4 ms·

> they either have permission (e.g. companies have agreed to hand over the encryption keys or allow monitoring of the data after it is unencrypted on arrival)

> they either have permission (e.g. companies have agreed to hand over the encryption keys or allow monitoring of the data after it is unencrypted on arrival) No, because nobody would do that and the NSA has no legal authority with which to force that. Companies wouldn't agree to this because they have everything to lose and nothing to gain. It's not like the NSA could even offer them favors in exchange, as the entire thing is ultra-classified. Also there's exactly zero chance this would ever be able to be kept secret. Companies can't even keep their products secret for the few months it takes from prototypes to launch, there's no way in hell the NSA would trust them to keep this secret for years. The first sys admin forced to do this would instantly talk about it. > some other means (man-in-the-middle attacks, server backdoors, hacking vulnerable software) to bypass the encryption entirely The article talks about this. That's definitely possible, but it's much more targetted and doesn't fit the scale that the Snowden leaks suggested the NSA was achieving.

seanwilson 11y ago
> No, because nobody would do that and the NSA has no legal authority with which to force that. Companies wouldn't agree to this because they have everything to lose and nothing to gain. Not claiming I'm well read up on this but wasn't a big part of the leaks that companies were cooperating with the NSA in secret? http://www.wired.com/2014/01/how-the-us-almost-killed-the-internet/ http://www.wired.com/2014/01/how-the-us-almost-killed-the-in... "Gellman wanted to be the first to expose a top-secret NSA program called Prism. Snowden’s files indicated that some of the biggest companies on the web had granted the NSA and FBI direct access to their servers, giving the agencies the ability to grab a person’s audio, video, photos, emails, and documents."
- wavefunction 11y ago
  Not only that, these companies (AT&T) for example get paid to provide the access.
- arebop 11y ago
  No, the prism leaks show that the NSA had access to data. It is often implied by various commentators that the access was facilitated by the companies, but there's no evidence to support that. The evidence about companies cooperating with NSA on mass surveillance came out in the first decade of the 2000s, e.g., http://www.salon.com/2006/06/21/att_nsa/ http://www.salon.com/2006/06/21/att_nsa/ and https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
- kllrnohj 11y ago
  The telcos (AT&T, Verizon, etc...) were cooperating, but that also fell under existing wiretap laws-ish and was known-ish. There had been rumors about it for years, there have been photos of mysterious governement vans of equipment showing up at sites, special locked rooms, etc... Those companies also haven't denied it. However there is none of that for any of the other companies listed under Prism. Later leaks from Snowden suggest that the companies listed in Prism did not know they were part of Prism (places where inter-dc traffic was being spliced, that sort of thing). Also just practically speaking with how fast companies rise & fall in this area doing this on a per-company basis wouldn't scale. Like when would you expect the NSA to approach, say, WhatsApp? Or Snapchat?
emidln 11y ago
> No, because nobody would do that and the NSA has no legal > authority with which to force that. Companies wouldn't agree > to this because they have everything to lose and nothing to > gain. You might say the same thing about every social engineering victim ever. Nothing to gain, why do they help? Someone asked for help / seemed like the had the authority / was afraid for no reason. Additionally, from my experience, monitoring after decryption isn't too hard to pull off. It takes a lot of time, money, and expertise to secure the inside and egress of the network and there is very little pressure on most companies to exert themselves to defend at those layers. Further, most networks aren't properly segmented and the attacks that tend to gain access to one machine (like a windows or mac laptop) on a network can be pivoted to access more restricted places. Given how open companies tend to be (practicing zero opsec), it's even very easy to know who to attack and have reasonable estimations about their machine's worth inside a network.
avn2109 11y ago
>> "No, because nobody would do that..." This is literally the most breathtakingly naive comment I have ever read on HN.
- teach 11y ago
  It's hyperbole. He doesn't, of course, mean that "nobody" would do it but that it wouldn't work because many would refuse.
nickpsecurity 11y ago
The ECI leaks mention that the FBI "compels" U.S. firms to "SIGINT-enable" their stuff for FISA purposes. So, they must have some authority over at least some U.S. companies. If it's classified, they also can (and have) use secrecy orders. Then, they pay them too. Many companies, esp govt contractors, were more than happy to help for tens of millions.

seanwilson 11y ago

> No, because nobody would do that and the NSA has no legal authority with which to force that. Companies wouldn't agree to this because they have everything to lose and nothing to gain. Not claiming I'm well read up on this but wasn't a big part of the leaks that companies were cooperating with the NSA in secret? http://www.wired.com/2014/01/how-the-us-almost-killed-the-internet/ http://www.wired.com/2014/01/how-the-us-almost-killed-the-in... "Gellman wanted to be the first to expose a top-secret NSA program called Prism. Snowden’s files indicated that some of the biggest companies on the web had granted the NSA and FBI direct access to their servers, giving the agencies the ability to grab a person’s audio, video, photos, emails, and documents."

wavefunction 11y ago
Not only that, these companies (AT&T) for example get paid to provide the access.
arebop 11y ago
No, the prism leaks show that the NSA had access to data. It is often implied by various commentators that the access was facilitated by the companies, but there's no evidence to support that. The evidence about companies cooperating with NSA on mass surveillance came out in the first decade of the 2000s, e.g., http://www.salon.com/2006/06/21/att_nsa/ http://www.salon.com/2006/06/21/att_nsa/ and https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
kllrnohj 11y ago
The telcos (AT&T, Verizon, etc...) were cooperating, but that also fell under existing wiretap laws-ish and was known-ish. There had been rumors about it for years, there have been photos of mysterious governement vans of equipment showing up at sites, special locked rooms, etc... Those companies also haven't denied it. However there is none of that for any of the other companies listed under Prism. Later leaks from Snowden suggest that the companies listed in Prism did not know they were part of Prism (places where inter-dc traffic was being spliced, that sort of thing). Also just practically speaking with how fast companies rise & fall in this area doing this on a per-company basis wouldn't scale. Like when would you expect the NSA to approach, say, WhatsApp? Or Snapchat?

emidln 11y ago

> No, because nobody would do that and the NSA has no legal > authority with which to force that. Companies wouldn't agree > to this because they have everything to lose and nothing to > gain. You might say the same thing about every social engineering victim ever. Nothing to gain, why do they help? Someone asked for help / seemed like the had the authority / was afraid for no reason. Additionally, from my experience, monitoring after decryption isn't too hard to pull off. It takes a lot of time, money, and expertise to secure the inside and egress of the network and there is very little pressure on most companies to exert themselves to defend at those layers. Further, most networks aren't properly segmented and the attacks that tend to gain access to one machine (like a windows or mac laptop) on a network can be pivoted to access more restricted places. Given how open companies tend to be (practicing zero opsec), it's even very easy to know who to attack and have reasonable estimations about their machine's worth inside a network.

avn2109 11y ago

>> "No, because nobody would do that..." This is literally the most breathtakingly naive comment I have ever read on HN.

teach 11y ago
It's hyperbole. He doesn't, of course, mean that "nobody" would do it but that it wouldn't work because many would refuse.

nickpsecurity 11y ago

The ECI leaks mention that the FBI "compels" U.S. firms to "SIGINT-enable" their stuff for FISA purposes. So, they must have some authority over at least some U.S. companies. If it's classified, they also can (and have) use secrecy orders. Then, they pay them too. Many companies, esp govt contractors, were more than happy to help for tens of millions.