7 ms·

I would like to believe these reports from Google [1] and Facebook [2], but someone is not telling the truth. There is evidence that directly contradicts their

I would like to believe these reports from Google [1] and Facebook [2], but someone is not telling the truth. There is evidence that directly contradicts their stories (i.e. The Guardian has verified the authenticity of the document, a 41-slide PowerPoint presentation – classified as top secret with no distribution to foreign allies – which was apparently used to train intelligence operatives on the capabilities of the program. The document claims "collection directly from the servers" of major US service providers. [3]). Who are we to believe? [1] http://googleblog.blogspot.ca/2013/06/what.html http://googleblog.blogspot.ca/2013/06/what.html [2] https://www.facebook.com/zuck/posts/10100828955847631 https://www.facebook.com/zuck/posts/10100828955847631 [3] http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n...

chris_mahan 13y ago
<sarcasm>That's the problem with you geeks: you need real evidence for everything. Can't you just have faith? Can't you learn to just believe?</sarcasm>
soup10 13y ago
The NSA have hooks in various data centers and internet backbones. They collect the intel indirectly giving the companies plausible deniability.
- uh_oh 13y ago
  Yes, but how would they do this exactly? To collect anything valuable from Google they would need to MITM SSL on a large scale. And Chrome actually ships with a list of pinned certificates, including those for Google, making it difficult to MITM even for the government.
  - deno 13y ago
    They wouldn’t do that, obviously, even if it was actually feasible. That kind of MITM would be easily detectable (though still effective, in short term)—we know when the Chinese do it. However the private keys have to deployed, on scale. So if as someone here is suggesting the NSA has infiltrated those companies, they could have got those keys and just decrypt the stream. I wouldn’t bet my money on that… but it’s more likely than breaking the encryption, and if they can get military secrets, I guess they could get the keys. Also those companies could have just volunteered them—that’s where the emphasis on ‘direct’ access comes in.
    - uh_oh 13y ago
      My understanding is that MITM (but in a perfect way, using the leaked private key) is still required, if ephemeral Diffie-Hellman is involved. You can't just passively record the stream and decrypt it, since you don't know the exchanged DH secret. The suggestion that the companies actually gave them the keys and this explains the "direct access" phrase makes a lot of sense!
- UnoriginalGuy 13y ago
  Right. But if you look at the slide why would companies slowly get "added" rather than just implicitly be being spied upon? I mean Apple only got added in 2011. If what you're saying is true then what does this date refer to?
  - dragonwriter 13y ago
    > But if you look at the slide why would companies slowly get "added" rather than just implicitly be being spied upon? Well, if they are intercepting data through backbones, and much of that data is encrypted, they need to defeat the encryption in a durable way to get a clear feed. While I don't suggest that this is what was going on, if it was, there would be know reason that each provider would necessarily be broken at the same time; there would likely both be prioritization of resources directed at each provider, differences in the security of each provider, and chance involved as to when each was broken.
  - Cthulhu_ 13y ago
    > I mean Apple only got added in 2011. If what you're saying is true then what does this date refer to? Growing popularity and usage of icloud and apple's own messaging system? iirc, before icloud, Apple didn't have that much user data.
  - bbbbbaaaaa 13y ago
    iMessage debuted in 2011.
asperous 13y ago
Maybe the government conspiracy is a government conspiracy!
skinnynerd 13y ago
And Obama came out to defend the program without saying that the companies were not involved (he did not say they were involved either) His press conference: http://www.youtube.com/watch?feature=player_embedded&v=iS6MOvLGpCQ http://www.youtube.com/watch?feature=player_embedded&v=iS6MO...
Achshar 13y ago
Exactly why is no company addressing the fact that the government already accepted the program's existence and the fact that they snoop emails/communications. How can the program exist and take data and these companies not giving the data at the same time? Other explanations include... * Data is not, as everyone seems to keep saying, "direct access" and either first sent to NSA servers or a copy is sent periodically. * Companies don't know and NSA is unlawfully getting data (unlikely). * Companies are being forced to not talk about it and outright deny it. * There is somehow a plausible deniability. The are not willingly giving up the data but they aren't stopping them from taking it either and just turning a blind eye to NSA's activities.
btilly 13y ago
There is no contradiction if you accept the suggestion from http://financialcryptography.com/mt/archives/001431.html http://financialcryptography.com/mt/archives/001431.html that the NSA got access to this information by planting moles at target companies who then created back doors for the NSA to use. This would be reasonably easy for the NSA to do, relatively hard for companies to catch, and perfectly explains all published facts.
