NSA's Novel Claim: Our Systems Are Too Complex To Obey the Law

Reader Bruce66423 (1678196) points out skeptical-sounding coverage at the Washington Post of the NSA's claim that it can't hold onto information it collects about users' online activity long enough for it to be useful as evidence in lawsuits about the very practice of that collection. From the article: 'The agency is facing a slew of lawsuits over its surveillance programs, many launched after former NSA contractor Edward Snowden leaked information on the agency's efforts last year. One suit that pre-dates the Snowden leaks, Jewel v. NSA, challenges the constitutionality of programs that the suit allege collect information about Americans' telephone and Internet activities. In a hearing Friday, U.S. District for the Northern District of California Judge Jeffrey S. White reversed an emergency order he had issued earlier the same week barring the government from destroying data that the Electronic Frontier Foundation had asked be preserved for that case. The data is collected under Section 702 of the Amendments Act to the Foreign Intelligence Surveillance Act. But the NSA argued that holding onto the data would be too burdensome. "A requirement to preserve all data acquired under section 702 presents significant operational problems, only one of which is that the NSA may have to shut down all systems and databases that contain Section 702 information," wrote NSA Deputy Director Richard Ledgett in a court filing submitted to the court. The complexity of the NSA systems meant preservation efforts might not work, he argued, but would have "an immediate, specific, and harmful impact on the national security of the United States.' Adds Bruce66423: "This of course implies that they have no backup system — or at least that the backup are not held for long."

Comments

Too Big to Be Indicted...

[mbone]

The computer version.

Re:Too Big to Be Indicted...

[B33rNinj4]

This is pretty much what will happen. The precedent was set with the banks and auto industry. I don't see why the NSA can't use the same argument.

Re:Too Big to Be Indicted...

[TaoPhoenix]

This argument has a bit of a different feel to it though.

Up till now for a decade the agencies just invoke "we're scary and secretive, we don't need to follow your puny little laws because of National Security but we need a billion dollars in next year's budget to build more systems to hold data forever and ever".

And you can bet they cherry pick their data so that they have ten years worth of people's email and Slashdot posts, but suddenly when a lawsuit comes along, suddenly that data vanishes. But then it becomes vital to an investigation! "Oh look, we found it again!"

Re:Too Big to Be Indicted...

[GameboyRMH]

We can call this The NSA Defense (our systems are too complex for the law), and the inverse of it is The Amazon Defense (the law is too complex for our systems).

Re:Too Big to Be Indicted...

[mi]

The precedent was set with the banks and auto industry.

Not sure about the auto industry, but banks and other financial institutions did spend untold billions on revamping their systems to comply with the new regulations. Working for them became horribly difficult — at least one client of mine had to hire a consultant, whose sole job was translating change-requests (such as: "We need to increase the JVM's memory limit of the risk-computing application") from engineer's English into regulation-compliant legalese...

Oh, and then an actual user had to sign-off on it — try to explain the intricacies of Java garbage-collection to an equity-options trader...

Re:Too Big to Be Indicted...

[oh_my_080980980]

What regulations? There were no new regulations. There no regulations were placed on the derivatives market. The only change was how much capital each bank had to have on hand.

Re:Too Big to Be Indicted...

[mi]

What regulations? There were no new regulations. There no regulations were placed on the derivatives market.

Yeah, right. It just became illegal for banks to have proprietary traders (derivatives and others) in-house — resulting in massive lay-offs of traders and their supporting personnel (IT, programmers, quants)...

But I did not mean that. The difficulties, to which I was originally referring, were caused by the Sarbanes Oxley Act, which made it painfully difficult to change even the slightest aspect of a production computer system in a financial institution.

Re:Too Big to Be Indicted...

[mi]

Then the industry rips off society I'd rather question whether they should be allowed to continue operating AT ALL.

The only industry, that lives off of society is the industry of government — they are paid by the taxpayers. And, armed with the IRS' ability to collect taxes at gunpoint, they are very hard to limit.

The banks, on the other hand, are very easy to "kill" — just stop using them. Unlike the government, they have no way to compel you.

More regulation, until they cannot operate any longer, makes much more sense.

Thank you for admitting, what the true intent of the regulations is. But would not it make even more sense to simply outlaw banks, huh? If only you could formulate such a law without shredding that pesky Constitution...

Re:Too Big to Be Indicted...

[ibwolf]

The banks, on the other hand, are very easy to "kill" — just stop using them. Unlike the government, they have no way to compel you.

Yes, "just" stop using them. Like we can "just" stop voting in all these rubbish politicians.

Most people can't stop doing business with them because they are already in debt and clearing that debt will take decades. Even if not in debt, not having a bank account and debit/credit card(s) and other financial services can cause you all manner of difficulties.

Banks, on top of providing essentially services, have built a money sucking machine. And they've made very sure to entangle the leeching part thoroughly in with the good bits.

The only way to address this, without plunging the economy into chaos, is for the government to step in and untangle it (cutting the proverbial Gordian knot). "Just" not doing business with the banks will either accomplish nothing (because you can't get enough people involved) or will precipitate a financial collapse.

Unfortunately, getting the government to do something about this "just" requires us to vote some decent people into office *sigh* yes, "just".

Re:Too Big to Be Indicted...

[meta-monkey]

Credit unions.

Re:Too Big to Be Indicted...

[mi]

Yes, "just" stop using them [banks]. Like we can "just" stop voting in all these rubbish politicians.

Unlike politicians, who impose themselves even upon those, who voted against them, banks have no power over you if you don't use them. You don't have to convince other people to stop using banks — just stop doing it yourself and you'll be free from them...

Most people can't stop doing business with them because they are already in debt

Nobody forces people into the debt. They take it voluntarily and are genuinely happy, when their applications are approved. Without banks, you'd have to save money for 10 years before buying a house. With banks, you can move-in right away and pay off in 15 years. Loans are a service, that banks provide to willing customers.

Banks, on top of providing essentially services, have built a money sucking machine

I'm not aware of this "money sucking machine". Could you, please, elaborate?

The only way to address this, without plunging the economy into chaos, is for the government to step in and untangle it

Just what is it, that you'd like to see "untangled"?

Re:Too Big to Be Indicted...

[pegdhcp]

this is sounding like a punishment duty I unfortunately did not think about during my previous incarnation as an operations manager :) shame on me I guess. "hey, you are going to explain memory upgrade requirement for SAP on MS (I know I know, long story) platform from 16 GB to 64 GB to accounting!"

Re:Too Big to Be Indicted...

[dave562]

The difference is that the banks are being sued and the underlying data (loan records, underwriting guidelines, securities information, etc.) is being preserved and provided to plaintiffs and defendants. The NSA is refusing to do collection / preservation / discovery at all.

Re:Too Big to Be Indicted...

[Anonymous Coward]

True nobody forces me into debt but for all intents Im forced to to have a bank account so I can get paid my wages.

Re:Too Big to Be Indicted...

[TubeSteak]

Unlike politicians, who impose themselves even upon those, who voted against them, banks have no power over you if you don't use them. You don't have to convince other people to stop using banks â" just stop doing it yourself and you'll be free from them...

Uhhhh... The global recession puts the lie to your notion that not doing business with banks means I'm free of their ill effects.

Nobody forces people into the debt. They take it voluntarily and are genuinely happy, when their applications are approved. Without banks, you'd have to save money for 10 years before buying a house. With banks, you can move-in right away and pay off in 15 years. Loans are a service, that banks provide to willing customers.

During the mortgage bubble, banks were doing several things
1. Forging a higher stated income onto loan documents so they could lend more money
2. Giving loans to people that they knew would not be able to afford it (NINA/NINJA loans)
3. Offering minorities ARM loans or loans with much higher interest rates than they would offer to white borrowers with the same credit score.

Blaming the borrower ignores the mountains of evidence showing wildly illegal, fraudulent, and outright deceptive behavior by the loan industry.
If you don't know this stuff, you must be willfully ignoring the facts as they've been reported.
Even Fox News has been reporting on it.

Re:Too Big to Be Indicted...

[spire3661]

O to live in your world with unlimited choice and chance....

Re:Too Big to Be Indicted...

[mi]

The global recession puts the lie to your notion that not doing business with banks means I'm free of their ill effects.

Nope. You are only affected as much as you were involved with the banks — being there customer or an employee, or dealing with other people, who were. But the recession was not the bank's fault — rather it is that of the politicians, who forced banks (with the threat of "discrimination" lawsuits) to give money to unqualified borrowers.

1. Forging a higher stated income onto loan documents so they could lend more money

Nope. It was not the banks doing the forging — it was the applicants. Bank-employees may have looked the other way, but the actual forgery was done by the customers.

2. Giving loans to people that they knew would not be able to afford it

Refusing to issue such a loan was to expose the firm to a discrimination lawsuit. But, once again, you are ignoring the role of the actual applicants, who lied on their applications — putting the blame solely on those, who were supposed to catch the lies.

3. Offering minorities ARM loans or loans with much higher interest rates than they would offer to white borrowers with the same credit score.

