AT&T Helped N.S.A. Spy on an Array of Internet Traffic

http://www.nytimes.com/2015/08/16/us/politics/att-helped-nsa-spy-on-an-array-of-internet-traffic.html?hp&action=click&pgtype=Homepage&module=first-column-region&region=top-news&WT.nav=top-news&_r=0

by tchalla • 11 years ago

568 109 11 years ago

nytimes.com

comrade15• 11 years ago

Hopefully companies and organizations like the UN start moving away from AT&T. AT&T is a publicly traded company and so the only thing they understand is profit and loss.

The snowden releases cost u.s. tech companies $100B+, including a 10% drop in Cisco quarterly revenues. Hopefully this continues as multinationals continue to move their business outside the u.s.

Let the u.s. government spy on Americans all they want since Americans seem to like being spied on, while the rest of us move on. I know that mindset doesn't match many of the people here on HN, but Americans are mostly Authoritarian and seem to like the comfort they feel from programs like this.

ianlevesque• 11 years ago

People just don't pay attention at all. I'm not sure which is worse.

jonknee• 11 years ago

It's very hard to move away from telecom companies. You may switch your direct services, but whoever you switch to will still use AT&T backbones and the like. All the big telecoms are guilty of being complicit with the government, what would make a difference is one taking a stand like Apple/Google has regarding encryption. That would put pressure on the others to follow suit.

toomuchtodo2• 11 years ago

Could Google, Facebook, Amazon, and Apple create a non-profit that owns their own dark fiber and parcels out capacity?

Think municipal fiber, but at a wholesale level.

fastandfurryous5• 11 years ago

Google and Apple are still subject to the same pressures applied by warrants, subpeonas and national security letters.

I'm not really sure what you mean by encryption, though. Apple's iMessage may be encrypted, but their key exchange can be MitM'd easily.

Realistically you wouldn't use a service that exists because of the profit motive or is in the US. It will continue to operate to drive a profit while working with the government to stay in business.

CyberDildonics• 11 years ago

There is no sense in trying to bend all the middle men to our will. The problem is broadcasting anything in the clear. Being able to effectively encrypt data at the IP level is what really needs to happen.

mercurial• 11 years ago

Who are these lucky "rest of us" fellows who have both advanced technical infrastructure and no government spying? They don't live in the EU, Russia, and I guess most of Asia.

johncolanduoni4• 11 years ago

Let the u.s. government spy on Americans all they want since Americans seem to like being spied on, while the rest of us move on. I know that mindset doesn't match many of the people here on HN, but Americans are mostly Authoritarian and seem to like the comfort they feel from programs like this.

What exactly is your source on this? If we're going to stick with anecdotal evidence, I (who actually live in the US) have found most people's reaction to the Snowden revelations to be overwhelmingly negative, particularly among younger people.

If we want to look at some actual data, instead of accusations about public opinion by someone who doesn't even live in the US, it appears that a majority of Americans don't approve of the NSA's actions[1]. On top of that, companies like Apple, Facebook, etc. have been implementing end to end encryption so thoroughly that the government is pushing to make it illegal[2].

So I'd thank you to not decide that all Americans like to be spied on, or that we're mostly authoritarian, just because it fits your ideology.

[1] http://www.pewresearch.org/fact-tank/2015/05/29/what-america... [2]: http://www.npr.org/sections/thetwo-way/2015/07/08/421251662/...

comrade15• 11 years ago

First, I'm American. I've worked on NSA and DoD projects, and I've worked for PGP. I now live in Switzerland.

You only have to look at the consequences of the Snowden revelations. Nothing has really changed - some meaningless legislation was passed that moves the phone metadata recording to the phone companies from the NSA, but even then it's not clear that its stopped - the NSA data center in Utah where those conversations were recorded doesn't seem to be shutting down. I would bet the phone conversation, skype conversation, etc recording is still going on since it was never explicitly addressed anywhere in legislation.

And my comment about Americans being Authoritarian is nothing new - they've long considered to be Authoritarian.

fnordfnordfnord6• 11 years ago

I live in the US too, and as far as I can tell most people are barely aware of anything to do with Snowden. Of those that are, many have a negative opinion and a very unsympathetic attitude towards privacy or civil rights.

