Hacker News Reader

Comment by rsingel | Hacker News Reader

There's 2 different things going on, under different legal authorities and Google is confusing them.

Verizon was given a Patriot Act order for business records, metadata; no names; no content, but all citizens or foreigner.

Google and other tech companies are said to have gotten orders under section 702 of the FISA Amendments Act of 2008. That allows the government to compel communications companies to furnish lots of metadata and CONTENT on NON-U.S. persons. This was Congress legalizing warrantless wiretapping ala AT&T, but limiting it by requiring it to be targeted at non U.S. persons.

Compliance is mandatory, under contempt of court and companies must provide facilities and help. They also get reimbursed.

So it's likely Google never got an order like Verizon did, they likely got one that involves content, but is supposed to exclude intentional targeting of Americans.

View on HN

I don't buy it. What I quoted above doesn't say anything about US persons or non-US persons, about content or metadata, about this law or that one. It just says,

    Any suggestion that Google is disclosing information 
    about our users’ Internet activity on such a scale 
    is completely false.

Now, Page may well be lying, but he definitely isn't weaseling. I'm pretty sure that denial covers both of the possibilities you're referring to.

Of course it's weaseling. Maybe they disclosed such information on a slightly lesser scale. That passage doesn't say.

They all said stuff about "direct access", without discussing what would and wouldn't qualify as "indirect". They didn't deny doing all kinds of different access that could be called indirect in some way.

WaPost backtracks on claim tech companies ‘participate knowingly’ in PRISM data collection

http://thenextweb.com/us/2013/06/07/wapost-backtracks-on-cla...;

Of course they don't deny indirect because that would be a lie. Everyone provides data indirectly via a thing called "warrants". Google publishes how many indirect requests they comply with right here: http://www.google.com/transparencyreport/userdatarequests

The thing is we can't trust any statement by anyone because of the gagging component of NSLs. I've heard it said that the above information is for FBI requests under the patriot act and doesn't include NSLs. For all we know NSL gags could explicitly forbid that kind of reporting and may even compel the recipients to lie if asked.

The last sentence he made, that the government needs to be far more transparent about what they're doing is the only sentence I can really trust as honest, especially given that the alternative to lying could be being thrown into Guantanamo for 'assisting terrorists'.

Those goole reports are for regular law enforcement requests. They have nothing to do with spying that happens in the name of national intelligence.

False, national intelligence is still covered by Google's transparency report - see the NSL (National Security Letters) part.

>The presentation claims Prism was introduced to overcome what the NSA regarded as shortcomings of Fisa warrants in tracking suspected foreign terrorists. It noted that the US has a "home-field advantage" due to housing much of the internet's architecture. But the presentation claimed "Fisa constraints restricted our home-field advantage" because Fisa required individual warrants and confirmations that both the sender and receiver of a communication were outside the US.

>"Fisa was broken because it provided privacy protections to people who were not entitled to them," the presentation claimed. "It took a Fisa court order to collect on foreigners overseas who were communicating with other foreigners overseas simply because the government was collecting off a wire in the United States. There were too many email accounts to be practical to seek Fisas for all."

http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n...

I think there are a lot of possibilities that could be consistent with Page's statement that also involve the NSA spying on Google users. For example, perhaps the NSA asked Google to disclose their SSL private keys; then, if they are willing to do an active attack with their own infrastructure, they could transparently perform a MITM attack on all requests to gmail, and it would be virtually undetectable.

Another possibility is that the NSA could have served orders on Google employees directly, and they are compelled not to tell their managers about what they did for the NSA.

Or you just follow standard operating procedures for foreign intelligence collection.

You hire a foreign national, working for a foreign division of Google to be your spy. Unless every US citizens mail server is domestic, lotta a loopholes to be found.

People should also not assume the credit card statement from their bank is a batch job run on US servers by their bank. I've been told this stuff is outsourced, probably to the lowest bidder. Which if I were an intelligence service, I would be more than happy to subsidize.

>I've been told this stuff is outsourced, probably to the lowest bidder.

You have been told incorrectly. (Source: I work for a major US credit card company.) Certain pieces of the development and maintenance may be outsourced (under the supervision of US employees), but we (and, as far as I know, all our major competitors) own the data centers where they are run.

  | they are compelled not to tell their managers
  | about what they did for the NSA.

This seems problematic. What if another employee discovers what was done? What if it goes all the way up the chain? When they ask the employee why the created a backdoor, is the employee then obligated to lie? Get fired for the lie? Go to prison while maintaining it's not a NSA secret program?

The key issue here is that Google and the other companies may have no idea this is going on. My read is that the NSA has managed to gain access to the data centers either through inside help, spy craft, hardware/router back doors, or some other means we have no idea about.

AT&T and Verizon are two of the most powerful companies in the US, and have massive lobbying power. The notion that those companies were compelled to sign on to huge espionage programs, with their chiefs being fully aware of it - but yet somehow Facebook / Google / Microsoft / Apple etc. did not have to sign on to anything related to Prism (which has been openly admitted to exist by the Feds), nor were they aware of anything, is just about impossible.

It's hard for me to believe they could access to the data centers without Google's knowledge.

Isn't it more plausible that they're intercepting data flowing in and out of Google servers?

Hmmm…

<conspiracy theory> We haven't seen posts from the CEOs of Cisco/Juniper/Dell/HP or other manufacturers of datacenter grade network equipment. Who needs Google/Facebook's "knowledge" if you've got root on all the border network gear (and SSL termination hardware)?

