Google’s Real Secret Spy Program? Secure FTP
wired.com
wired.com
...they [hackers] apparently were able to access a system used to help Google comply with search warrants by providing data on Google users, said a source familiar with the situation, who spoke on condition of anonymity because he was not authorized to speak with the press. "Right before Christmas, it was, 'Holy s!@#, this malware is accessing the internal intercept [systems],'" he said.
I guess this could be the system that google uses to compile the data before transmission, or something else, but none the less, it does raise questions.
[1] http://www.zdnet.com/blog/foremski/googles-internal-spy-syst...
[2] http://www.informationweek.com/security/attacks/google-auror...
which appears to have been a list of people that had been targets of "surveillance orders", which would have given the Chinese intel on any operatives that were being watched by the US, but isn't the "backdoor access system" that Schneier said it was at the time (seemingly without a source, but it's hard to tell as he doesn't say where that information comes from and no one else seems to have picked it up subsequently).
I swear that that ars story had an HN thread (maybe the washington post source article did?) but I can't find it now.
A remaining explanation that matches all the known facts right now is that PRISM is a data format or data standard. It makes the process more efficient since it doesn't require the NSA to adapt disparate data sources from different web companies.
One of the other slides mentions that this is a big problem for SIGINT at NSA. PRISM being a data standard would also explain why the program only cost the NSA $20M.
The difference between the tech companies participating in the program would be how they implemented it - perhaps Google push the data to the NSA but it sounds like other participants let the NSA pull the data (or they store it on a third server which the NSA retrieves from - the lockbox).
Also, saying that the requests are 'legal' isn't reassuring, since a large part of the recent NSA revenlations is the world finding out just what the Obama administration considers to be 'legal'.
Legal means nothing more than finding a government lawyer who will write an opinion that blanket metadata requests or pulling or pushing data from Facebook and Google is legal. The opinion is classified, the court arguments are classified, there is only the government at the court and it is presented to a judge who is appointed by the government.
Exact same thing happen with John Yoo and his legal opinion that the torture the government was carrying out was legal[1]. When the rest of the world found out just what the government considered legal, it very quickly became illegal.
Assuming that PRISM is the mechanism by which FISA requests are fulfilled, they can't discuss FISA requests in the open without breaking the law.
What people were worried about, a "dragnet" that allows arbitrary access and intercept of any user data by the NSA turns out to be false.
Unless you think you can use SFTP to upload, in real time, all traffic on Google services.
There's nothing Google could say or do to clear their name on this. The NSA, Congress or the Executive branch need to detail the level of access and the form of access that the NSA has to Google's information in order to clear Google's name. Even that unfortunately has to be taken with a large grain of salt.
There's simply too much information pointing towards mass surveillance with assistance from US companies to believe what the companies themselves say. This is a shitty position for Google to be in but consumers didn't put them in it, the US government did by admitting to the PRISM slides being correct without detailing how the companies mentioned on them are involved.
> If there was a dragnet it is very likely that they
> legally are not allowed to admit it as per terms of
> the court order.
> The NSA, Congress or the Executive branch need to
> detail the level of access and the form of access
> that the NSA has to Google's information in order
> to clear Google's name.
This is correct.
There is a difference between people lying, compelling silence, and being forced to lie.
The government can force people to be silent, be it upcoming raids, targets of investigations that they don't want tipped off, etc.
I know of zero legal authority that allows the government to force people to actively lie.
If anyone here does, i'd love to see it.
There is in fact, authority that the government cannot compel false or misleading statements. None that i'm aware of in the national security context, but this actually comes up quite a bit in the abortion context.
For example, Casey vs. Planned parenthood and others make it very clear the government cannot compel you to speak misleading information.
Opinions argue about what is false and what is misleading, but that is clearly not an issue here.
Realistically I'm not sure what the NSA would share with anyone that could be conclusive. But a logical explanation of how the NSA gets into data without corporate cooperation and that explanation matching up with the timeline presented on the one slide would be a great start.
For instance, you could argue that the PRISM timeline is simply showing once the NSA had filters in place to identify and capture general internet traffic headed to and from those specific companies. But this has a large hole in that why would Google, a company who's search queries would be highly valued, come so far after Microsoft on the timeline. So an explanation that addresses the large questions like that.
As opposed to the current situation which is a credible leak that makes Google look very bad, an executive branch that is defending the information in the leak as being legal and Google flat out denying any involvement.
It takes what the company was doing manually before PRISM (complying with NSLs and FISA warrants)...
and automates part of that process.
What it doesn't do is insert NSA as a wiretap into all their systems's traffic, as that's not what FISA compliance needed in the first place.
Of course it is. It's not proof, but it's evidence. It shifts the probability towards "there is no dragnet" by some amount. Maybe it's not significant, but it's there.
I bet that the bombshell disclosure will be that these 'proper legal warrants' are actually just arbitrary requests justified via the Patriot Act or similar.
Now the scenario is: They must obtain NSL/FISA orders, Google reviews them, then the data on their target is released.
Is that a dragnet? What if when Google wins the right to publish statistics on NSL/FISA requests, it turns out to be just a few hundred per year, or less than regular search warrants, like when a guy is suspected of killing his wife.
Would that change your opinion? It seems that the pitchforks came out on the original WashPo/Guardian scenario, and if that turns out to be wrong, people will keep moving the goal posts and not put the pitchforks away.
Some people just want to believe that the tech companies are greedy, unscrupulous, entities.
However, they should be even more specific. A skeptical person could say this still leaves the door open to, say, a custom SFTP server that gives the NSA access to any user data. I don't believe that's the case, but I think they should provide more detailed procedures for exactly how they comply with these requests.
e.x.
"The following procedure is the only method by which we provide data to law enforcement:
1. When we receive a request for user data from law enforcement, our legal department thoroughly examines the request to ensure it's legitimate, not overly broad, blah, blah, blah.
2. X person performs Y steps to extract the specifically requested data from our data stores, with Z safeguards to assure no additional data is included.
3. The legal department reviews the extracted data to ensure it matches the requested data, and only the requested data.
4. X person sends data to law enforcement agency using Y methods (i.e. uploading data to a SFTP server account) and notifies the agency that the request has been fulfilled."
Just because the transfer mechanism is sftp doesn't matter. My supposition is that prism is an auto-importer of these files: able to parse the data formats from these companies and present it to agents in their database UI.
Prism: import.io for anyone's data?
I guess I never thought of it being about feeling sorry for him. It was about the NSA using black mail to get CEOs to do what they want. Allowing CEOs to get away with crimes such as insider trading as long as they did what the NSA wanted.
If I try to imagine the consequences of this it includes promoting corruption at the CEO level down in the industries that the NSA deals with. The long term effects of this are certainly negative and hard to quantify.
Now are the negative consequences out weighed by the benefit that the NSA receives and passes on to the USA then to the world? I do not know, I am not familiar enough with that arena, it is far from an obvious win from where I am sitting however.
Since FISA is all about active surveillance and wiretaps (of phones when it was written in 1978), wouldn't the government also want a way to watch activities in online accounts in realtime?
Anyone else find humor in this?
As a result I'm reluctant to take this article with more than a grain of salt.
Seriously, these conspiracy theories are simply impossible most times.
And SFTP stands for secure for NSA file transfer protocol, cause they are cool katz apparently.