5 ms·

You claimed: Actually, going by 10-20 sites I'd put my money on spying on non-US Tier 1 provider traffic. If you really believe that, why do you think Bin

by bascule 13y ago

You claimed: Actually, going by 10-20 sites I'd put my money on spying on non-US Tier 1 provider traffic. If you really believe that, why do you think Binney risked his entire livelihood to reveal what he believed to be a domestic spying program?

jauer 13y ago
I don't need to think anything about Binney's motives to reason about the possible scope of surveillance on IP traffic. Based on what you'd have to do to capture foreign traffic as opposed to US traffic it makes sense that the Room 641A sites are intended to capture foreign traffic. All the public information supports this. There isn't any public disclosure of the type of infrastructure needed to comprehensively monitor US IP traffic. If they are trying to capture foreign IP traffic there would need to be a intercept device where the foreign network interconnects with the US networks and where cables land. Large foreign providers tend to have 20 or fewer IP POPs in the US clustered in the same places. Look at networks maps from Tata, ReTN, NTT, etc. You will see many of the same locations. To tap them you'd put a intercept site in Seattle, Bay Area, Chicago, Miami, New York, and Virginia. Maybe Atlanta & Texas. By the nature of the internet US traffic would get caught in that. E.g. ReTN had too much inbound traffic so they sold a college in Chicago some cheap outbound traffic. Now ReTN loses a router and their peering goes down so the bits to that college get hauled out to Europe and back. Bits just got captured. ThinThread (Binney's program) reportedly accounted for that and would mask US person PII pending a court order to decrypt it. The fact that Trailblazer doesn't mask PII is a issue, but both programs would have captured US person PII, the difference is the addition of a bureaucratic hoop that the current and past administration would order jumped in a heartbeat. It isn't like ThinThread required a FISA Judge to walk over with a crypto token and descramble the data. The nature of the problem means some US traffic will be caught but that does not make it a domestic spying program. Unlike many other countries with a domestic internet surveillance regime (Syria, Egypt, Iran just to name a few) the US does not mandate that traffic pass through the national carrier or otherwise limit connections within its borders. Syria can drop in a few Blue Coat boxes and catch everything. In the US you'd need thousands, if not tens of thousands of intercept devices -- one or more for every edge in the graph of ASs (http://www.caida.org/research/topology/as_core_network/ http://www.caida.org/research/topology/as_core_network/). It is not a insurmountable problem but it would take a act of Congress (likely challenged to the Supreme Court) and the cooperation of a lot of people to implement. It would not happen overnight or in secret. Now, US providers are required to support CALEA but that is targeted at individual subscribers and most manufacturer implementations aren't suited to wholesale spying. This isn't to say 641A sites couldn't work in hand with CALEA, just that it would be a bit more legit than "omg nsa taps all the wires". E.g. 641A could be watching traffic to/from a Jihadi site hosted in France without a court order under the Protect America Act of 2007. NSA notes someone from a US IP has been posting things that indicate radicalization. NSA passes it to FBI to check out. FBI gets a court order for a CALEA tap for the US IP. FBI sends order for tap to ISP. No wholesale tapping of US traffic is necessary. Of course in this example watching anything to/from the US without a FISA order is likely not kosher prior to PAA hence the warrantless surveillance controversy. When fearmongering over home-grown lone wolf terrorism get louder, that's when the real trouble starts (except they probably have all the info needed for that over the counter from TransUnion etc).
- bascule 13y ago
  So I'm confused: are you accusing William Binney of lying, or do you just think he doesn't understand Stellar Wind as well as you do? To reiterate: William Binney's allegations are that the NSA had the opportunity to intercept (and I mean in the Webster's sense, not the USSID 18 sense) only foreign traffic by putting these taps specifically on fiber entering the country, but they elected to spy on domestic traffic anyway. And what are your credentials, exactly? Did you work for the NSA? Is there some reason I should believe you over an NSA whistleblower? As far as I can tell you're just guessing, and your guesses disagree with someone with insider knowledge.
  - jauer 13y ago
    I'm doing neither. I'm saying that nothing Binney has said or that has been leaked thus far shows evidence of a program that is designed to comprehensively intercept internet traffic between US persons and that doing so covertly is technically and politically impossible because of the number of intercept points required, not because they lack the software (we know it exists via Binney), or have a place to store it (they do-in Utah). Putting taps on undersea cables is risky. Cables are closely monitored and quite frequently are owned by multi-country consortiums so if you don't want a party to the consortium to find out you might not want to stick a tap in the landing station. Also, you might only care about public IP traffic and not want to see piles of corporate MPLS traffic. I'm not saying that's what happened, just that there are valid reasons why tapping fiber coming into the country wouldn't be desirable. It is entirely possible that you are claiming a "there exists" and I'm arguing against a "for every". I'm sure we both agree that there exists a NSA program that happens to intercept some US traffic. That's what Binney and others have claimed. I'm arguing that going beyond that isn't supported by the leaks OR the nature of the internet. I run operations at small regional Tier 2 ISP/transport provider with 25 provider edges on that AS graph that I mentioned before. I've personally installed, repaired, or inspected all cable and gear that 12 of those links traverse end to end and there weren't any secret spy boxes. So, no, I'm not just guessing. I can guarantee that quite a few people aren't having their bits snarfed wholesale when they email (local ISP mail to school mail), post on locally hosted community forums, or reserve a book at their local library. My network may be too small to matter, but any comprehensive intercept regime would require myself and every other Tier 2 (transit + unpaid peering) ISP to cooperate.

