4 ms·

Unfortunately he didn't really answer it. "More detail on how direct NSA's accesses are is coming, but in general, the reality is this: if an NSA, FBI, CIA, DI

Unfortunately he didn't really answer it. "More detail on how direct NSA's accesses are is coming, but in general, the reality is this: if an NSA, FBI, CIA, DIA, etc analyst has access to query raw SIGINT databases, they can enter and get results for anything they want. Phone number, email, user id, cell phone handset id (IMEI), and so on - it's all the same. The restrictions against this are policy based, not technically based, and can change at any time. Additionally, audits are cursory, incomplete, and easily fooled by fake justifications. For at least GCHQ, the number of audited queries is only 5% of those performed."

thrownaway2424 13y ago
No, he did answer the question, with the biggest walk-back in the history of whistle-blowing. He defined it as "direct access" to internal databases of shit the NSA has already collected. Absolutely not the same as what Snowden was selling the newspaper reporters a week ago, which was "direct access" to Google servers. Also, by the way, 5% auditing is an very high rate. With a 5% audit rate, you'll catch evil-doers in no time at all.
- morsch 13y ago
  Not necessarily, if those audits are "cursory, incomplete, and easily fooled".
  - ianhawes 13y ago
    I don't think Snowden would have any idea whether the audits were effective or not. An analyst in the position of auditing is likely segregated from the employees whose searches are audited.
    - Spooky23 13y ago
      He may have guidance about the types of things that auditors are looking for. For example, checking out your neighbor, girlfriend or a public person's records for curiosity is probably a big red flag.
    - Amadou 13y ago
      I think it is entirely plausible that a sysadmin would know exactly what logs the auditors inspect and that he would know the things like how often the logs were deleted as well as exactly what information is (and is not) captured in the logs. He may even have had access to the same tools the auditors used so that he could run them himself and see what they flagged and didn't flag. It is my experience that systems auditors rely heavily on sysadmins to do their jobs. At a minimum the auditors are "just" another set of users and the sysadmins' responsibilities include supporting the auditors even more closely than they support regular users of classified systems. Frequently the auditors themselves do not have systems-level knowledge of the computers they are auditing. Security on every classified system that I've seen was generally limited to a series of a checklists that some talented specialists once put down in a manual and are left to low-skilled employees to check off each day/week/month - if it isn't specifically on the checklist they have little to no knowledge of it. That includes glaring procedural holes. Essentially security is all CYA, so that everybody involved can say they followed the rules and not lose their job if something goes wrong.
- codeulike 13y ago
  But the picture I'm getting is that they 'collect' everything (via fibre intercepts etc), because they've interpreted the rules as being "collect everything but then ask permission to look at it"
  - brown9-2 13y ago
    Which still doesn't mean that the NSA has "direct access" to any server owned by Google/Facebook/Microsoft.
    - grey-area 13y ago
