18 ms·
US intelligence mining data from 9 US Internet companies in broad secret program
- chrismarlow9 13y agoNext obvious step here is precrime or a massive attack on the US (civilians or troops) due to a leak of the data.
- ziko 13y agoI have two questions for which I couldn't find the answer: 1 - Will these companies provide data from all users or only US citizens? 2 - Who has access to the data? Only people working on this program at US intelligence or a wider set of people? For instance, can they look up my emails, photos and so on if I am about to be interview for high profile government job?
- natrius 13y agoNote that this is a separate story from today's furor about the NSA obtaining American phone call metadata.
- ISL 13y agoPublication today may have been stimulated by yesterday's news.
- donohoe 13y agoThe National Security Agency and the FBI are tapping directly into the central servers and then they're extracting audio, video, photographs, e-mails, documents and connection logs from... Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube, Apple. and it gets better Dropbox, the cloud storage and synchronization service, is described as “coming soon.”
- ryguytilidie 13y agoHow does this stuff work? Would someone at the NSA contact dropbox and ask them to build in a backdoor or are they just able to access whatever the fuck they want and simply do?
- nkassis 13y agoI don't believe they need backdoors, they probably just ask for the data and it's provided to them by those companies to comply with the current laws (or at least their interpretation of it.) I'm pretty sure dropbox can reverse any encryption they use for the files they store. Or do they even encrypt the data?
- sixothree 13y agoI think there was an article here that described how dropbox at the very least keeps hashes of every file.
- rdl 13y agoDropbox has every encryption key used with Dropbox, so they can decrypt any file. Both transport keys and storage keys. Dropbox does at least (allegedly) encrypt stuff for storage, so they can RMA hard drives without having to destroy them first, but that's pretty meaningless. There are some (flimsy) reasons for Dropbox to have copies of all storage keys (a web UI, which only some users use). Dropbox has done a good job of misrepresenting how their security worked for the past ~4 years to mislead people into trusting it, though. This is mostly why I don't use Dropbox whenever I have a choice.
- _k 13y agoSo if I'm using a US based hosting provider for my customers websites, their data will be extracted ?
- patrickaljord 13y agoUS or else, I wouldn't trust other governments either, even if you trust governments, your cloud provider could still get hacked and even if it doesn't get hacked you still have to trust a third party: your cloud provider. If you're storing stuff on the cloud, encrypting it on the client first is probably the only way to get (pretty good) privacy.
- msrpotus 13y agoProbably slightly safer using a US hosting company. At least some civil rights apply but I don't think there are any rules against the NSA spying on people outside the US.
- fosap 13y agoThe story that the CIA sold cocaine is pretty much outside of the realm of conspiracy theories. The idea that spying agencies care about laws is ridiculous. Why should they? If they are doing their job right no one will ever know.
- shmerl 13y agoThe only way to ensure your data will not be (easily) extracted is to encrypt it.
- bosch 13y agoI would be surprised if it hasn't already been extracted and added to the governments collection.
- stfu 13y agoWould be time for a call on VCs and Incubators that a sustainable future for the web would mean fostering startups that rise the convenience of privacy tools.
- ISL 13y agoNote link at the bottom to the powerpoint slides in question: http://www.washingtonpost.com/wp-srv/special/politics/prism-collection-documents/ http://www.washingtonpost.com/wp-srv/special/politics/prism-...
- o0-0o 13y agoThat link looks more like a security classification to me.
- cynwoody 13y agoTop secret, special intelligence, originator-controlled, no foreigners. A somewhat redacted, 158-page manual describing how to code these markings: http://www.fas.org/sgp/othergov/intel/capco_imp.pdf http://www.fas.org/sgp/othergov/intel/capco_imp.pdf A cheat sheet from 2008, by Julian Assange: http://www.fas.org/sgp/othergov/intel/capco_imp.pdf http://www.fas.org/sgp/othergov/intel/capco_imp.pdf
- shmerl 13y agoIn addition they simply suck all traffic from major providers. Like this: https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
- ry0ohki 13y agoWhat sort of threats does the NSA give to these companies so they participated without any leaks? Just curious what the penalty would be if the NSA approached me about sucking down my user data and I refused.
- yajoe 13y agoI've been on the receiving end and posted a couple times trying to explain how it happens. In short, the NSA doesn't typically appear directly. Instead they use the courts and subpoenas to induce compliance for what seem like mundane court cases. See a previous post: https://news.ycombinator.com/item?id=5754641 https://news.ycombinator.com/item?id=5754641
- vy8vWJlco 13y agoI suspect just getting a request from a three letter agency is enough to make most CTOs and CEOs wet themselves and roll over. (Standing up against the government is not usually part of the business plan.)
- lawnchair_larry 13y agoThat's the point of CISPA. They didn't want to fight the government, but they pushed back asking for more legal protections, especially after the AT&T warantless spying scandal broke. So, they've been trying hard to pass CISPA in order to give these CEOs more peace of mind.
- olympus 13y agoThey hand out these: http://en.wikipedia.org/wiki/National_security_letter http://en.wikipedia.org/wiki/National_security_letter You're not even supposed to reveal that you are complying (gag order). Google has been in the news recently about fighting one in court.
