15 ms·

Mark Zuckerberg addresses PRISM

412 points by cbrsch 13y ago

WestCoastJustin 13y ago
I would like to believe these reports from Google [1] and Facebook [2], but someone is not telling the truth. There is evidence that directly contradicts their stories (i.e. The Guardian has verified the authenticity of the document, a 41-slide PowerPoint presentation – classified as top secret with no distribution to foreign allies – which was apparently used to train intelligence operatives on the capabilities of the program. The document claims "collection directly from the servers" of major US service providers. [3]). Who are we to believe? [1] http://googleblog.blogspot.ca/2013/06/what.html http://googleblog.blogspot.ca/2013/06/what.html [2] https://www.facebook.com/zuck/posts/10100828955847631 https://www.facebook.com/zuck/posts/10100828955847631 [3] http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n...
- chris_mahan 13y ago
  <sarcasm>That's the problem with you geeks: you need real evidence for everything. Can't you just have faith? Can't you learn to just believe?</sarcasm>
- soup10 13y ago
  The NSA have hooks in various data centers and internet backbones. They collect the intel indirectly giving the companies plausible deniability.
  - uh_oh 13y ago
    Yes, but how would they do this exactly? To collect anything valuable from Google they would need to MITM SSL on a large scale. And Chrome actually ships with a list of pinned certificates, including those for Google, making it difficult to MITM even for the government.
    - deno 13y ago
      They wouldn’t do that, obviously, even if it was actually feasible. That kind of MITM would be easily detectable (though still effective, in short term)—we know when the Chinese do it. However the private keys have to deployed, on scale. So if as someone here is suggesting the NSA has infiltrated those companies, they could have got those keys and just decrypt the stream. I wouldn’t bet my money on that… but it’s more likely than breaking the encryption, and if they can get military secrets, I guess they could get the keys. Also those companies could have just volunteered them—that’s where the emphasis on ‘direct’ access comes in.
      - uh_oh 13y ago
        My understanding is that MITM (but in a perfect way, using the leaked private key) is still required, if ephemeral Diffie-Hellman is involved. You can't just passively record the stream and decrypt it, since you don't know the exchanged DH secret. The suggestion that the companies actually gave them the keys and this explains the "direct access" phrase makes a lot of sense!
  - UnoriginalGuy 13y ago
    Right. But if you look at the slide why would companies slowly get "added" rather than just implicitly be being spied upon? I mean Apple only got added in 2011. If what you're saying is true then what does this date refer to?
    - dragonwriter 13y ago
      > But if you look at the slide why would companies slowly get "added" rather than just implicitly be being spied upon? Well, if they are intercepting data through backbones, and much of that data is encrypted, they need to defeat the encryption in a durable way to get a clear feed. While I don't suggest that this is what was going on, if it was, there would be know reason that each provider would necessarily be broken at the same time; there would likely both be prioritization of resources directed at each provider, differences in the security of each provider, and chance involved as to when each was broken.
    - Cthulhu_ 13y ago
      > I mean Apple only got added in 2011. If what you're saying is true then what does this date refer to? Growing popularity and usage of icloud and apple's own messaging system? iirc, before icloud, Apple didn't have that much user data.
    - bbbbbaaaaa 13y ago
      iMessage debuted in 2011.
- asperous 13y ago
  Maybe the government conspiracy is a government conspiracy!
- skinnynerd 13y ago
  And Obama came out to defend the program without saying that the companies were not involved (he did not say they were involved either) His press conference: http://www.youtube.com/watch?feature=player_embedded&v=iS6MOvLGpCQ http://www.youtube.com/watch?feature=player_embedded&v=iS6MO...
- Achshar 13y ago
  Exactly why is no company addressing the fact that the government already accepted the program's existence and the fact that they snoop emails/communications. How can the program exist and take data and these companies not giving the data at the same time? Other explanations include... * Data is not, as everyone seems to keep saying, "direct access" and either first sent to NSA servers or a copy is sent periodically. * Companies don't know and NSA is unlawfully getting data (unlikely). * Companies are being forced to not talk about it and outright deny it. * There is somehow a plausible deniability. The are not willingly giving up the data but they aren't stopping them from taking it either and just turning a blind eye to NSA's activities.
- btilly 13y ago
  There is no contradiction if you accept the suggestion from http://financialcryptography.com/mt/archives/001431.html http://financialcryptography.com/mt/archives/001431.html that the NSA got access to this information by planting moles at target companies who then created back doors for the NSA to use. This would be reasonably easy for the NSA to do, relatively hard for companies to catch, and perfectly explains all published facts.
  - jlgreco 13y ago
    How are NSLs addressed? I assume to the CEO, but what if one was sent to a departmental VP? Would that VP be permitted, by the NSL, to inform the CEO that the letter had been received? For that matter, who is the CEO authorized to tell if the CEO got the letter. Obviously they have to be authorized to tell at least enough employees to actually implement the demand.
    - btilly 13y ago
      Google's statement was strong enough to rule out the possibility that either the CEO or chief legal counsel was aware of the existence of NSLs or warrants that are nearly as broad as what Verizon received. Therefore, while they can't say one way or the other whether they receive NSLs, it is a safe inference that Google has not received broad NSLs.
      - jlgreco 13y ago
        Yeah, I'm wondering if "someone down the chain in Gmail got NSL'd" is a possibility or not. I'm not familiar with Google's org chart nor do I know if NSLs are even flexible enough to accomplish such a thing. If it is possible though, there could perhaps be an NSL that covers "just gmail" that is otherwise as broad as the Verizon one. The notion that a CEO could be unaware of something like that happening is incredibly disturbing though. I hope that is not possible.
        benmmurphy 13y ago
        I assume they can but it would be a risky strategy. If google security found a breach where customer data was being leaked then they might disclose publicly before they can be informed that it is a national security issue.
- nolok 13y ago
  To quote myself in another message, > I've never taken a single lesson in legal or PR and even I can see the big huge holes. They insist on direct access, they insist on servers rather than data and they insist on governments.
  - masterzora 13y ago
    Anything else would be simply untrue. These companies obviously give limited data (not server access, not direct) to the government when required by subpoena and whatnot so they couldn't say "we give no access to any data" or anything like that.
- danso 13y ago
  One thing that has bothered me is that neither the Guardian or the Washington Post (someone kindly post the link if I've missed it) has posted more than just a few slides of this 41-slide presentation. I understand the leaker may want as few of slides as possible shown due to the danger of them being watermarked, but the few slides posted so far alone seem to lack important context. Secondly, in defense of the companies, at least Google and Facebook, they've put up real people (Zuckerberg and Page) behind these assertions. In the case of the leaker, we just know that he/she is a career intelligence official...which could mean many things. No, I'm not saying that leakers should be distrusted until they identify themselves...I'm saying when the evidence that the leaker has given is heavily redacted, then it's hard to know what assertions the responding companies have to actually lie about. In other words, it could be the case that we shouldn't believe anyone so far.
  - btilly 13y ago
    Implicit confirmation that the programs described in the press are real and as described goes all of the way to Obama himself. For example he responded to a reporter today by saying, "With respect to the Internet and emails, this does not apply to U.S. citizens and it does not apply to people living in the United States." If the programs were not as described, Obama would have certainly said so. Instead he confirmed their existence without disagreeing with what was said in the Washington Post about it. Given that, there is good reason to believe the substance of the leak, even though we don't know who leaked it or exactly what is in that presentation.
    - danso 13y ago
