5 ms·

1. Glenn Greenwald, the reporter with actual access to the source and documents, is sticking to the original narrative. I don't know where this "back walking" t

by pvnick 13y ago

1. Glenn Greenwald, the reporter with actual access to the source and documents, is sticking to the original narrative. I don't know where this "back walking" theme is coming from. Take a look at Greenwald's twitter @ggreenwald for clarification on this point. 2. We've learned that many of these requests are bulk demands for many, many people at a time, often demanding data to be delivered indefinitely thereafter on a periodic basis. We also know that the FISA appeals court has favored the government 100% of the time. 3. It was never stated that the "watching your thoughts as you type" portion was part of the PRISM program. This next part is wild speculation on my part, but if the NSA has a database of zero-day exploits, which I would bet that they do, you could theoretically streamline the process of setting up a keylogger on a target's computer if you know their basic system setup. If they've designed this process to coincide with the laws as has been the pattern with other things we've seen, it's certainly conceivable that Snowden could deploy that system from his terminal. Greenwald has stated that more revelations are coming. I would say to watch this story closely over the next several weeks, but I'm sure you were going to do that anyway.

quaunaut 13y ago
> Greenwald has stated that more revelations are coming. I would say to watch this story closely over the next several weeks, but I'm sure you were going to do that anyway. I was, but at this point he needs to offer actual evidence of his claims. He's effectively claiming there has been an insanely massive data collection program that has somehow gone unnoticed by tens of thousands of security professionals for several years. And while our security professionals may take awhile to find things like Stuxnet/Flame, they at least found vestiges of the programs much earlier, and neither is anything close to the insanely wide scale this would require. I'm not saying this is impossible, but god damn is a lot of it sounding improbable as hell.
- pvnick 13y ago
  >gone unnoticed by tens of thousands of security professionals for several years I like that you seem to be making an honest assessment of the program but I really insist that you check this [1] out to see a few whistleblowers who have tried to bring attention to this, only to be rewarded with federal lawsuits. This has created a climate of fear where people ask "Is it really worth it? Or should I continue collecting my 6-digit paycheck and live in Hawaii?" [1] http://www.usatoday.com/story/news/politics/2013/06/16/snowden-whistleblower-nsa-officials-roundtable/2428809/ http://www.usatoday.com/story/news/politics/2013/06/16/snowd...
  - quaunaut 13y ago
    The thing is, those are all NSA folks. The tens of thousands of security professionals I'm talking about is everyone outside the NSA.
    - lancewiggs 13y ago
      Nobody is talking right? Any one of those security professionals that somehow gets in the know has smartly kept their head down.
    - amirmc 13y ago
      Stuxnet/Flame were things put out into the 'wild'. The recent stories are of large-scale dragnets sucking information in. Why should security professionals (outside the entity itself), ever know of it?
  - deleted 13y ago
    [deleted]
- eliasmacpherson 13y ago
  https://en.wikipedia.org/wiki/Calea https://en.wikipedia.org/wiki/Calea Security professionals, talk to them, ask them about CALEA.
  - szc 13y ago
    Security Professionals: Read section 109(b). Pay attention to (1)(B,C,E,F,I,K). Talk to your lawyers and accountants. Your company "reputation" has a value. What is it worth (50-75% of stock market value)? Read 109(b)(2). You want option (B).
    - tripzilch 13y ago
      What does this mean?
      - szc 13y ago
        There is a provision for not having to do CALEA. You have to show it would cost too much and the US Government refuses to pay you to do it.
      - dvanduzer 13y ago
        Is this[0] what you're looking for? szc is saying that carriers should include lost business / damaged reputation, when reporting the costs of complying with the legislation. Say it costs Verizon $10 million to build the infrastructure to let the government listen in. Verizon could claim that the revelation of this program will cost them $10 billion in future lost business. Since the Attorney General is unlikely to approve such an expense, Verizon would be declared compliant without actually having to turn anything over. It's an interesting loophole in theory, but probably wouldn't actually work. [0] https://en.wikisource.org/wiki/Communications_Assistance_for_Law_Enforcement_Act_of_1994#Sec._109._Payment_of_Costs_of_Telecommunications_Carriers_to_Comply_with_Capability_Requirements https://en.wikisource.org/wiki/Communications_Assistance_for.... edit: the anchor tag isn't getting parsed correctly: http://bit.ly/14Gbifo http://bit.ly/14Gbifo
