4 ms·

Two ways I could see this being set up: 1. NSA goes to Facebook and tells them to install a server/rack in their data center. The server needs to be on a port

by jtchang 13y ago

Two ways I could see this being set up: 1. NSA goes to Facebook and tells them to install a server/rack in their data center. The server needs to be on a port that can "see" all traffic unencrypted. The servers then transparently record data and analysts on the backend parse it into something useful. 2. NSA puts servers on premises but instead they are pushed formatted feeds of data. This would require them to work more closely with the company to make sure they provide a feed that is workable. They would store the data and as requests for data came in the server would feed it back.

dm2 13y ago
You're assuming that the NSA requires physical access to unencrypted data. The NSA has been in the IT security game for a very long time, they employ the best of the best, and have practically unlimited funds. I'd imagine that very complicated algorithms determine who to monitor and what keywords to look for. Images from the middle east or a VPN are likely more heavily analyzed than images from a college campus inside the US. Why set up shop at specific social media companies when they have physical access to backbone routers and root certificate private keys? Yes, it would be easier to just ask FB/Google/Apple to give them unlimited read access to their databases, but that would be a scandal waiting to happen.
- acqq 13y ago
  http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server-collection-facebook-google http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server... The slide with the explicit formulation was published, written by NSA, that made claims of "not inside companies" much less believable: "Collection directly from the servers of these U.S. Service Providers: Microsoft, Yahoo, Google, Facebook, Paltalk, AOL, Skype, YouTube, Apple." This supports the claims of Glenn Greenwald's article and is exactly what companies claimed not existing. Read the slide: they explicitely name the collecition on the "fat pipes" under other code names. As they have the access to the big pipes, the real time data (c.f. the other slides, earlier) from the inside of companies is certainly unencrypted.
  - sirclueless 13y ago
    The slides may have come from within NSA, but they were created for a non-technical audience of analysts. Suppose for the sake of argument that the reality is that the NSA has hardware adjacent to company servers or on the internet backbone nearby that can collect messages in transit that match some search query. That's not really direct access, and it's not indiscriminate -- all the subsequent statements from company execs and government sources would be correct. But it's easy to see how some mid-level worker in the NSA, trying to convey to analysts that PRISM enables them to retrieve emails, phone records etc. from various companies, would make an over-simplification and suggest that there is direct access to company servers. "Never attribute to malice that which is adequately explained by stupidity." --Robert Hanlon. Despite the duplicitous and overly narrow statements about PRISM that skirt the truth, there's no reason to suggest they are all overtly lying, when a much simpler explanation is that some NSA employee overstated their technical capabilities on an internal powerpoint.
    - acqq 13y ago
      Read the articles by Post and Guardian. They published enough leaks to make clear how it works: the special court gives a blanket order, valid for as much as one year, but at least three months, under which the inteligence comunity can operate from their servers at the company site for up to one year without the company even knowing (or wanting to know) what is being requested from their servers. The court order is what's making the operation "legal" so the companies can't be held legally responsible. But that can't mean that the system doesn't exist.
      - leoc 13y ago
        Google has flatly denied that it has fulfilled, or even received, such broad orders http://googleblog.blogspot.ie/2013/06/what.html http://googleblog.blogspot.ie/2013/06/what.html : > Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist. Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false. It would also be hard to square Microsoft's statement that > In addition we only ever comply with orders for requests about specific accounts or identifiers. http://www.microsoft.com/en-us/news/Press/2013/Jun13/06-06statement.aspx http://www.microsoft.com/en-us/news/Press/2013/Jun13/06-06st... with compliance with a Verizon-style broad order.
leoc 13y ago
Closer to 2, but with the additional restriction that information only gets copied to the NSA on-premises server after the server makes a specific request/demand for it. All the reports seem to be saying that PRISM is a workflow-automation system for FISA orders.
hannibal5 13y ago
This has already been cleared up in my opinion. Documents show different program called Upstream that is used for transparently recording data. http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server-collection-facebook-google http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server...

by jtchang 13y ago

dm2 13y ago

You're assuming that the NSA requires physical access to unencrypted data. The NSA has been in the IT security game for a very long time, they employ the best of the best, and have practically unlimited funds. I'd imagine that very complicated algorithms determine who to monitor and what keywords to look for. Images from the middle east or a VPN are likely more heavily analyzed than images from a college campus inside the US. Why set up shop at specific social media companies when they have physical access to backbone routers and root certificate private keys? Yes, it would be easier to just ask FB/Google/Apple to give them unlimited read access to their databases, but that would be a scandal waiting to happen.

acqq 13y ago
http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server-collection-facebook-google http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server... The slide with the explicit formulation was published, written by NSA, that made claims of "not inside companies" much less believable: "Collection directly from the servers of these U.S. Service Providers: Microsoft, Yahoo, Google, Facebook, Paltalk, AOL, Skype, YouTube, Apple." This supports the claims of Glenn Greenwald's article and is exactly what companies claimed not existing. Read the slide: they explicitely name the collecition on the "fat pipes" under other code names. As they have the access to the big pipes, the real time data (c.f. the other slides, earlier) from the inside of companies is certainly unencrypted.
- sirclueless 13y ago
  The slides may have come from within NSA, but they were created for a non-technical audience of analysts. Suppose for the sake of argument that the reality is that the NSA has hardware adjacent to company servers or on the internet backbone nearby that can collect messages in transit that match some search query. That's not really direct access, and it's not indiscriminate -- all the subsequent statements from company execs and government sources would be correct. But it's easy to see how some mid-level worker in the NSA, trying to convey to analysts that PRISM enables them to retrieve emails, phone records etc. from various companies, would make an over-simplification and suggest that there is direct access to company servers. "Never attribute to malice that which is adequately explained by stupidity." --Robert Hanlon. Despite the duplicitous and overly narrow statements about PRISM that skirt the truth, there's no reason to suggest they are all overtly lying, when a much simpler explanation is that some NSA employee overstated their technical capabilities on an internal powerpoint.
  - acqq 13y ago
    Read the articles by Post and Guardian. They published enough leaks to make clear how it works: the special court gives a blanket order, valid for as much as one year, but at least three months, under which the inteligence comunity can operate from their servers at the company site for up to one year without the company even knowing (or wanting to know) what is being requested from their servers. The court order is what's making the operation "legal" so the companies can't be held legally responsible. But that can't mean that the system doesn't exist.
    - leoc 13y ago
      Google has flatly denied that it has fulfilled, or even received, such broad orders http://googleblog.blogspot.ie/2013/06/what.html http://googleblog.blogspot.ie/2013/06/what.html : > Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist. Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false. It would also be hard to square Microsoft's statement that > In addition we only ever comply with orders for requests about specific accounts or identifiers. http://www.microsoft.com/en-us/news/Press/2013/Jun13/06-06statement.aspx http://www.microsoft.com/en-us/news/Press/2013/Jun13/06-06st... with compliance with a Verizon-style broad order.

leoc 13y ago

Closer to 2, but with the additional restriction that information only gets copied to the NSA on-premises server after the server makes a specific request/demand for it. All the reports seem to be saying that PRISM is a workflow-automation system for FISA orders.

hannibal5 13y ago

This has already been cleared up in my opinion. Documents show different program called Upstream that is used for transparently recording data. http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server-collection-facebook-google http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server...