4 ms·

Google and Facebook are trying to clear their name here. But what I'm afraid of is that this mess with deciding exactly how much access the government has to G

Google and Facebook are trying to clear their name here. But what I'm afraid of is that this mess with deciding exactly how much access the government has to Google will turn into a distraction from the larger picture. Which is that, in all likelihood, the NSA does not have access to Google. What they do instead, and what the name PRISM implies, is that they connect to the backbone (Verizon/AT&T), scoop up ALL data, and store it in their freshly built data center in Utah. The slides I saw seemed to indicate when certain applications or filters came online. Such as a filter for Facebook data, or a filter for Google search/map/GPS data, etc. That's how I interpreted the graph, at least. It would indicate the NSA is rolling out specialized applications to handle data coming to and going from specific sites. Which allows them to more intelligently decipher what is being said, in more or less shotgun fashion. Hence, the name PRISM. It's a project to split the full Internet stream into a Facebook bucket and a Google bucket, etc.

seanmcdirmid 13y ago
It doesn't help just to have network transmission data if the data is encrypted. Google has increasingly been moving all of their services to https, I think facebook might be also.
chaz 13y ago
The problem I have with the "duplicate the Internet" theory is that it favors the hard solution vs the easy solution. The hard solution is to secretly duplicate traffic from every data center operated by each of these companies, reverse engineer every HTTP request that goes back and forth so that the data can be parsed, maintain it for every product change that happens at these companies, circumvent HTTPS by compromising the certificate authorities, store it all, and still maintain a massive analytics tool that can make sense of the astounding amount of data coming through. The easy solution is to avoid all of the technical ugliness of acquiring the data, and just legally make the companies give you the relevant information, neatly structured and packaged. NSLs are the ultimate hack.
- sneak 13y ago
  > circumvent HTTPS by compromising the certificate authorities You cannot decrypt passive monitoring with a CA's key.
  - AnIrishDuck 13y ago
    It honestly wouldn't surprise me if the gov't has issued a secret subpoena for every PRISM provider's SSL key (e.g. Google/Facebook/Yahoo/etc). That way they get to claim "hey, we're not giving them full access" and the government gets what they want anyway.
    - sneak 13y ago
      Me neither. Thing is, using PFS modes (like, DHE or ECDHE), even a server key compromise won't let you decrypt passive intercepts. Google started using these for their TLS setup about a year ago, and it's smart. They blogged about it, hoping others would follow suit. I wonder if perhaps that change, and blog post, were their way of saying without saying.
- DominikR 13y ago
  I wouldn't be so sure if that was the easy solution, as it depends on the cooperation of those companies. They at least have the choice to resist in some way or another. They also could be using both solutions simulatneously. From their perspective, why not? A lot of the communication won't be encrypted anyways, and some of it will be, but they may be able to decrypt it at some point in the future.
  - chaz 13y ago
    > From their perspective, why not? The hard solution isn't just a little bit harder ... it's several orders of magnitude harder and more expensive. It's also highly vulnerable to simply using encryption. The easy solution works because the US companies are bound by law to cooperate. There's no reason to believe that legal pressure on these companies has failed to get the government what it wants.
XorNot 13y ago
If the government had a wiretapping program for fiber-optics, they wouldn't call is PRISM. Why? Because you don't name your top-secret stuff with descriptive names that imply what it does. PRISM is a web-app. The slides make it pretty clear its a web-app. The army field manual link helpfully posted before in this discussion outright says its a web-app.

seanmcdirmid 13y ago

It doesn't help just to have network transmission data if the data is encrypted. Google has increasingly been moving all of their services to https, I think facebook might be also.

chaz 13y ago

The problem I have with the "duplicate the Internet" theory is that it favors the hard solution vs the easy solution. The hard solution is to secretly duplicate traffic from every data center operated by each of these companies, reverse engineer every HTTP request that goes back and forth so that the data can be parsed, maintain it for every product change that happens at these companies, circumvent HTTPS by compromising the certificate authorities, store it all, and still maintain a massive analytics tool that can make sense of the astounding amount of data coming through. The easy solution is to avoid all of the technical ugliness of acquiring the data, and just legally make the companies give you the relevant information, neatly structured and packaged. NSLs are the ultimate hack.

sneak 13y ago
> circumvent HTTPS by compromising the certificate authorities You cannot decrypt passive monitoring with a CA's key.
- AnIrishDuck 13y ago
  It honestly wouldn't surprise me if the gov't has issued a secret subpoena for every PRISM provider's SSL key (e.g. Google/Facebook/Yahoo/etc). That way they get to claim "hey, we're not giving them full access" and the government gets what they want anyway.
  - sneak 13y ago
    Me neither. Thing is, using PFS modes (like, DHE or ECDHE), even a server key compromise won't let you decrypt passive intercepts. Google started using these for their TLS setup about a year ago, and it's smart. They blogged about it, hoping others would follow suit. I wonder if perhaps that change, and blog post, were their way of saying without saying.
DominikR 13y ago
I wouldn't be so sure if that was the easy solution, as it depends on the cooperation of those companies. They at least have the choice to resist in some way or another. They also could be using both solutions simulatneously. From their perspective, why not? A lot of the communication won't be encrypted anyways, and some of it will be, but they may be able to decrypt it at some point in the future.
- chaz 13y ago
  > From their perspective, why not? The hard solution isn't just a little bit harder ... it's several orders of magnitude harder and more expensive. It's also highly vulnerable to simply using encryption. The easy solution works because the US companies are bound by law to cooperate. There's no reason to believe that legal pressure on these companies has failed to get the government what it wants.

XorNot 13y ago

If the government had a wiretapping program for fiber-optics, they wouldn't call is PRISM. Why? Because you don't name your top-secret stuff with descriptive names that imply what it does. PRISM is a web-app. The slides make it pretty clear its a web-app. The army field manual link helpfully posted before in this discussion outright says its a web-app.