NSA Spying and What You Can Do About It

Rocket Matter Webinar June 26, 2014
NSA Spying
(Some of) What we know so far
(Some of) the law
(Some of) What is EFF doing
(Some of) What you can do
Cindy Cohn, Legal
Director, EFF

Public Disclosure
•  In 2005, NYT revealed PSP, focus on
content collection
•  In 2006, USA Today revealed call-detail
records program
•  2006 Mark Klein reveals access to
fiberoptic cables (“upstream”)

New info via Snowden
(US collection)
•  Confirms call records collection (June 5, 2013)
•  Confirms fiberoptic collection (June 6, 2013)
•  “Prism” – company collection (June 6, 2013)
•  MUCH, MUCH MORE

Not Snowden: Hemisphere
(NYT Sept. 1 2013)
•  Domestic law enforcement
•  AT&T embeds into DEA
•  Records back to 1987
•  “Parallel Construction”

Phone Records Collection
•  “all call detail records or ‘telephony metadata’
created by Verizon for communications (i)
between the United States and abroad; or (ii)
wholly within the United States, including
local telephone calls.”
•  Originating and terminating phone nos., IMSI
#, IMEI #, trunk identifier, telephone calling
card numbers, and time and duration of call
•  Renewed every 90 days, kept 5 years

Section 215 of Patriot Act
•  Section 215 amended FISA to allow
orders to produce “tangible things”
•  Must be “relevant to an authorized
investigation (other than a threat
assessment)”
•  No broader than a Grand Jury
Subpoena

Gov’t Attempts to Explain
•  Need a big haystack to go back in time
and “connect the dots”
•  No identity
– NSA may have access to phone books
•  No location information
– “under this program” - Wyden
•  300 selectors + 3 hops
– ACLU says 2.4 million/govt 64,000 per
selector (now 2 hops)

Why Metadata Matters
•  You rang a phone sex service at 2:24 am and
spoke for 18 minutes..
•  You called the suicide prevention hotline from
the Golden Gate Bridge.
•  You spoke with an HIV testing service, then
your doctor, then your health insurance
company in the same hour.
•  Felten declaration in ACLU v. Clapper

Phone Records Cases
•  Klayman v. Obama (DC Circuit)
•  ACLU v. Clapper (2nd Circuit)
•  Smith v. Obama (9th Circuit)
•  EFF:
– First Unitarian Church of Los Angeles v.
NSA
– Jewel v. NSA (since 2008!)

Fiber-Optic Splitters
•  The “splitter cabinet” splits the light
signals in two, making two identical
copies of the data carried on the light
signal
– One copy goes to the NSA
•  Mark Klein & Room 641A

FISA Amendment Act
•  Section 702 was passed in 2008, and
the government relies on this for the
collection of content.
•  Targeting and Minimization docs
– Aimed foreign targets
– Encrypted information kept forever
– Can “Tip” the FBI on criminal (and maybe
IRS, DEA and others)

Fourth Amendment
•  Response to General Warrants/Writs of
Assistance
•  First question: is it a search or seizure
– Govt says no if metadata – Smith case
•  If Search then
– Probable cause (person or group)
– Particularity

"the child independence was then and there born,[for] every
man of an immense crowded audience appeared to me to
go away as I did, ready to take arms against writs of
assistance." - John Adams

First Amendment
•  Right of Association
–  NAACP v. Alabama
– Prop 8 case
•  If likely chilling effect
– Then must show “least restrictive means”
and “narrow tailoring”
•  Govt says doesn’t apply if not aimed at
associations

Turning upside down
•  Collect everything first and analyze
– Phone records
– Prism/Upstream
•  Sort out what you actually need second
– 215: RAS: reasonable articulable suspicion
– 702: 51% sure is foreign
•  As long as “target” is foreign, OK to analyze
data that includes Americans and innocent
foreigners

Word Games
•  Collect
•  DNI McConnell: “We may not know that
it is in the database until we have some
reason to go query that portion of the
database”
•  Data ≠ “Metadata
•  Conversations/Communications
•  Targeting
•  No. Not Wittingly

Sabotage – Bullrun 5 Sept 2013
•  “Insert vulnerabilities into commercial encryption systems, IT
systems, networks and endpoint communications devicees used
by targets”
•  "actively engages US and foreign IT industries to covertly
influence and/or overtly leverage their commercial products'
designs"
•  “Shape the worldwide commercial cryptography marketplace to
make it more tractable to advanced cryptoanalytic capabilities
being developed by NSA/CSS
•  "These design changes make the systems in question
exploitable through Sigint collection … with foreknowledge of
the modification. To the consumer and other adversaries,
however, the systems' security remains intact.”
•  “influence policies, standards and specifications for commercial
public key technologies”

What is EFF doing?
•  Litigation
– Jewel v. NSA (filed in 2008)
– First Unitarian v. NSA (filed last month)
– EFF v. DOJ (FOIA cases, 215 and FISC)
– Support for criminal cases

Legislation and Activism
•  Built multi-partisan coalition
– Delivered over half-million signatures to
Congress in October
– Interpret for public
•  Commenting on drafts
•  Feinstein/Rogers
•  USA Freedom

International
•  13 Principles (necessaryandproportionate.net)
– Around 300 organizations worldwide
– UN Special Rapporteurs
– Now picked up by Germany/Brazil
governments
•  Legal processes
– ECHR complaint
– OAS hearing

Technology
•  Still to be done: Ease of use
– End to end in phones, text message, the
web, email instant messaging, social
networking, disk drives, flash memory,
“data at rest”
•  Shore up crypto tools against sabotage

You
•  Pay attention, Activate, Share, Vote
– Activism is an open source project
•  Use the tools
•  Help with the technology projects
•  If you don’t want to live in a surveillance
state, stop building the tools of it

questions?
Cindy Cohn
Legal Director, EFF
Cindy@eff.org

NSA Spying and What You Can Do About It

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (17)

Semelhante a NSA Spying and What You Can Do About It

Semelhante a NSA Spying and What You Can Do About It (20)

Mais de Rocket Matter, LLC

Mais de Rocket Matter, LLC (20)

Último

Último (20)

NSA Spying and What You Can Do About It