NSA: we can warrantlessly grab your data and keep it forever if encrypted

https://www.techdirt.com/articles/20130620/15390323549/nsa-has-convinced-fisa-court-that-if-your-data-is-encrypted-you-might-be-terrorist-so-itll-hang-onto-your-data.shtml

by obstacle1 • 13 years ago

164 96 13 years ago

techdirt.com

doki_pen• 13 years ago

This is like getting a warrant to search your house because your blinds are drawn.

grecy• 13 years ago

Warrant? pfft, they just force their way in when they really want to http://www.storyleak.com/video-shows-home-searches-by-boston...

LoganCale2• 13 years ago

Absolutely sickening.

aspensmonster5• 13 years ago

And your door is LOCKED. WHAT ARE YOU HIDING?

alan_cx7• 13 years ago

Lost the key.... Sir?

OK, then we will take you house away and you cant have it back until you produce the key.

rayiner7• 13 years ago

No, it's like targeting your house for frequent drive-bys because your blinds are drawn.

You're presupposing that capturing data you have flowing over the internet is something that requires a warrant, and the NSA's position is predicated on the idea that it generally does not.

betterunix• 13 years ago

When I encrypt, I have a reasonable expectation of privacy. Period. Stop trying to violate that privacy, unless you are accusing me a specific crime and you have probable cause.

jessriedel• 13 years ago

I could be wrong, but I don't think any of the recent PRISM brouhaha hinges on whether you have a reasonable expectation of privacy. Everyone agrees that you do. Telephone calls (made in non-public places) explicitly enjoy this expectation. http://itlaw.wikia.com/wiki/Reasonable_expectation_of_privac...

Rather, the recent issue is a disagreement over what constitutes a violation of privacy, e.g. whether electronic collection of data (without a human listener) constitutes violation.

genwin• 13 years ago

It would also be an obvious privacy violation for the NSA to install cameras in our bedrooms, even if they promised to never watch the video without a warrant.

joe_the_user• 13 years ago

"the recent issue is a disagreement over..."

Wait, there are no "issues", there is no "disagreement", not in any conventional fashion.

From the state, we have seen nothing but the boiler-plate propaganda that comes out when any large bureaucracy faces an embarrassment.

They sort-of say it's OK to invade the privacy of (any vaguely accused) terrorists, they sort-of say they can look at anything and it's not an invasion of privacy and they sort-of say they can collect anything and as long they don't look its not an invasion of privacy. But none of it matters, it's not a "debate", there are no "disagreements" in the sense of a dialogue.

These are just press releases arguments are clearly wrong to everyone but morons, and they are naturally aimed for the mass of the morons out there (or the mass of ignorant and prefer-to-be-ignorant if you want).

grey-area• 13 years ago

Rather, the recent issue is a disagreement over what constitutes a violation of privacy, e.g. whether electronic collection of data (without a human listener) constitutes violation.

If you think accessing private communications should not be allowed except in limited circumstances, you should be very worried by the storing of all this information. The implications are that anyone's privacy can be violated simply because of a policy change by those agencies who store and swap this information across national borders at some unspecified point in the future. In addition to future use by your national agency - your data might be collected in one country, and used in 10 others without control. The only way to stop future abuse is not to collect the data.

The intelligence agencies have arrogated to themselves the right to listen to any communication by using lawyerly arguments like yours over the difference between collection and listening, and denying that they are using all this information they are collecting without proper legal authority (of course for the NSA, that legal authority turns out to be a six-monthly rubber stamp on their procedures, not oversight of their actual work, but oversight of what they say they do).

So I think your distinction between storing and accessing is unimportant and not worth arguing about - storage enables later access, so once it has all been stored, you have no control over the way it will be used (and it will be used).

rayiner7• 13 years ago

So "reasonable expectation of privacy" is an objective standard. The question isn't, do you, (betterunix personally), expect information to be private, but do people in general reasonably expect information information they throw out onto the intertubes to be private (in other words, you can't create zones of privacy by having a subjective expectation of privacy).

I don't think that's the kind of clear-cut argument you'd like it to be. To me, for example, if I'm letting AT&T or Verizon see the encrypted bits (as well as any intermediate carriers and backbone operators), I don't really have a privacy expectation on the encrypted bits themselves. I might be persuaded that I have a privacy expectation on the decrypted bits, however.

smokeyj4• 13 years ago

if I'm letting AT&T or Verizon see the encrypted bits (as well as any intermediate carriers and backbone operators), I don't really have a privacy expectation

Why? Because ISPs handle your data, they get to spy on you? If you asked UPS to ship a memory card full of photos, does that give them permission to copy it and use it how they wish?

alexqgb2• 13 years ago

Um, no.

