3 ms·

From the article: "The program is court-approved but does not require individual warrants." So does this mean that the number of government requests released

From the article: "The program is court-approved but does not require individual warrants." So does this mean that the number of government requests released by Facebook, Microsoft, etc. within the last few weeks are essentially meaningless in regards to PRISM and most likely other top secret government spying programs?

siddboots 13y ago
Exactly. It also means that the statements issued by those companies after the initial leak were misleading at best, and arguably, outright lies.
- themgt 13y ago
  Really seems kind of amazingly stupid to release those statements if the details being published here are anything close to accurate - wouldn't they have known the WP knew and could prove they were lying? The amount of trust in these companies going forward should be zero. There is going to be a huge market in replacing essentially any/all of these services with ones physically and legally outside of the USA, with companies that vow to never voluntarily cooperate with the American surveillance state.
  - eightyone 13y ago
    It really seems like these companies and the government are seriously underestimating the amount of information that Glenn Greenwald and friends have. This is why I love the strategy of slowly leaking out information. It let's us catch the government and companies involved lying and making contradictions. I agree. Also companies that fully embrace encryption and not having access to your data. I deleted my Dropbox account the first day they were implicated as a "work in progress" or whatever. I've been using BitTorrent Sync and it's working pretty well. There is still some work to be done, though. I've been meaning to take a good look at SpiderOak.
  - thrownaway2424 13y ago
    There doesn't seem to be any reason to believe these slides and whatnot are close to accurate at all.
    - dmix 13y ago
      My only question: with massive data centers owned by Google/Microsoft/FB etc, is onsite direct data retrieval really possible or practical?
  - siddboots 13y ago
    > There is going to be a huge market in replacing essentially any/all of these services with ones physically and legally outside of the USA, with companies that vow to never voluntarily cooperate with the American surveillance state. No. This shows the opposite. It shows that we can't place trust in jurisdiction anymore, and it shows that we can't trust companies who "vow" not to be evil. If there is a "huge market" it is in replacing services with ones that provide cryptographic assurance that my data and communications are secure from any third party, and ideally, from the hosting company itself.
    - Amadou 13y ago
      It would be nice if all these disclosures resulted in Eben Moglen's "Freedom Box" project getting a boost: https://freedomboxfoundation.org/learn/ https://freedomboxfoundation.org/learn/
segacontroller 13y ago
https://news.ycombinator.com/item?id=5964558 https://news.ycombinator.com/item?id=5964558 I think the uniformed response from the carriers is a diversion from the NSLs which they cannot speak about for the metadata or specific requests for information they have not obtained via fiber splitting. I don't think that many people knew about the fiber splitting. Only the telecoms were granted immunity.
tzs 13y ago
Facebook, etc., said their numbers included requests that were not in response to individual warrants, so could include requests that originated through PRISM.
tptacek 13y ago
This was known prior to the PRISM disclosure; they're (most likely) referring to the FAA 702 process, in which a court certifies a target for which multiple directives may then be issued. The certification establishing the target is reviewed in the manner of a FISA warrant, but the individual directives that flow from the certification aren't. Certifications have a 1:many relationship with directives. The reasonable expectation one would have about statistics released by (say) Yahoo pursuant to this process is that they would capture every directive received by the provider, since providers don't get the certifications. Just a quick reminder: the USG does not need and has never needed and probably will never need a warrant to spy on a foreign entity not on US soil. I'd be interested in hearing about any country that had a signals intelligence capability (Germany, France, Israel, UK, China, Japan, Brazil, &c) in which a warrant was required to conduct foreign intelligence.
- Joeri 13y ago
  > the USG does not need and has never needed and probably will never need a warrant to spy on a foreign entity not on US soil The older i get the more these artificial boundaries of nationalism bother me. Nationalism is cultural racism. I'm convinced that people will at one point look back on it the same negative way we perceive genetic racism today.
  - msg 13y ago
    There is an internet generation gap here. It's more important to be a citizen of the world than any particular place, and more important to think about the influence of multinationals on government than to think about the influence of one country on foreign policy.
  - jaekwon 13y ago
    This. Yet we need a good protocol for experimenting with different models in order to arrive at a good system. A balancing act. We certainly need more fluid borders in the world, like between the borders of our states.
- leoc 13y ago
  > The reasonable expectation one would have about statistics released by (say) Yahoo pursuant to this process is that they would capture every directive received by the provider, since providers don't get the certifications. Furthermore, Google etc. didn't just provide the number of directives, warrants, etc. served on them (within a range), they also listed the total number of accounts affected (again within a range, of course). The latter numbers were higher, but not 10×+ higher. > Just a quick reminder: the USG does not need and has never needed and probably will never need a warrant to spy on a foreign entity not on US soil And again, it's not actually super-obvious to most people that this applies to US cloud data. The USG apparently (IANAL) can't search the empty New York bachelor pad of a Russian oligarch or Saudi oil prince without a warrant - that apparently it can nonetheless turn over their GMail account (basically) at will is therefore pretty surprising. There's also the matter that US cloud-data firms have been making true-but-misleading statements apparently calculated to give their users the impression that they have the ability (as well as the willingness) to contest demands for individual users' data without a court finding of probable cause or something like it, when for a large majority of the PRISM-company users this is not the case. Finally, US citizens might like to check out the FISA appeals court's opinion about a foreign-intelligence exception to the Fourth Amendment. https://news.ycombinator.com/item?id=5923606 https://news.ycombinator.com/item?id=5923606

siddboots 13y ago

Exactly. It also means that the statements issued by those companies after the initial leak were misleading at best, and arguably, outright lies.

