Why is Snowden a traitor but Nadler not? Did Nadler not just go to the press with information that was part of a secret NSA briefing?
NSA admits listening to U.S. phone calls without warrants
31–40 of 407 posts
Re: NSA admits listening to U.S. phone calls without warrants
#32So that's not good. You can see how that could be happening; NSA has trunk-level access to telephony circuits. Telcos are engaged in a long-running game of footsie with the government that makes billion dollar Internet companies look like anarcho-capitalists. But I'm not seeing how we get from there to the contents of email. To have the email of arbitrary Americans without a warrant, the NSA would need direct access…
I think that the (theoretical) MITM attack is played out not between the user and google, but google and the other email provider. For example, a person on gmail sending mail to a yahoo account could be comprimised when google talks to yahoo. EDIT: Yahoo does NOT use TLS SMTP[1]. Also, Gmail fails Cert verification...[1] [1] http://www.checktls.com/perl/TestReceiver.pl
Google uses TLS SMTP.
Later
Nice catch. I based the Yahoo thing off message board posts with people getting TLS SMTP working, but from their mail clients, not server-to-server.
The Google Mail certificates don't validate because their hostname doesn't exactly match the host for which the certificate was issued ("mx.google.com"). I don't think that's a huge problem in practice.
Re: NSA admits listening to U.S. phone calls without warrants
#33So that's not good. You can see how that could be happening; NSA has trunk-level access to telephony circuits. Telcos are engaged in a long-running game of footsie with the government that makes billion dollar Internet companies look like anarcho-capitalists. But I'm not seeing how we get from there to the contents of email. To have the email of arbitrary Americans without a warrant, the NSA would need direct access…
"and the Guardian walked the claim back"
No they didn't.
"The Guardian has not revised any of our articles and, to my knowledge, has no intention to do so. That's because we did not claim that the NSA document alleging direct collection from the servers was true; we reported - accurately - that the NSA document claims that the program allows direct collection from the companies' servers. Before publishing, we went to the internet companies named in the documents and asked about these claims. When they denied it, we purposely presented the story as one of a major discrepancy between what the NSA document claims and what the internet companies claim, as the headline itself makes indisputably clear:"
http://www.guardian.co.uk/commentisfree/2013/jun/14/nsa-part...
Re: NSA admits listening to U.S. phone calls without warrants
#34Earlier quoted context omitted.
> the NSA would need direct access to the servers that run Google Mail. They do not have that access; Google has categorically denied it, and the Guardian walked the claim back. Also, I don't necessarily buy this. I don't think Google's denials are lies, as Google is not a single brain, but thousands of individuals. Hard to prove a negative.
You think it's possible that NSA got direct access to Google's servers in a way that was invisible to Google's CEO, it's general counsel, its Chief Architect, Justin Schuh of their security team, and any of their thousands of employees, most of whom would immediately report such a thing if they discovered it? Moreover, having obtained this illicit access, in direct defiance of the corporation that owns and controls t…
Not invisible, no. (Please don't strawman.)
I think that some of those people have knowledge of a secret program that enables access to the data (maybe without direct access to the servers that house it). That would make it easier to manage without having to bring all the SREs and such into the conspiracy.
I think that most of those people would not allow their lives to be destroyed with federal charges (or maybe even extralegal harassment, who knows - they do run secret prisons) in the process of reporting such a thing.
Tens of thousands of others have chosen to keep quiet about NSA's extralegal collection practices (from the contractors at the IXes installing beam splitters, to the mechanics who welded the fiber grabber arm onto the nuclear sub). Why is it such a stretch to think that 3 or 5 or 10 at Google wouldn't?
It's not even a stretch to think that NSA would have done their homework to know _which_ people inside of Google would be both able to participate and could be coerced into keeping quiet.
Re: NSA admits listening to U.S. phone calls without warrants
#35Earlier quoted context omitted.
As an extreme left-wing Democrat who opposes any attempt by government to acquire non-public information without a warrant, I must ask, what "shrill cries" are those?
As one extreme left-wing nut to another, let me suggest that you enter the word "partisan" in the search box below, sort by date, then start clicking back through the past few days.
Having now done so, I think your definition of "shrill" and mine are entirely unrelated, as are our definitions of the word "all".
I see annoyance with some clearly partisan statements and actions. I see people talking about the pathetic, even laughably bad polls done on the subject, and badly misinterpreting the statistics. And, of course, there's the idiot who decided that if half of Democrats support an action, that must mean all Democrats are mindless Obama supporters.
But I see no one suggesting that all outrage about this is partisan, much less shrilly.