- rsync 13y agoWe have been fighting this US policy since 2006: http://www.rsync.net/resources/notices/canary.txt http://www.rsync.net/resources/notices/canary.txt
- anon808 13y agoSounds like some one (or many) are blowing whistles. A lot of documents leaking.
- olympus 13y agoEdit: Just saw the portion markings (the stuff on the slides that says their classification level), and I'm going to change my judgement to "this was pretty classified." And whoever released these slides to the public is going to jail for violating the NDA they signed. Jail for quite a few years for knowingly revealing TS information. I'll leave my previous comment below so you won't think I erased anything. My problem is how they portray this. Direct from the article: "The highly classified program, code-named PRISM, " and also: "The technology companies, which participate knowingly in PRISM operations, include most of the dominant global players of Silicon Valley." If you have numerous (non-government contractor type) companies knowingly participating in the program, then it isn't "highly classified." And if you thought that your communications were private then you were fooling yourself. Even Tor, the darling of the EFF, was initially developed by the Navy. It's very tough for people to communicate electronically these days without the government being able to listen in.
- AnthonyMouse 13y ago>Even Tor, the darling of the EFF, was initially developed by the Navy. Tor is open source. Are you suggesting there is some secret backdoor inserted by the Navy which is not apparent in the public code?
- olympus 13y agoNo, I was suggesting that the government has touched things that many people don't realize. There might not be an explicit backdoor in the code, but it's quite possible there is a vulnerability that the government can exploit. I'm not saying that there is, but if there was it wouldn't be publicized and they'd be milking it for all it was worth before someone else discovers the hole and fixes it.
- ISL 13y agoPerhaps whomever leaked it regarded it as essential to upholding an oath of office. 'preserve, protect, and defend the Constitution of the United States.... '
- 13y ago
- Zoepfli 13y agoI just emailed Tim Cook that imho iCloud is dead. He is welcome to add options to use my own cloud storage while using clientside encryption, and I might reconsider. You're welcome to send him your opinion as well. It's tcook@youknowntherest.
- MichaelGG 13y agoBe serious. This is Apple. How on earth does clientside encryption fit into easy-to-use? Lost your password? Lost your files. That's entirely against the scenario Apple wants to sell. Clientside crypto will only possibly be mass-adopted when there's some easy system for common folks to store their keys.
- Zoepfli 13y agoI'm not asking for exclusive client-side encryption. I'm asking to have it as an option. Which is a totally legit wish. If the common forgetful folks like to trade ease-of-use with being spied upon, I'm fine with that. But me, I'm not willing to do that trade-off.
- jonknee 13y agoThey build that feature into their desktop OS (FileVault), I don't see why it couldn't be an option for their sync service. It shouldn't be the default, but it should absolutely be an option.
- deleted 13y ago[deleted]
- epoxyhockey 13y agoApple demonstrated that resistance is possible, for reasons unknown, when it held out for more than five years I'm pretty sure that unknown reason was Steve Jobs. Apple became a participant 1 year after Tim Cook took the helm.
- philwelch 13y agoAlmost makes you want to question the "liver cancer" story.
- EthanHeilman 13y agoAt least we know beyond a shadow of a doubt that Skype has a backdoor now. Not really surprising although they did have some security people analyze the protocol and state that it was e2e secure. FTA: "According to a separate “User’s Guide for PRISM Skype Collection,” that service can be monitored for audio when one end of the call is a conventional telephone and for any combination of “audio, video, chat, and file transfers” when Skype users connect by computer alone. Google’s offerings include Gmail, voice and video chat, Google Drive files, photo libraries, and live surveillance of search terms."
- olympus 13y agoI'm not sure when the security people you are talking about did their audit, but when Microsoft bought Skype a few years ago they changed it from P2P communications to routing everything through a central server. After that it would be child's play to put in a backdoor.
- igravious 13y agoNot to be too conspiracy theorist but maybe just maybe this was why Skype was bought by Microsoft in the first place? The thought crossed my mind at the time of purchase but I sent it away skuttling because I deemed it too tinfoil hatty. My main regret at the time as a Linux enthusiast was that Skype's Linux offering was sure to suffer, so I had that angle more on my mind than government aiding and abetting.
- brown9-2 13y agoWhy would Microsoft buy Skype to make government easedropping easier?
- jlmendezbonini 13y agoJust guessing, but maybe tax breaks or some government contracts.
- wmf 13y ago
- surferbayarea 13y agowill be exciting to see how soon these servers become compromised and massive amounts of private information leaked. I would give it a year tops!
- syncerr 13y agoThere's no upside to this happening. Governments will still collect data. Your personal details, however, will be publicly available.
- _pius 13y agoI'm just going to leave these here: https://www.cdt.org/content/donate https://www.cdt.org/content/donate https://supporters.eff.org/donate https://supporters.eff.org/donate
- ISL 13y agohttps://cloud.torproject.org/ https://cloud.torproject.org/ https://www.torproject.org/ https://www.torproject.org/ https://en.wikipedia.org/wiki/Pretty_Good_Privacy https://en.wikipedia.org/wiki/Pretty_Good_Privacy etc.
