Here's How the NSA Decides Who It Can Spy On
—By Kevin Drum
The NSA isn't allowed to spy on Americans, but the nature of modern communication doesn't always make it obvious whether a phone call or email is foreign or domestic. This means that in the course of its normal business of spying on foreigners, NSA will inevitably collect information it shouldn't have. Certain rules, called "minimization procedures," define what NSA is required to do when it discovers that it has inadvertently captured a U.S. person in its surveillance dragnet.
Today, in the latest release of classified NSA documents from Glenn Greenwald, we finally got a look at these minimization procedures. Here's the nickel summary:
The top secret documents published today detail the circumstances in which data collected on US persons under the foreign intelligence authority must be destroyed, extensive steps analysts must take to try to check targets are outside the US, and reveals how US call records are used to help remove US citizens and residents from data collection.
I have a feeling it must have killed Glenn to write that paragraph. But on paper, anyway, the minimization procedures really are pretty strict. If NSA discovers that it's mistakenly collected domestic content, it's required to cease the surveillance immediately and destroy the information it's already collected. However, there are exceptions. They can:
Retain and make use of "inadvertently acquired" domestic communications if they contain usable intelligence, information on criminal activity, threat of harm to people or property, are encrypted, or are believed to contain any information relevant to cybersecurity.
The Guardian has posted two classified documents online. The first one describes the procedure for determining whether a surveillance target is legitimate (i.e., a non-U.S. person located outside the country). The second one describes the minimization procedures in case of inadvertent targeting of a U.S. person. There are a few obvious things to say about them:
- The determination document repeatedly emphasizes that NSA bases its decisions on the "totality of the circumstances." There are quite a few safeguards listed to make sure that only foreigners are targeted, but in the end these are often judgment calls from analysts.
- The minimization procedures are fairly strict, but they do allow retention and dissemination of domestic data—without a warrant—under quite a few circumstances. "Threat of harm" is pretty broad, as is "criminal activity." The latter, in fact, seems like a loophole the size of a Mack truck. It suggests that NSA could have a significant incentive to "inadvertently" hoover up as much domestic information as possible so it can search for evidence of criminal activity to hand over to the FBI.
- The oversight procedures are pretty thin. Analysts have quite a bit of discretion here.
http://www.motherjones.com/kevin-drum/2013/06/heres-how-nsa-decides-who-it-can-spy
WaPo: New documents reveal parameters of NSA’s secret surveillance programs
http://www.democraticunderground.com/10023058091
NYT: Documents Detail N.S.A. Surveillance Rules
http://www.democraticunderground.com/10023058210
= new reply since forum marked as read
CALEA - an act passed by Congress in 1994 to help define wiretapping requirements mandated by the FCC
Here's a post I did a while back trying to explain how it actually works (when a carrier receives a warrant for surveillance of a target)
-----------------------------------------------------------------
Today our new term to learn is "Safe Harbor"
Most all companies outsource the connectivity to LEA (law enforcement agencies) to a trusted third party. Usually an MPLS VPN is established using a couple 10M or 100M circuits to the company you contract with, the trusted third party.
You can either let them directly handle the warrants and implement the tap by giving them access to your switches, OR, you have your own personnel with the proper clearance to implement the "tap" and direct the traffic over that MPLS VPN back to the trusted third party, who then send the traffic to various LEA. These companies already have the data connectivity back to places like Quantico. Google Quantico if you haven't heard that term before.
Here are two companies who do this for a living-
West Central Support
http://www.wcsupport.com/calea.php
West Central Support Offers a Complete CALEA Solutions Package
West Central support provides Procera Networks PacketLogic platform, a cost effective, complete, and scalable solution that seamlessly integrates into the service provider's existing network, without the need to upgrade any network element in the network infrastructure fabric. Procera's unique value proposition is that in addition to being able to handle the Interception and Delivery of content as sanctioned by the FCC CALEA regulations, the solution also delivers the most accurate, policy-based traffic management capabilities for Broadband Service Providers (BSPs).
In addition to providing Procera Networks' PacketLogic platform as a viable CALEA solution, West Central Support provides Trusted Third Party (TTP) CALEA services. We will analyze your network to identify the optimal location for the Packet Logic platform and assist in the set up, installation, and testing of the equipment. As the TTP, West Central Support will receive the intercept request from the ISP and appropriately configure the rules in PacketLogic to meet the specifics of the intercept request as well as facilitate information delivery to the LEA and handle the appropriate paperwork and filings.
http://www.subsentio.com/
SUBSENTIO — THE MARKET LEADER IN ELECTRONIC SURVEILLANCE SERVICES
At Subsentio, Safe Harbor is not just a provision within the Communications Assistance for Law Enforcement Act of 1994 (CALEA), it is our business philosophy. Our mission is to provide a safe environment for service providers, their subscribers and law enforcement should a need for electronic surveillance arise. This level of trust to provide a Safe Harbor in an industry that is turbulent at best can only be delivered by personnel with decades of experience — expertise that is unmatched within this small, but vitally important, niche of telecommunications. For Subsentio, providing Safe Harbor is not a job, it is our passion.
Based in Centennial, Colorado, Subsentio’s surveillance technology connects telecommunication service providers with Federal, State and Local Law Enforcement monitoring centers to comply with lawfully authorized electronic surveillance (LAES) court orders. From national carriers to ultra-small rural providers, Subsentio is responsible for millions of subscribers with a wide range of communication services. These services are often complex, multi-vendor environments encompassing differing phases of technological approaches that require our expertise to properly perform a lawful intercept.
that the NSA's core mission is Signal Intelligence ('SigInt') and simple logic suggests that it would hardly need to contract with outside third parties to gain access to a given telco's switch and its residual software (provided the telco cooperated or complied with a National Security Letter).
Which brings me back to my original point: the fact that the NSA can do something, i.e., has the technical capability to do something, does not mean that the NSA is doing something.
BTW, I worked in telecom in tech support for about 2.5 years but it was a few years back and I've forgotten a lot. So please excuse me for any lapses in memory 
And I think it would be apparent to most lawyers. But the People did not get to read the fine print. They got no legal advice. Because even Congress did not know how bad it is, there wasn't adequate oversight. Railroaded through via the Senate "Intelligence" Committee = 
It was Decided--as though we are children needing big daddy (or big brother) to protect us. Arrogance and over-reach doesn't begin to account for the breach of the public trust here. The reality is worse. We should all feel insulted--those of us who are not complicit.
