3 ms·

I think this does clean up some of the language of Googles prism statement. [1] First, we have not joined any program that would give the U.S. governm

by yk 13y ago

I think this does clean up some of the language of Googles prism statement. [1] First, we have not joined any program that would give the U.S. government—or any other government—direct access to our servers. Indeed, the U.S. government does not have direct access or a “back door” to the information stored in our data centers. We had not heard of a program called PRISM until yesterday. So they did not hear of the NSA codename for FBI operated equipment. ( And note that they do not deny wiretapping, just 'direct access' and 'back door.') Second, we provide user data to governments only in accordance with the law. [...] Press reports that suggest that Google is providing open-ended access to our users’ data are false, period. That seems to indicate that here Google defines 'provide user data' as a specific database access. Which seems to be reinforced by Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. Note they talk about records, not about live interception. ( And the order against Verizon seems than to indicate that Verizon did not participate in live wire tapping.) IMHO, this points in the direction, that there is FBI equipment in the Google datacenters. This equipment is tapping into the network connections and pipes them to the NSA. So the Guardians allegations [2] that "Collection directly from the servers of these US service providers: Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube, Apple." means that there is nothing between the servers and the wiretapping equipment. While the companies take the view, that only a account on a database server constitutes 'direct access.' [1]https://news.ycombinator.com/item?id=5841228 https://news.ycombinator.com/item?id=5841228 [2]http://www.guardian.co.uk/world/2013/jun/07/google-facebook-prism-surveillance-program http://www.guardian.co.uk/world/2013/jun/07/google-facebook-...

mpyne 13y ago
> means that there is nothing between the servers and the wiretapping equipment. There can easily still be no wiretapping equipment upstream of the servers; the companies are already copying the data directly to the collection equipment anyways, so that can be a parallel path. I'm not sure a place like Google or Facebook would ever choose to participate in something like this if their whole business were one misconfigured serial-path wiretap server away from being completely down. I believe the NYT had mentioned a couple of days after the story broke that 'real-time' collection was possible. Even that is easy technically, you just send a copy of that instant message or video frame to the FBI collection server as it goes out.
- Terretta 13y ago
  Even the cheapest managed switches have a traffic mirroring port setting, no "prism" required.
  - mpyne 13y ago
    Even if we assume that PRISM still needs to know what exactly to do with that inbound traffic, which it will need metadata for. Of course maybe it's possible to setup a session and then just forward all traffic from a given company subnet IP:port to a PRSIM case file, but that's getting back into impl details for me.
- yk 13y ago
  By 'nothing between' I meant 'nothing that is worth mentioning in a newspaper article.' But you raise an interesting point, the entire wiretapping needs to handle a similar load as a large datacenter and should not impact the uptime, and therefore it should be quite an engineering challenge. So there should be documentation on the Google side, how to 'plug' it into a data center, which power requirements that stuff has, etc...
  - mpyne 13y ago
    Which means that it's not something that Larry Page can just sneak into his datacenter without his squads and squads of Googlers never picking up on it, true.
Terretta 13y ago
The mirrored language in Page and Zuckerberg denials, focusing on denying direct access to servers and not on denying access to user information made it clear user information was being shared. Nobody really cares about the how, yet that's what all the technical denials focused on. What matters is the what. WaPo and The Guardian have played their hands well to let companies and government entities themselves reveal who is being straight with the public and who is tap dancing.
- slg 13y ago
  The reason they didn't deny "access to user information" is because it was common knowledge before the PRISM leak that they would send user information to the government on request. The only new accusation against these tech companies with the initial PRISM leak is that they were knowingly allowing the government to directly access their servers. That is why they denied direct access, because they were accused of supplying direct access. Just because Google and Facebook didn't deny these new accusation before they were ever levied against them doesn't mean they are automatically guilty of them. Let's wait to see how things play out before we starting making judgements.
  - llamataboot 13y ago
    FBI equipment ON COMPANY PROPERTY to transmit realtime information on whomever from a blanket approval order is pretty damning, and not at all consistent with the harsh language of the denials of google et al and their desire to share a specific (presumably small) number of warrants with us
    - slg 13y ago
      I don't disagree with how damning these new accusations might be. However, some people are taking the fact that these companies didn't deny FBI equipment being or their premise as admission that there is FBI equipment on their premise. Looking at these slides, I see no proof that companies have FBI equipment on their property. That seems to be a claim made by the WaPo that is supported by other slides or sources. I am just suggesting we wait until more information comes forward before we start taking these accusations as fact.
skwirl 13y ago
This is an incredibly fanciful interpretation of language. If these reports are correct then Google is simply outright lying. If you have to strain to read a statement to mean the exact opposite if what it plainly says and that opposite is the truth, then what practical difference is there between that statement and a lie? Statements from Google: we have not joined any program that would give the U.S. government—or any other government—direct access to our servers. Our legal team reviews each and every request, and frequently pushes back when requests are overly broad or don’t follow the correct process. Press reports that suggest that Google is providing open-ended access to our users’ data are false, period. Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist. Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false. We cannot say this more clearly -- the government does not have access to Google servers--not directly, or via a back door, or a so-called drop box. Nor have we received blanket orders of the kind being discussed in the media. It is quite wrong to insinuate otherwise. Google participates in that allows the kind of access that the media originally reported. Note that I say "originally" because you'll see that many of those original sources corrected their articles after it became clear that the PRISM slides were not accurate. There is no free-for-all, no direct access, no indirect access, no back door, no drop box. We’re not in the business of lying and we’re absolutely telling the truth about all of this. Our business depends on the trust of our users. And I’m an executive officer of a large publicly traded company, so lying to the public wouldn’t be the greatest career move. If by what has now been “revealed” you mean the allegation that Google is allowing the NSA unfettered access to user data or that we’re handing over data willy-nilly to the government, again, that’s just not true. It’s not rhetoric, it’s just a fact. QUESTION: Without giving any specifics which might put you in violation of such an order, are you legally bound to \ lie about anything to the public? (Yes or no is fine) ANSWER: Nope. No gun to my head. I’m really troubled if you’ve lost trust in us because of this idea that we’re collaborating in a broad surveillance program. We’re not, and that’s why we are pushing back so hard on these allegations. I really don't know how you could say NO more strongly. How would you say it? It is manifestly apparent at this point that there is no possible way that you could say it without someone who wants to believe otherwise reading whatever they want out of it.