- andre 13y agoHaven't used Nitro myself, worth exploring: Nitro is a library for painlessly writing scalable, fast, and secure message-passing network applications http://gonitro.io/ http://gonitro.io/
- deleted 13y ago[deleted]
- klon 13y agoAny data shared with hosted services really needs to be seen as postcards ie open for any agency to read.
- fosap 13y agoYes, this is bad. Yes, you are right to be upset. Yes you (not not really me, I'm not American and i avoid american hosting and hosting companies like amazon for exactly this reason) should change that. But honestly, are you surprised? Are you really? Government agencies have be building large datacenters, the EU loves data retention. There was no tin foil head required to see this.
- b6 13y agoWhen people wanted to talk about this kind of massive wiretapping program years ago, they were called paranoid nutcases. Now that the truth is coming out, people who want to talk about it are called out for belaboring the obvious. I see this "are you so naive as to be surprised?" reaction in almost every thread about this. It's some kind of defense mechanism.
- jfaucett 13y agoI think it depends on who your talking about. If your a decently educated person who follows political developments at least minimally, and to boot you're a developer - I really agree with the OP, should anyone be surprised here? Haven't you been acting all along like all data that major corps are collecting on you was public anyway? On the other hand, if your talking about an everyday citizen with a "normal" job, I think your criticisms are more in place.
- fosap 13y ago>I see this "are you so naive as to be surprised?" reaction in almost every thread about this. It's some kind of defense mechanism. That's why I'm saying you are right to be upset. I like the saying "being paranoid does not mean they are not after you". And being paranoid turned out to be realistic.
- bdamm 13y agoWell then try this on for size. Getting data through requesting it is only one way to get data. Another way to get data is to hack into the source. Consider that a number of governments, including the US, have active hacking teams. What are they hacking in to, exactly? I leave that up to you for speculation.
- andre 13y agoDropbox.... “coming soon.” Time to look at Bittorrent Sync again? Or other open source alternatives?
- meraku 13y agoMy thoughts exactly. I'm certainly going to be looking at other options, including BitTorrent Sync. As useful as Dropbox may be, it's something I'd be willing to do without if this is true.
- jlmendezbonini 13y ago"Is BitTorrent Sync open-source? BitTorrent Sync isn't open source software, and no announcements have been made to indicate that this will likely change."[1] [1]http://forum.bittorrent.com/topic/17782-bittorrent-sync-faq-unofficial/ http://forum.bittorrent.com/topic/17782-bittorrent-sync-faq-...
- andre 13y agoI know they are not open source currently, but for now they are not on the list. It would be awesome if they did open source it, or at least allow for third party (EFF?) review of source.
- stfu 13y agoWhat really saddens me is that this confirms all the conspiracy rumors. Wasn't it always just a rumor going around that the U.S. Government "made" Microsoft buy Skype for spying purposes? Well: "10 May 2011, Microsoft Corporation acquired Skype Communications" and on 2/6/11 Skype was added to the US spy program [1] They were so eager to spy on Skype users that they implemented that "feature" even before the deal was officially done. Considering that Skype had been around since 2003 the events don't appear very accidental. Wouldn't surprise to find out one day that the Skype acquisition was indirectly tax-payer funded. [1] http://www.washingtonpost.com/wp-srv/special/politics/prism-collection-documents/images/prism-slide-5.jpg http://www.washingtonpost.com/wp-srv/special/politics/prism-...
- kps 13y agoNot to detract from the concerns surrounding this program, or to defend Microsoft, but from the dates for Google, YouTube, and AOL one can see that Skype joined on February 6, not June 2.
- stfu 13y agoIt seems reasonable to suspect that for matters of urgency the transition process might have started earlier than the actual acquisition was publicly announced. Plus I am not quite sure if the dates on the slide indicate the starting or finishing date of the implementation process.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- nostromo 13y agoI'm saddened to see Dropbox on the list. Did they choose to participate or is it mandatory? In any case, we've moved several projects to BTSync recently from Dropbox (for no other reason than to free up space on Dropbox for our personal files) and have been enjoying the service. As a p2p encrypted protocol, I imagine it's much more difficult to eavesdrop on your files and would actually require a warrant to obtain. I presume that's true for AeroFS as well.
- cdooh 13y agoI've read somewhere that it's voluntary edit: read it here http://mobile.theverge.com/2013/6/6/4403868/nsa-fbi-mine-data-apple-google-facebook-microsoft-others-prism http://mobile.theverge.com/2013/6/6/4403868/nsa-fbi-mine-dat...
- mmanfrin 13y agoSource.
- cdooh 13y agohttp://mobile.theverge.com/2013/6/6/4403868/nsa-fbi-mine-data-apple-google-facebook-microsoft-others-prism http://mobile.theverge.com/2013/6/6/4403868/nsa-fbi-mine-dat...
- eli 13y agoThe Verge is just summarizing the Washingon Post; they don't know any more than you would after having read the Post's scoop.
- cdooh 13y agowould you prefer this link instead? http://www.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companies-in-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story.html?hpid=z1 http://www.washingtonpost.com/investigations/us-intelligence...
