NSA Recommends Dropping Phone-Surveillance Program | Hacker News Reader

NSA Recommends Dropping Phone-Surveillance Program

bgr.com

185 pointsbonyt112 comments

Personally, the skeptic in me believes if the NSA is losing interest in a major data collection program like this, then they are deflecting the narrative from focusing on an even more impressive and accurate data collection program that they have developed and are ready to deploy out into the world. I’m putting on my tinfoil hat at this point, but every day I read HN I’m surprised at what is capable, given the right technology, money, and time.

I think it's more likely that most everyone the NSA would be interested in snooping on is aware they're snooping and has changed how they communicate and moved to encryption.

The signal to noise ratio has to be completely ridiculous, to the point that it's no longer a justifiable effort.

Miranda warnings have been pop culture for decades, yet criminals keep confessing in interview rooms.

Threats to public safety tend not to be firing on all cylinders, thankfully.

For some reason, it’s often the people who should shut up the most who just can’t shut up. The ability to stop yourself from talking is an underrated skill.

Looks nervously in the general direction of the current President.

I think you misunderstand. Him not shutting up is probably how he got the job in the first place - the media gave him so much more attention than anybody else.

> I think you misunderstand.

I think I don’t. wink

I don't think it's that simple.

Intimidation and coercion are powerful motivators. The Innocence Project found 25% of people proven innocent, by DNA evidence, actually provided confessions or self-incriminating statements.

I worry about what other behind-the-door tactics are used. Some might even be official abuses of power, such as gag orders, which are already being used for what the WSJ called "political persecutions in Wisconsin,"(1) it wouldn't surprise me.

>Threats to public safety

This is what I'm worried about here.

0-https://www.innocencecanada.com/causes-of-wrongful-convictio...

1-https://www.nationalreview.com/2015/04/wisonsins-shame-i-tho...

Get an average person into a room, interrogate for hour or days,if necessary, and ultimately, the vast majority would confess to anything just for the sake of ending it. There are many tricks in a hat to do so+ decades of experience within police and other institutions.

I think you're talking about a different class of problems, though. The NSA is going to be focused on larger, sophisticated groups; Chinese government intrusions, multi-state-sponsored terrorism, coordinated Russian attempts to influence U.S. elections. Not the type of thing that's going to get caught in a police interview.

Of course there are some sophisticated adversaries who were probably too smart to use phones even before Snowden, but I’ll venture a guess that the typical terrorism conspiracy is closer in sophistication to a street gang than to the KGB. At least, if there were a clear link between a terrorist plot and and institution full of taxpayer-funded career spooks, it would not be terrorism, just war.

Encryption is nice but don't forget that every American university or company has been infiltrated by the NSA.

And the Chinese, and the Russians, probably some Iranians in there too.

You left out the Israelis who have had an extensive espionage operation in the US for decades.

Yeah pretty much or they are getting so much data from FAANG that they don't know what to do with this is totally useless and superfluous.

I think you mean GAF (reversed spelling). What is Netflix going to give the NSA? Looks like Osama bin Laden loves House of Cards. What about Amazon? The terrorists use AWS and ordered a bunch of pressure cookers?

AWS runs half the net..

Some useful data that might be subpoenad from a Netflix account:

* subscriber IP address (for an idea of target whereabouts)

* subscriber playback equipment (for confirming target)

* times of account usage (for determining daily routine or pattern analysis, or just confirming that they're home or sth)

* identity info on account or subaccounts (for identifying target or possible friends/family members)

* favorite shows (for chumming up to target to get them to talk/start conversation with)

I’m assuming by subpoena you mean a warrant. Not sure the feds would try and compel some terrorist to be a witness or give some evidence of something.

A cellphone would give you so much more information.

Fair enough, I'm not a legal expert. Yes, a cellphone also gives that info but an investigator may not always have a cellphone as a lead

IME you are served a subpoena to testify to specific information that they think you have, and if you can provide it prior to the date of testimony, you don't have to show up.

Suspect a warrant would be if they wanted to take something in your control, but I've never been subject of that kind of thing.

A cellphone would give information about the cellphone. Might be single use/shared burners - might be turned off. In certain cases the Netflix account might give better information (For example, imagine Snowden login in to Netflix in his hotel room. Or more likely, one of the journalists logging in to theirs...).

You might have a point regarding Netflix but Amazon’s cloud computing business is bigger than its online shop and used extensively the world over and has a lot of SaaS products based on communications alone (never mind all the other stuff in their portfolio)

“Amazon” — the company with massive contracts with the CIA and DoD, full time Alexa microphone in millions of homes, owner of Ring video doorbell, runs something like half the internet through their servers. Yeah I think they might have something the control freak “intelligence community” would be interest in.

oh so you don't understand humor and vote me down because of a funny comment - wow...

