7 ms·

As someone who has worked on security for said systems, and who is somewhat familiar with the types of requests that are serviced to LEAs and TLAs, I do think t

As someone who has worked on security for said systems, and who is somewhat familiar with the types of requests that are serviced to LEAs and TLAs, I do think that they don’t have access to back end databases. What, you think we set up a VPN for them so their SQL client in Fort Meade can just query as they please? Or do you think they hack us?

gruez 6y ago
There's precedent for all the things you described. >What, you think we set up a VPN for them so their SQL client in Fort Meade can just query as they please? https://cdn.vox-cdn.com/uploads/chorus_asset/file/12801415/prism-slide-4.1419979622.jpg https://cdn.vox-cdn.com/uploads/chorus_asset/file/12801415/p... >Or do you think they hack us? https://i.stack.imgur.com/jWW5v.jpg https://i.stack.imgur.com/jWW5v.jpg
- JoeSmithson 6y ago
  Your first link doesn't support your quote. The queries are sent to the data holder who send back the data, the agency does not have direct access
  - gruez 6y ago
    >the agency does not have direct access Sure, NSA can't directly query against whatever database gmail uses to store your email, but they still have all your emails, photos, and login history. As far as your privacy is concerned, there isn't really any meaningful difference.
    - JoeSmithson 6y ago
      Do you mind explaining precisely what you mean by "NSA has all my emails"? Suppose I sent an email yesterday from my Gmail to a friend's Gmail, are you saying the text of this email is stored on an NSA machine?
      - gruez 6y ago
        >Suppose I sent an email yesterday from my Gmail to a friend's Gmail, are you saying the text of this email is stored on an NSA machine? Maybe not today, but during its heyday must certainly. >Internal NSA presentation slides included in the various media disclosures show that the NSA could unilaterally access data and perform "extensive, in-depth surveillance on live communications and stored information" with examples including email, video and voice chat, videos, photos, voice-over-IP chats (such as Skype), file transfers, and social networking details.[2] Snowden summarized that "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want." >[Glenn Greenwald] added that the NSA databank, with its years of collected communications, allows analysts to search that database and listen "to the calls or read the emails of everything that the NSA has stored, or look at the browsing histories or Google search terms that you've entered, and it also alerts them to any further activity that people connected to that email address or that IP address do in the future."[44] Greenwald was referring in the context of the foregoing quotes to the NSA program X-Keyscore.[45] https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#Extent_of_the_program https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#E... But let's suppose they don't have your emails stored in their datacenters. Instead, it's still stored on google's servers but they can access your emails via automated requests to google, via search terms or by providing your user handle. Is that a meaningful difference, in terms of privacy?
        JoeSmithson 6y ago
        So essentially, no, they do not have "all my emails". > "Instead, it's still stored on google's servers but they can access your emails via automated requests to google, via search terms or by providing your user handle" You just said previously the exact opposite! That they can't query Google, but they have the data themselves. > "Is that a meaningful difference, in terms of privacy?" Yes, because it means Google are aware of what data they are being requested, and what they are sending in return. The transparency reports for these companies show that the total number of requests is in the region of 10k/year - a lot in some senses, but nowhere near the level of surveillance many people seem to believe.
- lawnchair_larry 6y ago
  Oh make no mistake, I am very familiar with those slides. PRISM is not a VPN with a SQL client, or anything close to it. The second one does not refer to domestic hacking. They don’t do that.