- danso 13y agoThis is fucking atrocious. How much money do we allocate to national security in a year and this is the kind of amateurish PowerPoint slide their analysts come up with? http://www.washingtonpost.com/wp-srv/special/politics/prism-collection-documents/ http://www.washingtonpost.com/wp-srv/special/politics/prism-... I wonder which cub analyst got the job of putting together a collage of logos for that final slide?
- deleted 13y ago[deleted]
- mtgx 13y agoThis is why've were trying to make it legal lately. They were already doing it. The same thing happened with the Patriot Act. It seems FBI/NSA "test-drive" a new illegal spying program first, and then lobby Congress to pass a law to make it legal (regardless of its constitutionality, as we've seen so far). I bet they would've wanted retroactive immunity, too, in these new laws. Also, let's see how those supporters of FISA, like Dianne Feinstein, try to spin this one as "they already knew about it" (which makes it that much worse) and that it's nothing new. Also let me see them say with a straight face that this is constitutional and doesn't violate the 4th Amendment. But seeing how cynical these people have become, I don't think it would be too hard for them to do it.
- samstave 13y agoNSA: "Look, I know that this was illegal, and we were not supposed to be doing this, but you have just got to look at the data. Just look at all the crazy terrorists out there. They've been organizing over FB, keeping their data on Dropbox and Drive and talking over skype. Here's our proof! You MUST make this activity legal... the FREEDOM of the US depends on it!!" Congress: "ok" --- But we are not fooling anyone. There is not a single worthy human being in congress. Every single last one of them is a corporate shill and they are all opportunistic criminals.
- deleted 13y ago[deleted]
- rdtsc 13y ago> retroactive immunity, Fuck everything about that. _That_ was what revealed Obama as a wolf in sheep's clothing. He voted for retroactive immunity of telecom companies spying on Americans. That is all I needed to know about him. Not saying Romney was better. But vis-a-vis the propaganda, the fans, the ass kissing, change, hope, etc etc it was even more so disgusting. Seeing Obama's track record compared to what people believed he was is a very sad "I told you so" for many of my friends and relatives. Yes I know he didn't promise to be open about this and he can't _create_ legislation but I am talking about the qualities people saw in him.
- randall 13y agoIs there a way to run AeroFS on AWS or something? So it's possible to store files encrypted, but with as simple syncing as Dropbox?
- yurisagalov 13y agoYes :-) http://blog.aerofs.com/479/s3-for-team-server http://blog.aerofs.com/479/s3-for-team-server
- randall 13y agoI was going to ask you on FB, but then thought more people would probably care here. :P
- o0-0o 13y agoJesus Christ. Shit just got real.
- luthr8 13y agoI am so happy this is finally getting media coverage. I'm sick and tired of being called 'paranoid' whenever I say it's obvious this is what the NSA is doing with their enormous data centers. This is STILL just the tip of the iceberg. I really hope the whistle blowers continue to release details of more and more of these secret programs. If people think this is as bad as it gets they're in for quite a shock. Call metadata, all your private files, and the people you stalk on Facebook are nothing. How about access to your laptop's webcam and microphone? How about the two cameras and the microphone on the smartphone you carry with you everywhere? How about the exact GPS location of your phone every minute of the day? How about aggregating the CCTV and traffic camera footage with facial recognition to give a full video/audio recording of you everywhere you go every day? How about all of your credit card purchases aggregated, plotted on map, used to determine your habits?
- eightyone 13y agoI'm especially appalled to see Dropbox on this list. I'm in the process of migrating to BitTorrent Sync.
- pavs 13y agoTime to self host everything. Paranoia just became reality. http://www.slashgeek.net/2013/02/17/self-host-everything/ http://www.slashgeek.net/2013/02/17/self-host-everything/
- brown9-2 13y agoVery interesting that the NSA's own material refers to Facebook's "surveillance" features: With a few clicks and an affirmation that the subject is believed to be engaged in terrorism, espionage or nuclear proliferation, an analyst obtains full access to Facebook’s “extensive search and surveillance capabilities against the variety of online social networking services.”
- luthr1 13y agoI am so happy this is finally getting media coverage. I'm sick and tired of being called 'paranoid' whenever I say it's obvious this is what the NSA is doing with their enormous data centers. This is STILL just the tip of the iceberg. I really hope the whistle blowers continue to release details of more and more of these secret programs. If people think this is as bad as it gets they're in for quite a shock. Call metadata, all your private files, and the people you stalk on Facebook are nothing. How about access to your laptop's webcam and microphone? How about the two cameras and the microphone on the smartphone you carry with you everywhere? How about the exact GPS location of your phone every minute of the day? How about aggregating the CCTV and traffic camera footage with facial recognition to give a full video/audio recording of you everywhere you go every day? How about all of your credit card purchases aggregated, plotted on map, used to determine your habits?
- sneak 13y agohttps://news.ycombinator.com/item?id=4070671 https://news.ycombinator.com/item?id=4070671 The short answer: You should have already presumed this was happening. Did you really think they'd allow this opportunity to pass them up?
- chris_mahan 13y agoI already presumed this was happening.
