>means that NSA grabs data directly from the "dropbox" set up and operated by the company.

the "direct collection" is a part of "FAA702 operations". The FAA702 is unrestricted collection of data of "non-USPER"sons, and in particular no individualized FISC orders required.

Now there is a choice - either Google combs their data, decides who is FAA 702 "eligible" and of interest to NSA and dumps the "non-USPER" data it has identified to the "dropbox" or the NSA does the combing/identifications itself (and if NSA does the combing - where it does it? on NSA servers attached to Google datacenters or does it transfer all data to NSA datacenter and combs it there?). What do you think NSA has chosen?

Individualised FISC orders are required. http://www.govtrack.us/congress/bills/110/hr6304/text (Or more precisely, FISC review and approval of individualised FISA 702 orders are required - the court doesn't actually issue 702 orders.) That's almost the only protection non-resident aliens have under FISA and the jurisprudence that upholds FISA, but the protection is there. It could be undermined by issuing millions of FAA 702 orders or one FAA 702 order covering millions of people, but we have reasonable assurance that this hasn't happened (yet) https://news.ycombinator.com/item?id=5865717 .

>Individualised FISC orders are required.

doesn't sound like it. 2nd slide:

http://www.aclu.org/files/pdfs/natsec/faafoia20101129/FAAFBI...

Yes, a FISA order, like a warrant, can identify more than one person. But again, in order to target (for example) every Facebook user, the 2000 FISA orders in 2012 would have to have covered an average of about 500,000 Facebook accounts each. That has probably not happened https://news.ycombinator.com/item?id=5865717 .

>the 2000 FISA orders in 2012 would have to have covered an average of about 500,000 Facebook accounts each.

500K pales in comparison with all the tens (or even hundred) of millions in this _one_ FISC order

http://www.guardian.co.uk/world/interactive/2013/jun/06/veri...

Again, for FAA 702 collection no individualized FISC required. 1 order for the whole Facebook, 1 order for whole Google, ... it seems that NSA does really need that server farm in Uta.

> 500K pales in comparison with all the tens (or even hundred) of millions in this _one_ FISC order

> http://www.guardian.co.uk/world/interactive/2013/jun/06/veri....

> Again, for FAA 702 collection no individualized FISC required.

That's not a FAA 702 order though. In fact it's in a different category to all the 70* orders, which fall under the "electronic survellance and/or physical searches" category in the https://www.fas.org/irp/agency/doj/fisa/2012rept.pdf annual report. The Verizon order would be a FAA 501 order, though people only ever seem to refer to it as a 50 USC § 1861 order. They're the "Applications for Access to Certain Business Records (Including the Production of Tangible Things)" on the annual report. These orders seem to be intended for things like the Verizon metadata, which it seems (IANAL) are considered to be unprotected by the probable-cause requirement even for USPERS. So I presume a 501 order couldn't be used to grab users' full private data from Google. In any case Google has denied that it has ever complied with http://www.wired.com/threatlevel/2013/06/google-uses-secure-... (or even been served http://googleblog.blogspot.ie/2013/06/what.html ) any order nearly as broad as the Verizon one, and Facebook and MS have more or less followed suit.

You think they're issuing individual FISA orders to track down whether foreign students are planning to work part-time while studying in the US?

http://www.dailydot.com/news/us-immigration-german-au-pair-f...

No, but then I also find it unlikely that they're actually giving away their Top Secret program by getting such data from Facebook through a secret order (whether it covers one person or many) and then handing it over for immigration desk staff to wave around.

I agree with you.

I think tptacek is using this non-issue to subtly discredit Glen Greenwald and Snowden.

Why is it a non-issue? One interpretation implies that the NSA is constantly accessing the data of anyone, anywhere. The other implies something incredibly smaller in scope and with a legal framework (which you may or may not like) behind it.

This seems to be the entire issue to me with PRISM - whether it's an unprecedented level of access or merely a statement of what has known to have been going on, and what was covered under FISA, for years, but just in a more technically expedient manner.

It is a non-issue because tptacek is inventing semantic distinctions (apparently irrelevant to whomever created the NSA document) to attack the credibility of multiple whistleblowers who allege widespread surveillance and abuse.

http://media.hotair.com/wp/wp-content/uploads/2013/06/prism-...

Especially given the fact that the leaked documents specifically encourage analysts to use a range of tools (i.e. "You should use both"), he has no technical grounds for suggesting that such a minor semantic debate (between NSA and Google) discredits the claims of multiple people with first-hand experience of the NSA who are coming forward with claims of its abuse of power.