14 ms·

The NSA slide you haven’t seen

440 points by spikels 13y ago

btipling 13y ago
> "collection directly from the servers" So either Snowden has incorrect slides, the slides are falsified, or everyone has been lying. Actual evidence of direct access would be better than these slides. I would like someone from Google, Facebook, et al to testify under oath that there is no direct access. Or maybe even the NSA, but we know they share inaccuracies under oath, so maybe that isn't worth so much.
- kimlelly 13y ago
  > I would like someone from Google, Facebook, et al to testify under oath that there is no direct access. Do you really have that much faith in those companies? Seems like some kind of super-power to me.
- count 13y ago
  So, if you're under oath, you're not allowed to lie. And if you're read into an SCI program that controls the disclosure of the existence of such access, you're most definitely not allowed to say anything about it (or, in many cases, even acknowledge that such a thing exists). There is no way someone would risk perjuring themselves OR disclosing classified information under oath.
  - btipling 13y ago
    Not saying anything would say a lot. It would be enough to affect consumer confidence in that products are not being accessed by the NSA.
    - count 13y ago
      I wonder if it could be construed as disclosing classified info by taking the 5th when asked. You didn't say anything, but did you say anything without saying anything?
  - betterunix 13y ago
    "So, if you're under oath, you're not allowed to lie" Yeah but what stops you from doing so? I mean, not lying, just giving the "least untruthful" statement you can: http://www.washingtonpost.com/blogs/fact-checker/post/james-clappers-least-untruthful-statement-to-the-senate/2013/06/11/e50677a8-d2d8-11e2-a73e-826d299ff459_blog.html http://www.washingtonpost.com/blogs/fact-checker/post/james-...
- rythie 13y ago
  I wonder if anyone would be brave enough to test this, i.e. use TLS 1.2/forward security to one of sites mentioned, send a message to a "friend" (dumby account) that says you are planning an attack, and see what happens (i.e. it's only viewable by facebook/google whatever, not in transit)
  - redblacktree 13y ago
    Great idea! I nominate you.
    - rythie 13y ago
      Yeah, I don't really want to be a "person of interest" for the rest of my life. :-)
      - mpyne 13y ago
        Too late, you've already posted to HN. :-)
  - threeseed 13y ago
    Sounds like a wonderful idea. Because law enforcement (like everyone really) LOVES having their time wasted.
  - SilasX 13y ago
    I suggested that on a forum 10 years ago (though about unencrypted emails) to see if the spooks were really monitoring email, and no one seems to want to take up that offer.
- mtgx 13y ago
  Yes, either the slides are wrong, and they don't mean "direct access" the way we're thinking about it, and they may be referring to those "lock boxes" or those "secure FTP" connections that the companies use to send them the requested data - or they've managed to hack these companies somehow, and they just aren't aware of it. This is assuming the companies didn't allow them to put backdoors on their servers. Either way, the tapping of cables is bad enough.
- ck2 13y ago
  I remember a few years ago or so Google was saying China hacked into the access meant for law enforcement. This might be what the slides meant. And the NSA has already lied under oath to congress. Maybe even twice.
- jellicle 13y ago
  They're getting the info directly from Google et al., but they don't have root on Google's servers. Google is required by law (CALEA, the Communications Assistance for Law Enforcement Act) to provide the ability for law enforcement to get information from them. This includes - required by law - the ability both to get stored data and to make real-time intercepts of new communications. Google is paid a fee to provide these services as well. Google et al. have fully complied with this law. The FBI manages the government-end of the CALEA tapping capabilities. The NSA makes requests to the FBI, which passes them on to Google, which flips a switch and enables the tapping of user "xyzzy123". From then on, xyzzy123's stored data and new communications get sent to the FBI through the CALEA connection, which forwards them to the NSA. CALEA also requires the service provider to provide all sorts of metadata about the user. This IS "direct access" to Google's servers. The denials about this have been carefully worded things that all access is supported by some sort of legal process, etc. The denials are non-denial denials. Yes, GOOGLE (et al.), not the NSA, flips the final switch which sends the data. But Google is required by law to do so, so....... And once the switch is flipped, all of the data is flowing automatically to the NSA. I hope this is clear.
  - indiefan 13y ago
    Correct me if I'm wrong, but you left out the step where a judge reviews the request to make sure it's not overly broad or based on flimsy reasoning. Aside from that I'd say it's a very clear, and it's sad that there seems to be a pervasive inference that these companies are something something beyond what our elected law makers have forced them to do. Why isn't more angst directed at the politicians responsible for this?
    - pvnick 13y ago
      Just like a judge reviewed the request compelling Verizon to turn over the details of every single call being made by everyone to everyone?
    - lisper 13y ago
      A judge does review the request. Whether that judge "makes sure it's not overly broad or based on flimsy reasoning" is far from clear. The judge has been hand-picked by John Roberts and only hears the government's side of the case. The FISA court has rejected 0.03 percent of the government's requests. Now, maybe that's just an indication that 99.97% of the government's requests are reasonable, but here's the problem: we have no way of knowing, because it's all secret. THAT is the problem IMHO, more than the surveillance itself.
- yk 13y ago
  Last time this came up I realized that Google is denies overspecificly everything that is not wiretapping. So my take is, that Google is saying "no direct access to the Google servers," as in no access to the actual boxes, while NSA and Guardian use servers in a somewhat looser sense. So my speculation is, that the NSA sits between the TLS reverse proxy and the actual servers. ( The mentionend post for reference and sources: https://news.ycombinator.com/item?id=5965994 https://news.ycombinator.com/item?id=5965994 )
- moskie 13y ago