- leoedin 13y ago
  You can't directly compare this with Stuxnet. Security people (or rather, security people who analyse viruses and worms) discovered stuxnet because it was in the wild. Security companies run honeypot machines set up to capture viruses so they can analyse them. Stuxnet was identified because they weren't discriminate enough with their targeting. It was only after stuxnet spread itself onto the wider internet that security researchers picked up on it and then thought "this is weird" when they looked at its behaviour. How do you suggest a third party security researcher could learn about data transfer between Apple's servers and the NSA's servers? Short of hacking into the system or an Apple/NSA employee whistleblowing, there's no way they could.
- temp9251 13y ago
  tl;dr citation 9. If nothing else, read that. Great article. The massive scale of the NSA's operations are hardly being disputed (logging of US-based backbones, underwater cables, foreign fiber, telephone records), what is up for debate is implementation details, specific wording, and the extent of protection for US citizens.[9] The "insanely massive data collection program" has been conducted for years. PRISM is one of 504 currently active SIGADs, or intel gathering operations. "The Boundless Informant documents show the agency collecting almost 3 billion pieces of intelligence from US computer networks over a 30-day period ending in March 2013." 97 billion were collected in total over that time span.[1] The FAQ for this program clarifies that it applies to metadata. [8] edit: that's 97 billion computer records. Metadata for 124 billion phone calls was also recorded over those 30 days. The NSA does not define "collection" as actually obtaining the data or metadata, it is defined as a human analyst viewing the data.[2] 11 FISA court warrant requests have been rejected over it's existence, out of over 33,000 total. The last one rejected was in 2009.[3] Warrants are also only needed retroactively (within a 7 day period), there is no need to obtain one before accessing data.[4] According to the New York Times, "FISA orders can range from inquiries about specific people to a broad sweep for intelligence, like logs of certain search terms, lawyers who work with the orders said." [5] The Fisa Amendment Act section 702 bars the NSA from collecting data on people "reasonably believed to be located outside the United States."[4] Additionally, data can be intentionally collected on any communication that has at least one foreign recipient or sender.[6] Note also that these warrants specifically contradict the fourth amendment, but as long as the target is "reasonably believed" to be a foreigner, it doesn't matter to the NSA. The test of whether someone is located outside the US has been interpreted as a keyword-based system indicating that it is at least 51% likely. And if they aren't actually foreigners? It's nothing to worry about, just include it on a quarterly report.[7] It's also possible that a warrant for a foreigner would permit access to data on US citizens up to 2 social "hops" away, but [citation needed]. Additional reading: https://www.eff.org/deeplinks/2013/06/foreign-surveillance-history-privacy-erosions https://www.eff.org/deeplinks/2013/06/foreign-surveillance-h... Written primarily for my own benefit, posted in the hope that someone else finds it informative. p.s. This account is wholly controlled and accessed by a United States citizen. [1] http://www.guardian.co.uk/world/2013/jun/08/nsa-boundless-informant-global-datamining http://www.guardian.co.uk/world/2013/jun/08/nsa-boundless-in... [2] https://www.eff.org/nsa-spying/wordgames#collect https://www.eff.org/nsa-spying/wordgames#collect [3] https://epic.org/privacy/wiretap/stats/fisa_stats.html https://epic.org/privacy/wiretap/stats/fisa_stats.html [4] FAA 702.g.1.B, page 6 at http://www.gpo.gov/fdsys/pkg/PLAW-110publ261/pdf/PLAW-110publ261.pdf http://www.gpo.gov/fdsys/pkg/PLAW-110publ261/pdf/PLAW-110pub... [5] http://www.nytimes.com/2013/06/08/technology/tech-companies-bristling-concede-to-government-surveillance-efforts.html?pagewanted=all http://www.nytimes.com/2013/06/08/technology/tech-companies-... [6] FAA 702.b.4 [7] http://www.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companies-in-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story_2.html http://www.washingtonpost.com/investigations/us-intelligence... [8] http://www.guardian.co.uk/world/interactive/2013/jun/08/boundless-informant-nsa-full-text http://www.guardian.co.uk/world/interactive/2013/jun/08/boun... [9] http://bigstory.ap.org/article/secret-prism-success-even-bigger-data-seizure http://bigstory.ap.org/article/secret-prism-success-even-big...
harshreality 13y ago
if the NSA has a database of zero-day exploits They have teams, hundreds of people, that do that stuff. http://www.foreignpolicy.com/articles/2013/06/10/inside_the_nsa_s_ultra_secret_china_hacking_group http://www.foreignpolicy.com/articles/2013/06/10/inside_the_...