- jlgreco 13y ago
  How are NSLs addressed? I assume to the CEO, but what if one was sent to a departmental VP? Would that VP be permitted, by the NSL, to inform the CEO that the letter had been received? For that matter, who is the CEO authorized to tell if the CEO got the letter. Obviously they have to be authorized to tell at least enough employees to actually implement the demand.
  - btilly 13y ago
    Google's statement was strong enough to rule out the possibility that either the CEO or chief legal counsel was aware of the existence of NSLs or warrants that are nearly as broad as what Verizon received. Therefore, while they can't say one way or the other whether they receive NSLs, it is a safe inference that Google has not received broad NSLs.
    - jlgreco 13y ago
      Yeah, I'm wondering if "someone down the chain in Gmail got NSL'd" is a possibility or not. I'm not familiar with Google's org chart nor do I know if NSLs are even flexible enough to accomplish such a thing. If it is possible though, there could perhaps be an NSL that covers "just gmail" that is otherwise as broad as the Verizon one. The notion that a CEO could be unaware of something like that happening is incredibly disturbing though. I hope that is not possible.
      - benmmurphy 13y ago
        I assume they can but it would be a risky strategy. If google security found a breach where customer data was being leaked then they might disclose publicly before they can be informed that it is a national security issue.
nolok 13y ago
To quote myself in another message, > I've never taken a single lesson in legal or PR and even I can see the big huge holes. They insist on direct access, they insist on servers rather than data and they insist on governments.
- masterzora 13y ago
  Anything else would be simply untrue. These companies obviously give limited data (not server access, not direct) to the government when required by subpoena and whatnot so they couldn't say "we give no access to any data" or anything like that.
danso 13y ago
One thing that has bothered me is that neither the Guardian or the Washington Post (someone kindly post the link if I've missed it) has posted more than just a few slides of this 41-slide presentation. I understand the leaker may want as few of slides as possible shown due to the danger of them being watermarked, but the few slides posted so far alone seem to lack important context. Secondly, in defense of the companies, at least Google and Facebook, they've put up real people (Zuckerberg and Page) behind these assertions. In the case of the leaker, we just know that he/she is a career intelligence official...which could mean many things. No, I'm not saying that leakers should be distrusted until they identify themselves...I'm saying when the evidence that the leaker has given is heavily redacted, then it's hard to know what assertions the responding companies have to actually lie about. In other words, it could be the case that we shouldn't believe anyone so far.
- btilly 13y ago
  Implicit confirmation that the programs described in the press are real and as described goes all of the way to Obama himself. For example he responded to a reporter today by saying, "With respect to the Internet and emails, this does not apply to U.S. citizens and it does not apply to people living in the United States." If the programs were not as described, Obama would have certainly said so. Instead he confirmed their existence without disagreeing with what was said in the Washington Post about it. Given that, there is good reason to believe the substance of the leak, even though we don't know who leaked it or exactly what is in that presentation.
  - danso 13y ago
    FWIW, here's the press conference referred to, and here's the question: > Q Mr. President, could you please react to the reports of secret government surveillance of phones and Internet? And can you also assure Americans that the government -- your government doesn't have some massive secret database of all their personal online information and activities? THE PRESIDENT: Yes. When I came into this office, I made two commitments that are more important than any commitment I made: Number one, to keep the American people safe; and number two, to uphold the Constitution. And that includes what I consider to be a constitutional right to privacy and an observance of civil liberties. Now, the programs that have been discussed over the last couple days in the press are secret in the sense that they're classified. But they're not secret in the sense that when it comes to telephone calls, every member of Congress has been briefed on this program. With respect to all these programs, the relevant intelligence committees are fully briefed on these programs. These are programs that have been authorized by broad bipartisan majorities repeatedly since 2006. I'm not arguing against you, I'm saying that his statement is vague, and that it could just be a broad assertion of the executive powers. It doesn't matter whether the program is called PRISM or SUPERPATRIOT or what (in the president's reasoning), such surveillance measures have been legally approved and are regulated, if the government chooses to undertake such measures in the name of security. This is not the same as acknowledging that PRISM exists (which would put Google/Facebook's claims to the test).