- numbers 13y agoI'll leave this here: https://news.ycombinator.com/item?id=3597347 https://news.ycombinator.com/item?id=3597347
- plg 13y agoI can't help think that if this were the 1970s and we were talking about the post office and phone company automatically forwarding copies of all communications to the us gov't, there would be riots in the streets. Oh how things have changed.
- Zigurd 13y agoWhen it was the 1970's and physical mail was opened, the Church Committee revealed illegal and untoward practices and prescribed reforms.
- edwardunknown 13y agoDevil's advocate, here: As long as it's restricted to terrorism investigations I don't care. If it stops bombs from going off go ahead and snoop through Facebook's database, big deal. If it ever trickles down to DEA or local police then it's a problem. If secret courts and SQL dumps become standard procedure then everything falls apart. If this is considered constitutional I don't know how you're going to tell Officer Shitforbrains he can't look at your phone records and Google search history to find out where you bought that joint.
- jlgreco 13y agoAre you really playing Devil's Advocate when you argue a position because you actually believe in it?
- edwardunknown 13y agoIt's more of a job title.
- jlgreco 13y agoYou being paid to post here? Wish I could say that I was surprised.
- edwardunknown 13y agoNo, geez. I just like to argue.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- bhauer 13y agoCan I cut out the middle-man and just use the NSA as my cloud provider?
- mtgx 13y ago> "In 2008, Congress gave the Justice Department authority to for a secret order from the Foreign Surveillance Intelligence Court to compel a reluctant company “to comply.”" One more reason FISA is one sick, disgusting piece of legislation, and it was just extended to 2017, last year - yet too many were dormant when all of it was going down.
- dragonwriter 13y ago> One more reason FISA is one sick, disgusting piece of legislation, and it was just extended to 2017, last year. I think you are confusing the nature of FISA -- a piece of legislation designed to constrain excessive executive domestic surveillance passed in the wake of widespread and highly politicized abuses by the Nixon Administration -- and recent amendments to FISA to expand the scope of allowed surveillance that were passed under the justification of the necessities of the "War on Terror".
- tn13 13y agoIt appears that both Democrats and Republicans have got their hands dirty in widening the police state that America is becoming day by day. From a higher perspective I assume this is just a symptom of what is wrong with the country.
- vijayboyapati 13y agoQuestion: At what point does the average statist admit that the libertarians (s)he has been belittling for so many years as tin-foil hat crackpots were far more savvy about the nature of the state than they were? Answer: never
- frisco 13y agoI think it's interesting to ask why these programs are so widely hated. These are national security assets: evidence gathered here will never be used in a drug case, or a tax evasion case. Why not? These tools exist for the bigger fish: the dozens of Soviet-era nuclear weapons believed to be missing, or the small amounts of dangerous pathogens that periodically vanish from research labs. These are what the government is worried about, and they're not going to risk revealing their methods for something lesser. Warren Buffet has predicted a major nuclear terrorist attack on an American city to be a "virtual certainty" given enough time. Ok, but no one here is going to argue that stopping terrorism is bad: the problem is in how we define terrorism. What happens when the definition becomes progressively wider? What counts as "terrorism" is political, after all. It's important to remember that we still have a functioning democracy. If you -- Hacker News reader -- decided to run for congress tomorrow, you might not win, but you won't be killed, sabotaged, or secretly blocked. While some individual politicans may be corrupt, the system broadly is not. These programs are enforcement mechanisms; the laws themselves are still made by the people, and maybe corporations. While we as a population may argue about social issues like gay marriage and abortion, our government is not fascist. Further, I take these programs as a great example that security is much harder to create than it is to destroy. Extreme efforts such as these may still be insufficient to prevent New York from being destroyed by terrorists. In that case, the acts of a few crazy people still overcame a monumental effort by the entire intelligence apparatus. What does that say about the time Hacker News is so afraid of, when it's more than only a few crazy people that the government is "worried about"? Should these programs exist? I don't know. I'm as worried as anyone about the scope creep. I'm willing to accept a level of inherent danger with living in a free society. However, do not forget that we can't see NSA success stories. I might be willing to accept a risk of periodic car bombs, which while tragic are not statistically significant; however, if PRISM is actually effective at tracing and intercepting Soviet nuclear weapons, I can see multiple sides of this issue. We have rights to privacy and protection from unreasonable search and seizure. Those rights were created to prevent unfair loss of life, liberty, and property. These programs, hidden in the background, don't inconvenience you, or lead to loss of freedom or property. Is privacy good? Of course. But the incentives the intelligence apparatus have to not use any data collected here against anyone for reasons less than "real" terrorism are strong enough, that I think it's not open-and-shut.