by pvnick 13y ago

quaunaut 13y ago

> Greenwald has stated that more revelations are coming. I would say to watch this story closely over the next several weeks, but I'm sure you were going to do that anyway. I was, but at this point he needs to offer actual evidence of his claims. He's effectively claiming there has been an insanely massive data collection program that has somehow gone unnoticed by tens of thousands of security professionals for several years. And while our security professionals may take awhile to find things like Stuxnet/Flame, they at least found vestiges of the programs much earlier, and neither is anything close to the insanely wide scale this would require. I'm not saying this is impossible, but god damn is a lot of it sounding improbable as hell.

pvnick 13y ago
>gone unnoticed by tens of thousands of security professionals for several years I like that you seem to be making an honest assessment of the program but I really insist that you check this [1] out to see a few whistleblowers who have tried to bring attention to this, only to be rewarded with federal lawsuits. This has created a climate of fear where people ask "Is it really worth it? Or should I continue collecting my 6-digit paycheck and live in Hawaii?" [1] http://www.usatoday.com/story/news/politics/2013/06/16/snowden-whistleblower-nsa-officials-roundtable/2428809/ http://www.usatoday.com/story/news/politics/2013/06/16/snowd...
- quaunaut 13y ago
  The thing is, those are all NSA folks. The tens of thousands of security professionals I'm talking about is everyone outside the NSA.
  - lancewiggs 13y ago
    Nobody is talking right? Any one of those security professionals that somehow gets in the know has smartly kept their head down.
  - amirmc 13y ago
    Stuxnet/Flame were things put out into the 'wild'. The recent stories are of large-scale dragnets sucking information in. Why should security professionals (outside the entity itself), ever know of it?
- deleted 13y ago
  [deleted]
eliasmacpherson 13y ago
https://en.wikipedia.org/wiki/Calea https://en.wikipedia.org/wiki/Calea Security professionals, talk to them, ask them about CALEA.
- szc 13y ago
  Security Professionals: Read section 109(b). Pay attention to (1)(B,C,E,F,I,K). Talk to your lawyers and accountants. Your company "reputation" has a value. What is it worth (50-75% of stock market value)? Read 109(b)(2). You want option (B).
  - tripzilch 13y ago
    What does this mean?
    - szc 13y ago
      There is a provision for not having to do CALEA. You have to show it would cost too much and the US Government refuses to pay you to do it.
    - dvanduzer 13y ago
      Is this[0] what you're looking for? szc is saying that carriers should include lost business / damaged reputation, when reporting the costs of complying with the legislation. Say it costs Verizon $10 million to build the infrastructure to let the government listen in. Verizon could claim that the revelation of this program will cost them $10 billion in future lost business. Since the Attorney General is unlikely to approve such an expense, Verizon would be declared compliant without actually having to turn anything over. It's an interesting loophole in theory, but probably wouldn't actually work. [0] https://en.wikisource.org/wiki/Communications_Assistance_for_Law_Enforcement_Act_of_1994#Sec._109._Payment_of_Costs_of_Telecommunications_Carriers_to_Comply_with_Capability_Requirements https://en.wikisource.org/wiki/Communications_Assistance_for.... edit: the anchor tag isn't getting parsed correctly: http://bit.ly/14Gbifo http://bit.ly/14Gbifo
leoedin 13y ago
You can't directly compare this with Stuxnet. Security people (or rather, security people who analyse viruses and worms) discovered stuxnet because it was in the wild. Security companies run honeypot machines set up to capture viruses so they can analyse them. Stuxnet was identified because they weren't discriminate enough with their targeting. It was only after stuxnet spread itself onto the wider internet that security researchers picked up on it and then thought "this is weird" when they looked at its behaviour. How do you suggest a third party security researcher could learn about data transfer between Apple's servers and the NSA's servers? Short of hacking into the system or an Apple/NSA employee whistleblowing, there's no way they could.
