16 ms·

I'm now just confused. If I understand it correctly, the government has publicly acknowledged the program and tried to explain how it's "limited and legal," but

by frisco 13y ago

I'm now just confused. If I understand it correctly, the government has publicly acknowledged the program and tried to explain how it's "limited and legal," but extant nonetheless. Now the companies are all uniformly denying it. The options: - The companies are lying. - The government has infiltrated these companies and developed backdoor access the executive team is unaware of. - The government is intercepting traffic en-route and doesn't need cooperation of the companies. - The government is confused on their talking about about what they're confirming here and PRISM has been misinterpreted by the press. #1 is possible, but implies that there exists a National Security Letter-like mechanism that can coerce this kind of public behavior. I find that unlikely but certainly not impossible; that would definitely be a concerning outcome. I think #2 is unlikely. There's an interesting passage in the original Washington Post article, though, about how they want to be careful to protect the identities of the cooperating companies so as to not "damage their sources". A simple reading of this is that the companies might pull out if they're publicly exposed as cooperating. However, since they appear capable of coercing cooperating anyway, a slightly more tin-foil-hat reading is that their access is less straightforward than asking Page and Zuckerberg for help. #3 is probably happening regardless of whatever cooperation the companies are providing. However, if that's the extent of PRISM I think it says interesting things about the likelihood that RSA has fallen. Is that likely? I have no idea. It wouldn't be unprecedented compared to what the NSA and its predecessors have done historically, though. It's worth noting that the NSA hasn't approved asymmetric crypto for protecting classified data. (http://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography http://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography)

randallu 13y ago
#3 doesn't necessarily require breaking RSA, just TLS (via fake certificates or something else). Breaking RSA would be pretty interesting though.
- qubitsam 13y ago
  SSL/TLS was broken once by breaking MD5. Now if the NSA can break SHA-1 using its numerous known weaknesses (there's a working attack on SHA-1 with 2^52 operations), they can pull off internet-wide MITMing. It's safe to assume the NSA can easily do way more than 2 petaflops, and they have an exaflop goal, and that would be enough to run known attacks against DES, factor 1024bit RSA moduli ... and if they can compromise just one root CA (which uses 1024bit RSA) they can issue valid certifications of their own and MITM everyone, and none would be the wiser. And all of this assuming the NSA relies on publicly known weaknesses in SSL/TLS. The matter of the fact is that they have very smart people with access to unlimited resources researching new vulns and actively exploiting them.
- er0k 13y ago
  Bill Binney has already stated that the NSA does not even need to break online encryption in most cases, since they already have the key(s) in the first place.
ihsw 13y ago
I may be naive but I have a theory that government officials will defend anything the government does -- regardless of whether the accusations are true. The NSA PRISM program may not even exist, however the Obama government may be too incensed with the notion of anybody opposing government's encroachment on privacy and civil liberties, and thusly they're hastily defending and deflecting any accusations of wrong-doing.
Miner49er 13y ago
I'm glad you pointed out that the government acknowledged the program. Obama himself did. If I had to guess, there was miscommunication in the government. Somebody ordered the CEO's to lie, and somebody acknowledged the program. I think this is also why the company's statements are nearly the same, they were either given a script or they are trying to send a message.
masterzora 13y ago
Option #5: They have a program regarding some data acquired in some manner but since it's still classified, even if something is leaked, they're not going to sit down and explain the specifics to everyone. The government's response has been vague at best. My assumption is some combination of #4 and #5, really.
c0ur7n3y 13y ago
#1 - It's really pretty simple. The companies get legal immunity from the government by denying the existence of the program. They already are, no doubt, indemnified. Companies are so risk averse they wouldn't do it without immunity. Disclosing information about the program would violate the conditions of that immunity.
mpyne 13y ago
Option #6: PRISM is the NSA-end of an interface to each named company to help automate data collection. The company still grabs the data, still runs each request through their legal team, etc. But there's no email or fax needed, requests arrive via something like a JSON request and are automatically returned to NSA once the company looks up the requested data. Company doesn't know NSA calls it PRISM. As far as the company is concerned it's just a bridge from their systems to the NSA for valid law enforcement reasons, why should they care what NSA calls it? That would also explain why it's so cheap ($20 million). Or rather, why it's so expensive given how little it really is...
- AJ007 13y ago
  There is no way that this is just some nice interface for court ordered collections. Watch the Washington Post video with the (Pulitzer Prize) author Barton Gellman. Gellman says that "We did hold back quite a bit from this story" and then later goes on to explain the reason the companies joined ... "The law does provide that they can give access and a secret surveillance court can make them give access, but in a situation that you have a clandestine program and a very rich and powerful component ... They don't want to litigate this with Facebook, they don't want a chance of it leaking ... Facebook also being a highly regulated industry, having all kinds of issues with privacy and whatever else doesn't want to antagonize the government, so they negotiate it. Now Apple took .. 5 years .. I don't know what happened, but Microsoft joined in 2007 and Apple didn't do it until the end of 2012." Unless the author, Gellman, exaggerated the story it is very clear that this is well beyond FISA court ordered surveillance. If Page's & Zuckerberg's denials are somewhat truthful it means there is a compromise in the traffic streams themselves.
  - ralfd 13y ago
    Actually, I think that sounds just like some nice interface. They have to five access because the law demands it, but they also make it easy to use for the agency to use. Which for example Twitter does not do. If the other theory about ISP level data collection would be true, it would make no sense that Twitter and Dropbox are missing and not part of PRISM.
brown9-2 13y ago
Marc Ambinder, a well-respected national security journalist who literally wrote the book on this topic, speculated (or perhaps stated what his sources have told him) how this could work on Twitter earlier tonight. Buzzfeed recapped it here: http://www.buzzfeed.com/jwherrman/direct-access-is-the-defining-phrase-of-the-nsa-scandal http://www.buzzfeed.com/jwherrman/direct-access-is-the-defin... > On the “no direct access” —ISPs push to a separate server the subset of accounts that the FISC order covers; NSA monitors them in real time > Let’s say court order says “all Yahoo accounts in Pakistan” Yahoo would push those accounts to the server; NSA could watch them in real time >They’d try & figure who & where the incoming emails were coming from. US persons data minimized automatically if possible (often it’s not).

