News for hackers. Stuff that matters.

A comment on The Guardian walks back claims of direct NSA access to servers of tech companies. Parent comment

Re:The Guardian walks back claims of direct NSA access to se... by leoc on Thursday June 13, 2013 @10:36PM (#5877972)
Individualised FISC orders are required. http://www.govtrack.us/congress/bills/110/hr6304/text (Or more precisely, FISC review and approval of individualised FISA 702 orders are required - the court doesn't actually issue 702 orders.) That's almost the only protection non-resident aliens have under FISA and the jurisprudence that upholds FISA, but the protection is there. It could be undermined by issuing millions of FAA 702 orders or one FAA 702 order covering millions of people, but we have reasonable assurance that this hasn't happened (yet) https://news.ycombinator.com/item?id=5865717 .
[ Parent | on HN ]
Re:The Guardian walks back claims of direct NSA access to se... by VladRussian2 on Thursday June 13, 2013 @11:59PM (#5878193)
>Individualised FISC orders are required.

doesn't sound like it. 2nd slide:

http://www.aclu.org/files/pdfs/natsec/faafoia20101129/FAAFBI...

[ Parent | on HN ]
Re:The Guardian walks back claims of direct NSA access to se... by leoc on Friday June 14, 2013 @01:01AM (#5878375)
Yes, a FISA order, like a warrant, can identify more than one person. But again, in order to target (for example) every Facebook user, the 2000 FISA orders in 2012 would have to have covered an average of about 500,000 Facebook accounts each. That has probably not happened https://news.ycombinator.com/item?id=5865717 .
[ Parent | on HN ]
Re:The Guardian walks back claims of direct NSA access to se... by VladRussian2 on Friday June 14, 2013 @02:05AM (#5878500)
>the 2000 FISA orders in 2012 would have to have covered an average of about 500,000 Facebook accounts each.

500K pales in comparison with all the tens (or even hundred) of millions in this _one_ FISC order

http://www.guardian.co.uk/world/interactive/2013/jun/06/veri...

Again, for FAA 702 collection no individualized FISC required. 1 order for the whole Facebook, 1 order for whole Google, ... it seems that NSA does really need that server farm in Uta.

[ Parent | on HN ]
Re:The Guardian walks back claims of direct NSA access to se... by leoc on Friday June 14, 2013 @07:55AM (#5879366)
> 500K pales in comparison with all the tens (or even hundred) of millions in this _one_ FISC order

> http://www.guardian.co.uk/world/interactive/2013/jun/06/veri....

> Again, for FAA 702 collection no individualized FISC required.

That's not a FAA 702 order though. In fact it's in a different category to all the 70* orders, which fall under the "electronic survellance and/or physical searches" category in the https://www.fas.org/irp/agency/doj/fisa/2012rept.pdf annual report. The Verizon order would be a FAA 501 order, though people only ever seem to refer to it as a 50 USC ยง 1861 order. They're the "Applications for Access to Certain Business Records (Including the Production of Tangible Things)" on the annual report. These orders seem to be intended for things like the Verizon metadata, which it seems (IANAL) are considered to be unprotected by the probable-cause requirement even for USPERS. So I presume a 501 order couldn't be used to grab users' full private data from Google. In any case Google has denied that it has ever complied with http://www.wired.com/threatlevel/2013/06/google-uses-secure-... (or even been served http://googleblog.blogspot.ie/2013/06/what.html ) any order nearly as broad as the Verizon one, and Facebook and MS have more or less followed suit.

[ Parent | on HN ]
Re:The Guardian walks back claims of direct NSA access to se... by trevelyan on Friday June 14, 2013 @03:13AM (#5878684)
You think they're issuing individual FISA orders to track down whether foreign students are planning to work part-time while studying in the US?

http://www.dailydot.com/news/us-immigration-german-au-pair-f...

[ Parent | on HN ]
Re:The Guardian walks back claims of direct NSA access to se... by leoc on Friday June 14, 2013 @07:58AM (#5879379)
No, but then I also find it unlikely that they're actually giving away their Top Secret program by getting such data from Facebook through a secret order (whether it covers one person or many) and then handing it over for immigration desk staff to wave around.
[ Parent | on HN ]