3 ms·
Watch this video from the Washington Post reporter who broke the story: http://www.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-in
by AJ007 13y ago
Watch this video from the Washington Post reporter who broke the story: http://www.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companies-in-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story.html http://www.washingtonpost.com/investigations/us-intelligence...
a) "We did hold back quite a bit from this story." "There are some things that we looked at on our own, and said we're not going to publish that, and there are other things we talked to the government about." What does that mean? We saw three slides of a very limited nature.
b) "This source believes that exposure was inevitable and is prepared to face that consequence." "He thinks what the NSA is doing exceeds all reasonable boundaries of privacy or necessity." This wasn't over mundane FISA court ordered data releases.
c) In response to the question, "Why do these companies authorize this?" Response: "There is a pretty complicated set of incentives and compulsions. The law does provide that they can give access and a secret surveillance court can make them give access, but in a situation that you have a clandestine program and a very rich and powerful component ... They don't want to litigate this with Facebook, they don't want a chance of it leaking ... Facebook also being a highly regulated industry, having all kinds of issues with privacy and whatever else doesn't want to antagonize the government, so they negotiate it. Now Apple took .. 5 years .. I don't know what happened, but Microsoft joined in 2007 and Apple didn't do it until the end of 2012."
So, the author, who saw all of the slides and talked to the source says that they they left great amounts out of the story, but absolutely confirms & goes in to detail that the companies were complicit with the NSA and that it went beyond what the legally mandated options.
If the denials issued by Facebook, Google, and their respective executives are not an outright lies, and this story is not a hoax (I am assuming it is real since Obama had an opportunity to deny its existence) then there is a compromise in the traffic streams entering and exiting these services provider's platforms, very possibly like the infamous AT&T Room 641A.
This may be more disturbing than we initially believed.
- jcrites 13y agoI'm imagining something like this: Imagine if the NSA has a copy of these companies' (Google and Facebook's) traffic, and has perhaps subpoena'd the TLS keys. Having the TLS keys is still not having "direct access" to their network, since the NSA at no point accesses internals of their network. But the NSA gets all the data and decrypts it. Next, NSA engineers spend time reverse-engineering the company's protocols. Or maybe the companies hand over the specs. Anyway, the NSA can now recognize a request to Facebook representing posting a message; or it can recognize in Google's traffic someone reading or sending an email. It can tell when a file is stored into iDrive. It saves copies of all of this - the date and time of the request to Facebook, the message, etc.; for Google, the entire copy of the email, or search query. NSA stores all of this data into a searchable, queryable database, that is capable of looking up a person's activity in those systems. And retrieve the same Facebook message, Google meail, or iDrive file that the user had sent. This is a version of events that seems to fit the data I've seen. In another thread, someone suggested that PRISM records information without "tapping" the companies lines. Perhaps that is true, and the tapping happens at the Internet backbone level, without awareness by these companies (beyond giving up their TLS keys). I think the question we need to ask Google, et al., is: did you divulge your SSL/TLS keys to any government, agent of the government, or any other entity?
- AJ007 13y agoThis sounds about right in the context of William Binney interviews given last year. I would really like to hear opinions on this from people who know a whole lot more about SSL and certificate issuance than I do. I think given a little more time the blanket denials will sink in and people will start to figure out what the very ugly alternatives are.
- zero_intp 13y agoI promise you this is true. I can not confirm specifics.