      FWIW, here's the press conference referred to, and here's the question: > Q Mr. President, could you please react to the reports of secret government surveillance of phones and Internet? And can you also assure Americans that the government -- your government doesn't have some massive secret database of all their personal online information and activities? THE PRESIDENT: Yes. When I came into this office, I made two commitments that are more important than any commitment I made: Number one, to keep the American people safe; and number two, to uphold the Constitution. And that includes what I consider to be a constitutional right to privacy and an observance of civil liberties. Now, the programs that have been discussed over the last couple days in the press are secret in the sense that they're classified. But they're not secret in the sense that when it comes to telephone calls, every member of Congress has been briefed on this program. With respect to all these programs, the relevant intelligence committees are fully briefed on these programs. These are programs that have been authorized by broad bipartisan majorities repeatedly since 2006. I'm not arguing against you, I'm saying that his statement is vague, and that it could just be a broad assertion of the executive powers. It doesn't matter whether the program is called PRISM or SUPERPATRIOT or what (in the president's reasoning), such surveillance measures have been legally approved and are regulated, if the government chooses to undertake such measures in the name of security. This is not the same as acknowledging that PRISM exists (which would put Google/Facebook's claims to the test).
fianchetto 13y ago
> Facebook is not and has never been part of any program to give the US or any other government direct access to our servers. Amazing how all them, to a company, are using the "direct access" phrase. Plausible deniability for the whole world to see along with the revelation of the biggest spying operation in history.
- skinnynerd 13y ago
  Maybe they all share the same lawyer /s
- jaydz 13y ago
  I agree, the funny thing is Obama already admitted the programs existence (WSJ article).
  - aniket_ray 13y ago
    The WSJ article was about NSA requesting CDRs from Verizon. This is not the same as having unrestricted access to private user data as the presentation titled PRISM claims. The strange thing is that just having a presentation is usually not enough for the HN crowd. If it would have been, I would never have to execute on any of my ideas beyond the presentation stage. Personally, I really don't think some making a presentation is really evidence of anything. I'm really not sure why HNers reacted differently in this instance though.
    - fianchetto 13y ago
      > I'm really not sure why HNers reacted differently in this instance though. Because the government has admitted it.
    - akiselev 13y ago
      Sorry, kind of have to throw "benefit of the doubt" out the window when dealing with "massive state-wide surveillance programs that have no transparent oversight."
- ig1 13y ago
SethMurphy 13y ago
Amazing how much Zuck's PRISM response was like Page's. Almost like the same people were telling them what to say.
- systematical 13y ago
  Felt the same way reading it.
- fchollet 13y ago
  Every single official corporate response in this story so far was formulated using the exact same terms, and did not constitute an actual, categorical denial of the claims. We have not giving "direct access". We are providing the government with our data through "legal channels".
  - ralfd 13y ago
    Like someone in the other thread about Pages blogpost asked: What could Zuck say more to convince you otherwise? He says explicitly Facebook is not providing information or metadata "in bulk", which seems to contradict the Guardian article ("direct access").
    - wooster 13y ago
      He says: We have never received a blanket request or court order from any government agency asking for information or metadata in bulk Not that they don't provide information in bulk. The next paragraph comes closer: When governments ask Facebook for data, we review each request carefully to make sure they always follow the correct processes and all applicable laws, and then only provide the information if is required by law. Which in an ungenerous reading leaves plenty of wiggle room. eg, "When governments ask", not "When governments order us". Personally, I believe Larry and Zuck, but the statements themselves are really weird.
- uh_oh 13y ago
  My thoughts exactly. And not just the content, but the vocabulary and the whole way the language is structured.
weakwire 13y ago
ok now... how Twitter's CEO will respond with 140 chars?
- jlgreco 13y ago
  Twitter may or may not be involved in this program or similar, but so far the documents released don't mention them. I wouldn't expect any sort of statement from them.
- rhizome 13y ago
  "Direct access 2 r servers: nope #prism #nsa"
  - onedev 13y ago
    hahahah perfect
    - weakwire 13y ago
      indeed !
- Achshar 13y ago
  Twitter seems unlikely because most of the data produced by twitter is public anyways. Only private communication is DM.
- asperous 13y ago
  Isn't all Twitter data public? They don't need to deny anything
  - camus 13y ago
    well , twitter doesnt publish your IP,your email or your social security number everytime you tweet ... so no , all its data is not public.
    - 13y ago
taylorbuley 13y ago
Note how similarly worded this response is to that posted by Larry Page: http://googleblog.blogspot.com/2013/06/what.html http://googleblog.blogspot.com/2013/06/what.html The cynic in me wants to believe the coincidence is because Facebook has equally good lawyers as Google.
- jlgreco 13y ago
  > The cynic in me wants to believe the coincidence is because Facebook has equally good lawyers as Google. The more cynical me wants to believe that Google has good lawyers and Facebook's lawyers, although perhaps as good, find it easier to plagiarize. :P
alan_cx 13y ago
Reads every much like google's statement. Heh, you'd think they had agreed it before hand.
beatpanda 13y ago
If I were covering this story my first move would be to figure out who wrote the boilerplate version of the press release being used by all these tech companies.
kjackson2012 13y ago
It's so creepy how Zuckerberg and Page, as well as every other CEO's responses are worded exactly the same. The same goes for Apple too. It's entirely not believable that everyone's answers would sound so similar.
- drhayes9 13y ago
  Makes sense to me: they can't say the government has no access to their servers because, of course, the US courts could compel access to their servers. They're US companies. But a running process or piece of hardware sitting in their DC sniffing traffic? No. That's what I think they're saying, at any rate. EDIT: One plausible explanation for why everyone keeps using the phrase "direct access" is because it appears in the Guardian story as the first sentence: http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n...
  - CoryG89 13y ago
    It's not just using the phrase 'direct access'. Anyone with half a brain knows that all these CEOs could not have released this responses that are so exactly the same except for choice of words independently. There has to be some explanation, whether it is completely innocent, or otherwise, is the question for me.
    - dtf 13y ago
      One explanation is a coordinated call for transparency. The last paragraph certainly has greater weight when sung in chorus. If you look at the releases of the EFF and Google over the last 48 hours there seems to be a growing plea for this.
    - drhayes9 13y ago
      I guess anyone with half a brain would hire a really good legal team that would probably arrive at the optimum initial salvo in a lawsuit defense: * No direct access. * Never heard of Prism. * We review each request. * We want more government transparency. Edit: Formatted the list.
sdoowpilihp 13y ago
I am sure that it's just a consequence of lawyers using their distinct brand of wording that leads to every single one of these denials from various CEO's and PR teams looking almost verbatim, but I do have to admit, the similarity in wording is disconcerting.
jarcoal 13y ago
These comments read just like the ones on the Larry Page thread! It's almost like someone is telling HN readers what to say...
- EGreg 13y ago
  There is a comment just like yours on the other page. Who are you? :P
cheald 13y ago
It is eerie how similarly worded Zuckerberg and Page's denials are.
kilroy123 13y ago
Something fishy is going on... the same message, same exact words being used. I'm thinking all these companies are legally being forced to give up data and provide direct access to some kind of third party company, which in turn works with the NSA. It's pretty clear Google, facebook, apple, etc. can't just come out and say they're doing this. They're choosing their words very carefully.
dkulchenko 13y ago
Look at the two writeups (Zuckerberg's and Page's) side by side. Each has 4 paragraphs. Each of the pairs of paragraphs addresses the same thing. 1st paragraph: we wanted to respond to these claims. 2nd paragraph: never heard of PRISM, don't give direct access. 3rd paragraph: each request goes through legal channels. 4th paragraph: encourage governments to be more transparent. Terrifying. EDIT: It gets worse. Here's Apple: "We have never heard of PRISM. We do not provide any government agency with direct access to our servers, and any government agency requesting customer data must get a court order." Here's Paltalk: "We have not heard of PRISM. Paltalk exercises extreme care to protect and secure users’ data, only responding to court orders as required to by law. Paltalk does not provide any government agency with direct access to its servers.” Here's AOL: "We do not have any knowledge of the PRISM program. We do not disclose user information to government agencies without a court order, subpoena or formal legal process, nor do we provide any government agency with access to our servers." And here's Yahoo: "We do not provide the government with direct access to our servers, systems, or network." Microsoft refused to issue a direct denial of involvement in PRISM.
- austenallred 13y ago
  Isn't a possibility just that they are using the same PR template, or that one looked at the other as they were responding? They are remarkably similar, but if you were the PR person at a company isn't that exactly what you would say as well?
- cjensen 13y ago
