6 ms·
“What Is That Box?” – When The NSA Shows Up At Your Internet Company
- phaer 13y agoI think the this excerpt is a fine description of the problem with secret courts and so on: "These programs that violate the Bill of Rights can continue because people can’t go out and say, “this is my experience, this is what happened to me, and I don’t think it is right.”"
- kephra 13y ago/me wonders: why a link to readability who is just framing buzzfeed.com and not a link to the original site? And why do 245 people upvote it without noticing this link bait?
- rpgmaker 13y agoAlso, the buzzfeed site has a relatively good layout. None of that overlay toolbar bullshit or popup shit. In fact, this readability link adds an overlay toolbar to the site (one of the main reasons why I use readability in the first place).
- j_baker 13y agoThis is likely the reason why lots of tech firms give the NSA access to their servers. It's better than having a box installed on your network. http://news.cnet.com/8301-13578_3-57593538-38/how-the-u.s-forces-net-firms-to-cooperate-on-surveillance/ http://news.cnet.com/8301-13578_3-57593538-38/how-the-u.s-fo...
- Terretta 13y agoI'd say from technical or engineering POV it's a whole lot less hassle and less likely to break things to just mirror a switch port.
- wmf 13y agoA switch port tends to carry traffic for multiple customers. Supposedly Carnivore does minimization, but I think companies like Google would rather collect data themselves to make sure it's done right.
- beloch 13y agoMaybe I just don't pay enough attention to this, but this is the first place where I've read that Google and other large companies are being paid for monitoring their customers. This is making my sleaze-o-meter spike. What are the rates like? Is it per user? Per message? Per kilobyte? It certainly couldn't be per arrest... Sometimes it seems like the rabbit hole just keeps going deeper, but then you realize it's a damned sewer!
- aray 13y agoThey don't offer anything up with that last point ("bigco's selling data"). As far as I can tell it was pulled from thin air. They're understandably upset -- a lot of us are -- but I don't think that quite justifies making unbased accusations like that (and if it has basis I'd love to hear more).
- lawnchair_larry 13y agoNo, this is not new information. Companies do get paid, a lot, to facilitate this. This was known before the leaks, but leaks confirmed it. Now there are articles all over if you search. Example: http://www.cbsnews.com/8301-201_162-57593273/verizon-at-t-get-most-bucks-from-feds-for-wiretaps/ http://www.cbsnews.com/8301-201_162-57593273/verizon-at-t-ge... "In its letter to Markey, AT&T estimated that it collected $24 million in government reimbursements between 2007 and 2011. Verizon, which had the highest fees but says it doesn't charge in every case, reported a similar amount, collecting between $3 million and $5 million a year during the same period." I'm not sure how I feel about that (making the companies pay for it doesn't seem fair either), but it certainly doesn't leave us with incentives in the right places.
- anigbrowl 13y ago$24 million over a year period paid to AT&T doesn't fit my definition of 'get paid a lot.' AT&T had profits of (approximately) $7 billion on revenue of $31 B in 2012. So these reimbursements amount to something like 0.015% of revenue, or 0.1% of profits. For a firm that size, there are much greater incentives to lobby for favorable rules on employee health benefits, spectrum allocation, or consumer relations. I mean, over that time period the CEO of AT&T earned about $100 m, so in theory he could afford to take the hit for all that fee revenue personally and still make more money in a year than most people see in a lifetime. I'm not expressing support for the NSA's activity here, I think this sort of data vacuuming is quite dangerous. But viewed in the context of actual corporate revenues, I don't think it's realistic to say the government is bribing big business here, because the amount they're paying is trivial, and thus largely reflective of the change in the actual operating cost of the corporate data centers.
- kabdib 13y agoSo, mount webcams in the datacenter. Point them at your racks (front and back, to show cables). This isn't a bad idea in any event, because sometimes it's good to know what Figby Tenthumbs recabled on Monday morning when he was hung-over. Now make access to the cameras public. "What's that new box?" "We can't say." "Ooohh, I see. Noted." Watch the watchers watching.
- eloisius 13y agoThat's a similar mechanism to a warrant canary. I like it, and haven't heard of it being used, but I doubt the effectiveness. Though, I suppose if a company suddenly had to take down their datacenter video feed for unspecified reasons, that would be tell tale.
- btown 13y agoBut could the FISA court order the datacenter operator to loop the feed? We'd never know. And that's scary.
- nthj 13y agoMeh. Pay an intern to drop a copy of today's newspaper in front of the camera every morning.
- kabdib 13y agoYou could trivially detect a loop by examining noise. You could trivially defeat that by injecting noise. You could less trivially defeat that by looking for "random" behavior in the datacenter, such as people walking by, vibrations caused by folks moving about, blinking patterns of the ubiquitous network activity LEDs in your rack and other racks, etc. I think a loop is trivial to detect.
- Shish2k 13y agoHave your own server's LEDs blink in pseudo-random sequence; have a script monitor the video feed, alerting if the sequence of LEDs doesn't match what is expected
- relaxitup 13y agoI wonder what the website was... The only one I can think of that might possibly get this treatment might be Maddox, but thats total speculation of course.