Citation needed.

Issuing repayable loans is the banks' bread-and-butter. That's, what they do. They normally have every incentive to issue as many loans to qualified borrowers as they can, while keeping the unqualified out. The bubble started, when the government messed up those incentives by, on the one hand, suspecting every rejection of being racially-motivated and, on the other, lowering the standards, under which banks could unload (sell) their loans to the government. It was this combination, that created the mortgage bubble — not some inherent evil of the "banksters".

Blaming the borrower ignores the mountains of evidence showing wildly illegal, fraudulent, and outright deceptive behavior by the loan industry

Nope. The borrower signing a fraudulent loan application is the main guilty party. Those failing — willfully or otherwise — to catch his lies may be somewhat responsible too, but the primary responsibility is with the applicant.

If you don't know this stuff, you must be willfully ignoring the facts

Yeah, yeah. And if I don't agree with you, I must be stupid and incompetent.

Re:Too Big to Be Indicted...

[Rinikusu]

Sorta, not really. After changing banks/credit cards because I felt the bank I was banking with was a bit too.. unethical? for my liking, a year later, my new bank was bought out by the old bank. Or a credit card I have with one bank? Gets sold to another bank that I want to avoid with a 10 foot pole.

Now, try getting a new credit card (again) and not have it hit your credit score while you try to transfer balances, etc. It's a gigantic PITA.

Re:Too Big to Be Indicted...

[mi]

Now, try getting a new credit card (again) and not have it hit your credit score while you try to transfer balances, etc. It's a gigantic PITA.

You misread... My proposition was not meant for people like yourself, who are dissatisfied with a particular bank's practices, but for those, who, like the Anonymous Coward above would like to abolish all banks.

In a typical Illiberal fashion, they are unsatisfied with simply not patronizing businesses they don't like themselves — they wish to ban them for the rest of humanity as well...

Re:Too Big to Be Indicted...

[LifesABeach]

So the NSA stands for acts of Treason?

Re:Too Big to Be Indicted...

[McFly777]

3. Offering minorities ARM loans or loans with much higher interest rates than they would offer to white borrowers with the same credit score

The last several mortgages which I have obtained were done completely over the phone, except for the closing of course. So whomever I was speaking to had no idea what color my skin was.

This is not to say that discrimination of this sort never happens, but my guess is that this is a "correlation does not equal causation" type of situation, in that there are many factors which play into the rate that is given; possibly including things like statistics of loan defaults for the area in which you are asking for the mortgage. If it just happens that these secondary factors correlate to race (again no causation implied) then the loan rates could also correlate, with no causal discrimination.

As to ARMs vs. traditional mortgages: I have been offered both. I was never interested in the ARM. Does that imply something about me? Does it imply something about the person who chooses the ARM? ARMs aren't bad products, but they are certanly only appropriate for specific situations.

Re:Too Big to Be Indicted...

[rickb928]

" try to explain the intricacies of Java garbage-collection to an equity-options trader..."

Um, you;'re doing it wrong. At least explain this to the trading manager. Preferably their compliance officer.

Re:Too Big to Be Indicted...

[rickb928]

SOX requires me to respond to multiple requests for access justification yearly for each system I use. It requires me to submit as if new continuing requests for access. SOX drives a default 'deny' action, requiring me to repeatedly justify access, even when it is invoked mid-term. SOX imposes significant overhead in IT management at all levels to provide the detailed and responsive justifications for systems, data, and access needed to run operate a bank.

And I only work for the holding company, not the actual 'bank'.

SOX is a burden, and not an inconsequential one, if your organization is actually a bank.

Re:Too Big to Be Indicted...

[Roger Wilcox]

You do seem to be stupid and incompetent (your words,) but not because you don't agree with the GP. Rather, it is because of the ridiculous arguments you are making:

"But the recession was not the bank's fault â" rather it is that of the politicians, who forced banks (with the threat of "discrimination" lawsuits) to give money to unqualified borrowers."

First of all, the article you link says nothing to support your claims of forcing or discrimination or even lawsuits. The closest the article gets to supporting your claims is to state that "rules of spending" were "loosened" for the banks by the politicians. How can you not see at this point that the banks (and the other giant corporations) are the ones wagging the dog here? They bribe politicians through so-called lobbying in order to bring about the loosening and tightening of rules that suit their favor. That much is plain as day! And you can't argue that these particular loosened loan rules didn't favor the banks. Obviously the banks stood to benefit, which they did, greatly and at taxpayer expense.

Now, to your credit I will say that blame for the recession can't be laid fully on the banks: each of us is also at fault for failing to lynch (literally or metaphorically) the bigwig asshats (meaning bankers and politicians, I don't discriminate) who are continuously allowed to pull this shit and get away with it.

"Nope. It was not the banks doing the forging â" it was the applicants. Bank-employees may have looked the other way, but the actual forgery was done by the customers."

"May have looked the other way," as you put it, implies that bank employees were complicit in the forgery, which they were. So why use this statement argue that they weren't forging income numbers? They were further "loosening the rules" and they should have known better.

Did you know that it is a bank's responsibility to assess the creditworthiness of it's debtors? If they make a bad investment on a homeowner and the loan isn't repaid, that's money that they lose! As you pointed out, this is their bread and butter business. They knew what they were doing here, and they used the government's new generously low (bribe-induced) requirements to help themselves unload what they knew to be bad loans on Fannie Mae.

.

This is how the system works, folks! Isn't it wonderful? Truly, We The People need to step in and clean house if we want these shenanigans to cease. Arguing about whether it was a bank's fault or a government's fault is meaningless. From the perspective of common people, the banks are the government and the government is the banks. They both have a vested interest in working together to milk us like we are livestock, which they do.

Re:Too Big to Be Indicted...

[smellotron]

try to explain the intricacies of Java garbage-collection to an equity-options trader...

If that is a problem in your organization, this would probably be a good start: "The equity-options traders that understand the role of technology in their trades will inevitably be eating your lunch."

Re:Too Big to Be Indicted...

[TubeSteak]

Nope. You are only affected as much as you were involved with the banks â" being there customer or an employee, or dealing with other people, who were. But the recession was not the bank's fault â" rather it is that of the politicians, who forced banks (with the threat of "discrimination" lawsuits) to give money to unqualified borrowers.

1. The global recession caused millions of people to lose their jobs, for so long, that the government has been extending unemployment for years (up until recently)
2. You're trotting out the long debunked claim that the Community Reinvestment Act caused this
3. Your debunked claim is supported by... an essay from Orson Scott Card. I will rebut with the Minneapolis Federal Reserve Bank

[Citation Needed]

Here's some reading for you.
https://www.google.com/search?q=Goldman+sachs+subprime+fraud
https://www.google.com/search?q=credit+suisse+mortgage+fraud
https://www.google.com/search?q=Washington+Mutual+loan+fraud
https://www.google.com/search?q=Bank+of+America+racial+settlement
https://www.google.com/search?q=wells+fargo+racial+settlement
https://www.google.com/search?q=PNC+Financial+racial+settlement
https://www.google.com/search?q=suntrust+racial+settlement
https://www.google.com/search?q=robo+signing+settlement
https://www.google.com/search?q=JPMorgan+mortgage+fraud+settlement

This is a fun press release:
The Federal Reserve Board on Wednesday issued a consent cease and desist order and assessed an $85 million civil money penalty against Wells Fargo [...]. The order addresses allegations that Wells Fargo Financial employees steered potential prime borrowers into more costly subprime loans and separately falsified income information in mortgage applications

If you noticed, I'm intentionally not rebutting you point by point,
because everything you've parroted has already been said and rejected a thousand times already.

Yeah, yeah. And if I don't agree with you, I must be stupid and incompetent.

And in yesterday's news: https://www.google.com/search?q=citigroup+mortgage+discrimination
I honestly don't know what alternate world of facts you're living in.
Going by your Orson Scott Card essay, Fark.com headlines are more informative than what you've been reading for the last 6 years.

Re:Too Big to Be Indicted...

[sirlark]

The banks, on the other hand, are very easy to "kill" — just stop using them.

Except when the government steps in with your taxes to bail out the bank that goes bankrupt because everyone stopped using it; and that is assuming Joe Consumer actually has a big enough effect in the first place, because banks don't get deposits only from the man on the street. The money is in the loans. And you can't just stop using a bank if you have a loan. Can't buy a house without a loan either generally, and buying often makes more sense than paying off your landlord's mortgage.

Re:Too Big to Be Indicted...

[Vitriol Angst]

Seriously? It's horrible how unprofessional you consider the NSA. They don't "dump" the data. The inspector calls two weeks ahead, and then they take them to the main office where there is a 486 computer with Windows 95 on it -- then they are allowed to search the entire FoxPro database with no strings attached.

Re:Too Big to Be Indicted...

