XKeyscore: NSA program collects 'nearly everything a user does on the internet' • Hacker News Board

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#491

Post by burntsushi » Wed, Jul 31, 2013, 7:42 PM UTC

mrt0mat0 wrote: post #434

stordoff wrote: post #349

Earlier quoted context omitted.

My interpretation is that the NSA basically have two main forms of collection: data directly from fibre intercepts, and data obtained (via voluntary agreement, court order, or otherwise) from private companies. This slide [1] would certainly suggest such an arrangement. The fibre intercepts would fairly easily give access to HTTP traffic, and Facebook/Google/etc. would probably 'come online' at about the same time (t…

so if that's the case, then it would seem that facebook, google, etc. are still lying? or could this be more gag order stuff?

No it would not... At this point, it seems quite feasible that Facebook, Google, et al., are telling the truth at least in some respect. The point is that there are TWO different forms of data collection: PRISM and XKeyscore. PRISM happens via court order and is what we've heard about primarily up until today. XKeyscore is a separate program and does not require the compliance of Google, Facebook, et al. In fact, it doesn't even require their knowledge.

The key now is to see who exactly is letting the NSA tap their network hubs to sniff the entire Internet. These will be your Internet Service Providers...

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#492

Post by synctext » Wed, Jul 31, 2013, 7:43 PM UTC

neilk wrote: post #289

DigitalJack wrote: post #246

Earlier quoted context omitted.

I would think Silk Road provides enough incentive that if the government could defeat tor hidden services, they would have busted Silk Road.

Absolutely not. The government is not one unitary piece. The NSA is not the ATF is not the FBI. These capabilities were likely kept secret from other governmental agencies as much as the public. Furthermore intelligence agencies are well aware that every action communicates information back to their adversaries. It's a no-brainer to let Silk Road exist if you think doing so gives you the edge on terrorism, or otherwi…

Silk Road is a few pennies and few gram transactions. [See the data here http://arxiv.org/abs/1207.7139] It would be foolish to expose their snooping capabilities for this, right? Wow, Tor is not considered safe... Amazing

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#493

Post by tedks » Wed, Jul 31, 2013, 7:44 PM UTC

Karunamon wrote: post #234

blueprint wrote: post #193

Earlier quoted context omitted.

> You can be completely correct and still be a crackpot. This is very important. What do you mean by "crackpot"?

It's not feasible for the average person to restrict their lives to the point that RMS does and advocates for. * Reading the web via email only * Using completely free software and hardware (which as far as I can tell, limits you to a very small subset of Linux on a single Chinese-made netbook) * Not carrying a cellphone * Not using any social networks. Stallman's principled stand is admirable, but untenable for most…

* RMS reads the web via email because he's traveling virtually all the time and rarely has Internet access. A batch-based system makes more sense for him. This isn't an ethical stance, and the fact you include it hits your credibility severely.

* The FSF uses computers other than Yeeloongs. The FSF also doesn't really care about free hardware. The Yeeloong has chips with non-free firmware burnt in, and the FSF doesn't care because that isn't software. It's the Free SOFTWARE Foundation, after all.

* Stallman is on a few social networks, notably identica @rms@identi.ca (possibly now defunct). He probably has a GNU Social endpoint.

I think you're conflating Stallman's willingness to be uncompromising in his own lifestyle with his calls for reform. Stallman is fairly intelligent and understands that not everyone can live like he does, but I suppose he feels the need to answer the question of "what should you do in the present beyond push for reform."

I also don't know what "entertainment" you're talking about. The FSF is against proprietary video game engines, but their mission pertains to software, not music/movies/etc.. They campaign against DRM because DRM requires non-free software to enforce.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#494

Post by ISL » Wed, Jul 31, 2013, 7:44 PM UTC

afterburner wrote: post #450

s_q_b wrote: post #414

Earlier quoted context omitted.

> The technical possibility isn't the new and staggering part, it's the profound lack of morality, respect for any ideal whatsoever, and compete apathy towards the oaths these people took to serve us. Again, I'll chime in as the resident apologist. The people working at Fort Meade are not evil. They truly believe they're doing a great service to the nation. They may be wrong, and they've certainly thrown privacy out…

I'm not American, so I'm wondering: was the public really actually behind the PATRIOT Act, or were they merely giving leeway in a time where everyone was supposed to go along? Or were you thinking that's the same thing? Same with the politicians; were they really for it, or simply incredibly afraid of the political suicide that would be the results of standing up against it? Because this was a time when people did no…

The public was behind doing something. Much of Congress didn't want to be seen as impeding something.

It was obvious from the length of the act alone that even Congressional staffers couldn't have read it carefully between the time of submission and the time it passed. Quite a few people that I knew were weakly opposed, but the sunset provisions may have made it more palatable.

It takes character to stand up and defend doing nothing when something "must be done".

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#495

Post by weinzierl » Wed, Jul 31, 2013, 7:45 PM UTC

talmand wrote: post #165

aspensmonster wrote: post #110

>How do I find a strong-selector for a known target? >How do I find a cell of terrorists that has no known connection to strong-selectors? >Answer: Look for anomalous events >E.g. Someone whose language is out of place for the region they are in >Someone who is using encryption >Someone searching the web for suspicious stuff Lovely. Suspicious stuff and encryption. But wait! There's more! >Show me all the VPN startup…

I'd like to know where they are keeping these "over 300 terrorists" that have been captured due to this program. How is one labeled a terrorist by this program I wonder?

>Someone whose language is out of place for the region they are in

Check (German browsing in English)

>Someone who is using encryption

Check (my PGP Key is on my website)

>Someone searching the web for suspicious stuff

Check (I'm a curious person, what did you expect?)