- marvin 13y agoWas what I thought too. Maddox would perfectly match the sort of semi-incompetent, this-guy-seems-creepy surveillance that someone who wants to cover their ass would do. Anyway, XMission is not that small, so there's no way of knowing.
- toyg 13y agoIt could easily have been a community association or other similar group. A group of gardeners? Well, they could be eco-terrorists. A bunch of software enthusiasts? Why, these open-source people are borderline commies, better check them out. This is routine activity for police authorities, unfortunately.
- rdl 13y agoI think it was related to ELF/environmental activism/terrorism. I'm not sure where I saw that, though.
- thingummywut 13y ago"A number of [larger] companies are getting paid for the information. If you go establish a tap on Google’s network, they will charge X amount per month. Usually the government pays it." This is directly contrary to what every "larger" company has repeatedly stated in response to Prism. People actually think that the companies are not only forced to keep silent, but release public statements lying?
- dangrossman 13y agoThat every major telecom/ISP charges for wiretaps and other information pulls has long been public knowledge. Reimbursing them for government requests is a line-item in our public federal budget. http://www.forbes.com/sites/andygreenberg/2012/04/03/these-are-the-prices-att-verizon-and-sprint-charge-for-cellphone-wiretaps/ http://www.forbes.com/sites/andygreenberg/2012/04/03/these-a...
- thyrsus 13y agoYes - we have seen language contorted into meaninglessness by by lawyers and courts. "Waterboarding is not torture." "Data recordings are not data collection." "Drones cause one civilian casualty per hundreds known dead terrorists." I am a fervent believer in the power of government to do enormous good - but is necessary that those actions be public or they will invariably be abused. Whenever you contemplate government acting in secret, you must weigh that against the cost of that action being abused - because at some point it will be. I'm angry and will let you imagine a link to foaas.com.
- Sanddancer 13y agoI used to work for a webhosting company, and had similar experiences. We'd get requests for Men In Nice Suits to come in, rack up a nice non-descript 3u box -- this was a few years prior to this experience, so I'm certain that the tech's improved since then. As was described, the box just sat there, eating power, under orders Not To Touch Under Any Circumstances, until the federales came back in to take their box back. Thinking back about it, again, this seems a lot of how the feds can keep things like this from getting out. The people that know are given the gag orders, the sysadmins racking and unracking know it's better for their careers, and their not staying out of jail, not to say that they have weird boxes on their network which have mirrored ports going to them. It's there, it's suspect, but the consequences for discussing a suspect box make it difficult to really discuss things.
- toble 13y agoI am so glad that I don't work under gag orders like that. It just doesn't seem ethical to be paid by a customer to spy on them. I understand why most would say nothing, but it must be so tempting to inform the customer.
- mathattack 13y agoIt just seems very inefficient to store stuff on a hard drive for 9 months, no? If it's important enough to snoop, shouldn't you want to get the word out sooner?
- coldcode 13y agoIf everyone said go stuff yourself and published it on the internet, eventually they might get the message. But no one wants to be force-fed in Cuba.
- tlongren 13y agoSo do these companies approach the government and say "Hey, give us $1000000 per month and we'll just give you full access."?
- lawnchair_larry 13y agoYour numbers are inflated, but that's literally what AT&T and Verizon did. They approached the government.
- Terretta 13y agoWe had to facilitate them to set up a duplicate port to tap in to monitor that customer’s traffic. It was a 2U (two-unit) PC that we ran a mirrored ethernet port to. [What we ended up with was] a little box in our systems room that was capturing all the traffic to this customer. Everything they were sending and receiving. And yet his lawyer could have written a truthful denial that they'd given the govt "direct access to the server". See how that works?
- exit 13y agocould someone run an isp with a completely public inbox, so that they couldn't receive a FISA without it becoming public? are companies obligated to have a private means of contacting them?
- Sanddancer 13y agoI imagine if someone tried that, the NSA/FBI would merely say, "hey, head down to our office, we want to talk to you about something."
- bostonvaulter2 13y agoContinuing that I wonder if you could have webcams in nearly every area of the building and make it all publicly accessible.
- rdl 13y agoIf you were in a one-party consent state (ideally without notification required), you could just transmit audio logs of "all incoming phone calls, for customer service and quality control purposes" to a third party, and the third party could choose which to publish. The third party would be under no obligation to keep it secret, and the caller would not know which third party to contact to get an injunction to prevent publication.
- jimwise 13y agoDumb question, but the author kept running a TOR node at a site he knew was under NSA surveillance? That doesn't strike me as very responsible...
- toyg 13y agoFrom how I read it, he did that after the experience, when it wasn't under surveillance anymore (well, at least not from inside the datacenter), as a sort of atonement.
- thyrsus 13y agoSomeone more knowledgeable than I should confirm or deny this, but my understanding was that TOR should be resilient to a single point attack like that. On the other hand, if they can watch packet timing on a significant fraction of intermediate nodes, there is a problem. And, hypothetically, the FISA authorized box was only getting traffic from the one site, and not the entirety of network traffic. The room 641A attack is far more problematic.
