Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Connecting the PRISM Dots: A New Theory on How PRISM Works

uncrunched.com

Post reply on HN
Print view View original

41–49 of 49 posts

Re: Connecting the PRISM Dots: A New Theory on How PRISM Works

#41

Post by cromwellian »

I posted this theory on my G+ feed the first day it was leaked, that PRISM amounted to an automated-NSL-request-and-response management system, like an issue tracker. Click a button to mail an NSL request electronically, notify employee when company approves, go pick up the data automatically.

PRISM is an NSA issue tracker with auto-import essentially.

But someone else pointed out to me something more interesting. All companies which provide voice telephony, even VoIP, have to comply with CALEA, which means they have to install equipment maintained by the FBI which allows intercepts of Voice calls via search warrant.

Once Google added Voice/Video chat, they might have had to comply with this, just like Skype. Ditto for Apple and Facetime.

The Washington Post said something about the NSA tasking the FBI in this pipeline. Therefore, PRISM may be abusing CALEA devices which companies are compelled to install, by leveraging them for intercepts of voice in ways that don't fit the law.

So, revised theory:

For email and non-voice data, PRISM sends an NSL to company, waits for approval, then hits a REST API to pick up the goods.

For voice, PRISM sends request to FBI, who then commands CALEA device for intercept. No company action required?

Re: Connecting the PRISM Dots: A New Theory on How PRISM Works

#42

Post by tonyb »

cromwellian wrote: post #41

I posted this theory on my G+ feed the first day it was leaked, that PRISM amounted to an automated-NSL-request-and-response management system, like an issue tracker. Click a button to mail an NSL request electronically, notify employee when company approves, go pick up the data automatically. PRISM is an NSA issue tracker with auto-import essentially. But someone else pointed out to me something more interesting. Al…

CALEA is not only for voice. Broadband providers are required to be CALEA compliant. Basically they have to be able to delivery data in a specific format to an LEA.

These devices are not (normally?) under LEA control. The service provider would receive a warrant/court order that says "send data for customer XYZ to this CALEA capture IP". Even if the LEA had direct control of the CALEA device it would need the assistance of the SP to know what data is coming from what customer.

Re: Connecting the PRISM Dots: A New Theory on How PRISM Works

#43

Post by cromwellian »

tonyb wrote: post #42
cromwellian wrote: post #41

I posted this theory on my G+ feed the first day it was leaked, that PRISM amounted to an automated-NSL-request-and-response management system, like an issue tracker. Click a button to mail an NSL request electronically, notify employee when company approves, go pick up the data automatically. PRISM is an NSA issue tracker with auto-import essentially. But someone else pointed out to me something more interesting. Al…

CALEA is not only for voice. Broadband providers are required to be CALEA compliant. Basically they have to be able to delivery data in a specific format to an LEA. These devices are not (normally?) under LEA control. The service provider would receive a warrant/court order that says "send data for customer XYZ to this CALEA capture IP". Even if the LEA had direct control of the CALEA device it would need the assista…

Is it possible that the NSA is in cahoots with the CALEA device manufacturers? Once a CALEA device has been integrated with the SP's system, might it be the case that it can act as a trojan horse?

On the one hand, they could wall off the device, and have packets routed to it after reviewing the request. On the other hand, the device could be unfirewalled from the rest of the network.

Re: Connecting the PRISM Dots: A New Theory on How PRISM Works

#44

Post by aceofspades19 »

pja wrote: post #27
mtgx wrote: post #14

> "It can begin surveillance a week before making the request to the secret court, and the surveillance can continue during the appeals process if, in a rare case, the spy court rejects the surveillance application." How can this be constitutional? Doesn't the 4th amendment say you need probable cause before spying/searching on someone? I've also read that the NSA is spying on some, and then gives the info to the FBI…

You only need probable cause for US citizens IIRC. Anyone else is fair game as far as the NSA is concerned. The twist here is that the NSA gets to trawl through the data looking for interesting stuff (to them) on a pinky promise to a judge (in a court that has never said no) that they won't target US citizens. Given that the US government has stated that a 51% chance that the target is not a US citizen is sufficient…

Just curious, is there anywhere in the constitution that it says it only applies to US citizens?

Re: Connecting the PRISM Dots: A New Theory on How PRISM Works

#45

Post by [deleted] »

IanCal wrote: post #20
ig1 wrote: post #6

"Meanwhile, the BBC has learned that Twitter was invited to join the Prism programme last year, but rejected the approach from US authorities." http://www.bbc.co.uk/news/uk-politics-22824379

What would be the point? The vast majority of the data is public, and Twitter will give you firehose access (essentially a stream of all tweets) if you ask nicely.

[deleted]

Re: Connecting the PRISM Dots: A New Theory on How PRISM Works

#47

Post by momerath »

lessnonymous wrote: post #24
acqq wrote: post #8

And as soon as you are not in the U.S. or aren't the citizen, they don't need any order at all, not even the broad one, it's lawful for security agencies to get as much as they can and for Google to not even log which queries were made. Google can even help agencies by automatically informing them if the "target" fits "free to access" criteria. And everybody is still not breaking the law. Moreover, the amount of beli…

As a non-US citizen or resident this is a great concern to me (and I feel it should be to you too). The NSA is not allowed to spy on Americans. ASIO is not allowed to spy on Australians. But what if the NSA gave the PRISM tech and data feed to ASIO so ASIO could spy on Americans and answer any question the NSA asks (and vice versa). Now neither intelligence service has an 'illegal wiretap' on their own citizens. They…

http://en.wikipedia.org/wiki/UKUSA_Agreement

Re: Connecting the PRISM Dots: A New Theory on How PRISM Works

#49

Post by lessnonymous »

lessnonymous wrote: post #24
acqq wrote: post #8

And as soon as you are not in the U.S. or aren't the citizen, they don't need any order at all, not even the broad one, it's lawful for security agencies to get as much as they can and for Google to not even log which queries were made. Google can even help agencies by automatically informing them if the "target" fits "free to access" criteria. And everybody is still not breaking the law. Moreover, the amount of beli…

As a non-US citizen or resident this is a great concern to me (and I feel it should be to you too). The NSA is not allowed to spy on Americans. ASIO is not allowed to spy on Australians. But what if the NSA gave the PRISM tech and data feed to ASIO so ASIO could spy on Americans and answer any question the NSA asks (and vice versa). Now neither intelligence service has an 'illegal wiretap' on their own citizens. They…

Aaaaand BINGO!

http://www.itwire.com/it-policy-news/govenrment-tech-policy/...

Post reply on HN