  Could Zuckerberg's statement have been "inspired" by Google's? Did any other companies release similar statements?
  - anthonycerra 13y ago
    In college, after we'd submit a programming assignment, our code was run through a program to test for plagiarism of another student's code. Can we run the same analysis on these announcements?
    - 13y ago
deleted 13y ago
[deleted]
- deleted 13y ago
  [deleted]
daniel-cussen 13y ago
"Yeah so if you ever need info about anyone at Harvard. Just ask. I have over 4,000 emails, pictures, addresses, SNS." Asked how, he responds: "People just submitted it. I don't know why. They 'trust me.' Dumb fucks." http://www.newser.com/story/88716/zuckerberg-once-mocked-dumb-users-over-trust.html http://www.newser.com/story/88716/zuckerberg-once-mocked-dum...
nolok 13y ago
> to give the US or any other government direct access to our servers "to give the US, or any other government, or any third party intermediary, direct or indirect access to our servers or our users' data" I mean come on, I've never taken a single lesson in legal or PR and even I can see the big huge holes. They insist on direct access, they insist on servers rather than data and they insist on governments. And that's not even taking into account the fact that most of those sentences are the same copy pasted text that we saw in Larry Page's message. If you want to make it sound like a personal message from the founder, maybe don't speak like a drone ...
brown9-2 13y ago
1. It would be nice if these statements defined "direct access to our servers". It's safe to guess that they are using the narrowest definition possible, meaning that a NSA employee can walk into the building that Facebook's servers are hosted in and log in to any server and run arbitrary commands. This is likely not what a layman's use of "direct access" would mean. The issue is whether or not the government can access whatever user data they wish provided the correct clearance or assertions. 2. "We hadn't even heard of PRISM before yesterday." Somehow I doubt that the National Security Agency is in the habit of telling companies that they work with the names they use for projects internally. 3. "we review each request carefully to make sure they always follow the correct processes and all applicable laws, and then only provide the information if is required by law. We will continue fighting aggressively to keep your information safe and secure." This doesn't preclude the idea that the government accesses more Facebook user data than the general public might realize under current law. Facebook can provide large volumes of info as the PRISM slides suggest if it is indeed lawful, and this statement would not be a lie. It hinges on what exactly is "required by law", or more precisely, what is allowed under the current interpretation of the law.
jpdoctor 13y ago
> Facebook is not and has never been part of any program to give the US or any other government direct access to our servers. > ... > When governments ask Facebook for data, we review each request carefully to make sure they always follow the correct processes and all applicable laws, and then only provide the information if is required by law. So no back door at FB, because the front door is open to secret courts signing the secret subpoenas to do secret things. Got it.
yid 13y ago
Hmm, what I'd like to hear is tech CEOs say "the NSA does not have the private key for our SSL certs." Beam splitters are a pretty cheap buy.
- voidlogic 13y ago
  this a thousand times
- thomasvendetta 13y ago
  I wish the people who have knowledge of implementing these things would come forward with a leak of some sort. Surely, somewhere their are citizens of this type, right?
- thomasvendetta 13y ago
  I wish the people who have knowledge of implementing these things would come forward with a leak of some sort. Surely, somewhere their are citizens of this type, right?
anthonycerra 13y ago
I still find it suspicious that the previous White House press secretary, Robert Gibbs, left the White House to work at Facebook. I realize that statement implies that no one from government can go into the private sector without it suddenly becoming a conspiracy theory, but in this particular case the link is especially concerning.
rglover 13y ago
This is a gun in the back response. Am I really supposed to believe the guy with an open index of almost every American hasn't in some way folded to the government. Ever? Sorry, Z.
pitchups 13y ago
It is remarkable how similar the two statements from Larry Page (LP) and Mark Zuckerberg (MZ) are below. The same responses worded slightly differently, and expressed in the same order: LP: "...we have not joined any program that would give the U.S. government—or any other government—direct access to our servers." MZ: "..Facebook is not and has never been part of any program to give the US or any other government direct access to our servers." LP: "... we provide user data to governments only in accordance with the law." MZ: "we... always follow the correct processes and all applicable laws." LP: "...we have long believed—there needs to be a more transparent approach." MZ: "We strongly encourage all governments to be much more transparent..." It almost looks like they are reading from a template or script!
- drsintoma 13y ago
  Let's not rule out the possibility that Zuckerberg saw Page's statement and sort of copy-pasted it.
CoryG89 13y ago
I believe, without a doubt, that both the Zuck response and the Page response were created from the same template or set of explanations. Unless all these CEOs met up together and decided how they would respond, then this seems very shady to me indeed.
marban 13y ago
Apple's response: We hadn't even heard of Microsoft, Yahoo, Google and Facebook before yesterday.
adrinavarro 13y ago
The keyword for me here is "direct". If PRISM is indeed a "prism", that is, a network-level dump, duplicate RAW of data, then there is no direct access involved.
skaevola 13y ago
http://www.theonion.com/video/cias-facebook-program-dramatically-cut-agencys-cos,19753&#x2F http://www.theonion.com/video/cias-facebook-program-dramatic...;
- mrwnmonm 13y ago
  The page you were looking for is not here.
realize 13y ago
If read the right way the responses could still allow for direct access to all their users data through a special API. Direct access to the server itself isn't necessary to get at all the data at will.
aantix 13y ago
With the creepy similarities, why do I get the feeling that it's these collective companies way of saying "Yes, they're monitoring you but we just can't say anything..."
frisco 13y ago
I'm now just confused. If I understand it correctly, the government has publicly acknowledged the program and tried to explain how it's "limited and legal," but extant nonetheless. Now the companies are all uniformly denying it. The options: - The companies are lying. - The government has infiltrated these companies and developed backdoor access the executive team is unaware of. - The government is intercepting traffic en-route and doesn't need cooperation of the companies. - The government is confused on their talking about about what they're confirming here and PRISM has been misinterpreted by the press. #1 is possible, but implies that there exists a National Security Letter-like mechanism that can coerce this kind of public behavior. I find that unlikely but certainly not impossible; that would definitely be a concerning outcome. I think #2 is unlikely. There's an interesting passage in the original Washington Post article, though, about how they want to be careful to protect the identities of the cooperating companies so as to not "damage their sources". A simple reading of this is that the companies might pull out if they're publicly exposed as cooperating. However, since they appear capable of coercing cooperating anyway, a slightly more tin-foil-hat reading is that their access is less straightforward than asking Page and Zuckerberg for help. #3 is probably happening regardless of whatever cooperation the companies are providing. However, if that's the extent of PRISM I think it says interesting things about the likelihood that RSA has fallen. Is that likely? I have no idea. It wouldn't be unprecedented compared to what the NSA and its predecessors have done historically, though. It's worth noting that the NSA hasn't approved asymmetric crypto for protecting classified data. (http://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography http://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography)
- randallu 13y ago
  #3 doesn't necessarily require breaking RSA, just TLS (via fake certificates or something else). Breaking RSA would be pretty interesting though.
  - qubitsam 13y ago
    SSL/TLS was broken once by breaking MD5. Now if the NSA can break SHA-1 using its numerous known weaknesses (there's a working attack on SHA-1 with 2^52 operations), they can pull off internet-wide MITMing. It's safe to assume the NSA can easily do way more than 2 petaflops, and they have an exaflop goal, and that would be enough to run known attacks against DES, factor 1024bit RSA moduli ... and if they can compromise just one root CA (which uses 1024bit RSA) they can issue valid certifications of their own and MITM everyone, and none would be the wiser. And all of this assuming the NSA relies on publicly known weaknesses in SSL/TLS. The matter of the fact is that they have very smart people with access to unlimited resources researching new vulns and actively exploiting them.
dbond 13y ago
About this direct access phrase, I read a post earlier today (linked from a comment on HN but can't find it now...) that described a hypothetical system offered by facebook to intelligence agencies, this system would allow the user to search for a person and then accept a EULA before being given access to personal information. If this system were to automate the submission and acceptance of a subpoena, would the system then be classed as having given indirect access through the correct "legal channels"?
