Hacker News new | past | comments | ask | show | jobs | submit login
19 Groups Sue NSA Over Data Collection (securityweek.com)
252 points by techinsidr on July 16, 2013 | hide | past | favorite | 35 comments



I think this has a strong chance of succeeding, eventually.

It does seem that PRISM is building a list of who people associate with - through email and phone communications, or various chat programs. Through this list of who you associate with, you can certainly start to label people and deny them rights based on their membership in various groups.

Back in the 1950s, the State Department was asking people to promise they weren't communists before granting them a passport so they can travel abroad. The amount of information they can get on people has grown exponentially since then - and that doesn't mean we have to be less careful with it.

First amendment - freedom of assembly - grounds is a brilliant way to argue this.


"Back in the 1950s, the State Department was asking people to promise they weren't communists before granting them a passport so they can travel abroad. The amount of information they can get on people has grown exponentially since then - and that doesn't mean we have to be less careful with it."

We do have a disadvantage this time. Prior to the internet era nearly anyone could easily understand exactly what was being done, as wiretapping was the most complex instrument used.

This time, one can attempt to abstract this as far as possible, and bury arguments with technical jargon. "Metadata isn't data", etc.


> "Metadata isn't data", etc.

The argument isn't that metadata isn't data. It's that metadata isn't "yours." It's AT&T's observations and records about your use of their system. That's not "technical jargon." It's a relevant distinction when discussing the scope of a privacy right: whose information is protected? If it's not just information generated by you, but also information relating to you, how closely does it have to relate? Etc.


Yep, agree. The courts have so far ruled that you have no "right to privacy" to data that isn't yours to begin with thus email headers and phone records can be collected by law enforcement en masse without a warrant.

But compare this with the Supreme Court ruling in 1958 blocking the Alabama government from obtaining the NAACP's membership lists as a condition to doing business in the state. The lists belong to the NAACP and not the individuals on those lists, but the Supreme Court still held that people had a right to "pursue their lawful private interests privately". [1]

"Immunity from state scrutiny of petitioner's membership lists is here so related to the right of petitioner's members to pursue their lawful private interests privately and to associate freely with others in doing so as to come within the protection of the Fourteenth Amendment"

[1] http://en.wikipedia.org/wiki/National_Association_for_the_Ad...


I've wondered why the businesses from which the government gets this data don't have a right to privacy. It seems like that since corporations were given the right to contribute money to political advertisements on the grounds that they are people then they should be extended the same privacy rights as well.


There is no "right to privacy" per se in the U.S. There is a right to be free of unreasonable searches and seizures (4th amendment), there is a right to refuse to testify against yourself at trial (5th amendment), etc. These protect certain aspects of a right to privacy, but if you read writings from the founding generation, they didn't have the kind of well-developed "right to privacy" concept many people have today.

As a result, these protections exist next to mechanisms that cut in the other direction. One of those mechanisms is the almost unlimited power of common law courts to compel people to furnish information, through subpoenas and warrants. And that power is especially strong when the information is about someone else. So for example, while a court cannot force you to testify against yourself (5th amendment), they can force you to testify against someone else. They can force you to furnish information or copies of documents relevant to an investigation or ongoing litigation. Indeed, in a civil litigation, often one of the lawyers will be able to issue subpoenas forcing parties to turn over documents in the name of the court. In the Anglo-American system, there is really no "right of privacy" as against the right of a court to gather all the evidence necessary in a civil or criminal litigation.

So corporations do have 4th amendment rights. The NSA doesn't come to their offices and take the information. But that doesn't protect them against court orders to furnish information about other people.


Citizens United did not say that corporations are people. If you are starting from that misunderstanding then lots of things won't make sense. Corporate personhood is not mentioned in the decision.

A year after Citizens the court ruled unanimously in FCC v ATT that corporations fail to meet the "personal" part of "personal privacy." That decision is fun to read if only for the last paragraph.