- deleted 13y ago[deleted]
- kevinalexbrown 13y agoI've lived under surveillance before, so I feel my perspective might be somewhat appropriate. I won't comment on the specifics (uninteresting and irrelevant, had to do with where I was living). I won't even make a statement about whether it's justified in my case or in general. I'd just ask everyone here to do one thing: Watch this, then ask yourself how you feel (if it doesn't go directly to 6:40, fastforward to it, then watch for 30 seconds): https://www.youtube.com/watch?v=QwiUVUJmGjs&feature=youtu.be&t=6m40s https://www.youtube.com/watch?v=QwiUVUJmGjs&feature=yout... I understand about various interpretations of "collect", "intercept", "analyze", etc. Just watch the video, and ask yourself how you feel. Please know that I'm not telling you how to feel, just providing a small snippet of a conversation. Why do you feel that way, and what does that feeling say about you, or your society? Originally found in a comment: https://news.ycombinator.com/item?id=5835025 https://news.ycombinator.com/item?id=5835025
- mtoddh 13y agoAnd my guess is the following video is an example of why the NYT is now saying that Obama no longer has any credibility on this issue: http://www.youtube.com/watch?v=B6fnfVJzZT4 http://www.youtube.com/watch?v=B6fnfVJzZT4
- rdl 13y agoI would have voted for that guy (except for "FISA works!", but enh). I'd even be ok with ditching the 22nd if we could get that guy as President. I wonder what happened -- was it all a cynical ploy, or was there some secret (real or fake) information about how without wholesale monitoring we'd all instantly be destroyed, or what.
- volandovengo 13y agoIf you are interested in looking into this more, I highly recommend the documentary which is coming out called terms and conditions may apply. It explores how companies are giving this information to the govt willingly + it is stated in their terms and conditions. This is the trailer: https://vimeo.com/57182041 https://vimeo.com/57182041
- blantonl 13y agoDropbox coming soon? Dropbox better come out ASAP with a formal response to this. But honestly, it might not even matter because if the NSA has targeted Dropbox, any betting man would say that it is already part of the problem. Ugh...
- hga 13y agoIf Dropbox is handed a National Security Letter (NSL), unless they want to go to Federal prison their people have no choice but to lie about it. Look at some of the discussions where these companies' carefully worded denials are parsed, they aren't really denying it. E.g. "back doors" aren't an issue when a NSL is used to come through the front door.
- drivebyacct2 13y agoI have a simple question: If you're a terrorist, why would you use any of these pre-built services? There are so many ways to do point-to-point, encrypted at both ends... I guess when I hear "Dragnet"... the only people I see getting swept into it is innocent people and really, really, really stupid terrorists.
- conroe64 13y agoIt's really hard not to leak information. This is just a guess, but if they see you doing something they don't like but can't decrypt, they can check their huge PRISM database for your ip. Even if you do a good job at hiding who you are, communication outside of the encrypted channel you are using might reveal yourself. Also they have their hooks in Microsoft and Apple. It stands to reason that means a backdoor in each of the operating systems, as well. You'd have to really be paranoid to avoid this. Using an opensource OS find an open access point, with no surveillance cameras anywhere, use it only for your encrypted communication and nothing else, and then leave and never come back. And obviously, don't bring a cellphone with you. Considering this was top secret, I would bet that a lot of persons of interest didn't know about PRISM either, making it a lot harder to realize that they fucked up.
- conroe64 13y agoIt's really hard not to leak information. This is just a guess, but if they see you doing something they don't like but can't decrypt, they can check their huge PRISM database for your ip. Even if you do a good job at hiding who you are, communication outside of the encrypted channel you are using might reveal yourself. Also they have their hooks in Microsoft and Apple. It stands to reason that means a backdoor in each of the operating systems, as well. You'd have to really be paranoid to avoid this. Using an opensource OS find an open access point, with no surveillance cameras anywhere, use it only for your encrypted communication and nothing else, and then leave and never come back. And obviously, don't bring a cellphone with you. Considering this was top secret, I would bet that a lot of persons of interest didn't know about PRISM either, making it a lot harder to realize that they fucked up.
- quackerhacker 13y agoI am convicted hacker that got caught through the patriot act (which was to catch terrorists)[0]. The biggest two lessons I learned from what I did was..1) if I can't tell someone what I'm doing it's probably wrong (I was 19 when I hacked Google, Etrade, and Schwab and thought it was ok)...and 2) if I have nothing to hide, then I shouldn't care to use the internet. All this is really is confirmation more than a discovery. [0] http://www.wired.com/threatlevel/2008/05/man-allegedly-b/ http://www.wired.com/threatlevel/2008/05/man-allegedly-b/
- greedo 13y agoThe "I have nothing to hide" meme needs to die with a stake through the heart, garlic wrapped around it's neck, and with a gallon of holy water poured over it.
- jonknee 13y agoThe odds are very high that users on HN have helped implement these systems. The more we know about how it works and what can be done to stay secure would be of upmost interest...
- ANH 13y agoInteresting to note that Apple held out until after Steve Jobs' death.
- ANH 13y agoAccording to the timeline in the presentation, Apple was the last to cave. It happened after Steve Jobs' died.
- joshe 13y agoApple was pretty late (Oct 2012) and I wonder if Jobs was a hold up, it's a full year after his death (Oct 2011). Google, sadly, came on board very early (2009).
