure, today its just intelligence on terrorists. However, once the system to do it is there, the ability to abuse it is there. All it takes is one unscrupulous operator, or a little pressure from a director, or dare I say, a secret presidential memo, to cause the system to be abused to any number of ends.

This is why we need oversight, and we need to hold these people responsible for what they do. If they can wiretap with impunity, then why not wiretap with impunity? If there is no punishment, then there is a lower bar to doing it.

Frankly, I think these programs should be outed, and every signle person involved, all the way up, should be indicted.

That goes for this program (if it was indeed illegal, if not they should fix the law), and the presidents wiretapping program thats been in the news. Intictments and impeachments are what should be going on right now.

-Steve

Re:Privacy Issues

[MacJedi]

The Supreme Court of the United States has generally ruled that the right to privacy is protected by the 9th ammendment and that aspects of the right privacy are explicitly protected, as you noted, by the 4th and 5th ammendments.

See: Loving v. Virginia , Griswald v. Connecticut and Eisenstadt v. Baird , among others.

Re:Privacy Issues

[caudron]

there really isn't a real "Right to Privacy" in the Constitution.

Well, actually, in 1965 the Constitutional basis for a right to privacy was recognized explicitly by the Supreme Court. It began with the case of Griswold v. Connecticut (381 U.S. 479). In short, they explained that the Constitution has what are called "penumbral rights"---rights that are inferrable by virtue of being necessary precursors to the rights more explicitly spelled out.

From Griswold v. Connecticut:
"The Fourth and Fifth Amendments were described in Boyd v. United States, 116 U.S. 616, 630, as protection against all governmental invasions 'of the sanctity of a man's home and the privacies of life.' We recently referred in Mapp v. Ohio, 367 U.S. 643, 656, to the Fourth Amendment as creating a 'right to privacy, no less important than any other right carefully and particularly reserved to the people.' See Beaney, The Constitutional Right to Privacy, 1962 Sup. Ct. Rev. 212; Griswold, The Right to be Let Alone, 55 Nw. U. L. Rev. 216 (1960) ... The present case, then, concerns a relationship lying within the zone of privacy created by several fundamental constitutional guarantees."

The explicit rights that grant a right to privacy as a precursor are the 4th, 5th, and the 9th, though the Justices said (and have upheld numerous times since, fyi) that the right to privacy may be inferred from other amendments as well, it's just that the 4th, 5th, and the 9th are particularly obvious in their inference.

So, yes, since 1965, U.S. Law has upheld EXPLICITLY that we have a Contitutional right to privacy.

Tom Caudron
http://tom.digitalelite.com/

Re:Privacy Issues

[mjm1231]

Neither do I own the air which is used to transmit my voice when I speak to someone in a closed room, but it still requires a warrant to hide a recording device in the room. A person's speech is their effect, regardless of the medium used to transmit it.

Re:Privacy Issues

[Beryllium Sphere(tm)]

>For better or worse, there really isn't a real "Right to Privacy" in the Constitution.

Did you know that some of the Founders didn't want to include a Bill of Rights? All were in favor of human rights (at least for white people, sigh) but some were afraid that if they wrote down a list then later generations might mistake it for an exhaustive list and might begin violating rights that hadn't been written down.

They put in the Ninth Amendment to spell out in black and white that all other rights were still guaranteed even if they didn't get a slot in the Bill of Rights. They did that to make absolutely sure that nobody in the future could ever disparage a right by saying "it's not in the Constitution".

>If we don't want the government to look over our shoulders, then we can't bitch when they didn't see something coming.

Why not? Aside from the "if they've got something why don't they get FISA warrants" question, why can't we bitch when the government finds plots (without mass domestic spying) and refuses to even ask for warrants?

Re:Privacy Issues

[smithmc]

  Obviously at the time of writing, phone lines didn't exist, but it's reasonable to see that as an "effect" belonging to an individual.

The switches that route your call, and record the source/destination/time, do not belong to you; they belong to the phone company. The same could be said about a written letter - the letter and its verbal content are yours, but the information about where the letter came from and where it is going are necessarily shared with the Postal Service, which then possesses that information and can do with it as it pleases.

Re:Privacy Issues

[Grym]

Well... for that matter, what about the Third Amendment?

No Soldier shall, in time of peace be quartered in any house, without the consent of the Owner, nor in time of war, but in a manner to be prescribed by law.

Bear in mind that quartering was not a military necessity but a way of finding and uprooting dissent at it's roots--the common household. They didn't just quarter at random. Suspected sympathizers were often specifically targeted for the simple reason that having a few brutish and nosey soldiers from the government in your house either makes you clean up your affairs or start explaining yourself in front of a judge.

The third amendment was a response to a specific type of attack on privacy by a people which had been traumatized by it. You can bet your powdered wig that if England had tried to read the correspondence of every suspected revolutionary (wire-tapping) or recorded data about every conversation that ever occurred in a public square and the parties involved (phone database), that those too would have been specifically mentioned as well.