  The real problem is that "direct access to servers" is not a specific term. Given the various definitions it could have, everyone could be being truthful. Some would interpret "direct access" to mean root level access to their entire infrastructure, which sounds absurd to me, yet some people seem to believe that's what's happening. And it's my understanding that this is what Google, facebook, etc. have been denying. They could instead be giving "direct access" to an FTP server or some other portal set up to provide the requested data, meaning that Snowden and these slides are being truthful in that context. I also think it could be argued that we all gain "direct access" to Google's servers every time we type "www.google.com" into a browser's address bar. It is just not a useful term, and should be replaced with something more specific in all these instances.
  - mpyne 13y ago
    > It is just not a useful term, and should be replaced with something more specific in all these instances How about "collection directly from the server of..." just like it appeared in the actual slide, instead of 'direct access' as everyone else misquotes it?
    - moskie 13y ago
      But it seems like that still has all the ambiguity I mentioned. It could still be construed as root level access, or an FTP server, or anything in between. Also realize that Glenn Greenwald shares a good amount of blame for this misquote. The first line in the first article about PRISM is "The National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants." (http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n...)
      - trestles 13y ago
        The problem is with Greenwald / Snowden - they needed to provide indisputable evidence regarding their most garish claims; or `direct access` to a representation of the evidence
      - 13y ago
- indiefan 13y ago
  I think it's also worth noting that the intended audience of these slides wasn't the general public/press. It's possible the purpose of using wording like "directly from the servers" was simply to delineate the origin of the data from the data pulled off the wire, not the mechanism of retrieval (e.g. some backdoor outside of the existing legal procedure for acquiring such data). I just picture the person who wrote these slides and chose those words either laughing their ass off, or face-palming right now. The companies involved have been pretty explicit (at great risk I might add by putting their founders' names on the denials) that there isn't "direct access" or anything like it. The real story here is the "Upstream" collection. Just horribly irresponsible behavior for a steward of much of the Internet's infrastructure. Shameful.
- brown9-2 13y ago
  The other option is that the slides use ambiguous language.
- samstave 13y ago
  If clapper was outright lying to congress about the data collection... what makes you think getting Zuck under "oath" is going to do any better. After all, he thinks we're all a bunch of "dumb fucks" and it would appear he happily sold all global user data to the USG without even a second thought.
  - stcredzero 13y ago
    Maybe the creepy illuminati hoodie makes more sense now.
    - samstave 13y ago
      In have to tell you, it warms my skeptic heart to see HN so damn discerning over all this info regarding the true state of the world; HN has really surprised me at how many people here are really paying attention!!
      - stcredzero 13y ago
        It was said in jest.
- H3g3m0n 13y ago
  From my limited understanding, the slides are unlikely to be 'incorrect' as Snowden worked there so he would know what was actually going on. It's possible Snowden is making the whole thing up but the government haven't denied anything is going on. It should also be possible for at least some of Snowdens claims to be verified. For example he has claimed that the government was hacking Universities it might be possible to see evidence of that. Or he claimed people have been wiretapped, maybe he knows some of the conversations. It's possible the government won't deny due to a policy of denial and are sticking to it despite the huge PR issues. Or maybe they want people to think they are watching. Or maybe the people in positions to deny stuff want the current government to look bad. Maybe the government will deny later and it's taken a while due to bureaucracy. But by that time it will be to late since if there was anything they will have had time to clean house. Only Google have so for made a post saying the whole thing is fake.
- CyberDroiD 13y ago
  Of course everyone is lying. It's the law: you can't divulge this info, you must lie. Such naivety.
- rtpg 13y ago
  Or the slides use shortened terminology, because it's sorta equivalent in that the processes seem very streamlined. It's not direct from the servers, but to the analysts it might as well could be the same. These slides might have been meant for tech-illiterate people, saying that might be clearer.
kimlelly 13y ago
Anyone still using - Microsoft - Yahoo - Google - Facebook - PalTalk - AOL - Skype - YouTube - or Apple? Yeah, I thought so. EDIT: Seriously, downvoters: you NEED TO WAKE THE FUCK UP !
- ihuman 13y ago
  Yes, because I actually carefully choose what I do online.
  - kimlelly 13y ago
    Good, continue to support the surveillance state with - either your data - and/or your money. Sincerely, your NSA
    - ihuman 13y ago
      But I am not giving them useful information, nor am I paying for those services.
      - PavlovsCat 13y ago
        You're still supporting them. They do get paid, and you figure into the usage statistics and eyeballs for which they get paid. Like it or not.
- minikites 13y ago
  Okay, thanks for the teenage-level politics. What do you suggest as an actual alternative? How do you personally know those alternatives are safer or more secure? How would you construct a recommendation for a small or medium company that relies on Skype/MS Office/Google to use alternatives and how would you train non-tech savvy employees? With what time and money? That's why people are downvoting you. Not because they disagree but because your comment provides no actual information.
oscilloscope 13y ago
It may have been published at the Post for the first time, but Guardian released this over a month ago. http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server-collection-facebook-google http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server...
- danso 13y ago
  Was just about to post this, the only difference is that two of the secret program names are unredacted in the Wapo version.
  - sneak 13y ago
    As the article points out, the map is different in both as well. One shows CONUS, the other, the whole Earth.
    - swamp40 13y ago
      These come from the NSA originally - so it's probably SOP to make slight changes to every page of every document each time it is released to someone, so that they can track the exact source and path of any leaks.
