6 ms·

I think you are making some poor semantic arguments yourself. The simple case is that of the NSA document ("collection directly from the servers of these US se

I think you are making some poor semantic arguments yourself. The simple case is that of the NSA document ("collection directly from the servers of these US service providers") against google ("The U.S. government does not have direct access or a “back door” to the information stored in our data centers"). These are two competing claims, neither of which have been supported by evidence and hence the burden of proof rests equally with both cases. Anything else (By the Guardian, Slate, the 'mainstream view on HN' or yourself) is purely speculative. You seem to place the burden of proof on one claim over another and hold a very specific view on what 'direct access' means. You also seem to hold a strange interpretation of the Guardian's reporting, but I won't get into that as its largely immaterial to the real subject.

tptacek 13y ago
For those keeping score, this is another of the kind of comment that lead me to believe that most HN commenters take the obvious interpretation of "direct access".
- twelvechairs 13y ago
  What? I'm not putting forth any interpretation of 'direct access'. I appreciate that it seems you are responding to a lot of comments but I really find this comment lazy and borderline offensive.
  - tptacek 13y ago
    The two are not really competing claims; the argument over whether they are is the argument that NSA could in fact have direct access to the servers operating Google Mail. I'm not trying to single you out, sorry.
    - twelvechairs 13y ago
      Are you saying that the "collection directly from the servers" claim of the NSA document is simply the systems we already know about (FISA warrants or otherwise) until proven otherwise? To me the terminology of the document probably (though not necessarily) indicates something more serious, but I'm not sure its necessarily 'cables into gmail' (which you seem to indicate as the only alternate). For instance, potentially someone working for Google may transfer selected records out manually without the knowledge of Google. Thanks but I'm not so concerned to be 'singled out' as 'lumped in'. I want to get to understand your views more than simply disagree. I hope my previous posts haven't seemed too argumentative either.
      - tptacek 13y ago
        Marc Ambinder, a reporter who has covered the national security beat for many years (before that he was a political reporter for The Atlantic, and before that the White House reporter for --- I think? --- CBS), reported that PRISM is a system of dropbox servers and a user interface that allows seamless access to all of those servers, presumably so that analysts don't have to keep track of which data is affiliated with Google and which data is affiliated with Yahoo. Other reports have corroborated this. Declan McCullagh, who has covered this beat for CNet for something like 10 years and is most notable on HN for jumping into threads and arguing the EFF's side of any given story against me (in other words: not a guy prone to support of the establishment), ran a story last week with sources that also denied that NSA had unilateral access to Google Mail. The NYT just a few days ago ran a story with a linked FISA court order that documented Yahoo's attempt to push back on a FISA directive, a process that would not have been necessary (for the government) had NSA had direct access to Yahoo's servers; the court order demanded that Yahoo turn over data. And, of course, Google categorically denies that NSA has direct unilateral access to their servers and, for that matter, that they've been able to obtain records for large fractions of their user base. Those denials have come from multiple levels of the company, from the CEO to the General Counsel to their tech leaders to people on their security team. I'm not simply supposing that NSA doesn't have this access. Based on the evidence available, I am drawing the obvious conclusion that they do not.
        declan 13y ago
        Hey! That's me! (I've covered this beat at CNET for 11 years and at Wired and Time and Wired a second time before that for about 5 years. It's not the EFF's side I'd argue, but I'm flattered that you think so.) Anyway, I've disagreed politely with <tptacek> before, but he is 100% correct here.
        twelvechairs 13y ago
        Thanks for the detail - I now understand you view far better than earlier in the thread. will read these articles when I have the time
        vidarh 13y ago
  - mpyne 13y ago
    You're saying that Google's claims compete with NSA's. They don't.
    - twelvechairs 13y ago
      Thanks for the response. See my reply to tptacek above. I probably should have said 'appear to compete' or similar, as reading them together does not lead to an easy answer - and there are a number of possibilities as to how you could interpret them.
      - mpyne 13y ago
        Certainly true that there are a number of possibilities. The one that seems to make sense per Occam's Razor and the mass of evidence we now have is that Prism is an NSA-side "facade pattern" against a set of company-specific FISA/NSL-compliance APIs. In NSA-speak this is "collection directly from the servers of $FOO" because there is no wiretap or other SIGINT or ELINT shenanigans. They ask, or the FISA Court compels by warrant, for a company to turn over information they have, the company sends it over electronically. Prism, on the NSA end, takes care to feed that information that is sent over to whichever analyst is working the case, patches up company-specific details so the analyst doesn't have to worry about it, etc. But they don't have feelers onto every datacenter owned by those 9 companies so there is no "direct access to data", as has been errorneously and loosely parroted around.
nathan_long 13y ago
>> These are two competing claims Steve Gibson has proposed a scenario that makes both claims credible: that the NSA has installed fiber optic splitters (hence the name "prism") directly upstream from Google, Apple, etc and therefore can sniff all the packets headed to their servers without their knowledge. Notes from Gibson's podcast: https://www.grc.com/sn/sn-408.txt https://www.grc.com/sn/sn-408.txt This scenario would be a large expansion of what Mark Klein testified was being done at AT&T in 2006 (https://www.eff.org/files/filenode/att/presskit/ATT_onepager.pdf https://www.eff.org/files/filenode/att/presskit/ATT_onepager...). It would also explain why the NSA slides showed service providers being added gradually: it would take time to carry out these secret installations. If Gibson's analysis is right, Google et al would have no knowledge of the taps, yet the NSA would have most of their traffic. Yes, SSL traffic is still impenetrable. However, 1) it can be stored for cracking in the future (perhaps in the Bluffdale facility) and 2) lots of traffic, like email traveling between hosts, is not encrypted.