      Did Snowden say "direct access" in his interview or elsewhere? I thought that was an extrapolation of journalists writing about his story afterward (who also got details like the salary slightly wrong), taken from the wording on the slides, and reinforced in people's minds by the denials from Google et al which talked of backdoors etc? I don't think he made any claims about direct access, only that he could access all account details including emails etc if he had 'the proper authorities' as he puts it (which is pretty consistent with the slides and with the Google claims). I don't remember him using that particular phrase at all at least in his initial video - I remember him talking about the ease with which they could access data using a 'selector' like an email address, not making claims about specific connections to servers or anything similar. He's not responsible for what journalists say, and we can't expect them to clearly restate it all the time, but what we do know about the extent of surveillance is disturbing. It's still unclear exactly what is recorded, when and how and I'm sure we'd all love to know more, but in the meantime it's not very useful to try to discredit his claims based on the interpretations of others. https://eslkevin.wordpress.com/2013/06/10/edward-snowden-interview-transcript-full-text/ https://eslkevin.wordpress.com/2013/06/10/edward-snowden-int...
      - brown9-2 13y ago
        Yes, it's an extrapolation from the slides. My beef with the phrase though is that Greenwald keeps repeating it and sticks by the story that the NSA slides said it so it must mean something, without bothering to ask his supposedly very knowledgable source to expand further on the topic.
- retube 13y ago
  Yes, and the guardian actually published a (tiny) retraction to this effect. So tiny I can't find it, but yes the central, core, money-shot claim is actually patently not true. edit: I found this on the issue: http://www.zdnet.com/the-real-story-in-the-nsa-scandal-is-the-collapse-of-journalism-7000016570/ http://www.zdnet.com/the-real-story-in-the-nsa-scandal-is-th...
- nitrogen 13y ago
  Why is "walkback" the term everyone is using?
  - thrownaway2424 13y ago
    To walk a story back is journalism industry jargon for slowly dropping claims made in your initial story, until there's nothing of substance remaining. Going from "NSA has direct access to servers of major internet companies" to "Some NSA analysts' database accesses inadequately audited, according to random sysadmin" is a textbook walk-back. Of course you will never see the latter headline on Greenwald's blog.
- chris_mahan 13y ago
  In answer to the first question, he writes: "...Not only that, when NSA makes a technical mistake during an exploitation operation, critical systems crash. ..." Well, if they have no access to the actual company servers, how could you then reconcile the above statement?
  - dsuth 13y ago
    That statement was in regards to their widespread international network intrusions into potentially critical networks, not authorised access to American companies.
foobarqux 13y ago
What are the contents of the raw SIGINT databases with respect to telephone audio? Is that audio dragnet? Can an analyst, from a technical perspective, initiate monitoring of a person unilaterally?
- codeulike 13y ago
  The impression I get is that they collect everything they can. If they want to actually _look_ at what they've collected, they are supposed to ask secret permission from a secret court that gives a secret answer. Of course, we trust that they _always_ ask this secret court.
discostrings 13y ago
He answered the question that was asked. He didn't answer the question that the person asking probably wanted an answer to, which was about direct access in regard to Prism. But that's the fault of the person asking not being precise... You have to remember there are tons of programs going on. To the people who have been paying attention to the Prism "direct access" debate, it's probably pretty clear what the person asking the question was getting at. But it makes total sense that someone as familiar with the programs as a whole would answer about "direct access" in general.