      - yk 13y ago
        Or someone just decided that a US map would look better for the other briefing.
        sneak 13y ago
        On the US-map one, the ellipses line up correctly with the cable landings, and the PRISM-partner logos are over the US, not floating in the ocean. Also, the arrowheads on the cable-bundle ellipses aren't all distorted, and the drop shadow on the "You Should Use Both" text displays correctly. I'm marking this one down to PowerPoint-specific rendering (vs, say, OpenOffice).
      - 13y ago
runjake 13y ago
Once again, I suggest everyone interested read James Bamford's book Shadow Factory. All these revelations regarding call metadata, PRISM collection (albeit under a different codename at the time), modern fiber taps, and even more are covered. You'll learn about how they shave fiber optic cables in order to intercept traffic and not be detected. You'll find out about the various facilities already reported, along with others like the NSA Georgia facility. You'll find out exactly where on what beach these fiber lines run in and out of. It's a very well-researched book. You'll learn a lot more than what's been verified with these leaks. http://www.amazon.com/The-Shadow-Factory-Eavesdropping-America/dp/0307279391/ref=sr_1_1?ie=UTF8&qid=1373476980&sr=8-1&keywords=shadow+factory http://www.amazon.com/The-Shadow-Factory-Eavesdropping-Ameri...
- samsnelling 13y ago
  Thanks for this! I've been looking for more to read (I just went back and re-read 1984). ... I thought one of the points of Fiber was that you couldn't tap in without disturbing the optical signal? Did I just make that up in my head?
  - eitland 13y ago
    No, you have not made it up in your head. It has been widely accepted as a fact but I guess if it was originally true there must have been a few "givens'.
    - Locke1689 13y ago
      Who said this? It seems obviously false. All you would have to do is insert a detector and another emitter that simply replays everything the detector reads.
      - enko 13y ago
        While I agree it's certainly false, your implementation idea would almost certainly introduce detectable delay. All you'd need is a beam splitter. You can manufacture them to only take 1% of the beam.
leephillips 13y ago
This is truly shocking. Who in the NSA thought that this was an acceptable color combination?
kimlelly 13y ago
I'll say it again, because I was immediately downvoted into invisibility: You CAN NOT continue to use products and services by NSA companies like Microsoft - Yahoo - Google - Facebook - PalTalk - AOL - Skype - YouTube - or Apple and THEN turn around and BITCH AND CRY ABOUT LOSING YOUR RIGHTS AND PRIVACY. This is completely INSANE, you NEED TO WAKE UP! EDIT: Yeah, let the censuring begin again. You know what? When I look at the people here on HackerNews, I'm beginning to see a SOCIETY THAT ACTUALLY WANTS TO BE FUCKED - DEEPLY EVEN.
- hayksaakian 13y ago
  There is a difference between opting out of privacy (eg Facebook) and being guaranteed privacy -- which is unknowingly violated (NSA)
- brandonbloom 13y ago
  You're being down voted because your comment is entirely non-constructive. 1) Calling people insane won't win you any favors. 2) "WAKE UP" is an entirely useless platitude. 3) Simply not using "NSA companies" is completely impractical. Not everyone can afford to be a recluse eccentric by ignoring the largest software providers on the planet. Never mind the fact that switching to an alternative in mass would simply produce a new "NSA company". These companies aren't at fault, our government is. Do you have any concrete proposals? Do you have anything new to share? It doesn't seem that you do.
  - kimlelly 13y ago
    > Calling people insane won't win you any favors. I say exactly what it IS. It IS INSANE. I do NOT give a fuck about any favors. I don't care about any fucking karma points - we're turning into a turn-key totalitarian system, and people act like nothing has changed. You got https://prism-break.org/ https://prism-break.org/ Now go and do your homework, I'm not your dad.
    - knowaveragejoe 13y ago
      You must be new to HN. Reddit is probably better suited for you.
United857 13y ago
Any speculation as to what the redaction next to "Processing" in the "PRISM Collection Data Flow" slide is?
- peter487 13y ago
  "Decryption" would be my guess. I don't buy the explanation WaPo offers for "Protocol Exploitation" because the name itself is so suggestive...
- yk 13y ago
  It is next to "Protocol Exploitation," so it could be anything from "Data" to "Public Key." What I am wondering at the moment is the "DNI" on the same slide, is this direct neural interface? /tinfoil
  - mpyne 13y ago
    Though I can't look at the slide, DNI should stand for Director of National Intelligence.
samstave 13y ago
Not sure how that's "published here for the first time" as I had seen that slide a few weeks back... though I do not recall from where..
milhous 13y ago
Is it possible that the CEOs are in fact telling the truth, but are unaware/ignorant that at the carrier level (before reaching the ingress points), data headed to their respective networks/server farms is being "copied"? Does Google, Apple, Skype, etc. physically own Internet infrastructure, or are they all leased lines from carriers? If they owned any physical "lines", and the gov was tapping into these lines, then they would be lying about the direct access claim. But if they don't own these lines, it seems the companies can't do anything about it, and that the telcos are the villains. Apologies in advance if I'm oversimplifying.
dmourati 13y ago
Here's a much better map of the underwater cables: http://www.submarinecablemap.com/ http://www.submarinecablemap.com/
rschmitty 13y ago
Not to sound like a conspiracy theorist, but does anyone else think this prism thing was all something made up by PalTalk as a PR stunt?
- unreal37 13y ago
  It's never been published "there" before, so it's technically true. And this is the first time I'm making this comment here.
mmuro 13y ago
I feel like it will be a while before we truly know exactly what is going on.
- fragsworth 13y ago
  It is likely that we will never know. I suppose "forever" counts as a while.
deleted 13y ago
[deleted]
david_shaw 13y ago
