NSA admits listening to U.S. phone calls without warrants • Hacker News Board

Re: NSA admits listening to U.S. phone calls without warrants

#61

Post by burntsushi » Sun, Jun 16, 2013, 12:56 AM UTC

tptacek wrote: post #36

eightyone wrote: post #33

Earlier quoted context omitted.

"and the Guardian walked the claim back" No they didn't. "The Guardian has not revised any of our articles and, to my knowledge, has no intention to do so. That's because we did not claim that the NSA document alleging direct collection from the servers was true; we reported - accurately - that the NSA document claims that the program allows direct collection from the companies' servers. Before publishing, we went to…

I'm not interested in the semantic argument. Emily Bazelon called The Guardian out this week on the Slate political podcast, as have many others; this is now a mainstream criticism of how The Guardian reported the story. Either way: the original notion that NSA had direct access to the servers that actually operate Google Mail has been found to be unsupported by the evidence published thus far. I call this out contin…

> most of the people commenting on the NSA story on HN say things that make it clear that they believe NSA continues to have the direct access to Google's systems

You're mincing words. Your comments clearly indicate that you think "direct access" unambiguously means "access to servers that run GMail that the NSA can snoop on any time they like." But from what I've seen, most comments on HN adopt and acknowledge a more ambiguous definition.

The one you propose is the extreme. But other definitions include an interface for the NSA to request data and have it deposited in some "drop box" that can then be accessed by the NSA (all without a warrant). It's reasonable to call this "direct access", particularly if the audience is not tech savvy. (Which is something we don't know.)

Moreover, most folks here seem painfully aware that "direct access" really hasn't been qualified. It seems reasonable your definition isn't really true, but that doesn't mean the Guardian's reporting is incorrect. (The Guardian never put forward a precise definition---either because they didn't have one or were unwilling to release it.)

Personally, I think you are attributing way too much certainty to the HN crowd.

Re: NSA admits listening to U.S. phone calls without warrants

#62

Post by st0p » Sun, Jun 16, 2013, 12:56 AM UTC

tptacek wrote: post #36

eightyone wrote: post #33

Earlier quoted context omitted.

"and the Guardian walked the claim back" No they didn't. "The Guardian has not revised any of our articles and, to my knowledge, has no intention to do so. That's because we did not claim that the NSA document alleging direct collection from the servers was true; we reported - accurately - that the NSA document claims that the program allows direct collection from the companies' servers. Before publishing, we went to…

I'm not interested in the semantic argument. Emily Bazelon called The Guardian out this week on the Slate political podcast, as have many others; this is now a mainstream criticism of how The Guardian reported the story. Either way: the original notion that NSA had direct access to the servers that actually operate Google Mail has been found to be unsupported by the evidence published thus far. I call this out contin…

So what? The NSA is harvesting data on an unprecedented scale. It might be legal but it is definitly unethical.

Whether the initial reports were 100% accurate or not is irrelevant. What does matter is that this now out in the open and hopefully something changes.

Re: NSA admits listening to U.S. phone calls without warrants

#63

Post by tptacek » Sun, Jun 16, 2013, 12:56 AM UTC

revelation wrote: post #55

tptacek wrote: post #36

Earlier quoted context omitted.

I'm not interested in the semantic argument. Emily Bazelon called The Guardian out this week on the Slate political podcast, as have many others; this is now a mainstream criticism of how The Guardian reported the story. Either way: the original notion that NSA had direct access to the servers that actually operate Google Mail has been found to be unsupported by the evidence published thus far. I call this out contin…

For not being interested in "the semantic argument", you have previously shown lots of confidence in the Governments secret semantic interpretation. No evidence has been published, and who is talking about Google Mail anyway?

I'm not interested in the semantic argument about whether publishing a story that contradicts a previous story without issuing a correction on that previous story counts or does not count as a "walk back", that term having no specific technical meaning the argument can rely on.

I'm not averse to all semantic arguments.

Re: NSA admits listening to U.S. phone calls without warrants

#64

Post by jlgreco » Sun, Jun 16, 2013, 12:58 AM UTC

nknighthb wrote: post #35

jlgreco wrote: post #24

Earlier quoted context omitted.