I guess I'm considered a terrorist nowadays.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#496

Post by junto » Wed, Jul 31, 2013, 7:45 PM UTC

jnbiche wrote: post #490

junto wrote: post #468

The map on page 6 is interesting. Server locations of note: Moscow, Russia Caracas, Venezuela Tripoli, Libya Hubei Province, China Burma Lagos, Nigeria Saudi Arabia Iran (and geograhically surrounding Iran) Ukraine Based on page 13, I wonder if Google have any servers at these locations? Oh, what a surprise: http://royal.pingdom.com/2008/04/11/map-of-all-google-data-c... Does that look familiar?

I'm very suspicious of Google's role in all this, but there's not much overlap in the list above and the map you refer to, outside of the normal population and business centers in Europe and the US. I didn't see any in Google data centers in Libya, Burma, Nigeria, Ukraine, Saudi Arabia, Iran, or even Venezuela (the only one in S. American looks like it's in Brazil). Based on a quick glance, the only overlap between t…

Sorry, I wasn't suggesting Google were complicit, but the NSA need to suck up search queries, so it makes sense to locate these NSA servers right next to local Google installations.

Again, page 13; a local Google Pakistan search query.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#497

Post by deveac » Wed, Jul 31, 2013, 7:48 PM UTC

afterburner wrote: post #450

s_q_b wrote: post #414

Earlier quoted context omitted.

> The technical possibility isn't the new and staggering part, it's the profound lack of morality, respect for any ideal whatsoever, and compete apathy towards the oaths these people took to serve us. Again, I'll chime in as the resident apologist. The people working at Fort Meade are not evil. They truly believe they're doing a great service to the nation. They may be wrong, and they've certainly thrown privacy out…

I'm not American, so I'm wondering: was the public really actually behind the PATRIOT Act, or were they merely giving leeway in a time where everyone was supposed to go along? Or were you thinking that's the same thing? Same with the politicians; were they really for it, or simply incredibly afraid of the political suicide that would be the results of standing up against it? Because this was a time when people did no…

For the most part, we as Americans didn't actually ever read the Patriot Act, and we didn't get to vote on it. Our representatives that we elected before we ever knew 9/11 would happen voted for it in a climate that made it politically suicidal to not vote for it.

To be clear, the "hawk" politicians (and let's be honest, -many on the left) believed in the legislation but also exploited the tragedy to ram it through and neutered the ability of the other side to have a reasoned debate.

Our population was attacked, angry, and for the most part followed the lead of politicians who said we needed these laws to fight the people that attacked us.

In the aftermath, the scrutiny on the part of the American people never materialized. You're basically witnessing the moment where the most scrutiny on these types of programs/laws has ever occurred since 9/11. Worth keeping in mind that many components of these surveillance programs also predate 9/11.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#498

Post by mrt0mat0 » Wed, Jul 31, 2013, 7:49 PM UTC

kudu wrote: post #213

yread wrote: post #12

This is brilliant, I love the screenshots: Foreignness factor: The person has stated that he is located outside the U.S. Human intelligence source indicates person is located outside the U.s. The person is a user of storage media seized outside the U.s. Foreign govt indicates that the person is located outside the U.s. Phone number country code indicates the person is located outside the U.s. Phone number is register…

The fact that they don't require a wiretap order or even a warrant to monitor foreign citizens is disturbing in itself and is based on a questionable internal interpretation of the law.

On cspan this morning, the phrased it as: a secret interpretation. the fact that those two words can even sit together hurts my head. How do you secretly interpret something one way, but openly interpret another way.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#499

Post by jasonkolb » Wed, Jul 31, 2013, 7:58 PM UTC

nikcub wrote: post #29

This is overwhelming. Even when you always hear the claims about we knew this was going on, somehow it is still shocking when you see it all laid out infront of you with screenshots and the capabilities described. I can see how they get HTTP information, since they would intercept at transit hubs - but how are they getting all Facebook private messages and Gmail? I was also looking for another unique ID that users ar…

What's really sickening is that you can tell that programmers or very technical people were involved at some level to design these systems which help people construct rubber-stamp plausible deniability. Whoever these people were knew full well that they were architecting systems that skirt the letter of the law if not outright flaunt it.

Somewhere there is an architectural diagram of these systems that describes how to make people check checkboxes before releasing information. CYA-oriented programming that has clearly driven the entire design of this thing.

Re: XKeyscore: NSA program collects 'nearly everything a user does on the internet'

#500

Post by jrochkind1 » Wed, Jul 31, 2013, 8:02 PM UTC

DigitalJack wrote: post #246

nwh wrote: post #49

Earlier quoted context omitted.

I wouldn't for a second bet on it. A hidden service has exactly the same issue as traffic that exits the network. The topography looks like this. httpd > tor node > tor node > tor node > rendezvous point With enough monitoring, the location of the web server (or other hidden service) can just be found out by bombing the hidden service with traffic and seeing what end point lights up with traffic. With fine enough mon…

I would think Silk Road provides enough incentive that if the government could defeat tor hidden services, they would have busted Silk Road.

No way. What you forget is that once they bust it -- then they've REVEALED that they have the capability to do that.

Once they've revealed that, then people take account of it, and it becomes harder for the NSA to monitor them.

Half of the signals intelligence game is keeping your capabilities secret, so you can keep monitoring the signals, rather than have your target change their game.

That is to say, if they can get into Silk Road, then they probably ARE already monitoring everything that happens on Silk Road, and they'd rather it stay UP so they can keep monitoring the people on it (being very careful never to reveal that they can monitor it), then bust it so the people go elsewhere.