FOIA the PRISM tech stack | Hacker News Reader

FOIA the PRISM tech stack

nsa.gov

147 pointsmerinid24 comments

For all you PGP fanatics, consider (from http://33bits.org/2011/03/09/link-prediction-by-de-anonymiza..., a blog which I highly recommend) the sentence "During (...) 2007-2009, Shmatikov and I (...) showed how to take two graphs representing social networks and map the nodes to each other based on the graph structure alone—no usernames, no nothing."

Tinfoil won't save you this time.

Ooooh - http://www.pdl.cmu.edu/SDI/2013/slides/big_graph_nsa_rd_2013...

Nice find.

This paper seems to suggest that a possible counter attack is to create bogus edges and adjacencies--thus fucking with the utility of a (sparse) adjacency matrix or attempts at having useful window sizes for BFS or the like.

I suspect, though, that any sort of attempt at that would somehow be thwarted and just cause more pain on the attempting party.

I find this especially interesting coupled with Cray's YarcData graph analytics hardware called Urika, which has 512 terabytes in memory. http://www.yarcdata.com/Products/

I'm not sure what this is all about, but even though it is _my_ government, I feel like submitting this form would add me to some monitoring list.

So, sadly true. I was sending a friend an email today about this entire thing and for the first time ever I questioned whether my email would be eavesdropped on by my own government. It was a horrible feeling.

Exactly. This loss of trust and credibility is a big deal. Once it's lost, I'm not sure what the government does to get it back.

They don't need credibility, the chilling effects of knowing you are being watched are enough. You prevented yourself from actualizing your thought crime.

Don't worry about it. Everyone's on the monitoring list.

The nice thing about exposing what was already "known" is now so many people are talking about it openly. It is hard for the wolves to attack so many moving targets. What we need is for hundreds to file very narrowly focused FOIA requests that do not probe too deeply. They need to be fulfillable.

Good chances they are using http://en.wikipedia.org/wiki/Apache_Accumulo

Do you have any specific reason to believe that?

Nice try, NSA. You're not getting any more of my information.

No SSL/TLS, great job. Well, I assume AES crypto wouldn't bother them anyway. ;) Because it wouldn't be smart to make standard crypto which would blind them.

If I remember correctly, Verisign has indicated they would be willing to create a trusted root level certificate for the government to spoof the ssl of any domain... so I don't know if SSL is enough, unless you only allow CAs you've created or you trust.

Why would they have a form to ask for records on yourself when they don't publish which records they have. This is like a game of Go Fish but with personal data.

I just submitted the form and got the following error. Might be time to upgrade that ColdFusion formmail script, guys.

http://www.nsa.gov/applications/forms/foiaemail.cfm

Internal Server Error - Read

The server encountered an internal error or misconfiguration and was unable to complete your request. Reference #3.a447da3f.1370606557.3a7abfb

Also, they appear to be redirecting all HTTPS requests to HTTP. Try it: https://www.nsa.gov/public_info/foia/submit_foia_request/foi...

Configuration mistake or force of habit?

Unfortunately, despite the disturbing fact that we are reading about PRISM (disturbing both that it exists and that our government can't keep highly sensitive secrets), it is classified Top Secret until September 1, 2036. I could be wrong but I believe that FOIA requests regarding it will fail until then.

> disturbing both that it exists and that our government can't keep highly sensitive secrets

Why could it be disturbing that a government's officials can't keep secrets about cases where they abuse their power or act against the public interest? Isn't that how democratic institutions are supposed to be designed?

It's disturbing because if things as sensitive as this are leaking, it means other things will leak that could cost lives.

You're assuming that all sensitive information has the same probability of leaking. Anecdotally, that's not really true. Most of these systems depend on honest citizens to keep the information secret, and honest citizens are more likely to leak "secret" evidence of abuse than information that will cost innocent people their lives.

Or it was leaked on purpose to let everyone know that they should, "shut the fuck up." Or be watched?

http://www.youtube.com/watch?v=TuET0kpHoyM

Reply on news.ycombinator.com