back
98 comments
This is where the NSA overreaches: collecting data on innocent Americans either incidentally or deliberately, and data on foreign citizens indiscriminately.

Put aside the question of data on U.S. citizens: I don't understand how in an era of burner phones and widespread encryption any intelligence agency can do without some bulk foreign surveillance. Say HUMINT gets its hands on a foreign bad guy's contact list. Odds are the most relevant information you'd be able to extract is in the past, especially if the target knows you captured his list.

Is it really an "overreach" if the NSA can acquire the mobile phone records of Yemen "indiscriminately" and use the data to build social graphs for current and future (currently unknown) targets of interest?

EDIT: I don't mean to cast Schneier's argument uncharitably. He may very well make a distinction between "acceptable" and "overreaching" bulk surveillance, but if so he doesn't seem to outline it in this piece.

> Is it really an "overreach" if the NSA can acquire the mobile phone records of Yemen "indiscriminately

Yes. You can not commit act of violence indiscriminately just-in-case.

The US army could place a bomb under every house in Yemen, just in case that they would need to bomb it later. Would that be an overreach? If they don't activate them, how can it be harmful?

Dealing with the necessities of the real world means drawing lines, and just because it may be ridiculous to draw the line in one place does not mean that the whole exercise is ridiculous. At the opposite extreme: even if a terrorist is heading at you with an AK-47, you shouldn't "commit an act of violence" because what if he chances his mind and decides not to shoot you?
That is comparing indiscriminately violence to self defense against a specific identified person.

The lines are not that silly. Yes, you can defend yourself against someone pointing a gun at you. No, you can not use a nuke, or release biological weapons that kill indiscriminately everyone in the whole nation. Reactions should be appropriate to the threat, and indiscriminately violence is rarely if ever appropriate.

Where in the world did we start talking about bombing in the comment above? He is talking about passive communications collection.
Passive communications collection is extremely dangerous. If data get leaked, people are going to die left and right. If the data is somehow incorrect or corrupted, innocent people will die.

Surveillance is violence. It is that simple.

First you mention ways in which surveillance could result in violence, then you equate violence and surveillance.

Doesn't your own argument indicate that they are separate concepts? It doesn't seem simple at all.

Silence is violence. Talking is violence. Planning is violence. Shall I go on?
Communication collection is an act of violence, but of a much smaller degree than blowing something up, of course.
This seems like a tortured use of language. I have a very hard time believing that my friend who enjoys people-watching at the park is doing violence to anybody.
Is it really an "overreach" if the NSA can acquire the mobile phone records of Yemen "indiscriminately" and use the data to build social graphs for current and future (currently unknown) targets of interest?

That's not his line of argument. He says that bulk collection of data will not remain confined to the Yemen - there will be mission and scope creep, to include indiscriminate data collection on US citizens and the whole world. That way lies the "Deep State".

How do you read the piece that way? He calls bulk data collection useless: "It doesn't make us any safer." If he were carving out kinds of bulk foreign surveillance that would be acceptable were it not for the potential for abuse, I think it would be clearer.

Or are you discussing something else he has written?

Schneier calls bulk spying worse than useless. What he says is (emphasis mine):

"This is where the NSA overreaches: collecting data on innocent Americans either incidentally or deliberately, and data on foreign citizens indiscriminately. It doesn't make us any safer, and it is liable to be abused."

We know that politicians like to keep dirt on their opponents to protect their fiefdoms, and we have seen the phenomenon of sudden, unexplained resignations. We also know that government oversight of the secret agencies is lax. Some say effective oversight is not possible.

I admit to bias here - Germans of a certain generation are intimately familiar with the abuses of the Stasi.

I, for one, would accept a marginal increase in an already unlikely risk (terrorist attack) if it means better respecting the rights of innocents in Yemen. I'm not even convinced it would mean an increase, as the good will derived from respect may dominate.
What American security planners are worried about is exactly that marginal increase.