> What is Netflix going to give the NSA? Looks like Osama bin Laden loves House of Cards.

Looks like Osama bin Laden loved "Tom & Gerry".

https://www.cia.gov/library/abbottabad-compound/index_video....

According to Wikipedia, PRISM (the collection of internet communication) is "the number one source of raw intelligence used for NSA analytic reports".

https://en.wikipedia.org/wiki/PRISM_(surveillance_program)

Based on documents from 2011-13, a lot could have changed since then

I rather doubt that internet communication has become less important since 2013.

On the contrary, its grown even more important, but encryption has also grown immensely in popularity.

What is most interesting to me is that we are talking about this in open now, we have accepted that this is the new normal.

I decided to watch the x files this evening after not watching it since it was on regular television. And my god, the entire show is adorable. Scullys entire character is "the goverment would never do that. It would be illegal."

The American dream we all had at one point is staggering. And sad how much we have lost. Rose colored glasses aside, if the same show aired today, it would not last a season, since it would be considered to naive to take seriously.

And we should believe the word of an agency that broke it many times before and actively tried to sabotage encryption, because?...

This damned-if-they-do sentiment risks dismissing positive policy moves. If this headline read "NSA is expanding surveillance programs" people would be up in arms over the privacy implications. Instead they announce that they believe it should be dismantled and the response is... the same?

I understand the hesitation. Outright dismissing positive change feels like a counter-productive stance to adopt.

I understand why you say this, but even if they're truly doing the right thing here, I only owe them gratitude enough to say, "Thanks for stopping spying on me, finally, at least in this way." Add that to the number of times the NSA has shown itself to be untrustworthy and intentionally deceptive, and I'm willing to seem ungrateful and hard to satisfy. They've cultivated a hostile relationship, toward fixing which this is at best a small step.

They could be invasive, by monitoring even when there's nothing going on, but there are well-defined rules and strict protocols in place, and I have never heard any cases where they have used the data to attack anyone personally or are there?

Not sure if this[0] falls under the "attack anyone personally" umbrella but it definitely falls under the invasive, even when there's nothing going on, portion of your comment.

[0] - https://www.reuters.com/article/us-usa-surveillance-watchdog...

Certain employees were discovered to have been using these tools to spy on wives, partners, love interests, children etc.

That's just the stuff we actually heard about.

I never consented to have my data snooped on by some cabal of creeps out in Washington DC. If they suspect I’m up to something, then show sufficient evidence to get a warrant and be transparent about it. Whether they’ve acted on the data or not is irrelevant — they’re stealing what should be my property and building tools for tyranny.

You wont, because of a little thing called Parallel Construction.

NSA finds something out illegally, unethically, they pass it to another agency so proceeds to figure out a way to "discover" what the NSA did in a way that is legal, or at least plausible to the courts, thus never having to admit the investigation started with the NSA

I'm never really sure how to react to these stories... In general, I agree with you that "they suck anyway" is an unhelpful stance, but the NSA's track record is singularly bad.

They went in front of the Church Committee and lied outright to Congress, then dodged all consequences when a DoJ investigation explicitly concluded that their stonewall tactics were too effective to defeat. Decades later, when we look at Clapper's testimony to Congress, nothing much seems to have improved. At best, every word of the promises and announcements has an exotic meaning no one could intuit, which won't be provided until after the story is leaked. At worst, they're naked lies.

I don't know what healthy progress and activism here look like, because as far as I can tell they've never happened. (Barring, I suppose, James Bamford's work.) When Congress repeatedly fails to bring an agency to heel, and the DoJ outright admits it's not up to the task, it's hard to find much faith in anything that agency says.

The only positive "policy move" would be the agency being cutoff, disbanded, and any employee involved in attacks against persons on US soil or US persons abroad going to prison. Announcing that they may be shrinking their scope really has no bearing on the matter that they continue to operate with impunity.

You wouldn't stop clamoring for justice for an armed robber that announces they're moving on to simple pickpocketing for fear of making them reconsider.

I think what you’re seeing is skepticism that the plan is to decrease overall surveillance. It sounds as if they are merely phasing out an obsolete method.

> Outright dismissing positive change

They say that "logistical and legal burdens of keeping it outweigh its intelligence benefits", but the important criticisms weren't about it being expensive without results that justify it. Not a word about it being wrong or anything.

