5 ms·

No that would make 0 sense. The NSA doesn't "attack" american companies with covert implants. They get FISA court orders that force american companies to attac

by mox1 8y ago

No that would make 0 sense. The NSA doesn't "attack" american companies with covert implants. They get FISA court orders that force american companies to attach their equipment.

late2part 8y ago
You don't know that. We do know that the USG covertly intercepted fiber communications. https://www.washingtonpost.com/news/the-switch/wp/2013/11/04/how-we-know-the-nsa-had-access-to-internal-google-and-yahoo-cloud-data/?noredirect=on&utm_term=.4b6fb73c032e https://www.washingtonpost.com/news/the-switch/wp/2013/11/04...
- mox1 8y ago
  The story literally quotes the general of the NSA, saying they go though the FBI to get a FISA court order to compel the company.. Additionally, the story quoted talks about how the UK obtained the data and gave it to the NSA. Nowhere is the NSA installing covert implants. They just don't do that. The CIA does that :)
  - gowld 8y ago
    That's not correct. https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present) https://en.wikipedia.org/wiki/Global_surveillance_disclosure...
  - calcifer 8y ago
    > The story literally quotes the general of the NSA Ah, so he pinky-promised? Well OK then!
  - late2part 8y ago
    What I meant was that you don’t know it isn’t done. You are taking the word of a spy? Did he say it wittingly?
    - killaken2000 8y ago
      Sure! It was the least untruthful thing he could say.
tyingq 8y ago
I think they do both. https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html?noredirect=on https://www.washingtonpost.com/world/national-security/nsa-i...
mtgx 8y ago
The NSA has "attacked" internet infrastructure for many years before it became sort of legal (but probably still unconstitutional).
endorphone 8y ago
Wasn't PRISM all about attacking American companies with covert implants? For instance tapping into Google region to region data transfers, after which Google started encrypting everything.
- hannasanarion 8y ago
  I thought PRISM wasn't covert. Companies were compelled to allow them to install their sniffing hardware, it was all above-board. Snowden even leaked an internal slideshow with a nice timeline of when each tech company joined the program.
  - endorphone 8y ago
    Parts of that whole expose were covert. In the case of Google we know by tapping fiber connections that they had between data centers (as sseth mentioned, using foreign intelligence peers to do an end run around legal protections), which was on Google owned fiber, theoretically entirely "in-house", so Google transferred it unencrypted. I believe they called this operation "Muscular". After the fiasco Google started assuming everything was hostile.
  - gowld 8y ago
    PRISM was an overt program (to the data stewards, not to the public) for processing FISA warrants and the like. Other NSA programs that Snowden revealed were covert hacks. https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present) https://en.wikipedia.org/wiki/Global_surveillance_disclosure...
- sseth 8y ago
  My understanding is that the google tapping was done in UK using British intelligence services, thus bypassing the legal constraints.
- snowwrestler 8y ago
  The program for tapping data center links had the internal code name MUSCULAR and was a partnership with the British GCHQ, who actually did the intercepting. PRISM was at first reported as some sort of direct access to the servers of certain American companies, but it turned out to be the code name for a joint program with the FBI for using FISA warrants to request data from those companies.
Bartweiss 8y ago
> ...doesn't "attack" american companies with covert implants. Specific example aside, it's worth talking about why this does happen. "Black bag jobs" can mean "we didn't get a warrant", but they can also mean "we got a warrant and still aren't telling". Even given a court order, there's still a possibility that employing surveillance by fiat will cause somebody to leak, or modify how they handle data, or simply reveal information about what sort of surveillance tools a given agency employs. Given that a FISA order can be obtained without a defendant, getting a court order and then doing the thing secretly anyway gives a sort of "bowling with bumpers" advantage where the project is approved if it gets revealed, but also done without revealing anything if it isn't. More disturbingly, there's also substantial evidence that the NSA attacks companies covertly in places where they couldn't get a court order. Taking a specific device out of the supply chain and adding surveillance before it's shipped to the destination is a warrant-worthy project. Setting up systematic physical vulnerabilities with a use case of "turn it on some time in the future to get something interesting" isn't in the purview of a FISA order, so if the NSA did do that it would have to be without an order.
deleted 8y ago
[deleted]
not_real_acct 8y ago
I used to work in engineering at one of the big wireless telecoms. The impression that I got was that many of the outsourced services were compromised. For instance, we had zero control over our voice mail systems, they were outsourced to Amdocs. You can see how this benefits the NSA; if the voice mail is outsourced to a foreign company, and the NSA buys intel from that company, it's technically not spying on US citizens, particularly if they're getting metadata.
platz 8y ago
but the NSA has been performing backdoors on hardware for years PRISM https://www.schneier.com/blog/archives/2018/08/backdoors_in_ci.html https://www.schneier.com/blog/archives/2018/08/backdoors_in_... > Juniper has confirmed that an initial analysis of malware linked to the National Security Agency appears to affect its firewalls. https://www.zdnet.com/article/juniper-confirms-leaked-nsa-exploits-affect-its-firewalls/ https://www.zdnet.com/article/juniper-confirms-leaked-nsa-ex...
jrockway 8y ago
"SSL added and removed here ;-)" doesn't sound like a FISA court order.