FlaceBook• 11 years ago

I know that mindset doesn't match many of the people here on HN

Right, the people here on HN only support spying when they are the ones doing it to users for "ad targeting" purposes.

white-flame2• 11 years ago

I wonder what percentage of YC ventures have their revenue model based on advertising prospects.

Zigurd2• 11 years ago

It's all hostile territory. While it's rational to punish quislings, it's irrational to think anyone handling a large amount of communications isn't a quisling. Certainly nobody is making claims that they are working to secure your data against state surveillance.

It's also long past time when providers like Google, Microsoft, Yahoo, etc. could have been offering secure communications and storage. At some point you have to suspect they are in with the surveillance state as much as the telcos are.

mtgx2• 11 years ago

After the Snowden revelations I believe AT&T was stopped from expanding in Europe. Mexico seems to welcome them on the other hand...

happyscrappy• 11 years ago

This is a standard trope, but it requires that you be willfully ignorant that 1) all western countries are sharing intel 2) the US does most of its spying on foreign countries 3) there is no European politician that has even tried to run on an anti US platform. I wonder why?

danso• 11 years ago

Worth reading: ProPublica (who co-published with NYT on this story) has an explainer of how they followed the trail of documents to break this story:

https://www.propublica.org/article/a-trail-of-evidence-leadi...

evook3• 11 years ago

Cases like this reinforce my opinion, that there is an increasing demand to educate consumers how to prevent getting data leaked to government institutions like intelligence services. Especially the consequences of picking the wrong service provider.

Luckily I am now in a position where I am fully responsible and aware of the routes my data takes. Yet we as a B2B ISP constantly get requests by intelligence services to provide information regarding our customers. Strangely they always assume that's totally okay to -just- ask for the data, instead of going the formal way. If we demand the judicial permissions they always rant about emergencies and so on. We can't help but follow the law, and the law disallows us to keep specific data for more than 60 days. I am really curious about how many ISPs voluntarily provide their customer data without asking for judicial permission beforehand.

Such conversations are coming around 2 or 3 times a week.

stingraycharles• 11 years ago

It could just be a technique to convince you it's perfectly normal to give up the data. I wouldn't be surprised if many people would fall for such a thing.

evook3• 11 years ago

That is of course possibe. I highly think that most companies fall for it. If you speak with someone of a state agency, you always feel like they are used to get it. Some of them are actually surprised and openly disappointed when you refuse to hand over.

What wonders me the most is, that most of the time they won't go down the legal way. Instead they just seem to do their job without the data as well afterwards. So what was the point in requesting the data in the beginning?

eli2• 11 years ago

To be fair, if I were investigating a crime I would start by just asking companies to give me information informally, even if most say no.

bediger40004• 11 years ago

Why? If you were investigating a crime, you're in law enforcement. Officers of the law have an ethical duty to obey the law, perhaps a stronger duty than those of us who are not sworn to uphold the Constitution or some other higher document. Law enforcement officers also have better knowledge of the law and what it requres of both officers and people/businesses with data.

If I were part of a business, I would be obliged to follow the laws about giving away data, so I would find out exactly what my legal obligation is, and follow that as best I could. If that means asking for a warrant, I would politely, but firmly ask for one.

I'm thinking of getting one of those doormats that say "GET A WARRANT", personally.

facetube4• 11 years ago

Out of curiosity, how about if you were investigating potential crime, or tasked with crime prevention? In other words, crimes that you believe are being planned and may happen in the future, based on some non-individualized correlation (e.g. past shootings in a particularly problematic neighborhood). Would this change your approach?

harry82• 11 years ago

To be fair, if I were (a public servant) involved in organised crime I would start by just asking companies to give me the information informally, even if most say no.

Animats2• 11 years ago

There's one cellular provider which has the obligation under CALEA to do wiretaps. They comply with the law strictly, which annoys the FBI.

First, CALEA requires that the company provide a "senior official" as a point of access for law enforcement, and a backup 24/7 contact. Their senior official is their general counsel, and the backup is another lawyer. It's not their network operations center. Their general counsel wants to see a warrant, and checks back with the court to make sure it's valid. This is the way to do it; bring in Legal.

