Comment by cromwellian | Hacker News Reader

Comment by cromwellian | Hacker News Reader

So basically, PRISM is just a system for negotiating electronic dead-drop locations to pick up data when companies are compelled by an NSL to archive and copy an individuals data? If it were done by printing out the data and dropping a physical box in a pre approved location, would be be as scandalous?

What are we to believe PRISM is now? Is it

a) a firehose feed that allocates arbitrary, indisriminate, ad-hoc querying over large swaths of user data in cloud datacenters?

or

b) is it an automated system for sending out National Security Letters, and the polling dropbox locations for compliance, and then importing the data into some centralized government intelligence repository?

a) is an absolute outrage, there should be rioting in front of congress and the whitehouse

b) is pretty much just making delivery of information they are compelled to legally deliver more efficient. Although if I were these companies, I'd make it as painful as possible by printing all of the information requested on sheets of paper in Comic Sans and mailing it USPS.

Just because the system described in the article exists, is there any reason to believe that it is PRISM? Couldn't PRISM be something the NSA is doing in addition to this?

Could it be both? Most network monitoring systems specifically don't want to modify the network data, so "direct access" is undesirable anyway. It seems Google, FB and others are compelled to duplicate all data (including real time data) specified in the FISA, which is basically everything, into these special portals. Then the agencies can access whatever they want carte blanche from the duplicate environments without alerting sysadmins on the production servers. And the CEOs can say they don't have direct access and haven't heard the word PRISM before.

> FISA orders can range from inquiries about specific people to a broad sweep for intelligence, like logs of certain search terms, lawyers who work with the orders said. There were 1,856 such requests last year, an increase of 6 percent from the year before.

From the NYT story seems that PRISM is more b) than a). However, I suppose the remaining questions are:

1) To what extent did these automated processes for reducing the burden of handling FISA requests enable the total quantity of data requested through FISA requests to increase? "Quantity has a quality all its own."

2) How extensive are these broad-sweep FISA requests now, and to what extent do they falsify the impression that FISAs are "lawful, specific orders about individuals" (Google), "orders for requests about specific accounts or identifiers" (Microsoft)? In other words, that each individual FISA request covers only one person or a handful of people, so for example the number of people intruded on by FISAs last year is some reasonably small multiple of 1,856?

3) To what extent could the compartmentalisation of FISA information to a few employees, combined with the streamlining process and broad FISA requests, mean that the CEOs have less awareness than they thought about just how broad the FISA net really casts by now? Or instead are they happy not to know, or happy to be able to pretend not to know?

In other words, is PRISM b) in principle but something closer to a) in practise, and if so who knew?

Automated system for NSL letters will work a lot like automated system for DMCA takedowns. And we know how fine that turned out.

Is mailing hard copies more secure? I tend to think of phone calls and hard copies as less secure.

I don't particularly mind the security implications of the technique. However, It certainly is less convenient if you are the recipient.

It's easy, we encode encrypted audio data in binary, print out the 0s and 1s on an eco friendly paper and send the bundle off in mail. It is pretty secure since they will be the only one with private key.</s>

Reply on news.ycombinator.com