Suppose Yemen (sorry to pick on Yemen) becomes a secure base for bad guys who manage to bomb an airplane, a subway, or a major sporting event somewhere in the world "merely" half a dozen times a year. You can argue all you want about how you'd still be more likely to die from a traffic accident, but that won't change the political pressure for action. Frankly, a lot of that pressure would be rational: The costs of disruptive attacks of course go way beyond the mere casualties, even if everyone involved is perfectly stoic.

Now you're looking at the potential for a military incursion, dramatically escalated security at transportation hubs and public events, and/or a bunch of other responses that you might find a whole lot more distasteful than the intelligence agency of a democratic government keeping tabs on phone calls in an unstable country.

I know that's what they're worried about (assuming good faith on their part). The potential downside is not tiny[1], but the question is what change in the likelihood is produced by the change in policy. Remember that we are not talking about forgoing all intelligence gathering; we are specifically talking about focusing on HUMINT and targetted surveillance instead of mass surveillance. Resources spent on mass surveillance are not spent elsewhere. I contend that the change from shifting resources to mass surveillance is likely to be small (if it's even in the desired direction). And a small change is something I want to bear if it is the price of respecting the rights of innocent people, because I am not a coward.

[1] Though if we keep our heads - which is what I've advocated consistently - it can be small. Sadly, I don't think that's likely, but we should continue to push for it. Fear of terrorism is how democracies fall - anyone saying "you need to be freaking out about terrorism" is the enemy.

> Now you're looking at the potential for a military incursion, dramatically escalated security at transportation hubs and public events, and/or a bunch of other responses that you might find a whole lot more distasteful than the intelligence agency of a democratic government keeping tabs on phone calls in an unstable country.

You're assuming those things are inevitable. The argument seems to be that we are bound to act irrationally so let's just give in to it and do something harmful and ineffective. The right answer is to keep our heads in all cases.

Let's suppose you're right and the predominant cost of terrorist attacks is our overreaction to them. Isn't it then obvious that the solution is to prohibit the overreaction? Amend the constitution. Make it much more difficult for the government to engage the military in a foreign excursion. Prohibit all of this TSA security theater entirely. Take away from Congress the ability to self-inflict damage -- that's the actual problem so that's what the solution has to fix.

What American security planners are worried about is exactly that marginal increase.

Can I inquire as to how you know that? American security planners haven't exactly been forthcoming about their motivations and rationalizations.

> Is it really an "overreach" if the NSA can acquire the mobile phone records of Yemen "indiscriminately" and use the data to build social graphs for current and future (currently unknown) targets of interest?

Is it an overreach if the Yemeni government "indiscriminately" collects the mobile phone records of US citizens? Or, more realistically, China, Russia, UK, Germany, etc...? It seems to me, when you carry out that kind of surveillance (really any sort of wide reaching security/military tactics) you can only expect reciprocity. And at that point why even be bothered if the NSA can collect American data? Even if they cannot legally capture it on their own, they know exactly where they need to go to get it...

I guess my point really boils down to "Do unto others...".

Is it an overreach if the Yemeni government "indiscriminately" collects the mobile phone records of US citizens? Or, more realistically, China, Russia, UK, Germany, etc...?

By my thinking, no, not at all. It's life in the modern world of sovereign states and power politics. And of course one of the NSA's jobs is to make that kind of surveillance harder. (I'm less sanguine about the kinds of intelligence sharing operations with allies that are indeed end-runs around the Fourth Amendment.)

In theory, having every bit of data would be useful.

In practice (a decade or more of NSA collecting phone records), this doesn't seem to be the case. Multiple terrorist events have happened, but apparently NSA was not able to use all that data to detect or prevent them.

Where the data has been most useful has been in persecuting journalists and political rivals and whistle blowers and circumventing due process in courts.

I'd bet on NSA destroying our democracy long before a terrorist could.

> Is it really an "overreach" if the NSA can acquire the mobile phone records of Yemen "indiscriminately" and use the data to build social graphs for current and future (currently unknown) targets of interest?

If all they do is foreign activity like that, then no, probably.

