The NSA's Lockbox Has No Lock

from the like-that-won't-be-abused? dept

One of the key points that officials have been making in defense of the NSA surveillance is this idea that even if they’re collecting all this data on your communications, they can’t actually do anything with it, because they keep it safely locked up in a lockbox, and only check it if they have some bit of data they want to find out about later. That was the crux of the claims made by former NSA/CIA boss Michael Hayden who seemed to think that “data mining” and “asking the database questions” were two different things. However, as William Saletan is pointing out at Slate, the lockbox is a lie. There is no lockbox. He quotes officials including NSA boss Keith Alexander and Congress’s number one NSA apologist, Rep. Mike Rogers, both suggesting strongly that even if the NSA is collecting all your data, it’s safe because it can’t be explored without a “very specific court-ordered approval process.”

Except… what they conveniently left out, is that the court doesn’t review any of this. It appears that it probably set some very basic rules up front when it gave the okay on collecting the data, which no one else gets to know about, and no one carefully checks up on the NSA later to see if they really follow any of those rules. What the claims most certainly do not mean, is that the NSA needs to get a court order to search the database. Senator Dianne Feinstein admitted as much directly:

Q:  Is a court order necessary to query the metadata database?
Feinstein:  Is a court order necessary to query—
Q: The metadata database under 215. An individual court order for each query.
Feinstein: A court order—well, I don’t know what you mean by a query. A court order—
Q: To search the database.
Feinstein: To search the database, you have to have reasonable, articulable cause—
Q: Certified by a judge?
Feinstein: —to believe that that individual is connected to a terrorist group. You cannot—
Q: But does that have to be determined by a judge?
Feinstein: Could I answer? You may not like it, but I’ll answer. Then you can query the numbers. The only numbers you have—there’s no content. You have the name and the number called, whether it’s one number or two numbers. That’s all you have. Then you can get the numbers. If you want to collect content, then you get a court order.
Q: So you don’t need a court order for the query itself.
Feinstein: That’s my understanding.

And yet, as the article notes, most of the defenders of the program strongly imply otherwise, highlighting the “court-approved” process that people need to go through to query the database. But if there’s no real oversight, and no court reviewing each query, then, as Saletan points out, there is no lockbox.

There’s no lock on the lockbox.

That hasn’t stopped current and former government officials from repeating the lockbox line. Yesterday Rogers used it again on Face the Nation. Dick Cheney, appearing on Fox News Sunday, backed him up. On Meet the Press, Michael Hayden, the guy who ran the NSA when it began collecting phone records, assured Rep. Bobby Scott, (D-Va.,) “The only way you can access the metadata is through a terrorist predicate.” When Scott asked, “Where is that written?” Hayden replied: “It’s in the court order.” Really? Where’s the court order? When is it applied, and how?

If the court isn’t screening data requests, that leaves two possibilities. One is that nobody’s screening them. The other is that some other, unknown entity is doing it in a way that nobody has explained. Either way, the answers we’re getting are unacceptable. They betray privacy, public trust, and national security.

If there’s no public standard, and no official oversight or review process, then the probability that the database is being abused approaches one very, very quickly.

Filed Under: , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “The NSA's Lockbox Has No Lock”

Subscribe: RSS Leave a comment
Uriel-238 (profile) says:

Mike when you said There’s no Lock on the lockbox, my first thought is that this information lies unencrypted in an easily searchable system hooked up to the internet with, probably, a modest firewall at best.

Which means any hacker worth his salt will be able to ALSO use the massive NSA database for their own ends.

I’d like some reassurance of how few (or rather, how many) people actually have access to this supertrove of data.

What would it take to force the NSA to purge the thing and stop?

Anonymous Coward says:

Re: Re:

The database is probably NOT on the Internet, NSA have their own network for obvious reasons, they are paranoid about anyone else getting their data. They pass carefully written reports to the government, with most sources and names removed. These are probably still on paper so that they can be locked in a safe.

Rapnel (profile) says:

Re: Re:

He may have confused that fact that the system queries the operator when things need another look which may or may not lead to a request for immediate attention or a request to the secret court in order to bust out the man power.

That and browsing the data feeds, gosh, in pretty much real real-time, is not exactly a well formed query. I can see how some clarification on the usage of “query” may have been necessary.

Anonymous Coward says:

Government officials are tech illiterate, the tech people know they are lying and they know why what they are saying is a lie.

If you can query a database, the only thing stopping you from making other queries is you not a judge and if there is nobody looking there is no lock, is the judge the one that gives some sort of digital key to open the query station for them?
I doubt it is done that way.

The analogue version of this would be locking someone in a warehouse full of documents collected from everywhere and leaving the guy in there only to come out and ask the judge to authorize his use of some piece of paper he found in there.