There's a procedure for "emergency requests" in advance of a warrant under CALEA. This telco immediately faxes the law enforcement requester a brief form to fill in for those. It requires name, police department, office address, badge number, and a brief explanation of why there's no warrant yet. The form to be signed by the law enforcement official contains a statement that the official will provide a warrant within 48 hours, and in the event that they fail to do so, their department will take full responsibility for their actions, including indemnifying the telco against any costs and damages. That's followed by a statement that in the event the law enforcement organization fails to authorize the actions of their official, the official will be personally responsible for said costs. The telco also reserves the right to disclose requests for which a court order does not follow.

This discourages fake "emergency" requests. Get your legal people to draft something like that. The key to this is that law enforcement's interface to your company should go through your legal department.

(I used to have a link for this, including their forms, but can't find it now. Can anyone else find it? )

evook3• 11 years ago

I am very interested in these forms and would be grateful if someone could provide a link to them. If they're watertight, we could probably reduce some overhead with them. Although I dislike the idea of using an employee as an "responsibility-shield" for failing government agencies.

Animats2• 11 years ago

Here's Comcast's form for emergencies.[1] It ends with

"If Comcast makes an emergency disclosure to your law enforcement agency or governmental entity pursuant to 18 U.S.C. § 2702(b) or § 2702(c), you agree to provide Comcast with a formal order to provide your agency with the information provided pursuant to this request within 72 hours. I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct."

The law enforcement rep has to sign that. This discourages bogus requests.

Each carrier has their own form. Collect those up and show them to your legal people.

More info: an ACLU copy of some guidance for law enforcement on CALEA. [2] Note that DOJ says different carriers have different requirements; some require a court order, and some don't.

More info: Sprint's form.[3] Another "under penalty of perjury" requirement, plus "Pursuant to Title 18 United States Code §2518, §2701, and §3125 all electronic surveillance assistance will terminate if the appropriate legal demand or customer consent is not received within 48 hours."

More info: MetroPCS's policy.[4] "At a minimum, requests for interceptions citing Exigent Circumstances must include: ... a statement that no warrant or court order is required by law. ... a statement that all statutory requirements have been met. ... the signature of EITHER (i) the Attorney General of the United States, OR (ii) a law enforcement officer specially designated by the Attorney General, the Deputy Attorney General, the Associate Attorney General, or by the principal prosecuting attorney of any state or subdivision thereof."

It looks like industry practice other than for AT&T is to impose reasonably strict standards on confirming such requests.

[1] http://www.comcast.com/~/Media/403EEED5AE6F46118DDBC5F8BC436... [2] https://www.aclu.org/files/cellphonetracking/20120328/celltr... [3] http://al911board.com/sites/default/files/Sprint%20-%20Nexte... [4] https://info.publicintelligence.net/metropcscalea.pdf

PhantomGremlin• 11 years ago

This is the way to do it; bring in Legal.

The big problem with that is cost.

If it's a giant telecom they are already paying in-house lawyers. If it's a smallish ISP then this costs them big bucks to keep outside counsel on retainer. Maybe they can work with their law firm and cut a deal?

This stuff is pretty much boilerplate, so maybe a paralegal can do most of the work and then get it blessed by a J.D.?

mtgx2• 11 years ago

It helps that carriers now have immunity so they can do whatever the NSA asks of them without fear of any repercussions (another than stories like this one, but meh, everyone is going to think "it's not going to happen to us" at the time of doing the deed).

superuser2• 11 years ago

I think you conflating law enforcement/evidence-gathering surveillance (which the NSA does not give a rat's ass about) with national security/intelligence community spying. On all accounts the story is less dire for the former.

It is way more likely that your data is protected from the local police than from NSA/CIA.

aluhut• 11 years ago

I would set up an fake identity for the whole department to use and use that for all requests.

rdl• 11 years ago

It's a shame these conversations don't get published in realtime.

olympus2• 11 years ago

Is this really a surprise to anyone? We've known that the N.S.A. has gotten (or coerced) support from communications companies in the past, and AT&T in particular (the article mentions it going back as far as 2003 https://en.wikipedia.org/wiki/Room_641A).

Did anybody really think it stopped when the secret room was uncovered in 2006? Telecom companies make no promise that your traffic is protected. It's up to you to protect yourself.

comrade15• 11 years ago

Spying on the u.n. based on terrorism legislation is a revelation. Recording of all telephone conversations in the u.s. is a revelation. Recording of all emails, skype, sms, etc is a revelation.

