14 ms·

The Guardian walks back claims of direct NSA access to servers of tech companies

161 points by skwirl 13y ago

mpyne 13y ago
So in other words, the Guardian is saying that I'm right (again)? https://news.ycombinator.com/item?id=5859493 https://news.ycombinator.com/item?id=5859493
- tptacek 13y ago
  Greenwald, in (I think) a slippery way, tried to start walking this back last week: https://news.ycombinator.com/item?id=5845649 https://news.ycombinator.com/item?id=5845649
  - skwirl 13y ago
    Here's an interesting take on Mr. Greenwald's handling of this story: http://thedailybanter.com/2013/06/greenwald-sticks-with-his-story-in-spite-of-growing-questions/ http://thedailybanter.com/2013/06/greenwald-sticks-with-his-...
- jonlucc 13y ago
  I think it's possible that Steve Gibson is right on this week's Security Now podcast. He suggests that perhaps the NSA has tapped into the ISP just upstream of the 9 companies listed. Then, they copy all of the data coming into and out of the fiber going to the Google datacenters. This fits with the name Prism, and is corroborated by the 2006 revelation about the NSA-controlled room in the ATT building in San Francisco. Edit: this does rely on the NSA having access to routers, not servers, so it still isn't exactly what they said
  - mpyne 13y ago
    Yeah, the NSA might have a system like that for all I know, but it's going to be named something other than PRISM.
  - skwirl 13y ago
    While certainly a possibility, that really wouldn't fit in with everything else we've heard about PRISM, including what the tech companies have said. It also wouldn't allow the NSA to view data transferred over SSL (which I believe is all gmail and Facebook traffic, at least for me) -- unless the NSA has broken the encryption algorithms.
  - tonfa 13y ago
    With a 20M budget?
    - holloway 13y ago
      Prism might only be part of it, there are ways of breaking up projects in budgets obviously. It could just feed the data into another system
- anologwintermut 13y ago
  A pyrrhic victory if Google's interface is Bool is_NSA_authorized(int fisa_id) const { return True; // Our hands are tied by FAA 702. // We really don't want to be doing this. // But we have no choice, its "legal". // I hope the NSA has some procedures // to make sure this isn't abused. // Otherwise they could get anything // they want from us. }
  - tptacek 13y ago
    Also this is all a sideshow if Google is in fact trying to conceal the existence of alien spacecraft recovered from Roswell.
  - mpyne 13y ago
    That could have been their manual process before Prism as well...
    - anologwintermut 13y ago
      It may well have been . And thats not their fault if their hands are legally tied. Especially since they appear to be trying to actually disclose what they have to hand over. My comment wasn't meant as a dig at Google, they are forced to comply with what ever the law actually authorized. My point was we need to know how much they can actually be forced to hand over and what checks there are on that power being abused.
jessaustin 13y ago
How would access to an FTP server that serves all the data one wants not be considered "direct"? I really doubt NSA analysts need shell access to do their dirty work...
- skwirl 13y ago
  The point is that the companies decide what production data to deposit on these servers after their legal teams have reviewed FISA requests. According to the tech companies, these requests are individually reviewed and target individuals and are narrow in scope. And they push back when they are broad. This detail is a major one. This would mean the NSA cannot simply log on to Facebook and query for whatever they want. It means the system is simply a way for companies to comply with FISA requests, something that they were already required to do. So: even though Twitter doesn't use PRISM, there is really no difference between what the NSA can access on Twitter and what they can access on Facebook. Twitter just complies through some other manner.
  - holloway 13y ago
    I think that's a bit generous. They look over the request but if the result set is too large it couldn't be reasonably vetted by lawyers. Eg, they would have a look at it but we don't know how rigorous they are or could be.
    - skwirl 13y ago
      Yeah, I think the main point is that this is simply a way of responding to FISA requests, which are completely independent of PRISM. In other words, there is no new news here. The debate over FISA itself is certainly quite valid. Google has claimed these requests are infrequent and narrowly focused, and they have requested permission from the government to publish some statistics. I hope they get it.
- mpyne 13y ago
  Because the company has to provide the data (or not). The company can (must) decide to exclude data that doesn't have a FISA warrant, for example. The threat to this model is the idea that a FISA warrant might not be required until monitoring has gone on for 72 hours, but that was just as much of a threat with the prior model, where the data were manually extracted and sent by the company instead of using the automated dropbox setup.
WestCoastJustin 13y ago
Steve Gibson suggests [1] that direct access means, direct access to their internet pipes, effectively tapping or mirroring their content for analysis. He says that "direct access" has more meaning to non-techies than saying they "are listening at the upstream router". Very interesting podcast too. The $20 million per collection point, is to build the secure secret rooms [2] at their [google, facebook, apple, microsoft, etc] telecom providers, slip the fibers, and for all the gear they need to do it. He even suggests this is legal, since it is the open internet and anyone is allowed to peer into the traffic, since this is not actually in any of their [google, facebook, apple, microsoft, etc] data centers, but at the peering level. [1] http://twit.tv/show/security-now/408 http://twit.tv/show/security-now/408 [2] http://en.wikipedia.org/wiki/Room_641A http://en.wikipedia.org/wiki/Room_641A
- mpyne 13y ago
  Was the wording on the slide "direct access to"? I remember there being a "directly from the servers", but that wording has to be interpreted in the context of what it means to someone in the intel community (like the NSA). And I'm 80% sure that what it means in that context is that the source of the data received has no middleman. I.e. they pull Google's records straight from Google, not from a wiretap or SIGINT, just like for Facebook, PalTalk, etc.