tptacek 13y ago

For those keeping score, this is another of the kind of comment that lead me to believe that most HN commenters take the obvious interpretation of "direct access".

twelvechairs 13y ago
What? I'm not putting forth any interpretation of 'direct access'. I appreciate that it seems you are responding to a lot of comments but I really find this comment lazy and borderline offensive.
- tptacek 13y ago
  The two are not really competing claims; the argument over whether they are is the argument that NSA could in fact have direct access to the servers operating Google Mail. I'm not trying to single you out, sorry.
  - twelvechairs 13y ago
    Are you saying that the "collection directly from the servers" claim of the NSA document is simply the systems we already know about (FISA warrants or otherwise) until proven otherwise? To me the terminology of the document probably (though not necessarily) indicates something more serious, but I'm not sure its necessarily 'cables into gmail' (which you seem to indicate as the only alternate). For instance, potentially someone working for Google may transfer selected records out manually without the knowledge of Google. Thanks but I'm not so concerned to be 'singled out' as 'lumped in'. I want to get to understand your views more than simply disagree. I hope my previous posts haven't seemed too argumentative either.
    - tptacek 13y ago
      Marc Ambinder, a reporter who has covered the national security beat for many years (before that he was a political reporter for The Atlantic, and before that the White House reporter for --- I think? --- CBS), reported that PRISM is a system of dropbox servers and a user interface that allows seamless access to all of those servers, presumably so that analysts don't have to keep track of which data is affiliated with Google and which data is affiliated with Yahoo. Other reports have corroborated this. Declan McCullagh, who has covered this beat for CNet for something like 10 years and is most notable on HN for jumping into threads and arguing the EFF's side of any given story against me (in other words: not a guy prone to support of the establishment), ran a story last week with sources that also denied that NSA had unilateral access to Google Mail. The NYT just a few days ago ran a story with a linked FISA court order that documented Yahoo's attempt to push back on a FISA directive, a process that would not have been necessary (for the government) had NSA had direct access to Yahoo's servers; the court order demanded that Yahoo turn over data. And, of course, Google categorically denies that NSA has direct unilateral access to their servers and, for that matter, that they've been able to obtain records for large fractions of their user base. Those denials have come from multiple levels of the company, from the CEO to the General Counsel to their tech leaders to people on their security team. I'm not simply supposing that NSA doesn't have this access. Based on the evidence available, I am drawing the obvious conclusion that they do not.
      - declan 13y ago
        Hey! That's me! (I've covered this beat at CNET for 11 years and at Wired and Time and Wired a second time before that for about 5 years. It's not the EFF's side I'd argue, but I'm flattered that you think so.) Anyway, I've disagreed politely with <tptacek> before, but he is 100% correct here.
      - twelvechairs 13y ago
        Thanks for the detail - I now understand you view far better than earlier in the thread. will read these articles when I have the time
      - vidarh 13y ago
- mpyne 13y ago
  You're saying that Google's claims compete with NSA's. They don't.
  - twelvechairs 13y ago
    Thanks for the response. See my reply to tptacek above. I probably should have said 'appear to compete' or similar, as reading them together does not lead to an easy answer - and there are a number of possibilities as to how you could interpret them.
    - mpyne 13y ago
      Certainly true that there are a number of possibilities. The one that seems to make sense per Occam's Razor and the mass of evidence we now have is that Prism is an NSA-side "facade pattern" against a set of company-specific FISA/NSL-compliance APIs. In NSA-speak this is "collection directly from the servers of $FOO" because there is no wiretap or other SIGINT or ELINT shenanigans. They ask, or the FISA Court compels by warrant, for a company to turn over information they have, the company sends it over electronically. Prism, on the NSA end, takes care to feed that information that is sent over to whichever analyst is working the case, patches up company-specific details so the analyst doesn't have to worry about it, etc. But they don't have feelers onto every datacenter owned by those 9 companies so there is no "direct access to data", as has been errorneously and loosely parroted around.

nathan_long 13y ago

>> These are two competing claims Steve Gibson has proposed a scenario that makes both claims credible: that the NSA has installed fiber optic splitters (hence the name "prism") directly upstream from Google, Apple, etc and therefore can sniff all the packets headed to their servers without their knowledge. Notes from Gibson's podcast: https://www.grc.com/sn/sn-408.txt https://www.grc.com/sn/sn-408.txt This scenario would be a large expansion of what Mark Klein testified was being done at AT&T in 2006 (https://www.eff.org/files/filenode/att/presskit/ATT_onepager.pdf https://www.eff.org/files/filenode/att/presskit/ATT_onepager...). It would also explain why the NSA slides showed service providers being added gradually: it would take time to carry out these secret installations. If Gibson's analysis is right, Google et al would have no knowledge of the taps, yet the NSA would have most of their traffic. Yes, SSL traffic is still impenetrable. However, 1) it can be stored for cracking in the future (perhaps in the Bluffdale facility) and 2) lots of traffic, like email traveling between hosts, is not encrypted.