downandout 13y ago
I have also been skeptical of the carefully worded releases, but looking at the PRISM slides more carefully just now, nothing on them necessarily indicates that the target companies actually know what is happening. Perhaps PRISM is based on partnering with backbone providers to suck data straight off the pipe, and the "Dates When PRISM Collection Began" refer to dates when they completed software to scope out information specifically destined for or leaving the services of each "provider". This is just a possibility - I tend to believe the companies are simply lying. But it is possible.
andyl 13y ago
Facebook: "We do not provide any government organization with direct access" Google: "the U.S. government does not have direct access" Apple: "We do not provide any government agency with direct access" Yahoo: "We do not provide the government with direct access" The consistency is amazing - do they all use the same law firm? Something stinks here.
- ralfd 13y ago
  What else should they say in your opinion?
- onedev 13y ago
  When the government asks them for access to data, they provide it ONLY THROUGH LEGAL MEANS ON A CASE BY CASE BASIS. That's what they mean by not providing direct access. The government can't just waltz into their front doors and just ask for the data of all the users. Nor does the government have straight access to the servers or databases. Hope you understand now.
deleted 13y ago
[deleted]
rwhitman 13y ago
Again notice the words "direct access". What about indirect access?
leoc 13y ago
Hm. At this point I think I'd set better than 50% odds that the PRISM Powerpoint is a fake. Which is not to say that there's nothing to it - there could be all sorts of things behind it (the phrase 'modified limited hangout' is one that springs to mind).
brokentone 13y ago
They're awfully precise about a limited set of things that did not happen.
themgt 13y ago
Anyone find it interesting that "direct access to servers" keeps being mentioned when PRISM could almost be an in-joke for the kind of beam-splitting tech they were already using in Room 641A (and elsewhere) - i.e. they're not touching servers, they're just siphoning off a perfect copy of all network traffic
edouard1234567 13y ago
Responses from Larry Page and Mark Zuckerberg are suspiciously very similar...
- aayala 13y ago
  indeed, very similar like a government script ...
suredo 13y ago
A leak from one of the companies involved would be nice.
EGreg 13y ago
And the plot gets thicker: http://www.theweek.co.uk/us/53475/white-house-admits-it-has-access-facebook-google http://www.theweek.co.uk/us/53475/white-house-admits-it-has-... What to make of this in light of the companies' chorus of denials?
outside1234 13y ago
are they playing with words? do they know about complete access to the network just short of their data center but are saying that they are not providing it?
lispm 13y ago
They are not allowed to tell anyone. So they tell a version which is totally flawed, so that everyone understands that the opposite is actually true.
swartz 13y ago
I really seems quite strange that the statement from both facebook and google CEO's are almost exactly same thing. If i didn't know better, i would say same person wrote them.
joering2 13y ago
> We will continue fighting aggressively to keep your information safe and secure. Is it only me, or is Mark implying that agreeing on every government request to provide data would make your information unsafe and insecure?
CyberDroiD 13y ago
I guess the question is: should governments have the same access as "social media platform sysops"? I would be surprised if they didn't.
mattbarrie 13y ago
"direct"
o0-0o 13y ago
The fact is, when you sign an agreement with the government like this you are given a 30+ page contract. Some items ALWAYS in the contract are: 1. If you are asked about it, you will deny it, and LIE about it. They actually tell you to lie. 2. If you break the contract you will be destroyed, and everyone you know will be destroyed. Ask a senior member of the military how this stuff works.
ownagefool 13y ago
Another possibility would be that PR works in fairly formulistic way. It might not be an exact science, but if asked to comment on such a subject, and you were innocent, I'm sure the following would be what you say: > I have no idea what you're talking about. > We only give access when absolutely necessary within the confines of the law. > We're on our customers side. Now some of the terms such as "direct access" are errily familiar, I'll give you that but the message being conveyed and the order it's formed woudn't be enough to suprised me on it's own and the guys working PR for these orgs are probably pretty inbred. Still, it is interesting.
mrwnmonm 13y ago
if it was direct access, didn't the years here differ - http://tctechcrunch2011.files.wordpress.com/2013/06/prism-slide-5.jpg http://tctechcrunch2011.files.wordpress.com/2013/06/prism-sl...
spydum 13y ago
If you want to go full conspiracy theorist, you might suggest the slide deck and capabilities were all a psy-ops tactic to persuade the real criminals to abandon using google,Facebook,apple, and all of the big corps who refused to freely hand over user data, and instead flee to smaller businesses that the government could much more easily coerce into participating...
ianmcgowan 13y ago
It does seem as though these companies are trying to signal something (a la cryptonomicon), by the repeated emphasis on direct. That's the part that is scary - as someone else pointed out, with the right SSL keys and a copy of the bytes flowing thru a limited number of NAP's, you don't need your grubby fingers in the google/facebook datacenters. The telcom's seem quite willing to roll over...
homosaur 13y ago
Why would you believe anything these guys have to say on this matter? For one, the government has clearly given them some kind of deniability. For two, if they were given orders under the National Security Letter program, they couldn't admit they had knowledge even if they did. I don't trust Zuckerberg, I don't trust Larry Page, hell, I wouldn't trust you either if you had to respond.
fakeer 13y ago
It's like: John Doe asks, "Hey Larry, did you let Zuck read my mail I wrote you last week?". Larry says, "No! He doesn't have my password or yours, right?" Joe persists and proves Zuck knows the contents of the email. Then Larry shrugs and says, "Well, I didn't give him access to your email, I gave him a print out when he asked for it".
deleted 13y ago
[deleted]
aayala 13y ago
So the CEO knows every technical detail of the IT infrastructure? that's awesome
drchiu 13y ago
Seriously. Anyone naive enough to believe that FB/Google/etc isn't involved?
aviraldg 13y ago
Political language is designed to make lies sound truthful and murder respectable, and to give an appearance of solidity to pure wind. - George Orwell
icodestuff 13y ago
Reading between the lines: > Facebook is not and has never been part of any program to give the US or any other government direct access to our servers. We have however set up a tap that mirrors all traffic to Facebook to NSA servers, and we've given them the certificate to decrypt that traffic. > We have never received a blanket request or court order from any government agency asking for information or metadata in bulk, like the one Verizon reportedly received. Instead, we were requested to provide our SSL certificate and to install some hardware in our data center. We never handed over any data ourselves. > And if we did, we would fight it aggressively. Too much work to provide all that data. Best to just give them a mirrored PHY stream. > We hadn't even heard of PRISM before yesterday. We didn't know _what_ the program was called; they never told us, specifically for plausible deniability reasons. > When governments ask Facebook for data, we review each request carefully to make sure they always follow the correct processes and all applicable laws, and then only provide the information if is required by law. Technically, they didn't ask for user data, they asked for a hardware interconnect and a private key. > We will continue fighting aggressively to keep your information safe and secure. Our lawyers made us say this. C'mon, we're Facebook, what do you expect? > We strongly encourage all governments to be much more transparent about all programs aimed at keeping the public safe. It's the only way to protect everyone's civil liberties and create the safe and free society we all want over the long term. Good God, what have we done?! We're under an NSL, can't you tell that, people?!
wangii 13y ago
1, They got same press release template. 2, they all give govt indirect access to the servers, e.g. ssh. 3, relax, we Chinese have had this since day 1. You think govt can really outsmart determined people?
bambax 13y ago
> ... create the safe and free society we all want over the long term I don't think you can have both. Freedom has to be paid for, and the only currency it'll take is blood. If we're unwilling to pay that price then I guess we won't have freedom. Also, I'm not sure I'd want freedom regulated by Facebook, where bare breast in centuries old paintings are forbidden or jokes have to pass a censoring committee.
nfm 13y ago
"We will continue fighting aggressively to keep your information safe and secure." - ...Facebook
bbwharris 13y ago
Here's one: neither zuckerberg nor page posted those responses. The NSA did. Once we all believe, the rabbit hole is an abyss.
Myrmornis 13y ago
Dear Mr Zuckerberg, Feel free to deny your company's involvement, but don't you fucking dare criticize the free press's reporting as "outrageous". Thanks.
washedup 13y ago
Sounds exactly like Google's response

