This law applies to all email communications, including those between U.S. persons. The article you linked to talks about incidental data about U.S. persons collected by means other than "from a wire on American soil." Specifically, the NSA collection extends to:

> [The] contents of the phone calls and email the security agency vacuums up around the world, including bulk collection of satellite transmissions, communications between foreigners as they cross network switches in the United States, and messages acquired overseas or provided by allies.

Except if you dare to use encryption. Then it becomes "foreign" even if the endpoints are domestic.

Source?

Intelligence Authorization Act for Fiscal Year 2015: section 309 [0]

"A covered communication shall not be retained in excess of 5 years, unless ... (iii) the communication is enciphered or reasonably believed to have a secret meaning;"

[0] https://www.congress.gov/bill/113th-congress/house-bill/4681...

That does not refute my point above. Section 309 only applies to incidentally acquired communication that is collected via the routes mentioned above. It does not allow the NSA to collect traffic between domestic endpoints just because it is encrypted.

"covered communication" is defined in the prior page (309.a). The definition stands alone, regardless of how "incidentally" appears on the same page, it makes no reference to proceeding limitation or definitions.

"...any nonpublic telephone or electronic communication acquired without the consent of a person who is a party to the communication, including communications in electronic storage."

You don't ignore section headings when reading laws. Besides that, nothing in that section discusses granting authority to collect "covered communication." The section is discussing the retention policies of communications collected by some authorized manner.

> You don't ignore section headings when reading laws.

You do when you are interpreting the laws. They're labels that carry as much weight as subsection markers. To say otherwise would imply that the "Patriot Act" by another name would be interpreted differently, or that bullet point "1" is more important that "2".

> nothing in that section discusses granting authority

Correct, it is a direction to those that already have such authority. While I enjoy the legal equivalent to the underhanded C contest as much as the next guy, the events that spawned this legislation make debating the finer points of section headings seem pretty silly.

You might recall that the NSA has a curious definition of "collect". They use "collect" where most of us would use "search the existing massive database that we already collected".

But collection is sweeping and worldwide (including domestic). We know that already.

Right. Bottom line: Securely encrypt end-to-end, if you want privacy. Or not. Either way, bet on stuff being retained.

Could Congress pass a law to reclassify domestic encrypted communications as domestic?

If it overrides Intelligence Authorization Act for Fiscal Year 2015: section 309.

See woodman's post: https://news.ycombinator.com/item?id=11586178

Regardless of how you feel about a polarizing issue, I don't think anybody on any side has ever claimed that. Pretty big thread derail risk with this one, too.

Wow, well let me ruin your day: you are wrong. Intelligence Authorization Act for Fiscal Year 2015: section 309.

"A covered communication shall not be retained in excess of 5 years, unless ... (iii) the communication is enciphered or reasonably believed to have a secret meaning;"

I'm actually not, and 'rayiner is doing a pretty good job of explaining why in the second place you cited that law (for some reason), so I will not repeat that thread derailment.

Yeah, discussing domestic surveillance legislation in a thread linked to an article covering the latest domestic surveillance legislation is way off topic.

A serious question here: has anyone reading this been arrested, prosecuted or otherwise harassed because of email contents obtained by the NSA? I am not in favor or warrantless searches, but it feels more and more like the tech community treats the NSA like Eastasia.

I certainly could be wrong, thus the question.

It's very hard to say, because of the use of parallel construction. We know very little about what the NSA does with its data; even members of Congress are being denied access to this information. But we do know for a fact that the DEA has prosecuted people based on information they received from the NSA.

https://en.wikipedia.org/wiki/Parallel_construction http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130...

Tech people should be concerned about this because we are the ones with the knowledge necessary to do something about it. Because there's no transparency, it's impossible to tell how many people have been harmed by the violation of their privacy. It may be that nobody here is in that group: hacker news readers are probably mostly white and upper-middle class, not usually a target demographic. But if we don't do something about invasions of privacy, no one will, because no one else is capable.

Downvoted? But no answer? Seems to prove my point that the knee-jerk hatred of the NSA ought to be backed by some real world facts.

You appear to be ignoring the fact that even if you consider the NSA's work benevolent, it is only benevolent to US citizens. Meanwhile lots of us on here are, in fact, not US citizens, especially at this time of day. So the NSA's activities are all negative, no positive to non-Americans.