Hacker News Reader

The mirrored language in Page and Zuckerberg denials, focusing on denying direct access to servers and not on denying access to user information made it clear user information was being shared.

Nobody really cares about the how, yet that's what all the technical denials focused on. What matters is the what.

WaPo and The Guardian have played their hands well to let companies and government entities themselves reveal who is being straight with the public and who is tap dancing.

The reason they didn't deny "access to user information" is because it was common knowledge before the PRISM leak that they would send user information to the government on request. The only new accusation against these tech companies with the initial PRISM leak is that they were knowingly allowing the government to directly access their servers. That is why they denied direct access, because they were accused of supplying direct access. Just because Google and Facebook didn't deny these new accusation before they were ever levied against them doesn't mean they are automatically guilty of them. Let's wait to see how things play out before we starting making judgements.

FBI equipment ON COMPANY PROPERTY to transmit realtime information on whomever from a blanket approval order is pretty damning, and not at all consistent with the harsh language of the denials of google et al and their desire to share a specific (presumably small) number of warrants with us

They denied any hardware on their property as well:

> We refuse to participate in any program — for national security or other reasons — that requires us to provide governments with access to our systems or to install their equipment on our networks,” he said.

http://www.wired.com/threatlevel/2013/06/google-uses-secure-...

I don't disagree with how damning these new accusations might be. However, some people are taking the fact that these companies didn't deny FBI equipment being or their premise as admission that there is FBI equipment on their premise.

Looking at these slides, I see no proof that companies have FBI equipment on their property. That seems to be a claim made by the WaPo that is supported by other slides or sources. I am just suggesting we wait until more information comes forward before we start taking these accusations as fact.

I'm unaware of where "facts" will come from though. So far it seems as if the gov't says one thing, the companies say another, and the leaks say yet another. I don't see any companies rushing forward to clarify what exactly is going on, and the government isn't really a neutral arbiter of truth here. I would say we prioritize the information from the leaks, given their restricted nature and their intended audience, but that doesn't mean there might not be over-generalizations or mis-interpretations there either.

I really hope that tech company CEOs get their feet held to the fire for misleading statements though and journalists keep (or start) asking them direct and difficult questions to get answers on record before more leaks come out.

getspopcorn

> means that there is nothing between the servers and the wiretapping equipment.

There can easily still be no wiretapping equipment upstream of the servers; the companies are already copying the data directly to the collection equipment anyways, so that can be a parallel path. I'm not sure a place like Google or Facebook would ever choose to participate in something like this if their whole business were one misconfigured serial-path wiretap server away from being completely down.

I believe the NYT had mentioned a couple of days after the story broke that 'real-time' collection was possible. Even that is easy technically, you just send a copy of that instant message or video frame to the FBI collection server as it goes out.

By 'nothing between' I meant 'nothing that is worth mentioning in a newspaper article.' But you raise an interesting point, the entire wiretapping needs to handle a similar load as a large datacenter and should not impact the uptime, and therefore it should be quite an engineering challenge. So there should be documentation on the Google side, how to 'plug' it into a data center, which power requirements that stuff has, etc...

Which means that it's not something that Larry Page can just sneak into his datacenter without his squads and squads of Googlers never picking up on it, true.

Even the cheapest managed switches have a traffic mirroring port setting, no "prism" required.

Even if we assume that PRISM still needs to know what exactly to do with that inbound traffic, which it will need metadata for.

Of course maybe it's possible to setup a session and then just forward all traffic from a given company subnet IP:port to a PRSIM case file, but that's getting back into impl details for me.

This is an incredibly fanciful interpretation of language. If these reports are correct then Google is simply outright lying. If you have to strain to read a statement to mean the exact opposite if what it plainly says and that opposite is the truth, then what practical difference is there between that statement and a lie?

Statements from Google:

  we have not joined any program that would 
  give the U.S. government—or any other 
  government—direct access to our servers.

  Our legal team reviews each and every request, 
  and frequently pushes back when requests are overly 
  broad or don’t follow the correct process. Press 
  reports that suggest that Google is providing 
  open-ended access to our users’ data are false, period.

  Until this week’s reports, we had never heard of the 
  broad type of order that Verizon received—an order 
  that appears to have required them to hand over 
  millions of users’ call records. We were very surprised 
  to learn that such broad orders exist. Any suggestion 
  that Google is disclosing information about our 
  users’ Internet activity on such a scale is 
  completely false.

  We cannot say this more clearly -- the government does 
  not have access to Google servers--not directly, or via 
  a back door, or a so-called drop box. Nor have we 
  received blanket orders of the kind being discussed in 
  the media. It is quite wrong to insinuate otherwise.