412 points by cbrsch 13y ago

I would like to believe these reports from Google [1] and Facebook [2], but someone is not telling the truth. There is evidence that directly contradicts their stories (i.e. The Guardian has verified the authenticity of the document, a 41-slide PowerPoint presentation – classified as top secret with no distribution to foreign allies – which was apparently used to train intelligence operatives on the capabilities of the program. The document claims "collection directly from the servers" of major US service providers. [3]). Who are we to believe? [1] http://googleblog.blogspot.ca/2013/06/what.html http://googleblog.blogspot.ca/2013/06/what.html [2] https://www.facebook.com/zuck/posts/10100828955847631 https://www.facebook.com/zuck/posts/10100828955847631 [3] http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n...

chris_mahan 13y ago
<sarcasm>That's the problem with you geeks: you need real evidence for everything. Can't you just have faith? Can't you learn to just believe?</sarcasm>
soup10 13y ago
The NSA have hooks in various data centers and internet backbones. They collect the intel indirectly giving the companies plausible deniability.
- uh_oh 13y ago
  Yes, but how would they do this exactly? To collect anything valuable from Google they would need to MITM SSL on a large scale. And Chrome actually ships with a list of pinned certificates, including those for Google, making it difficult to MITM even for the government.
  - deno 13y ago
    They wouldn’t do that, obviously, even if it was actually feasible. That kind of MITM would be easily detectable (though still effective, in short term)—we know when the Chinese do it. However the private keys have to deployed, on scale. So if as someone here is suggesting the NSA has infiltrated those companies, they could have got those keys and just decrypt the stream. I wouldn’t bet my money on that… but it’s more likely than breaking the encryption, and if they can get military secrets, I guess they could get the keys. Also those companies could have just volunteered them—that’s where the emphasis on ‘direct’ access comes in.
    - uh_oh 13y ago
      My understanding is that MITM (but in a perfect way, using the leaked private key) is still required, if ephemeral Diffie-Hellman is involved. You can't just passively record the stream and decrypt it, since you don't know the exchanged DH secret. The suggestion that the companies actually gave them the keys and this explains the "direct access" phrase makes a lot of sense!
- UnoriginalGuy 13y ago
  Right. But if you look at the slide why would companies slowly get "added" rather than just implicitly be being spied upon? I mean Apple only got added in 2011. If what you're saying is true then what does this date refer to?
  - dragonwriter 13y ago
    > But if you look at the slide why would companies slowly get "added" rather than just implicitly be being spied upon? Well, if they are intercepting data through backbones, and much of that data is encrypted, they need to defeat the encryption in a durable way to get a clear feed. While I don't suggest that this is what was going on, if it was, there would be know reason that each provider would necessarily be broken at the same time; there would likely both be prioritization of resources directed at each provider, differences in the security of each provider, and chance involved as to when each was broken.
  - Cthulhu_ 13y ago
    > I mean Apple only got added in 2011. If what you're saying is true then what does this date refer to? Growing popularity and usage of icloud and apple's own messaging system? iirc, before icloud, Apple didn't have that much user data.
  - bbbbbaaaaa 13y ago
    iMessage debuted in 2011.
asperous 13y ago
Maybe the government conspiracy is a government conspiracy!
skinnynerd 13y ago
And Obama came out to defend the program without saying that the companies were not involved (he did not say they were involved either) His press conference: http://www.youtube.com/watch?feature=player_embedded&v=iS6MOvLGpCQ http://www.youtube.com/watch?feature=player_embedded&v=iS6MO...
Achshar 13y ago
Exactly why is no company addressing the fact that the government already accepted the program's existence and the fact that they snoop emails/communications. How can the program exist and take data and these companies not giving the data at the same time? Other explanations include... * Data is not, as everyone seems to keep saying, "direct access" and either first sent to NSA servers or a copy is sent periodically. * Companies don't know and NSA is unlawfully getting data (unlikely). * Companies are being forced to not talk about it and outright deny it. * There is somehow a plausible deniability. The are not willingly giving up the data but they aren't stopping them from taking it either and just turning a blind eye to NSA's activities.
btilly 13y ago
There is no contradiction if you accept the suggestion from http://financialcryptography.com/mt/archives/001431.html http://financialcryptography.com/mt/archives/001431.html that the NSA got access to this information by planting moles at target companies who then created back doors for the NSA to use. This would be reasonably easy for the NSA to do, relatively hard for companies to catch, and perfectly explains all published facts.
- jlgreco 13y ago
  How are NSLs addressed? I assume to the CEO, but what if one was sent to a departmental VP? Would that VP be permitted, by the NSL, to inform the CEO that the letter had been received? For that matter, who is the CEO authorized to tell if the CEO got the letter. Obviously they have to be authorized to tell at least enough employees to actually implement the demand.
  - btilly 13y ago
    Google's statement was strong enough to rule out the possibility that either the CEO or chief legal counsel was aware of the existence of NSLs or warrants that are nearly as broad as what Verizon received. Therefore, while they can't say one way or the other whether they receive NSLs, it is a safe inference that Google has not received broad NSLs.
    - jlgreco 13y ago
      Yeah, I'm wondering if "someone down the chain in Gmail got NSL'd" is a possibility or not. I'm not familiar with Google's org chart nor do I know if NSLs are even flexible enough to accomplish such a thing. If it is possible though, there could perhaps be an NSL that covers "just gmail" that is otherwise as broad as the Verizon one. The notion that a CEO could be unaware of something like that happening is incredibly disturbing though. I hope that is not possible.
      - benmmurphy 13y ago
        I assume they can but it would be a risky strategy. If google security found a breach where customer data was being leaked then they might disclose publicly before they can be informed that it is a national security issue.
nolok 13y ago
To quote myself in another message, > I've never taken a single lesson in legal or PR and even I can see the big huge holes. They insist on direct access, they insist on servers rather than data and they insist on governments.
- masterzora 13y ago
  Anything else would be simply untrue. These companies obviously give limited data (not server access, not direct) to the government when required by subpoena and whatnot so they couldn't say "we give no access to any data" or anything like that.
danso 13y ago
One thing that has bothered me is that neither the Guardian or the Washington Post (someone kindly post the link if I've missed it) has posted more than just a few slides of this 41-slide presentation. I understand the leaker may want as few of slides as possible shown due to the danger of them being watermarked, but the few slides posted so far alone seem to lack important context. Secondly, in defense of the companies, at least Google and Facebook, they've put up real people (Zuckerberg and Page) behind these assertions. In the case of the leaker, we just know that he/she is a career intelligence official...which could mean many things. No, I'm not saying that leakers should be distrusted until they identify themselves...I'm saying when the evidence that the leaker has given is heavily redacted, then it's hard to know what assertions the responding companies have to actually lie about. In other words, it could be the case that we shouldn't believe anyone so far.
- btilly 13y ago
  Implicit confirmation that the programs described in the press are real and as described goes all of the way to Obama himself. For example he responded to a reporter today by saying, "With respect to the Internet and emails, this does not apply to U.S. citizens and it does not apply to people living in the United States." If the programs were not as described, Obama would have certainly said so. Instead he confirmed their existence without disagreeing with what was said in the Washington Post about it. Given that, there is good reason to believe the substance of the leak, even though we don't know who leaked it or exactly what is in that presentation.
  - danso 13y ago
    FWIW, here's the press conference referred to, and here's the question: > Q Mr. President, could you please react to the reports of secret government surveillance of phones and Internet? And can you also assure Americans that the government -- your government doesn't have some massive secret database of all their personal online information and activities? THE PRESIDENT: Yes. When I came into this office, I made two commitments that are more important than any commitment I made: Number one, to keep the American people safe; and number two, to uphold the Constitution. And that includes what I consider to be a constitutional right to privacy and an observance of civil liberties. Now, the programs that have been discussed over the last couple days in the press are secret in the sense that they're classified. But they're not secret in the sense that when it comes to telephone calls, every member of Congress has been briefed on this program. With respect to all these programs, the relevant intelligence committees are fully briefed on these programs. These are programs that have been authorized by broad bipartisan majorities repeatedly since 2006. I'm not arguing against you, I'm saying that his statement is vague, and that it could just be a broad assertion of the executive powers. It doesn't matter whether the program is called PRISM or SUPERPATRIOT or what (in the president's reasoning), such surveillance measures have been legally approved and are regulated, if the government chooses to undertake such measures in the name of security. This is not the same as acknowledging that PRISM exists (which would put Google/Facebook's claims to the test).