After seeing this article today, I made a post on Facebook to explain to some of my friends that aren't closely following the PRISM story that this is not compatible with the statements released by Mark Zuckerberg, Marissa Mayer, and Larry Page. I'll reproduce some of my post here--I'd link directly, but my Facebook is set to 'private.' Remember when Mark Zuckerberg (Facebook), Marissa Mayer (Yahoo!) and Larry Page (Google) all denied "directly" giving the NSA everyone's data? They claimed that all access was done through national security letters and warrants, because the slides that had leaked at the time supported that. Turns out new slides leaked, and everyone lied! *snip* (I linked to the WaPo article, and the slide directly) And for sources on the original denial (each claiming "no direct access"): https://www.facebook.com/zuck/posts/10100828955847631 https://www.facebook.com/zuck/posts/10100828955847631 (Zuckerberg/FB) http://yahoo.tumblr.com/post/53243441454/our-commitment-to-our-users-privacy http://yahoo.tumblr.com/post/53243441454/our-commitment-to-o... (Mayer/Yahoo!) http://googleblog.blogspot.com/2013/06/what.html http://googleblog.blogspot.com/2013/06/what.html (Page/Google)
- pudquick 13y ago
  Well, the best we can do is assume they lied. However unlikely, it's still possible the NSA had moles or secret legal proceedings against certain employees that directed them to provide the NSA with a direct connection to the servers. The reason why I say 'unlikely' is that such a setup would also involve data connectivity out of those data centers and additionally would probably trip all sorts of intrusion monitoring systems (if the big companies are doing their jobs right). There's still a little wiggle room here, just not much very realistically.
- ignostic 13y ago
  They didn't lie - they just made the truth dance with help from legal advisers. I think we already knew that, but the slide just confirms that they knew exactly what they were doing. EDIT: to clarify, GIVING someone access directly to a server and allowing/knowing about access to the data going in and out of a server are not technically the same thing. When I saw the Google/Facebook responses, it was obvious that the posts had a lot in common. Both used the phrase "direct access to our servers". When you see a phrase repeated like that, one of two things has happened. Either one copied the other's phrasing, or someone told them what to say. In either case, the legal department would definitely weigh in on a huge issue like this. A smart lawyer would never let the company lie outright. They would advise everyone to speak the truth, but "the truth they speak may not be the truth you think you hear." No direct access to servers. Sure. They just had access to the data going in and out of the server. To someone used to reading political and legal documents, "no direct access to servers" almost screams "some form of access to something." Otherwise the denial would have been more Zuck and Page didn't lie, but they were less than forthcoming. Myers didn't even bother addressing the claim directly. I suspect a government lawyer fed them phrases they could use that sound like denials without actually lying.
josephlord 13y ago
I wonder if the Guardian redactions are due to D-Notices.
csomar 13y ago
If we are going to rely and trust the slide, it mentions "You Should Use Both". That might mean, they are still not using the two of them, or one of them.
chrissnell 13y ago
For those with security clearances, clicking on a random HN link is risking your job and livelihood. It's easy to see a link to WikiLeaks and avoid that but when it's the WP posting it, not so much. These articles really need to be flagged/tagged by HN and by the newspapers that publish them. I don't want to see a TS/SCI-classified document and I don't want to be seen as seeking them out. I love the technical stories on HN (95% of what we read here) but it bothers me that I'm risking my clearance when I read this site.
- stefantalpalaru 13y ago
  How about taking the necessary precautions yourself instead of asking a website to protect you from illegal information?
  - mh- 13y ago
    what precautions should/could he take, other than avoiding HN entirely?
    - PavlovsCat 13y ago
      Taking more than the hostname of the link into account; the title maybe.
    - stefantalpalaru 13y ago
      Hiding his IP with Tor would be a good start. Using separate accounts for reading unsafe links and commenting safe ones can avoid detection based on writing style analysis. Since Tor exit nodes can be compromised easily and HTTPS is vulnerable to attackers powerful enough to have the private keys of major certificate authorities, the passwords used should not be reused for other services.
    - jlgreco 13y ago
      If I were him, I'd read titles before I click on them. Or you know, avoid HN entirely. Or quit.
- 13y ago
hawkharris 13y ago
I don't mean to brag, but as I was writing a story about surveillance on my home computer today, the NSA director called and said, "I really love where you're going with this."
anigbrowl 13y ago
I'm amused by BLARNEY. I presume this represents cable that runs from the US to Ireland. http://en.wikipedia.org/wiki/Blarney_Stone http://en.wikipedia.org/wiki/Blarney_Stone Before the safeguards were installed, the kiss was performed with real risk to life and limb, as participants were grasped by the ankles and dangled bodily from the height. I can reliably inform you that this is indeed as scary as it sounds.
- ajtaylor 13y ago
  Been there, done that. I've only kissed the Blarney Stone with the safeguards, but it was still pretty freaky leaning down for the kiss. Everyone should do it at least once. :)
pointernil 13y ago
My quite simple opinions on Prism etc. https://bitly.com/14SrSXI https://bitly.com/14SrSXI
zmmmmm 13y ago
Are we agreed that the Washington Post has had access to the full set of slides all along and are choosing to dribble them out, one by one? If so I feel that there's a certain lack of ethics involved in this. We now have a slide recommending "direct access", after weeks of denials and pointless discussion about it that would have been much clarified and bolstered if this slide had been released. On the other hand, we still don't know the full context of the slides. Perhaps the next one says "But we don't have direct access yet, we are still working on that". Or perhaps it says "for direct access, get a warrant". We just don't know. I understand the motives of the WP in releasing these slides one by one. It will undoubtably be maximizing the publicity and traffic they get from it. But I am not at all sure it is serving the public interest.
- falk 13y ago
  On the contrary, we've caught a lot of people in a lot of lies. It's worth noting that the Guardian published this slide weeks ago, except they redacted some information. We most likely wouldn't still be talking about this if the Washington Post and Guardian played all their cards at once.
  - zmmmmm 13y ago
    > It's worth noting that the Guardian published this slide weeks ago, except they redacted some information Heh, well, I guess I fell for the incorrect headline then. Thanks.