  - satisfaction 6y ago
    I don't imagine they have raw sql access but you probably have an API that takes a name or social or other identifier and returns relevant results. This access may have been granted to an account that is not described as "FBI" it's probably another sub-contractor or analytics provider.
    - lawnchair_larry 6y ago
      You are incorrect. None of the companies we are talking about would build this backdoor interface and grant access like that to a shell company or contractor. If they wouldn’t do it for the TLAs directly, why on earth would they do it for a third party?
      - MagnumOpus 6y ago
        > why on earth would they do it for a third party - Legally: They get served a NSL with a gag order forcing them to add the backdoor without telling you, on penalty of prison time - Extra-legally: They get blackmailed by a TLA do add access and cover it up, or else. ("They" is not necessarily the company's CEO/CTO, but a sufficiently senior DBA/network admin.)
  - throwaway5370 6y ago
    > The second one does not refer to domestic hacking. They don’t do that. What do you believe is happening in that second image? One could argue semantics as to whether a fiber tap is "hacking" or not, or whether tapping a domestic company's network from an international transit link counts as "domestic hacking"... but there is ample evidence that US intelligence agencies do target domestic companies and their networks. See also, the rest of the docs on MUSCULAR: https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program) https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program...
- some_random 6y ago
  What are you trying to say with the second picture? Getting access to a GFE gets you access to what's going through it? What does that have to do with the FBI hacking into the backend of a airline company? The FBI (and NSA for that matter) are a lot more constrained by the law than HN seems to think, they can't just shell anyone they want especially if the target is a third party that has done nothing wrong.
  - gruez 6y ago
    > What are you trying to say with the second picture? Getting access to a GFE gets you access to what's going through it? https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program)#Operational_details https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program... Pretty much that, and also tapping any traffic that's in their internal networks, since that's not encrypted either. > What does that have to do with the FBI hacking into the backend of a airline company? That's one possible attack that the FBI could be carrying out. ie. sabre doesn't encrypt its communications in their internal network, and that's being tapped similar to how the NSA tapped google's internal networks.
  - DubiousPusher 6y ago
    > they can't just shell anyone they want especially if the target is a third party that has done nothing wrong. The reality is not that clear. A lot of what governs what these agencies can and can't do comes from executive branch policies. There is a lot of gray around what is "legal" and congress likes it that way because it keeps responsibility for allowing to much or not enough surveillance far away from them. What's more, you cannot adjudicate what you don't know about and a lot of the secrecy in programs like this is just as much about keeping away civil libertarian attorneys as it is about confounding "the enemy". There's a reason the FISA court rules nearly 100% of the time with the state. Responding attorneys are rarely involved and when they are they are often hamstrung due to a lack of knowledge that prevents them from filing any kind of useful motion or raising serious opposition.
jjuel 6y ago
Are you saying you think that if the government asked your company to turn over some information that my be useful they would deny the request?
- Svip 6y ago
  What about airlines that only operate in said government's jurisdiction, but is not based there?
- lawnchair_larry 6y ago
  I feel that I was pretty clear as to what I was and was not saying. If you’d like to ask a different question, feel free, but I am not interested playing the “are you saying...” game.