  - jdp23 13y ago
    The wording was indeed "collection directly from the servers". [1] Robert O'Harrow et. al.'s followon article from the Washington post had more details [2] Intelligence community sources said that this description, although inaccurate from a technical perspective, matches the experience of analysts at the NSA. From their workstations anywhere in the world, government employees cleared for PRISM access may “task” the system and receive results from an Internet company without further interaction with the company’s staff.... According to a more precise description contained in a classified NSA inspector general’s report, also obtained by The Post, PRISM allows “collection managers [to send] content tasking instructions directly to equipment installed at company-controlled locations,” rather than directly to company servers. The companies cannot see the queries that are sent from the NSA to the systems installed on their premises, according to sources familiar with the PRISM process. [1] http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server-collection-facebook-google http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server... [2] http://www.washingtonpost.com/world/national-security/us-company-officials-internet-surveillance-does-not-indiscriminately-mine-data/2013/06/08/5b3bb234-d07d-11e2-9f1a-1a7cdee20287_print.html http://www.washingtonpost.com/world/national-security/us-com...
DanielBMarkham 13y ago
Just to recap, PRISM looks like a web front-end to a shitload of other systems. This is why a relative noob like Snowden was working on it -- it was web work. It's also why he had such a broad overview of what was going on. He knew the direction and capabilities, if not the details. He was probably just hooking up APIs somewhere. That's just guesswork, of course. I think it's easy for us (and the Guardian) to imply a lot of detail where none exists. I don't think the Guardian has anything to apologize for. It'd be great if we all got a better technical view of these systems. But asking to receive it third-hand through a leaker and a non-technical reporter is probably a bit much.
- mpyne 13y ago
  The Guardian could at least "apologize" for using "scare quotes" in the process of walking back their claim. That's underhanded for any media publication that aspires to the idea of "journalism". In addition they could have at least mentioned the idea that other theories emerged as to what the slides they presented might actually mean that way people would be aware that there were other valid conclusions that could possibly be drawn, especially by those with tech and government experience.
  - ubernostrum 13y ago
    British papers tend to do that not as "scare quotes" but because they often quote someone else's description of an event in their headlines, or refer to it in the article.
  - cadlin 13y ago
    The Guardian isn't walking back anything. The submitted article just takes another Guardian article about a different aspect of the story (article title: "NSA scandal: Microsoft and Twitter join calls to disclose data requests") and proceeds to call it a walk-back, which it is not.
    - tptacek 13y ago
      No. Rather than issue a direct correction to their initial story which so falsely represented the facts on the ground that all of the US's largest internet companies simultaneously issued categorical denials, the Guardian ran another article that redefined the term "direct access", knowing (as they had to have) that their own original interpretation of the term, in black and white in Greenwald's original reporting, had been repeated as fact by numerous major media outlets.
anologwintermut 13y ago
So the Gaurdian appears to have done some very very shoddy reporting. But isn't this all a distraction? FTP or direct acces, it makes no practical difference if the employee on the other end rubber stamps the requests when they get them. The real question is how much data can the NSA get and what procedures do they have to prevent the targeting of US person? what checks does e.g Google actually run on the requests? If the procedure is email FISA@google.com and then some google employee rubber stamps it and sticks the data in an SFTP server, the NSA effectively has unfettered access. Its clear that you don't need a warrant for targeting a foreign person, so the employee can't check that it came for FISC. Even if they did, FISC seems to be willing to rubber stamp things themselves. So aside from maybe checking if the account is typically accessed from a US IP, whats Google going to do? I pick on Google here specifically only because they have a reputation for trying to automate everything including a lot of customer support and I suspect that if they don't have any discretion on these cases, they may well have automated it. Of course, maybe they didn't, maybe there are rigorous checks both at the NSA and at the receiving companies. But we don't know and we need to.
- skwirl 13y ago
  Google has directly contradicted what you are saying about rubber stamping requests. See http://googleblog.blogspot.com/2013/06/what.html http://googleblog.blogspot.com/2013/06/what.html and http://googleblog.blogspot.com/2013/06/asking-us-government-to-allow-google-to.html http://googleblog.blogspot.com/2013/06/asking-us-government-.... For example: "Our legal team reviews each and every request, and frequently pushes back when requests are overly broad or don’t follow the correct process."
  - anologwintermut 13y ago
    That does seem to preclude dragnet requests. But what is google going to do when the NSA asks for all the mail from "foo@gmail.com"? Is NSA going to give some justification for why the need access? Now what happens if the NSA issues thousands of those requests? They are not broad, they are for specific people. As to following proper procedure, it appears rather strongly that secret procedures allows the NSA to request a hell of a lot legally and may not provide much safeguard for preventing abuse. We don't know because the procedures are secret. Again, the companies in question appear to have little choice in the matter and that probably absolves them of a lot, but that doesn't mean the situation is ok from the view of what they were compeled to do.
Aqueous 13y ago
https://news.ycombinator.com/item?id=5844303 https://news.ycombinator.com/item?id=5844303
andrewcooke 13y ago
