4 ms·

I think that's an excellent summary, but also: that SFTP-like access almost certainly keeps happening, for that targeted account, after the initial request. Per

by gojomo 13y ago

I think that's an excellent summary, but also: that SFTP-like access almost certainly keeps happening, for that targeted account, after the initial request. Perhaps it happens hourly, or even faster when relevant account events (login, message-received, message-sent, voip-call) occur. For most of the world -- those who have never SSH'd into a machine, nor had machine 'root' access -- that rapid-batch-dump access still would be fairly described as "direct access". Word meanings vary based on context and the expertise of the discussion participant; the slide deck and the journalistic reports were all written at the level of fuzzy understanding, not technical precision. Practitioner nitpicks about the implementation details don't refute them.

tptacek 13y ago
The Guardian went out of its way to characterize the access not only as "direct" but "unilateral".
- gojomo 13y ago
  I'd need to see the context to know if the Guardian was wrong where they used that exact word, or were simply describing something that exists with some companies or at another level of tapping.
  - tptacek 13y ago
    A graf from Greenwald's original story: When the FAA was first enacted, defenders of the statute argued that a significant check on abuse would be the NSA's inability to obtain electronic communications without the consent of the telecom and internet companies that control the data. But the Prism program renders that consent unnecessary, as it allows the agency to directly and unilaterally seize the communications off the companies' servers. Every part of this graf appears to be false!
    - gojomo 13y ago
      The 1st sentence seems fine: the companies have no practical way to withhold consent. The phrasing "directly and unilaterally seize" seems exaggerated given the preponderance of current revelations and denials, but if Prism includes other not-yet-revealed acquisition methods, might still be substantially true. After all, the denials you're relying on are from company leaders who also said they've never heard of Prism. I can believe Greenwald got overexcited in that phrasing, and trusted the slide deck (including as-yet-unreleased slides) too much. Just like perhaps Obama was a bit clumsy and overeager to reassure with his phrasing, "Nobody is listening to your telephone calls."
      - tptacek 13y ago
        The companies can withhold consent simply by not consenting. Both NSA and the company then have to appear before a federal court and argue the case; a court then orders one side or the other (obviously: virtually always the company) to back down. It bothers people that the USG virtually always wins these cases. But I think it shouldn't bother people as much as it does, for a couple of reasons: * It's also the case that state governments win most attempts to get Title III wiretaps; in those cases, it's because getting a Title III wiretap is an expensive process that involves a shitload of paperwork, and prosecutors don't waste the time going for them unless they're sure they're going to win. It appears easier to get a FISA directive upheld, but it's not free. * It's what you'd expect to see happen if the USG was only using FISA to conduct foreign surveillance, which, while I wouldn't take NSA's word for it, is not at all hard to believe; what is the motivation for them to set up a paper trail with the FISC of doing something else?
      - leoc 13y ago
        > but if Prism includes other not-yet-revealed acquisition methods, might still be substantially true Yes, but that's close to being a tautology: what outlandish claim might not turn out to be true if in future startling new revelations supported it? In fact, direct access in the NSA-has-root sense is less likely in light of the PRISM slides: why file 702 orders and dicker with webco lawyers if you're able and willing to get whatever you want through some kind of back channel? Why create a Top Secret overview and training resource for Internet surveillance and apparently not mention this backdoor?
    - vidarh 13y ago
      Greenwald's statement here about the Prism program is explaining what the NSA document claims. This is clear from context. If it is false, it is false in the same way as a book reviews that recaps events in a novel is false. And unless I've missed some major revelation, it "appears to be false" on the basis of press releases from companies with an interest in not being caught with their pants down. Forgive me for not being so willing to jump to conclusions about which claims to believe.