440 points by spikels 13y ago

> "collection directly from the servers" So either Snowden has incorrect slides, the slides are falsified, or everyone has been lying. Actual evidence of direct access would be better than these slides. I would like someone from Google, Facebook, et al to testify under oath that there is no direct access. Or maybe even the NSA, but we know they share inaccuracies under oath, so maybe that isn't worth so much.

kimlelly 13y ago
> I would like someone from Google, Facebook, et al to testify under oath that there is no direct access. Do you really have that much faith in those companies? Seems like some kind of super-power to me.
count 13y ago
So, if you're under oath, you're not allowed to lie. And if you're read into an SCI program that controls the disclosure of the existence of such access, you're most definitely not allowed to say anything about it (or, in many cases, even acknowledge that such a thing exists). There is no way someone would risk perjuring themselves OR disclosing classified information under oath.
- btipling 13y ago
  Not saying anything would say a lot. It would be enough to affect consumer confidence in that products are not being accessed by the NSA.
  - count 13y ago
    I wonder if it could be construed as disclosing classified info by taking the 5th when asked. You didn't say anything, but did you say anything without saying anything?
- betterunix 13y ago
  "So, if you're under oath, you're not allowed to lie" Yeah but what stops you from doing so? I mean, not lying, just giving the "least untruthful" statement you can: http://www.washingtonpost.com/blogs/fact-checker/post/james-clappers-least-untruthful-statement-to-the-senate/2013/06/11/e50677a8-d2d8-11e2-a73e-826d299ff459_blog.html http://www.washingtonpost.com/blogs/fact-checker/post/james-...
rythie 13y ago
I wonder if anyone would be brave enough to test this, i.e. use TLS 1.2/forward security to one of sites mentioned, send a message to a "friend" (dumby account) that says you are planning an attack, and see what happens (i.e. it's only viewable by facebook/google whatever, not in transit)
- redblacktree 13y ago
  Great idea! I nominate you.
  - rythie 13y ago
    Yeah, I don't really want to be a "person of interest" for the rest of my life. :-)
    - mpyne 13y ago
      Too late, you've already posted to HN. :-)
- threeseed 13y ago
  Sounds like a wonderful idea. Because law enforcement (like everyone really) LOVES having their time wasted.
- SilasX 13y ago
  I suggested that on a forum 10 years ago (though about unencrypted emails) to see if the spooks were really monitoring email, and no one seems to want to take up that offer.
mtgx 13y ago
Yes, either the slides are wrong, and they don't mean "direct access" the way we're thinking about it, and they may be referring to those "lock boxes" or those "secure FTP" connections that the companies use to send them the requested data - or they've managed to hack these companies somehow, and they just aren't aware of it. This is assuming the companies didn't allow them to put backdoors on their servers. Either way, the tapping of cables is bad enough.
ck2 13y ago
I remember a few years ago or so Google was saying China hacked into the access meant for law enforcement. This might be what the slides meant. And the NSA has already lied under oath to congress. Maybe even twice.
jellicle 13y ago
They're getting the info directly from Google et al., but they don't have root on Google's servers. Google is required by law (CALEA, the Communications Assistance for Law Enforcement Act) to provide the ability for law enforcement to get information from them. This includes - required by law - the ability both to get stored data and to make real-time intercepts of new communications. Google is paid a fee to provide these services as well. Google et al. have fully complied with this law. The FBI manages the government-end of the CALEA tapping capabilities. The NSA makes requests to the FBI, which passes them on to Google, which flips a switch and enables the tapping of user "xyzzy123". From then on, xyzzy123's stored data and new communications get sent to the FBI through the CALEA connection, which forwards them to the NSA. CALEA also requires the service provider to provide all sorts of metadata about the user. This IS "direct access" to Google's servers. The denials about this have been carefully worded things that all access is supported by some sort of legal process, etc. The denials are non-denial denials. Yes, GOOGLE (et al.), not the NSA, flips the final switch which sends the data. But Google is required by law to do so, so....... And once the switch is flipped, all of the data is flowing automatically to the NSA. I hope this is clear.
- indiefan 13y ago
  Correct me if I'm wrong, but you left out the step where a judge reviews the request to make sure it's not overly broad or based on flimsy reasoning. Aside from that I'd say it's a very clear, and it's sad that there seems to be a pervasive inference that these companies are something something beyond what our elected law makers have forced them to do. Why isn't more angst directed at the politicians responsible for this?
  - pvnick 13y ago
    Just like a judge reviewed the request compelling Verizon to turn over the details of every single call being made by everyone to everyone?
  - lisper 13y ago
    A judge does review the request. Whether that judge "makes sure it's not overly broad or based on flimsy reasoning" is far from clear. The judge has been hand-picked by John Roberts and only hears the government's side of the case. The FISA court has rejected 0.03 percent of the government's requests. Now, maybe that's just an indication that 99.97% of the government's requests are reasonable, but here's the problem: we have no way of knowing, because it's all secret. THAT is the problem IMHO, more than the surveillance itself.