As for "dismantling", being skeptical of that is absolutely warranted, e.g. https://en.wikipedia.org/wiki/Total_Information_Awareness

> Although the program was formally suspended, its data mining software was later adopted by other government agencies, with only superficial changes being made. The core architecture of TIA continued development under the code name "Basketball." According to a 2012 New York Times article, the legacy of Total Information Awareness is "quietly thriving" at the National Security Agency (NSA)

Seems naive to believe that any announcement coming from the NSA is truthful or positive.

That is the point of the boy who cried wolf.

If you lie enough times, you lose all credibility and even good actions will be received with a massive amount of scepticism.

They dug their own grave and now they have to lie in it. (in the sense of their reputation among the populace)

I am not sure, how many lies have been spotted? NSA typically lies by omission but so far, every secret surveillance program they have had was totally expected to anyone who read the laws that enabled them.

I often say that the only revelation Snowden gave us was the name of the different programs, but a lot of what was there was already guessable from the Patriot Act

In the absence of public pressure, i can't see why a government agency would give up any power at all like this. Maybe so they can say "see, look how much better than China we are?" is one reason i can think of. I would imagine if they give something up, they have something equivalent or better to replace it. I don't trust them one bit, i hate them.

I wonder if recruitment was also a factor in making this decision. Recently they released ghidra which they admitted was mainly for recruitment purposes. If it's because of this, then it makes sense it's not worth it. Collecting massive amounts of (mostly useless) data versus attracting talented people. I know it's not a black or white situation and they can still attract talented people, but if there's a negative perception of the NSA then the pool of people will be a lot less.

The rumor is that recruitment absolutely was affected after Snowden. More damage done to our country by him.

I wouldn’t be surprised to learn that he did put the full cache of files online before fleeing, to be able to sell them to Russia. He certainly had the capability to do so. Also, I wouldn’t be surprised to learn that he was involved with Vault 7 somehow; it’s another conspiracy theory floating around.

Unclear why this is being downvoted.

Is it damage?

He exposed the job for what it was and concensious citizens decided that it wasn't a purpose they wanted to fight for. Much better than working on the Manhattan project thinking it would be used for nuclear energy, only to then see your creation be used for mass destruction.

Is whistle blowers exposing rampant abuse in the church doing damage to the good of Christianity too?

The citizens deserve to know about the scale on which their own government violates their privacy.

Snowden is no Assange.

Yes, it’s damage. He torched the NSA to the ground. Comparison to a church doesn’t make sense.

In other words, the NSA found a better way of snooping. If they are asking to drop phone surveillance, then they found a superior method of data collection.

Facebook just hired the author of the Patriot Act. Coincidence? Probably...

The replacement programs are known as FACEBOOK and GOOGLE.

Aggregated by Pinkerton.

If they've found a better way of snooping then why announce it to the world instead of silently dropping the program?

This sounds more like a public relations move instead of a technically inspired one.

PR, i agree.

You can bet that "smart dust" is already here, if in limited application.

https://www.theatlantic.com/magazine/archive/2016/11/even-bu...

https://now.northropgrumman.com/mems-and-smart-dust-the-big-...

The only conclusion is that the NSA simply cannot be trusted in the future. I'm sure our illogical lawmakers will not draw it, but this is clearly another case of being told this program was crucial and people's rights needed to be trampled on that was simply untrue. The NSA just wanted the power for powers sake. Lawmakers should stop giving this agency what it asks for as it clearly has no bounds or idea of what it's doing with the incredible power it has.

It seems like they have at least enough bounds to say now that's not necessary.

Not necessarily; it may have been a very important source that has dried up or has been superseded by alternatives.

The phone program was launched prior to the iPhone and Facebook (even though we only found out about it after both). It may well have been very important up to at least 2012 (6 years into Facebook, 3 into the iPhone/ android boom) when we learned about the program and the NSA defended it.

Since the revelation seven years ago, it could well be that targets of the NSA are no longer using communication channels where phone metadata is useful.

Meanwhile in England:

https://en.wikipedia.org/wiki/Tempora

And Utah:

https://en.wikipedia.org/wiki/Utah_Data_Center#Purpose

From a purely technical perspective, the bespoke equipment needed to buffer and search through the traffic flow of a single 100Gbps transatlantic DWDM circuit (of which there might be 40 or 80 possible circuits in a single cable, from Porthcurnow to NY/NJ) would be incredibly complicated and costly. Just the amount of RAM you would need is nuts.

Or to do the same as a passive intercept on a 100Gbps PNI between two ISPs at Telehouse Docklands.