That they routinely and indiscriminantly collect mine and other Americans' data, yes. You can't put aside US collection, because it's a huge part of their activity. They are arguably routing around the Constitution.

If all they do is foreign activity like that, then no, probably.

But that's not what Schneier wrote. He specifically calls out indiscriminate bulk surveillance of foreign citizens as "overreach", even without making a distinction between U.S. allies and adversaries.

Again, I'm not interested in having yet another discussion about exactly which data the NSA is or isn't allowed to collect accidentally or deliberately on U.S. citizens. If you think there have been a paucity of discussion threads about that, feel free to start another one.

it's not only overreach, it's obvious human rights abuse

people have a right to not be indiscriminately surveilled by every country that they don't live in.

The division between citizens, residents, and nonresident concitizens does not exist in the law. The constitution recognizes the rights of "the people". It does not mention any other criterion. Foreigners have exactly the same rights to privacy and due process under the constitution as Americans under American law.

The difference in practice stems from the difficulties foreigners have suing for civil rights violations in American courts. State and federal district courts do not have personal or territorial jurisdiction over the plaintiff. The Supreme Court is reluctant to hear cases that have not already been decided by those lower courts.

So a foreigner has to file directly with the Supreme Court, and they, unsurprisingly, refuse to hear the case. As a result, the ability of the executive to violate the civil rights of nonresident noncitizens is effectively unchecked. Arms of the executive routinely break American law while abroad, utterly without fear of reprisal.

It would be naive in the extreme to think that mere laws could curtail military and industrial espionage, but when it comes to massive, Stasi-like domestic surveillance, you'd think that the law would at least make a dent.

The law is clear: no searches without specific warrants based on reasonable articulable suspicion. Forget who should be doing the legwork. Who the hell would be reading and signing all those warrants?

The mere fact that Bruce Schneier can be tricked into making a distinction between foreign and domestic is telling, because warrantless, suspicionless surveillance of foreigners is still an illegal infringement upon their civil rights to privacy and due process!

If the NSA were only "acquir[ing] the mobile phone records of Yemen" and nothing else, Edward Snowden would not have risked everything by leaking thousands of documents and we would not be having this discussion today.

Put another way, if you're characterizing the debate as merely about "acquir[ing] the mobile phone records of Yemen," you haven't been following the debate.

Schneier is suggesting reforms we should initiate based on the Snowden revelations. One of those proposed reforms is, apparently, the elimination of bulk foreign data collection by any intelligence agency. I think that's an unreasonable limitation for the reasons I articulated.

I'm not sure what about that claim indicates I'm not following the debate.

You are correct that Bruce mentioned, in passing, that it may not be a good idea for the NSA to collect "data on foreign citizens indiscriminately."

It's of course possible and perhaps reasonable to argue that Yemen has a far higher percentage of AQ leaders than, say, Canada, so vacuuming up all of Yemen's phone records is not "indiscriminate."

But the point I was making is that it's especially alarming when the NSA's giant electronic ear is turned inward, and the spy agency uses these vast powers granted for overseas surveillance for domestic surveillance. The Yemeni government can't order the NSA to hand over information gathered on Yemeni citizens. The U.S. government, on the other hand, can order the NSA to hand over information gathered on U.S. citizens.

That is what a good portion -- certainly not all, but a good portion -- of the NSA debate is about. (Also see: "DEA use of NSA intercepts for domestic criminal prosecutions.")

Scheier previously wrote his opionion about this subject.

I can't find it straight away, but the problem is that militaristic rhetoric presents mass-surveillance as straightforward and productive, while in reality - the way Schneier presents it - it's not.

A very serious problem is also that indiscriminate collection tends to be related to indiscriminate action; there have been some examples in HN in the last times.

We have a Cold War sized security apparatus. This is what led our leaders to think wars on the far side of the planet could be done at "only" a few tens of billions, and why the cost ballooned to multiple trillions. Because it could. Because we have the machinery in place.

Now we realize that machinery has put us in a panopticon. To keep us from creating any fundamental change in government or society. That will cost us more than trillions of dollars.

