What your government is up to...

[jeffxandra]

kyriotate wrote earlier this week on his frustration with the recent NSA telephone information datamining revelations. I've got some thoughts on that which I'm putting behind the cut.


A phone company, as with any other organization, has the right to release or sell the non-personal information of its customers. By personal information, I mean: information that individually identifies the customer outside of the data set. A customer number assigned by the company (assuming it's not a SSN) is considered non-personal because it can't be matched to outside sources to identify that person. The other information is presumed to have been voluntarily offered to the company.

For an example

Customer #12: bought the DVD Young Sluts in Lust

That would theoretically be okay

Customer (SSN): bought the DVD Young Sluts in Lust

That's not okay.

In isolation, a data set of connecting phone numbers and the time information associated with that would not generally be considered useful information without having something to look for in the first place. It would be too massive a database to examine every connection and look for the useful data. So why would the government do it if they didn't have a means to use it?

In this case, it's clear that the NSA has to have a key they're already looking for. Namely the phone numbers of, ooh... can't use "suspects" any more, Persons of Interest. Using that information, they're finding out who the PoIs are talking to. Then the NSA is using that information to find out who those people are talking to (and so on and so forth).

Now to actually listen to the conversations, the government would have to get a warrant to tap those persons' phones using the FISA court. Doing the datamine is an attempt to sidestep that issue. The government is arguing that a phone number is non-personal information.

And they should not be able to argue that because they are using phone numbers as personal information.

The government knows that the PoI's phone number is 555-555-5555 and thinks any time that number is used, it is the PoI using it and therefore all calls made from that number are of interest to them. And the people at the end of those numbers are now also of interest.


It's really quite simple. As usual, the administration is saying whatever it wants you to believe, while doing something quite different.

Comments

[jeffxandra.livejournal.com]

It comes down to whether the phone records are considered anonymous information or not. If they are, then the phone companies can turn them over without a warrant. More can be heard on this NPR Morning Edition story (http://www.npr.org/templates/story/story.php?storyId=5414285) I heard today. The link is to a web page. There's a listen option there.

I argue that since the only way the NSA could use those records is with them not being anonymous that it's impossible for the information to be anonymous.

It doesn't need a separate database anyway (unless you just mean a separate source of data)

The NSA searches the database for Phone Number 1 which they've identified from their investigations. Phone Number 1 called Phone Number 2. So they go use a web search engine to look up Phone Number 2 and find out who owns it.

[jeffxandra.livejournal.com]

But even with that theory, doing a timing comparison between events, what value would be gained without their being an application of a secondary database.

Okay so calls to Iran, let's say, increase after the Terror Level changes

What, in and of itself, does that indicate, other than people in Iran don't watch CNN/Fox News/BBC News etc, without applying the additional database?

[jeffxandra.livejournal.com]

Here's the problem with that thought.

If they have a FISA warrant on someone then they could obtain the phone records for that person. That part is simple. The problem for the NSA is that they can't go and check the phone records of any person their initial suspect called without going back to the court to get another warrant for the new person.

Doing this datamining is an attempt to sidestep that.

[jeffxandra.livejournal.com]

Aren't you using a separate outside database once you connect point 47X to point Y?