- Spooky23 6y ago
  The person you're replying to very specifically said they don't provide access to backend systems. No entity is going to ignore subpoenas or warrants. They may challenge them for reasons that are applicable to the business.
deleted 6y ago
[deleted]
znpy 6y ago
Subpoena? You wouldn't even be allowed to disclose that you had received a subpoena. Some companies establish subpoena canaries for that specific reason.
- Scoundreller 6y ago
  Sabre would include a lot of companies that are outside the borders of a US subpoena.
  - walrus01 6y ago
    In some ways that actually makes it a lot easier for the NSA doing its role as sigint agency against anything "foreign", which doesn't have any US legal protection related to the 4th amendment.
grey-area 6y ago
If you work for a useful target yes they probably have hacked you. They've certainly hacked google in the past for example - see below. These agencies are lawless and motivated. I imagine knowing where targets stay/travel in advance could be very useful. https://www.google.com/amp/s/amp.theguardian.com/technology/2013/nov/06/google-nsa-gchq-spying-judicial-process https://www.google.com/amp/s/amp.theguardian.com/technology/...
- 2OEH8eoCRo0 6y ago
  >These agencies are lawless Citation needed
  - opnitro 6y ago
    [https://en.wikipedia.org/wiki/James_Clapper#Testimony_to_Congress_on_NSA_surveillance,_2013 https://en.wikipedia.org/wiki/James_Clapper#Testimony_to_Con...]
    - lawnchair_larry 6y ago
      This doesn’t relate to the topic in question.
      - opnitro 6y ago
        I was asked for an example of the organization being lawless, I gave a concrete example of the organization failing the most basic of accountability measures: Being asked under oath about their processes. The leader of the organization lied. I think that's a decent indictment of the organization.
  - grey-area 6y ago
    Here you go: Stellar Wind, Tempora, Prism. https://www.nytimes.com/video/opinion/100000001733041/the-program.html https://www.nytimes.com/video/opinion/100000001733041/the-pr... This is a particularly interesting profile of Binney, who worked on stellar wind. https://www.forbes.com/sites/emmawoollacott/2018/09/13/uk-mass-surveillance-ruled-illegal/#44ae35b16329 https://www.forbes.com/sites/emmawoollacott/2018/09/13/uk-ma... https://www.bbc.co.uk/news/world-us-canada-23123964 https://www.bbc.co.uk/news/world-us-canada-23123964 Of course they claimed after being exposed that these programs are legal, but I think lawless is apt as these agencies don't consider the law as a boundary they need to respect. O tempora, o mores
dylan604 6y ago
Is that data encrypted in transit? If so, what encryption was used? The ones "suggested" that NSA knows how to decrypt? Also, do you know what agreements have been made that are "above your pay grade"? Do you know what every piece of equipment in your data center does? What about what equipment is installed at the ISP level? Don't be so quick to say "you" are not actively having data taken. "You" just might not be aware of it.
- lawnchair_larry 6y ago
  Don’t be so quick to assume you have any idea how these things actually work, and what is or isn’t possible. None of the examples that you are running through would facilitate this type of thing.
squeaky-clean 6y ago
I once had a rep at an airline email me PDF's containing full instructions on how to connect to their developer VPN, connect to their dev and prod databases, a Java code sample, and full credentials for all. It was meant for a new developer but got sent to me (contractor working outside the company). I haven't ever tried connecting to it, but I'll tell you when I alerted their security team there was no urgency about it, and the password was so simple I bet you could guess it within 10 tries.
matheusmoreira 6y ago
> Or do you think they hack us? Would that surprise anyone? Governments are known to stockpile and exploit vulnerabilities in targeted computers in order to obtain access. The US government even came up with an euphemism for this malware: network investigative techniques.

