Hacker News Reader

Comment by jtchang | Hacker News Reader

Two ways I could see this being set up:

1. NSA goes to Facebook and tells them to install a server/rack in their data center. The server needs to be on a port that can "see" all traffic unencrypted. The servers then transparently record data and analysts on the backend parse it into something useful.

2. NSA puts servers on premises but instead they are pushed formatted feeds of data. This would require them to work more closely with the company to make sure they provide a feed that is workable. They would store the data and as requests for data came in the server would feed it back.

View on HN

You're assuming that the NSA requires physical access to unencrypted data.

The NSA has been in the IT security game for a very long time, they employ the best of the best, and have practically unlimited funds. I'd imagine that very complicated algorithms determine who to monitor and what keywords to look for. Images from the middle east or a VPN are likely more heavily analyzed than images from a college campus inside the US.

Why set up shop at specific social media companies when they have physical access to backbone routers and root certificate private keys?

Yes, it would be easier to just ask FB/Google/Apple to give them unlimited read access to their databases, but that would be a scandal waiting to happen.

http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server...

The slide with the explicit formulation was published, written by NSA, that made claims of "not inside companies" much less believable:

"Collection directly from the servers of these U.S. Service Providers: Microsoft, Yahoo, Google, Facebook, Paltalk, AOL, Skype, YouTube, Apple."

This supports the claims of Glenn Greenwald's article and is exactly what companies claimed not existing.

Read the slide: they explicitely name the collecition on the "fat pipes" under other code names. As they have the access to the big pipes, the real time data (c.f. the other slides, earlier) from the inside of companies is certainly unencrypted.

The slides may have come from within NSA, but they were created for a non-technical audience of analysts. Suppose for the sake of argument that the reality is that the NSA has hardware adjacent to company servers or on the internet backbone nearby that can collect messages in transit that match some search query. That's not really direct access, and it's not indiscriminate -- all the subsequent statements from company execs and government sources would be correct. But it's easy to see how some mid-level worker in the NSA, trying to convey to analysts that PRISM enables them to retrieve emails, phone records etc. from various companies, would make an over-simplification and suggest that there is direct access to company servers.

"Never attribute to malice that which is adequately explained by stupidity." --Robert Hanlon. Despite the duplicitous and overly narrow statements about PRISM that skirt the truth, there's no reason to suggest they are all overtly lying, when a much simpler explanation is that some NSA employee overstated their technical capabilities on an internal powerpoint.

Read the articles by Post and Guardian. They published enough leaks to make clear how it works: the special court gives a blanket order, valid for as much as one year, but at least three months, under which the inteligence comunity can operate from their servers at the company site for up to one year without the company even knowing (or wanting to know) what is being requested from their servers. The court order is what's making the operation "legal" so the companies can't be held legally responsible. But that can't mean that the system doesn't exist.

Google has flatly denied that it has fulfilled, or even received, such broad orders http://googleblog.blogspot.ie/2013/06/what.html :

> Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist. Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false.

It would also be hard to square Microsoft's statement that

> In addition we only ever comply with orders for requests about specific accounts or identifiers.

http://www.microsoft.com/en-us/news/Press/2013/Jun13/06-06st... with compliance with a Verizon-style broad order.

NSA and FBI don't even need orders at all for this:

http://www.wired.com/threatlevel/2011/04/fourth-amendment-em...

"As the law stands now, the authorities may obtain cloud e-mail without a warrant if it is older than 180 days, thanks to the Electronic Communications Privacy Act adopted in 1986."

Ok, so the one thing we have figured out in the past couple of days is that the NSA undoubtedly has the ability to collect almost all user data and internet traffic, even for US citizens.

Your link is broken, should be: http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server...

Now, what do they do with it? The guardian is claiming that 77,000 reports have referenced PRISM but it is also the name of an internal accounting program (http://www.dot.gov/individuals/privacy/pia-prism)

We have a long way to go with this NSA issue. I believe that they are a great agency but have a very difficult job to preform, and unfortunately their mission sometimes requires questionable actions. They're powerful enough to make anything they want legal retro-actively, which isn't necessarily a good thing.

Many people assume that the NSA has been "spying" domestically for decades, because it's arguably necessary in order to sufficiently protect the country. I love technology but am already tired of this debate. You are not going to prevent the NSA from data-mining, end of story.

Thanks for the link correction.

The Federal Aviation Administration's "PRISM" is obviously not the one discussed now in public, and not the one ending in the reports to the president. I invite everybody once again to read the Post and Guardian, they obviously have so much material and try to post only as much as to make the public aware of the legal aspects of the system: the blanket special court orders, allowing companies not to do anything, not even track what is being requested, the orders valid for months and practically automatically renewed. It is "legal."

Closer to 2, but with the additional restriction that information only gets copied to the NSA on-premises server after the server makes a specific request/demand for it. All the reports seem to be saying that PRISM is a workflow-automation system for FISA orders.

This has already been cleared up in my opinion. Documents show different program called Upstream that is used for transparently recording data.

http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server...

Reply on news.ycombinator.com