by yk 13y ago

mpyne 13y ago

> means that there is nothing between the servers and the wiretapping equipment. There can easily still be no wiretapping equipment upstream of the servers; the companies are already copying the data directly to the collection equipment anyways, so that can be a parallel path. I'm not sure a place like Google or Facebook would ever choose to participate in something like this if their whole business were one misconfigured serial-path wiretap server away from being completely down. I believe the NYT had mentioned a couple of days after the story broke that 'real-time' collection was possible. Even that is easy technically, you just send a copy of that instant message or video frame to the FBI collection server as it goes out.

Terretta 13y ago
Even the cheapest managed switches have a traffic mirroring port setting, no "prism" required.
- mpyne 13y ago
  Even if we assume that PRISM still needs to know what exactly to do with that inbound traffic, which it will need metadata for. Of course maybe it's possible to setup a session and then just forward all traffic from a given company subnet IP:port to a PRSIM case file, but that's getting back into impl details for me.
yk 13y ago
By 'nothing between' I meant 'nothing that is worth mentioning in a newspaper article.' But you raise an interesting point, the entire wiretapping needs to handle a similar load as a large datacenter and should not impact the uptime, and therefore it should be quite an engineering challenge. So there should be documentation on the Google side, how to 'plug' it into a data center, which power requirements that stuff has, etc...
- mpyne 13y ago
  Which means that it's not something that Larry Page can just sneak into his datacenter without his squads and squads of Googlers never picking up on it, true.

Terretta 13y ago

The mirrored language in Page and Zuckerberg denials, focusing on denying direct access to servers and not on denying access to user information made it clear user information was being shared. Nobody really cares about the how, yet that's what all the technical denials focused on. What matters is the what. WaPo and The Guardian have played their hands well to let companies and government entities themselves reveal who is being straight with the public and who is tap dancing.

slg 13y ago
The reason they didn't deny "access to user information" is because it was common knowledge before the PRISM leak that they would send user information to the government on request. The only new accusation against these tech companies with the initial PRISM leak is that they were knowingly allowing the government to directly access their servers. That is why they denied direct access, because they were accused of supplying direct access. Just because Google and Facebook didn't deny these new accusation before they were ever levied against them doesn't mean they are automatically guilty of them. Let's wait to see how things play out before we starting making judgements.
- llamataboot 13y ago
  FBI equipment ON COMPANY PROPERTY to transmit realtime information on whomever from a blanket approval order is pretty damning, and not at all consistent with the harsh language of the denials of google et al and their desire to share a specific (presumably small) number of warrants with us
  - slg 13y ago
    I don't disagree with how damning these new accusations might be. However, some people are taking the fact that these companies didn't deny FBI equipment being or their premise as admission that there is FBI equipment on their premise. Looking at these slides, I see no proof that companies have FBI equipment on their property. That seems to be a claim made by the WaPo that is supported by other slides or sources. I am just suggesting we wait until more information comes forward before we start taking these accusations as fact.

skwirl 13y ago

This is an incredibly fanciful interpretation of language. If these reports are correct then Google is simply outright lying. If you have to strain to read a statement to mean the exact opposite if what it plainly says and that opposite is the truth, then what practical difference is there between that statement and a lie? Statements from Google: we have not joined any program that would give the U.S. government—or any other government—direct access to our servers. Our legal team reviews each and every request, and frequently pushes back when requests are overly broad or don’t follow the correct process. Press reports that suggest that Google is providing open-ended access to our users’ data are false, period. Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist. Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false. We cannot say this more clearly -- the government does not have access to Google servers--not directly, or via a back door, or a so-called drop box. Nor have we received blanket orders of the kind being discussed in the media. It is quite wrong to insinuate otherwise. Google participates in that allows the kind of access that the media originally reported. Note that I say "originally" because you'll see that many of those original sources corrected their articles after it became clear that the PRISM slides were not accurate. There is no free-for-all, no direct access, no indirect access, no back door, no drop box. We’re not in the business of lying and we’re absolutely telling the truth about all of this. Our business depends on the trust of our users. And I’m an executive officer of a large publicly traded company, so lying to the public wouldn’t be the greatest career move. If by what has now been “revealed” you mean the allegation that Google is allowing the NSA unfettered access to user data or that we’re handing over data willy-nilly to the government, again, that’s just not true. It’s not rhetoric, it’s just a fact. QUESTION: Without giving any specifics which might put you in violation of such an order, are you legally bound to \ lie about anything to the public? (Yes or no is fine) ANSWER: Nope. No gun to my head. I’m really troubled if you’ve lost trust in us because of this idea that we’re collaborating in a broad surveillance program. We’re not, and that’s why we are pushing back so hard on these allegations. I really don't know how you could say NO more strongly. How would you say it? It is manifestly apparent at this point that there is no possible way that you could say it without someone who wants to believe otherwise reading whatever they want out of it.