7 ms·

So now the debate is about what "direct access" exactly means, instead of about the content of the leaks, about the massive surveillance. Isn't this a misdirec

by gasull 13y ago

So now the debate is about what "direct access" exactly means, instead of about the content of the leaks, about the massive surveillance. Isn't this a misdirection?

skwirl 13y ago
This is exactly about the content of the leaks. If the supposed leak is baloney then it is not misdirection to call it out. The debate over "direct access" is not a small detail. It is the difference between a major story and something that tells us nothing new. I think this was best explained here: https://medium.com/prism-truth/82a1791c94d3 https://medium.com/prism-truth/82a1791c94d3
- samstave 13y ago
  Direct Access is a red herring. What I want to know is if they had full conent mirroring, MITM nodes etc. Personally, I believe there is a possibility that the name PRISM itself is an allusion to the method of data slurping the NSA has been using. Where there are plenty of articles talking about their fiber splicing actions etc... I take PRISM to mean they were taking streams and were able to focus on a particular 'wavelength' in the stream and mirror it to their own systems. I don't think they had "direct" access to FB systems - even though there are plenty of former CIA/SS/Military (and potentially NSA moles) already openly working as actual employees of FB - I don't think they necessarily needed full and direct access - the NSA taps the ISPs directly.
  - mikegioia 13y ago
    I think given the "direct access" note in the slide, SV's weird focus on the word "direct", the name "PRISM", and the outing of AT&T 641A a few years ago it is definitely within reason to assume they're beam splitting the fiber signal at the ISP level. That provides plausible deniability to Google, FB, etc. What I want to know is how much of that signal are they (a) storing indefinitely, (b) DPI or SSL decrypting, and (c) merely keyword analyzing. If they're storing it indefinitely and/or utilizing SSL MITM then we're pretty much done as far as privacy is concerned. But if they're just keyword analyzing cleartext packets then honestly who gives a shit. My gut is telling me they're decrypting SSL. FB and Google moved to HTTPS everywhere a few years ago and they're clearly getting this data somehow so...
    - samstave 13y ago
      >"how much of that signal are they (a) storing indefinitely, (b) DPI or SSL decrypting, and (c) merely keyword analyzing. I think this probably nails it - but in reverse order: They peel a stream off, keyword analyze it - in conjunction with other weights (i.e. who is talking, to whom, between where, what medium, when (i.e. the meta data)) and then they store the key ones. If I am talking to my Grandma, the drop it. If I am talking to an unknown number in [foreign country] they test for keywords, if any are hits - they store it and add more meta-data. I mean - the whole thing is what I understood the Mythical Project Echelon to be -- but there was never any concrete evidence of Echelon to the degree that it was rumored to be, until now. Now we know that they definitely trap any packet they can wrangle. The tech side of HOW they are seeing everything is inconsequential to the fact that they ARE seeing everything crossing the pipes.
    - leoc 13y ago
      They do do "upstream collection", it says so in the released slides. However they also do "direct collection" from the webapp companies ("You Should Use Both"), so it doesn't provide SV with plausible deniability.
- gasull 13y ago
  What matters is the scope of the access, how broad it is. Not if the access is "direct" or not. That's semantics. The NSA requested all metadata from Verizon. That tells us something new.
  - rayiner 13y ago
    It's not semantics at all. The "scope" is infinite. The government can get pretty much any information that exists pursuant to a valid warrant or subpoena. That has been true since the founding of the republic, and was true in England for hundreds of years before that. What matters is how direct that access is. Does the government have to submit a warrant to get user-specific data, and then gets that data back in a drop box like system? Then there's nothing illegal, surprising, or even sketchy about that. Can the government get direct access to Facebook's servers without going through their legal department? Then that's a big deal!
    - gasull 13y ago
      I mean the scope of the already requested data, not of the data they could potentially request. It's indeed very sketchy that the NSA asks for the metadata of all the Verizon customers.
VladRussian2 13y ago
razor thin differences here would beat the differences of various semantics of "to have sex with this woman" :)
- marshray 13y ago
  Well that depends on what your definition of 'is' is.
  - Zigurd 13y ago
    I think it's already been claimed that the "least untruthful" statement about monitoring hinges on the definition of "collect."
    - marshray 13y ago
      Perhaps that's just a misdirection from the real redefinition: #define metadata DNA samples for breeding a clone army

by gasull 13y ago

So now the debate is about what "direct access" exactly means, instead of about the content of the leaks, about the massive surveillance. Isn't this a misdirection?