which guardian article is being discussed? because if you look at http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n... they are absolutely correct in what they report. everything is qualified with "the documents say...", etc.
- skwirl 13y ago
  Are they? The Guardian has selectively released three or four slides out of 41. You can split hairs and try to come up with some contrived reading of the article that could be argued as accurate, but I think in reality everyone understood the article to be claiming that the NSA had unfettered access to the severs of tech companies.
  - andrewcooke 13y ago
    they're reporters, not clairvoyants. their job is to tell you what the docs say. they told you, and they were right to tell you, because the information looked very interesting. you jumped to conclusions. and so they now have to apologize because you weren't as careful as they were? they did their job as well as they could. they had what appeared to be interesting data, but instead of just saying, "wow, XXX" they were very careful to not go beyond what was said. i jumped to conclusions too. but then i realised i was probably wrong. it happens. but i don't then blame the reporters who did their job reasonably well. i made the mistake, not them.
room271 13y ago
The precise mechanism isn't important. The key question is: is there mass surveillance going on without warrants? And the answer appears to be yes. No one has disputed, for example, the Verizon leaks that started all this.
- brown9-2 13y ago
  Technically the Verizon "leak" was a leak of a court order, so it has some legal merit. We can debate if it's fair or in spirit with the Constitution and 4th Amendment to issue such a wide-reaching court order, but it's not warrant-less.
  - joeguilmette 13y ago
    Technically, it is a court order, not a warrant. So it is warrantless.
skwirl 13y ago
An interesting article was just published with the headline "Greenwald gives away the game on his PRISM claim." He is continuing to walk back his original claims of direct access. http://littlegreenfootballs.com/article/42126_Greenwald_gives_away_the_game_on_his_PRISM_claims http://littlegreenfootballs.com/article/42126_Greenwald_give...
danso 13y ago
I think that Greenwald should've been more skeptical, regardless of how technical savvy he may or may not be. Look at the slide in question...in any other organization, that slide would be interpreted as a slide aimed at the newbies/idiots in a company...it pretty much literally says, using brightly colored bubbles: "Hey people, remember that we have two systems for collecting data, so please use both of them. We even gave one of them an easy-to-remember acronym" Isn't it possible that a slide written for newbies (within NSA, or those who work with the NSA) might have also been written by someone who is not an all-star in technical communication?
- Steko 13y ago
  The Bob Cesca item this mediaite post is building on makes the case that Greenwald saw what he wanted to see: I’m going to put it all out there and let the chips fall where they may: I’m increasingly convinced that Glenn Greenwald’s reporting on the NSA story is tainted by his well-known agenda, leading him to make broad claims for the purposes of inciting outrage. http://thedailybanter.com/2013/06/greenwald-sticks-with-his-story-in-spite-of-growing-questions/ http://thedailybanter.com/2013/06/greenwald-sticks-with-his-... See also: http://www.rants.org/2013/06/11/epic_botch_of_prism_story/ http://www.rants.org/2013/06/11/epic_botch_of_prism_story/
  - brown9-2 13y ago
    Greenwald's twitter feed of the last few days confirms this (in my mind) - many tweets praising those who are praising Snowden, comparing him to Ellsberg, etc, about how a survey shows X% of Americans think Snowden is a hero. It's not really what I would have expected of a journalist at a major newspaper.
tptacek 13y ago
A lie gets halfway around the world before the truth gets its pants on. This story made it 1/3rd up the front page; stories based on the most extreme possible interpretation of what seems to be Greenwald's own extreme interpretation of a slide deck covered the entire front page for days. Remember when "direct access" meant Palantir was a third party doing the actual collection? Just look at their name! Remember when all of Facebook and Google and Yahoo's denials looked "suspiciously similar"? Someone on Twitter (sorry) said that Google and Facebook "looked like angels" compared to Verizon. That sounds about right to me, too. But what incentive do they have to do that when their reward is conspiracy-theoretic nonsense about how NSA has their TLS keys and 3rd party contractors are used to keep them from "lying" when they say NSA has no direct access?
- bstrand 13y ago
  Here's what Glenn Greenwald said on June 8: "Our story was written from the start to say NSA claimed this, telecoms deny-we wanted them to have to work it out in public what they do. We reported - accurately - what the NSA claims. We reported - accurately - what the companies claim. It conflicts. That's why we reported it."
  - tptacek 13y ago
    It looks to me like what he's saying now conflicts with what he actually wrote in his original report. https://news.ycombinator.com/item?id=5845649 https://news.ycombinator.com/item?id=5845649 edited to be less conclusive
    - nullc 13y ago
      You keep making these statements but they don't agree with your own links. "The National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants, ___according to a top secret document obtained by the Guardian___." (Em mine) This is text from the message of yours which you are linking to here. It agrees with the quote bstrand provided.
gasull 13y ago
This is the best explanation I've read about how PRISM might work: http://uncrunched.com/2013/06/11/connecting-the-prism-dots-my-new-theory/ http://uncrunched.com/2013/06/11/connecting-the-prism-dots-m...
ig1 13y ago