A world in which there was truly no privacy is one in which anyone on the planet could log into your bank account, and get an itemized list of every transaction you've run through it. Obviously, that's not the case. Just as obviously, your medical records are not a matter of public record. Nor are your job performance reviews, your tax returns, or the contents of your medicine cabinet.

Indeed, there's a TON of material that people both expect to be private and which, in the normal course of life, IS private. Moreover, the "reasonable expectation of privacy" standard is not based simply on what's technically possible to conceal, but on the boundaries that are socially necessary to maintain a free and open democracy.

And I'm sorry, but this is a VERY clear cut argument. The lines are as straight and as bright and as shining as they've ever been. For the government to search records that a citizen has made a legal effort to shield from public view, it must have specific and articulable cause to suspect that citizen of a specific crime. Whether my correspondence is printed on paper or stored in my smartphone has exactly zero bearing on the fundamental law governing the government itself. None, zero, nada, zip.

Apologies for the caps used as emphasis. I try not to use them unless the comment in question is not just stupid and wrong, but dangerously stupid and wrong. And this comment is about as stupidly dangerous and wrong as asserting "if you've got nothing to hide, you've got nothing to fear."

alan_cx7• 13 years ago

Now, encryption is probable cause...

seclorum• 13 years ago

The argument goes: you are using public networks over which you have zero control, so there is no expectation whatsoever of any privacy, at all.

nodata4• 13 years ago

And it only takes one vulnerability once for them to get your passphrase. Sleep well!

aspensmonster5• 13 years ago

Rotate your passwords. Regularly.

nodata4• 13 years ago

That won't help at all. One vulnerability once and it's game over.

gfodor3• 13 years ago

Easier said than done.

justanother• 13 years ago

How generous of the NSA to admit to a DDOS attack surface. You may all commence emailing each other PGP-encrypted copies of the complete Star Trek: TNG (Blu-Ray, natch), now.

cleaver• 13 years ago

That was my thought.

dd if=/dev/urandom of=secret.txt bs=1m count=200

^^^ this should do the trick!

IanChiles• 13 years ago

An unbreakable code! Or we can send around 'encrypted' messages that are completely devoid of meaning, but incredibly suspicious...

phogster• 13 years ago

Guilty until proven innocent. Sounds reasonable.

alan_cx7• 13 years ago

Well, what have you got to hide........?

finkin1• 13 years ago

Have you seriously missed the dozens of articles on HN recently explaining why privacy is important even if you have nothing to hide? Or are you just trolling?

gasull• 13 years ago

If I lose all my data due to a hard drive crash, can I submit a FOIA request to obtain a backup? :-)

alan_cx7• 13 years ago

In theory, why not?

sigmar• 13 years ago

did you transmit your entire hard drive contents over the internet at some point?

iamjustin• 13 years ago

You could image the PC, then upload an encrypted copy to Google Drive, so that the NSA can keep the copy forever for you.

jlgreco3• 13 years ago

You can request a FOIA request for the brainscans of the alien found inside of FDR's skull. Of course you won't get anything back, but that is another matter...

microb• 13 years ago

All encryption is temporary encryption. "In other words, if your messages are encrypted, the NSA is keeping them until they can decrypt them."

toddsiegel• 13 years ago

That was exactly my first thought. They can hold until they have the computing power to crack it.

lazyjones2• 13 years ago

So, tell me - did Google start encrypting so many services just to give the NSA a better excuse for siphoning all data, including SSL encrypted communication, E-Mails etc.?

zhemao• 13 years ago

Google stores an unencrypted copy on their servers, so the NSA would just get it from them. No need to store the encrypted copy for perpetuity.

lazyjones2• 13 years ago

Yes, but since the user encrypted it, he's suspicious and more likely to be snooped on, right? So by enforcing encryption, Google helped get the NSA an excuse to grab data (even the unencrypted copy) in more cases.

fudged71• 13 years ago

"Forever", meaning until they have the Quantum Computing technology to decrypt such 'suspicious' files.

ferdo• 13 years ago

Guvf vf trggvat evqvphybhf.

DoubleCluster• 13 years ago

If your data isn't safe when someone has access to it "forever" then you haven't encrypted it good enough. I'd still prefer them not to keep it though.

obstacle12• 13 years ago

I think a big problem there is that "encrypted good enough" today might be "completely breakable" in 20, 40, or X number of years.

donniezazen• 13 years ago

As a user of an online backup solution that encrypts everything client side, I am reluctant to use it anymore. Would knowing that encryption makes you more vulnerable for illegal online search and seizure change your online behavior?

exit• 13 years ago

we should all dedicate a percentage of our bandwidth to spewing random numbers at random listeners

providing endless cover to actual chatter

a crypto tithing

darkarmani• 13 years ago

You mean create additional gmail accounts and fill them up with encrypted "messages." How many gigs are free these days, 10GB?

sneak5• 13 years ago

I think it's still less than one utah datacenter divided by a billion or so.