yk 13y ago
Last time this came up I realized that Google is denies overspecificly everything that is not wiretapping. So my take is, that Google is saying "no direct access to the Google servers," as in no access to the actual boxes, while NSA and Guardian use servers in a somewhat looser sense. So my speculation is, that the NSA sits between the TLS reverse proxy and the actual servers. ( The mentionend post for reference and sources: https://news.ycombinator.com/item?id=5965994 https://news.ycombinator.com/item?id=5965994 )
moskie 13y ago
The real problem is that "direct access to servers" is not a specific term. Given the various definitions it could have, everyone could be being truthful. Some would interpret "direct access" to mean root level access to their entire infrastructure, which sounds absurd to me, yet some people seem to believe that's what's happening. And it's my understanding that this is what Google, facebook, etc. have been denying. They could instead be giving "direct access" to an FTP server or some other portal set up to provide the requested data, meaning that Snowden and these slides are being truthful in that context. I also think it could be argued that we all gain "direct access" to Google's servers every time we type "www.google.com" into a browser's address bar. It is just not a useful term, and should be replaced with something more specific in all these instances.
- mpyne 13y ago
  > It is just not a useful term, and should be replaced with something more specific in all these instances How about "collection directly from the server of..." just like it appeared in the actual slide, instead of 'direct access' as everyone else misquotes it?
  - moskie 13y ago
    But it seems like that still has all the ambiguity I mentioned. It could still be construed as root level access, or an FTP server, or anything in between. Also realize that Glenn Greenwald shares a good amount of blame for this misquote. The first line in the first article about PRISM is "The National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants." (http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n...)
    - trestles 13y ago
      The problem is with Greenwald / Snowden - they needed to provide indisputable evidence regarding their most garish claims; or `direct access` to a representation of the evidence
    - 13y ago
indiefan 13y ago
I think it's also worth noting that the intended audience of these slides wasn't the general public/press. It's possible the purpose of using wording like "directly from the servers" was simply to delineate the origin of the data from the data pulled off the wire, not the mechanism of retrieval (e.g. some backdoor outside of the existing legal procedure for acquiring such data). I just picture the person who wrote these slides and chose those words either laughing their ass off, or face-palming right now. The companies involved have been pretty explicit (at great risk I might add by putting their founders' names on the denials) that there isn't "direct access" or anything like it. The real story here is the "Upstream" collection. Just horribly irresponsible behavior for a steward of much of the Internet's infrastructure. Shameful.
brown9-2 13y ago
The other option is that the slides use ambiguous language.
samstave 13y ago
If clapper was outright lying to congress about the data collection... what makes you think getting Zuck under "oath" is going to do any better. After all, he thinks we're all a bunch of "dumb fucks" and it would appear he happily sold all global user data to the USG without even a second thought.
- stcredzero 13y ago
  Maybe the creepy illuminati hoodie makes more sense now.
  - samstave 13y ago
    In have to tell you, it warms my skeptic heart to see HN so damn discerning over all this info regarding the true state of the world; HN has really surprised me at how many people here are really paying attention!!
    - stcredzero 13y ago
      It was said in jest.
H3g3m0n 13y ago
From my limited understanding, the slides are unlikely to be 'incorrect' as Snowden worked there so he would know what was actually going on. It's possible Snowden is making the whole thing up but the government haven't denied anything is going on. It should also be possible for at least some of Snowdens claims to be verified. For example he has claimed that the government was hacking Universities it might be possible to see evidence of that. Or he claimed people have been wiretapped, maybe he knows some of the conversations. It's possible the government won't deny due to a policy of denial and are sticking to it despite the huge PR issues. Or maybe they want people to think they are watching. Or maybe the people in positions to deny stuff want the current government to look bad. Maybe the government will deny later and it's taken a while due to bureaucracy. But by that time it will be to late since if there was anything they will have had time to clean house. Only Google have so for made a post saying the whole thing is fake.
CyberDroiD 13y ago
Of course everyone is lying. It's the law: you can't divulge this info, you must lie. Such naivety.
rtpg 13y ago
Or the slides use shortened terminology, because it's sorta equivalent in that the processes seem very streamlined. It's not direct from the servers, but to the analysts it might as well could be the same. These slides might have been meant for tech-illiterate people, saying that might be clearer.