Kept in its historical context, the third amendment represents a limit to the imposition of households and the government's ability to intrude upon the private lives of ordinary citizens.

But you know what? What about the Ninth Amendment?

The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people.

Any reasonable person can conclude that a right to privacy exists on some level. We shouldn't need a document of finite length, written over 200 years ago to tell us exactly what rights we, by virtue of our humanity, possess. In fact, this ridiculous argument we're having over whether a right to privacy exists or doesn't is the entire reason that the ninth Amendment was devised.

Alexander Hamilton in Federalist 84, said it best (emphasis mine):
"[I] affirm that bills of rights, in the sense and to the extent in which they are contended for, are not only unnecessary in the proposed Constitution, but would even be dangerous. They would contain various exceptions to powers not granted; and, on this very account, would afford a colorable pretext to claim more than were granted. For why declare that things shall not be done which there is no power to do? Why, for instance, should it be said that the liberty of the press shall not be restrained, when no power is given by which restrictions may be imposed? I will not content that such a provision would confer a regulating power; but it is evident that it [an enumerated Bill of Rights] would furnish, to men disposed to usurp, a plausible pretence for claiming that power."

-Grym

NSA track record

[cyber_rigger]

...and of course the NSA has an excellent track record of unbreakable encryption (in case these records get in the wrong hands).

Re:NSA track record

[Ohreally_factor]

I think the point is to keep the NSA from knowing whose phone records it's looking at, not to protect them in case they fall into the "wrong hands".

Depending on the circumstances, how do you make the distinction between the NSA and the "wrong hands"? =)

But seriously, ThinThread as originally constituted contains the mechanism necessary for oversight. It's amazing that they dispensed with that part of the program, especially now in hindsight when the Administration is embroiled in a scandal. What were they thinking? Are they that arrogant? That stupid?

On condition of anonymity

[Billosaur]

Four intelligence officials knowledgeable about the program agreed to discuss it with The Sun only if granted anonymity because of the sensitivity of the subject.

Let's hope they didn't talk on the phone...

Hmm

[The Living Fractal]

NSA: "Stand very still, we're going to beat you with this baseball bat."
U.S. Citizen: "Don't I have rights? You can't just beat me with that bat!"
NSA: "Don't worry, we've encrypted it."

Right.

[Rob T Firefly]

And be assured, citizens, that we will never, ever, let a curious finger wander across the board and idly press the beautiful, shiny button labeled "decrypt."

The jolly, candy-like button...

Re:thats OK then, AKA respectful my ass!

[mausmalone]

Part of the proposed program would make it illegal to do so without a court order. And therefore, any evidence gained from a surreptitiously decrypted number would be inadmissible in court (and very embarrassing for the NSA).

See, technically the only thing that stops the police from tapping every phone (other than respect for the community) is that it's illegal to do so and any evidence gathered is wholly worthless.

Re:thats OK then, AKA respectful my ass!

[CosmeticLobotamy]

Obviously turning the "encrypted number" back into a real one would never slip from "a threat was found" to "we wanted to know who it was".

You're crapping on an effective means of controlling who gets access to data because there's a possibility it might not be used properly in some instances. If it's not used properly, then we have the situation we already are in. At the very least, we can file this under "better and under no circumstances worse."

Whether or not we can label it "good" is beyond the scope of me.

Trust not

[Red Flayer]

"* Analyzed the data to identify relationships between callers and chronicle their contacts. Only when evidence of a potential threat had been developed would analysts be able to request decryption of the records.

Says who? The NSA?

Who defines what a potential threat is? A judge of the court, or some bureaucrats in the NSA?

Why would we trust an agaency known to play games with the law to have access to this data? A layer of separation (the encryption) doesn't change the fact that the data is still there for misuse. Just because it's harder to tie to an individual doesn't mean it can be misused.

All the encryption does is make it harder for a rogue/spy to get access to actual phone numbers. Systemic abuse or misuse of the data is not prevented at all. And frankly, systemic abuse/misuse frightens me much more than one person being able to misuse the data.

We as Americans need to ask hard questions.

[GundamFan]

We are at a crossroads, and we need to take a step back from the emotion of September eleventh (nearly 5 years later) and really look at what we want to see in the future.

I won't stand on a soapbox here and force my opinion on others but I think it is time for a very serious debate over what is acceptable to give up in the name of security, what secrets we will let our government keep from us and what checks and balances need to be in place.

I think we are in trouble of letting "terrorism" be the ultimate excuse for any unpopular move by the government and it sadens me to see that the events of 2001 have changed us so much.

P.S.
The latest Justifications I have heard for the NSA wire taping are indicative of the problem... saying "we havent had a terrorist atack because of this program" is like saying "the wolly mammoth repelant is working" unless you can show proof that attacks have been thwarted .

Re:We as Americans need to ask hard questions.

[ERJ]

Not that I disagree with your statement, we need to be rational about this and figure out the best balance, but this is talking about a project which predates 9/11.

Re:The Number To Call For Questions: +1, Seditious

[mausmalone]

P.S. Can you say Iran-Contra Part 2?