thrownaway2424 13y ago

No, he did answer the question, with the biggest walk-back in the history of whistle-blowing. He defined it as "direct access" to internal databases of shit the NSA has already collected. Absolutely not the same as what Snowden was selling the newspaper reporters a week ago, which was "direct access" to Google servers. Also, by the way, 5% auditing is an very high rate. With a 5% audit rate, you'll catch evil-doers in no time at all.

morsch 13y ago
Not necessarily, if those audits are "cursory, incomplete, and easily fooled".
- ianhawes 13y ago
  I don't think Snowden would have any idea whether the audits were effective or not. An analyst in the position of auditing is likely segregated from the employees whose searches are audited.
  - Spooky23 13y ago
    He may have guidance about the types of things that auditors are looking for. For example, checking out your neighbor, girlfriend or a public person's records for curiosity is probably a big red flag.
  - Amadou 13y ago
    I think it is entirely plausible that a sysadmin would know exactly what logs the auditors inspect and that he would know the things like how often the logs were deleted as well as exactly what information is (and is not) captured in the logs. He may even have had access to the same tools the auditors used so that he could run them himself and see what they flagged and didn't flag. It is my experience that systems auditors rely heavily on sysadmins to do their jobs. At a minimum the auditors are "just" another set of users and the sysadmins' responsibilities include supporting the auditors even more closely than they support regular users of classified systems. Frequently the auditors themselves do not have systems-level knowledge of the computers they are auditing. Security on every classified system that I've seen was generally limited to a series of a checklists that some talented specialists once put down in a manual and are left to low-skilled employees to check off each day/week/month - if it isn't specifically on the checklist they have little to no knowledge of it. That includes glaring procedural holes. Essentially security is all CYA, so that everybody involved can say they followed the rules and not lose their job if something goes wrong.
codeulike 13y ago
But the picture I'm getting is that they 'collect' everything (via fibre intercepts etc), because they've interpreted the rules as being "collect everything but then ask permission to look at it"
- brown9-2 13y ago
  Which still doesn't mean that the NSA has "direct access" to any server owned by Google/Facebook/Microsoft.
  - grey-area 13y ago
    Did Snowden say "direct access" in his interview or elsewhere? I thought that was an extrapolation of journalists writing about his story afterward (who also got details like the salary slightly wrong), taken from the wording on the slides, and reinforced in people's minds by the denials from Google et al which talked of backdoors etc? I don't think he made any claims about direct access, only that he could access all account details including emails etc if he had 'the proper authorities' as he puts it (which is pretty consistent with the slides and with the Google claims). I don't remember him using that particular phrase at all at least in his initial video - I remember him talking about the ease with which they could access data using a 'selector' like an email address, not making claims about specific connections to servers or anything similar. He's not responsible for what journalists say, and we can't expect them to clearly restate it all the time, but what we do know about the extent of surveillance is disturbing. It's still unclear exactly what is recorded, when and how and I'm sure we'd all love to know more, but in the meantime it's not very useful to try to discredit his claims based on the interpretations of others. https://eslkevin.wordpress.com/2013/06/10/edward-snowden-interview-transcript-full-text/ https://eslkevin.wordpress.com/2013/06/10/edward-snowden-int...
    - brown9-2 13y ago
      Yes, it's an extrapolation from the slides. My beef with the phrase though is that Greenwald keeps repeating it and sticks by the story that the NSA slides said it so it must mean something, without bothering to ask his supposedly very knowledgable source to expand further on the topic.
retube 13y ago
Yes, and the guardian actually published a (tiny) retraction to this effect. So tiny I can't find it, but yes the central, core, money-shot claim is actually patently not true. edit: I found this on the issue: http://www.zdnet.com/the-real-story-in-the-nsa-scandal-is-the-collapse-of-journalism-7000016570/ http://www.zdnet.com/the-real-story-in-the-nsa-scandal-is-th...
nitrogen 13y ago
Why is "walkback" the term everyone is using?
- thrownaway2424 13y ago
  To walk a story back is journalism industry jargon for slowly dropping claims made in your initial story, until there's nothing of substance remaining. Going from "NSA has direct access to servers of major internet companies" to "Some NSA analysts' database accesses inadequately audited, according to random sysadmin" is a textbook walk-back. Of course you will never see the latter headline on Greenwald's blog.
chris_mahan 13y ago
In answer to the first question, he writes: "...Not only that, when NSA makes a technical mistake during an exploitation operation, critical systems crash. ..." Well, if they have no access to the actual company servers, how could you then reconcile the above statement?
- dsuth 13y ago
  That statement was in regards to their widespread international network intrusions into potentially critical networks, not authorised access to American companies.

foobarqux 13y ago

What are the contents of the raw SIGINT databases with respect to telephone audio? Is that audio dragnet? Can an analyst, from a technical perspective, initiate monitoring of a person unilaterally?

codeulike 13y ago
The impression I get is that they collect everything they can. If they want to actually _look_ at what they've collected, they are supposed to ask secret permission from a secret court that gives a secret answer. Of course, we trust that they _always_ ask this secret court.

discostrings 13y ago

He answered the question that was asked. He didn't answer the question that the person asking probably wanted an answer to, which was about direct access in regard to Prism. But that's the fault of the person asking not being precise... You have to remember there are tons of programs going on. To the people who have been paying attention to the Prism "direct access" debate, it's probably pretty clear what the person asking the question was getting at. But it makes total sense that someone as familiar with the programs as a whole would answer about "direct access" in general.