chris_mahan 13y ago

<sarcasm>That's the problem with you geeks: you need real evidence for everything. Can't you just have faith? Can't you learn to just believe?</sarcasm>

soup10 13y ago

The NSA have hooks in various data centers and internet backbones. They collect the intel indirectly giving the companies plausible deniability.

uh_oh 13y ago
Yes, but how would they do this exactly? To collect anything valuable from Google they would need to MITM SSL on a large scale. And Chrome actually ships with a list of pinned certificates, including those for Google, making it difficult to MITM even for the government.
- deno 13y ago
  They wouldn’t do that, obviously, even if it was actually feasible. That kind of MITM would be easily detectable (though still effective, in short term)—we know when the Chinese do it. However the private keys have to deployed, on scale. So if as someone here is suggesting the NSA has infiltrated those companies, they could have got those keys and just decrypt the stream. I wouldn’t bet my money on that… but it’s more likely than breaking the encryption, and if they can get military secrets, I guess they could get the keys. Also those companies could have just volunteered them—that’s where the emphasis on ‘direct’ access comes in.
  - uh_oh 13y ago
    My understanding is that MITM (but in a perfect way, using the leaked private key) is still required, if ephemeral Diffie-Hellman is involved. You can't just passively record the stream and decrypt it, since you don't know the exchanged DH secret. The suggestion that the companies actually gave them the keys and this explains the "direct access" phrase makes a lot of sense!
UnoriginalGuy 13y ago
Right. But if you look at the slide why would companies slowly get "added" rather than just implicitly be being spied upon? I mean Apple only got added in 2011. If what you're saying is true then what does this date refer to?
- dragonwriter 13y ago
  > But if you look at the slide why would companies slowly get "added" rather than just implicitly be being spied upon? Well, if they are intercepting data through backbones, and much of that data is encrypted, they need to defeat the encryption in a durable way to get a clear feed. While I don't suggest that this is what was going on, if it was, there would be know reason that each provider would necessarily be broken at the same time; there would likely both be prioritization of resources directed at each provider, differences in the security of each provider, and chance involved as to when each was broken.
- Cthulhu_ 13y ago
  > I mean Apple only got added in 2011. If what you're saying is true then what does this date refer to? Growing popularity and usage of icloud and apple's own messaging system? iirc, before icloud, Apple didn't have that much user data.
- bbbbbaaaaa 13y ago
  iMessage debuted in 2011.

asperous 13y ago

Maybe the government conspiracy is a government conspiracy!

skinnynerd 13y ago

And Obama came out to defend the program without saying that the companies were not involved (he did not say they were involved either) His press conference: http://www.youtube.com/watch?feature=player_embedded&v=iS6MOvLGpCQ http://www.youtube.com/watch?feature=player_embedded&v=iS6MO...

Achshar 13y ago

Exactly why is no company addressing the fact that the government already accepted the program's existence and the fact that they snoop emails/communications. How can the program exist and take data and these companies not giving the data at the same time? Other explanations include... * Data is not, as everyone seems to keep saying, "direct access" and either first sent to NSA servers or a copy is sent periodically. * Companies don't know and NSA is unlawfully getting data (unlikely). * Companies are being forced to not talk about it and outright deny it. * There is somehow a plausible deniability. The are not willingly giving up the data but they aren't stopping them from taking it either and just turning a blind eye to NSA's activities.

btilly 13y ago

There is no contradiction if you accept the suggestion from http://financialcryptography.com/mt/archives/001431.html http://financialcryptography.com/mt/archives/001431.html that the NSA got access to this information by planting moles at target companies who then created back doors for the NSA to use. This would be reasonably easy for the NSA to do, relatively hard for companies to catch, and perfectly explains all published facts.