  Google participates in that allows the kind of access 
  that the media originally reported. Note that I 
  say "originally" because you'll see that many of 
  those original sources corrected their articles after 
  it became clear that the PRISM slides were not accurate.

  There is no free-for-all, no direct access, no 
  indirect access, no back door, no drop box.

  We’re not in the business of lying and we’re absolutely
  telling the truth about all of this. Our business 
  depends on the trust of our users. And I’m an executive 
  officer of a large publicly traded company, so lying to 
  the public wouldn’t be the greatest career move.

  If by what has now been “revealed” you mean the allegation 
  that Google is allowing the NSA unfettered access to user 
  data or that we’re handing over data willy-nilly to the 
  government, again, that’s just not true. It’s not 
  rhetoric, it’s just a fact.

  QUESTION: Without giving any specifics which might put you 
  in violation of such an order, are you legally bound to \
  lie about anything to the public? (Yes or no is fine)
  ANSWER: Nope. No gun to my head.

  I’m really troubled if you’ve lost trust in us because of 
  this idea that we’re collaborating in a broad surveillance 
  program. We’re not, and that’s why we are pushing back so 
  hard on these allegations.

I really don't know how you could say NO more strongly. How would you say it? It is manifestly apparent at this point that there is no possible way that you could say it without someone who wants to believe otherwise reading whatever they want out of it.

In your examples, Google again just talks about 'servers.' There is no language which indicates that there is no wiretapping equipment in their datacenters, except for

    There is no free-for-all, no direct access, no 
    indirect access, no back door, no drop box.

Which is clearly wrong, since there is a indirect access to user data ( via court order). [1]

However at this point Google is trying to prove a negative, that it does not knowingly participates in covert surveillance of its users. ( With the added complexity, that AdWords analytics should qualify as surveillance.) So Google will have a very hard time to convince me. However a published privacy policy, verified by a third party, would go quite a long way.

[1] http://www.google.com/transparencyreport/userdatarequests/?h...

You seem to read only the lines that you can creatively contort to validate your belief and ignore the rest. I don't think you are intentionally doing this, but it seems quite apparent that it is happening anyway from my vantage point. The Google comments mention user data in addition to the servers themselves, and many of the comments refer to surveillance in general.

If the media claims turn out to be true nobody is going to think "Oh, Google was telling the truth the whole time!" As I mentioned, there is no practical difference between this statement being "true" in the sense that you creatively "read" it and an outright lie. No reasonable person would read these statements in the way that you have.

You seem to be having a really hard time simultaneously holding the idea that the media reports are correct and the idea that Google/the big tech industry is trustworthy, hence the mental gymnastics. You're going to have to drop one of those two ideas. You will eventually.

Of course I am discarding some texts and doing a hostile interpretation of others. The reason for this is, that not all texts are created equal. Some, like the Larry Page one, are created by lawyers and PR specialists in endless meetings. The Google blog post in particular has the purpose of limiting the damage to the Google brand. For this it needs to sound good first of all, but it also needs to contain a sliver of truth so that the company can not be forced to retract it, which would just further damage the brand.

So implying something, while actually reporting something different is a lie, but it is a highly specific type of lie. And it is quite often quite interesting to do these mental gymnastics to uncover the sliver of truth in these statements.

Or the precursor to their more-formal statement:

"What the ...?" Posted: Friday, June 07, 2013

Dear Google users—

You may be aware of press reports alleging that Internet companies have joined a secret U.S. government program called PRISM to give the National Security Agency direct access to our servers. As Google’s CEO and Chief Legal Officer, we wanted you to have the facts.

First, we have not joined any program that would give the U.S. government—or any other government—direct access to our servers. Indeed, the U.S. government does not have direct access or a “back door” to the information stored in our data centers. We had not heard of a program called PRISM until yesterday.

Second, we provide user data to governments only in accordance with the law. Our legal team reviews each and every request, and frequently pushes back when requests are overly broad or don’t follow the correct process. Press reports that suggest that Google is providing open-ended access to our users’ data are false, period. Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist. Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false.

Finally, this episode confirms what we have long believed—there needs to be a more transparent approach. Google has worked hard, within the confines of the current laws, to be open about the data requests we receive. We post this information on our Transparency Report whenever possible. We were the first company to do this. And, of course, we understand that the U.S. and other governments need to take action to protect their citizens’ safety—including sometimes by using surveillance. But the level of secrecy around the current legal procedures undermines the freedoms we all cherish.

Posted by Larry Page, CEO and David Drummond, Chief Legal Officer

>This is an incredibly fanciful interpretation of language. If these reports are correct then Google is simply outright lying.

A huge corporation? Lying? About doing stuff that's harmful to their image -- stuff that they would have been pressured to lie about and deny them anyway?

Please. Next thing you'll tell us that there's no Santa Claus!