[david_thornley]

When I worked on mortgage modelling for a home mortgage company, I got familiar with the information in the database. There were two columns in particular that puzzled me: stated income and stated assets. These mean that there was no documentation supplied, and the mortgager just went along with what was written in (by the mortgage broker or the borrower). This means that the company knew precisely which mortgages were "liar's loans". Since they were willing to make the loans anyway, and knew which ones, forgery by applicants wasn't an issue. The mortgage company simply didn't care whether the stated information was accurate. They not only failed to catch the lies, they were complicit in the forgery.

Issuing repayable loans is a good way for a bank to make money, but it wasn't the only way. By using financial legerdemain, they packaged up known bad loans into valuable securities, and made money on them. Banks try to avoid lending money unprofitably, and since they knew certain loans were bad they obviously had reason to make bad loans.

Re:Too Big to Be Indicted...

[dl_sledding]

And you can bet they cherry pick their data so that they have ten years worth of people's email and Slashdot posts, but suddenly when a lawsuit comes along, suddenly that data vanishes. But then it becomes vital to an investigation! "Oh look, we found it again!"

Much like law enforcement dashcam video/audio...

Re:Too Big to Be Indicted...

[RockDoctor]

all intents Im forced to to have a bank account so I can get paid my wages.

Don';t they have things like Credit Unions etc in your home country? And not all banks are mega-conglomerates in any case.

Fine ...

[gstoddart]

If you can't have your data available to demonstrate what you're doing it lawful, and you are going to delete it, then only reasonable conclusion is what you are doing cannot be proven lawful.

Therefore, the program is not lawful, and you need to stop.

Problem solved.

This amounts to "your honor, we collect so damned much information we couldn't possibly hold onto it long enough to be subject to legal oversight. Trust us."

What crap.

Re:Fine ...

[oodaloop]

I imagine the problem is that these databases only hold collected data for a short period of time, say 30 or 90 days. The data scraped is massive, so it is constantly deleting old data to make way for more. IAA Intelligence Analyst, and I know of some imagery databases, for example, that only hold the last 30 days of imagery. If you forced them to hold all of it for years, it would mean increasing server space by orders of magnitude.

Re:Fine ...

[Anonymous Coward]

SO hold onto a random sampling of a significant but manageable size. There is middle ground between everything and nothing. Especially if you let the other side examine the full data set and the sample, they can agree that the sample is of a significant enough size to work in court. We can then extrapolate from the sample to the population. Its not perfect, but if there's damning evidence the sample should be good enough.

Re:Fine ...

[gstoddart]

So, basically, your saying that they should just expect everybody to simply trust that what they're doing is entirely legal? Because the logistics of actually proving this is so difficult they can't do it?

I say horseshit to that.

We know the data they scrape is massive. What we don't know is that they're complying with the law in order to do it.

And I fail to see why the benefit of the doubt should be given in this case.

Sorry, but it's "trust, but verify", and if you can't verify, you can't bloody well trust. The whole point of these lawsuits is that they likely go beyond the scope of their legal mandate. Saying you couldn't possibly be bothered to hold onto the evidence the court has demanded is just too damned bad.

Re:Fine ...

[Anonymous Coward]

So, basically, your saying that they should just expect everybody to simply trust that what they're doing is entirely legal?

No, they're expecting everybody to remember the little clause that "accidentally collected" data on US citizens must be deleted within 30 days. So by deleting everything 29.9 days after acquisition, they are deleting the US citizen data within the permissible timeframe.

The problem comes in when someone points out that collecting on US citizens wasn't accidental. Intentionally collecting data on US citizens is a violation even if you don't keep it around any longer than it takes your RAM to write over the data.

Re:Fine ...

[oodaloop]

So, basically, your saying that they should just expect everybody to simply trust that what they're doing is entirely legal?

Where did I say or imply anything like that? I'm no more a fan of what NSA is doing than anyone else here. They are disliked throughout the rest of the intel community too, btw.

Re:Fine ...

[bigpat]

Sarcasm aside I think you make an important point... Between the “state secrets” privilege and the apparent willingness of the NSA to engage in a wholesale violation of the US Constitution and lie to congress and the courts I seriously doubt it would be remotely possible for a court to narrowly "rule on the facts" of the particular case. Rather courts are going to have to rule on the law and the probability that the NSA is violating individual liberties and then issue injunctions which give the government and the NSA and US government future instructions that the 4th amendment applies to their surveillance activities in the US despite whatever the Patriot Act might be interpreted to mean... meaning the courts will have to issue rulings based on what is permissible rather than issuing narrow injunctions against particular acts.

So for instance the court should simply rule that for the NSA to force companies to hand over business records including communications logs and the like that they need a warrant that complies with the 4th amendment and is issued: "upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized"

Re:Fine ...

[Runaway1956]

Isnt' that precisely what they did recently? They built a facility for the very purpose of increasing storage by orders of magnitude? Or, did I misunderstand all those stories?

Re:Fine ...

[oodaloop]

My understanding is that the new facility is for storage of new programs, not stable backups of existing data. I'm not an expert though.

Re:Fine ...

[Anonymous Coward]

They are disliked throughout the rest of the intel community too, btw.

So what? The rest of the intel community is no less traitorous scum than they are.

Before the CIA and NSA were founded, the US was 9-0 in war. Since their founding, the US is 0-5 in war. The CIA and NSA in and of themselves are national security risks.

Re:Fine ...

[swillden]

I imagine the problem is that these databases only hold collected data for a short period of time, say 30 or 90 days. The data scraped is massive, so it is constantly deleting old data to make way for more. IAA Intelligence Analyst, and I know of some imagery databases, for example, that only hold the last 30 days of imagery. If you forced them to hold all of it for years, it would mean increasing server space by orders of magnitude.

None of which in any way impacts the GP's point.

Re:Fine ...

[JWW]

I totally get that their systems very likely need to purge inconsequential data to remain effective. However, if the court forced a private company to retain data under a court order, it wouldn't care one wit about whether that was feasible within the system or not. If the private company did not comply, their officers would be held in contempt.

The NSA should not get special treatment in this case.

Re:Fine ...

[oh_my_080980980]

Really? That's not what the NSA was instructed to do. The NSA was instructed to hold *some* information that was involved in a court case. They were not forced to hold it for years nor were they forced to hold everything. In fact when the NSA was asked to do so they did not say they couldn't do it. Instead they said they didn't think the hold order applied to the information they deleted.

Please stick to the topic on hand and not make up a scenario that did not happen.

Re:Fine ...

[oh_my_080980980]

Then don't make up a scenario they weren't asked with which to comply.

Re:Fine ...

[oh_my_080980980]

Then not commenting is your best option.

Re:Fine ...

[Testudo Kleinmanni]

Funny stuff. Its unknown lawfulness quanta, hence nowhere near proven unlawful ergo criminal and actionable if sufficiently recent. Disregarding the legal statue of the breach of regulation discussed, which may be criminal itself but will never be prove positive of guilt regarding different unlawful acts to it. ...until proven guilty.

Re:Fine ...

[Anonymous Coward]

Well, if I design a system and I can't prove that it complies with all of the laws that regulates my field then I'm not allowed to sell that system.
If I sell it anyway then I will be fined. (Or possibly imprisoned if someone gets killed because of me not following the norms.)

If it is considered illegal when I design a system that is too complex to verify the legality of, why isn't it illegal for NSA?

Re:Fine ...

[dpidcoe]

If you can't have your data available to demonstrate what you're doing it lawful, and you are going to delete it, then only reasonable conclusion is what you are doing cannot be proven lawful.

Therefore, the program is not lawful, and you need to stop.

So if you're not going to answer the questions to demonstrate your innocence, and your memory is fuzzy anyway, then the only reasonable conclusion is that you're guilty and therefore need to be thrown in jail?

That's a bit of a dangerous precident to be setting.

Re:Fine ...

[silas_moeckel]

Since the programs are not needed, or lawfull just can them problem solved.

Re:Fine ...

[Runaway1956]

That's a little rude. If we all restricted ourselves to commenting on subjects in which we are experts - slashdot would appear to be abandoned. Two or three people would comment on some subjects, other subjects might have fifteen people participating. And, whatever would happen to good old AC?

Re:Fine ...

[king neckbeard]

That it's hard work for them to comply with the law is their problem, not our. If you can't play by the rules, you shouldn't play..

Re:Fine ...

[TheCarp]

I think you are seriously overthinking this. Its very simple. They CAN save data. Period. How do I know? Its very simple here. Do you really believe that if they found credible data on a top Con Queso leader, that they would need to analyse it within a specific time frame before they lose it forever, or do you think they can flag it to be saved?

Very simple. Being able to do this is a basic requirement for them, so they can do it already, right now.

So any claim that they could not do this is so disingenuous on its face that it is ridiculous. If you claim in court that you can't be the rapist because you cut your penis off as a child, then at the VERY LEAST, you should fully expect to be dropping your pants in front of somebody who can verify this.

They may as well be claiming they don't use computers at all to do their work, the claim would be 100% every bit as credible.

Re:Fine ...

[king neckbeard]

Government agencies are not citizens. If a program cannot be proven to be lawful, we should not allow it.

