Comment by pvnick | Hacker News Reader

Comment by pvnick | Hacker News Reader

Parent Full thread

The Guardian "backwalk" actually VALIDATES our worst fears, albeit with technical nuances to ensure legality. It's really just about the only viable way to implement this absent an SSL encryption crack (I would guess they're dumping encrypted communications from Room 641A waiting for an encryption weakness to be discovered, that way they'll have everything). As Snowden said, you could wiretap the president if you have a personal email.

Here's how it works (this is my opinion as a web developer, not verified details from Snowden leak):

1) Fancy user interface developed by Booz Allen Hamilton. Enter email address (good choice for a unique identifier, used as unique key in many databases).

2) Backend uses curl to send a request to NSA-certified web api on each service shown on the slide. This serves as a legally-binding FISA request either regarding a foreign agent - no court order required - or a domestic agent - secret FISA court order required (see http://www.npr.org/2013/06/13/191226106/fisa-court-appears-t...) and assumed to be fulfilled by the api.

3) Kick off NSA equivalent of gearman worker that checks contents of "dropbox"-like service from each company for updates.

4) Services (Google, Facebook, etc) automatically grant request without question as it is a legally binding FISA order. This saves them a ton of money and, hey, it's legal! They have some custom code that allows them to look up a user by their email address - almost guaranteed to be indexed in their database - join it to relevant data sets, and dump it to the "dropbox"-like system.

5) Fancy frontend shows progress bar, while skinny backend compresses retrieved data into zip file for easy download.

This is the most efficient, cost-effective way to do this without venturing into science fiction, ie storing a mirror of all the data which would be stupid on NSA's part. It still verifies our worst fears and answers the question as to how such a program can cost "only" $20 million per year as reported by the slides.

The trick is in the legal framework, not the technical details. This is why the FISA courts are secret.

Except that Google have stated that they have humans look into each request, and that there is no dropbox. So either Google's lying, or The Guardian/Edward Snowdon didn't actually understand what was going on (beyond the obviously true and worrying collusion with AT&T and Verizon).

>Google have stated that they have humans look into each request, and that there is no dropbox

I've been looking for this since I read your comment but can't seem to find it. Perhaps you could point me to the article to which you're referring?

If true that would be great, but to fulfill the constrains set by the information we do know, it is possible that most companies have drop boxes, while Google opted out. Do you recall what Facebook said about human review and drop box existence?

Edit: I also wonder how many requests are appealed. The human overseers you're referring to may be little more than mechanical turks and that data is returned in near-realtime.

I'm unclear on why the "drop box" matters, so long as it's being filled manually after expert review. In fact, a secure drop box is better than the alternative, which would be ad hoc distribution of sensitive information over the public Internet.

The problem is a lack of oversight. FISA courts are secret and allegedly a rubberstamp process (see link in my original post). If the program were to go through normal channels it would be ok.

What does this have to do with whether there's a dropbox or not?

Point you to an article?

You mean you've been shooting off here on HN without even reading?

At Google's official blog post, they stated that review each request.

Don't ask people for a link. Do your research first before you comment.

Here's how it works (this is my professional opinion as a web developer

    +++ATH0
    NO CARRIER

> +++ATH0

> NO CARRIER

Now now, let's not resort to modem violence.

Yes I am a web developer that goes to work everyday in a professional environment.

In your professional experience as a web developer, maybe you could square this assertion:

Services (Google, Facebook, etc) automatically grant request without question as it is a legally binding FISA order

... with the court order the NYT linked to from FAS, where Yahoo is seen to go several rounds with the FISC after having received a lawful directive from NSA to initiate surveillance?

From exactly what evidence do you argue that Google (or any other Internet company) automatically approves all FISA requests?

Snarky tone unnecessary. To which court order do you refer?

Edit: Also, your tweet quoting me sarcastically was also unnecessary. I'm trying to be helpful and you're being rude.

A little snark is probably the politest thing you're going to hear if you're supporting your speculation that

4) Services (Google, Facebook, etc) automatically grant request without question as it is a legally binding FISA order

with nothing more than the fact that you're a professional web developer. Replace that with the equally valid 'amateur lion-tamer' just to get get a more disinterested sense of how it sounds.

This is apparently the article. http://www.nytimes.com/2013/06/14/technology/secret-court-ru...

Thank you :)

Relevant part of the article:

>In a secret court in Washington, Yahoo’s top lawyers made their case. The government had sought help in spying on certain foreign users, without a warrant, and Yahoo had refused, saying the broad requests were unconstitutional. Related

>The judges disagreed. That left Yahoo two choices: Hand over the data or break the law.

>So Yahoo became part of the National Security Agency’s secret Internet surveillance program, Prism, according to leaked N.S.A. documents, as did seven other Internet companies.

From the court order:

"After a careful calibration of this balance and consideration of the myriad of legal issues presented, we affirm the lower court's determinations that the directives at issue are lawful and that compliance with them is obligatory."

Seems to me that tptacek is supporting my hypothesis

Saw that tweet. I usually don't like snark but you deserve it!

removed word "professional" because apparently that's a bigger deal than the content itself...

Instead of talking about my silly tweet, how about you address the question? Do you think I made the court order up?

Response: https://news.ycombinator.com/item?id=5878534

You responded to the NYT story, not the court order it linked to, and thus didn't address my argument, which was not about the NYT story itself.

Reply on news.ycombinator.com