Except that theory doesn't explain the public statements either. Google has specifically denied having a drop box facility: "We cannot say this more clearly—the government does not have access to Google servers—not directly, or via a back door, or a so-called drop box." https://plus.google.com/+google/posts/TMh6gUVrwMq https://plus.google.com/+google/posts/TMh6gUVrwMq Among other features WashPo specifically describes live interception which would require more sophisticated integration than a mere drop box facility: "Google’s offerings include Gmail, voice and video chat, Google Drive files, photo libraries, and live surveillance of search terms." http://www.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companies-in-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story_3.html http://www.washingtonpost.com/investigations/us-intelligence... Not to mention NYT's independent source: "In one recent instance, the National Security Agency sent an agent to a tech company’s headquarters to monitor a suspect in a cyberattack, a lawyer representing the company said. The agent installed government-developed software on the company’s server and remained at the site for several weeks to download data to an agency laptop. In other instances, the lawyer said, the agency seeks real-time transmission of data, which companies send digitally." http://www.nytimes.com/2013/06/08/technology/tech-companies-bristling-concede-to-government-surveillance-efforts.html?pagewanted=2&_r=0&hp http://www.nytimes.com/2013/06/08/technology/tech-companies-...
- discostrings 13y ago
  It's important to remember that there are many companies involved here. PalTalk's direct access could be a begrudgingly set up teletype of live chat transcripts while Apple could have provided a VPN connection and a root password. We don't know yet know what access was sufficient to be a part of the "direct access" Prism program. It will be interesting to see what degree of commitment each of these companies showed to the privacy of its users. It appears that however Twitter was complying with requests, it wasn't as convenient for the NSA as Prism access...
interstitial 13y ago
Anyone else think they are playing "Rope a Dope"?
detcader 13y ago
According to Greenwald, The Guardian is "not remotely" walking back any initial claims. https://twitter.com/ggreenwald/status/345315199257047040 https://twitter.com/ggreenwald/status/345315199257047040 onekade: Confused about this. The Guardian "correction" doesn't walk back its initial claim at all. mediaite.com/online/fulsome… ggreenwald: @onekade Not remotely - they're desperate to discredit all the spying, but it's not going to work. Documents are too powerful
lostlogin 13y ago
I can help but think about the following point when looking at this. Do people really care whether access was direct or indirect if their own personal records have all been captured and/or seen/analyzed? It sure wouldn't matter to me how they pried their way in - it would matter to me that they had done it though.
CurtMonash 13y ago
Simple explanation of the original error -- the person who put together the slide deck wasn't exactly a dev on the technology itself. It does call into doubt the credibility of Snowden's OPINIONS about the scope of NSA technology and procedures. The technology error -- or more precisely the lack of rapid correction -- isn't one of Greenwald's finer moments, but in general he's done such an awesome job on this issue that I give him a pass on that blunder.
- CurtMonash 13y ago
  And by the way -- $20 million budget always meant PRISM was only a small part of the whole. Not realizing that was actually a dumber error on Greenwald's part than him taking "direct access" at face value.
pradocchia 13y ago
I don't know, but it appears the message brigade is out in force now. Our initial shock is gone, and we are eager for more narrative. Now is the opportunity to cast doubt, to reframe, to discredit.
deleted 13y ago
[deleted]
pvnick 13y ago
The Guardian "backwalk" actually VALIDATES our worst fears, albeit with technical nuances to ensure legality. It's really just about the only viable way to implement this absent an SSL encryption crack (I would guess they're dumping encrypted communications from Room 641A waiting for an encryption weakness to be discovered, that way they'll have everything). As Snowden said, you could wiretap the president if you have a personal email. Here's how it works (this is my opinion as a web developer, not verified details from Snowden leak): 1) Fancy user interface developed by Booz Allen Hamilton. Enter email address (good choice for a unique identifier, used as unique key in many databases). 2) Backend uses curl to send a request to NSA-certified web api on each service shown on the slide. This serves as a legally-binding FISA request either regarding a foreign agent - no court order required - or a domestic agent - secret FISA court order required (see http://www.npr.org/2013/06/13/191226106/fisa-court-appears-to-be-rubberstamp-for-government-requests http://www.npr.org/2013/06/13/191226106/fisa-court-appears-t...) and assumed to be fulfilled by the api. 3) Kick off NSA equivalent of gearman worker that checks contents of "dropbox"-like service from each company for updates. 4) Services (Google, Facebook, etc) automatically grant request without question as it is a legally binding FISA order. This saves them a ton of money and, hey, it's legal! They have some custom code that allows them to look up a user by their email address - almost guaranteed to be indexed in their database - join it to relevant data sets, and dump it to the "dropbox"-like system. 5) Fancy frontend shows progress bar, while skinny backend compresses retrieved data into zip file for easy download. This is the most efficient, cost-effective way to do this without venturing into science fiction, ie storing a mirror of all the data which would be stupid on NSA's part. It still verifies our worst fears and answers the question as to how such a program can cost "only" $20 million per year as reported by the slides. The trick is in the legal framework, not the technical details. This is why the FISA courts are secret.
- muglug 13y ago
  Except that Google have stated that they have humans look into each request, and that there is no dropbox. So either Google's lying, or The Guardian/Edward Snowdon didn't actually understand what was going on (beyond the obviously true and worrying collusion with AT&T and Verizon).
junto 13y ago
It would seem to be relatively obvious to me, that would I be interested in partaking in a bit of terrorism, I would be relatively sure that using Skype, Facebook or Gmail would be a stupid idea. I think I would have deeply suspected that that was a stupid idea before PRISM, and now even more so since Snowdengate. The idea that this technology is being used for anything other than mass control is bullshit. I don't want to sound like a member of the tinfoil-hat-brigade, but sadly, I just don't see terrorists using any of the resources offered by the PRISM mentioned US corporations. I do see a very dangerous threat to democracy.