Re:Fine ...

[Widowwolf]

We arent 0-5 in wars since 1947 Actual Wars we have been in : War of 1812 Mexican-American War Civil War Spanish-American War World War I World War II Everything since World War II has been what is known as a "police action," those are: Korean Conflict Vietnam Panama Gulf War I Bosnia Afghanistan Gulf War II War has to be declared by Congress

Re:Fine ...

[gstoddart]

So if you're not going to answer the questions to demonstrate your innocence, and your memory is fuzzy anyway, then the only reasonable conclusion is that you're guilty and therefore need to be thrown in jail?

No, I'm saying that when a court orders you to retain evidence as part of a legal proceeding in order that they can determine guilt or innocence, and you destroy the evidence ... for the rest of us, that is a crime.

If their system is lawful, it should be possible to show evidence of that. If they knowingly destroy the evidence someone would use to determine that, they're either lying to us about how lawful it is, or deciding the law doesn't apply to them.

That's a bit of a dangerous precident to be setting.

Well, since that's not what I said, I'm not worried about it.

The court already told them to retain the data. If they couldn't do that, the time to say that was when the order was given, and then they would have been required to show just cause.

Because, in the world in which the rest of us live, under things like SOX (and other evidentiary rules), destroying records which are being held for purposes of the court is a crime.

I'm saying the NSA et al are either knowingly violating the law, and would prefer not to tell us, or incapable of adhering to the law (either due to incompetence or unwillingness).

They keep saying they operate in accordance with the law. But on numerous occasions they've been caught lying to us. At which point taking them at face value is utterly a stupid idea.

What the NSA is saying is "leave us alone with your pesky laws, we're busy collecting all of your data".

To which I say ... "papers please, comrade", and point out that the oversight on these guys isn't nearly adequate to convince us they're not disregarding the law.

Re:Fine ...

[mrchaotica]

So what? Nothing about that invalidates the grandparent's point, which is that if you as a government entity cannot prove that you have a legal basis for doing something, then it is assumed that you don't have a legal basis for it and you must stop doing it.

Any and every technological argument is irrelevant.

Re:Fine ...

[mrchaotica]

That's a bit of a dangerous precident to be setting.

No, it's exactly the opposite of a dangerous precedent. Remember, we're talking about the government here, not the people, and the relationship between the government and the people (and other parts of the government) is explicitly adversarial (hence "checks and balances").

If it's appropriate for people to be presumed innocent until proven guilty, then it's equally appropriate for the government to be presumed guilty until proven innocent!

Re:Fine ...

[budgenator]

How much is that measured in semi-trailors loaded full of mylar punched tape?

Re:Fine ...

[spire3661]

They dont hold the image data, they scan it, assign a few bytes of metadata to it and dump it. Doesnt make it any less illegal.

Re:Fine ...

[phayes]

Again Timothy with the biased & false click-bait summary...

Courts do not issue impossible to obey orders. The NSA sifts through massive amounts of data & deletes almost all of it after a period of time. Forcing the NSA to no longer delete the data as the court initially ordered implies the immediate shutdown of the data collection program. While that may be the desired outcome of some here, it is NOT what the judge intended. He intended only to force the NSA to preserve what data it could. When the NSA explained that preserving the scope of data requested data without shutting down the data program or spending hundreds of millions to the judge he rescinded his original order.

Thus Timothy's "Our Systems Are Too Complex To Obey the Law" is false and misleading

Re:Fine ...

[pla]

My driving skills are too complex to obey the speed limit.
Bernie Madoff's finances were too complex to obey SEC regulations.
God's will is too complex to charge priests as pedophiles.
Dzhokhar Tsarnaev's relationship with his brother is too complex to charge him in the bombing.

You buyin' any of that bullshit, NSA? Yeah, neither do we.

How about "Edward Snowden's political views are too complex to charge him with treason". You understand that?

Re:Fine ...

[lgw]

Well, if we still had a representative democracy, we'd just set NSAs budget to 0 and the problem would vanish. But half the congresscritters would shriek at any suggestion of reducing any government spending in any way, and the other half would claim that would mean the terrists win, so we'll just continue our slide into totalitarianism.

Re:Fine ...

[rogoshen1]

If a program cannot be proven to be useful, we should not allow it..

As near as I can tell we'd be better served by Fort Meade focusing all of that computing power on folding@home, or seti@home. =/

Re:Fine ...

[bigpat]

Heck they can double the NSA budget as long as they are snooping on foreigners and not every American without a warrant. Maybe that is the compromise.... we increasa youah budget if youah stoppa snoopin' on the American people. Maybe the cost of Freedom is that we have to pay off the people who would otherwise take Freedom away from us.

Re:Fine ...

[lgw]

I don't trust the NSA to honor any rule or commitment in the future. Dust off and nuke em from orbit - it's the only way to be sure.

Let other US intel agencies already charged with spying on ferners with no history of spying internally have the job. If we defunded and destroyed, permanently, any org that crossed the line, they'd eventually learn.

Re:Fine ...

[Impy the Impiuos Imp]

IANAL but doesn't the NSA just concede the data proves the plaintiff's point?

After all, no heads will roll and the payout ain't their money anyway, so who cares?

My real concern is what the hell other gems might be hidden in it that they really don't want known such that they're also ready to go this route.

Re:Fine ...

[HornWumpus]

oodaloop is blithering though.

Nobody programs fast enough to fill data-centers with 'new programs'. Certainly not government programmers.

The new data-centers will hold more archived phone calls, emails, online backup sets etc. Duh.

Conflating 'stable backups of existing data' with 'the progressively/constantly filtered contents of a data firehose' is also 'inexpert'.

Re:Fine ...

[rickb928]

"what you are doing cannot be proven lawful."

"Therefore, the program is not lawful, and you need to stop."

Fine. You've just declared the NSA outside the protections and requirements of the Fourth and possibly Fifth Amendments.

Is that were you wanted to go? Seems like a quick trip to do this to citizens, starting with those working at the NSA, but not ending there.

Re:Fine ...

[rickb928]

Intelligence gathering did not start with the CIA or NSA. The agencies may be failing, but the process is not merely mandatory, we would be worse off if we did not collect and analyze data at all.

And if you're assigning failure in Vietnam in any way to intelligence efforts, I would argue that with you. The Vietnam War was a political failure.

Re:Fine ...

[CrimsonAvenger]

You've just declared the NSA outside the protections and requirements of the Fourth and possibly Fifth Amendments.

Neither the Fourth nor the Fifth Amendments apply to the NSA.

"Rights" apply to people, "Powers" apply to Government.

NSA is part of the Government, and thus has whatever Powers were granted it by the Constitution and applicable laws.

As individual citizens, the members of the NSA have the same Rights as the rest of us. Acting in their official capacity as agents of the government, they're rather more restricted.

Re:Fine ...

[TheCarp]

While I understand that, we ARE talking about data that was subject to a court case.

Shit, when I worked at a University we had a policy about destroying backups....and a policy about.... ready for this.... saving them when they were subject to legal proceedings.

No claim that this was impossible is credible. Certainly no claim that doing so was a "waste of the time, space, and energy to back it up" should be accepted by the courts on this. Destruction of evidence is what this deserves to be called.

Re:Fine ...

[TapeCutter]

Every war is a failure of politics, the Vietnam war was a war of attrition fought to score a ideological point.

Re:Fine ...

[ahabswhale]

They CAN provide the information requested but they have to shutdown the system to do it. Otherwise, they don't have space and the system will auto delete everything over a certain age. There's just no room to keep the system running without delete functionality active. You could argue that they should shut it down until it's audited but that would require you actually read instead of rant.

Re:Fine ...

[smellotron]

Nobody programs fast enough to fill data-centers with 'new programs'.

I don't read that as "new program text" i.e. the storage for newly-released executables. I read it as "storage for [data generated by] new programs," where the new programs are "programs" from a TLA organization's perspective and not individual executables. From that perspective, it is quite believable that the NSA would be capable of filling new datacenters with new programs.

Re: Fine ...

[rickb928]

Since we would not be putting the NSA in jail, we can assume it would be the people who run it.

They have inconvenient rights.

Re: Fine ...

[rickb928]

I disagree. War is either:
- a failure of diplomacy
- the only response to an implacable foe, no matter their motivation.

WWI may be the former.
WWII was clearly the latter, on both frints

Re:Fine ...

[lister king of smeg]

They CAN provide the information requested but they have to shutdown the system to do it. Otherwise, they don't have space and the system will auto delete everything over a certain age. There's just no room to keep the system running without delete functionality active. You could argue that they should shut it down until it's audited but that would require you actually read instead of rant.

you say that like it is a bad thing

Re:Fine ...

[SlaveToTheGrind]

I think you are seriously overthinking this. Its very simple. They CAN save data. Period. How do I know? Its very simple here. Do you really believe that if they found credible data on a top Con Queso leader, that they would need to analyse it within a specific time frame before they lose it forever, or do you think they can flag it to be saved?

