NSA Rejection of Digital FOIA(blog.jarrett.io)

184 pointsby jstreebinvor 13 Jahren55 comments

blog.jarrett.io

http://blog.jarrett.io/post/53847082072/nsa-response-to-foia-request

19 comments

JunkDNAvor 13 Jahren

If you are the sort of person who is surprised by this, you need to get out from under the rock you live under. This is what any self-respecting intelligence gathering organization is going to say. Not revealing whether or not information exists (let alone the actual information itself) has been a staple of the trade from the very beginning of the intelligence community. This response would be identical regardless of current events.

edit: typos

Stratoscopevor 13 Jahren

I'm no fan of the NSA, but you're right, the response made perfect sense to me. There's really no other way they could respond.

This isn't an exact parallel, but when I read their response and the reason for it, the first thought that came to mind was, "Oh, of course - it would be like a JavaScript timing attack."

llamatabootvor 13 Jahren

I have gotten the same responses from the FBI many times for a FOIA request, though I have many associates questioned by the FBI, and I was detained in Ireland for possible hacking in the United States, so I assume I have a file. But anyway, same response of neither confirm nor deny from FBI about 4-5 times in last 10 years.

pyrevor 13 Jahren

When applying for a foreign visa, they will probably require police records from your country of origin/citizenship. If you send in a request for records from the FBI, do they just send back a "Does Not Compute" answer, and then you're out of luck for preparing your visa application?

(assuming you're a US citizen)

llamatabootvor 13 Jahren

Don't know the answer to that one, as I have never asked for a formal background check.

pyrevor 13 Jahren

IIRC, it's $18 + submitting your fingerprints to the FBI in the US. Might be interesting to see what you get back if FOIA requests for their records on you return a "Huh? What records?" response.

jsmcgdvor 13 Jahren

Here's how I interpreted the letter: "We cannot confirm or deny the thing you requested exists because that thing you requested is classified". Unless all FOIA fail, it seems to me, in some broad sense, that they just confirmed the existence of the requested material.

vorporealvor 13 Jahren

I think it's more of "The information you requested, were it to exist, would be highly classified (due to its type), and therefore we can neither confirm nor deny its existence."

ethomsonvor 13 Jahren

I'm pretty sure that actually means that even the knowledge of existence is classified, as per the "details about them remain classified and/or protected from release..."

ctdonathvor 13 Jahren

Read as "We cannot confirm or deny the thing you requested exists because if it exists/existed it would be classified, and that includes your request of whether it exists."

SCAQTonyvor 13 Jahren

I read it this way: "we are asserting our 5th amendment right to neither confirm or deny we violated your 4th and 5th amendment rights so you can't sue us and have some uppity judge make us follow the law."

dagwvor 13 Jahren

It's sometimes worth doing something you know will fail, just to find out exactly how it will fail.

rhizomevor 13 Jahren

They could have just offered the least untruthful answer instead.

rsingelvor 13 Jahren

This what's known as a Glomar response: http://en.wikipedia.org/wiki/Glomar_response

That developed in law thanks to the press uncovering a secret, massive sunken-sub-raising boat built by Howard Hughes for the CIA to retrieve a lost Soviet sub (yes, the very thing that The Hunt for Red October was based on).

darkarmanivor 13 Jahren

> Lower court precedent has thus far ruled the Glomar response to have potential merit, if the secretive nature of the material truly requires it, and only if the agency provides "as much information as possible" to justify its claim. Otherwise, the principles established in FOIA may trump claims to secrecy.

Is it required if they have no data collected and the subject isn't under investigation?

dfcvor 13 Jahren

Is what required?

johngvor 13 Jahren

We can't tell you if we are monitoring you. Or what capabilities for monitoring we have. Despite you being a US citizen which we would have no reason to monitor.

Scary stuff folks.

sageikosavor 13 Jahren

You can't expect the secret police to divulge their secrets.

whaevrvor 13 Jahren

Ooh gestapit..

PavlovsCatvor 13 Jahren

Just like you can't expect a scorpion not to sting? So far, the main argument for the continued existence of secret police A is the existence of antagonistic secret police B. Even the "bad guys".

Sounds like a great opportunity for an AI of the future: "find any group of people working together against everyone else, start subtracting members from the group until coherence reaches 0". That would deal with the spooks and the ones that create work for them in one swoop. Ahhh, I can dream, can't I.

sliverstormvor 13 Jahren

If they are trying to avoid divulging capabilities to foreign agencies, what does your citizenship have to do with anything? "I know it's Top Secret, but I'm a citizen! It's ok, you can tell me"

sawyervor 13 Jahren

Last week: We'd be happy to respond to requests submitted via the handy dandy online form - these paper copies are invalid.

Today: We're sorry, if we told you of the existence or non-existence of data about you it would help terrorists.

fnordfnordfnordvor 13 Jahren

"I know," says spook1 to spook2, "We'll put up a web page where the rubes can enter their address, and have it automatically send them a FOIA_GLOMAR_GO_JUMP_IN_A_LAKE_HA_HA.pdf"

redblacktreevor 13 Jahren

They responded. They just denied the request.

