What, you think we set up a VPN for them so their SQL client in Fort Meade can just query as they please? Or do you think they hack us?
https://www.google.com/amp/s/amp.theguardian.com/technology/...
Citation needed
Stellar Wind, Tempora, Prism.
https://www.nytimes.com/video/opinion/100000001733041/the-pr...
This is a particularly interesting profile of Binney, who worked on stellar wind.
https://www.forbes.com/sites/emmawoollacott/2018/09/13/uk-ma...
https://www.bbc.co.uk/news/world-us-canada-23123964
Of course they claimed after being exposed that these programs are legal, but I think lawless is apt as these agencies don't consider the law as a boundary they need to respect.
O tempora, o mores
https://www.newyorker.com/magazine/2011/05/23/the-secret-sha...
Tempora is domestic hacking, Stellar Wind is domestic hacking (sweeping up data from all Americans), and these agencies share data extensively, so domestic vs foreign has very little meaning to them at least.
I’m familiar with what kinds of things they do, and I don’t agree that they should be doing a lot of what they do. It’s just that rooting american assets isn’t one of those.
Also, you have the wrong country for Tempora.
Files obtained from Edward Snowden suggest NSA can collect information sent by fibre optic cable between Google and Yahoo data hubs 'at will'...
Citing documents obtained from former NSA contractor Edward Snowden and interviews with officials, the Washington Post claimed the agency could collect information "at will" from among hundreds of millions of user accounts.
The documents suggest that the NSA, in partnership with its British counterpart GCHQ, is copying large amounts of data as it flows across fiber-optic cables that carry information between the worldwide data centers of the Silicon Valley giants. The intelligence activities of the NSA outside the US are subject to fewer legal constraints than its domestic actions.
31 October 2013
https://www.theguardian.com/technology/2013/oct/30/google-re...
You've referenced proof they couldn't hack Google and instead they had to use alternative measures.
>Google is understood to be working on "forward encryption" for its private network so that communications even over its private leased lines would be unintelligible to anyone without the "keys" to decrypt it.
That's basically the reason it was even possible. Such surveillance is not a hack.
>What, you think we set up a VPN for them so their SQL client in Fort Meade can just query as they please?
https://cdn.vox-cdn.com/uploads/chorus_asset/file/12801415/p...
>Or do you think they hack us?
Sure, NSA can't directly query against whatever database gmail uses to store your email, but they still have all your emails, photos, and login history. As far as your privacy is concerned, there isn't really any meaningful difference.
Suppose I sent an email yesterday from my Gmail to a friend's Gmail, are you saying the text of this email is stored on an NSA machine?
Maybe not today, but during its heyday must certainly.
>Internal NSA presentation slides included in the various media disclosures show that the NSA could unilaterally access data and perform "extensive, in-depth surveillance on live communications and stored information" with examples including email, video and voice chat, videos, photos, voice-over-IP chats (such as Skype), file transfers, and social networking details.[2] Snowden summarized that "in general, the reality is this: if an NSA, FBI, CIA, DIA, etc. analyst has access to query raw SIGINT [signals intelligence] databases, they can enter and get results for anything they want."
>[Glenn Greenwald] added that the NSA databank, with its years of collected communications, allows analysts to search that database and listen "to the calls or read the emails of everything that the NSA has stored, or look at the browsing histories or Google search terms that you've entered, and it also alerts them to any further activity that people connected to that email address or that IP address do in the future."[44] Greenwald was referring in the context of the foregoing quotes to the NSA program X-Keyscore.[45]
https://en.wikipedia.org/wiki/PRISM_(surveillance_program)#E...
But let's suppose they don't have your emails stored in their datacenters. Instead, it's still stored on google's servers but they can access your emails via automated requests to google, via search terms or by providing your user handle. Is that a meaningful difference, in terms of privacy?
> "Instead, it's still stored on google's servers but they can access your emails via automated requests to google, via search terms or by providing your user handle"
You just said previously the exact opposite! That they can't query Google, but they have the data themselves.
> "Is that a meaningful difference, in terms of privacy?"
Yes, because it means Google are aware of what data they are being requested, and what they are sending in return.
The transparency reports for these companies show that the total number of requests is in the region of 10k/year - a lot in some senses, but nowhere near the level of surveillance many people seem to believe.
We can discuss the problems with it, but only if we start from a point of truth.
PRISM is not a VPN with a SQL client, or anything close to it.
The second one does not refer to domestic hacking. They don’t do that.
- Legally: They get served a NSL with a gag order forcing them to add the backdoor without telling you, on penalty of prison time
- Extra-legally: They get blackmailed by a TLA do add access and cover it up, or else.
("They" is not necessarily the company's CEO/CTO, but a sufficiently senior DBA/network admin.)
What do you believe is happening in that second image?
One could argue semantics as to whether a fiber tap is "hacking" or not, or whether tapping a domestic company's network from an international transit link counts as "domestic hacking"... but there is ample evidence that US intelligence agencies do target domestic companies and their networks.
See also, the rest of the docs on MUSCULAR: https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program...
Since the links are likely compromised, ubiquitous encryption is your friend.
The FBI (and NSA for that matter) are a lot more constrained by the law than HN seems to think, they can't just shell anyone they want especially if the target is a third party that has done nothing wrong.
https://en.wikipedia.org/wiki/MUSCULAR_(surveillance_program...
Pretty much that, and also tapping any traffic that's in their internal networks, since that's not encrypted either.
> What does that have to do with the FBI hacking into the backend of a airline company?
That's one possible attack that the FBI could be carrying out. ie. sabre doesn't encrypt its communications in their internal network, and that's being tapped similar to how the NSA tapped google's internal networks.
The reality is not that clear. A lot of what governs what these agencies can and can't do comes from executive branch policies. There is a lot of gray around what is "legal" and congress likes it that way because it keeps responsibility for allowing to much or not enough surveillance far away from them.
What's more, you cannot adjudicate what you don't know about and a lot of the secrecy in programs like this is just as much about keeping away civil libertarian attorneys as it is about confounding "the enemy". There's a reason the FISA court rules nearly 100% of the time with the state. Responding attorneys are rarely involved and when they are they are often hamstrung due to a lack of knowledge that prevents them from filing any kind of useful motion or raising serious opposition.
I haven't ever tried connecting to it, but I'll tell you when I alerted their security team there was no urgency about it, and the password was so simple I bet you could guess it within 10 tries.
Don't be so quick to say "you" are not actively having data taken. "You" just might not be aware of it.
Some companies establish subpoena canaries for that specific reason.
Would that surprise anyone? Governments are known to stockpile and exploit vulnerabilities in targeted computers in order to obtain access. The US government even came up with an euphemism for this malware: network investigative techniques.
If you’d like to ask a different question, feel free, but I am not interested playing the “are you saying...” game.
No entity is going to ignore subpoenas or warrants. They may challenge them for reasons that are applicable to the business.