by mox1 8y ago

No that would make 0 sense. The NSA doesn't "attack" american companies with covert implants. They get FISA court orders that force american companies to attach their equipment.

late2part 8y ago

You don't know that. We do know that the USG covertly intercepted fiber communications. https://www.washingtonpost.com/news/the-switch/wp/2013/11/04/how-we-know-the-nsa-had-access-to-internal-google-and-yahoo-cloud-data/?noredirect=on&utm_term=.4b6fb73c032e https://www.washingtonpost.com/news/the-switch/wp/2013/11/04...

mox1 8y ago
The story literally quotes the general of the NSA, saying they go though the FBI to get a FISA court order to compel the company.. Additionally, the story quoted talks about how the UK obtained the data and gave it to the NSA. Nowhere is the NSA installing covert implants. They just don't do that. The CIA does that :)
- gowld 8y ago
  That's not correct. https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present) https://en.wikipedia.org/wiki/Global_surveillance_disclosure...
- calcifer 8y ago
  > The story literally quotes the general of the NSA Ah, so he pinky-promised? Well OK then!
- late2part 8y ago
  What I meant was that you don’t know it isn’t done. You are taking the word of a spy? Did he say it wittingly?
  - killaken2000 8y ago
    Sure! It was the least untruthful thing he could say.

tyingq 8y ago

I think they do both. https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/ https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa... https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html?noredirect=on https://www.washingtonpost.com/world/national-security/nsa-i...

mtgx 8y ago

The NSA has "attacked" internet infrastructure for many years before it became sort of legal (but probably still unconstitutional).

endorphone 8y ago

Wasn't PRISM all about attacking American companies with covert implants? For instance tapping into Google region to region data transfers, after which Google started encrypting everything.

hannasanarion 8y ago
I thought PRISM wasn't covert. Companies were compelled to allow them to install their sniffing hardware, it was all above-board. Snowden even leaked an internal slideshow with a nice timeline of when each tech company joined the program.
- endorphone 8y ago
  Parts of that whole expose were covert. In the case of Google we know by tapping fiber connections that they had between data centers (as sseth mentioned, using foreign intelligence peers to do an end run around legal protections), which was on Google owned fiber, theoretically entirely "in-house", so Google transferred it unencrypted. I believe they called this operation "Muscular". After the fiasco Google started assuming everything was hostile.
- gowld 8y ago
  PRISM was an overt program (to the data stewards, not to the public) for processing FISA warrants and the like. Other NSA programs that Snowden revealed were covert hacks. https://en.wikipedia.org/wiki/Global_surveillance_disclosures_(2013%E2%80%93present) https://en.wikipedia.org/wiki/Global_surveillance_disclosure...
sseth 8y ago
My understanding is that the google tapping was done in UK using British intelligence services, thus bypassing the legal constraints.
snowwrestler 8y ago
The program for tapping data center links had the internal code name MUSCULAR and was a partnership with the British GCHQ, who actually did the intercepting. PRISM was at first reported as some sort of direct access to the servers of certain American companies, but it turned out to be the code name for a joint program with the FBI for using FISA warrants to request data from those companies.

Bartweiss 8y ago

> ...doesn't "attack" american companies with covert implants. Specific example aside, it's worth talking about why this does happen. "Black bag jobs" can mean "we didn't get a warrant", but they can also mean "we got a warrant and still aren't telling". Even given a court order, there's still a possibility that employing surveillance by fiat will cause somebody to leak, or modify how they handle data, or simply reveal information about what sort of surveillance tools a given agency employs. Given that a FISA order can be obtained without a defendant, getting a court order and then doing the thing secretly anyway gives a sort of "bowling with bumpers" advantage where the project is approved if it gets revealed, but also done without revealing anything if it isn't. More disturbingly, there's also substantial evidence that the NSA attacks companies covertly in places where they couldn't get a court order. Taking a specific device out of the supply chain and adding surveillance before it's shipped to the destination is a warrant-worthy project. Setting up systematic physical vulnerabilities with a use case of "turn it on some time in the future to get something interesting" isn't in the purview of a FISA order, so if the NSA did do that it would have to be without an order.

deleted 8y ago

[deleted]

not_real_acct 8y ago

I used to work in engineering at one of the big wireless telecoms. The impression that I got was that many of the outsourced services were compromised. For instance, we had zero control over our voice mail systems, they were outsourced to Amdocs. You can see how this benefits the NSA; if the voice mail is outsourced to a foreign company, and the NSA buys intel from that company, it's technically not spying on US citizens, particularly if they're getting metadata.

platz 8y ago

but the NSA has been performing backdoors on hardware for years PRISM https://www.schneier.com/blog/archives/2018/08/backdoors_in_ci.html https://www.schneier.com/blog/archives/2018/08/backdoors_in_... > Juniper has confirmed that an initial analysis of malware linked to the National Security Agency appears to affect its firewalls. https://www.zdnet.com/article/juniper-confirms-leaked-nsa-exploits-affect-its-firewalls/ https://www.zdnet.com/article/juniper-confirms-leaked-nsa-ex...

jrockway 8y ago

"SSL added and removed here ;-)" doesn't sound like a FISA court order.