Actually most it was winding down after the cold war; it was Terror which really brought it back. (the IC was shrinking fast; the mainstream military had been cut in half but the rest had a long lead time to reduce beyond that.)

(EDIT: I meant "it re-inflated back to peak size; it's not like it's remained at that size since the Cold War" -- which is almost worse, since it means it was a semi-conscious choice vs. just inertia.)

At no point was it "cut in half."

Here's a graph: http://www.washingtonpost.com/blogs/wonkblog/files/2012/11/M...

It's barely below the peak spending, including Star Wars and all that, of the height of the Cold War.

Cutting it in half would be a good start, along with Homeland Security.

More was spent on the recent wars than the whole Cold War. That's your grandchildrens' debt slavery right there. People should be very very angry about that.

The number of personnel in the Army was cut approximately in half (ok, more like 35%) after CW and Gulf War 1; the spending (and headcount) lagged new enlistment to a combination of inflation and Congressional protection (and the process of separating people being slow). BRAC, etc. was quite real. Capabilities were approximately cut in half under Clinton, too

http://www.infoplease.com/ipa/A0004598.html is a decent graph of headcount. Reductions in force lag 4-8 years, though.

We did have a massive ramp-up post-9/11 -- not arguing that. I'm arguing that in the 1990s the military was on a downward trajectory, which was good, and it was cut substantially and in-line with previous cuts.

Personnel count is a more inflation-insensitive way to measure defense spending, IMO. Part of that is due to increased contractor use, but that really didn't kick off until ~2001. The US military in the 1990s was objectively declining in size, capabilities, and mission, as it usually did after a war, until they developed the "perpetual war on a tactic" innovation.

The IC was the area which was cut a lot, though. CIA under Clinton was basically dumping ground for incompetent liberal artists starting their careers, with political motivations -- sort of like a third-string law school -- which was fine since there was ~no mission. The Cold War era people were essentially either of retirement age, or shifted to the commercial world. NSA wasn't growing much, either. NRO, I believe, was in sustainment mode. The problem is they ramped up the IC post-9/11 and did it with those people, and then bringing in trigger-puller types, including lots of "crusaders" (super-religious, relatively uninformed, un-nuanced understanding of any of the issues) people. It's kind of amazing we didn't end up actually invading Iran or whatever.

Do you have an article link for the graph? It would be good to see the caption and also to know what type of dollars they're plotting (inflation-adjusted, etc.).
"Second, all surveillance of Americans should be moved to the FBI."

This sounds like a great idea in theory, but in the current age of global communications I'm concerned that it's impossible to separate surveillance into "American" and "foreign". This gray area is what the NSA currently uses to circumvent the US Constitution, and I don't see how any other agency would handle it differently.

There's lots of middle ground. For example, just tell the foreign intelligence side that they can't tap any communication where at least one side of it originates in the U.S. and then install meaningful (or stringent or whatever you want to call it) oversight on the domestic side.
"This sounds like a great idea in theory, but in the current age of global communications I'm concerned that it's impossible to separate surveillance into "American" and "foreign"."

I've got an even better idea: No surveillance at all!

What do Americans gain from the all-encompassing, algorithmic surveillance? -Why precisely nothing, of course. On the contrary, they suffer massive losses in privacy.

So why is it done, then? -Not for the people's benefit, that's for sure.

"No surveillance at all" wouldn't just exclude "all-encompassing, algorithmic surveillance". It would also exclude warranted tapping of phones in connection with a murder investigation, and similar. I would be hugely leery of asserting that we gain precisely nothing from that.
You know what I was referring to.
I think the photo they picked to go with the article subtly undermines it. I wonder if that was deliberate.
Yeah, that's awful.
It's good to see a piece like this on cnn.com, but I doubt that anything will come of it.
Right after the military industrial complex and its pseudo "jobs program".
its
No need to break them up. They just need their virtually unlimited budget cut to the neighborhood of 1995 levels. A gas expands to fill its container. A political organization expands to fill its budget.
"It's time to bell the cat," the mice agree.
First, I am really surprised to see this on CNN....