by frisco 13y ago

randallu 13y ago

#3 doesn't necessarily require breaking RSA, just TLS (via fake certificates or something else). Breaking RSA would be pretty interesting though.

qubitsam 13y ago
SSL/TLS was broken once by breaking MD5. Now if the NSA can break SHA-1 using its numerous known weaknesses (there's a working attack on SHA-1 with 2^52 operations), they can pull off internet-wide MITMing. It's safe to assume the NSA can easily do way more than 2 petaflops, and they have an exaflop goal, and that would be enough to run known attacks against DES, factor 1024bit RSA moduli ... and if they can compromise just one root CA (which uses 1024bit RSA) they can issue valid certifications of their own and MITM everyone, and none would be the wiser. And all of this assuming the NSA relies on publicly known weaknesses in SSL/TLS. The matter of the fact is that they have very smart people with access to unlimited resources researching new vulns and actively exploiting them.
er0k 13y ago
Bill Binney has already stated that the NSA does not even need to break online encryption in most cases, since they already have the key(s) in the first place.

ihsw 13y ago

I may be naive but I have a theory that government officials will defend anything the government does -- regardless of whether the accusations are true. The NSA PRISM program may not even exist, however the Obama government may be too incensed with the notion of anybody opposing government's encroachment on privacy and civil liberties, and thusly they're hastily defending and deflecting any accusations of wrong-doing.

Miner49er 13y ago

I'm glad you pointed out that the government acknowledged the program. Obama himself did. If I had to guess, there was miscommunication in the government. Somebody ordered the CEO's to lie, and somebody acknowledged the program. I think this is also why the company's statements are nearly the same, they were either given a script or they are trying to send a message.

masterzora 13y ago

Option #5: They have a program regarding some data acquired in some manner but since it's still classified, even if something is leaked, they're not going to sit down and explain the specifics to everyone. The government's response has been vague at best. My assumption is some combination of #4 and #5, really.

c0ur7n3y 13y ago

#1 - It's really pretty simple. The companies get legal immunity from the government by denying the existence of the program. They already are, no doubt, indemnified. Companies are so risk averse they wouldn't do it without immunity. Disclosing information about the program would violate the conditions of that immunity.

mpyne 13y ago

Option #6: PRISM is the NSA-end of an interface to each named company to help automate data collection. The company still grabs the data, still runs each request through their legal team, etc. But there's no email or fax needed, requests arrive via something like a JSON request and are automatically returned to NSA once the company looks up the requested data. Company doesn't know NSA calls it PRISM. As far as the company is concerned it's just a bridge from their systems to the NSA for valid law enforcement reasons, why should they care what NSA calls it? That would also explain why it's so cheap ($20 million). Or rather, why it's so expensive given how little it really is...

AJ007 13y ago
There is no way that this is just some nice interface for court ordered collections. Watch the Washington Post video with the (Pulitzer Prize) author Barton Gellman. Gellman says that "We did hold back quite a bit from this story" and then later goes on to explain the reason the companies joined ... "The law does provide that they can give access and a secret surveillance court can make them give access, but in a situation that you have a clandestine program and a very rich and powerful component ... They don't want to litigate this with Facebook, they don't want a chance of it leaking ... Facebook also being a highly regulated industry, having all kinds of issues with privacy and whatever else doesn't want to antagonize the government, so they negotiate it. Now Apple took .. 5 years .. I don't know what happened, but Microsoft joined in 2007 and Apple didn't do it until the end of 2012." Unless the author, Gellman, exaggerated the story it is very clear that this is well beyond FISA court ordered surveillance. If Page's & Zuckerberg's denials are somewhat truthful it means there is a compromise in the traffic streams themselves.
- ralfd 13y ago
  Actually, I think that sounds just like some nice interface. They have to five access because the law demands it, but they also make it easy to use for the agency to use. Which for example Twitter does not do. If the other theory about ISP level data collection would be true, it would make no sense that Twitter and Dropbox are missing and not part of PRISM.

brown9-2 13y ago

Marc Ambinder, a well-respected national security journalist who literally wrote the book on this topic, speculated (or perhaps stated what his sources have told him) how this could work on Twitter earlier tonight. Buzzfeed recapped it here: http://www.buzzfeed.com/jwherrman/direct-access-is-the-defining-phrase-of-the-nsa-scandal http://www.buzzfeed.com/jwherrman/direct-access-is-the-defin... > On the “no direct access” —ISPs push to a separate server the subset of accounts that the FISC order covers; NSA monitors them in real time > Let’s say court order says “all Yahoo accounts in Pakistan” Yahoo would push those accounts to the server; NSA could watch them in real time >They’d try & figure who & where the incoming emails were coming from. US persons data minimized automatically if possible (often it’s not).