- juliancox 13y agobomb fertilizer 9/11 As a Kiwi it saddens me that the US and (and to some extent) NZ are descending into the style of government they proclaim to defend the world from. If they are going to spy on their own citizens, why not protest by giving them something to spy on and hopefully increase their work load to something unmanageable. I propose peppering every phone call, email comment etc with some choice trigger words of the day Al Queda. Perhaps some hacker could come up with a plugin to do it automatically for us? C4 semtex
- Myrmornis 13y agoGood idea. A similar plan would be that everyone starts a pen pal relationship with someone in Iran, Afganistan, Yemen, Gaza or somewhere similarly likely to attract attention and we send weekly emails and texts to them. If enough people do that it could be an annoyance for the spies. It would also be a good thing to do.
- caycep 13y agoLooking at all the spiffy official "Top Secret" warnings on top of all the slides, it seems that maybe this ties into previous WaPo stories about the "top secret" spying mentality in the Mil-Ind-Complex since 9/11. The top spooks tried to get an account of all the "top secret" programs and clearances going on in all the intelligence/law enforcement agencies and found that there were so many that were shielded away from oversight that it was impossible to get an accounting of everything the government was up to.
- shaaaaawn 13y agoSo knowing how audacious of a undertaking this would be I'm a bit skeptical that the Tech companies complied. No one keeps a secret this big for this long, plus some of these companies actually do care about privacy and are rather open about their government requests for data. It seems more feasible that the ISP's are cooperating (the Guardian article states they rely on compliance of ISPs). The government and ISP's/telecoms have a long history of cooperation in regards to surveillance. Wouldn't it be feasible for the government to sniff traffic to/from these companies central servers with help from ISP's? The data would be encrypted, but we already know the NSA can quickly break the most common encryption methods employed by these companies. (http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/all/1 http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/al...) From there who knows who they rebuild or aggregate the data, but this seems more likely/feasible than trying to strong arm companies into back doors. Also makes the program scalable. Regardless this is ridiculous.
- sweedy 13y agoyou guys all knew about the surveillance sinse the eary 90´s, and i dont mean all the non tech guys, i mean you.It was all about the foreigners, so you dont care. Echelon was all about the non-american, so nobody cares at all. My sympathy now for you is so close to zero, like same sympathy you have shown in the past
- caycep 13y agothink of all the bitcoins you could mine in that Utah facility. Satoshi Nakamoto - are you in there?
- danbruc 13y agoIt would be so dead simple to do it right - just ask the people if they are willing to accept a certain amount of surveillance for more safety or if they are willing to take the additional risk but keep their privacy. And everybody could live happily.
- joewee 13y agoPeople fail to understand PRISM, companies don't have to GIVE data, they can give security keys which allow data to be intercepted.
- dschiptsov 13y agoWhy so much cries? As long as operators has all kind of logs anyway (location, calls, IP sessions) it is only matter of time that authorities will use it with this or that pretext. In countries like Russia where police and intelligence services have unlimited power, every provider is obliged to collect and keep such logs for use of authorities. The first thing that authorities around the globe are copying from each other is any kind of scam that gives them even an illusion of more "control" over the people. Why should it be different in US?) And of course, such programs are great opportunities to allocate and "utilize" (read: steal) millions of government money.
- ANH 13y agoA depressing historical fact: The FISA Court that for the past decade has been warped into a protective shield for these sorts of operations was established in 1978 to prevent this from happening again. See: Project SHAMROCK, http://en.wikipedia.org/wiki/Project_SHAMROCK http://en.wikipedia.org/wiki/Project_SHAMROCK. There was a time when those in the Intelligence Community had this lesson burned into their brains.
- deleted 13y ago[deleted]
- charlieok 13y agoSuddenly a phone conversation is looking like the most private way to communicate (short of self-hosting, encrypting, and being an all-around crypto-anarchist). At least then it's apparently just the “metadata”.
- jmh42 13y agoDoes anyone know how much the Gov't agencies pay for this data? I'm guessing here, but it seems logical. There must be some kind of economic benefit for Facebook, Google, AT&T, Verizon, etc. to save and provide this data. Perhaps they even help organize it for the "requesting entities".
- cwhittle 13y agoI think we all hoped it wouldn't happen but knew it would.
- gridmaths 13y agoHow about some kind of non-violent mass protest, it worked for sopa? A million geeks have quite a lot of power, if its focused at one point in time. What would be the most effective form of protest? Examples : Everyone call random phone number on their mobile phones at exactly the same time "Hi, Im your friendly geek, just wanted you to know this conversation is being monitored" Everyone use TOR for one week. Everyone tweet "You are being spied on by the US government" at the same time ? Basically the protest needs to drive home the massive swell of opposition on the issue - so that both sides of the house see it as a political survival necessity to reduce state sponsored surveillance.
- Myrmornis 13y agoHow about creating a website which allows us all to find a pen-friend in Iran, Gaza, Yemen, Afghanistan or wherever, and we send regular (e.g. weekly) communications to that person. It would be a good thing to do anyway.
- monkmartinez 13y agoChilling: William Binney in Dec 2012 http://www.youtube.com/watch?v=TuET0kpHoyM http://www.youtube.com/watch?v=TuET0kpHoyM … 20 to 30 trillion communications "stored" #Prism #NSA
- tantalor 13y agoIt's not very fair to call this "mining." Mining has a specific meaning, and implies you have general read access, which is not true in this case. They actually have very narrow, operational read access.