As one extreme left-wing nut to another, let me suggest that you enter the word "partisan" in the search box below, sort by date, then start clicking back through the past few days.

Having now done so, I think your definition of "shrill" and mine are entirely unrelated, as are our definitions of the word "all". I see annoyance with some clearly partisan statements and actions. I see people talking about the pathetic, even laughably bad polls done on the subject, and badly misinterpreting the statistics. And, of course, there's the idiot who decided that if half of Democrats support an action, th…

I suppose you are more charitable than I am.

Re: NSA admits listening to U.S. phone calls without warrants

#65

Post by gojomo » Sun, Jun 16, 2013, 12:59 AM UTC

tptacek wrote: post #58

gojomo wrote: post #52

Earlier quoted context omitted.

Is the relay of mail between, say, Yahoo and Gmail using strong crypto? (I'm curious; I thought not but I haven't been keeping up on bulk email interchange practices.)

I believe so, yes.

I can't find a reference and until recently would have assumed it was unencrypted SMTP like the olden days.

What gives you that belief, and if it's TLS-secured, would you assume it has the same forward-security as (eg) Chrome-to-Gmail? Or might it be something else, because it happens out of sight, that is a little behind-the-times?

Re: NSA admits listening to U.S. phone calls without warrants

#66

Post by tptacek » Sun, Jun 16, 2013, 1:00 AM UTC

burntsushi wrote: post #61

tptacek wrote: post #36

Earlier quoted context omitted.

I'm not interested in the semantic argument. Emily Bazelon called The Guardian out this week on the Slate political podcast, as have many others; this is now a mainstream criticism of how The Guardian reported the story. Either way: the original notion that NSA had direct access to the servers that actually operate Google Mail has been found to be unsupported by the evidence published thus far. I call this out contin…

> most of the people commenting on the NSA story on HN say things that make it clear that they believe NSA continues to have the direct access to Google's systems You're mincing words. Your comments clearly indicate that you think "direct access" unambiguously means "access to servers that run GMail that the NSA can snoop on any time they like." But from what I've seen, most comments on HN adopt and acknowledge a mor…

The process as I understand it:

* NSA (or some other USG agency) issues a directive to the provider under authorization from FISA. No court order is required for NSA to issue directives under FISA.

* If the provider is Google, Yahoo, or Facebook†, that directive is reviewed manually by the provider.

* In at least the case of Yahoo, where this step is supported by court documents, but probably all the other cases too based on provider public statements, the provider has the option of refusing to comply with the directive, at which point they send lawyers to FISC.

* For all intents and purposes USG never loses at FISC.

* Some process happens at the provider in which data pertaining to the directive is collected, marshalled into some kind of bundle, and placed on a secure drop box server ("similar to an FTP server"); it is NSA's access to these servers that "PRISM" refers to.

If you're telling me that this is the understanding most HN people have about what "direct access" means, I'd direct your attention to this very thread to rebut that argument. I'm accused upthread of "mincing words" but would respond by arguing that any attempt to characterize the process in this post as "direct access" is a much finer mince; a brunoise of words, if you will.

† Because those providers have publicly stated that.

Re: NSA admits listening to U.S. phone calls without warrants

#67

Post by paulsutter » Sun, Jun 16, 2013, 1:00 AM UTC

tptacek wrote: post #53

paulsutter wrote: post #47

Earlier quoted context omitted.

First, most SMTP travels without encryption. Second, it's unfathomable to me to imagine the NSA isn't doing their damnedest to obtain all private keys. I have no idea how many they do have, but it seems foolish to assume they don't have a specific private key. Why do you think the NSA would regard private keys as some kind of sacred ground? For example, they could go after it the same way the Chinese do - phishing at…

Most SMTP does, but does most SMTP that originates or terminates at Google Mail? I don't think so. (Here it's worth noting that mail between Google Mail users doesn't ever hit the public Internet in plaintext SMTP). I do not think it's unfathomable that NSA has Google Mail's public key. I do think it's unfathomable that, having illicitly obtained that key, their possession of it wouldn't be one of the most closely gu…

What percentage of email stays within gmail?