fianchetto 13y ago

> Facebook is not and has never been part of any program to give the US or any other government direct access to our servers. Amazing how all them, to a company, are using the "direct access" phrase. Plausible deniability for the whole world to see along with the revelation of the biggest spying operation in history.

skinnynerd 13y ago
Maybe they all share the same lawyer /s
jaydz 13y ago
I agree, the funny thing is Obama already admitted the programs existence (WSJ article).
- aniket_ray 13y ago
  The WSJ article was about NSA requesting CDRs from Verizon. This is not the same as having unrestricted access to private user data as the presentation titled PRISM claims. The strange thing is that just having a presentation is usually not enough for the HN crowd. If it would have been, I would never have to execute on any of my ideas beyond the presentation stage. Personally, I really don't think some making a presentation is really evidence of anything. I'm really not sure why HNers reacted differently in this instance though.
  - fianchetto 13y ago
    > I'm really not sure why HNers reacted differently in this instance though. Because the government has admitted it.
  - akiselev 13y ago
    Sorry, kind of have to throw "benefit of the doubt" out the window when dealing with "massive state-wide surveillance programs that have no transparent oversight."
ig1 13y ago

SethMurphy 13y ago

Amazing how much Zuck's PRISM response was like Page's. Almost like the same people were telling them what to say.

systematical 13y ago
Felt the same way reading it.
fchollet 13y ago
Every single official corporate response in this story so far was formulated using the exact same terms, and did not constitute an actual, categorical denial of the claims. We have not giving "direct access". We are providing the government with our data through "legal channels".
- ralfd 13y ago
  Like someone in the other thread about Pages blogpost asked: What could Zuck say more to convince you otherwise? He says explicitly Facebook is not providing information or metadata "in bulk", which seems to contradict the Guardian article ("direct access").
  - wooster 13y ago
    He says: We have never received a blanket request or court order from any government agency asking for information or metadata in bulk Not that they don't provide information in bulk. The next paragraph comes closer: When governments ask Facebook for data, we review each request carefully to make sure they always follow the correct processes and all applicable laws, and then only provide the information if is required by law. Which in an ungenerous reading leaves plenty of wiggle room. eg, "When governments ask", not "When governments order us". Personally, I believe Larry and Zuck, but the statements themselves are really weird.
uh_oh 13y ago
My thoughts exactly. And not just the content, but the vocabulary and the whole way the language is structured.

weakwire 13y ago

ok now... how Twitter's CEO will respond with 140 chars?

jlgreco 13y ago
Twitter may or may not be involved in this program or similar, but so far the documents released don't mention them. I wouldn't expect any sort of statement from them.
rhizome 13y ago
"Direct access 2 r servers: nope #prism #nsa"
- onedev 13y ago
  hahahah perfect
  - weakwire 13y ago
    indeed !
Achshar 13y ago
Twitter seems unlikely because most of the data produced by twitter is public anyways. Only private communication is DM.
asperous 13y ago
Isn't all Twitter data public? They don't need to deny anything
- camus 13y ago
  well , twitter doesnt publish your IP,your email or your social security number everytime you tweet ... so no , all its data is not public.
  - 13y ago

taylorbuley 13y ago

Note how similarly worded this response is to that posted by Larry Page: http://googleblog.blogspot.com/2013/06/what.html http://googleblog.blogspot.com/2013/06/what.html The cynic in me wants to believe the coincidence is because Facebook has equally good lawyers as Google.

jlgreco 13y ago
> The cynic in me wants to believe the coincidence is because Facebook has equally good lawyers as Google. The more cynical me wants to believe that Google has good lawyers and Facebook's lawyers, although perhaps as good, find it easier to plagiarize. :P

alan_cx 13y ago

Reads every much like google's statement. Heh, you'd think they had agreed it before hand.

beatpanda 13y ago

If I were covering this story my first move would be to figure out who wrote the boilerplate version of the press release being used by all these tech companies.

kjackson2012 13y ago

It's so creepy how Zuckerberg and Page, as well as every other CEO's responses are worded exactly the same. The same goes for Apple too. It's entirely not believable that everyone's answers would sound so similar.

drhayes9 13y ago
Makes sense to me: they can't say the government has no access to their servers because, of course, the US courts could compel access to their servers. They're US companies. But a running process or piece of hardware sitting in their DC sniffing traffic? No. That's what I think they're saying, at any rate. EDIT: One plausible explanation for why everyone keeps using the phrase "direct access" is because it appears in the Guardian story as the first sentence: http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n...
- CoryG89 13y ago
  It's not just using the phrase 'direct access'. Anyone with half a brain knows that all these CEOs could not have released this responses that are so exactly the same except for choice of words independently. There has to be some explanation, whether it is completely innocent, or otherwise, is the question for me.
  - dtf 13y ago
    One explanation is a coordinated call for transparency. The last paragraph certainly has greater weight when sung in chorus. If you look at the releases of the EFF and Google over the last 48 hours there seems to be a growing plea for this.
  - drhayes9 13y ago
    I guess anyone with half a brain would hire a really good legal team that would probably arrive at the optimum initial salvo in a lawsuit defense: * No direct access. * Never heard of Prism. * We review each request. * We want more government transparency. Edit: Formatted the list.

sdoowpilihp 13y ago

I am sure that it's just a consequence of lawyers using their distinct brand of wording that leads to every single one of these denials from various CEO's and PR teams looking almost verbatim, but I do have to admit, the similarity in wording is disconcerting.

jarcoal 13y ago

These comments read just like the ones on the Larry Page thread! It's almost like someone is telling HN readers what to say...

EGreg 13y ago
There is a comment just like yours on the other page. Who are you? :P

cheald 13y ago

It is eerie how similarly worded Zuckerberg and Page's denials are.

kilroy123 13y ago

Something fishy is going on... the same message, same exact words being used. I'm thinking all these companies are legally being forced to give up data and provide direct access to some kind of third party company, which in turn works with the NSA. It's pretty clear Google, facebook, apple, etc. can't just come out and say they're doing this. They're choosing their words very carefully.

dkulchenko 13y ago

Look at the two writeups (Zuckerberg's and Page's) side by side. Each has 4 paragraphs. Each of the pairs of paragraphs addresses the same thing. 1st paragraph: we wanted to respond to these claims. 2nd paragraph: never heard of PRISM, don't give direct access. 3rd paragraph: each request goes through legal channels. 4th paragraph: encourage governments to be more transparent. Terrifying. EDIT: It gets worse. Here's Apple: "We have never heard of PRISM. We do not provide any government agency with direct access to our servers, and any government agency requesting customer data must get a court order." Here's Paltalk: "We have not heard of PRISM. Paltalk exercises extreme care to protect and secure users’ data, only responding to court orders as required to by law. Paltalk does not provide any government agency with direct access to its servers.” Here's AOL: "We do not have any knowledge of the PRISM program. We do not disclose user information to government agencies without a court order, subpoena or formal legal process, nor do we provide any government agency with access to our servers." And here's Yahoo: "We do not provide the government with direct access to our servers, systems, or network." Microsoft refused to issue a direct denial of involvement in PRISM.