Considering that we're letting people like John Negroponte back into the government, it is all a little Déja Vù.

Bullshit

[Jah-Wren Ryel]

Political infighting seems to have dropped an interesting and respectful program from the books.

Big freaking deal if the numbers are 'encrypted' or not. The problem is not that the NSA knows people's phone numbers - that's why we have phonebooks. The problem is that they have this huge database that lets anyone with access draw all kinds of inferences about people's relationships with each other. The right to freely associate is not free at all if it means that you end up on some big list in a government computer (or anyone else's computer for that matter).

Having your phone number encrypted when it is in the database doesn't help a bit because the encrypted number is just another unique identifier. Its the equivalent of saying that they used social security numbers in place of the phone numbers.

NSA is not supposed to operate inside the USA

[Creepy]

I don't see how this gets around the fact that, like the CIA, the NSA is NOT supposed to be gathering intelligence within the borders of the United States (see the executive order that created the NSA)- that is the FBI's responsibility. President Bush used an executive order to allow for the NSA to investigate within the USA after 9/11.

I believe that any monitoring that originates and terminates in the United States prior to Bush's executive order is illegal (it's also illegal after Bush's order, IMO) unless Clinton also gave an executive order to permit it.

From wikipedia: ...the NSA's United States Signals Intelligence Directive 18 (USSID 18) strictly prohibits the interception or collection of information about "...US persons, entities, corporations or organizations..." without explicit written legal permission from the Attorney General of the United States"

Absence of evidence is evidence. So they say.

[ianscot]

Among the most Orwellian moments I've had in the past several years -- and we've had our share of "the new people will go by 'Total Security Agency'" moments, haven't we? -- was the time when my ex-brother-in-law explained that the only way to tell an intelligence agency was succeeding was when you knew nothing about it at all.

In this person's world, by definition, the public should never be able to point to an intelligence accomplishment. Our best response to the existence of stuff like these NSA capers is to keep our heads down. So said my brother-in-law, who had previously explained to me his rationale by which Nixon was the best President we've ever had.

One can see the obvious stepping off point to "the real traitors are the ones who *reveal* our secret, extra-constitutional prison system."

Confronted with evidence of past incompetence on the part of the CIA -- I mentioned the massive expense of the Glomar Explorer misadventure, which got us basically nothing new (old details about an aging vintage Soviet sub) for the staggering money involved -- John simply suggested that there must've been a lot more to the story, and that it obviously succeeded because we didn't know about the successful parts. (Whereupon he spun straw into gold and disappeared like Colonel Flag on M*A*S*H -- "like the wind" -- from our family. I believe he's living as an expat in China now.)

Constitution, who needs it !

[DrSkwid]

Universal Declaration of Human Rights
http://www.un.org/Overview/rights.html

Adopted and proclaimed by General Assembly resolution 217 A (III) of 10 December 1948

Article 12.

            No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.

Article 30.

            Nothing in this Declaration may be interpreted as implying for any State, group or person any right to engage in any activity or to perform any act aimed at the destruction of any of the rights and freedoms set forth herein.

Member -- (Date of Admission)

United States of America -- (24 Oct. 1945)

In that example, get a warrant.

[khasim]

You have two "known" "nutjobs". If you want to know who they're talking to and what they're saying, then get a warrant.

That way, when they both implicate "B", you can immediately get a warrant to find out who "B" is talking to.

Also, you might find out that "C" is a "nutjob", too. Then you can get a warrant for his phone.

All very easy and all very legal under existing laws.

Re:Future options

[NMerriam]

The Bill of Rights is not a suicide pact.

On the contrary, the founding documents of this nation were very much a suicide pact.

The Declaration of Independence said it quite explicitly:

And for the Support of this Declaration, with a firm Reliance on the Protection of Divine Providence, we mutually pledge to each other our Lives, our Fortunes, and our sacred Honour.

Or, to put it more succinctly, "Give me Liberty or Give me Death".

Life without liberty is not life worth living, and the founding fathers knew quite well that they would either succeeed or be killed as traitors.

And of course the irony is that the only way we would commit "suicide" (ie, kill OURSELVES, as opposed to being destroyed by external forces) is to destroy the Constitution and Bill of Rights, exactly as we're doing so well right now. No terrorist bomb can accomplish that task, we're doing it all on our own.

Bruce Schneier says it better than I could

[why-is-it]

For better or worse, there really isn't a real "Right to Privacy" in the Constitution.

Do you only have the rights that are explicitly defined in your constitution?

However, people demand security. Often security and privacy conflict with one another and we as a society need to decide where that line needs to be drawn. If we don't want the government to look over our shoulders, then we can't bitch when they didn't see something coming.

I think that Bruce Schneier's recent article in Wired is one of the most reasoned and insightful responses to your line of argumentation.

As he states, it is not a debate over security versus privacy - it is liberty versus tyranny.

anonomous strip search

[0xC2]

As long as you wear a paper bag over your head, the Feds should be able to explore your body cavities!