- wslh 13y agoIs someone implementing an NSA honeypot? like talking about bombings and terrorist attacks? I think is a good exercise to uncover this iniatives.
- gasull 13y agoWilliam Binney at the last HOPE conference talking about the NSA spying program: https://www.youtube.com/watch?v=hqN59beaFMI https://www.youtube.com/watch?v=hqN59beaFMI
- mgpetkov 13y ago"They who can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." Benjamin Franklin
- Myrmornis 13y agoAre the Guardian and Washington Post going to explain why their "PRISM" slides are different? (Guardian has no arrow head, and red rectangle behind logo in upper right)
- dragonwriter 13y agoProbably not; it suggests that they were separate leaks of different versions of the same presentation.
- conroe64 13y agoWhat bothers me is that Apple and Microsoft have both been cooperative. It's not much of a leap to think that the NSA has a backdoor into Windows, MacOS, and iOS now either.
- runjake 13y agoAn important thing to know here is how compartmentalization works. On one hand, it's to help limit classified information to those with a need-to-know. On the other hand, it's used to mislead oversight and limit the visible scope of an overall goal. So while it may be technically true that PRISM is only doing x, there may be a separate compartment (called, say FROGBUTT or whatever) that performs the sister role of y in support of PRISM. This is how intelligence agencies hide and mislead the public. They say "Yeah, we do have a program called FROGBUTT that collects call metadata, but we don't collect personal information or examine the contents of a call." What they don't mention is that they have another companion program called LIZARDDICK that does collect that accompanying personal information, and they have yet another program called COWBONG that collects the contents of calls. This is how this work. Plausible deniability, onion layers, confusion. Combine this with the fact they periodically change compartment program names, and it gets exponential. See also: RAGTIME, THINTHREAD, STELLAR WIND, TRAILBLAZER, etc
- marcamillion 13y agoSo...I am going to just go on the record and say it. I was an Obama supporter - both times. But this crap....is definitely impeachable. He blatantly made it sound nice, that we wouldn't sacrifice liberty for security and all this stuff. But then all of these revelations - are you kidding me. Someone has to pay - or many have to pay. This is disgusting man.
- marcamillion 13y ago> Dropbox, the cloud storage and synchronization service, is described as “coming soon.” WTF....I don't know why I am surprised by this - but if they get access to Dropbox....wow. I had let my guard down, but this is just crazy - that there would be nothing I could do to stop it....save for not using Dropbox. That's an annoying choice to make - but it's a relatively easy one.
- runn1ng 13y ago....I don't want to buy Google Glass anymore.
- w_t_payne 13y agoWell, I can confidently assume that the NSA has spied on me in the past, and I know exactly what dirt they have on me. I am just waiting to see if / when / how they use it.
- bsaul 13y agoIt's funny how people in the US hate government so much that they seem more outraged by a national agency collecting meta-data for antiterrorism purpose, than private company collecting content for ad targeting.
- hga 13y agoIn the previous century governments killed upwards of a quarter billion of their own people; I'm unaware of any even vaguely comparable mass murders by corporations.
- bsaul 13y agoWell, don't know how many people the tobacco industry killed those recent years, but that's got to be pretty big for someone who's not part of a war. One may also argue that a dictatorship pretty much makes a state work like a corporation : you don't have anything to say about the way the thing is run.
- neilkelty 13y agoHasn't this NSA stuff been pretty much public knowledge for years? Why are people acting like they've been had all of a sudden?
- manish_gill 13y agoQuestion to the more experienced hackers here: Would such a massive undertaking be possible without the knowledge of the regular developers working at these companies? Some big names on that list, like Facebook (and I think Dropbox was 'coming soon'). If developers at these companies knew about these measures, I'm really skeptical in believing that it took an intelligence officer to expose this story. Chances would be much higher of devs at these companies (chances being good that some of them are the reddit/HN libertarian types) would have exposed this long ago. Is such an operation feasible without the knowledge of hundreds of Google/facebook/other engineers?
- andrewmccall 13y agoI had the same question and it leads me to believe the companies saying they had no idea. Someone at Google/MS/Facebook would almost surely notice those extra servers over there, all that extra network traffic going somewhere, or those cables that seem to go into a locked closet. I think it's far more likely this is built off the back of the data they're already known to be sucking down via major exchanges. A national security letter for the TLS certs and you can take what you want, when you want off straight from the stream of packets.
- cpursley 13y agoThis is no surprise to us libertarians.
- ywang0414 13y agoWhat's the big deal about this? If you have nothing to hide, then why worry about the government looking into your data?
- prasanthabr 13y agoWell, what concerns me most here is this: The US Government is in a spot wrt US citizens and US homeland, blanket surveillance on the rest of the world seems fair game. Sure, the law would not protect the 'aliens'. Concerned citizens should look at being aware of alternative tools that would minimize possibility of the US Gov eavesdropping, inadvertently or otherwise. Perhaps a system of opensource OSs, TOR logins and specially crafted logins, on pre-identified low risk networks. thoughts?