I know here in .au, Huawei have been excluded from the government-deployed National Broadband Network due to suspicions that the Chinese government has too much control/access to Huawei newtwork hardware.

an old time option - a few employees "compelled" to provide access and keep mouth shout.

a new time option - Larry is lying because of the gag order.

in between - Larry said "on such scale". Well, Google probably is of a bigger scale than Verizon.

Anyway, once the data is out there, it is only a matter of time and determination for a government (or any financially well backed up player) to get to it.

This scandal will be a great boost for any services involving "crypto", and probably would spring a new ones like an encrypted phone exchange/switch service, where one can see incoming and outcoming phone numbers, yet not which one connected to which :)

This was my initial assumption, that Prism referred to fiber optic prisms that are used to duplicate data with zero interference.

These can be installed at the trunk level with virtually no one knowing about it (maybe a couple of on site managers). They can handle massive data and pipe it directly to the NSA. The problem of course is you're dealing with raw data which isn't nearly as easy to work with then if you had direct access to internals.

These are already installed on every major backbone so I also don't see why they would bother to involve anyone, so there must be more to it.

ps. It would be nice if another whistleblower came out with the data on optic splitters and how the NSA uses them.

possible the timeline on the slide is when NSA successfully began making sense of the raw data they could be collecting at internet backbones? also possible that the document purposefully threw the public off track by implicating these players, thus limiting the legitimacy of the claim if it ever came to light?

Consider the sheer volume of data we're talking about here. Unless you think these companies would miss a fiber optic trunk running out the back door of their data centers, does that make any sense?

The Feds have direct taps into every major telecom carrier in the US. You can't fire off a search query to Google without the Feds technically being able to pick it up.

Access is trivial, volume is a much more interesting problem.

This is accurate. When your service provider is having a scheduled maintenance, it might be a passive optical tap or port replicator.

How much data is leaving?

There could be a lot less data leaving than you think.

>>Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false.

If you consider that PRISM is not a 'dragnet' but rather an automated system that processes FISA warrants on company premises then the denial wouldn't be wrong. There is no 'scale' that you wouldn't be able to get using regular data requests to internet companies. PRISM could just make the process a lot easier for everyone involved.

So instead of sending a warrant over, having the company verify and send the data to the NSA, then finally transforming the data into a reportable format PRISM automates the whole process.

If you read some of the media descriptions it almost looks like PRISM is more of a data aggregation and portal system that sits on top of a data source and allows analysts to explore content.

I 100% agree; I don't see how anyone can ask for a more blatant and firm statement than that.

But if they were give similar court order terms as under the Verizon court order wouldn't he legally have to lie or violate the court order? Or just not give a comment, but no comment on this would implies guilt to a lot of people so lying could seem like the correct path.

I don't believe he can be forced to lie. If he was in that situation, I imagine he would simply not respond.

> Verizon was given a Patriot Act order for business records, metadata; no names; no content, but all citizens or foreigner.

No, it was a FISA order: http://www.guardian.co.uk/world/interactive/2013/jun/06/veri...

Both of you are correct. The Patriot Act Section 215 amended the FISA statutes.

I don't see how they could have gotten an order under the Patriot Act. The section that deals with this is section 215, which amended section 501 of FISA.

It specifically states that such an order can be made "provided that such investigation of a United States person is not conducted solely upon the basis of activities protected by the first amendment to the Constitution".

If they have been violated, then there are a number of members of Congress and the Senate who are falling down on their job - the Attorney General must inform the Permanent Select Committee on Intelligence of the House of Representatives and the Select Committee on Intelligence of the Senate. On top of this, every 6 months the Attorney General must also provide a report to the Committee on the Judiciary of the House of Representatives and the Senate which details the total number of applications made for orders approving requests for the production of tangible things and the total number of such orders either granted, modified, or denied.

I've read and documented the USA PATRIOT Act on Wikipedia incidentally. Took me two years to read and understand the thing. Possibly things after the Patriot Act changed FISA, I wasn't going to spend any more time on writing up about this subject. I'm an Australian citizen, after all.

I should note that I'm not thrilled about the fact that the U.S. government can read my communications. Not that I have anything to hide, nor am I of any interest to them, but hardly the point.

The two parts to read on Wikipedia, incidentally are:

* http://en.wikipedia.org/wiki/Patriot_Act,_Title_II#Overview

* http://en.wikipedia.org/wiki/Detailed_breakdown_of_USA_PATRI...

>This was Congress legalizing warrantless wiretapping ala AT&T, but limiting it by requiring it to be targeted at non U.S. persons

But how would you determine on the internet that an account holder was a US person or not ?

If I claim to be the person X who is a US person by registering for an account in their name, am I then a US person and therefore supposedly exempt from monitoring? Even IP-based clues are not enough as those are not full-proof.

I suspect that both US persons can be just as susceptible to tracking from the Government.

> But how would you determine on the internet that an account holder was a US person or not?

That's why they only have to check a box saying they a reasonably sure that there is at least a 51% chance.

Vague laws are invariably wildcards that can and will be abused.

Unless I am mistaken US and most European countries are based on Democracy. Wikipedia defines Democracy as a form of government in which all eligible citizens have an equal say in the decisions that affect their lives. Granted, wikipedia is not the oracle but it gives a good definition in my opinion. Does, the gathering of my personal data, affect my life ? Well in my personal opinion it does, therefore I should be informed about it.

The US was based on the ideas of a Constitutional Republic, not a Democracy.

Right, there are different forms of democracies. From this chart I see that US is categorized under Full Democracy: https://en.wikipedia.org/wiki/File:Democracy_Index_2012_gree... https://en.wikipedia.org/wiki/Democracy_Index https://en.wikipedia.org/wiki/Democracy

Reply on news.ycombinator.com