Hacker News Reader

Comment by semenko | Hacker News Reader

> edit: Gmail messages must only be captured when they leave the Google network.

It seems easier for the NSA to tap datacenter <-> datacenter fiber links inside Google's network.

Why worry about decryption when you can have Google's frontend servers do it for you?

Or, the NSA could force Google to provide them with private keys to their certs for "national security" and then they can mitm all they want.

Why assume that inter-datacenter links are not encypted?

Why would Google (or anyone) link to them directly? with fiber no less! this stuff is alarming enough no need for FUD.

This XKS business seems about intercepting non-encrypted traffic as the references to HTTP payload quoted in the article would suggest.

(Keep in mind these slides are 5 years old, before Google Search over SSL)

The NSA has clearly tapped trans-oceanic fiber -- why not also tap high-volume inter-datacenter links?

I guess they could tap the fibre at a relay point, maybe somewhere like Hawaii.

> Why would Google (or anyone) link to them directly? with fiber no less! this stuff is alarming enough no need for FUD.

Who says Google has a choice or is even complicit? The backbone providers have mostly stayed mum and it's known that the likes of AT&T split their fiber for the NSA. If we're willing to go to the bottom of the ocean to tap fiber lines it's pretty easy to believe that we'd tap terrestrial lines too.

My understanding is that internet firms enjoy slightly more leverage, and that is why in contrast to telecos they are now petitioning the courts to reveal the scope of the orders.

That's all hand-waving. The courts won't allow it, the giants know that, so the internet giants use it as a chance to look good. Furthermore, it benefits the NSA for us all to think that Google, Yahoo, et. al., are not in their pocket.

> Why would Google (or anyone) link to them directly? with fiber no less!

"They have no direct access to our servers"

I wonder what a beam splitter consists of. Oh. A PRISM.

Beam splitters are, in general, not prisms. A prism, as traditionally referred-to (and in the NSA PRISM graphic) separates light of different wavelengths. In a signal tap, you want to split the intensity, not the wavelength. In simplest form, telecom signals are at a single wavelength; passing it through a 'Dark side of the moon' prism will only deflect the beam, not split it.

When one refers to a beamsplitter, it's usually a partially silvered mirror.

http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=914

If it's fancy, it might use an evanescent wave to do the coupling, as in some cube beamsplitters.

Beamsplitters for optical fiber are more generally referred to as 'couplers' and involve bringing two fiber cores close enough for a long enough distance that the probability of coupling light from one to the other is the desired amount.

http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=374

It is possible to split beams with a birefringent prism, but it is much less common.

http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=745 http://www.thorlabs.us/newgrouppage9.cfm?objectgroup_id=917

Disclaimer for the following: I only work with optical fiber couplers occasionally, and not for telecom. Someone who works on telecom fibers daily will be more informed.

In summary, if someone wanted me to tap an optical fiber, I'd call up ThorLabs, get a matching coupler shipped overnight, cut the relevant fiber, slap APC ends on the fiber ends, and jack in. Splitting the beam in free space (outside of a fiber) with a prism is far more errorprone, unstable, and no more efficient. A fiber coupler has no moving parts, can't break, and won't take down a telecom's trunk line if someone breathes on it funny.

If they're actually using a prism, it's because of some sort of impedance/reflection minimization scheme; I can't conjure one that would work better than using simpler techniques though.

You can/do/might use actual prisms for a variety of reasons, however, such as if you're trying to get a frequency-multiplexed set of signals off a single fibre broken down as their constituent components - i.e. bulk data collection from a single tap on a mass fibre bridge.

Anyway, you're probably right, it's probably just bog standard parts, and PRISM was a buzzword for management.

Are couplers detectable via time domain reflectometry in practice?

Actually it's: "There is no free-for-all, no direct access, no indirect access, no back door, no drop box."

http://www.guardian.co.uk/technology/blog/2013/jun/19/google...

And I tend to believe him.

Reply on news.ycombinator.com