jlgreco 13y ago
How are NSLs addressed? I assume to the CEO, but what if one was sent to a departmental VP? Would that VP be permitted, by the NSL, to inform the CEO that the letter had been received? For that matter, who is the CEO authorized to tell if the CEO got the letter. Obviously they have to be authorized to tell at least enough employees to actually implement the demand.
- btilly 13y ago
  Google's statement was strong enough to rule out the possibility that either the CEO or chief legal counsel was aware of the existence of NSLs or warrants that are nearly as broad as what Verizon received. Therefore, while they can't say one way or the other whether they receive NSLs, it is a safe inference that Google has not received broad NSLs.
  - jlgreco 13y ago
    Yeah, I'm wondering if "someone down the chain in Gmail got NSL'd" is a possibility or not. I'm not familiar with Google's org chart nor do I know if NSLs are even flexible enough to accomplish such a thing. If it is possible though, there could perhaps be an NSL that covers "just gmail" that is otherwise as broad as the Verizon one. The notion that a CEO could be unaware of something like that happening is incredibly disturbing though. I hope that is not possible.
    - benmmurphy 13y ago
      I assume they can but it would be a risky strategy. If google security found a breach where customer data was being leaked then they might disclose publicly before they can be informed that it is a national security issue.

nolok 13y ago

To quote myself in another message, > I've never taken a single lesson in legal or PR and even I can see the big huge holes. They insist on direct access, they insist on servers rather than data and they insist on governments.

masterzora 13y ago
Anything else would be simply untrue. These companies obviously give limited data (not server access, not direct) to the government when required by subpoena and whatnot so they couldn't say "we give no access to any data" or anything like that.

danso 13y ago

One thing that has bothered me is that neither the Guardian or the Washington Post (someone kindly post the link if I've missed it) has posted more than just a few slides of this 41-slide presentation. I understand the leaker may want as few of slides as possible shown due to the danger of them being watermarked, but the few slides posted so far alone seem to lack important context. Secondly, in defense of the companies, at least Google and Facebook, they've put up real people (Zuckerberg and Page) behind these assertions. In the case of the leaker, we just know that he/she is a career intelligence official...which could mean many things. No, I'm not saying that leakers should be distrusted until they identify themselves...I'm saying when the evidence that the leaker has given is heavily redacted, then it's hard to know what assertions the responding companies have to actually lie about. In other words, it could be the case that we shouldn't believe anyone so far.

btilly 13y ago
Implicit confirmation that the programs described in the press are real and as described goes all of the way to Obama himself. For example he responded to a reporter today by saying, "With respect to the Internet and emails, this does not apply to U.S. citizens and it does not apply to people living in the United States." If the programs were not as described, Obama would have certainly said so. Instead he confirmed their existence without disagreeing with what was said in the Washington Post about it. Given that, there is good reason to believe the substance of the leak, even though we don't know who leaked it or exactly what is in that presentation.
- danso 13y ago
  FWIW, here's the press conference referred to, and here's the question: > Q Mr. President, could you please react to the reports of secret government surveillance of phones and Internet? And can you also assure Americans that the government -- your government doesn't have some massive secret database of all their personal online information and activities? THE PRESIDENT: Yes. When I came into this office, I made two commitments that are more important than any commitment I made: Number one, to keep the American people safe; and number two, to uphold the Constitution. And that includes what I consider to be a constitutional right to privacy and an observance of civil liberties. Now, the programs that have been discussed over the last couple days in the press are secret in the sense that they're classified. But they're not secret in the sense that when it comes to telephone calls, every member of Congress has been briefed on this program. With respect to all these programs, the relevant intelligence committees are fully briefed on these programs. These are programs that have been authorized by broad bipartisan majorities repeatedly since 2006. I'm not arguing against you, I'm saying that his statement is vague, and that it could just be a broad assertion of the executive powers. It doesn't matter whether the program is called PRISM or SUPERPATRIOT or what (in the president's reasoning), such surveillance measures have been legally approved and are regulated, if the government chooses to undertake such measures in the name of security. This is not the same as acknowledging that PRISM exists (which would put Google/Facebook's claims to the test).