161 points by skwirl 13y ago

mpyne 13y ago

So in other words, the Guardian is saying that I'm right (again)? https://news.ycombinator.com/item?id=5859493 https://news.ycombinator.com/item?id=5859493

tptacek 13y ago
Greenwald, in (I think) a slippery way, tried to start walking this back last week: https://news.ycombinator.com/item?id=5845649 https://news.ycombinator.com/item?id=5845649
- skwirl 13y ago
  Here's an interesting take on Mr. Greenwald's handling of this story: http://thedailybanter.com/2013/06/greenwald-sticks-with-his-story-in-spite-of-growing-questions/ http://thedailybanter.com/2013/06/greenwald-sticks-with-his-...
jonlucc 13y ago
I think it's possible that Steve Gibson is right on this week's Security Now podcast. He suggests that perhaps the NSA has tapped into the ISP just upstream of the 9 companies listed. Then, they copy all of the data coming into and out of the fiber going to the Google datacenters. This fits with the name Prism, and is corroborated by the 2006 revelation about the NSA-controlled room in the ATT building in San Francisco. Edit: this does rely on the NSA having access to routers, not servers, so it still isn't exactly what they said
- mpyne 13y ago
  Yeah, the NSA might have a system like that for all I know, but it's going to be named something other than PRISM.
- skwirl 13y ago
  While certainly a possibility, that really wouldn't fit in with everything else we've heard about PRISM, including what the tech companies have said. It also wouldn't allow the NSA to view data transferred over SSL (which I believe is all gmail and Facebook traffic, at least for me) -- unless the NSA has broken the encryption algorithms.
- tonfa 13y ago
  With a 20M budget?
  - holloway 13y ago
    Prism might only be part of it, there are ways of breaking up projects in budgets obviously. It could just feed the data into another system
anologwintermut 13y ago
A pyrrhic victory if Google's interface is Bool is_NSA_authorized(int fisa_id) const { return True; // Our hands are tied by FAA 702. // We really don't want to be doing this. // But we have no choice, its "legal". // I hope the NSA has some procedures // to make sure this isn't abused. // Otherwise they could get anything // they want from us. }
- tptacek 13y ago
  Also this is all a sideshow if Google is in fact trying to conceal the existence of alien spacecraft recovered from Roswell.
- mpyne 13y ago
  That could have been their manual process before Prism as well...
  - anologwintermut 13y ago
    It may well have been . And thats not their fault if their hands are legally tied. Especially since they appear to be trying to actually disclose what they have to hand over. My comment wasn't meant as a dig at Google, they are forced to comply with what ever the law actually authorized. My point was we need to know how much they can actually be forced to hand over and what checks there are on that power being abused.

jessaustin 13y ago

How would access to an FTP server that serves all the data one wants not be considered "direct"? I really doubt NSA analysts need shell access to do their dirty work...

skwirl 13y ago
The point is that the companies decide what production data to deposit on these servers after their legal teams have reviewed FISA requests. According to the tech companies, these requests are individually reviewed and target individuals and are narrow in scope. And they push back when they are broad. This detail is a major one. This would mean the NSA cannot simply log on to Facebook and query for whatever they want. It means the system is simply a way for companies to comply with FISA requests, something that they were already required to do. So: even though Twitter doesn't use PRISM, there is really no difference between what the NSA can access on Twitter and what they can access on Facebook. Twitter just complies through some other manner.
- holloway 13y ago
  I think that's a bit generous. They look over the request but if the result set is too large it couldn't be reasonably vetted by lawyers. Eg, they would have a look at it but we don't know how rigorous they are or could be.
  - skwirl 13y ago
    Yeah, I think the main point is that this is simply a way of responding to FISA requests, which are completely independent of PRISM. In other words, there is no new news here. The debate over FISA itself is certainly quite valid. Google has claimed these requests are infrequent and narrowly focused, and they have requested permission from the government to publish some statistics. I hope they get it.
mpyne 13y ago
Because the company has to provide the data (or not). The company can (must) decide to exclude data that doesn't have a FISA warrant, for example. The threat to this model is the idea that a FISA warrant might not be required until monitoring has gone on for 72 hours, but that was just as much of a threat with the prior model, where the data were manually extracted and sent by the company instead of using the automated dropbox setup.

WestCoastJustin 13y ago

Steve Gibson suggests [1] that direct access means, direct access to their internet pipes, effectively tapping or mirroring their content for analysis. He says that "direct access" has more meaning to non-techies than saying they "are listening at the upstream router". Very interesting podcast too. The $20 million per collection point, is to build the secure secret rooms [2] at their [google, facebook, apple, microsoft, etc] telecom providers, slip the fibers, and for all the gear they need to do it. He even suggests this is legal, since it is the open internet and anyone is allowed to peer into the traffic, since this is not actually in any of their [google, facebook, apple, microsoft, etc] data centers, but at the peering level. [1] http://twit.tv/show/security-now/408 http://twit.tv/show/security-now/408 [2] http://en.wikipedia.org/wiki/Room_641A http://en.wikipedia.org/wiki/Room_641A