by bascule 13y ago

jauer 13y ago

I don't need to think anything about Binney's motives to reason about the possible scope of surveillance on IP traffic. Based on what you'd have to do to capture foreign traffic as opposed to US traffic it makes sense that the Room 641A sites are intended to capture foreign traffic. All the public information supports this. There isn't any public disclosure of the type of infrastructure needed to comprehensively monitor US IP traffic. If they are trying to capture foreign IP traffic there would need to be a intercept device where the foreign network interconnects with the US networks and where cables land. Large foreign providers tend to have 20 or fewer IP POPs in the US clustered in the same places. Look at networks maps from Tata, ReTN, NTT, etc. You will see many of the same locations. To tap them you'd put a intercept site in Seattle, Bay Area, Chicago, Miami, New York, and Virginia. Maybe Atlanta & Texas. By the nature of the internet US traffic would get caught in that. E.g. ReTN had too much inbound traffic so they sold a college in Chicago some cheap outbound traffic. Now ReTN loses a router and their peering goes down so the bits to that college get hauled out to Europe and back. Bits just got captured. ThinThread (Binney's program) reportedly accounted for that and would mask US person PII pending a court order to decrypt it. The fact that Trailblazer doesn't mask PII is a issue, but both programs would have captured US person PII, the difference is the addition of a bureaucratic hoop that the current and past administration would order jumped in a heartbeat. It isn't like ThinThread required a FISA Judge to walk over with a crypto token and descramble the data. The nature of the problem means some US traffic will be caught but that does not make it a domestic spying program. Unlike many other countries with a domestic internet surveillance regime (Syria, Egypt, Iran just to name a few) the US does not mandate that traffic pass through the national carrier or otherwise limit connections within its borders. Syria can drop in a few Blue Coat boxes and catch everything. In the US you'd need thousands, if not tens of thousands of intercept devices -- one or more for every edge in the graph of ASs (http://www.caida.org/research/topology/as_core_network/ http://www.caida.org/research/topology/as_core_network/). It is not a insurmountable problem but it would take a act of Congress (likely challenged to the Supreme Court) and the cooperation of a lot of people to implement. It would not happen overnight or in secret. Now, US providers are required to support CALEA but that is targeted at individual subscribers and most manufacturer implementations aren't suited to wholesale spying. This isn't to say 641A sites couldn't work in hand with CALEA, just that it would be a bit more legit than "omg nsa taps all the wires". E.g. 641A could be watching traffic to/from a Jihadi site hosted in France without a court order under the Protect America Act of 2007. NSA notes someone from a US IP has been posting things that indicate radicalization. NSA passes it to FBI to check out. FBI gets a court order for a CALEA tap for the US IP. FBI sends order for tap to ISP. No wholesale tapping of US traffic is necessary. Of course in this example watching anything to/from the US without a FISA order is likely not kosher prior to PAA hence the warrantless surveillance controversy. When fearmongering over home-grown lone wolf terrorism get louder, that's when the real trouble starts (except they probably have all the info needed for that over the counter from TransUnion etc).

bascule 13y ago
So I'm confused: are you accusing William Binney of lying, or do you just think he doesn't understand Stellar Wind as well as you do? To reiterate: William Binney's allegations are that the NSA had the opportunity to intercept (and I mean in the Webster's sense, not the USSID 18 sense) only foreign traffic by putting these taps specifically on fiber entering the country, but they elected to spy on domestic traffic anyway. And what are your credentials, exactly? Did you work for the NSA? Is there some reason I should believe you over an NSA whistleblower? As far as I can tell you're just guessing, and your guesses disagree with someone with insider knowledge.
- jauer 13y ago
  I'm doing neither. I'm saying that nothing Binney has said or that has been leaked thus far shows evidence of a program that is designed to comprehensively intercept internet traffic between US persons and that doing so covertly is technically and politically impossible because of the number of intercept points required, not because they lack the software (we know it exists via Binney), or have a place to store it (they do-in Utah). Putting taps on undersea cables is risky. Cables are closely monitored and quite frequently are owned by multi-country consortiums so if you don't want a party to the consortium to find out you might not want to stick a tap in the landing station. Also, you might only care about public IP traffic and not want to see piles of corporate MPLS traffic. I'm not saying that's what happened, just that there are valid reasons why tapping fiber coming into the country wouldn't be desirable. It is entirely possible that you are claiming a "there exists" and I'm arguing against a "for every". I'm sure we both agree that there exists a NSA program that happens to intercept some US traffic. That's what Binney and others have claimed. I'm arguing that going beyond that isn't supported by the leaks OR the nature of the internet. I run operations at small regional Tier 2 ISP/transport provider with 25 provider edges on that AS graph that I mentioned before. I've personally installed, repaired, or inspected all cable and gear that 12 of those links traverse end to end and there weren't any secret spy boxes. So, no, I'm not just guessing. I can guarantee that quite a few people aren't having their bits snarfed wholesale when they email (local ISP mail to school mail), post on locally hosted community forums, or reserve a book at their local library. My network may be too small to matter, but any comprehensive intercept regime would require myself and every other Tier 2 (transit + unpaid peering) ISP to cooperate.