gruez 6y ago

There's precedent for all the things you described. >What, you think we set up a VPN for them so their SQL client in Fort Meade can just query as they please? https://cdn.vox-cdn.com/uploads/chorus_asset/file/12801415/prism-slide-4.1419979622.jpg https://cdn.vox-cdn.com/uploads/chorus_asset/file/12801415/p... >Or do you think they hack us? https://i.stack.imgur.com/jWW5v.jpg https://i.stack.imgur.com/jWW5v.jpg

JoeSmithson 6y ago
Your first link doesn't support your quote. The queries are sent to the data holder who send back the data, the agency does not have direct access
- gruez 6y ago
  >the agency does not have direct access Sure, NSA can't directly query against whatever database gmail uses to store your email, but they still have all your emails, photos, and login history. As far as your privacy is concerned, there isn't really any meaningful difference.
  - JoeSmithson 6y ago
    Do you mind explaining precisely what you mean by "NSA has all my emails"? Suppose I sent an email yesterday from my Gmail to a friend's Gmail, are you saying the text of this email is stored on an NSA machine?
    - gruez 6y ago
      >Suppose I sent an email yesterday from my Gmail to a friend's Gmail, are you saying the text of this email is stored on an NSA machine? Maybe not today, but during its heyday must certainly. >Internal NSA presentation slides included in the various media disclosures show that the NSA could unilaterally access data and perform "extensive, in-depth surveillance on live communications and stored information" with examples including email, video and voice chat, videos, photos, voice-over-IP chats (such as Skype), file transfers, and social networking details.[2] Snowden summarized that "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want." >[Glenn Greenwald] added that the NSA databank, with its years of collected communications, allows analysts to search that database and listen "to the calls or read the emails of everything that the NSA has stored, or look at the browsing histories or Google search terms that you've entered, and it also alerts them to any further activity that people connected to that email address or that IP address do in the future."[44] Greenwald was referring in the context of the foregoing quotes to the NSA program X-Keyscore.[45] https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#Extent_of_the_program https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#E... But let's suppose they don't have your emails stored in their datacenters. Instead, it's still stored on google's servers but they can access your emails via automated requests to google, via search terms or by providing your user handle. Is that a meaningful difference, in terms of privacy?
      - JoeSmithson 6y ago
        So essentially, no, they do not have "all my emails". > "Instead, it's still stored on google's servers but they can access your emails via automated requests to google, via search terms or by providing your user handle" You just said previously the exact opposite! That they can't query Google, but they have the data themselves. > "Is that a meaningful difference, in terms of privacy?" Yes, because it means Google are aware of what data they are being requested, and what they are sending in return. The transparency reports for these companies show that the total number of requests is in the region of 10k/year - a lot in some senses, but nowhere near the level of surveillance many people seem to believe.
lawnchair_larry 6y ago
Oh make no mistake, I am very familiar with those slides. PRISM is not a VPN with a SQL client, or anything close to it. The second one does not refer to domestic hacking. They don’t do that.
- satisfaction 6y ago
  I don't imagine they have raw sql access but you probably have an API that takes a name or social or other identifier and returns relevant results. This access may have been granted to an account that is not described as "FBI" it's probably another sub-contractor or analytics provider.
  - lawnchair_larry 6y ago
    You are incorrect. None of the companies we are talking about would build this backdoor interface and grant access like that to a shell company or contractor. If they wouldn’t do it for the TLAs directly, why on earth would they do it for a third party?
    - MagnumOpus 6y ago
      > why on earth would they do it for a third party - Legally: They get served a NSL with a gag order forcing them to add the backdoor without telling you, on penalty of prison time - Extra-legally: They get blackmailed by a TLA do add access and cover it up, or else. ("They" is not necessarily the company's CEO/CTO, but a sufficiently senior DBA/network admin.)
- throwaway5370 6y ago
  > The second one does not refer to domestic hacking. They don’t do that. What do you believe is happening in that second image? One could argue semantics as to whether a fiber tap is "hacking" or not, or whether tapping a domestic company's network from an international transit link counts as "domestic hacking"... but there is ample evidence that US intelligence agencies do target domestic companies and their networks. See also, the rest of the docs on MUSCULAR: https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program) https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program...
some_random 6y ago
What are you trying to say with the second picture? Getting access to a GFE gets you access to what's going through it? What does that have to do with the FBI hacking into the backend of a airline company? The FBI (and NSA for that matter) are a lot more constrained by the law than HN seems to think, they can't just shell anyone they want especially if the target is a third party that has done nothing wrong.
- gruez 6y ago
  > What are you trying to say with the second picture? Getting access to a GFE gets you access to what's going through it? https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program)#Operational_details https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program... Pretty much that, and also tapping any traffic that's in their internal networks, since that's not encrypted either. > What does that have to do with the FBI hacking into the backend of a airline company? That's one possible attack that the FBI could be carrying out. ie. sabre doesn't encrypt its communications in their internal network, and that's being tapped similar to how the NSA tapped google's internal networks.
- DubiousPusher 6y ago
  > they can't just shell anyone they want especially if the target is a third party that has done nothing wrong. The reality is not that clear. A lot of what governs what these agencies can and can't do comes from executive branch policies. There is a lot of gray around what is "legal" and congress likes it that way because it keeps responsibility for allowing to much or not enough surveillance far away from them. What's more, you cannot adjudicate what you don't know about and a lot of the secrecy in programs like this is just as much about keeping away civil libertarian attorneys as it is about confounding "the enemy". There's a reason the FISA court rules nearly 100% of the time with the state. Responding attorneys are rarely involved and when they are they are often hamstrung due to a lack of knowledge that prevents them from filing any kind of useful motion or raising serious opposition.

jjuel 6y ago

Are you saying you think that if the government asked your company to turn over some information that my be useful they would deny the request?