mpyne 13y ago
Was the wording on the slide "direct access to"? I remember there being a "directly from the servers", but that wording has to be interpreted in the context of what it means to someone in the intel community (like the NSA). And I'm 80% sure that what it means in that context is that the source of the data received has no middleman. I.e. they pull Google's records straight from Google, not from a wiretap or SIGINT, just like for Facebook, PalTalk, etc.
- jdp23 13y ago
  The wording was indeed "collection directly from the servers". [1] Robert O'Harrow et. al.'s followon article from the Washington post had more details [2] Intelligence community sources said that this description, although inaccurate from a technical perspective, matches the experience of analysts at the NSA. From their workstations anywhere in the world, government employees cleared for PRISM access may “task” the system and receive results from an Internet company without further interaction with the company’s staff.... According to a more precise description contained in a classified NSA inspector general’s report, also obtained by The Post, PRISM allows “collection managers [to send] content tasking instructions directly to equipment installed at company-controlled locations,” rather than directly to company servers. The companies cannot see the queries that are sent from the NSA to the systems installed on their premises, according to sources familiar with the PRISM process. [1] http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server-collection-facebook-google http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server... [2] http://www.washingtonpost.com/world/national-security/us-company-officials-internet-surveillance-does-not-indiscriminately-mine-data/2013/06/08/5b3bb234-d07d-11e2-9f1a-1a7cdee20287_print.html http://www.washingtonpost.com/world/national-security/us-com...

DanielBMarkham 13y ago

Just to recap, PRISM looks like a web front-end to a shitload of other systems. This is why a relative noob like Snowden was working on it -- it was web work. It's also why he had such a broad overview of what was going on. He knew the direction and capabilities, if not the details. He was probably just hooking up APIs somewhere. That's just guesswork, of course. I think it's easy for us (and the Guardian) to imply a lot of detail where none exists. I don't think the Guardian has anything to apologize for. It'd be great if we all got a better technical view of these systems. But asking to receive it third-hand through a leaker and a non-technical reporter is probably a bit much.

mpyne 13y ago
The Guardian could at least "apologize" for using "scare quotes" in the process of walking back their claim. That's underhanded for any media publication that aspires to the idea of "journalism". In addition they could have at least mentioned the idea that other theories emerged as to what the slides they presented might actually mean that way people would be aware that there were other valid conclusions that could possibly be drawn, especially by those with tech and government experience.
- ubernostrum 13y ago
  British papers tend to do that not as "scare quotes" but because they often quote someone else's description of an event in their headlines, or refer to it in the article.
- cadlin 13y ago
  The Guardian isn't walking back anything. The submitted article just takes another Guardian article about a different aspect of the story (article title: "NSA scandal: Microsoft and Twitter join calls to disclose data requests") and proceeds to call it a walk-back, which it is not.
  - tptacek 13y ago
    No. Rather than issue a direct correction to their initial story which so falsely represented the facts on the ground that all of the US's largest internet companies simultaneously issued categorical denials, the Guardian ran another article that redefined the term "direct access", knowing (as they had to have) that their own original interpretation of the term, in black and white in Greenwald's original reporting, had been repeated as fact by numerous major media outlets.

anologwintermut 13y ago

So the Gaurdian appears to have done some very very shoddy reporting. But isn't this all a distraction? FTP or direct acces, it makes no practical difference if the employee on the other end rubber stamps the requests when they get them. The real question is how much data can the NSA get and what procedures do they have to prevent the targeting of US person? what checks does e.g Google actually run on the requests? If the procedure is email FISA@google.com and then some google employee rubber stamps it and sticks the data in an SFTP server, the NSA effectively has unfettered access. Its clear that you don't need a warrant for targeting a foreign person, so the employee can't check that it came for FISC. Even if they did, FISC seems to be willing to rubber stamp things themselves. So aside from maybe checking if the account is typically accessed from a US IP, whats Google going to do? I pick on Google here specifically only because they have a reputation for trying to automate everything including a lot of customer support and I suspect that if they don't have any discretion on these cases, they may well have automated it. Of course, maybe they didn't, maybe there are rigorous checks both at the NSA and at the receiving companies. But we don't know and we need to.

skwirl 13y ago
Google has directly contradicted what you are saying about rubber stamping requests. See http://googleblog.blogspot.com/2013/06/what.html http://googleblog.blogspot.com/2013/06/what.html and http://googleblog.blogspot.com/2013/06/asking-us-government-to-allow-google-to.html http://googleblog.blogspot.com/2013/06/asking-us-government-.... For example: "Our legal team reviews each and every request, and frequently pushes back when requests are overly broad or don’t follow the correct process."
- anologwintermut 13y ago
  That does seem to preclude dragnet requests. But what is google going to do when the NSA asks for all the mail from "foo@gmail.com"? Is NSA going to give some justification for why the need access? Now what happens if the NSA issues thousands of those requests? They are not broad, they are for specific people. As to following proper procedure, it appears rather strongly that secret procedures allows the NSA to request a hell of a lot legally and may not provide much safeguard for preventing abuse. We don't know because the procedures are secret. Again, the companies in question appear to have little choice in the matter and that probably absolves them of a lot, but that doesn't mean the situation is ok from the view of what they were compeled to do.