Perhaps a bit less simple if you consider the breadth of the judge's order and understand the ramifications of being on the wrong side of that order by later being found to have (however unintentionally) deleted any data inside its scope.

Being able to save the small discrete pieces of data in your hypothetical has nothing to do with whether they could fully comply with the court's order, which prohibited them from “destroying any potential evidence relevant to the claims at issue in this action , including but not limited to prohibiting the destruction of any telephone metadata or ‘call detail’ records , pending further order of the Court" (emphasis mine). In short: until further notice, save everything.

Without even getting into the question of whether the systems have the capability of archiving every bloody bit without some sort of manual intervention, as others have already observed, the sheer storage space required to carry everything along gets really big really fast after you exceed the age-out window you designed into your system. The discovery process in civil litigation doesn't exactly run at a breakneck pace.

And even if you were to try to save it all by making the necessary architectural changes and slapping on storage capacity, if you screw up and lose any data whatsoever in that process, that quite often will result in an instruction to the jury that they can presume the data you destroyed would have proved the other side's case. There's generally little point in following through with a trial at that point -- the outcome is nearly certain with that kind of a thumb on the scale.

I'm far from a fan of the NSA, but I get why they spoke up quickly and loudly about this. To say nothing now about the prohibitive breadth of the court's order (i.e., to signal that they intended to comply) would just make it worse for them were any data lost down the road.

Re:Fine ...

[bigpat]

Shuffling around the agencies is no solution either. What we need is legal clarification from Congress and the courts that the 4th amendment really does apply within the borders of the United States of American.

Then if someone gets caught violating the constitution again they can't go and claim what they are doing is legally valid like they are doing now. The rule of law doesn't mean no one will ever break the law or violate the constitution, it means that when you get caught like the NSA got caught violating the constitution in such a blatant and massive way then there have to be some consequences and at least some shame... you can't just have everyone circling the wagons and saying the NSA or the president can do whatever they feel they need to unbounded by the law or the constitution. The law and the constitution are supposed to be a restraint on government power not a blank check to be cashed by whomever happens to pass a security background check and knows someone who knows someone in Washington.

Re:Fine ...

[lgw]

Individual deterrents do not work as organizational deterrents. There's always a true believer, or a patsy to take the fall. Only by threatening the life of the organization can you keep it under control. Keeping the NSA alive now is exactly like the bank bailouts: a lesson that "fuck the law, we can get away with anything" that will be remembered for 20 years.

Re:Fine ...

[HornWumpus]

Bug fixes are 'new programs'. Abracadabra.

Does anybody believe they aren't already sucking up all the data they know to get?

So it's out of control?

[Skarjak]

I guess they really are making Skynet... Seriously though, everything the NSA has said since this whole scandal started reeks of "The end justifies the means." They're basically a cartoon villain at this point.

Re:So it's out of control?

[ColdWetDog]

I guess they really are making Skynet...

Skynet as the world's collection of cell phone calls? Man, that is one seriously dystopian future. You need some help.

Re:So it's out of control?

[DutchUncle]

No, Skynet as the world's collection of cellphones, and all of the other embedded processors with zillions of cycles available and a lot of spare time on their hands . . . . Seriously, half of us are walking around with more computer power PER DEVICE than the entire world was using on any given day in the 1960s. And we have our "real" computer at home. Even M$ couldn't waste all of that computational capacity. Do you think the push to hook them all together in an IoT is really coming from *humans*????? (see Roger Zelazny, "LOKI 7281")

Re:So it's out of control?

[Runaway1956]

No, the cell phones are merely remote sensors for the AI hidden behind the scenes. Of course, given an AI, the computational power that accompanies those sensors is probably somewhat useful as well.

Are they arguing Occam's Razor?

[timrod]

So wait, the NSA's argument as to why their program is legal.. is that they're too incompetent to design a system that can follow the law. Shouldn't this be grounds to fire everyone at the NSA for incompetence, if this is the argument they're using?

Re:Are they arguing Occam's Razor?

[bobbied]

So wait, the NSA's argument as to why their program is legal.. is that they're too incompetent to design a system that can follow the law. Shouldn't this be grounds to fire everyone at the NSA for incompetence, if this is the argument they're using?

Well, I'm not sure folks fully understand the issue and it's posts like this that really muddy the water.

The PROBLEM is that they simply collect too much data to have a prayer of being able to store and process it all. They are drowning in data and there is no practical way to store this data for any length of time so they routinely purge "old" data to make room. From news reports I've read in the past, I'm surmising that the raw data can only be kept for periods measured in days, maybe tens of days, before they run out of disk space.

When the NSA gets sued, they are subject to having to provide any and all data they have related to the suit. From the moment they get served, or have reason to believe that they are being sued, by law, they cannot delete any data that is related or could be related to the suit. Doing so is destroying evidence, which is a crime.

So what the NSA is saying, is that they simply don't have enough resources to retain data that might be subject to discovery in a lawsuit due to the number and length of the lawsuits they are facing. Which seems to be reasonable and not an intentional failure of the NSA to abide within the law with their system design and implementation. They got caught off guard with the scrutiny generated by the Snowden affair, and now in the flood of court actions find their data capacity strained.

I conclude that the NSA is not intending to violate the law, but they feel that the system operation is more important so they leave it running, risking deleting data subject to discovery. You can argue with their choice I suppose, but there ARE reasons for the system's existence and issues with just turning it off.

Re:Are they arguing Occam's Razor?

[TheRaven64]

The thing that seems to be overlooked in all of the NSA illegality discussion is quite how much the recent revelations point to their incompetence. For example, consider Heartbleed. The NSA claims that they had no knowledge of it. If you assume that they're telling the truth, then this means that they either failed to identify OpenSSL as a critical piece of software to review (odd, given how much US and other government infrastructure uses it), or they did review it and still failed to find the vulnerability. Given how obvious the vulnerability was to anyone who looked at the code (the only reason it survived so long was that there wasn't adequate code review), this implies that the people that are doing code review are incompetent. Alternatively, we can assume that they're lying and they did know about it in advance. Given the amount of government and civilian infrastructure that depends on OpenSSL, and the probability that foreign governments (and organised crime syndicates) have identified that OpenSSL is critical infrastructure and are busy fuzzing it and reviewing the code, that's somewhat problematic. So, the options are:

• Their strategic analysts are incompetent for failing to identify that OpenSSL is a critical piece of software.
• Their core reviewers are incompetent for failing to spot the vulnerability.
• Their threat analysts are incompetent for failing to identify that defending against Heartbleed and similar attacks is more important than holding them for attack.

Re:Are they arguing Occam's Razor?

[CaptnZilog]

The PROBLEM is that they simply collect too much data to have a prayer of being able to store and process it all. They are drowning in data and there is no practical way to store this data for any length of time so they routinely purge "old" data to make room. From news reports I've read in the past, I'm surmising that the raw data can only be kept for periods measured in days, maybe tens of days, before they run out of disk space.

Which is, in essence, admitting that they collect way too much data to really be useful - and that they would be far better off targeting particular people with proper warrants rather than trying to collect everything, illegally (according to the constitution).

Re:Are they arguing Occam's Razor?

[Zordak]

he PROBLEM is that they simply collect too much data

Precisely. If they were doing what a legitimate government agency should be doing---targeted investigation of crimes and threats to national security---there wouldn't be a problem.

Re:Are they arguing Occam's Razor?

[Zordak]

Exactly the opposite. They designed their system to comply with the law (delete the data). Now the EFF wants them to do something different (retain the data so they can peruse it). If you've ever worked a a big system you would know that a major requirements change like that cannot be implemented quickly or easily.

What I find most interesting here is the outrage we keep seeing on /. when a story is posted about search warrants that are too broad. But now the EFF has essentially requested a search warrant for everything the NSA has.

No, that's not true. The duty of preservation in a civil lawsuit is entirely different from a search warrant in a criminal investigation. And no, they didn't design the system to comply with the law. If they'd done that, they wouldn't allegedly have so much information that it can't be stored. They should be performing targeted searches related to actual criminal cases and threats to national security, not wholesale data mining on every man, woman, and child in the United States, regardless of how soon they delete it.

Re:Are they arguing Occam's Razor?

[bobbied]

he PROBLEM is that they simply collect too much data

Precisely. If they were doing what a legitimate government agency should be doing---targeted investigation of crimes and threats to national security---there wouldn't be a problem.

Where that is the seemingly practical solution, the question becomes what is deemed a "collected" piece of data?

If you are sorting through all the internet traffic on a link collecting traffic to/from an IP, you will have to look at a packet's headers. Does looking at the packet header mean you "collected" the packet? After all, that packet was transferred into NSA equipment.

This is not an easy question to decide...

Re:Are they arguing Occam's Razor?

[tomhath]

The duty of preservation in a civil lawsuit

Preserving what? The data that the law requires them to delete.

Preserving for what reason? So EFF can look at it, because they don't know what was collected and they want to search through it.

Re:Are they arguing Occam's Razor?