- gizmo686 13y agoTOR is resilient to a single point. However, if an adversary can compromise both the entrance and exit node, then they can de-anonomize the traffic.
- 6d0debc071 13y agoAs I understand it, TOR uses encrypted layers each of which tells the node where to send the partially unwrapped message on to. So, if I encrypt something to, say, three layers and sent it to some TOR nodes: 1-2-3 1 knows it came from me and knows to send it to 2 2 knows it came from 1 and to send it to 3 3 knows it came from 2 and to send it to wherever No one point on the system, IIRC, is meant to have the information necessary to compromise the entire chain. Though, if you could compromise a sizeable portion of the network, you'd be in with a significant chance of compromising any given message - which I find hard to believe that the government hasn't done.
- rdl 13y ago
- e12e 13y agoDirect link to the story: http://www.buzzfeed.com/justinesharrock/what-is-that-box-when-the-nsa-shows-up-at-your-internet-comp http://www.buzzfeed.com/justinesharrock/what-is-that-box-whe...
- Sukotto 13y agoWait. They show you the warrant requiring your compliance. But you don't get to keep a copy of that paper? How do you later prove that you were required by law to make the actions that you did? How do you ensure that you comply completely with the instruction if you can't compare your action to the original warrant? That seems strange.
- dangrossman 13y ago> How do you later prove that you were required by law to make the actions that you did? The gag order attached to it prevents you from telling anyone but your attorney that you received the court order. Having the paper wouldn't help you prove anything when you are not allowed to acknowledge its existence.
- spiritplumber 13y agoWait, the government can ask me to pretend that a physical object is not there? Do they really expect engineers to start ignoring the laws of physics?
- dopamean 13y ago> Do they really expect engineers to start ignoring the laws of physics? Well apparently they have been for a while already.
- jevinskie 13y agoExactly, I'd go into CYA mode and try my hardest to get a copy.
- Zoepfli 13y agoSounds like a great way to create mayhem: talk to isp, fake a gov warrant. Say they can't copy it. Get them install your box. Do mayhem. If anybody comes, there is no paper trail. profit. :-(
- rachelbythebay 13y agoIt's not always the NSA. Some of my datacenter friends told me stories about times when "a box" would appear and they were officially to not go within 6 feet of it. Of course, actually working on neighboring customer boxes meant sometimes violating that (without telling anyone), but for the most part they would stay away. I seem to recall they were chasing down online pill vendors this way. One little box with power and two Ethernet ports can collect a whole bunch of evidence, after all. They get what they need, and then they remove it. This was 10 years ago... or more. I can only imagine what happens now.
- aspensmonster 13y agoI'm very curious to know if these little black boxes could function as a MITM. I mean, if you're already there mirroring everything that's going across...
- moepstar 13y agoJust guessing, but since it "just" gets all of the traffic that is passing in and out of the other server(s)/switchport (probably much like a hub), i don't think it'd be able to interfere with the monitored servers traffic. Also, it'd kinda tip off the monitored person(s) if there suddenly was another hop on the route to their server, no?
- Sanddancer 13y agoNo. Its entire job is logging. Doing MITMs could very potentially lead to information leaking that shows surveillance is going on. Pretty much any switch a datacenter's going to use has port mirroring, which allows for a passive, invisible tap of a server.
- justincormack 13y agoI do wonder if the NSA insists this functionality is there...
- Sanddancer 13y agoJust an unfortunate side effect. There are lots of legitimate uses for port mirroring in troubleshooting and monitoring a network, like intrusion detection and performance monitoring.
- griffordson 13y agoThis was probably the FBI. And if the data center's switch couldn't mirror the customer port (I can't imagine any data center would use a switch that couldn't - but it is within the realm of possibility), the investigating agency would probably provide a 1U switch along with the 2U server that could handle the mirroring and then they could force the data center to connect the customer through that switch instead.
- femto 13y agoUnder such circumstances, why not extract as much monetary compensation as possible from the government and donate it to the EFF, ACLU, or similar?
- D9u 13y agoThanks for speaking of your experiences with the rogue spy apparatchik which has recently reared its ugly head and I'd also like to thank you for running a Tor node. Together we stand, for freedom. For America.
- LekkoscPiwa 13y agoThe whole American society is gagged and that's the problem. If you don't like unconstitutional actions of the US Government then you are called: 1. Traitor 2. 9/11 Truther 3. Terrorist That's where the apathy originates from. I strongly believe that in the USA of today saying out loudly that a radical change is needed to get the country back on its Constitutional track could make one a terrorism suspect. If they can label 82-year old nun a terrorist and try her in court on this nonsense, then why not me or others who speak out loud ?
- vaadu 13y agoWhat if this ISP instead cancelled the service of the business to be tapped?
- captainmuon 13y agoI would be tempted to quit my job on the spot if I'd receive one of those orders... (Not earning that much anyway so I could deal with it.)