Hacker News Reader

Comment by newgre | Hacker News Reader

If it is true that the NSA MITMed Google connections, then one could draw the conclusion that the NSA doesn't actually have a direct connection to Google data centers (as claimed by Google). If they had such a connection, then why would they use MITM attacks against people?

View on HN

The "direct access" that the NSA has to Google accounts probably requires sending a request for some set of information to Google. It likely needs to be signed off on (even if it's all automated). I'd imagine the NSA would like to hide some activities, especially corporate espionage, even from the watchers at Google--it reduces the risk of anyone at Google growing a spine.

If you can't be sure your "backdoor" can be kept alive indefinitely, you better get used to using multiple approaches.

Requests to Google may be audited or logged; Google have an incentive to do this so they can pass the buck when the inevitable evidence of abuse comes out.

The NSA, on the other hand, would prefer there to be no audit trail so there's no evidence of the inevitable abuses.

Hard to know for-sure, but it could be something as basic as redundancy. If one method of information-capture was eventually disallowed, they'd have an alternative. Or if one method of information-capture required more oversight than they wanted - they'd have an alternative.

It would also stand to reason that the court/LEO requests to Google for data are just a CYA/formality with respect to them "legally" getting the authorization to read the data.

They likely have the access to all the data they want. They use the legal vectors for requests just to see what the companies would give them on the request, and can compare the difference between the provided data vs the slurped data.

Reply on news.ycombinator.com