[bobbied]

Have fun beating that shadow argument to death..

OBVIOUSLY, this system is useful in some way. Unless you just think the NSA folks are stupid dolts who don't think about what they are doing, in which case the system is totally useless and thus harmless.... Obviously you don't think the system is harmless....

Re:Are they arguing Occam's Razor?

[david_thornley]

It's been long established that, in a civil case, the court can order relevant information to be preserved. This overrides any laws that demand deletion (and I think you're making up the deletion laws). Further, there are long-established procedures for dealing with data that must not be made public, and the judge's job is to make sure discovery doesn't turn into a fishing expedition.

If the NSA deliberately designs systems to be unable to comply with legitimate court orders, that isn't the judge's problem, or the plaintiff's.

Can't hold data, or can't tell the truth?

[alphatel]

"This of course implies that they have no backup system — or at least that the backup are not held for long."

It implies nothing other than the NSA continues to lie whenever an order to turnover data is presented.

Fine.

[epyT-R]

Then it's time to stop what you're doing. People's rights are more important hiding politicians' (and their benefactors') dirty laundry. What you're doing is undermining the fundamental principles that separate western democracy from the dark ages.

Re:Fine.

[whoever57]

People's rights are more important hiding politicians' (and their benefactors') dirty laundry.

Why do you think that they are engaged in hiding politicians' dirty laundry? Why not assume that identifying and using that dirty laundry (to ensure support from those politicians) is part of the purpose of the data collection. What's the probability that the NSA doesn't have some dirt on Senator Feinstein?

Awesome

[50000BTU_barbecue]

My biology is so complex it's not understood yet either!

Woohoo! Behold the new lawless me!!!!!

Re:Awesome

[50000BTU_barbecue]

No that's the "sitting naked on a synthetic leather computer chair" effect.

Re:Awesome

[larry bagina]

Stick to leather -- it doesn't absorb farts. My buddy has a cloth chair that is oversaturated with farts. Aside from the permanent stench -- which would be bad enough -- it releases a gas bomb if you ever sit in it.

Re:Awesome

[DocSavage64109]

Really, you should get one of those Aeron mesh chairs. It's much nicer to let your body breath.

Try that one in front of a judge

[sandbagger]

Just give everyone the finger, it's faster.

The Boy Who Cried Wolf

[Anonymous Coward]

Everything concerning the NSA has "an immediate, specific, and harmful impact on the national security of the United States."

Releasing any information has "an immediate, specific, and harmful impact on the national security of the United States."
Saving any information has "an immediate, specific, and harmful impact on the national security of the United States."
Any whistle blowers have "an immediate, specific, and harmful impact on the national security of the United States."
Disagreeing with any official has "an immediate, specific, and harmful impact on the national security of the United States."
Giving out the legal reasoning behing their operations has "an immediate, specific, and harmful impact on the national security of the United States."

Why have more people not clued in that the NSA is "an immediate, specific, and harmful impact on the national security of the United States."

they have damaged the reputation of their agencies simply by believing that none of their secrets would get out. My mom always told me that once more than one person knows something it is no longer a secret and will not be kept that way.

Re:The Boy Who Cried Wolf

[bluefoxlucid]

What is the "national security of the United States" anyway? Because last I checked, it amounts to military power. If I can put a boot in your ass, your intelligence telling you I'm coming to put a boot in your ass doesn't help.

Re:The Boy Who Cried Wolf

[DutchUncle]

"Three can keep a secret, if two of them are dead." - Benjamin Franklin

Re:The Boy Who Cried Wolf

[crimson tsunami]

Of course it does. If I know you're coming I can take all the data/cash/family/etc and flee to Russia/China. Then wave my ass in your face.

Lies.

[Charliemopps]

The NSA, The CIA, the FBI and the Justice department have already been caught in BOLD FACED LIES in regards to their activities on dozens of occasions. The Presidents (both Obama and Bush) have gone on National Television and lied directly to the American people regarding this programs over and over and over again. Several NSA directors have gone in front of congress and lied while under oath. They were then called back and admitted that they're lied. You cannot trust anything they say at all. The only solution to this is to shut down the agency. They are willing to violate the law, the constitution, court order and even the will of the president. No regulatory reform or court order will be effective against an agency that thinks its charter is more important than obeying the law or will of the people. They fundamentally believe that your physical safety is more important than our individual rights. That is totalitarianism. It is not a belief that is compatible with democracy.

Re:Lies.

[Gramie2]

They fundamentally believe that your physical safety is more important than our individual rights.

I'd be more inclined to say that they value their own power and influence over your individual rights (I'm not American, and so have no rights in their eyes). If they really worried about your physical safety, they would be getting evidence on polluters, unsafe working conditions, social collapse, the prison industry, and all the other things that contribute to the decay of your quality of life.

Re:Lies.

[Charliemopps]

They fundamentally believe that your physical safety is more important than our individual rights.

I'd be more inclined to say that they value their own power and influence over your individual rights (I'm not American, and so have no rights in their eyes). If they really worried about your physical safety, they would be getting evidence on polluters, unsafe working conditions, social collapse, the prison industry, and all the other things that contribute to the decay of your quality of life.

This is the problem with totalitarianism. When you're wrong, no one is allowed to disagree with you unless they're willing to move to Hong Kong or Moscow.

Re:Lies.

[Princeofcups]

They fundamentally believe that your physical safety is more important than our individual rights.

You were great until that line. "Safety" is purely a PR term. They are protecting corporate interests, not individual's safety.

Re:Lies.

[sribe]

The NSA, The CIA, the FBI and the Justice department have already been caught in BOLD FACED LIES....

I'm pretty sure their lies were published in roman weight.

Re:Lies.

[fustakrakich]

The only solution to this is to shut down the agency.

Impossible. It will just go deeper "underground", and move even more contraband than they do now to keep the money flowing. The entire government is going rogue and the submissive population will do nothing about it. This is the world we live in.

Re:Lies.

[Rigel47]

At the end of the day accountability is almost totally absent in the upper echelons of government. Sure, sure, somebody might resign months later after a complete cluster-fuck of a healthcare.gov web site but actual crimes like perjuring oneself while under oath? meh.. "I didn't understand the question" or "it was as truthy as I felt comfortable"

Fuck these guys.

Re:Lies.

[Anonymous Coward]

Yup. Shall we count the times the current president has lied to us since the revelations?

"We do not collect any information on US citizens or allies, only terrorist organizations" - Collects info from both US citizens and allies
"OK, so maybe we are exposed to some information as it passes through the pipes, but we don't save any of it" - Mandatory saving for 5 years for any data captured
"OK, well maybe we have to save some of it, but we don't actually look at any of it unless we believe it has ties to terrorists" - Actually looks at data from anyone for absolutely any reason
"Well yeah we can check it out, but it's only metadata! We don't actually have an real data!" - They totally have your actual data, and don't forget that whole Petreus ordeal was exposed by "metadata."
"Fine, we have your content, but it's only information from phone calls. We don't snoop in on your emails or other private data." - Yes they do. They dig their grubby claws into everything and anything they can
"Well it's necessary! We're doing this to make you safe!" - And somehow completely ignoring actual threads while removing inalienable rights from the people, and subverting encryption technologies they use to protect themselves (such as in internet banking), is supposed to make us safer...how?
"Anyone could be a terrorist! We only examine people that are within 3 hops of a terrorist connection!" - Actually, you examine every man, woman, and child you possibly can.
"Well it's not illegal!" - 4th amendment disagrees.
"Search and seizure doesn't apply! When we 'take' your data and 'examine it', that's not the same as seizing it to search it!" - I'll remember that the next time the RIAA/MPAA sues for ridiculous amounts. They weren't "downloading" and "copyright infringing," they were just "obtaining a copy to watch/listen to." See, everything is totally legal if you just make up your own definitions along the way!

And the list goes on.

Re:Lies.

[imatter]

Comic Sans = Beta

Re:Lies.

[Jason Levine]

The only solution to this is to shut down the agency.

And any politician that did this would immediately be tarred as doing something that hurts America and helps The Terrorists. Since politicians are a spineless lot, always worried about being cast in a negative light, they will shy away from any real reform. Instead they will back "slap on the wrist" or "finger wagging" reform that looks to the public like real reform, but in reality does nothing.

Re:Lies.

[Charliemopps]

And any politician that did this would immediately be tarred as doing something that hurts America and helps The Terrorists.

So? Snowden gave up his freedom, citizenship and possibly will be murdered or sent to prison for the rest of his life over the same issue. Apathy is how we got here. Trying to rationalize evil only leads to more evil.

I believe them

[towermac]

It's the biggest system there is. There's nothing to 'back it up to', for various reasons. The letter of the (original) order can't be complied with, without shutting it off, and saving the current contents for the upcoming hearing (or trial). In the meantime, we have nothing as far as NSA protection goes. I get that.

