NSA Boss Asks Congress For Blanket Immunity For Companies That Help NSA Spy

Argh. Important subject material, crappy article, lots of confusion, argh argh argh.

TL;DR: everything about the WAY this story was reported is an obvious deception.

First, methodology. This is blogspam that adds nothing to the original article at http://dyn.politico.com/printstory.cfm?uuid=EF9BC1BF-34EB-41... (at least they link it). That article, in turn, cites no sources. So I'm basing the following only on those articles.

Also, let me be clear that I'm anti-immunity in general, and I think that the UsGov behaviour in Hepting vs AT&T is reprehensible, and no one should ever vote for any lawmaker who voted in favour of FISA, for that reason alone.

Okay, let's take it apart.

If you read TOA, it specifically says Alexander specifically claims he's not asking for blanket immunity. So the title is linkbait. Fuck you techdirt, for sabotaging the cause of freedom; now if/when Alexander/NSA replies to this article, he can avoid the issue by denying your false allegation. Don't muddy the waters.

Next, the context is not explicitly about spying at all. Not at all. Zero mention of spying. Oh look, the headilne is linkbait twice over. Fuck you twice over, techdirt. I can only conclude that Mike Masnick is either illiterate, or a liar.

ALSO, while Alexander is the head of the NSA, and while the NSA and the USCYBERCOM are deeply in bed, they is still some distinction, and this really sounds more like a USCYBERCOM thing than an NSA thing.

Next, listen, the only legitimate reason for cops to exist is to protect the populace. And if there's ONE thing that I trust Alexander about, it's the fact that at least some people want to fuck with US companies and US infrastructure (he's probably lying about the scale, and basically everything else). If SinoGov, or crazy terrorists, or AnonSecOfTheWeek, or whatever, attack US Companies, and private enterprise can't cope, it's reasonable for USGov to fight on behalf of Americans and American companies, and that might include giving them advice on cybersecurity, and that might involve giving them the equivalent of virus definitions, and saying "block all traffic that matches this signature and you'll be in better shape". This is legit. This is a strong argument. He goes on to say that if companies obey the NSA and turn out to harm someone with it, they should be immune. Okay, this part I disagree with. But seriously, of all the horrible asshole claims the NSA has made lately, this one is about as reasonable as it gets.

That said, I'd argue against such immunity. If the companies act in good faith with due diligence, what do they have to lose? And if they don't do due diligence, fuck them... what kind of moron trusts the fucking NSA?

As for counter-hacking, sooner or later the law is going to have to address it. And it's going to be difficult. And they should fucking get started, and proceed slowly and cautiously.

EDIT: slight touch-up on TLDR

I find it to be the direct consequence of institutionalization.

It isn't a new one— it's the longstanding behavior with respect to information held in third party care.

Whats changing is how powerful a surveillance tool it is— especially with service providers intentionally blurring the boundary between local and cloud data for unrelated business reasons.

In 1787 there would have practically no reason for you to hand over your most personal papers and effects to a third party. Today its increasingly hard to avoid and can even happen without any real knowledge or consent.

The obvious fix isn't statutory: Keep your private data local, don't use software that will cloudify your data without your knowledge, and when you must use third party systems always use encryption. ... but this is complicated by the fact that there are multiple industries whos revenue is threaded by prudent behavior like this.

Hopefully they'll realize that taking the immunity only solves the lesser of the problems this presents and they'll provide the resources needed to create the legislative change to insure privacy for the data they hold in trust. But maybe it's just cheaper to convince everyone that they don't need any privacy?

Yes, that was my point, though I may have been unclear. There's lots of describing him as the head of the NSA (both by techdirt and by politico), but I suspect that that was misleading, because I suspect that he made these statements as head of USCYBERCOM.

Maybe I misunderstand the division of responsibilities, but AIUI, the NSA limits themselves pretty absolutely to spying, and actually going out and doing things (like telling companies to block certain packets, which allegedly might cause that company to need immunity (ha!)) is not really an NSA thing.

Subpoenas are a basic tool of discovery, a very broad instrument for collecting relevant information. See: http://en.wikipedia.org/wiki/Subpoena_duces_tecum