>What, you think we set up a VPN for them so their SQL client in Fort Meade can just query as they please?
https://cdn.vox-cdn.com/uploads/chorus_asset/file/12801415/p...
>Or do you think they hack us?
The FBI (and NSA for that matter) are a lot more constrained by the law than HN seems to think, they can't just shell anyone they want especially if the target is a third party that has done nothing wrong.
https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program...
Pretty much that, and also tapping any traffic that's in their internal networks, since that's not encrypted either.
> What does that have to do with the FBI hacking into the backend of a airline company?
That's one possible attack that the FBI could be carrying out. ie. sabre doesn't encrypt its communications in their internal network, and that's being tapped similar to how the NSA tapped google's internal networks.
The reality is not that clear. A lot of what governs what these agencies can and can't do comes from executive branch policies. There is a lot of gray around what is "legal" and congress likes it that way because it keeps responsibility for allowing to much or not enough surveillance far away from them.
What's more, you cannot adjudicate what you don't know about and a lot of the secrecy in programs like this is just as much about keeping away civil libertarian attorneys as it is about confounding "the enemy". There's a reason the FISA court rules nearly 100% of the time with the state. Responding attorneys are rarely involved and when they are they are often hamstrung due to a lack of knowledge that prevents them from filing any kind of useful motion or raising serious opposition.
Sure, NSA can't directly query against whatever database gmail uses to store your email, but they still have all your emails, photos, and login history. As far as your privacy is concerned, there isn't really any meaningful difference.
Suppose I sent an email yesterday from my Gmail to a friend's Gmail, are you saying the text of this email is stored on an NSA machine?
Maybe not today, but during its heyday must certainly.
>Internal NSA presentation slides included in the various media disclosures show that the NSA could unilaterally access data and perform "extensive, in-depth surveillance on live communications and stored information" with examples including email, video and voice chat, videos, photos, voice-over-IP chats (such as Skype), file transfers, and social networking details.[2] Snowden summarized that "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want."
>[Glenn Greenwald] added that the NSA databank, with its years of collected communications, allows analysts to search that database and listen "to the calls or read the emails of everything that the NSA has stored, or look at the browsing histories or Google search terms that you've entered, and it also alerts them to any further activity that people connected to that email address or that IP address do in the future."[44] Greenwald was referring in the context of the foregoing quotes to the NSA program X-Keyscore.[45]
https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#E...
But let's suppose they don't have your emails stored in their datacenters. Instead, it's still stored on google's servers but they can access your emails via automated requests to google, via search terms or by providing your user handle. Is that a meaningful difference, in terms of privacy?
> "Instead, it's still stored on google's servers but they can access your emails via automated requests to google, via search terms or by providing your user handle"
You just said previously the exact opposite! That they can't query Google, but they have the data themselves.
> "Is that a meaningful difference, in terms of privacy?"
Yes, because it means Google are aware of what data they are being requested, and what they are sending in return.
The transparency reports for these companies show that the total number of requests is in the region of 10k/year - a lot in some senses, but nowhere near the level of surveillance many people seem to believe.
We can discuss the problems with it, but only if we start from a point of truth.
PRISM is not a VPN with a SQL client, or anything close to it.
The second one does not refer to domestic hacking. They don’t do that.
- Legally: They get served a NSL with a gag order forcing them to add the backdoor without telling you, on penalty of prison time
- Extra-legally: They get blackmailed by a TLA do add access and cover it up, or else.
("They" is not necessarily the company's CEO/CTO, but a sufficiently senior DBA/network admin.)
What do you believe is happening in that second image?
One could argue semantics as to whether a fiber tap is "hacking" or not, or whether tapping a domestic company's network from an international transit link counts as "domestic hacking"... but there is ample evidence that US intelligence agencies do target domestic companies and their networks.
See also, the rest of the docs on MUSCULAR: https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program...
Since the links are likely compromised, ubiquitous encryption is your friend.