They have a budget in the billions.

Also they don't need it all necessarily. Just metadata could be extremely useful, on a long timeline.

No, it's not.

Gigamon can easily tap 100G and deconstruct it into 10x10G flows.

https://www.gigamon.com/company/news-and-events/newsroom/gig...

An off the shelf server can line rate tap/filter 10g.

gigamon might cost $50k? Each server might cost $5k? $100k to monitor a 100g circuit? Peanuts.

You are talking about one 100G circuit and the relatively minor sever+tap costs.

Summary of metadata might be possible if they have a small number of selectors pushed out to the edge, but given the footprint of a FAANG backbone and edge pops, keeping up with them would be noticeable, if only for impact on fiber and real-estate markets.

People keep talking about NSA's Utah DC like it's something huge, but in the scheme of scale out operators it's pretty average...

Yep. I suspect we agree more than we disagree.

You are aware that every cable landing station has a classified area, right? And noone is allowed to visit a landing station w/out clearance from USG? And that the USG has a large data center near every cable landing station with rights to use the backhaul fiber from the landing station?

Ask Jay or Najam if they think the USG was tapping FB before they started encrypting everything.

There's on the order of 100 transoceanic cables terminating in the US with on the order of 80 lambdas per cables. That's 8k 100gs at $100k each, or $800M. That's less than 1% of NSA budget and about a tenth of 1% of the black budget. It's a relatively low cost to ensure "total information awareness" of comms in/out of the US.

I don't suggest that 100% of this being stored. It is a fairly trivial computer science problem w/ today's solutions to real time scan the words and pull out flagged data for analysis. That's the metadata you mention and I agree.

I suspect the nuances, attacks, and mitigations around this would be a good topic of conversation at a conference or something if we ever run into each other.

Unfortunately there's not much that one can say in public around specifics of CLS etc :/

> And noone is allowed to visit a landing station w/out clearance from USG?

I work on a regular basis with people at ISPs who operate the terrestrial dark fiber and DWDM networks into many of the WA, OR and CA cable landing stations, and none of them have ever been required to get special permission from the feds. Most have gone through ordinary background checks through their employers, for basic stuff (way, way less involved than doing an SF-86 for a Secret clearance, basically just credit checks, criminal record check, and calling this previous references on their CV when they're hired).

https://www.google.com/search?&q=fort+gordon+rsoc&ie=utf-8&o...

All they really need is metadata, IP-addresses, then they can use network theory to build graphs that shows who is communicating with who. If you for example visit a "terrorist" web site you are now linked to everyone else who also visited that site. Using network mesh graphs they can discover new "terrorist" cells. They can even figure out who the leader of this "terrorist" cell is and effectively destroy the cell. I can imagine they are also tracking location data to see who meets physically.

Are the budgets for these programs public knowledge? How much money have we (taxpayers) spent (or wasted?) on these "tools"? And for historians, will we ever get to see the source code and details of how they worked (other than powerpoint documents leaked by Snowden..)?

This particular program, or the whole shebang?

It looks like the NSA got about $11B of the "Black Budget" in 2013 https://www.washingtonpost.com/wp-srv/special/national/black... It's further broken down on that page.

We can't trust what they say but either way, most phone traffic is probably VOIP nowadays (not traditional phone, so that program is probably obsolete?)...

We changed the URL from https://www.wsj.com/articles/nsa-recommends-dropping-phone-s... because WSJ seems no longer to have a paywall workaround. If someone can suggest a better URL, we can change it again. I just did a Google and picked the first link I found that wasn't illegibly crammed with ads.

Doing the nerd's work. I like you. <3

This works (even without the bypass paywalls extension) in a firefox private window:

https://m.facebook.com/flx/warn/?u=https://www.wsj.com/artic...

I guess what I'm saying is that HN should not penalize the company doing the journalism. People can buy a subscription, those that won't still have a technical solution, and for the rest they can google like you did and find an article to read among the blogspam.

There's simply no good solution here, short of the publishing business restructuring so we can pay once to read everything, which I hope I live to see.

In the meantime, we have a clear if sucky policy, described at https://news.ycombinator.com/newsfaq.html and https://news.ycombinator.com/item?id=10178989, with plenty more explanation at https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme.... It is the way it is not because we or anyone else likes it, but because the alternatives would suck worse.

WSJ is not a hard paywall+, it has multiple technical solutions similar to what was allowed before, open these in a private window for example:

https://www.wsj.com/articles/the-yale-dad-who-set-off-the-co...

https://facebook.com/l.php?u=https://www.wsj.com/articles/th...

https://m.facebook.com/flx/warn/?u=https://www.wsj.com/artic...