kimlelly 13y ago

Anyone still using - Microsoft - Yahoo - Google - Facebook - PalTalk - AOL - Skype - YouTube - or Apple? Yeah, I thought so. EDIT: Seriously, downvoters: you NEED TO WAKE THE FUCK UP !

ihuman 13y ago
Yes, because I actually carefully choose what I do online.
- kimlelly 13y ago
  Good, continue to support the surveillance state with - either your data - and/or your money. Sincerely, your NSA
  - ihuman 13y ago
    But I am not giving them useful information, nor am I paying for those services.
    - PavlovsCat 13y ago
      You're still supporting them. They do get paid, and you figure into the usage statistics and eyeballs for which they get paid. Like it or not.
minikites 13y ago
Okay, thanks for the teenage-level politics. What do you suggest as an actual alternative? How do you personally know those alternatives are safer or more secure? How would you construct a recommendation for a small or medium company that relies on Skype/MS Office/Google to use alternatives and how would you train non-tech savvy employees? With what time and money? That's why people are downvoting you. Not because they disagree but because your comment provides no actual information.

oscilloscope 13y ago

It may have been published at the Post for the first time, but Guardian released this over a month ago. http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server-collection-facebook-google http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server...

danso 13y ago
Was just about to post this, the only difference is that two of the secret program names are unredacted in the Wapo version.
- sneak 13y ago
  As the article points out, the map is different in both as well. One shows CONUS, the other, the whole Earth.
  - swamp40 13y ago
    These come from the NSA originally - so it's probably SOP to make slight changes to every page of every document each time it is released to someone, so that they can track the exact source and path of any leaks.
    - yk 13y ago
      Or someone just decided that a US map would look better for the other briefing.
      - sneak 13y ago
        On the US-map one, the ellipses line up correctly with the cable landings, and the PRISM-partner logos are over the US, not floating in the ocean. Also, the arrowheads on the cable-bundle ellipses aren't all distorted, and the drop shadow on the "You Should Use Both" text displays correctly. I'm marking this one down to PowerPoint-specific rendering (vs, say, OpenOffice).
    - 13y ago

runjake 13y ago

Once again, I suggest everyone interested read James Bamford's book Shadow Factory. All these revelations regarding call metadata, PRISM collection (albeit under a different codename at the time), modern fiber taps, and even more are covered. You'll learn about how they shave fiber optic cables in order to intercept traffic and not be detected. You'll find out about the various facilities already reported, along with others like the NSA Georgia facility. You'll find out exactly where on what beach these fiber lines run in and out of. It's a very well-researched book. You'll learn a lot more than what's been verified with these leaks. http://www.amazon.com/The-Shadow-Factory-Eavesdropping-America/dp/0307279391/ref=sr_1_1?ie=UTF8&qid=1373476980&sr=8-1&keywords=shadow+factory http://www.amazon.com/The-Shadow-Factory-Eavesdropping-Ameri...

samsnelling 13y ago
Thanks for this! I've been looking for more to read (I just went back and re-read 1984). ... I thought one of the points of Fiber was that you couldn't tap in without disturbing the optical signal? Did I just make that up in my head?
- eitland 13y ago
  No, you have not made it up in your head. It has been widely accepted as a fact but I guess if it was originally true there must have been a few "givens'.
  - Locke1689 13y ago
    Who said this? It seems obviously false. All you would have to do is insert a detector and another emitter that simply replays everything the detector reads.
    - enko 13y ago
      While I agree it's certainly false, your implementation idea would almost certainly introduce detectable delay. All you'd need is a beam splitter. You can manufacture them to only take 1% of the beam.

leephillips 13y ago

This is truly shocking. Who in the NSA thought that this was an acceptable color combination?

kimlelly 13y ago

I'll say it again, because I was immediately downvoted into invisibility: You CAN NOT continue to use products and services by NSA companies like Microsoft - Yahoo - Google - Facebook - PalTalk - AOL - Skype - YouTube - or Apple and THEN turn around and BITCH AND CRY ABOUT LOSING YOUR RIGHTS AND PRIVACY. This is completely INSANE, you NEED TO WAKE UP! EDIT: Yeah, let the censuring begin again. You know what? When I look at the people here on HackerNews, I'm beginning to see a SOCIETY THAT ACTUALLY WANTS TO BE FUCKED - DEEPLY EVEN.

hayksaakian 13y ago
There is a difference between opting out of privacy (eg Facebook) and being guaranteed privacy -- which is unknowingly violated (NSA)
brandonbloom 13y ago
You're being down voted because your comment is entirely non-constructive. 1) Calling people insane won't win you any favors. 2) "WAKE UP" is an entirely useless platitude. 3) Simply not using "NSA companies" is completely impractical. Not everyone can afford to be a recluse eccentric by ignoring the largest software providers on the planet. Never mind the fact that switching to an alternative in mass would simply produce a new "NSA company". These companies aren't at fault, our government is. Do you have any concrete proposals? Do you have anything new to share? It doesn't seem that you do.
- kimlelly 13y ago
  > Calling people insane won't win you any favors. I say exactly what it IS. It IS INSANE. I do NOT give a fuck about any favors. I don't care about any fucking karma points - we're turning into a turn-key totalitarian system, and people act like nothing has changed. You got https://prism-break.org/ https://prism-break.org/ Now go and do your homework, I'm not your dad.
  - knowaveragejoe 13y ago
    You must be new to HN. Reddit is probably better suited for you.

United857 13y ago

Any speculation as to what the redaction next to "Processing" in the "PRISM Collection Data Flow" slide is?

peter487 13y ago
"Decryption" would be my guess. I don't buy the explanation WaPo offers for "Protocol Exploitation" because the name itself is so suggestive...
yk 13y ago
It is next to "Protocol Exploitation," so it could be anything from "Data" to "Public Key." What I am wondering at the moment is the "DNI" on the same slide, is this direct neural interface? /tinfoil
- mpyne 13y ago
  Though I can't look at the slide, DNI should stand for Director of National Intelligence.

samstave 13y ago

Not sure how that's "published here for the first time" as I had seen that slide a few weeks back... though I do not recall from where..

milhous 13y ago

Is it possible that the CEOs are in fact telling the truth, but are unaware/ignorant that at the carrier level (before reaching the ingress points), data headed to their respective networks/server farms is being "copied"? Does Google, Apple, Skype, etc. physically own Internet infrastructure, or are they all leased lines from carriers? If they owned any physical "lines", and the gov was tapping into these lines, then they would be lying about the direct access claim. But if they don't own these lines, it seems the companies can't do anything about it, and that the telcos are the villains. Apologies in advance if I'm oversimplifying.

dmourati 13y ago

Here's a much better map of the underwater cables: http://www.submarinecablemap.com/ http://www.submarinecablemap.com/

rschmitty 13y ago

Not to sound like a conspiracy theorist, but does anyone else think this prism thing was all something made up by PalTalk as a PR stunt?

unreal37 13y ago
It's never been published "there" before, so it's technically true. And this is the first time I'm making this comment here.

mmuro 13y ago

I feel like it will be a while before we truly know exactly what is going on.

fragsworth 13y ago
It is likely that we will never know. I suppose "forever" counts as a while.

