The massive scale of the NSA's operations are hardly being disputed (logging of US-based backbones, underwater cables, foreign fiber, telephone records), what is up for debate is implementation details, specific wording, and the extent of protection for US citizens.[9] The "insanely massive data collection program" has been conducted for years.
PRISM is one of 504 currently active SIGADs, or intel gathering operations. "The Boundless Informant documents show the agency collecting almost 3 billion pieces of intelligence from US computer networks over a 30-day period ending in March 2013." 97 billion were collected in total over that time span.[1] The FAQ for this program clarifies that it applies to metadata. [8]
edit: that's 97 billion computer records. Metadata for 124 billion phone calls was also recorded over those 30 days.
The NSA does not define "collection" as actually obtaining the data or metadata, it is defined as a human analyst viewing the data.[2]
11 FISA court warrant requests have been rejected over it's existence, out of over 33,000 total. The last one rejected was in 2009.[3] Warrants are also only needed retroactively (within a 7 day period), there is no need to obtain one before accessing data.[4] According to the New York Times, "FISA orders can range from inquiries about specific people to a broad sweep for intelligence, like logs of certain search terms, lawyers who work with the orders said." [5]
The Fisa Amendment Act section 702 bars the NSA from collecting data on people "reasonably believed to be located outside the United States."[4] Additionally, data can be intentionally collected on any communication that has at least one foreign recipient or sender.[6] Note also that these warrants specifically contradict the fourth amendment, but as long as the target is "reasonably believed" to be a foreigner, it doesn't matter to the NSA.
The test of whether someone is located outside the US has been interpreted as a keyword-based system indicating that it is at least 51% likely. And if they aren't actually foreigners? It's nothing to worry about, just include it on a quarterly report.[7] It's also possible that a warrant for a foreigner would permit access to data on US citizens up to 2 social "hops" away, but [citation needed].
Additional reading: https://www.eff.org/deeplinks/2013/06/foreign-surveillance-h...
Written primarily for my own benefit, posted in the hope that someone else finds it informative.
p.s. This account is wholly controlled and accessed by a United States citizen.
[1] http://www.guardian.co.uk/world/2013/jun/08/nsa-boundless-in...
[2] https://www.eff.org/nsa-spying/wordgames#collect
[3] https://epic.org/privacy/wiretap/stats/fisa_stats.html
[4] FAA 702.g.1.B, page 6 at http://www.gpo.gov/fdsys/pkg/PLAW-110publ261/pdf/PLAW-110pub...
[5] http://www.nytimes.com/2013/06/08/technology/tech-companies-...
[6] FAA 702.b.4
[7] http://www.washingtonpost.com/investigations/us-intelligence...
[8] http://www.guardian.co.uk/world/interactive/2013/jun/08/boun...
[9] http://bigstory.ap.org/article/secret-prism-success-even-big...
I like that you seem to be making an honest assessment of the program but I really insist that you check this [1] out to see a few whistleblowers who have tried to bring attention to this, only to be rewarded with federal lawsuits. This has created a climate of fear where people ask "Is it really worth it? Or should I continue collecting my 6-digit paycheck and live in Hawaii?"
[1] http://www.usatoday.com/story/news/politics/2013/06/16/snowd...
It was only after stuxnet spread itself onto the wider internet that security researchers picked up on it and then thought "this is weird" when they looked at its behaviour.
How do you suggest a third party security researcher could learn about data transfer between Apple's servers and the NSA's servers? Short of hacking into the system or an Apple/NSA employee whistleblowing, there's no way they could.
Read 109(b)(2). You want option (B).
szc is saying that carriers should include lost business / damaged reputation, when reporting the costs of complying with the legislation.
Say it costs Verizon $10 million to build the infrastructure to let the government listen in. Verizon could claim that the revelation of this program will cost them $10 billion in future lost business. Since the Attorney General is unlikely to approve such an expense, Verizon would be declared compliant without actually having to turn anything over.
It's an interesting loophole in theory, but probably wouldn't actually work.
[0] https://en.wikisource.org/wiki/Communications_Assistance_for....
edit: the anchor tag isn't getting parsed correctly: http://bit.ly/14Gbifo
I was, but at this point he needs to offer actual evidence of his claims. He's effectively claiming there has been an insanely massive data collection program that has somehow gone unnoticed by tens of thousands of security professionals for several years. And while our security professionals may take awhile to find things like Stuxnet/Flame, they at least found vestiges of the programs much earlier, and neither is anything close to the insanely wide scale this would require.
I'm not saying this is impossible, but god damn is a lot of it sounding improbable as hell.