Hey, that's great that you understand this to the extent of articulating why metadata gathering is a problem - but I assure you that the "metadata isn't data" rhetoric GP mentions is, in fact, the tactic I see most often in the wild.

So calling it "technical jargon" is pretty accurate - people encounter this confusing word "metadata" and have no idea what it means or how to reason about it.


Even if that's so, there is still the issue of "expectation of privacy". If the customer buys AT&T's service and expects a certain degree of privacy (meaning no one can just try and locate where he is with that data, or with who he is talking to, etc), then I think he deserves that kind of privacy.

Ultimately, the citizens can demand laws that state that fact explicitly. There are countries where collection of metadata by authorities in this way is illegal - and not because they didn't try to collect it. They did. It's just that "the people" won the argument, and now they aren't allowed to use the metadata (or at least not in this sweeping way).


An interesting example of how through correlation and context, metadata can reveal more than you'd think....

http://www.securityweek.com/how-metadata-reveals-more-about-...


HIPAA (privacy portion) covers more than just your data, so I could see the same thing here. What if "your" medical data was private, but all the metadata about where you are treated could be recorded.


Can you imagine if they decided HIPAA didn't consider "metadata" private? Sure, the doctor's notes are private, but the list of every procedure you've had and every drug you've taken doesn't count.


Except that in what way is PRISM preventing you from being able to assemble ?

There is NO evidence that the NSA et al are using this information to target anything other than the most serious of terrorists. Until we evidence of the contrary I fail to see how these lawsuits will be able to stick.


The 1958 Supreme Court ruling struck down a law that required groups to provide their membership lists to the State of Alabama. They don't have to "prevent" people from being able to assemble, but building lists of which groups people belongs to still violates their "right to pursue their private interests privately". So in large part, the right to assemble also includes the right to be part of any group (even communists!) without the government needing to know.


But again what evidence is there that the NSA is creating these list of groups ? They could just be simply looking at which individuals a person is speaking to. It is a subtle distinction but legally a significant one.

I just seem to see a lot of conjecture but no actual evidence.


I think especially in light of recent events, it'd be foolish to give them the benefit of the doubt.

You don't see evidence because these programs are hidden from the populous. Maybe you're right - we don't know.


The no fly lists? They are generated somehow, and if there isn't transparency we have a right to be suspicious.


It might be legally significant, but technically, there is no real difference.

Given your social network, and training data consisting of the public members of a group you can use a semi-supervised learning algorithm to determine group membership. Since social networks have a small diameter and the public members are typically well connected, you would expect this approach to be fairly accurate. Or rather, accurate enough to act on, if you do not need to provide legal justification for your decision.

What's the required legal justification for putting someone on a no-fly list?

If you want to give some real world basis to the legal distinction you need oversight and transparency. In particular, global analysis of the whole dataset must be illegal, since it pretty much corresponds to total surveillance. Your results might not be completely accurate, but they don't need to be if you can act once you have something like 51% confidence.


It is a subtle distinction but legally a significant one.

Not subtle. No distinction.

I just seem to see a lot of conjecture but no actual evidence.

All data about every one. Including everyone's social network.

Hard to be more clear than that.


You are absolutely correct.

There are a number of possible interpretations as to what thety are doing and some interpretation of what we have seen and read regarding the NSA data collection probably exists that would probably make most of us pretty happy.

The problems are: (a) we dont know what they are actually doing and (b) we cannot trust them not to lie to us about what they are doing, one way or another.

The other problem is that the NSA has made it clear that in its opinion collecting metadata on a call is fine at any time, for anyone/everyone.

Metadata on a cell phone clearly includes time and location of cellphone/receiver checkins.

It is absolutely reasonable to assume that, if they want, the NSA can track the location of any person carrying a cellphone; or - given that they are storing this data - reach into the past and know exactly where you were, and when.

that is a remarkable power, IMO.

Hook that data up to a computer display and holy cow, that is a powerful tool.

Frankly, it would be awesome. if it wasn't for the fact that you, specifically and personally, appear on that display.