Notice that "?mod=rsswn" is used as described in this issue^ for a browser extension which can be used for a number of sites.

I'll try all these after I click reply and edit if it does not work.

+ https://news.ycombinator.com/item?id=19496356#19506786

^ https://github.com/iamadamdev/bypass-paywalls-firefox/issues...

edit: All worked though an ad appeared over the article that I was able to dismiss by clicking on the small x in the upper right of the ad itself. Then I was able to read all those articles without being logged-in to the WSJ, just like readers of HNs could before.

I wonder if they realized this back when they lied to congress and tried to take credit for FBI work when they couldn't come up with "a single instance in which analysis of the NSA’s bulk collection metadata collection actually stopped an imminent attack, or otherwise aided the Government in achieving any objective that was time-sensitive in nature". It's always interesting when something crazy is going on and you would think the NSA would have relevant information to help, but they don't.

I suppose six years is enough time to save some face from the 2013 fiasco?

The intelligence agencies used to try to find out a persons skills and experience. Now they jest check their LinkedIn profile. They used to try to find who their friends and associates were. Now they check their Facebook friends. They used to try to figure out where the person travels on their day to day routine. Now they can check your Google Maps location history. Instead of going through great expenses to try to do surveillance on individual phones, they should just focus on how to get that data from these American companies that already have them.

>...they should just focus on how to get that data from these American companies that already have them.

...but they were already in their bases, killing their doodz[0], yeah? Why would they focus on something they already had on-hand?

[0] - https://www.theguardian.com/world/2013/jun/06/us-tech-giants...

I'd assume they have now other means to get what they want.

For the life of me, I cannot figure out why this comment by "holyend" is being silently ghosted (censored) / flagged. Can a moderator explain the reasoning for it being flagged? Are curse words disallowed?

https://ibb.co/f9gVV3Q

I'm assuming this comment will also be ghosted/flagged; if so, requesting a reason please.

I heard they are dropping this because they can get all the data they need from FB's new data partner program. /s

Surprise: The NSA was lying. Not only in the details of what they were saying but also in taking what looked like a most definitive stance on a topic they couldn't know enough about.

This only includes the cellphones of American citizens, doesnt it?

They already have enough data to build the rest of it

For clarification on my previous response... I mean it's a probably a good thing for the program to be stopped

No need to intercept cellphone communications because they already have all in Facebook and whatsapp

Just an FYI to people trying to view this article, the usual tricks like facebook outlinking, using outline.com and setting google as a referrer didn't work to circumvent the paywall. But I did manage to view the article by changing my user-agent to Safari - iOS. Dunno why it works but ¯\_(ツ)_/¯.

EDIT: I take it back. This briefly worked, but doesn't anymore. I have no idea what changed. Sorry peeps.

Amusingly, I got a paywall in Safari on iOS.

It's super weird, this only worked for me once? It no longer does.

What specific version. In Safari on Mac, you can set the user agent in the Develop menu, to iOS iPhone, iPad, etc. Tried them all and no luck. Is there a specific iOS Device/iOS version you set to to be able to view the article?

Super weird, this worked once and no longer works, I have no idea what changed. Sorry.

try the bypass paywalls extension, works fantastic:

https://github.com/iamadamdev/bypass-paywalls-firefox

https://github.com/iamadamdev/bypass-paywalls-chrome

BPC 1.4.8 on google chrome 73.0.3683.103 (Official Build) (64-bit) apple works great thanks

Sounds like you screwed the pooch by telling us all. Sorry for our loss.

ONCE AGAIN, they're clutching at their pearls and swooning about losing the (straw man) metadata. They think we're stoopid. Required reading,

NSA Surveillance: Exploring the Geographies of Internet Interception

Andrew Clement

Faculty of Information, University of Toronto

https://archive.org/download/GeographiesOfInternetIntercepti...

Might be a mix of hearsay but some pieces of the puzzle are becoming clearer. Skip to the section on 'NSA Splitters' and ask yourself, if they had drop-in access to the baseband circuits, qould they already be able to intercept the Telcom providers' streams that gather the data that is now part of the disclosure programs? And even if the links are encrypted, keys can be leaked. Telcos are finally 'off the hook'.

Url changed from https://www.wsj.com/articles/nsa-recommends-dropping-phone-s..., which points to this.

this extension* still works for me for that WSJ URL (right-click 'open link in igcognito window')

* https://news.ycombinator.com/item?id=19744632

Reply on news.ycombinator.com