deleted 13y ago

[deleted]

david_shaw 13y ago

After seeing this article today, I made a post on Facebook to explain to some of my friends that aren't closely following the PRISM story that this is not compatible with the statements released by Mark Zuckerberg, Marissa Mayer, and Larry Page. I'll reproduce some of my post here--I'd link directly, but my Facebook is set to 'private.' Remember when Mark Zuckerberg (Facebook), Marissa Mayer (Yahoo!) and Larry Page (Google) all denied "directly" giving the NSA everyone's data? They claimed that all access was done through national security letters and warrants, because the slides that had leaked at the time supported that. Turns out new slides leaked, and everyone lied! *snip* (I linked to the WaPo article, and the slide directly) And for sources on the original denial (each claiming "no direct access"): https://www.facebook.com/zuck/posts/10100828955847631 https://www.facebook.com/zuck/posts/10100828955847631 (Zuckerberg/FB) http://yahoo.tumblr.com/post/53243441454/our-commitment-to-our-users-privacy http://yahoo.tumblr.com/post/53243441454/our-commitment-to-o... (Mayer/Yahoo!) http://googleblog.blogspot.com/2013/06/what.html http://googleblog.blogspot.com/2013/06/what.html (Page/Google)

pudquick 13y ago
Well, the best we can do is assume they lied. However unlikely, it's still possible the NSA had moles or secret legal proceedings against certain employees that directed them to provide the NSA with a direct connection to the servers. The reason why I say 'unlikely' is that such a setup would also involve data connectivity out of those data centers and additionally would probably trip all sorts of intrusion monitoring systems (if the big companies are doing their jobs right). There's still a little wiggle room here, just not much very realistically.
ignostic 13y ago
They didn't lie - they just made the truth dance with help from legal advisers. I think we already knew that, but the slide just confirms that they knew exactly what they were doing. EDIT: to clarify, GIVING someone access directly to a server and allowing/knowing about access to the data going in and out of a server are not technically the same thing. When I saw the Google/Facebook responses, it was obvious that the posts had a lot in common. Both used the phrase "direct access to our servers". When you see a phrase repeated like that, one of two things has happened. Either one copied the other's phrasing, or someone told them what to say. In either case, the legal department would definitely weigh in on a huge issue like this. A smart lawyer would never let the company lie outright. They would advise everyone to speak the truth, but "the truth they speak may not be the truth you think you hear." No direct access to servers. Sure. They just had access to the data going in and out of the server. To someone used to reading political and legal documents, "no direct access to servers" almost screams "some form of access to something." Otherwise the denial would have been more Zuck and Page didn't lie, but they were less than forthcoming. Myers didn't even bother addressing the claim directly. I suspect a government lawyer fed them phrases they could use that sound like denials without actually lying.

josephlord 13y ago

I wonder if the Guardian redactions are due to D-Notices.

csomar 13y ago

If we are going to rely and trust the slide, it mentions "You Should Use Both". That might mean, they are still not using the two of them, or one of them.

chrissnell 13y ago

For those with security clearances, clicking on a random HN link is risking your job and livelihood. It's easy to see a link to WikiLeaks and avoid that but when it's the WP posting it, not so much. These articles really need to be flagged/tagged by HN and by the newspapers that publish them. I don't want to see a TS/SCI-classified document and I don't want to be seen as seeking them out. I love the technical stories on HN (95% of what we read here) but it bothers me that I'm risking my clearance when I read this site.

stefantalpalaru 13y ago
How about taking the necessary precautions yourself instead of asking a website to protect you from illegal information?
- mh- 13y ago
  what precautions should/could he take, other than avoiding HN entirely?
  - PavlovsCat 13y ago
    Taking more than the hostname of the link into account; the title maybe.
  - stefantalpalaru 13y ago
    Hiding his IP with Tor would be a good start. Using separate accounts for reading unsafe links and commenting safe ones can avoid detection based on writing style analysis. Since Tor exit nodes can be compromised easily and HTTPS is vulnerable to attackers powerful enough to have the private keys of major certificate authorities, the passwords used should not be reused for other services.
  - jlgreco 13y ago
    If I were him, I'd read titles before I click on them. Or you know, avoid HN entirely. Or quit.
13y ago

hawkharris 13y ago

I don't mean to brag, but as I was writing a story about surveillance on my home computer today, the NSA director called and said, "I really love where you're going with this."

anigbrowl 13y ago

I'm amused by BLARNEY. I presume this represents cable that runs from the US to Ireland. http://en.wikipedia.org/wiki/Blarney_Stone http://en.wikipedia.org/wiki/Blarney_Stone Before the safeguards were installed, the kiss was performed with real risk to life and limb, as participants were grasped by the ankles and dangled bodily from the height. I can reliably inform you that this is indeed as scary as it sounds.

ajtaylor 13y ago
Been there, done that. I've only kissed the Blarney Stone with the safeguards, but it was still pretty freaky leaning down for the kiss. Everyone should do it at least once. :)

pointernil 13y ago

My quite simple opinions on Prism etc. https://bitly.com/14SrSXI https://bitly.com/14SrSXI

zmmmmm 13y ago

Are we agreed that the Washington Post has had access to the full set of slides all along and are choosing to dribble them out, one by one? If so I feel that there's a certain lack of ethics involved in this. We now have a slide recommending "direct access", after weeks of denials and pointless discussion about it that would have been much clarified and bolstered if this slide had been released. On the other hand, we still don't know the full context of the slides. Perhaps the next one says "But we don't have direct access yet, we are still working on that". Or perhaps it says "for direct access, get a warrant". We just don't know. I understand the motives of the WP in releasing these slides one by one. It will undoubtably be maximizing the publicity and traffic they get from it. But I am not at all sure it is serving the public interest.

falk 13y ago
On the contrary, we've caught a lot of people in a lot of lies. It's worth noting that the Guardian published this slide weeks ago, except they redacted some information. We most likely wouldn't still be talking about this if the Washington Post and Guardian played all their cards at once.
- zmmmmm 13y ago
  > It's worth noting that the Guardian published this slide weeks ago, except they redacted some information Heh, well, I guess I fell for the incorrect headline then. Thanks.