      - mpyne 13y ago
        It's false in that it's technically inaccurate, even given nothing but the slides. E.g. "direct and unilateral access". Unilateral means exactly that only one party needs to decide, the reality is that it is bilateral access (both parties must agree). So that's at least one thing Greenwald managed to screw up in his "book review" of a single slide. The question is whether blame lies with Greenwald alone, or if Snowden mislead him into that by stupidity or malice.
        vidarh 13y ago
        > the reality is that it is bilateral access (both parties must agree). How do you know this on the basis of the slides alone?
- unclebucknasty 13y ago
  So what? The subject of this thread is that the NSA admitted that analysts can listen to the content of all of our phone calls without a warrant. We are having this discussion because the Snowden link put the NSA front and center. Yet, you are arguing some mundane semantics? Instead of smearing the people responsible for these revelations, why not try to focus on the big picture? That is, all of this is leading to long overdue appropriate dialogue, that is engaging our representatives in the oversight that is required to uphold our Constitution. Big picture!
  - tptacek 13y ago
    No, I am arguing that AT&T rolled over (and, as it turns out from today's Gellman piece in WaPo, took money from the USG to do it), while Google fought back. But commenters on boards like this are happy to shit all over Google because (a) any allegation that Google rolled over to the USG confirms their biases, (b) they're inclined to put people into binary "agrees with me entirely" or "disagrees with me entirely" buckets that presume anyone who argues with them must be apologizing for NSA, and (c) because it's fun to talk about big companies like Google being evil and less fun to talk about them working hard not to be. You think these are mundane semantics. I think they're more meaningful than that. People on HN can't get me to shut over the right fix for a CSRF bug or how taxicabs can be licensed; why would anyone think I'd back down on an issue like this?
    - vidarh 13y ago
      It's more that a lot of people are more inclined to trust a leaked NSA document that claims NSA does the type of things that people already believed NSA does, including when it implicates Google, than a Google PR denial of a very specific interpretation of the same. In the absence of more evidence about what exactly PRISM does, what we have is guesswork, but guesswork where believing some interpretation of the NSA documents becomes easier the more revelations of extensive NSA surveillance via other channels that are coming out.
    - tripzilch 13y ago
      If they didn't want to be "evil" they shouldn't have been collecting these gigantic amounts of data without properly protecting them from parties such as the NSA. For all the promotion they put into two-factor authentication for account-safety, "suspicious login attempt" notifications, etc, if they had done the same for GPG in GMail/Chrome, that would have been a huge step towards giving the mainstream a taste of actually being in control of their own privacy, I'm not saying we wouldn't have this problem right now, but we'd be in a way better position of dealing with it, for sure. edit: to be clear, that is one of the many reasons why I think this arguing about whether this access is "direct" or whether it's "sorta kinda direct" distracts from the real issue: access.
- vidarh 13y ago
  The Guardian reported what the NSA documents claims PRISM does. You keep implying that The Guardian is making unsubstantiated claims, but their article is full of "NSA claims" and quotation marks, and it would take someone intentionally trying to read something else into it to ascribe these claims to The Guardian. Are you claiming The Guardian is lying or mistaken about what the NSA documents says? Because if you are not, then your beef should not be with The Guardian articles, but with the NSA documents. It's possible the NSA documents are technically incorrect, but if that is what you believe, then complain about the NSA rather than attack the reporting, as in that case attacking the reporting just seems like a weak attempt at making your arguments seem more credible by attaching the claims about "direct" access to the reporters rather than the NSA.