Aqueous 13y ago

https://news.ycombinator.com/item?id=5844303 https://news.ycombinator.com/item?id=5844303

andrewcooke 13y ago

which guardian article is being discussed? because if you look at http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n... they are absolutely correct in what they report. everything is qualified with "the documents say...", etc.

skwirl 13y ago
Are they? The Guardian has selectively released three or four slides out of 41. You can split hairs and try to come up with some contrived reading of the article that could be argued as accurate, but I think in reality everyone understood the article to be claiming that the NSA had unfettered access to the severs of tech companies.
- andrewcooke 13y ago
  they're reporters, not clairvoyants. their job is to tell you what the docs say. they told you, and they were right to tell you, because the information looked very interesting. you jumped to conclusions. and so they now have to apologize because you weren't as careful as they were? they did their job as well as they could. they had what appeared to be interesting data, but instead of just saying, "wow, XXX" they were very careful to not go beyond what was said. i jumped to conclusions too. but then i realised i was probably wrong. it happens. but i don't then blame the reporters who did their job reasonably well. i made the mistake, not them.

room271 13y ago

The precise mechanism isn't important. The key question is: is there mass surveillance going on without warrants? And the answer appears to be yes. No one has disputed, for example, the Verizon leaks that started all this.

brown9-2 13y ago
Technically the Verizon "leak" was a leak of a court order, so it has some legal merit. We can debate if it's fair or in spirit with the Constitution and 4th Amendment to issue such a wide-reaching court order, but it's not warrant-less.
- joeguilmette 13y ago
  Technically, it is a court order, not a warrant. So it is warrantless.

skwirl 13y ago

An interesting article was just published with the headline "Greenwald gives away the game on his PRISM claim." He is continuing to walk back his original claims of direct access. http://littlegreenfootballs.com/article/42126_Greenwald_gives_away_the_game_on_his_PRISM_claims http://littlegreenfootballs.com/article/42126_Greenwald_give...

danso 13y ago

I think that Greenwald should've been more skeptical, regardless of how technical savvy he may or may not be. Look at the slide in question...in any other organization, that slide would be interpreted as a slide aimed at the newbies/idiots in a company...it pretty much literally says, using brightly colored bubbles: "Hey people, remember that we have two systems for collecting data, so please use both of them. We even gave one of them an easy-to-remember acronym" Isn't it possible that a slide written for newbies (within NSA, or those who work with the NSA) might have also been written by someone who is not an all-star in technical communication?

Steko 13y ago
The Bob Cesca item this mediaite post is building on makes the case that Greenwald saw what he wanted to see: I’m going to put it all out there and let the chips fall where they may: I’m increasingly convinced that Glenn Greenwald’s reporting on the NSA story is tainted by his well-known agenda, leading him to make broad claims for the purposes of inciting outrage. http://thedailybanter.com/2013/06/greenwald-sticks-with-his-story-in-spite-of-growing-questions/ http://thedailybanter.com/2013/06/greenwald-sticks-with-his-... See also: http://www.rants.org/2013/06/11/epic_botch_of_prism_story/ http://www.rants.org/2013/06/11/epic_botch_of_prism_story/
- brown9-2 13y ago
  Greenwald's twitter feed of the last few days confirms this (in my mind) - many tweets praising those who are praising Snowden, comparing him to Ellsberg, etc, about how a survey shows X% of Americans think Snowden is a hero. It's not really what I would have expected of a journalist at a major newspaper.

tptacek 13y ago

A lie gets halfway around the world before the truth gets its pants on. This story made it 1/3rd up the front page; stories based on the most extreme possible interpretation of what seems to be Greenwald's own extreme interpretation of a slide deck covered the entire front page for days. Remember when "direct access" meant Palantir was a third party doing the actual collection? Just look at their name! Remember when all of Facebook and Google and Yahoo's denials looked "suspiciously similar"? Someone on Twitter (sorry) said that Google and Facebook "looked like angels" compared to Verizon. That sounds about right to me, too. But what incentive do they have to do that when their reward is conspiracy-theoretic nonsense about how NSA has their TLS keys and 3rd party contractors are used to keep them from "lying" when they say NSA has no direct access?

bstrand 13y ago
Here's what Glenn Greenwald said on June 8: "Our story was written from the start to say NSA claimed this, telecoms deny-we wanted them to have to work it out in public what they do. We reported - accurately - what the NSA claims. We reported - accurately - what the companies claim. It conflicts. That's why we reported it."
- tptacek 13y ago
  It looks to me like what he's saying now conflicts with what he actually wrote in his original report. https://news.ycombinator.com/item?id=5845649 https://news.ycombinator.com/item?id=5845649 edited to be less conclusive
  - nullc 13y ago
    You keep making these statements but they don't agree with your own links. "The National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants, ___according to a top secret document obtained by the Guardian___." (Em mine) This is text from the message of yours which you are linking to here. It agrees with the quote bstrand provided.

gasull 13y ago

This is the best explanation I've read about how PRISM might work: http://uncrunched.com/2013/06/11/connecting-the-prism-dots-my-new-theory/ http://uncrunched.com/2013/06/11/connecting-the-prism-dots-m...