Main point - I'd be willing to bet that the NSA collects as many private keys as it can. Can't prove it, don't need to. I'll conduct myself as if they have all the private keys. That's a loss of freedom, and that's not what the authors of the fourth amendment intended.

Re: NSA admits listening to U.S. phone calls without warrants

#68

Post by chacham15 » Sun, Jun 16, 2013, 1:01 AM UTC

tptacek wrote: post #53

paulsutter wrote: post #47

Earlier quoted context omitted.

First, most SMTP travels without encryption. Second, it's unfathomable to me to imagine the NSA isn't doing their damnedest to obtain all private keys. I have no idea how many they do have, but it seems foolish to assume they don't have a specific private key. Why do you think the NSA would regard private keys as some kind of sacred ground? For example, they could go after it the same way the Chinese do - phishing at…

Most SMTP does, but does most SMTP that originates or terminates at Google Mail? I don't think so. (Here it's worth noting that mail between Google Mail users doesn't ever hit the public Internet in plaintext SMTP). I do not think it's unfathomable that NSA has Google Mail's public key. I do think it's unfathomable that, having illicitly obtained that key, their possession of it wouldn't be one of the most closely gu…

See my update: https://news.ycombinator.com/item?id=5886826

Re: NSA admits listening to U.S. phone calls without warrants

#69

Post by rickhanlonii » Sun, Jun 16, 2013, 1:02 AM UTC

tptacek wrote: post #36

eightyone wrote: post #33

Earlier quoted context omitted.

"and the Guardian walked the claim back" No they didn't. "The Guardian has not revised any of our articles and, to my knowledge, has no intention to do so. That's because we did not claim that the NSA document alleging direct collection from the servers was true; we reported - accurately - that the NSA document claims that the program allows direct collection from the companies' servers. Before publishing, we went to…

I'm not interested in the semantic argument. Emily Bazelon called The Guardian out this week on the Slate political podcast, as have many others; this is now a mainstream criticism of how The Guardian reported the story. Either way: the original notion that NSA had direct access to the servers that actually operate Google Mail has been found to be unsupported by the evidence published thus far. I call this out contin…

You may not be interested in a semantic argument, but it's a semantic point you're arguing. The title of the article in question[1] is:

"NSA Prism program taps in to user data of Apple, Google and others • Top-secret Prism program claims direct access to servers of firms including Google, Apple and Facebook • Companies deny any knowledge of program in operation since 2007"

The first sentence states:

"The National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants, according to a top secret document obtained by the Guardian."

Emphasis on according to a top secret document obtained by the Guardian. If you read on, the content of the article supports this title and summary. It doesn't matter what Emily Bazelon has said, it don't matter what others have said, and it certainly doesn't matter what the mainstream criticism is when determining whether or not the statements in the article are accurate. The slides say the NSA can "collect data directly from the servers" of these companies. Guardian states the the slides state that the NSA can collect data directly from the servers of these companies.

That is a demonstrable fact. In fact, I just demonstrated it.

Now, I'm in the camp of people who think that whoever wrote the slides just didn't know what they were talking about. Neverthess, I'm also in the camp of people who think that the Guardian was accurate in their reporting--because the reporting is right there to be read.

We could, of course, argue over the congruace between the phrases "direct access" and "collect data directly from the servers," but you said you weren't interested in semantics.

[1]: http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n...

Re: NSA admits listening to U.S. phone calls without warrants

#70

Post by stfu » Sun, Jun 16, 2013, 1:02 AM UTC

tptacek wrote: post #12

So that's not good. You can see how that could be happening; NSA has trunk-level access to telephony circuits. Telcos are engaged in a long-running game of footsie with the government that makes billion dollar Internet companies look like anarcho-capitalists. But I'm not seeing how we get from there to the contents of email. To have the email of arbitrary Americans without a warrant, the NSA would need direct access…

So far fact is that the NSA denied listening to U.S. phone calls without warrants.

Now we know that the Obama administration and NSA intentionally lied and mislead the public. I am certain that with a little bit of luck we will find out how NSA email hacking works in practice. So far the smoke seems long from settling.

Based on how the Obama administration and NSA is handling this issue I see very little reason to expect anything else than the maximum level of intrusiveness possible.