Comment by Tloewald | Hacker News Reader

Comment by Tloewald | Hacker News Reader

The key point in the answers thus far is that when he refers to "direct access" he means to some database that has all the stuff in it, and not (e.g.) via a direct conduit to Google or whoever's database.

So what I think is going on is that the NSA archives packets it can see in transit, but doesn't necessarily know who all the endpoints are. (It probably has a VERY good idea most of the time.) When someone becomes of particular interest they can execute a warrant on Google et al and get more detailed information on a specific target which lets them make better use of data they've already got.

The key thing they're doing is, fundamentally, logging packets that they can see going past any number of bottlenecks in the internet, which should have been perfectly obvious that they would try to do from day one. This alone is enormously powerful and all the extra info from service providers is probably only icing on the cake. If you can be identified from some cleartext comms somewhere then all you other dealings have been archived, and can be correlated, and then decrypted and traced back to you posthoc.

This is my belief as well. A few years ago I worked for a company that sold packet capture appliances to unnamed government agencies. The higher end appliances were capable of 10Gb/s packet to disk streaming. I helped write a search interface for the resulting data capable of the type of filtering and data reconstruction described. If organizations directly, indirectly, knowingly or unknowingly allowed the NSA to tap Internet links, they could theoretically provide full data access, while at the same time publicly deny direct server or backdoor access.

How do they get past the ssl encryption? Mmmm? You don't have to answer that...

When I left they hadn't worked it out, only plaintext artifacts could be extracted. There was discussion of server plugins to intercept and store SSL keys and later use those to decrypt data, but this would require endpoint access and complex interaction back to the appliance. However, in the case of email, although you might utilize encrypted protocols to send/receive, a direct or indirect recipient might not, so at some point the message may cross the wire in plaintext.

For a government agency like the NSA, that's easily accomplished by a man-in-the-middle attack. They can almost certainly convince multiple US-based certificate authorities to give them a certificate that will be included in the default set of trusted certificates by all mainstream browsers. They would only have problems with the very small number of people who are both paranoid and tech-savvy enough to change the certificates that there browser trusts.

Chrome, at least, has certificate pinning for Google properties (and perhaps some other big sites?), which prevent the use of a different but otherwise valid certificate from a trusted CA.

This is the impression that I took away from his remarks, too. However, this prompts a question: is it feasible to capture everything, store those data, and filter after the fact? How much traffic are we discussing, how much storage over what period, etc.? The costs to capture and store everything for any significant length of time seem astronomical; am I wrong? And if it's not everything, how useful is it?

They could filter for communication related packets based on port numbers: email, chat, voip, etc. The resulting data feed would be more manageable to capture and store long term.

It's also possible, although I don't know how likely, that there are employees of Google, Facebook, etc.. who are secretly working for the NSA to gather specific information that they would otherwise miss.

Reply on news.ycombinator.com