temp9251 13y ago
tl;dr citation 9. If nothing else, read that. Great article. The massive scale of the NSA's operations are hardly being disputed (logging of US-based backbones, underwater cables, foreign fiber, telephone records), what is up for debate is implementation details, specific wording, and the extent of protection for US citizens.[9] The "insanely massive data collection program" has been conducted for years. PRISM is one of 504 currently active SIGADs, or intel gathering operations. "The Boundless Informant documents show the agency collecting almost 3 billion pieces of intelligence from US computer networks over a 30-day period ending in March 2013." 97 billion were collected in total over that time span.[1] The FAQ for this program clarifies that it applies to metadata. [8] edit: that's 97 billion computer records. Metadata for 124 billion phone calls was also recorded over those 30 days. The NSA does not define "collection" as actually obtaining the data or metadata, it is defined as a human analyst viewing the data.[2] 11 FISA court warrant requests have been rejected over it's existence, out of over 33,000 total. The last one rejected was in 2009.[3] Warrants are also only needed retroactively (within a 7 day period), there is no need to obtain one before accessing data.[4] According to the New York Times, "FISA orders can range from inquiries about specific people to a broad sweep for intelligence, like logs of certain search terms, lawyers who work with the orders said." [5] The Fisa Amendment Act section 702 bars the NSA from collecting data on people "reasonably believed to be located outside the United States."[4] Additionally, data can be intentionally collected on any communication that has at least one foreign recipient or sender.[6] Note also that these warrants specifically contradict the fourth amendment, but as long as the target is "reasonably believed" to be a foreigner, it doesn't matter to the NSA. The test of whether someone is located outside the US has been interpreted as a keyword-based system indicating that it is at least 51% likely. And if they aren't actually foreigners? It's nothing to worry about, just include it on a quarterly report.[7] It's also possible that a warrant for a foreigner would permit access to data on US citizens up to 2 social "hops" away, but [citation needed]. Additional reading: https://www.eff.org/deeplinks/2013/06/foreign-surveillance-history-privacy-erosions https://www.eff.org/deeplinks/2013/06/foreign-surveillance-h... Written primarily for my own benefit, posted in the hope that someone else finds it informative. p.s. This account is wholly controlled and accessed by a United States citizen. [1] http://www.guardian.co.uk/world/2013/jun/08/nsa-boundless-informant-global-datamining http://www.guardian.co.uk/world/2013/jun/08/nsa-boundless-in... [2] https://www.eff.org/nsa-spying/wordgames#collect https://www.eff.org/nsa-spying/wordgames#collect [3] https://epic.org/privacy/wiretap/stats/fisa_stats.html https://epic.org/privacy/wiretap/stats/fisa_stats.html [4] FAA 702.g.1.B, page 6 at http://www.gpo.gov/fdsys/pkg/PLAW-110publ261/pdf/PLAW-110publ261.pdf http://www.gpo.gov/fdsys/pkg/PLAW-110publ261/pdf/PLAW-110pub... [5] http://www.nytimes.com/2013/06/08/technology/tech-companies-bristling-concede-to-government-surveillance-efforts.html?pagewanted=all http://www.nytimes.com/2013/06/08/technology/tech-companies-... [6] FAA 702.b.4 [7] http://www.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companies-in-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story_2.html http://www.washingtonpost.com/investigations/us-intelligence... [8] http://www.guardian.co.uk/world/interactive/2013/jun/08/boundless-informant-nsa-full-text http://www.guardian.co.uk/world/interactive/2013/jun/08/boun... [9] http://bigstory.ap.org/article/secret-prism-success-even-bigger-data-seizure http://bigstory.ap.org/article/secret-prism-success-even-big...

harshreality 13y ago

if the NSA has a database of zero-day exploits They have teams, hundreds of people, that do that stuff. http://www.foreignpolicy.com/articles/2013/06/10/inside_the_nsa_s_ultra_secret_china_hacking_group http://www.foreignpolicy.com/articles/2013/06/10/inside_the_...