That doesn't mean the the spirit of the order can't be complied with. Snapshots of sections, randomly chosen database blocks from among representative groups, a sampling of the most called routines; something. If it's a freaking computer, then there is some way that evidence can be gotten without bringing the system down, assuming cooperation on the part of the admins. I hope they are not getting off the hook.

Re:I believe them

[imatter]

Fuck they can't even turn on the second floor air conditioning without bringing the first floor down!

Re:I believe them

[DutchUncle]

I thought the NSA system *is* the backup . . . for the Internet.

Re:I believe them

[dissy]

No, simply no.

If they have a method to extract and keep data used against me and my case, then that proves they sure as fuck have a method to extract and keep data used to protect me and my case.

On a pure technical level both actions are identical.

They are claiming they can't save X bytes of data that help someone, but of course they can save X bytes of data to ruin a persons life. X = X = X

Re:I believe them

[budgenator]

Sure your Honor no problem, What's your Email address and do you want us to CC to the EFF as well?

And next... 'we need more funding for data storage

[bigpat]

Out of one side they will argue that they can't possibly store all this massive data they are collecting. And then they will turn around and blame the courts for needing more storage to store all this data they are collecting. See we can't stop spying on the American people... the courts are making us.

Speed up the trial!

[coolguyclay]

If the data cannot be saved, then speed up the trial! It's been going on for a while now.

Ignorance is no excuse

[allypally]

A basic legal principle is that ignorance of the law is no excuse.

It may be a factor in applying penalties, but it does not affect the finding of fact re guilty or not guilty.

If the NSA has historically used perceived complexity of operation as a reason for turning a blind eye to their legal obligations, they may be guilty of massed conspiracy.

So what they are saying is...

[TheCarp]

So if their system is too complex to obey the law....the short version of what they said is "We built a system without regard to the law" and "We broke the law". Thank you for the confession. Now its time to start dismantling and prosecuting thanks.

Re:So what they are saying is...

[Vitriol Angst]

Kind of like the mob;
1) illegal money comes in.
2) complex interaction with banks and insurance policies perhaps, perhaps gum drops and candy.
3) clean money comes out.

With the NSA we know about steps 1 and 3, and they are just waving their hands at step 2 and saying "trust us. We lied every step of the way and only admitted each and every thing after we were caught each and every time, but everything complicated is where we remove the bad and sprinkle sugar and gum drops."

Nice precedent

[gmuslera]

Next one will be "proper process is too complex, so we just directly jail anyone that our trusty staff think that deserves it"

orphan

[NikeHerc]

This reminds me of the story of the kid who murdered his parents, then threw himself on the mercy of the court because he was an orphan.

We have (or at least had) a Constitution to protect citizens from governmental abuses of this nature.

too big to avoid storage overflow is more like it

[swschrad]

and if they're collecting too damn much information to hold it, let alone process it, then it's almost all GIGO. dump the assumptions and Orwell on your desk for reference, and narrow your search. the FBI never caught a bootlegger chasing the history of every barefoot kid on the street, either.

taxes

[stenvar]

Do you think "The tax code is too complex for me to figure out, so I don't really have to pay, do I?" would work?

Too complex? Then simplify them!

[kheldan]

Aww, poor NSA, their systems are too complex for them to control according to the law? What a terrible 1st world problem to have! Fear not NSA, I have a solution that will take this horrible burden off your shoulders, and make the rest of us happy at the same time: simplify your goddamn systems to the point where you can 'control' them and be in accordance with the law. Either that or maybe we need to take a chainsaw to your 'systems' and just chop them down to a reasonable size. Here, here's an abacus, that's about all I'd trust you motherfuckers with at this point.

Re:Too complex? Then simplify them!

[Anonymous Coward]

Here, here's an abacus, that's about all I'd trust you motherfuckers with at this point.

You should look at an abacus before stating something like that. Guess where all those beads will end up.

Target audience

[Livius]

They don't actually mean that the system is too complex to obey the law.

They merely mean that it is too complex for "journalists" to tell whether they are obeying the law or not.

Re:Target audience

[bobbied]

No actually they are saying that a big enough system to take and keep a backup of the data they collect doesn't exist. Which, if you think about it, seems reasonable if what we are told about the NSA's collection ability is actually true.

solution

[Evtim]

I say we EMP the whole site from orbit. It's the only way to be sure!

Re:This would actually be kinda good if true

[bobbied]

Since it would mean that they don't routinely hold onto this information for further analysis, future blackmail, etc. However, it seems far more likely that they are simply lying when they say they can't do this.

Shesh you guys have made the NSA into an all powerful, all knowing, all seeing boogeyman. Think about the "system" you describe and the huge amount of data that we KNOW the NSA routinely collects. Where I don't discount the possibility that the data could be used for blackmail, the problem you have is finding the data you need (the needle) in the huge data set they are collecting (the field of haystacks).

Do you load this in to some MySQL database so you can run an SQL query on it? Um, not if you want an answer anytime soon. There are ways to do this, but we are talking about really large numbers of disk drives, CPU's and specialized bits of software to dig through the haystacks. Not to mention that you simply must have a place to start looking, a target to investigate, unless you figure on just going after some random person and trying to find something you can use for profit... Then there is the pesky size of all this data. It seems very reasonable that the NSA is running out of space and needs to routinely purge older data.

So I don't think you have anything to fear from the NSA, especially if you fear blackmail for something that happened more than a few weeks ago.. Unless you are linked to a terrorist group or something....

Re:Utah Datacenter

[bobbied]

NSA is lying.

Actually, I think they are telling the truth this time....

How much data do you think they are collecting? A Lot right? Or why would anybody be up in arms? The NSA is the all knowing, all seeing boogeyman you know, so they have to collect nearly everything. You cannot archive that much stuff forever, certainly there will be limits on how much they can keep online.

I wish ...

[PPH]

... I could use this argument with the IRS.

"Sorry. My financial transactions are far too complex for me to maintain tax compliance records."

More likely to big to be backed up

[budgenator]

My big ass hairy guess is the systems algorithms automatically controls what is stored and what is dropped without human intervention, and any real attempt to permanantly store any particular thing would mean basically shutting down the collection system. The size of the system the NSA is using would have to be mind-boggling, the amount of data coming in is staggering; new stuff has to be incoming faster than any backup could ever keep up with. It's highly likely that new stuff would over-write old stuff, making it impossible to secure particular records reliably.

I'm sure that there has to be some metadata system that ranks how long and in what detail data is to be retained, and what most of us boring normal people is downgraded faster than people that keep tripping the filters, the NSA has to be bumping up against the limits of what is possible to do on a regular basis; I'm amazed they actually can do what they are doing.

Re:More likely to big to be backed up

[Isca]

While I'm sure there is plenty of NSA Skullduggery to go around, in this case the parent is probably right on the money. I'm sure someone had an aha moment with this one - they most likely can't even begin to store all of this data - yet. Probably only a small fraction of it.

Re:More likely to big to be backed up

[MobSwatter]

They have way too much data to parse to actually be of any use. Instructing the programmers to write code within the law is just too troublesome, then again why would a mob run country that wipes it's ass with the constitution bother with the law.

Re:More likely to big to be backed up

[HornWumpus]

They can store any bit of it for as long as they need it. But they don't want to clog up their system for mere legal compliance.

A federal judge should clear things up for them. But I bet he won't.

Decimate Their Spending

[BrendaEM]

American citizens should not have to pay to be spied on by an Unconstitutional organization.

Re:Decimate Their Spending

[Bob the Super Hamste]

I think their funding needs to be cut by more than 1/10.

Re:This would actually be kinda good if true

[Zordak]

You act like it's some crazy notion that people in government would covertly collect information on private citizens for purposes of blackmail to "keep them in line"---not because those citizens are breaking any law, but because certain officials deem them to be dangerous to their own personal agendas and power structure. Have you ever heard of a guy named J. Edgar Hoover? Perhaps you should look into that.

Re:This would actually be kinda good if true

[dave562]

Isilon + Hadoop + Content Analyst (http://en.wikipedia.org/wiki/Content_Analyst_Company)

The last piece is just what the civilians have access to. It came out of the intelligence community. You can guarantee that the NSA has something way more advanced and/or better optimized at this point. Specifically look at Conceptual Clustering and Categorization.

Their challenge is not going to be pulling the data out of the haystack. It is going to be having enough analysts to sort through the results and enough guidance from on high as to which result sets to review first.

NSA Definitions and weasel words

[pepsikid]

"an immediate, specific, and harmful impact on the national security of the United States."

Yes, and see, they measured it out to be on the order of .0000000000000001% of a mission obstacle lasting all of 6 seconds. But by strict definition, it qualifies to trigger the "let us do anything we want without conditions" mechanism they love so much.

"This of course implies that they have no backup system — or at least that the backup are not held for long."

Unfortunately, it proves nothing. The recording systems capture EVERY byte coming along the cables and can be used to REPLAY exactly what data went between two points at any time. This means they can go back and re-examine traffic to find hidden transmissions they overlooked before. They don't throw anything out (specifically stating that they keep anything encrypted forever) and longevity is reported as anywhere from 4 days to several years of 100% of the Internet's activity. Reports vary due to being what the system was capable of at the time, probably. The UT center probably won't be full until your kids are out of diapers and graduating high school.

