US tech giants knew of NSA data collection, agency's top lawyer insists
theguardian.com
theguardian.com
> Neither De nor any other US official discussed data taken from the internet under different legal authorities. Different documents Snowden disclosed, published by the Washington Post, indicated that NSA takes data as it transits between Yahoo and Google data centers, an activity reportedly conducted not under Section 702 but under a seminal executive order known as 12333.
So the companies knew that they were receiving secret court orders to disclose data. Well, duh.
Edit: he even says so explicitly:
> “All 702 collection is pursuant to court directives, so they have to know,” De reiterated to the Guardian.
Thanks for saving that for the last line. All the rest is just trying to connect dots they have no new evidence for.
The NSA seems to have been forced by events to break that likely mutual-understanding.
Second, what does it mean for a "company" to know something? What if one compartmentalized group of employees know – perhaps ex-military/intelligence people themselves – and believe they are both compelled to comply and to keep the full details from upper management (for everyone's protection)?
Does that count as the "company" knowing? I could see the CEOs saying, as they have, "no", and the NSA saying, as they are here, "yes".
Probably, helping the security-state even makes keeping other security threats out, easier: if you play ball, they want their secret, exclusive access to be unique. They fortify the holes behind them, and can use their many, many vantage points to warn you about other emerging threats. Otherwise, you're on your own.
Do you want to be friends with the best-funded, legally-advantaged infosphere apex predator, or enemies?
The CEOs might know, and think it safe to lie. (That's the "First" part of the topmost post.) They might not know because the NSA only approached targeted lower employees, and the combination of the law and the company's own structure prevents the full decision/compliance from every being told to the CEO. (That's the "Second" part of the topmost post.)
And the reason that the don't "know" could be that the NSA is really good at a targeted approach, or that the CEO has helped by making sure enough people to make the NSA happy are empowered and compartmentalized to do so, without it getting back to him. In such a case, he honestly doesn't "know" exactly whether or how much the NSA is poking around, but that's ignorance-by-design.
If the government were angry at a CEO engineering such ignorance to avoid criminal liability, they'd prosecute under the theory of willful blindness:
http://en.wikipedia.org/wiki/Willful_blindness
But since the CEO is in this case doing the government a favor, the government will "look the other way" about the CEO "looking the other way"...
Probably most in the tech industry now...
That's not quite a 'black bag' job. Nor is it completely legitimate. It's something in-between, which most of the time lets everyone work under convenient fictions, getting on with the rest of their jobs.
But to consider another variant, I could absolutely see a janitor becoming convinced by men with badges that he must cooperate with their investigation, perhaps by planting a bug or offering out-of-hours access. A janitor could also be convinced by official-looking (and perhaps even truly official!) judicial paperwork that says he's not allowed to tell others.
In the case of my hypothetical 'Joe with Ft. Meade experience', the cooperation is cheerful because he believes in the mission and legitimacy of the request. But under the strange logic of compelled secret compliance, lower-level employees might be coerced into cooperation. (That'd be more likely to be seen as a true corporate infosec failure, rather than a "wink, wink, 'failure'", from the perspective of top executives.)
Earlier, the government insisted that simply collecting information in their databases was not a 4th ammendment violation, because the actual 'search' only occured when they _search_ the database, not when they collect and put in their database.
(I think maybe they even defined 'collect' so it somehow only applied when they did a search, not when they actually collected?)
Now they:
> ...strongly rejected suggestions by the panel that a court authorise searches for Americans’ information inside the 702 databases. “If you have to go back to court every time you look at the information in your custody, you can imagine that would be quite burdensome,” deputy assistant attorney general Brad Wiegmann told the board.
> De argued that once the Fisa court permits the collection annually, analysts ought to be free to comb through it, and stated that there were sufficient privacy safeguards for Americans after collection and querying had occurred. “That information is at the government’s disposal to review in the first instance,” De said.
Combine them both, and, well, you see where you get.
Come again...? So we're breaking the separation of the three powers because otherwise the authorities have to be inconvenienced with the "quite burdensome" task of "going back to court"? He can't be serious.
As COO of Facebook, she must have known a great deal about what was going on... it would be very interesting for me, given her talk of leadership, if she were asked some questions about this....
It's like their mothers never told them to look both ways before crossing the street, or to not play in traffic, for that matter. Or maybe their mothers hated them and told them to go play in traffic and that's why they hate the world. There are so many ways this allegory works. Ultimately, they're all going to get paved over by a road crew, if not hit by a very large bus. (cough, ahem, HD video, excuse me my digestion hasn't been right lately).
Bad reporting.
EDIT: Apparently the "upstream" collection does not refer to the third capture method in question, which exploited the fact that Google did not (at the time) encrypt its internal communications.
http://en.wikipedia.org/wiki/Upstream_collection vs http://en.wikipedia.org/wiki/MUSCULAR
> After the hearing, De said that the same knowledge, and associated legal processes, also apply when the NSA harvests communications data not from companies directly but in transit across the internet, under Section 702 authority.
doesn't imply that Facebook is informed when an "upstream collection" request is made to a telco in relation to a Facebook user, but rather that the telco is. It's pretty unclear though.
PRISM and UPSTREAM featured in the same slide which would explain them being discussed together, but UPSTREAM isn't subject to tech firms' whims so the discussion might have been concerning telecom firms as well.
The reporting isn't clear, best read the transcript when available.
What is amazing is the carelessness that the government shows w.r.t. protecting the interests of American tech firms. NSA could hardly have done more to destroy worldwide trust and credibility in our tech industry.
The other side of the coin is that the companies collaborating in these programs seem to put themselves at the mercy of the government rather than making products that can be verifiably trusted.
>> “All 702 collection is pursuant to court directives, so they have to know,” De reiterated to the Guardian.
So, yes, companies knew they were being served with FISA warrants (that they complied with) but AFAICT they were unaware that the NSA was tapping their data lines like the example where they tapped data lines between Google's (and others) data centers. [1]
[1] http://www.washingtonpost.com/world/national-security/nsa-in...
It doesn't even make sense anyways; what does Facebook have to do with surreptitiously tapping into a router in Belgrade or Quito?
The issue is that some of the participants in PRISM denied providing "direct access" to their data. Some people here are saying those denials are meaningful when we do not have a complete picture of how cooperation is compelled.