skwirl 13y ago

This is exactly about the content of the leaks. If the supposed leak is baloney then it is not misdirection to call it out. The debate over "direct access" is not a small detail. It is the difference between a major story and something that tells us nothing new. I think this was best explained here: https://medium.com/prism-truth/82a1791c94d3 https://medium.com/prism-truth/82a1791c94d3

samstave 13y ago
Direct Access is a red herring. What I want to know is if they had full conent mirroring, MITM nodes etc. Personally, I believe there is a possibility that the name PRISM itself is an allusion to the method of data slurping the NSA has been using. Where there are plenty of articles talking about their fiber splicing actions etc... I take PRISM to mean they were taking streams and were able to focus on a particular 'wavelength' in the stream and mirror it to their own systems. I don't think they had "direct" access to FB systems - even though there are plenty of former CIA/SS/Military (and potentially NSA moles) already openly working as actual employees of FB - I don't think they necessarily needed full and direct access - the NSA taps the ISPs directly.
- mikegioia 13y ago
  I think given the "direct access" note in the slide, SV's weird focus on the word "direct", the name "PRISM", and the outing of AT&T 641A a few years ago it is definitely within reason to assume they're beam splitting the fiber signal at the ISP level. That provides plausible deniability to Google, FB, etc. What I want to know is how much of that signal are they (a) storing indefinitely, (b) DPI or SSL decrypting, and (c) merely keyword analyzing. If they're storing it indefinitely and/or utilizing SSL MITM then we're pretty much done as far as privacy is concerned. But if they're just keyword analyzing cleartext packets then honestly who gives a shit. My gut is telling me they're decrypting SSL. FB and Google moved to HTTPS everywhere a few years ago and they're clearly getting this data somehow so...
  - samstave 13y ago
    >"how much of that signal are they (a) storing indefinitely, (b) DPI or SSL decrypting, and (c) merely keyword analyzing. I think this probably nails it - but in reverse order: They peel a stream off, keyword analyze it - in conjunction with other weights (i.e. who is talking, to whom, between where, what medium, when (i.e. the meta data)) and then they store the key ones. If I am talking to my Grandma, the drop it. If I am talking to an unknown number in [foreign country] they test for keywords, if any are hits - they store it and add more meta-data. I mean - the whole thing is what I understood the Mythical Project Echelon to be -- but there was never any concrete evidence of Echelon to the degree that it was rumored to be, until now. Now we know that they definitely trap any packet they can wrangle. The tech side of HOW they are seeing everything is inconsequential to the fact that they ARE seeing everything crossing the pipes.
  - leoc 13y ago
    They do do "upstream collection", it says so in the released slides. However they also do "direct collection" from the webapp companies ("You Should Use Both"), so it doesn't provide SV with plausible deniability.
gasull 13y ago
What matters is the scope of the access, how broad it is. Not if the access is "direct" or not. That's semantics. The NSA requested all metadata from Verizon. That tells us something new.
- rayiner 13y ago
  It's not semantics at all. The "scope" is infinite. The government can get pretty much any information that exists pursuant to a valid warrant or subpoena. That has been true since the founding of the republic, and was true in England for hundreds of years before that. What matters is how direct that access is. Does the government have to submit a warrant to get user-specific data, and then gets that data back in a drop box like system? Then there's nothing illegal, surprising, or even sketchy about that. Can the government get direct access to Facebook's servers without going through their legal department? Then that's a big deal!
  - gasull 13y ago
    I mean the scope of the already requested data, not of the data they could potentially request. It's indeed very sketchy that the NSA asks for the metadata of all the Verizon customers.

VladRussian2 13y ago

razor thin differences here would beat the differences of various semantics of "to have sex with this woman" :)

marshray 13y ago
Well that depends on what your definition of 'is' is.
- Zigurd 13y ago
  I think it's already been claimed that the "least untruthful" statement about monitoring hinges on the definition of "collect."
  - marshray 13y ago
    Perhaps that's just a misdirection from the real redefinition: #define metadata DNA samples for breeding a clone army