Re:Interesting

[Ash-Fox]

my friends aunt just got a stunning black Nissan only from working parttime off a macbook

She should sell it; then she can afford to give you a proper education in sentence structures, spelling, grammar and hyperlinking.

Re:This would actually be kinda good if true

[bobbied]

Isilon + Hadoop + Content Analyst (http://en.wikipedia.org/wiki/Content_Analyst_Company)

Totally aware of this technology, actually have done professional work with it.

Their challenge is not going to be pulling the data out of the haystack. It is going to be having enough analysts to sort through the results and enough guidance from on high as to which result sets to review first.

No, the challenge here is knowing what to look for in the data you collected. You have to use No-SQL techniques to sort though the raw data using map-reduce jobs and collect the information you want about the specific target(s). The individual data reduction steps are *easy* if you have a target to start with. What's hard is performing these steps in a resource constrained world when you have huge data sets that are constantly changing. So the Data part of this is not analyst constrained, it's compute and storage resource constrained. Analysts should only be formulating the queries and setting the queries loose on specific targets and then looking at the results.

Re:This would actually be kinda good if true

[bobbied]

You act like it's some crazy notion that people in government would covertly collect information on private citizens for purposes of blackmail to "keep them in line"---not because those citizens are breaking any law, but because certain officials deem them to be dangerous to their own personal agendas and power structure. Have you ever heard of a guy named J. Edgar Hoover? Perhaps you should look into that.

Oh I don't discount the mis-use of government power, believe me. What I'm saying is that the NSA system requires a TARGET to look for or the data is pretty much worthless. Somebody has to formulate the data query, program the system to actually perform the query wanted, then set the query process in motion for a specified target before they will get results. As I understand this system, if a data item doesn't trigger some kind of flag that says it's of interest, it's going to be removed from the system fairly quickly, at least in its raw form.

So, if you are not already a target that sets off flags, you are lost in the noise and your data is deleted. If you are a target, heaven help you and your friends...

Re:This would actually be kinda good if true

[dave562]

My experience with the technology has been peripheral. The demonstration I saw showed clustering and with that technology, it removed the need to know what to look for. It put the concepts / clusters together for you and let you see, at a high level, basically what the data set was about. This was assuming that the data set was trained on itself. If you had a more focused training set, say one derived from already vetted intelligence, the algorithms could sort through the noise to find conceptually similar result sets.

The above assumes that there are compute and storage resources available to do the initial training. Obviously the entire data set is too large, so it needs to be culled and that is the challenge.

Off topic and not terrorism related, but it would be interesting to see the correlations between big wins in the stock market and communications patterns between individuals leading up to them. Not that the SEC has the stomach for it, nor am I comfortable with the civil liberties implications of such a setup, but it would be cool to let the algos go for a year or two and see what potential prosecutions they bring back.

It's the securities, stupid.

[Tenebrousedge]

I don't know about stupid and incompetent, but you're entirely wrong as to the fundamentals of the 2008 financial crisis.

It's nice to make this about individual responsibility, but that's just not what happened. You probably heard the terms "credit default swap" and "mortgage derivatives" but didn't understand them. Essentially what was happening was major financial companies found that they could package up a bunch of low-rated mortgage-backed securities, hide the information about the individual loans, and turn a bunch of shitty loans into an AAA-rated security, and then trade the risk to someone else. Moody's and S&P were getting their cut from rating these things, and did not even have the information to be able to rate them properly. Then we have the credit default swaps, which were a little-understood and unregulated market, but essentially a way for companies to trade debt as if it were an asset, specifically all of the risk they were exposed to as part of these MBS deals. The concept of trading debt as an asset is not new, but it really only works when you have a good idea of how risky the debt is. There was a booming market[1] in these credit default swaps right up until the first wave of foreclosures hit and the MBS market started crumbling, and then whoever was left holding the bag got screwed.

Banks generally don't do stupid things, even when the government wants them to. They sure as shit don't advertise things that are going to lose money. There were a lot of people with a vested interest in pinning this on the individual consumer and the government, but the seeds were sown with the repeal of Glass-Steagal. The federal loan program ticked along quietly for over a decade, but the mortgage market exploded due to the derivatives market. Taking a shitty subprime mortgage and packing it into an AAA-rated security was like printing money. There was no governmental obligation to offer NINJA loans, for example, and yet Wikipedia has a lovely advertisement offering free money to essentially anyone with a pulse. The loans peaked in 2006; 2008 marked the first round of foreclosures.

Wikipedia has a good but lengthy article on the subprime mortgage crisis, and "The Big Short" is a good read that covers the origins and fallout of the crisis. You can also read the Financial Crisis Inquiriy Commission report. In point of fact, reading anything about the subject would be an improvement in your understanding; your specific theory has been destroyed in any number of sources. It's a complicated subject, and to be honest the exact details of a lot of these things escape me, but you have seized upon a simple answer that suits your preexisting beliefs. Start from the evidence and work backwards instead -- why did Bear Stearns collapse? It wasn't because they were issuing mortgages. This will save you from looking like an ignorant Wall Street stooge in the future.

[1] "The volume of CDS outstanding increased 100-fold from 1998 to 2008, with estimates of the debt covered by CDS contracts, as of November 2008, ranging from US$33 to $47 trillion"

Re:It's the securities, stupid.

[volmtech]

Didn't these loans have mortgage insurance? Where did that money go? I had a FHA farm loan. I couldn't pay it back so foreclosed and sold my property for half of what is was worth, which is exactly what I owed them. That's how you run a loan program.

NoSubject

[roninmagus]

What would they do for anyone else? They'd just seize the servers for investigation and be done with it. Not let you give some wimpy cry about your retention policies--hard to enforce retention when your server is sitting in some FBI storeroom waiting to have its hard drives combed over.

Re:This would actually be kinda good if true

[bobbied]

Where I think the results of your thought experiment would be interesting, the results of it would clearly be unusable as evidence and would not be something the SEC would have the legal right to do.

But, I would imagine that the number of people you could prove where insider trading doing this would be extremely limited. Apart from congress (who are exempt from the insider trading laws anyway), most people are usually not that prone to do things that are clearly illegal. Most of the companies who do trading are careful to train on insider trading and ethics for a reason. The companies are liable should they have folks doing illegal trades, the people leaking information are also criminally liable, even if they don't profit from the trades. The SEC has made it clear that this kind of crime doesn't pay, and if you get caught, it's not going to go well for you. I think the message has generally been received.

The problem has moved on to other things.... Now days, It's about shaving fractions of a penny on huge blocks of stock, duping retail customers into taking the hair cut in the process, and laughing all the way to the bank...

NSA: No Sales for America.

[Futurepower(R)]

NSA: Not Safe for Americans.

NSA: No Sales for America. The NSA is a powerful advertisement that nothing complicated made by a U.S. manufacturer is safe.

NSA: Not Sensible for America.

Too large to obey a court order...

[sirwired]

The headline implies that the systems are too large to meet some statutory obligation. This is not the case; the truth is that they are saying their systems are too large to comply with this new, not-previously-existing requirement.

I'm not saying I believe them, but it's certainly a plausible argument. It's perfectly normal for the subject of a subpeona or other court order to object to it on the grounds that compliance would prevent the ordinary course of business. I can certainly conceive of a system that takes in huge amount of data and discards 99.99 percent of it; it's par for the course in Business Intelligence systems in the private sector. Wal-Mart, for instance, does not need to retain indefinitely which transactions at particular times contain particular sets of items. After a year or so, the data is far less useful, and ever-larger datasets are harder to search and process. It makes perfect sense to completely discard the data after a certain period of time and have no provisions in the system to archive it on a long-term basis. (This whole concept is referred to as Information Lifecycle Management.)

A court order saying "Wal-Mart, keep all transaction data indefinitely, starting Right Now" is certainly going to result in Wal-Mart objecting on the grounds that it cannot do so without completely destroying it's business.

Re:Too large to obey a court order...

[david_thornley]

On the other hand, if Wal-Mart refused to keep information about a certain person indefinitely pursuant to a court order, they'd be in serious trouble. This doesn't mean they have to find the data they've already deleted, but they do have to preserve the data they've already got. (This is one reason Information Lifecycle Management typically imposes strict rules on when to keep data and when to dispose of it - if your policy is to delete stuff a year old, you're completely off the hook, legally, for data a year before proceedings started.)

some more detail here

[tedlistens]

http://motherboard.vice.com/re...
The government appeared to want it both ways, Andrew Crocker, a legal fellow at the EFF, told Motherboard. "They said [the Internet data collected under the Foreign Intelligence Surveillance Court] is not relevant to our case, but they've also made statements, in asserting state secrets, that we touch on issues under the guidance of the FISC."

They Bought Into Their Own Cloud

[tmjva]

So I guess they bought into their own secure "cloud" and have the same issues regular customers do.