The NSA: An Inside View

> As with any government agency, the more they insist that they must not be held accountable, the more accountability we should jam down their collective throats.

Did you read the same essay I did? He didn't argue for less accountability (indeed, he argued for more). He did argue that the capability had to remain in order for the U.S. to maintain its ability to survive in the ongoing shadow cyber battles.

I agree with you that the high-level concerns are the real key, but you seem to working at it in the opposite direction. You have a specific end in mind, seemingly independent of any high-level examination of the effects of achieving that end. Then you say that the high-level things (law, trust, comparisons, etc.) should be arranged to meet the specific end.

Rather I'd argue it from the other direction, just as I have from day 1 of all of this: Does a country need to have the ability to monitor the goings-on of electronic communications (including the Internet) for its welfare & national security purposes? If so, what capabilities are needed? Is "pre-emptive self defense" needed (or even allowed)?

Do the totality of these capabilities introduce a risk towards civil liberties, or otherwise conflict with law? If so, can they be mitigated, must the law be changed, or should the state simply abdicate its security/welfare reponsibility (noting that it would be only the US doing the "abdicating" here)? Can the state employ other capabilities that can achieve the same essential effect with less risk on civil liberties?

Some of these questions you touch on, e.g. "you haven't proven that you are doing more or better compared to other ways we could push back against scary people.", but many are ignored completely as it is simply assumed that absolute privacy on the Internet is sacred (but only for the NSA; criminal organizations, other nation's intelligence agencies, and the local cypherpunk wardriving around are obviously not a threat), even while absolute privacy on the old landline phones was never a reality.

The best argument I've heard so far has been that the sheer scale of this type of network surveillance, along with its near-undetectable nature, makes it different in kind. I actually agree with that viewpoint, but I also think that this matter of scale makes it possible to install good oversight and accountability if the capability is actually needed. It would take probably at least 10 people just from a "command + control" sense to launch a U.S. nuclear missile; there's no reason even better accountability, oversight, and specific legal guidance and safeguards can't be baked-in to a one-and-only central monitoring system.

But the question is whether we need the capability, and no one seems to want to take a specific answer as to why the U.S. (and the U.S. alone) can survive without it.

>in 2007 the US suffered an "espionage Pearl Harbor" in which entities "broke into all of the high tech agencies, all of the military agencies, and downloaded terabytes of information."

Man, I would hate if an entity downloaded my information! Poor agencies. But it's probably fine, I mean, those "entities" couldn't look at terabytes of information. It's probably just sitting in a database somewhere. So, nothing to worry about.

> everything the NSA collects is by default shared with your government

So... does that mean that even though the NSA supposedly doesn't analyze American communications, their colleagues in other countries can?

Also, while it may be reassuring for Americans to know that US IP addresses are not allowed in searches, how reassuring is it for Canadians, Mexicans, Germans, Australians, etc? Does this not harm both our reputation and business interests?

In general, this article assumes agents of the government are, and will continue to be, law abiding and respecting of citizens rights. Is that likely to remain the case in 20, 50, 100 years? How about after a major terrorist attack?

It feels like saying Bletchley Park just needed more diligent and loyal crib workers and they would have solved the Enigma.

Without Turing and the Bombe where would we all be?

U.S. law has never been compatible with E.U. data protection law as I understand it though, even before Snowden. The Europeans can't seriously have thought the U.S. wasn't engaging in surveillance (and indeed, they did know otherwise, with ECHELON), so what can be said for that other than "caveat emptor"?

Until multilateral treaties are passed dictating how one national jurisdiction will handle the data of another then every EU business using a US cloud service has just been using wishful thinking. And again, this was true even before Snowden.