austenallred 13y ago
Isn't a possibility just that they are using the same PR template, or that one looked at the other as they were responding? They are remarkably similar, but if you were the PR person at a company isn't that exactly what you would say as well?
cjensen 13y ago
Could Zuckerberg's statement have been "inspired" by Google's? Did any other companies release similar statements?
- anthonycerra 13y ago
  In college, after we'd submit a programming assignment, our code was run through a program to test for plagiarism of another student's code. Can we run the same analysis on these announcements?
  - 13y ago

deleted 13y ago

[deleted]

deleted 13y ago
[deleted]

daniel-cussen 13y ago

"Yeah so if you ever need info about anyone at Harvard. Just ask. I have over 4,000 emails, pictures, addresses, SNS." Asked how, he responds: "People just submitted it. I don't know why. They 'trust me.' Dumb fucks." http://www.newser.com/story/88716/zuckerberg-once-mocked-dumb-users-over-trust.html http://www.newser.com/story/88716/zuckerberg-once-mocked-dum...

nolok 13y ago

> to give the US or any other government direct access to our servers "to give the US, or any other government, or any third party intermediary, direct or indirect access to our servers or our users' data" I mean come on, I've never taken a single lesson in legal or PR and even I can see the big huge holes. They insist on direct access, they insist on servers rather than data and they insist on governments. And that's not even taking into account the fact that most of those sentences are the same copy pasted text that we saw in Larry Page's message. If you want to make it sound like a personal message from the founder, maybe don't speak like a drone ...

brown9-2 13y ago

1. It would be nice if these statements defined "direct access to our servers". It's safe to guess that they are using the narrowest definition possible, meaning that a NSA employee can walk into the building that Facebook's servers are hosted in and log in to any server and run arbitrary commands. This is likely not what a layman's use of "direct access" would mean. The issue is whether or not the government can access whatever user data they wish provided the correct clearance or assertions. 2. "We hadn't even heard of PRISM before yesterday." Somehow I doubt that the National Security Agency is in the habit of telling companies that they work with the names they use for projects internally. 3. "we review each request carefully to make sure they always follow the correct processes and all applicable laws, and then only provide the information if is required by law. We will continue fighting aggressively to keep your information safe and secure." This doesn't preclude the idea that the government accesses more Facebook user data than the general public might realize under current law. Facebook can provide large volumes of info as the PRISM slides suggest if it is indeed lawful, and this statement would not be a lie. It hinges on what exactly is "required by law", or more precisely, what is allowed under the current interpretation of the law.

jpdoctor 13y ago

> Facebook is not and has never been part of any program to give the US or any other government direct access to our servers. > ... > When governments ask Facebook for data, we review each request carefully to make sure they always follow the correct processes and all applicable laws, and then only provide the information if is required by law. So no back door at FB, because the front door is open to secret courts signing the secret subpoenas to do secret things. Got it.

yid 13y ago

Hmm, what I'd like to hear is tech CEOs say "the NSA does not have the private key for our SSL certs." Beam splitters are a pretty cheap buy.

voidlogic 13y ago
this a thousand times
thomasvendetta 13y ago
I wish the people who have knowledge of implementing these things would come forward with a leak of some sort. Surely, somewhere their are citizens of this type, right?
thomasvendetta 13y ago
I wish the people who have knowledge of implementing these things would come forward with a leak of some sort. Surely, somewhere their are citizens of this type, right?

anthonycerra 13y ago

I still find it suspicious that the previous White House press secretary, Robert Gibbs, left the White House to work at Facebook. I realize that statement implies that no one from government can go into the private sector without it suddenly becoming a conspiracy theory, but in this particular case the link is especially concerning.

rglover 13y ago

This is a gun in the back response. Am I really supposed to believe the guy with an open index of almost every American hasn't in some way folded to the government. Ever? Sorry, Z.

pitchups 13y ago

It is remarkable how similar the two statements from Larry Page (LP) and Mark Zuckerberg (MZ) are below. The same responses worded slightly differently, and expressed in the same order: LP: "...we have not joined any program that would give the U.S. government—or any other government—direct access to our servers." MZ: "..Facebook is not and has never been part of any program to give the US or any other government direct access to our servers." LP: "... we provide user data to governments only in accordance with the law." MZ: "we... always follow the correct processes and all applicable laws." LP: "...we have long believed—there needs to be a more transparent approach." MZ: "We strongly encourage all governments to be much more transparent..." It almost looks like they are reading from a template or script!

drsintoma 13y ago
Let's not rule out the possibility that Zuckerberg saw Page's statement and sort of copy-pasted it.

CoryG89 13y ago

I believe, without a doubt, that both the Zuck response and the Page response were created from the same template or set of explanations. Unless all these CEOs met up together and decided how they would respond, then this seems very shady to me indeed.

marban 13y ago

Apple's response: We hadn't even heard of Microsoft, Yahoo, Google and Facebook before yesterday.

adrinavarro 13y ago

The keyword for me here is "direct". If PRISM is indeed a "prism", that is, a network-level dump, duplicate RAW of data, then there is no direct access involved.

skaevola 13y ago

http://www.theonion.com/video/cias-facebook-program-dramatically-cut-agencys-cos,19753&#x2F http://www.theonion.com/video/cias-facebook-program-dramatic...;

mrwnmonm 13y ago
The page you were looking for is not here.

realize 13y ago

If read the right way the responses could still allow for direct access to all their users data through a special API. Direct access to the server itself isn't necessary to get at all the data at will.

aantix 13y ago

With the creepy similarities, why do I get the feeling that it's these collective companies way of saying "Yes, they're monitoring you but we just can't say anything..."

frisco 13y ago

I'm now just confused. If I understand it correctly, the government has publicly acknowledged the program and tried to explain how it's "limited and legal," but extant nonetheless. Now the companies are all uniformly denying it. The options: - The companies are lying. - The government has infiltrated these companies and developed backdoor access the executive team is unaware of. - The government is intercepting traffic en-route and doesn't need cooperation of the companies. - The government is confused on their talking about about what they're confirming here and PRISM has been misinterpreted by the press. #1 is possible, but implies that there exists a National Security Letter-like mechanism that can coerce this kind of public behavior. I find that unlikely but certainly not impossible; that would definitely be a concerning outcome. I think #2 is unlikely. There's an interesting passage in the original Washington Post article, though, about how they want to be careful to protect the identities of the cooperating companies so as to not "damage their sources". A simple reading of this is that the companies might pull out if they're publicly exposed as cooperating. However, since they appear capable of coercing cooperating anyway, a slightly more tin-foil-hat reading is that their access is less straightforward than asking Page and Zuckerberg for help. #3 is probably happening regardless of whatever cooperation the companies are providing. However, if that's the extent of PRISM I think it says interesting things about the likelihood that RSA has fallen. Is that likely? I have no idea. It wouldn't be unprecedented compared to what the NSA and its predecessors have done historically, though. It's worth noting that the NSA hasn't approved asymmetric crypto for protecting classified data. (http://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography http://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography)

randallu 13y ago
#3 doesn't necessarily require breaking RSA, just TLS (via fake certificates or something else). Breaking RSA would be pretty interesting though.
- qubitsam 13y ago
  SSL/TLS was broken once by breaking MD5. Now if the NSA can break SHA-1 using its numerous known weaknesses (there's a working attack on SHA-1 with 2^52 operations), they can pull off internet-wide MITMing. It's safe to assume the NSA can easily do way more than 2 petaflops, and they have an exaflop goal, and that would be enough to run known attacks against DES, factor 1024bit RSA moduli ... and if they can compromise just one root CA (which uses 1024bit RSA) they can issue valid certifications of their own and MITM everyone, and none would be the wiser. And all of this assuming the NSA relies on publicly known weaknesses in SSL/TLS. The matter of the fact is that they have very smart people with access to unlimited resources researching new vulns and actively exploiting them.

dbond 13y ago

About this direct access phrase, I read a post earlier today (linked from a comment on HN but can't find it now...) that described a hypothetical system offered by facebook to intelligence agencies, this system would allow the user to search for a person and then accept a EULA before being given access to personal information. If this system were to automate the submission and acceptance of a subpoena, would the system then be classed as having given indirect access through the correct "legal channels"?