Fice• 13 years ago

And even if they say they will not keep your data if not encrypted, how can you know for sure?

ke7in• 13 years ago

I'm curious to what options we have as citizens, short of organizing militias, can really do here. I think the government play is just "wait til this blows over" and they might get away with that.

LoganCale2• 13 years ago

Call—actually call your members of Congress. It's a lot more effective than sending an email. Urge others to call too. If they get enough calls to understand a large number of people are actively angry about this, they might actually do something.

http://callday.org

Also encrypt everything possible, and encourage others to do that too. It might attract more attention to you, but it's also a strong assertion of your right to privacy. Everyone should use encryption for even the most mundane of things. The government says we have no right to privacy for emails older then 180 days because we are sharing them via someone else's server. If we encrypt them, that argument is invalid, because we are making it clear that only the recipients are intended to read it and it is private from everyone else.

aclevernickname• 13 years ago

"short of organizing militias".

that's why I left your country. whole bunch of Short-of's.

admig• 13 years ago

i don't believe this joke. ;)

cabalamat3• 13 years ago

If the NSA is saying that all encrypted communication is automatically suspicious, then everyone should use encryption for all data they send over the internet.

Starting today, I am writing email encryption software that, when you send an email to someone else with the software installed, will automatically encrypt it on the way out, and automatically decrypt any encrypted messages on the way in. (A "zero user interface" once installed).

The intention is that this will allow people to encrypt their messages with zero effort on their part.

Initially it will encrypt email and will run on unixlike machines (Linux and Mac). Later it will run on all major platforms (Windows, iOS, Android) and have functionality for VoIP and social networking (the intention is to replace Skype and Facebook with secure alternatives).

pwnna• 13 years ago

This should be open source software as there needs to be security reviews and what not.

Also, checkout OWS: https://whispersystems.org/

cabalamat3• 13 years ago

This should be open source software as there needs to be security reviews and what not.

It will be open source.

gfodor3• 13 years ago

If you really want this to work you should target the webmail use case for the big three webmail providers. Nobody wants to use a standalone client on a PC, if that's what you are suggesting. Next up is a mobile client for Android and iOS that works identically to the existing mail client on those platform so there is no learning curve.

In other words, this will be a long slog where most of the work is product-oriented and feature Xerox'ing, and not whiz-bang cool encryption oriented. Good luck :)

chacham15• 13 years ago

Im unsure of what you are describing. Are you stating that hotmail should be able to display your decrypted emails? That would imply that they themselves would be able to read it and therefore remove any benefit. Any website you would build would have the same problem unless you resort to js crypto in which the js can be changed on you in a second (when the government forces your company to do so) and send the private key to the nsa. How exactly are you envisioning a solution?

__--__• 13 years ago

Nobody wants to use a standalone client on a PC, if that's what you are suggesting.

I do. Am I the only one who finds web-based email clients insufferably slow?

cabalamat3• 13 years ago

Nobody wants to use a standalone client on a PC

What if your standalone client is a website running on your local box with an interface similar to gmail?

In other words, this will be a long slog where most of the work is product-oriented and feature Xerox'ing, and not whiz-bang cool encryption oriented.

Yes, you're right. The crypto itself isn't that complicated.

codex• 13 years ago

No, that's not what the NSA is saying. The regulations only apply to material inadvertently collected while targeting a specific foreign target (who, presumably, might be routing their traffic through the U.S. to evade surveillance). If the information is encrypted, the NSA doesn't know if it's real domestic communications, or foreign communications, until it can be decrypted, so it's kept until it can be decrypted. Otherwise, a foreign target would easily be able to evade intercept simply by making their traffic appear to be domestic.

MereInterest• 13 years ago

And all of their arguments start from the wrong side. It should not be "We stop listening as soon as we know that it is a US citizen." Instead, it should be "We only start listening once we know that it is not a US citizen."

And that is ignoring the whole aspect of it that they shouldn't be doing blanket surveillance to begin with, and should only be doing targeted surveillance, whether or not it is against a US citizen.

sneak5• 13 years ago

Users can't and won't securely store key material, even their own.

Servers that store key material are subject to wiretaps.

We're not lacking secure alternatives because this isn't a technical problem.

johnchristopher• 13 years ago

Users can't and won't securely store key material, even their own.

I believe it is an interface problem. I am surprised Mozilla isn't re-activating Thunderbird with an easier to use encryption procedure and an educational campaign to raise awareness in users instead of making petitions around Firefox.

Raz0rblade• 13 years ago

Well one thing they hate probaply is blowfish encryption. Dont use triple DES, as they where involved in it forcing it as a standard.

NSA: we can warrantlessly grab your data and keep it forever if encrypted

Related Stories