ig1 13y ago

Except that theory doesn't explain the public statements either. Google has specifically denied having a drop box facility: "We cannot say this more clearly—the government does not have access to Google servers—not directly, or via a back door, or a so-called drop box." https://plus.google.com/+google/posts/TMh6gUVrwMq https://plus.google.com/+google/posts/TMh6gUVrwMq Among other features WashPo specifically describes live interception which would require more sophisticated integration than a mere drop box facility: "Google’s offerings include Gmail, voice and video chat, Google Drive files, photo libraries, and live surveillance of search terms." http://www.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companies-in-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story_3.html http://www.washingtonpost.com/investigations/us-intelligence... Not to mention NYT's independent source: "In one recent instance, the National Security Agency sent an agent to a tech company’s headquarters to monitor a suspect in a cyberattack, a lawyer representing the company said. The agent installed government-developed software on the company’s server and remained at the site for several weeks to download data to an agency laptop. In other instances, the lawyer said, the agency seeks real-time transmission of data, which companies send digitally." http://www.nytimes.com/2013/06/08/technology/tech-companies-bristling-concede-to-government-surveillance-efforts.html?pagewanted=2&_r=0&hp http://www.nytimes.com/2013/06/08/technology/tech-companies-...

discostrings 13y ago
It's important to remember that there are many companies involved here. PalTalk's direct access could be a begrudgingly set up teletype of live chat transcripts while Apple could have provided a VPN connection and a root password. We don't know yet know what access was sufficient to be a part of the "direct access" Prism program. It will be interesting to see what degree of commitment each of these companies showed to the privacy of its users. It appears that however Twitter was complying with requests, it wasn't as convenient for the NSA as Prism access...

interstitial 13y ago

Anyone else think they are playing "Rope a Dope"?

detcader 13y ago

According to Greenwald, The Guardian is "not remotely" walking back any initial claims. https://twitter.com/ggreenwald/status/345315199257047040 https://twitter.com/ggreenwald/status/345315199257047040 onekade: Confused about this. The Guardian "correction" doesn't walk back its initial claim at all. mediaite.com/online/fulsome… ggreenwald: @onekade Not remotely - they're desperate to discredit all the spying, but it's not going to work. Documents are too powerful

lostlogin 13y ago

I can help but think about the following point when looking at this. Do people really care whether access was direct or indirect if their own personal records have all been captured and/or seen/analyzed? It sure wouldn't matter to me how they pried their way in - it would matter to me that they had done it though.

CurtMonash 13y ago

Simple explanation of the original error -- the person who put together the slide deck wasn't exactly a dev on the technology itself. It does call into doubt the credibility of Snowden's OPINIONS about the scope of NSA technology and procedures. The technology error -- or more precisely the lack of rapid correction -- isn't one of Greenwald's finer moments, but in general he's done such an awesome job on this issue that I give him a pass on that blunder.

CurtMonash 13y ago
And by the way -- $20 million budget always meant PRISM was only a small part of the whole. Not realizing that was actually a dumber error on Greenwald's part than him taking "direct access" at face value.

pradocchia 13y ago

I don't know, but it appears the message brigade is out in force now. Our initial shock is gone, and we are eager for more narrative. Now is the opportunity to cast doubt, to reframe, to discredit.

deleted 13y ago

[deleted]

pvnick 13y ago

The Guardian "backwalk" actually VALIDATES our worst fears, albeit with technical nuances to ensure legality. It's really just about the only viable way to implement this absent an SSL encryption crack (I would guess they're dumping encrypted communications from Room 641A waiting for an encryption weakness to be discovered, that way they'll have everything). As Snowden said, you could wiretap the president if you have a personal email. Here's how it works (this is my opinion as a web developer, not verified details from Snowden leak): 1) Fancy user interface developed by Booz Allen Hamilton. Enter email address (good choice for a unique identifier, used as unique key in many databases). 2) Backend uses curl to send a request to NSA-certified web api on each service shown on the slide. This serves as a legally-binding FISA request either regarding a foreign agent - no court order required - or a domestic agent - secret FISA court order required (see http://www.npr.org/2013/06/13/191226106/fisa-court-appears-to-be-rubberstamp-for-government-requests http://www.npr.org/2013/06/13/191226106/fisa-court-appears-t...) and assumed to be fulfilled by the api. 3) Kick off NSA equivalent of gearman worker that checks contents of "dropbox"-like service from each company for updates. 4) Services (Google, Facebook, etc) automatically grant request without question as it is a legally binding FISA order. This saves them a ton of money and, hey, it's legal! They have some custom code that allows them to look up a user by their email address - almost guaranteed to be indexed in their database - join it to relevant data sets, and dump it to the "dropbox"-like system. 5) Fancy frontend shows progress bar, while skinny backend compresses retrieved data into zip file for easy download. This is the most efficient, cost-effective way to do this without venturing into science fiction, ie storing a mirror of all the data which would be stupid on NSA's part. It still verifies our worst fears and answers the question as to how such a program can cost "only" $20 million per year as reported by the slides. The trick is in the legal framework, not the technical details. This is why the FISA courts are secret.

muglug 13y ago
Except that Google have stated that they have humans look into each request, and that there is no dropbox. So either Google's lying, or The Guardian/Edward Snowdon didn't actually understand what was going on (beyond the obviously true and worrying collusion with AT&T and Verizon).

junto 13y ago

It would seem to be relatively obvious to me, that would I be interested in partaking in a bit of terrorism, I would be relatively sure that using Skype, Facebook or Gmail would be a stupid idea. I think I would have deeply suspected that that was a stupid idea before PRISM, and now even more so since Snowdengate. The idea that this technology is being used for anything other than mass control is bullshit. I don't want to sound like a member of the tinfoil-hat-brigade, but sadly, I just don't see terrorists using any of the resources offered by the PRISM mentioned US corporations. I do see a very dangerous threat to democracy.