> $ dig captcha.nsa.gov
> ;; ANSWER SECTION:
> captcha.nsa.gov. 13246 IN CNAME www.nsa.gov.edgekey.net.
> www.nsa.gov.edgekey.net. 21528 IN CNAME e6655.dscna.akamaiedge.net.
> e6655.dscna.akamaiedge.net. 19 IN A 23.213.xxx.xxx
The IP addreses at the last one all seem to be Akamai IPs. So So that is fronting Google here it seems?
You can find more info about how that works here: https://en.wikipedia.org/wiki/Reverse_proxy
i.e. if I see you producing fake Coca Cola drinks, I can't sue you for infringing on The Coca Cola Company's trademark. They would have to sue you. Same applies for the government.
And of course, if NSA does have an agreement with Google to reverse proxy https://google.com/, them doing exactly that would be perfectly legal. I presume they have SOME sort of agreement, and aren't just doing this behind Google's back, as the website is on HN's first page in the first 5 places for an hour already, and Google hasn't banned access.
Try getting even 50 Google queries with a reverse proxy, and you will see what I mean -- they will show you a progressively more difficult ReCAPTCHA until a certain treshold, after which the CAPTCHA is unsolvable and is there only to waste your time. This hasn't happened to HN readers [yet].
that's definitely not what's happening here though, most obviously because it has an SSL certificate. If it were just being CNAMEd over to google, the SSL would be invalid. NSA has to be catching the request to terminate the SSL, and then proxying it back to google.