themgt 13y ago
Really seems kind of amazingly stupid to release those statements if the details being published here are anything close to accurate - wouldn't they have known the WP knew and could prove they were lying? The amount of trust in these companies going forward should be zero. There is going to be a huge market in replacing essentially any/all of these services with ones physically and legally outside of the USA, with companies that vow to never voluntarily cooperate with the American surveillance state.
- eightyone 13y ago
  It really seems like these companies and the government are seriously underestimating the amount of information that Glenn Greenwald and friends have. This is why I love the strategy of slowly leaking out information. It let's us catch the government and companies involved lying and making contradictions. I agree. Also companies that fully embrace encryption and not having access to your data. I deleted my Dropbox account the first day they were implicated as a "work in progress" or whatever. I've been using BitTorrent Sync and it's working pretty well. There is still some work to be done, though. I've been meaning to take a good look at SpiderOak.
- thrownaway2424 13y ago
  There doesn't seem to be any reason to believe these slides and whatnot are close to accurate at all.
  - dmix 13y ago
    My only question: with massive data centers owned by Google/Microsoft/FB etc, is onsite direct data retrieval really possible or practical?
- siddboots 13y ago
  > There is going to be a huge market in replacing essentially any/all of these services with ones physically and legally outside of the USA, with companies that vow to never voluntarily cooperate with the American surveillance state. No. This shows the opposite. It shows that we can't place trust in jurisdiction anymore, and it shows that we can't trust companies who "vow" not to be evil. If there is a "huge market" it is in replacing services with ones that provide cryptographic assurance that my data and communications are secure from any third party, and ideally, from the hosting company itself.
  - Amadou 13y ago
    It would be nice if all these disclosures resulted in Eben Moglen's "Freedom Box" project getting a boost: https://freedomboxfoundation.org/learn/ https://freedomboxfoundation.org/learn/

segacontroller 13y ago

https://news.ycombinator.com/item?id=5964558 https://news.ycombinator.com/item?id=5964558 I think the uniformed response from the carriers is a diversion from the NSLs which they cannot speak about for the metadata or specific requests for information they have not obtained via fiber splitting. I don't think that many people knew about the fiber splitting. Only the telecoms were granted immunity.

tzs 13y ago

Facebook, etc., said their numbers included requests that were not in response to individual warrants, so could include requests that originated through PRISM.

tptacek 13y ago

This was known prior to the PRISM disclosure; they're (most likely) referring to the FAA 702 process, in which a court certifies a target for which multiple directives may then be issued. The certification establishing the target is reviewed in the manner of a FISA warrant, but the individual directives that flow from the certification aren't. Certifications have a 1:many relationship with directives. The reasonable expectation one would have about statistics released by (say) Yahoo pursuant to this process is that they would capture every directive received by the provider, since providers don't get the certifications. Just a quick reminder: the USG does not need and has never needed and probably will never need a warrant to spy on a foreign entity not on US soil. I'd be interested in hearing about any country that had a signals intelligence capability (Germany, France, Israel, UK, China, Japan, Brazil, &c) in which a warrant was required to conduct foreign intelligence.

Joeri 13y ago
> the USG does not need and has never needed and probably will never need a warrant to spy on a foreign entity not on US soil The older i get the more these artificial boundaries of nationalism bother me. Nationalism is cultural racism. I'm convinced that people will at one point look back on it the same negative way we perceive genetic racism today.
- msg 13y ago
  There is an internet generation gap here. It's more important to be a citizen of the world than any particular place, and more important to think about the influence of multinationals on government than to think about the influence of one country on foreign policy.
- jaekwon 13y ago
  This. Yet we need a good protocol for experimenting with different models in order to arrive at a good system. A balancing act. We certainly need more fluid borders in the world, like between the borders of our states.
leoc 13y ago
> The reasonable expectation one would have about statistics released by (say) Yahoo pursuant to this process is that they would capture every directive received by the provider, since providers don't get the certifications. Furthermore, Google etc. didn't just provide the number of directives, warrants, etc. served on them (within a range), they also listed the total number of accounts affected (again within a range, of course). The latter numbers were higher, but not 10×+ higher. > Just a quick reminder: the USG does not need and has never needed and probably will never need a warrant to spy on a foreign entity not on US soil And again, it's not actually super-obvious to most people that this applies to US cloud data. The USG apparently (IANAL) can't search the empty New York bachelor pad of a Russian oligarch or Saudi oil prince without a warrant - that apparently it can nonetheless turn over their GMail account (basically) at will is therefore pretty surprising. There's also the matter that US cloud-data firms have been making true-but-misleading statements apparently calculated to give their users the impression that they have the ability (as well as the willingness) to contest demands for individual users' data without a court finding of probable cause or something like it, when for a large majority of the PRISM-company users this is not the case. Finally, US citizens might like to check out the FISA appeals court's opinion about a foreign-intelligence exception to the Fourth Amendment. https://news.ycombinator.com/item?id=5923606 https://news.ycombinator.com/item?id=5923606