Before discovery of that room everyone knew that there was close cooperation between the telecoms and the government, but we had no idea it was this close and we were shocked at especially the recording of all phone conversations in the u.s.

DanBC• 11 years ago

Even though we had pretty thorough proof of this with ECHELON? Including the EU parliamen report into echelon; and the stuff about the US using it to provide commercial advantage to their aerospace industry?

Risk assessment has always been part of security. And people have always said that you should probably assume a well funded government can and does read everything. This was more of an assumption, but the fact that governments do listen to everything should not have been a surprise.

a3n2• 11 years ago

I'm not surprised, but it still needs to be called out. The price of freedom from your government is eternal vigilance.

facetube4• 11 years ago

The NSA's giant database will be breached. It's only a matter of time. It could be state-sponsored (e.g. like the OPM theft), or it could be due to the NSA's own lack of internal security oversight. Maybe not this year, maybe not next. I certainly won't have anything to do with it. But it'll eventually happen. What then?

revelation2• 11 years ago

What makes you think they are not already breached?

By any available evidence, these guys can't even maintain a simple download counter on their wiki. A random IT contractor like Snowden was already gone for a month and they had no idea. I think they still have no clue what he has.

All the science fiction gives this very distorted picture when really the people working at the NSA are private-sector leftovers, and even if someone with half a brain slips into their ranks, a layer of ignorance and government inefficiency will promptly suffocate them. It's a good thing, their incompetence is our only protection.

knowaveragejoe• 11 years ago

Wow, if you really believe this, you've got another thing coming.

orthoganol• 11 years ago

Surveillance state is all about $$, it's an evolving industry where people have figured out how to make billions. I share the same doubts with OP here, they aren't as much of a Big Brother as they are just a bloated cash cow scraping by & keeping appearances. They aren't particularly competent primarily because they don't really care as much as we think they do.

Obviously it's still a terrible situation to setup this infrastructure given the potential for abuse, so I'm not defending it. I'm just saying I've been an American long enough to know $$ is at the heart of this, not control, and the $$ they're getting isn't dependent on how good of a job they do so don't expect a well oiled machined.

gscott• 11 years ago

Here is an article on security agencies using a private amazon cloud system built at the governments spying facility in Utah. http://www.nextgov.com/cloud-computing/2014/11/nsa-turns-clo.... So it is possible Amazon can secure it properly.

"NSA officials picked up on Google research in 2007 that ultimately paved the way for the intelligence agency’s formal adoption of cloud computing in 2010—part of a broad effort within the intelligence community to more effectively share data and services. In a similar move, the CIA last year signed a contract with Amazon Web Services for a cloud to be used by all 17 intelligence agencies."

a3n2• 11 years ago

The NSA's databases must be the Holy Grail for other governments and criminals.

I would hope (but do not expect) that the NSA or some other agency has a permanent penetration effort over those networks and databases, to discover vulnerabilities before others do. Because bygawd you know other governments and criminals must be so currently engaged.

Miner49er• 11 years ago

Could already be breached, and we would probably never know. It's not feasible for somebody to post all the info online like often happens in hacks, there's just too much data.

thembones• 11 years ago

Where have you all been?

http://archive.wired.com/science/discoveries/news/2006/05/70...

10 years old and not even close to the oldest evidence.

comrade15• 11 years ago

This was an interesting and early revelation, but it wasn't until the Snowden documents that we understood what this closet really meant. We had no idea the government was recording every phone conversation in the u.s., every email, etc... We still had some hope that the rule of law as being followed and that this closet was just a way to make targeted surveillance easier.

cma• 11 years ago

some hope that the rule of law as being followed

Wasn't it already ruled illegal prior to Snowden and the phone companies had to be retroactively indemnified by congress?

PopeOfNope• 11 years ago

but it wasn't until the Snowden documents that we understood what this closet really meant.
We had no idea the government was recording every phone conversation in the u.s.
We still had some hope that the rule of law as being followed

All lies. This was well covered on slashdot when it happened. We all knew exactly what it meant.

Snowden's release was iron clad and incontrovertible, which was refreshing, but it also detailed the extent to which private tech companies outside of AT&T were aiding the federal government in their illegal activities.

