The NYT is using "social network" in the term's pre-Internet era sense, meaning, as the headline and story say, "social connections" and "large-scale graph anal

The NYT is using "social network" in the term's pre-Internet era sense, meaning, as the headline and story say, "social connections" and "large-scale graph analysis." Nowhere in their story do the reporters allege that the NSA has been bulk-downloading private Twitter, Facebook, Google+, etc. information with the cooperation of those companies. (In fact, I would be very surprised if that were the case, as it goes against what my own reporting has established.) Instead, as the story says in the second paragraph, the NSA is building social graphs based on its "analysis of phone call and e-mail logs." We know they get phone call metadata via Section 215 of the Patriot Act from telcoms like AT&T, VZ, Sprint, etc., which have long been in bed with FedGov. My guess is that the email metadata comes from two sources: AT&T, VZ, Sprint, etc., and bulk fiber taps (remember, "UPSTREAM" from the earlier Snowden slides) aimed at email providers that do not fully support SMTP-TLS. When I wrote about this in June (http://news.cnet.com/8301-13578_3-57590389-38/ http://news.cnet.com/8301-13578_3-57590389-38/), only Google among the top mail providers was fully supporting SMTP-TLS, while Yahoo Mail, Hotmail.com/Outlook.com, AOL, etc. were not. And for SMTP-TLS, it takes two to tango. A possible third source, also via UPSTREAM, is monitoring HTTPS connections to Facebook itself, which was using 1024-bit RSA keys until recently, as I wrote about here: http://news.cnet.com/8301-13578_3-57591560-38/ http://news.cnet.com/8301-13578_3-57591560-38/ Finally, the NSA is supplementing its email-and-phone metadata database with whatever it can vacuum up through public records (the article refers to voter registration rolls, property records, and Facebook profiles) and non-public data held by regulated industries that, unlike large Silicon Valley companies, have little interest in litigating against FedGov on privacy. The article refers to bank codes, insurance information, passenger manifests, billing records, and "location-based services like GPS and TomTom" -- odd wording, that, and a hint that the reporters may not have understood all of their material. Cell phone location metadata from carriers is probably included as well. In other words, Facebook can be reasonably criticized for moving slowly away from 1024-bit RSA keys and not supporting SMTP-TLS, which have made it easier for not only the NSA but other intelligence agencies to conduct surveillance too. But this story is not about the NSA having direct access to Facebook's servers or getting bulk dumps of direct messages from Twitter, and in fact there's zero evidence that's the case.