downandout 13y ago

I have also been skeptical of the carefully worded releases, but looking at the PRISM slides more carefully just now, nothing on them necessarily indicates that the target companies actually know what is happening. Perhaps PRISM is based on partnering with backbone providers to suck data straight off the pipe, and the "Dates When PRISM Collection Began" refer to dates when they completed software to scope out information specifically destined for or leaving the services of each "provider". This is just a possibility - I tend to believe the companies are simply lying. But it is possible.

andyl 13y ago

Facebook: "We do not provide any government organization with direct access" Google: "the U.S. government does not have direct access" Apple: "We do not provide any government agency with direct access" Yahoo: "We do not provide the government with direct access" The consistency is amazing - do they all use the same law firm? Something stinks here.

ralfd 13y ago
What else should they say in your opinion?
onedev 13y ago
When the government asks them for access to data, they provide it ONLY THROUGH LEGAL MEANS ON A CASE BY CASE BASIS. That's what they mean by not providing direct access. The government can't just waltz into their front doors and just ask for the data of all the users. Nor does the government have straight access to the servers or databases. Hope you understand now.

deleted 13y ago

[deleted]

rwhitman 13y ago

Again notice the words "direct access". What about indirect access?

leoc 13y ago

Hm. At this point I think I'd set better than 50% odds that the PRISM Powerpoint is a fake. Which is not to say that there's nothing to it - there could be all sorts of things behind it (the phrase 'modified limited hangout' is one that springs to mind).

brokentone 13y ago

They're awfully precise about a limited set of things that did not happen.

themgt 13y ago

Anyone find it interesting that "direct access to servers" keeps being mentioned when PRISM could almost be an in-joke for the kind of beam-splitting tech they were already using in Room 641A (and elsewhere) - i.e. they're not touching servers, they're just siphoning off a perfect copy of all network traffic

edouard1234567 13y ago

Responses from Larry Page and Mark Zuckerberg are suspiciously very similar...

aayala 13y ago
indeed, very similar like a government script ...

suredo 13y ago

A leak from one of the companies involved would be nice.

EGreg 13y ago

And the plot gets thicker: http://www.theweek.co.uk/us/53475/white-house-admits-it-has-access-facebook-google http://www.theweek.co.uk/us/53475/white-house-admits-it-has-... What to make of this in light of the companies' chorus of denials?

outside1234 13y ago

are they playing with words? do they know about complete access to the network just short of their data center but are saying that they are not providing it?

lispm 13y ago

They are not allowed to tell anyone. So they tell a version which is totally flawed, so that everyone understands that the opposite is actually true.

swartz 13y ago

I really seems quite strange that the statement from both facebook and google CEO's are almost exactly same thing. If i didn't know better, i would say same person wrote them.

joering2 13y ago

> We will continue fighting aggressively to keep your information safe and secure. Is it only me, or is Mark implying that agreeing on every government request to provide data would make your information unsafe and insecure?

CyberDroiD 13y ago

I guess the question is: should governments have the same access as "social media platform sysops"? I would be surprised if they didn't.

mattbarrie 13y ago

"direct"

o0-0o 13y ago

The fact is, when you sign an agreement with the government like this you are given a 30+ page contract. Some items ALWAYS in the contract are: 1. If you are asked about it, you will deny it, and LIE about it. They actually tell you to lie. 2. If you break the contract you will be destroyed, and everyone you know will be destroyed. Ask a senior member of the military how this stuff works.

ownagefool 13y ago

Another possibility would be that PR works in fairly formulistic way. It might not be an exact science, but if asked to comment on such a subject, and you were innocent, I'm sure the following would be what you say: > I have no idea what you're talking about. > We only give access when absolutely necessary within the confines of the law. > We're on our customers side. Now some of the terms such as "direct access" are errily familiar, I'll give you that but the message being conveyed and the order it's formed woudn't be enough to suprised me on it's own and the guys working PR for these orgs are probably pretty inbred. Still, it is interesting.

mrwnmonm 13y ago

if it was direct access, didn't the years here differ - http://tctechcrunch2011.files.wordpress.com/2013/06/prism-slide-5.jpg http://tctechcrunch2011.files.wordpress.com/2013/06/prism-sl...

spydum 13y ago

If you want to go full conspiracy theorist, you might suggest the slide deck and capabilities were all a psy-ops tactic to persuade the real criminals to abandon using google,Facebook,apple, and all of the big corps who refused to freely hand over user data, and instead flee to smaller businesses that the government could much more easily coerce into participating...

ianmcgowan 13y ago

It does seem as though these companies are trying to signal something (a la cryptonomicon), by the repeated emphasis on direct. That's the part that is scary - as someone else pointed out, with the right SSL keys and a copy of the bytes flowing thru a limited number of NAP's, you don't need your grubby fingers in the google/facebook datacenters. The telcom's seem quite willing to roll over...

homosaur 13y ago

Why would you believe anything these guys have to say on this matter? For one, the government has clearly given them some kind of deniability. For two, if they were given orders under the National Security Letter program, they couldn't admit they had knowledge even if they did. I don't trust Zuckerberg, I don't trust Larry Page, hell, I wouldn't trust you either if you had to respond.

fakeer 13y ago

It's like: John Doe asks, "Hey Larry, did you let Zuck read my mail I wrote you last week?". Larry says, "No! He doesn't have my password or yours, right?" Joe persists and proves Zuck knows the contents of the email. Then Larry shrugs and says, "Well, I didn't give him access to your email, I gave him a print out when he asked for it".

deleted 13y ago

[deleted]

aayala 13y ago

So the CEO knows every technical detail of the IT infrastructure? that's awesome

drchiu 13y ago

Seriously. Anyone naive enough to believe that FB/Google/etc isn't involved?

aviraldg 13y ago

Political language is designed to make lies sound truthful and murder respectable, and to give an appearance of solidity to pure wind. - George Orwell

icodestuff 13y ago

Reading between the lines: > Facebook is not and has never been part of any program to give the US or any other government direct access to our servers. We have however set up a tap that mirrors all traffic to Facebook to NSA servers, and we've given them the certificate to decrypt that traffic. > We have never received a blanket request or court order from any government agency asking for information or metadata in bulk, like the one Verizon reportedly received. Instead, we were requested to provide our SSL certificate and to install some hardware in our data center. We never handed over any data ourselves. > And if we did, we would fight it aggressively. Too much work to provide all that data. Best to just give them a mirrored PHY stream. > We hadn't even heard of PRISM before yesterday. We didn't know _what_ the program was called; they never told us, specifically for plausible deniability reasons. > When governments ask Facebook for data, we review each request carefully to make sure they always follow the correct processes and all applicable laws, and then only provide the information if is required by law. Technically, they didn't ask for user data, they asked for a hardware interconnect and a private key. > We will continue fighting aggressively to keep your information safe and secure. Our lawyers made us say this. C'mon, we're Facebook, what do you expect? > We strongly encourage all governments to be much more transparent about all programs aimed at keeping the public safe. It's the only way to protect everyone's civil liberties and create the safe and free society we all want over the long term. Good God, what have we done?! We're under an NSL, can't you tell that, people?!

wangii 13y ago

1, They got same press release template. 2, they all give govt indirect access to the servers, e.g. ssh. 3, relax, we Chinese have had this since day 1. You think govt can really outsmart determined people?

bambax 13y ago

> ... create the safe and free society we all want over the long term I don't think you can have both. Freedom has to be paid for, and the only currency it'll take is blood. If we're unwilling to pay that price then I guess we won't have freedom. Also, I'm not sure I'd want freedom regulated by Facebook, where bare breast in centuries old paintings are forbidden or jokes have to pass a censoring committee.

nfm 13y ago

"We will continue fighting aggressively to keep your information safe and secure." - ...Facebook

bbwharris 13y ago

Here's one: neither zuckerberg nor page posted those responses. The NSA did. Once we all believe, the rabbit hole is an abyss.

Myrmornis 13y ago

Dear Mr Zuckerberg, Feel free to deny your company's involvement, but don't you fucking dare criticize the free press's reporting as "outrageous". Thanks.

washedup 13y ago

Sounds exactly like Google's response