The government is not naive, they know not to allow access to sensitive information to anybody, they put several layers of protection and when you need something you need to go ask authorization to someone to unlock so there is a paper trail, but somehow they devised a scheme where there are apparently zero safeguards real safeguards in place and are telling people that it works the way they say because they say so.


out_of_the_blue says:

So why should you think Google is any better?

Mike is only “against” the visibly gov’t part of the surveillance grid. He not only doesn’t worry about Google, which is a major source of NSA data in the first place, he promotes it.

Schmidt also said Google has been known to curb its own creepy impulses:

“There are many, many things that Google could do, that we chose not to do… One day we had a conversation where we figured we could just try to predict the stock market. And then we decided it was illegal. So we stopped doing that.”

Schmidt: ‘Google doesn’t do data mining’

That last is EXACTLY what the NSA is saying here.

John Doe says:

Just wait 5 or 10 years when people run for office

The fun will really start in 5 to 10 more years when someone decides to run for office and they are not part of the party in charge. Suddenly they will get visits from unsavory people suggesting they not run for office or their internet search history, phone history and email records will come to light. Maybe those records show the person was into weird stuff. Stuff he doesn’t really want the public to know. This can/will become a tool for the party in charge to stay in charge for a long, long time.

RyanNerd (profile) says:

Damn Bureaucrats

But sometimes if you look at what they say as a kind of dance. Frome the perspective that what they say as an art form it does take the stench out of the BS just a little. It can actually be an ashonishingly amazing tap dance routine to witness:

Q: But does that have to be determined by a judge?
Feinstein: Could I answer? We see here a classic flaps step.
You may not like it, but I’ll answer. This is another classic step called digs.
Then you can query the numbers. The only numbers you have?there’s no content. This move is called the riff.
You have the name and the number called, whether it’s one number or two numbers. That’s all you have. Then you can get the numbers. This is a complicated step called the Shuffle bufflo.
If you want to collect content, then you get a court order.
Finally we end with yet another very complicated step called the pull backs single to double.

Anonymous Coward says:

We already know that the FBI abuses NSLs constantly and yearly reports show it continues.

Here you have no oversight, no public visibility for verifying the process, and the court supposedly responsible for oversight doesn’t.

This sounds like a whole bunch of politicians who are in on it not wanting to be exposed and nearly everything you are hearing are lies.

Only the light of public scrutiny will now clear up this stain.

John Fenderson (profile) says:

Re: Re: Re:

I think that the activities of the NSA, CIA, or any other TLA should be public as far as possible. There are some circumstances where this isn’t realistic. In those circumstances, though, there needs to be real, actual, authoritative, effective oversight by people who represent the US citizenry.

Right now, there isn’t. That’s an even bigger problem than any individual program, as the lack of oversight is what allows these egregious individual programs to persist.

Anonymous Coward says:

See the post that over 200 people on TD have seen. See the post that mike desperately doesn’t want anyone to see. He’s so desperate to hide this that he’s blocking IPs, keywords, titles, and links.

Mike hates this post so much that he’s going out of his way to censor it:

the next edition will be out very soon.

How hard will he work to hide that from you too?

Lurker Keith says:

Re: Re:

I don’t know if this has anything to do w/ these Trolls claiming to be blocked by some automated process, but I have noticed Techdirt behaving strangely of late.

The last few days (could be over a week or more; I’ve not been paying sufficient attention to when it started), Techdirt has been lagging, & I’ve been getting “Techdirt is not responding due to a long script running” errors.

Today, I’m getting those script errors, & additional lagging, trying to uncollapse the Hidden posts (if I’m going to read the comments below them, I’d prefer to know what they’re replying too… I do sometimes regret trying to read the IQ reducing stupid).

I’ve been considering reporting these lags, & so now I have.

I also will point out that I sometimes have to use IE10’s Compatibility Mode a lot to get the Funny/ Insightful/ Report buttons to display (it’s inconsistent, & sometimes even that doesn’t work & an additional refresh is required).

I have noticed that the pop-up whatever those are lag again, as well. & one has to keep being closed every refresh/ with each new page opened.

Hopefully, this report is helpful enough to find out what the problems are.

Ninja (profile) says:

So you are telling me that they’ll behave and never look at data without a warrant despite it being readily available. Right.

Then they say 9/11 could have been avoided if they had all that data. How do both statements fit together? The only possible way they could look at the data if available would be to have a court warrant which means they’d need to argue that there’s a probable cause and this could only be done by normal police work which would have raised some data first.

Providing a warrant is given, the telcos store metadata as what was collected for a good while thus making such preemptive surveillance completely unnecessary. Their own arguments kill each other.

No really, just a peek.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...