by gojomo 13y ago

tptacek 13y ago

The Guardian went out of its way to characterize the access not only as "direct" but "unilateral".

gojomo 13y ago
I'd need to see the context to know if the Guardian was wrong where they used that exact word, or were simply describing something that exists with some companies or at another level of tapping.
- tptacek 13y ago
  A graf from Greenwald's original story: When the FAA was first enacted, defenders of the statute argued that a significant check on abuse would be the NSA's inability to obtain electronic communications without the consent of the telecom and internet companies that control the data. But the Prism program renders that consent unnecessary, as it allows the agency to directly and unilaterally seize the communications off the companies' servers. Every part of this graf appears to be false!
  - gojomo 13y ago
    The 1st sentence seems fine: the companies have no practical way to withhold consent. The phrasing "directly and unilaterally seize" seems exaggerated given the preponderance of current revelations and denials, but if Prism includes other not-yet-revealed acquisition methods, might still be substantially true. After all, the denials you're relying on are from company leaders who also said they've never heard of Prism. I can believe Greenwald got overexcited in that phrasing, and trusted the slide deck (including as-yet-unreleased slides) too much. Just like perhaps Obama was a bit clumsy and overeager to reassure with his phrasing, "Nobody is listening to your telephone calls."
    - tptacek 13y ago
      The companies can withhold consent simply by not consenting. Both NSA and the company then have to appear before a federal court and argue the case; a court then orders one side or the other (obviously: virtually always the company) to back down. It bothers people that the USG virtually always wins these cases. But I think it shouldn't bother people as much as it does, for a couple of reasons: * It's also the case that state governments win most attempts to get Title III wiretaps; in those cases, it's because getting a Title III wiretap is an expensive process that involves a shitload of paperwork, and prosecutors don't waste the time going for them unless they're sure they're going to win. It appears easier to get a FISA directive upheld, but it's not free. * It's what you'd expect to see happen if the USG was only using FISA to conduct foreign surveillance, which, while I wouldn't take NSA's word for it, is not at all hard to believe; what is the motivation for them to set up a paper trail with the FISC of doing something else?
    - leoc 13y ago
      > but if Prism includes other not-yet-revealed acquisition methods, might still be substantially true Yes, but that's close to being a tautology: what outlandish claim might not turn out to be true if in future startling new revelations supported it? In fact, direct access in the NSA-has-root sense is less likely in light of the PRISM slides: why file 702 orders and dicker with webco lawyers if you're able and willing to get whatever you want through some kind of back channel? Why create a Top Secret overview and training resource for Internet surveillance and apparently not mention this backdoor?
  - vidarh 13y ago
    Greenwald's statement here about the Prism program is explaining what the NSA document claims. This is clear from context. If it is false, it is false in the same way as a book reviews that recaps events in a novel is false. And unless I've missed some major revelation, it "appears to be false" on the basis of press releases from companies with an interest in not being caught with their pants down. Forgive me for not being so willing to jump to conclusions about which claims to believe.
    - mpyne 13y ago
      It's false in that it's technically inaccurate, even given nothing but the slides. E.g. "direct and unilateral access". Unilateral means exactly that only one party needs to decide, the reality is that it is bilateral access (both parties must agree). So that's at least one thing Greenwald managed to screw up in his "book review" of a single slide. The question is whether blame lies with Greenwald alone, or if Snowden mislead him into that by stupidity or malice.
      - vidarh 13y ago
        > the reality is that it is bilateral access (both parties must agree). How do you know this on the basis of the slides alone?
unclebucknasty 13y ago
So what? The subject of this thread is that the NSA admitted that analysts can listen to the content of all of our phone calls without a warrant. We are having this discussion because the Snowden link put the NSA front and center. Yet, you are arguing some mundane semantics? Instead of smearing the people responsible for these revelations, why not try to focus on the big picture? That is, all of this is leading to long overdue appropriate dialogue, that is engaging our representatives in the oversight that is required to uphold our Constitution. Big picture!
- tptacek 13y ago
  No, I am arguing that AT&T rolled over (and, as it turns out from today's Gellman piece in WaPo, took money from the USG to do it), while Google fought back. But commenters on boards like this are happy to shit all over Google because (a) any allegation that Google rolled over to the USG confirms their biases, (b) they're inclined to put people into binary "agrees with me entirely" or "disagrees with me entirely" buckets that presume anyone who argues with them must be apologizing for NSA, and (c) because it's fun to talk about big companies like Google being evil and less fun to talk about them working hard not to be. You think these are mundane semantics. I think they're more meaningful than that. People on HN can't get me to shut over the right fix for a CSRF bug or how taxicabs can be licensed; why would anyone think I'd back down on an issue like this?
  - vidarh 13y ago
    It's more that a lot of people are more inclined to trust a leaked NSA document that claims NSA does the type of things that people already believed NSA does, including when it implicates Google, than a Google PR denial of a very specific interpretation of the same. In the absence of more evidence about what exactly PRISM does, what we have is guesswork, but guesswork where believing some interpretation of the NSA documents becomes easier the more revelations of extensive NSA surveillance via other channels that are coming out.
  - tripzilch 13y ago
    If they didn't want to be "evil" they shouldn't have been collecting these gigantic amounts of data without properly protecting them from parties such as the NSA. For all the promotion they put into two-factor authentication for account-safety, "suspicious login attempt" notifications, etc, if they had done the same for GPG in GMail/Chrome, that would have been a huge step towards giving the mainstream a taste of actually being in control of their own privacy, I'm not saying we wouldn't have this problem right now, but we'd be in a way better position of dealing with it, for sure. edit: to be clear, that is one of the many reasons why I think this arguing about whether this access is "direct" or whether it's "sorta kinda direct" distracts from the real issue: access.
vidarh 13y ago
The Guardian reported what the NSA documents claims PRISM does. You keep implying that The Guardian is making unsubstantiated claims, but their article is full of "NSA claims" and quotation marks, and it would take someone intentionally trying to read something else into it to ascribe these claims to The Guardian. Are you claiming The Guardian is lying or mistaken about what the NSA documents says? Because if you are not, then your beef should not be with The Guardian articles, but with the NSA documents. It's possible the NSA documents are technically incorrect, but if that is what you believe, then complain about the NSA rather than attack the reporting, as in that case attacking the reporting just seems like a weak attempt at making your arguments seem more credible by attaching the claims about "direct" access to the reporters rather than the NSA.