RyanMcGrealvor 13 Jahren

I cannot confirm or deny the existence or non-existence of a sense of humour, irony or shame on the part of the poor functionary who had to send out that response.

raintreesvor 13 Jahren

One of my favorite lines from Men In Black: "We at the FBI do not have a sense of humor that we are aware of."

breakbreadvor 13 Jahren

I received pretty much the exact same response in the mail yesterday.

http://i.imgur.com/CFgQ0eM.jpg

http://i.imgur.com/yVEvptE.jpg

http://i.imgur.com/inUUStL.jpg

http://i.imgur.com/qVGtdTj.jpg

jasonkolbvor 13 Jahren

Absolute crap. Denied by an executive order, which is not legislated law and definitely does NOT supersede the law that put the FOIA process into place. This is garbage.

genwinvor 13 Jahren

tl;dr:

Dear FOIA requestor,

You get nothing, by law. It's for your own protection.

Sincerely,

NSA

driverdanvor 13 Jahren

Jarrett, can you post higher res images or an OCRed version? Those images are so small the text is about 4pt on my screen.

jstreebinvor 13 Jahren

Sure thing, gimme a sec

jstreebinvor 13 Jahren

https://www.dropbox.com/sh/b8d4bb9pfgryj3t/mGBrXRzkkY

Lmk if this helps

[deleted]vor 13 Jahren

vaaduvor 13 Jahren

I'm surprised they actually replied to you. A reply is admitting they exist, which they can not confirm nor deny.

pionarvor 13 Jahren

A reply does no such thing. They can say that your request is denied without even looking to see if the information exists first.

They're not saying, "It's there, we're just not going to admit it." They're saying "We're not even going to begin looking for it."

yebyenvor 13 Jahren

I think gp was saying: to reply to your letter is to confirm the existence of the body, the NSA itself, who received and replied to your request.

Now we know they exist!!!

dhimesvor 13 Jahren

We always knew NSA existed. Some of the other guys, however...

sliverstormvor 13 Jahren

I suppose at least this means they have yet to pull "the greatest trick the Devil ever pulled" ("convincing the world he doesn't exist")

sp332vor 13 Jahren

When did the NSA start using Georgia? I always thought Times New Roman was more "official".

dslvor 13 Jahren

Just recently: https://news.ycombinator.com/item?id=5844063

redblacktreevor 13 Jahren

Awesome. A comment on typography. :)

sp332vor 13 Jahren

Well, it's not like there's any content in this letter to look at :p

achughesvor 13 Jahren

NSA probably just wants to look more approachable /s

tsaoutourpantsvor 13 Jahren

I hope that someone fights this. :) Just because the NSA determines that something is exempt from FOIA doesn't mean that their determination is lawful. I belive a court will rule that since it is entirely public that they've collected the information, as well as how they've collected it, and there have been government officials who have admitted to the program, their claim of exemption is improper.

coldcodevor 13 Jahren

Hmm what would happen if the entire (US) Hacker News readership sent in an FOIA request at the same time. Maybe we can destroy their photocopiers?

ghjmvor 13 Jahren

"Each agency may promulgate regulations, pursuant to notice and receipt of public comment, providing for the aggregation of certain requests by the same requestor, or by a group of requestors acting in concert, if the agency reasonably believes that such requests actually constitute a single request, which would otherwise satisfy the unusual circumstances specified in this subparagraph, and the requests involve clearly related matters."

They would just publish one response and send us all a link to it.

ctdonathvor 13 Jahren

Taxes on American HN readers would increase accordingly to cover costs of buying & operating new copiers.

alanhvor 13 Jahren

Debt, rather. Expenses and taxes are divorced: it’s the deficit!

[deleted]vor 13 Jahren

malkiavor 13 Jahren

Be careful! This might look in someone's eyes as subversive action.

agardenvor 13 Jahren

The logic makes sense if you assume that the NSA is only using the data to target terrorists. In that scenario, the danger isn't that they will reveal to innocent civilians that they have your data. The danger is the precedent. Want to know if you are on their target list? File a FOIA. If they grant it, you're okay. If they deny it, you're in their sights.

But since we already know that they are collecting this metadata on absolutely everyone, I don't see what good it does to refuse to send it to you, whether you are a suspected terrorist or not. ...I suppose you could be fretting about whether you had slipped up and called Cousin Guido on your regular cell instead of a throw-away prepaid phone.

schrodingervor 13 Jahren

Ps, I've heard that apple will replace your iPhone for those purple specs in the pictures.

jstreebinvor 13 Jahren

Oh sick! Thanks!

Yeah, my camera has gone to shit. I'll take it in next time I'm near a store

fourplyvor 13 Jahren

You missed a spot in p1 with the case number.

jstreebinvor 13 Jahren

Oops, thanks

edraferivor 13 Jahren

Surprisingly well-written response actually. Not too hard to figure out what they're talking about.

joering2vor 13 Jahren

Were we to provide positive or negative responses to requests such as yours, our adversaries' compilation of the information provided would reasonably be expected to cause exceptionally grave damage to the national security.

simple as that: we can't tell you what you want to know, because we think you are a terrorist.