4 ms·
The Guardian "backwalk" actually VALIDATES our worst fears, albeit with technical nuances to ensure legality. It's really just about the only viable way to impl
by pvnick 13y ago
The Guardian "backwalk" actually VALIDATES our worst fears, albeit with technical nuances to ensure legality. It's really just about the only viable way to implement this absent an SSL encryption crack (I would guess they're dumping encrypted communications from Room 641A waiting for an encryption weakness to be discovered, that way they'll have everything). As Snowden said, you could wiretap the president if you have a personal email.
Here's how it works (this is my opinion as a web developer, not verified details from Snowden leak):
1) Fancy user interface developed by Booz Allen Hamilton. Enter email address (good choice for a unique identifier, used as unique key in many databases).
2) Backend uses curl to send a request to NSA-certified web api on each service shown on the slide. This serves as a legally-binding FISA request either regarding a foreign agent - no court order required - or a domestic agent - secret FISA court order required (see http://www.npr.org/2013/06/13/191226106/fisa-court-appears-to-be-rubberstamp-for-government-requests http://www.npr.org/2013/06/13/191226106/fisa-court-appears-t...) and assumed to be fulfilled by the api.
3) Kick off NSA equivalent of gearman worker that checks contents of "dropbox"-like service from each company for updates.
4) Services (Google, Facebook, etc) automatically grant request without question as it is a legally binding FISA order. This saves them a ton of money and, hey, it's legal! They have some custom code that allows them to look up a user by their email address - almost guaranteed to be indexed in their database - join it to relevant data sets, and dump it to the "dropbox"-like system.
5) Fancy frontend shows progress bar, while skinny backend compresses retrieved data into zip file for easy download.
This is the most efficient, cost-effective way to do this without venturing into science fiction, ie storing a mirror of all the data which would be stupid on NSA's part. It still verifies our worst fears and answers the question as to how such a program can cost "only" $20 million per year as reported by the slides.
The trick is in the legal framework, not the technical details. This is why the FISA courts are secret.
- muglug 13y agoExcept that Google have stated that they have humans look into each request, and that there is no dropbox. So either Google's lying, or The Guardian/Edward Snowdon didn't actually understand what was going on (beyond the obviously true and worrying collusion with AT&T and Verizon).
- pvnick 13y ago>Google have stated that they have humans look into each request, and that there is no dropbox I've been looking for this since I read your comment but can't seem to find it. Perhaps you could point me to the article to which you're referring? If true that would be great, but to fulfill the constrains set by the information we do know, it is possible that most companies have drop boxes, while Google opted out. Do you recall what Facebook said about human review and drop box existence? Edit: I also wonder how many requests are appealed. The human overseers you're referring to may be little more than mechanical turks and that data is returned in near-realtime.
- tptacek 13y agoI'm unclear on why the "drop box" matters, so long as it's being filled manually after expert review. In fact, a secure drop box is better than the alternative, which would be ad hoc distribution of sensitive information over the public Internet.
- dannyr 13y agoPoint you to an article? You mean you've been shooting off here on HN without even reading? At Google's official blog post, they stated that review each request. Don't ask people for a link. Do your research first before you comment.
- tptacek 13y agoHere's how it works (this is my professional opinion as a web developer +++ATH0 NO CARRIER
- pvnick 13y agoYes I am a web developer that goes to work everyday in a professional environment.
- tptacek 13y agoIn your professional experience as a web developer, maybe you could square this assertion: Services (Google, Facebook, etc) automatically grant request without question as it is a legally binding FISA order ... with the court order the NYT linked to from FAS, where Yahoo is seen to go several rounds with the FISC after having received a lawful directive from NSA to initiate surveillance? From exactly what evidence do you argue that Google (or any other Internet company) automatically approves all FISA requests?
- pvnick 13y agoSnarky tone unnecessary. To which court order do you refer? Edit: Also, your tweet quoting me sarcastically was also unnecessary. I'm trying to be helpful and you're being rude.