Svip 6y ago
What about airlines that only operate in said government's jurisdiction, but is not based there?
lawnchair_larry 6y ago
I feel that I was pretty clear as to what I was and was not saying. If you’d like to ask a different question, feel free, but I am not interested playing the “are you saying...” game.
Spooky23 6y ago
The person you're replying to very specifically said they don't provide access to backend systems. No entity is going to ignore subpoenas or warrants. They may challenge them for reasons that are applicable to the business.

deleted 6y ago

[deleted]

znpy 6y ago

Subpoena? You wouldn't even be allowed to disclose that you had received a subpoena. Some companies establish subpoena canaries for that specific reason.

Scoundreller 6y ago
Sabre would include a lot of companies that are outside the borders of a US subpoena.
- walrus01 6y ago
  In some ways that actually makes it a lot easier for the NSA doing its role as sigint agency against anything "foreign", which doesn't have any US legal protection related to the 4th amendment.

grey-area 6y ago

If you work for a useful target yes they probably have hacked you. They've certainly hacked google in the past for example - see below. These agencies are lawless and motivated. I imagine knowing where targets stay/travel in advance could be very useful. https://www.google.com/amp/s/amp.theguardian.com/technology/2013/nov/06/google-nsa-gchq-spying-judicial-process https://www.google.com/amp/s/amp.theguardian.com/technology/...

2OEH8eoCRo0 6y ago
>These agencies are lawless Citation needed
- opnitro 6y ago
  [https://en.wikipedia.org/wiki/James_Clapper#Testimony_to_Congress_on_NSA_surveillance,_2013 https://en.wikipedia.org/wiki/James_Clapper#Testimony_to_Con...]
  - lawnchair_larry 6y ago
    This doesn’t relate to the topic in question.
    - opnitro 6y ago
      I was asked for an example of the organization being lawless, I gave a concrete example of the organization failing the most basic of accountability measures: Being asked under oath about their processes. The leader of the organization lied. I think that's a decent indictment of the organization.
- grey-area 6y ago
  Here you go: Stellar Wind, Tempora, Prism. https://www.nytimes.com/video/opinion/100000001733041/the-program.html https://www.nytimes.com/video/opinion/100000001733041/the-pr... This is a particularly interesting profile of Binney, who worked on stellar wind. https://www.forbes.com/sites/emmawoollacott/2018/09/13/uk-mass-surveillance-ruled-illegal/#44ae35b16329 https://www.forbes.com/sites/emmawoollacott/2018/09/13/uk-ma... https://www.bbc.co.uk/news/world-us-canada-23123964 https://www.bbc.co.uk/news/world-us-canada-23123964 Of course they claimed after being exposed that these programs are legal, but I think lawless is apt as these agencies don't consider the law as a boundary they need to respect. O tempora, o mores

dylan604 6y ago

Is that data encrypted in transit? If so, what encryption was used? The ones "suggested" that NSA knows how to decrypt? Also, do you know what agreements have been made that are "above your pay grade"? Do you know what every piece of equipment in your data center does? What about what equipment is installed at the ISP level? Don't be so quick to say "you" are not actively having data taken. "You" just might not be aware of it.

lawnchair_larry 6y ago
Don’t be so quick to assume you have any idea how these things actually work, and what is or isn’t possible. None of the examples that you are running through would facilitate this type of thing.

squeaky-clean 6y ago

I once had a rep at an airline email me PDF's containing full instructions on how to connect to their developer VPN, connect to their dev and prod databases, a Java code sample, and full credentials for all. It was meant for a new developer but got sent to me (contractor working outside the company). I haven't ever tried connecting to it, but I'll tell you when I alerted their security team there was no urgency about it, and the password was so simple I bet you could guess it within 10 tries.

matheusmoreira 6y ago

> Or do you think they hack us? Would that surprise anyone? Governments are known to stockpile and exploit vulnerabilities in targeted computers in order to obtain access. The US government even came up with an euphemism for this malware: network investigative techniques.