Re: NSA admits listening to U.S. phone calls without warrants
#36So that's not good. You can see how that could be happening; NSA has trunk-level access to telephony circuits. Telcos are engaged in a long-running game of footsie with the government that makes billion dollar Internet companies look like anarcho-capitalists. But I'm not seeing how we get from there to the contents of email. To have the email of arbitrary Americans without a warrant, the NSA would need direct access…
"and the Guardian walked the claim back" No they didn't. "The Guardian has not revised any of our articles and, to my knowledge, has no intention to do so. That's because we did not claim that the NSA document alleging direct collection from the servers was true; we reported - accurately - that the NSA document claims that the program allows direct collection from the companies' servers. Before publishing, we went to…
I'm not interested in the semantic argument. Emily Bazelon called The Guardian out this week on the Slate political podcast, as have many others; this is now a mainstream criticism of how The Guardian reported the story.
Either way: the original notion that NSA had direct access to the servers that actually operate Google Mail has been found to be unsupported by the evidence published thus far.
I call this out continuously and obnoxiously on HN because it is very much not the mainstream view on HN; most of the people commenting on the NSA story on HN say things that make it clear that they believe NSA continues to have the direct access to Google's systems that Google and the Guardian say they do not have.
Re: NSA admits listening to U.S. phone calls without warrants
#37So that's not good. You can see how that could be happening; NSA has trunk-level access to telephony circuits. Telcos are engaged in a long-running game of footsie with the government that makes billion dollar Internet companies look like anarcho-capitalists. But I'm not seeing how we get from there to the contents of email. To have the email of arbitrary Americans without a warrant, the NSA would need direct access…
Well, Larry Page says "... we provide user data to governments only in accordance with the law" If the law is that the NSA just has to request it, no warrant necessary, there you go.
The Electronic Communications Privacy Act says all email stored on a server that is older than 180 days is not protected under the 4th Amendment.
Furthermore, the IRS appears to operate under the assumption that no email is protected.
> New documents released to the ACLU under the Freedom of Information Act reveal that the IRS Criminal Tax Division has long taken the position that the IRS can read your emails without a warrant—a practice that one appeals court has said violates the Fourth Amendment (and we think most Americans would agree).
http://www.aclu.org/blog/technology-and-liberty-national-sec...
Re: NSA admits listening to U.S. phone calls without warrants
#38Why is Snowden a traitor but Nadler not? Did Nadler not just go to the press with information that was part of a secret NSA briefing?
I'm also quite curious about this. The article doesn't even seem to acknowledge the fact that Nadler disclosed supposedly classified information. The only thing I can surmise is that a "classified briefing" may contain unclassified information:
Rep. Nadler's disclosure that NSA analysts can listen to calls without
court orders came during a House Judiciary hearing on Thursday that included
FBI director Robert Mueller as a witness.
Mueller initially sought to downplay concerns about NSA surveillance by
claiming that, to listen to a phone call, the government would need to seek "a
special, a particularized order from the FISA court directed at that particular
phone of that particular individual."
Is information about that procedure "classified in any way?" Nadler asked.
"I don't think so," Mueller replied.
"Then I can say the following," Nadler said. "We heard precisely the
opposite at the briefing the other day. We heard precisely that you could get
the specific information from that telephone simply based on an analyst
deciding that...In other words, what you just said is incorrect. So there's a
conflict."Re: NSA admits listening to U.S. phone calls without warrants
#39Earlier quoted context omitted.
A copy of Google's SSL private keys, provided they don't use cipher modes that provide forward secrecy, would suffice if they'd already tapped all the transit fibers (though not gmail-to-gmail).
A copy of Google's private keys would be a more outrageous and damning discovery than NSA somehow having direct access to Google's servers. NSA doesn't have Google's private key.
You keep confidently asserting that, but many of the exact same compartmentalization and security procedures which protect the private keymatter also make a secret private key disclosure easier to keep hidden.
How would we know otherwise?
As you note, that "would be a more outrageous and damning discovery" - so there's more incentive to keep it closely held. It would help the NSA do what it feels it must, simply by using its other network taps. And, it would help minimize the risk of discovery without involving extra employees and ongoing connections, all while retaining the ability for Page/Drummond/etc to deny involvement.
Those add up to making a key compromise more attractive for NSA and Google than the alternatives.
Re: NSA admits listening to U.S. phone calls without warrants
#40So that's not good. You can see how that could be happening; NSA has trunk-level access to telephony circuits. Telcos are engaged in a long-running game of footsie with the government that makes billion dollar Internet companies look like anarcho-capitalists. But I'm not seeing how we get from there to the contents of email. To have the email of arbitrary Americans without a warrant, the NSA would need direct access…
If it's true, 'not good' is a very understated way of putting it. On the other hand, if there's anything this whole clusterfuck has reiterated is that it's best to be wary of uncorroborated, single-source statements. So far, the only source for this appears to be Congressman Jerrold Nadler.