Even the most paranoid nutbag commenting on those old slashdot threads couldn't imagine how bad it was going to get. Reality outpaced the conspiracy theorists.

mirimir2• 11 years ago

It goes back hundreds of years! National intelligence agencies have consistently managed to get full intercepts. Way back in the day, they counterfeited wax seals and steamed open letters. In the 1800s, they got telegraph printouts. In the early 1900s, wires. In the 60s-70s, tapes. Then hard drives. It's just part of what governments do ;)

omegaham• 11 years ago

I think that the big difference today is that they can analyze all data that they can grab. Back in the Good Old Days, you had to devote considerable manpower to this analysis; if you wanted to read letters, you had to be specific because you simply didn't have the resources to look at everyone's mail. This is why most people (including me) have no problem with the idea of monitoring POTS lines; it ties up a considerable amount of resources, so the police are much more likely only to tap the phones they think will get results.

Now, we've gotten to the point where the challenges facing mass surveillance are political rather than physical. I think that this is a lot more dangerous than 1800s police looking at telegraph printouts line by line.

rwhendrix• 11 years ago

It's interesting that they released this report on a Saturday, when markets are closed.

Istof• 11 years ago

let's keep it on the front page until Monday

nickysielicki• 11 years ago

What we really need is less centralization and more communities able to invest in 21st century infrastructure. We might be too far gone, though.

Take this for example: I am a student at the University of Wisconsin. There's a nonprofit/cooperative in Wisconsin called wiscnet [1]. They provide(d) libraries and schools with Internet. A Wisconsin telecom association (mostly backed by AT&T) was able to use their lobby to push it out. Millions in infrastructure made useless because it was argued to be anticompetitive.

The story is told much better by Ars. [2]

[1] http://wiscnet.net/

[2] http://arstechnica.com/tech-policy/2011/06/wisconsin-public-...

mrbill• 11 years ago

I think a lot of states have (if not active, legacy) Internet backbones where schools and such had connectivity back in the day before the "general public".

Oklahoma's is "OneNet"[1], and we had a T1 at usao.edu back in '93 [2].

[1] https://onenet.net/

[2] I set up the very first USAO web site as a summer Independent Study project in '95, running a web server on our VAX 4700. People told me "You have to have a Sun box to run a web server!" and I proved them wrong. It was a fun 9-week gig, because the actual work only took me a couple of weeks, including creating a HTML version of the Student Handbook. Bits of the site I created persisted for almost a decade.

kfcm• 11 years ago

Geez, what a yawner. This has been either assumed or an open secret for decades.

known• 11 years ago

Cuckoo's nest?

RexRollman• 11 years ago

It must be so nice for AT&T; making money twice on the same customer.

niteskunk• 11 years ago

My favorite part of this was the not 1 but /3/ AT&T U-verse advertisements embedded in the mobile page.

"Gee guys, any idea why our conversion rates are so low?"

eternalban• 11 years ago

"news": The "Alphabet" companies help one another.

white-flame2• 11 years ago

At the same time, the government has been fighting in court to keep the identities of its telecom partners hidden.

And because of that, we can trust nobody, and work to encrypt everything at the most fundamental layers we have access to. Good for individual privacy, but you can't help but note that the NSA continues to shoot itself in the foot in pursuing its goals.

There has to be willful ignorance at the top of the food chain. They can't believe this stuff actually works, or is in any way actually related to national security. But it must be so, so they double-think themselves into believing it. Having met people at that level in other government branches, I can't see it as anything else.

ErikRogneby• 11 years ago

This should surprise no one. https://en.wikipedia.org/wiki/Room_641A

harry82• 11 years ago

You should also be unsuprised to have it pointed out that your surprise level is wholly is irrelevant and rather silly to mention. Murder is unsurprising and we don't ignore it. The "And this surprises you?" Meme response should always be "Adults are talking."

c3534l• 11 years ago

“We don’t comment on matters of national security”

Wow, they really think that's what they're doing, don't they? Nothing above and beyond here, right?

BTW, I was actually surveyed by AT&T on the phone when the news that they were doing this first broke over a decade ago.

louithethrid• 11 years ago

Could the actual physical infrastructure be decentralised? At least in Citys?

AT&T Helped N.S.A. Spy on an Array of Internet Traffic

Related Stories