One way for them to stick is if "collect it all" surveillance is judged to violate the Fourth Amendment regardless of whom the agencies are currently targeting.


The Main Core database is reported to contain a list of 8 million people. You probably want to avoid associating with them.


While I disagree with this position from a policy stance, it may have legal weight. Courts are loathe to rule on things based on hypothetical future harm.


Metadata collation as impinging on freedom of association. Brilliant! Of course these concepts are very US-centric so we need to package these ideas up and sell them globally, adapt them to local markets if you will.

What we need to build is a website based off of Google Maps which allows us to drill down and wiki style tabulate the social and tech systems that individual nations are pursuing at the expense of citizen's privacy. The key players and enablers of these programs need to be highlighted. Questions need to be asked of our politicians globally exactly when they were thinking of consulting us about this growing global dragnet, this Leviathan as some have called it, Panopticon as others have called it.


In simple terms, what do the people in the lawsuit hope to gain from the lawsuit? If they won, would the NSA have to stop the program, or would the government have to pass laws saying it was allowed?

I'm just trying to figure out what the end-game is and/or if there is any way to stop something as powerful and uncontrollable as the NSA (government in general?) appears to be.


The end-goal is to get the government to stop.

The government is not uncontrollable. Litigation has stopped many government practices, historically. For example, originally the Bush administration tried to hold Yaser Hamdi (a U.S. citizen who had left the U.S. as a child and had been captured in 2001 in Afghanistan) as an enemy combatant. The Bush administration tried to claim that enemy combatants did not have habeas corpus rights. The Supreme Court disagreed. Hamdi was released and deported to Saudi Arabia on condition of renouncing his U.S. citizenship. Since then, dozens of detainees have won their habeas petitions and been released: http://www.andyworthington.co.uk/guantanamo-habeas-results-t....


The goal would be to get a permanent injunction barring the activity until such time as laws were passed making it legal. In the US system of laws its the way folks force someone to stop doing something when that someone is more than an individual (you can't put a corporation in jail but you can tell them that if they do something you will put their leadership in jail [an imperfect analogy])


"you can't put a corporation in jail but you can tell them that if they do something you will put their leadership in jail [an imperfect analogy])"

Does leadership, from a corporation either private or government (NSA, CIA, FTC, etc) ever end up going to jail though? It seems like after the banking industry was pretty much caught red-handed breaking all kinds of laws and/or causing all kinds of programs to end or start, none of them ended up behind bars. I have to think the NSA would be better at avoiding jailtime than bankers...

Maybe I'm just pessimistic but it seems more like the best this could hope for is the NSA stopping Prism and then finding out 5-10 years later (or never) that they started Diamond or some other program that does the same thing except doesn't record the first 5 seconds of phone calls, or something else that "obeys the new rules"...


> Does leadership, from a corporation either private or government (NSA, CIA, FTC, etc) ever end up going to jail though?

Yes. E.g., http://en.wikipedia.org/wiki/Jeffrey_Skilling


If the suit succeeds, wouldn't ratifying the Constitution be the only way to actually make it 'legal'? A law the infringes on the rights of the people without due process cannot be remedied by any other number of laws except where those laws reduce the scope to those wherein more narrow warrants are granted (I think).


And if such laws do get passed, the people who wrote and supported them would be open to voter backlash, which is why they were done using secretive "guidelines."


It's smart of them to include a variety of groups across the political spectrum, both left and right. It's interesting how this issue is positioned and who supports the fight.


I don't think smart has anything to do with it. I believe that this issue transcends normally antagonistic parties. This is something most of us can agree on. Left/right/liberal/conservative/anarchist/socialist/capitalist/whatever - we all expect a certain base level of privacy w.r.t. our private communication, both contents and metadata.


Hooray.


I really don't mind these data collections if it indeed can thwart terror attacks & can provides an adavtange over China/Russia/Iran, BUT I wish I had access to the data- like being able to see your own FBI file

Imagine, the NSA for "free" (kinda) has created "Dropbox++"- all your online content indexed & backed up




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: