'Everyone in US under virtual surveillance' - NSA whistleblower

http://rt.com/usa/news/surveillance-spying-e-mail-citizens-178/

by nhebb • 14 years ago

378 202 14 years ago

rt.com

rglover• 14 years ago

This can't possibly be a surprise.

joelrunyon2• 14 years ago

Certainly that can't make it acceptable.

alan_cx2• 14 years ago

Oh yes it it. US voters happily allow it. You allow it.

The problem is your government, whether Rep or Dem, sees you, the people, as the enemy. There for, the government is your enemy, an enemy with in. It must be logically. How else can that work? Now, why does your constitution allow guns? Why do so many US citizens insist on their right to gun ownership? Is it not to oppose such an enemy? Yet all Americans do is sit on their big old butts and type stuff on the internet. So, what are all those guns for? Polishing and comparing to penises? Are women attracted by them?

What makes me laugh (or is it cry) as a Brit is that mention universal health care and its commie time, people on the streets claiming health care will kill granny. Yet here is a Democrat government continuing and expanding the removal of your freedoms and privacy started with a Republican hawk government, and your all cool with it. All you do is bleat on the web, and that's that. As some one pointed out, you knew this in 2006. Yet here you are 6 years on, and its worse. You do nothing.

Don't get me wrong, its the same every where. People just accept this stuff. Which is why this disgusting spying on your own people lark, KGB style, is in fact absolutely acceptable. Your inaction says so.

Until the people say no, the government, either party, UK or US, does what the hell it likes. Its up to us.

shmerl9• 14 years ago

https://en.wikipedia.org/wiki/NSA_warrantless_surveillance_c...

Karunamon6• 14 years ago

I'd feel a lot better if this article was from almost any other news site. RT is not known for being fair or balanced when it comes to anything involving the USA.

jessaustin3• 14 years ago

If you find similar coverage elsewhere please link it. In the meantime I'm glad RT is on this.

And please distinguish between the long-term goals and values of the USA and the craven personal interests of its present rulers. In pieces I've read and seen from RT, they've often honored the former while excoriating the latter. Which is something I wish an American news source could do. I'll know it's possible as soon as I see a single example.

saber_taylor• 14 years ago

The Defcon video is similar: http://www.youtube.com/watch?v=sqIz-RNUL1g (not sure if this link is bootleg) https://www.defcon.org/html/links/dc-archives/dc-20-archive.... (just the audio)

has the ACLU and the same guy if that makes it more legit.

The 10 zetabyte storage capacity estimate is based on building size. I think we need more details.

shmerl9• 14 years ago

That's because RT dares to talk about what others don't.

pyre• 14 years ago

So does the Westboro Baptist Church. Just because someone talks about something doesn't make it the truth.

tokenadult2• 14 years ago

From a previous thread under a submission from RT:

http://news.ycombinator.com/item?id=4247829

"> The source of the submitted article, rt.com, is not known for careful journalism.

"Understatement of the year."

rdtsc7• 14 years ago

> I'd feel a lot better if this article was from almost any other news site. RT is not known for being fair or balanced when it comes to anything involving the USA.

Quite the contrary. RT is pretty well balanced when it comes to USA. A lot more so than Fox or CNN say.

RT is not balanced when it comes to Russia though.

clobber4• 14 years ago

Uh, article? How about a direct link to the interview with known NSA whistlerblower? http://www.youtube.com/watch?v=TuET0kpHoyM

R_Edward• 14 years ago

As I was reading, I was impressed with how narrow the line is between "alarming" and "nuttier'n squirrel poo."

SoftwareMaven• 14 years ago

the Buffdale facility

It's Bluffdale, not Buffdale. And it creeps me out every time I look across the valley at it.

I really wish the investors in the company I was working on building to encrypted email for the "common man" would have been willing to invest what it would really take to make it work. We were on the right track. :(

gojomo2• 14 years ago

And also Narus not Naris. Seems like this is a rough transcript, perhaps from live closed-captioning.

rdl• 14 years ago

And of course the "18-T" facility and "AST&T" were all AT&T.

jkimmel2• 14 years ago

I'm curious as to the technical specifications of the supposed Naris device. I don't doubt that the US government can obtain the email logs of most citizens, but would it truly occur in this manner? Binney seems to describe a single unit connected directly into the backbone networks of major ISPs, logging all data on certain ports I assume (ie, the common POP3, IMAP, SMTP ports)? Depending on the level of distribution, this device would be tapping into potentially enormous amounts of data. The processing and storage infrastructure would have to be incredibly robust.

I'm not very knowledgable as to the feasibility of such a device, and quite frankly don't know where to begin, but I would love to hear from someone who might know more.

As a back of the napkin, rougher-than-order-of-magnitude calculation, it seems more feasible for the government to tap into existing email providers' databases than to try and administer their own. Would it not simply be easier to file requests (perhaps in a quasi-legitimate manner) for data from Google/Yahoo/MS/Apple than to try and catalog the entire email history of the Internet?

gojomo2• 14 years ago

Filing requests with endpoints leaves a trail, and an agency would have a hard time requesting everyone's total traffic without proper cause.

On the other hand, recording everything through a key bottleneck leaks no information about what is specifically of interest. It also allows retrospective looks at things that might not have seemed interesting enough to request up front. And 'certain ports'? Bah! Get it all. Maybe future breakthroughs (or current undisclosed innovations) can render it all transparent.

This may not be the 'easiest' approach, but it's definitely the 'best', for maximum knowledge, if you can afford/manage it.

The proper spelling is 'Narus', which is also the name of the supplier company, based in Sunnyvale and since 2010 a subsidiary of Boeing. You can read about them and their capabilities at:

http://en.wikipedia.org/wiki/Narus_%28company%29

http://www.narus.com/

jkimmel2• 14 years ago

Ah, thank you very much. A google for "Naris" (as it is spelled in the RT article) isn't very helpful.

Your logic is definitely sound. It's just mind boggling to me that anyone could possibly be logging everything thrown through every port. Every single day. Just, wow.

yajoe2• 14 years ago

I think the government is sniffing packets directly. It's much easier to feed through whatever content analysis engines they have today than try to access remote systems routinely. SSL? When the government has access to most of the internet's root keys, decrypting 128-bit SSL is 'annoying' and definitely solved. There was a controversy a few years ago about secret closets with direct access to raw fiber traffic:

* http://yro.slashdot.org/story/05/12/25/0029204/nsa-data-mini...

* http://slashdot.org/story/06/04/07/1246259/att-forwarding-al...

* http://yro.slashdot.org/story/07/11/09/2040206/ex-att-tech-s...

Mirroring traffic at the ISP would be much harder to detect, more thorough, and reduces the number of pesky admins who would come across surprises in their logs. My vote is on that approach -- it's similar to how spy satellites are operated now ("record everything and playback like it's a DVR when we need it").

As an aside, this is the third time in as many days that I've seen 'repeated' content from old Slashdot on HN. Not sure what I make of that trend.

wondring• 14 years ago

So if I have my own server, with my own self-signed certificate, the government can still decrypt my traffic easily?

tlrobinson4• 14 years ago

Can you clarify the government's SSL decryption capabilities?

I'm aware the US government has CA certs installed in pretty much all browsers. Obviously being a CA allows you to MITM any SSL connection (though probably not without someone noticing, if done on the scale people are talking about, which is probably computationally prohibitive anyway).

But isn't it impossible to decrypt passively sniffed SSL traffic in all cases?

jessaustin3• 14 years ago

Someone should buy a Naris and let hackers start hammering on it. The delivery vector for any malware developed would be trivial. Just send it in an email to someone in the USA.

Hi NSA!

IheartApplesDix2• 14 years ago

1.) Citizens can't afford a Narus device, let alone what they're offering now (more service oriented, less local hardware)

2.) Narus doesn't sell to citizens. Citizens aren't allowed to have information on what kind of monitoring Narus does because it's national security classified.

>The exact use of this data is not fully documented, as the public is not authorized to see what types of activities and ideas are being monitored.

http://en.wikipedia.org/wiki/Narus_%28company%29

jessaustin3• 14 years ago

Yeah it probably isn't cheap. If motivated enough, however, somebody like EFF or WikiLeaks could co-opt enough officials in a third-party nation (Ecuador, perhaps?) to purchase the service. "National security classified" has never stopped Boeing from selling cut-rate, not-latest-generation tech to other nations before. After all, their pals who want to work for them upon "retirement" from the military decide what's classified. Probably the service wouldn't come with a complete ruleset, but it would come with consulting, from the same people who helped develop the initial USA ruleset. Also, the system is probably optimized for the use of its largest customer.

Failing that, you might be able to enlist the help of some of the APT folks who've been downloading all the F-35 plans. Why would we expect Boeing's network to be more secure than Lockheed's?

If one were really patient and as immoral as the NSA, one could start moving around a lot of fabricated-but-plausible evidence against USA citizens for national security-type crimes, and then paying special attention to federal prosecution notices. If you noticed which manufactured "evidence" turned up most often, you'd be able to run a kind of oracle attack by fine-tuning for what got prosecuted the most. In addition, many of these framed citizens would be so obviously innocent that even our debased court system would acquit. This would undermine the perceived accuracy of this fancy expensive system. After federal prosecutors look foolish a couple of times when relying on super-secret we-can't-tell-you-where-we-got-this surveillance data, word will get around.

However it's done, if someone figured out how to characterize which packets get saved (I still refuse to believe they're saving every packet sent in the USA), one could generate many such packets, which could be obviously bogus upon inspection but enough to fool the initial analyzer. That's a DOS right there.

Just throwing out some ideas. I'm sure you smart guys have already thought of all this.

yk3• 14 years ago

Wired had some time ago an article about one NSA data center [1]. That article had some additional numbers on the scale of the surveillance efforts. Specifically it did note that the specific site will have a 65 MW power station, which one can compare to some supercomputers. For comparision RIKENs K Computer demands roughly 12 MW of power. [2] ( One can also try to estimate similar numbers from the size of the facility and from the building costs. In all cases one gets a similar factor of a few above modern supercomputers.)

[1] https://news.ycombinator.com/item?id=3711603

[2] http://top500.org/list/2012/11/

Uhhrrr• 14 years ago

> a 65 MW power station

That seems like a giant blinking point of failure.

carbocation2• 14 years ago

Alternatively, the power grid itself is the SPOF, and the 65 MW power station is essentially a redundancy.

w1ntermute3• 14 years ago

How is this news? We've known this since Mark Klein[0] leaked the NSA warrantless wiretapping program to the press in 2006, more than 6 years ago. If you're doing anything illegal with a method of communication that doesn't have end-to-end encryption, then you're really stupid. Fortunately for the authorities, the vast majority of individuals who commit crimes are really stupid.

0: http://en.wikipedia.org/wiki/Mark_Klein

mtgx2• 14 years ago

Sigh. I keep seeing comments like these whenever such article is posted. But there are 2 problems with that mentality:

1) Just because we the HN readers and Reddit readers, and other people who take an active interest in either being up to date with this sort of stuff, know about this, doesn't mean that population at large either a) knows about it, b) believes it (this sort of stuff sounds too much like conspiracy theories, even if it's real in this case).

2) Just because there were some news about it a few years ago, and there was like a mini-outrage for like a week, and then nothing really happened, doesn't mean we should stop talking about it now, and just let them continue doing it. The point is to keep raising awareness, and incite people to fight for their rights, and demand answers from NSA and the administration. More than that - demand change.

w1ntermute3• 14 years ago

Re to 1): well, this is HN, so you're just preaching to the choir. Why not instead spend the time/effort spreading awareness among the general public? They're the ones that decide elections (and thus policies, or at least I hope).

Re to 2): again, this isn't going to raise awareness. The vast majority of people here already know about this.

harrylove• 14 years ago

We've also known since 2007 that "you can't hide secrets from the future with math[1]." So, if you're doing anything illegal and that information is available to a network, it's a matter of time, not encryption.

Also worth pointing out, in the video he reminds us that the definition of "crime" is not set in stone.

[1] http://en.wikipedia.org/wiki/Secrets_from_the_Future

w1ntermute3• 14 years ago

If the time that it will take to break the encryption is significantly longer than your expected remaining lifespan (and anyone you care about), then you probably have nothing to worry about. In any case, sneakernet is an option that is always available.

MattiasC• 14 years ago

Google 'Room 641A', that's all you need to know...

Wingman4l7• 14 years ago

Or you could just click this: http://en.wikipedia.org/wiki/Room_641A

(In a nutshell: "Room 641A is a telecommunication interception facility operated by AT&T for the U.S. National Security Agency, beginning in 2003, and exposed in 2006. [...] It is fed by fiber optic lines from beam splitters installed in fiber optic trunks carrying Internet backbone traffic [...] contains several racks of equipment, including a Narus STA 6400, a device designed to intercept and analyze Internet communications at very high speeds.")

timdiggerm• 14 years ago

But then he wouldn't look so mysterious!

rooshdi• 14 years ago

Yes, this is old news, but we need a reminder every now and then about how intrusive our government has become.

tokenadult2• 14 years ago

How does this compare to the current practices in other countries? Are there whistleblowers elsewhere whose revelations are reported on in reliable press sources?

(I used to live in a country that was then ruled by a dictatorship, and I am aware of how people behave under such rule. That country now has a free press and free, contested elections for the national leadership.)

morroccomole• 14 years ago

What are you going to DO about it?

contingencies• 14 years ago

The initial, public report describing this sort of thing was prepared by for the European Parliament in 2001... PDF at: http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//...

I would invite HN readers to consider that report, then consider over a decade of technology improvements have since occurred, then consider how little of the public's interest has been engaged in such matters. Having done so, consider supporting the efforts of a small number of parties like the EFF and Assange to raise awareness of these issues and fight for the public interest and individual rights.

tvirot• 14 years ago

Some of you might be interested in his recent talk:

MIT TechTV – The Government is Profiling You http://techtv.mit.edu/videos/21783-the-government-is-profili...

3A2D50• 14 years ago

Incredible... this deserves a submission of its own.

hamoid2• 14 years ago

From that clip:

"Where do you see this going in 5 or 10 years? I see it becoming a totalitarian state. An imperial president (a dictator). Unless we do something."

"It doesn't matter if you say 'bomb' or not. Everything is stored now."

melito3• 14 years ago

It's easy to opine about things like educating the public or engineering 'crypto' for the common man.

In my opinion that would be an exercise in futility.

I think a proper response to this issue is to simply promote social depravity on a grand scale.

Everybody should just constantly read/watch/listen to media involving things like methamphetamine manufacturing, nuclear & home made weapons/chemicals, illegal currencies, human trafficking, hardcore pornography, armed rebellions, the middle east, famous terrorists, serial killers, bon jovi, etc

All of those are a lot more interesting to the common man than lessons on how to use PGP....which is theoretically breakable thanks to the advent of quantum computing.

If everything is being sniffed and stored, there have to be a number of very specific topics that are being sought after in that data.....in my opinion it'd be far worse if the government wasn't searching for things like human trafficking and nuclear weapons (things, hopefully, we can all agree are not good).

Television series like "Breaking Bad" are already pulling weekly audience number of around 3 million plus. One could argue that you wouldn't even have to do much promotion, as these topics already seem to be mainstays in much present day pop culture

Karunamon6• 14 years ago

Business idea: A "chaff box" that can be sold to the public.

Given a list of dodgy search keywords, youtube links, etc etc etc, regularly updated from a central location (think like a websense blocklist but in reverse), uses a configurable amount of bandwidth. Hits these sites with a human-like usage pattern when HTTP traffic from your LAN IP is detected (so it only works when you're actually browsing the web).

Plug it in and gain plausible deniability from most forms of government shenaniganery. Given critical mass, makes most forms of government behavioral analysis (and possibly advertiser behavioral analysis) useless.

Build it on the raspberry pi or similar platform. Materials cost is $35 plus shipping materials. Main time investment is limited to maintaining the blocklist and the central servers.

Hmm. Wonder how this could sell to the soccer mom crowd...

Would also raise some interesting and thorny questions for the server side. If enough people are using the box for the effect to be meaningful, then a lot of sites are going to have a lot of useless web traffic; yet allowing sites to "opt out" or having an identifier of some kind of the box's traffic completely defeats the purpose of the system.

melito3• 14 years ago

I think there are already a couple products like that....in fact I have a few in my house.

I call them my cable modem and tivo

dtromero• 14 years ago

In theory, couldn't an interested party filter out the blocklist from the all other traffic? It would be more interesting to have a dynamic list that gets updated based on actual user behavior. That way, the interested party wouldn't be able to filter out the blocklist without potentially filtering out actual traffic. This of course would create all kinds of legal issues.

cbhl• 14 years ago

You'd want it to be decentralized. Centralized servers are so 2000.

andrewflnr• 14 years ago

I'll admit I don't know all that much about machine learning and statistics, but it seems like it would be pretty hard to simulate human activity in a way that was really indistinguishable (highly sporadic, with trends of connected ideas, for a start). More immediately, most people are never going to get on board with making it look like they're into "bad stuff". It's icky, and they don't think they have that much to lose.

BjoernKW• 14 years ago

There's a story by Cory Doctorow, in which terrorists blow up Bay Bridge and the US establish a surveillance state in the wake of those events. In response, the protagonist creates a distributed system using Xboxes that pretty much works like the way you're suggesting.

imglorp• 14 years ago

Forget the box, you just need a web browser plugin. It could sit in the background. It could have two lists (updated occasionally like spamblockers do it), one of search engines and one of spook-luring phrases. Every, say rand(1..10) minutes, it could make a few connected queries from list B to some engine in list A. Visit a link or two from the gotten page. Stop after say rand(1..10) queries total on that theme. Throw everything away and go back to sleep.

If a million people installed this plugin, that would avg 5 queries every 5 minutes, that would be avg 1.4e9 queries per day, a tiny fraction of the intertubes.

edit: but, apology to parent, you'd never sell a browser plugin...

nitid_name• 14 years ago

If it's from a central location and all clients are working off the same database, it seems like it would be fairly simple for their data mining teams to sift out the identical chaff.

JakeSc2• 14 years ago

Tor essentially provides the same plausible deniability to its end-node users, without needing to simulate human behavior.

jmsduran• 14 years ago

This is an interesting idea. However, for a noise box to be effective requires that a significant number of people are also using a noise box, which assures plausible deniability the same way TOR and shared-IP VPNs do.

If you're the only one using a noise box, or are part of a very small minority of users that do, the random noise you generate is just increasing your attack surface through which the government can more easily target and identify you.

blhack• 14 years ago

A friend of mine built a thing like this.

http://www.haystackproject.org/

mylittlepony2• 14 years ago

That's awesome, thanks for sharing. I'll send it to my friends.

Jach• 14 years ago

> PGP....which is theoretically breakable thanks to the advent of quantum computing.

This is a minor quibble with your overall point, but what I've quoted is wrong. The underlying encryption algorithms for modern PGP implementations are breakable with Shor's algorithm on a quantum computer, but not all encryption algorithms are vulnerable and a PGP implementation in the future could use such an algorithm as default instead. (For instance, http://en.wikipedia.org/wiki/McEliece_cryptosystem)

siculars• 14 years ago

This. Increase the noise. Like a raspberry pi noise maker.

peteretep• 14 years ago

I suspect that an organization with the computational resources and mathematical clout of the NSA are going to have little trouble distinguishing between people clicking around on "J0llY R0g3rs Gu1d3 to NUKELERA WEPONS" and people creating specific, repeated trails to suspicious resources.

jlgreco2• 14 years ago

The idea, if nothing else, is that such an analysis is possible it is also expensive enough to make it hard to do for everyone at once. If everyone superficially appears to be searching for verboten stuff, then their job becomes harder than just "carefully investigate whoever is hitting naughty keywords".

cpeterso• 14 years ago

Emacs' M-x spook command will paste some suitable words into the current buffer:

  Croatian nuclear FBI colonel plutonium Ortega Waco, Texas Panama CIA DES jihad 
  fissionable quiche terrorist World Trade Center assassination DES NORAD Delta 
  Force Waco, Texas SDI explosion Serbian Panama Uzi Ft. Meade SEAL Team 6 
  Honduras PLO NSA terrorist Ft. Meade strategic supercomputer $400 million in 
  gold bullion quiche Honduras BATF colonel Treasury domestic disruption SEAL 
  Team 6 class struggle smuggle [Hello to all my fans in domestic surveillance]

http://www.cypherspace.org/rsa/spook.html

jandrewrogers• 14 years ago

As much as I hate to disappoint everyone, chaffing with lots of keywords, made up searches, and arbitrary blocks of suggestive text will not trigger any kind of flag except "people trying (poorly) to chaff NSA".

The algorithms used for text mining are much more contextual and semantic than what would be fooled by the simple gags I commonly see on the Internet. Those gags might send a message of sorts but they don't make anyone's job more difficult. For a start, they know you are not a terrorist or whatever; nothing about your life as modeled across myriad data sources suggests that. Instead, you will be some random person pretending to stick it to The Man, which they don't care about and never lands in front of a person.

To chaff the state-of-the-art data mining would require some sophisticated computer science and sophisticated operations. You would (1) have to understand the state-of-the-art algorithms used and (2) devise a way to break those algorithms transparently. It is not a trivial task by any means even for someone that understands what is involved.

Superficial attempts to chaff surveillance systems might feel good but they won't accomplish much against a sophisticated adversary. The tech these days is much too good. Even leaving a minimal footprint for analysis is becoming nigh impossible.

unfamiliar• 14 years ago

What if I create a new hotmail account which I use exclusively for emailing a random address in Pakistan, and after a few months delete all of my Facebook/gmail accounts and go completely off the grid save for this one email account which I start accessing from internet cafes dotted around the country, where I also look up information on Arabic websites about fertiliser... would that get their attention?

slavak• 14 years ago

So the only way to truly stick it to the man is to actually become a terrorist!

Show the government your disapproval of their trampling of the constitution. Join Al-Qaeda.

debacle• 14 years ago

It smells like you're talking out your ass.

melito3• 14 years ago

As much this reads as FUD, I agree.

That's what I was getting at with my "Breaking Bad" comment.

A sort of "total depravity" is already a big part of pop culture, so it'd be easy to ignore false positives of people crying wolf.

What I was getting at is that what they're looking for is kind of a big unknown. If media about illegal things is so popular and they ignore it, it leads one to think that data being mined is possibly being used in a fashion similar to a personal agenda.

That's what's truly dangerous about monitoring at this scale. It's not so much that it's happening it's that they're creating something that could grant someone almost god like powers.

If I were to make an analogy, I'd say it's like a man buying a pistol to protect his family and then his child finds it loaded in a night stand.

aw3c2• 14 years ago

http://cs.nyu.edu/trackmenot/

Graham24• 14 years ago

bon jovi?

guscost• 14 years ago

The Kremlin can't afford this scale.

USA! USA!

grecy• 14 years ago

In all honesty, is the constitution in America even worth talking about anymore?

It seems like every day a new article comes to light about how the government is blatantly violating it with complete disregard.

Worse, nobody seems to be doing anything about it.

moostapha• 14 years ago

In addition to probably millions of pieces of cyberpunk/science fiction, there was a crack in Gilmore Girls about victims not caring if you take away their freedom slowly and without them noticing at first.

Tipzntrix• 14 years ago

The old boil a frog slowly metaphor.

I think this myth was debunked, interestingly enough

wissler• 14 years ago

Almost everyone is distracted from the main point:

"A declaration of rights is not a creation of them, nor a donation of them. It is a manifest of the principle by which they exist, followed by a detail of what the rights are; for every civil right has a natural right for its foundation, and it includes the principle of a reciprocal guarantee of those rights from man to man. As, therefore, it is impossible to discover any origin of rights otherwise than in the origin of man, it consequently follows, that rights appertain to man in right of his existence only, and must therefore be equal to every man."-- Thomas Paine

makhanko• 14 years ago

Being Russian myself I always thought that nobody took anything that RT publishes seriously. I guess I was wrong.

rdtsc7• 14 years ago

I am from those "parts" of the world but also monitor US media. I found from experience that RT actually does a great job covering issues related to US (and other countries) but it is complete bullshit when it comes to Russia itself.

American and other news agencies (say Al Jazeera) also seem to follow the same pattern more or less.

So it helps to monitor and compare various news outlets and you can sort of see who they cover the same story and how they spin and then, well, decide for yourself if you can't independently verify the facts. If you can then you can benchmark and compare the performance/quality of each of the news sources.

smsm422• 14 years ago

Right from the start it sounds strange. They cite the case of Petreus as a proof FBI has access to everybody's email. But it is certainly wrong - FBI can obtain access to everybody's email if it is hosted by US provider such as Google, given enough cause to obtain warrants (such as suspicion that CIA director's email account was compromised). This is not news - hardly anyone in the US has doubts that given strong enough cause, FBI can solicit and receive access to specific accounts at US providers. Calling this "everyone under surveillance" is misleading. And how is it related to NSA? And why does not Binney point out Petreus' case is not about surveillance?

nikcub2• 14 years ago

> given enough cause to obtain warrants

The FBI accessed all of Broadwell's IP address info and email accounts with nothing more than subpoena's.

I believe they are storing this information, they just don't have the technology yet that can sort it and allow access to it. So the Petreus emails are probably being stored at the NSA as well, it was just easier for the FBI to get them from Google.

rhizome2• 14 years ago

As long as they have it they can wait until they have a reason to narrow things down. Pick a target, winnow their data. Reverse investigation.

rhizome2• 14 years ago

Petraeus' case is not about surveillance, but it was driven by the "warrantless access to anything over 6mos old" powers of the FBI.

rdtsc7• 14 years ago

The key to this all are these two things (and someone who knows more please correct me):

1) Constitutionally they (NSA) seemed to have found a loophole that states that just storing the data on the disk doesn't constitute spying|invasion of privacy. Only when someone (a human) looks at the results then it triggers all the Constitutional restrictions. Sounds like a bunch of bullshit to me, but that's how they are justifying it.

2) A court subpoena or an executive "magic-Patriot-Act-Federal-Injunction whatever it is called?" when issued can apply to all the data, including historic data from the beginning of time associated with that individual. So, if they ever get a subpoena say when you are in your 50's they could legally pull all the data you generated, created, accessed since the day you were born.

Basically it is pretty obvious they are just planning on storing all the data they can. Therefore the big new data center with a 65MW power station next to it.

My hope is only that someone who is involved in this, just like this whistle-blower, will realize that this is wrong and will expose it and the public in general will start caring enough about this to turn this into a major political issues.

moxie• 14 years ago

This is a story that hasn't shown itself to have legs, I think largely in part because both political parties are fully complicit, so neither are interested in driving the narrative.

So the problem is, what does it mean for the public in general to care? Or rather, what is the value of truth in a world where we have no agency?

jl6• 14 years ago

Worse, they'll go public with the world's most awesome restore-from-backup service and everyone will love it, for the low price of incriminating yourself in future crimes (but you're not planning to commit any crimes anyway, right?).

smsm422• 14 years ago

Public in general is indifferent or worse, supportive, when it is being literally grabbed by their balls and photographed literally without their clothes - if only this is done under the guise of more security. And you want to talk about couple of emails? Forget about the public in general.

However this still does not justify mixing up signal with noise. If you want to talk about NSA surveillance - fine. But then don't start with Petreus who has nothing to do with it.

salman896• 14 years ago

Thought my connection to Google was almost always under the HTTPS protocol... can someone explain to me how the NSA has broken SSL encryption to possibly THE largest internet company in the world?

batgaijin• 14 years ago

ever heard of _NSAKEY or 'stellar wind'?

lostlogin• 14 years ago

Thanks. For those like me who had not. http://en.m.wikipedia.org/wiki/NSAKEY#section_2

salman896• 14 years ago

Not sure how this relates. Article/interviewee is stipulating that the NSA intercepts all communications at the telecom level (as far as I understand). It doesn't say how this device also magically breaks encryption on encrypted data.

I guess you are saying that Google willingly allows the NSA to decrypt the data? What would Google have to gain there? Because they certainly have a lot to lose.

mylittlepony2• 14 years ago

How? By hiring all the mathematicians in the world. I don't see how the size of the company would matter. Also, they are US-based, and have to comply with US cryptography laws. But even if their SSL was unbreakable, the NSA/FBI/etc must have a free pass to Google/Facebook/etc data.

salman896• 14 years ago

Must? Why? What evidence do we have to prove this, or even substantiate it?

magicalist3• 14 years ago

> By hiring all the mathematicians in the world.

not even a little bit.

> Also, they are US-based, and have to comply with US cryptography laws

unless you're talking about sending encryption software to iran, huh?

neilk• 14 years ago

No one says they have.

jacquesm2• 14 years ago

They don't have to break any encryption at all:

http://epic.org/foia/epic_v_nsa_google.html

DanBC2• 14 years ago

ECHELON is ancient; the only differences between that and this is are i) the lack of other nations and ii) the US directly spying on its citizens.

While it's not acceptable it surely can't be surprising? Especially seeing the other attacks on liberties happening every day.

Having said that, other people mention a bunch of problems with the article. Warrants provide easy legal access; connections are encrypted (and it'd be scary if that encryption was broken); the reliability of Russia Today; etc.

OzzyOsbourne2• 14 years ago

"I don’t think they are filtering it. They are just storing it"

How much would it actually cost to store all the emails that American citizens send and receive? I find it difficult to visualise a system of checks and balances approving the massive budget required to house all that data. And the technical challenge of sifting through those emails would be seriously hard. I understand that this might not be just about national security, but it could also be a power game on the part of the FBI. One has to consider how much [national security | power] this really affords [US citizens | the FBI] when measured against the gargantuan expenditure required to actually pull it off. This makes me totally skeptical. Additionally, by saying 'basically the e-mails of virtually everybody in the country' Binney demonstrates his lack of conviction and uncertainty of his own claims.

So, if his words aren't the giveaway, then two minutes of critical thinking will make the interview seem alarmist and inaccurate.

nikcub2• 14 years ago

> a system of checks and balances approving the massive budget

NSA budgets aren't approved by the entire house, but by secret meetings of the intelligence sub-committee.

This datacenter is definitely being built. It is so well known that Wired did a cover story on it:

http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/

OzzyOsbourne2• 14 years ago

Interestingly, the article explicitly mentions the FBI, not the NSA. But, if we were to unify them in our respective imaginations (for the purposes of discussion), they still need to have the budget for their operations supplied from somewhere. http://www.fbi.gov/news/testimony/fbi-budget-request-for-fis... - it appears as if the FBI's budget is just as rigidly controlled as any other governmental organisation. How they internally allocate the funding they receive is a different matter. To me it seems that if there is any form of oversight within the FBI, then the funding of a project of this cost/return ratio would be infeasible and therefore the project could possibly be shut down. There is the possibility that this is an exercise in propaganda and scare tactics: "We can read your emails, so don't try anything. Check out our power". However, because the internal mechanics of the FBI are necessarily not public knowledge this is all speculation and unsubstantiated opinion. But, the argument can be made that this very fact enables the FBI to get away with scare tactics. I still don't see an organisation with the real-world constraints of money being able to store the sheer volume of data that they claim to. For arguments sake, let's assume that the year-on-year rate of email generation remains uniform for the next decade. In one year, they need to have the ability to store X amount of emails. In a decade, they'll need 10X amount of storage. How are they going to store all that data?

rayiner2• 14 years ago

Google is already monitoring everything I do on the internet, why should I be more worried about the NSA doing the same?

Ygg2• 14 years ago

Because one of those has the ability to arrest you and the other doesn't?

rayiner2• 14 years ago

Sure, but we've got a pretty spiffy legal system that protects you from that, and in any case the NSA has no incentive to arrest me. I have no real protection from Google or its employees selling my information, using it against me, etc, and as a practical matter they have a lot more incentive to do that than the government does to arrest me.

alan_cx2• 14 years ago

You can opt out of google's monitoring. Can you opt out of the NSA's monitoring? Do they even pretend?

tptacek• 14 years ago

You can opt out to the extent that Google allows and to the extent that Google is transparent about it.

chimeracoder2• 14 years ago

Funny - the way I look at it, the question is, why aren't people worried about Google, et. al. monitoring you the same way the NSA does?

charonn02• 14 years ago

According to Mr. Binney's sworn declaration[1] in support of an EFF suit[2] against the NSA (stemming from the warrantless wiretapping/AT&T scandal,) he doesn't actually know that any of this is going on, but bases his assumptions on decade-old knowledge that it was possible.

It certainly might be the case that all net traffic is being stored by the NSA, but this man's say-so is hardly proof.

[1] https://publicintelligence.net/binney-nsa-declaration/

[2] https://www.eff.org/cases/jewel

wildranter• 14 years ago

Just get a warrant, raid into their server rooms, and don't forget to tell all about it to us!

Now seriously, the government got too big. What are you going to do about it?

Caution! Everything you say here or anywhere is being recorded, and may or may not be used against you in a court of law.

s_henry_paulson• 14 years ago

To me the warrantless wiretapping scandal IS the proof.

I mean if we know that there are Room 614As [1] all over the country, and that they are diverting nearly ALL communications to their facilities, in addition to them building new facilities to house data all the time [2].

All of this culminating with their shiny new data center [3], which cost 2 billion dollars to build, covers 900,000 sqft, and has a 40 million dollar annual utility bill, it becomes less about proving that they're doing this, but proving that they aren't doing this.

[1] http://en.wikipedia.org/wiki/Room_641A

[2] http://www2.sacurrent.com/news/story.asp?id=69607

[3] http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/al...

tripzilch• 14 years ago

Exactly. If they're not tapping all communications on the net, then why are they building a data centre to store and process all of that data?

Because I personally can't imagine another datastream 1) of such magnitude and 2) worth billions of dollars to build a data centre for.

indiecore2• 14 years ago

Next time I can't find an IRC log I'll just call the NSA.

twelvechairs• 14 years ago

To be fair to the man, its pretty clear from his declaration you link to that some what he says is first-hand, some is second hand and some is assumptions. I think this is a little less nuts than the way you make it sound (that he doesn't know anything other than its possible).

charonn02• 14 years ago

If he were nuts, he would have told the court the same things he told the reporter and with the same conviction. He didn't, so he's sane but unreliable.

mtgx2• 14 years ago

Is it possible to write an OTR plugin/extension for Google Talk that can encrypt the text locally before it's sent to the other person, who would also use this plugin? From what I'm reading Cryptocat already works in a similar way.

I know there's already Jitsi or Pidgini with OTR that can do this for Google Talk and FB chat, but those are just other apps that you need to install, and I think a Chrome plugin/"app" would see much wider adoption. Or should we just wait for web crypto before this can be possible (2014)? Or just wait until Google themselves to do it? (if ever)

shmerl9• 14 years ago

Those who care anyway already use clients which support OTR with the same Google Talk or any other XMPP server like Pidgin, Adium, Jitsi and etc. Those who don't care won't use anything even within the Google Talk web application.

Standalone XMPP clients anyway are way better than Google Talk web application, since they are more flexible and allow using several accounts at once.

seanlinmt• 14 years ago

This reminds me of the presentation "DEFCON 18: Your ISP and the Government: Best Friends Forever" http://www.youtube.com/watch?v=t0aQojDGSD4. I wonder if the "don't get involve in drugs and you'll be fine" advice still holds.

nathan_long• 14 years ago

Best quote:

>> RT: It seems that the public is divided between those, who think that the government surveillance program violates their civil liberties, and those who say, 'I've nothing to hide. So, why should I care?' What do you say to those who think that it shouldn't concern them.?

>> WB: The problem is if they think they are not doing anything that’s wrong, they don’t get to define that. The central government does, the central government defines what is right and wrong and whether or not they target you. So, it’s not up to the individuals. Even if they think they aren't doing something wrong, if their position on something is against what the administration has, then they could easily become a target.

hamoid2• 14 years ago

'Everyone in US', but not limited to the US, right? Services provided by servers in the States are used by people all around the world. Many communications started in other countries have their recipients in the US.

So isn't it more like 'A large part of the worlds population under virtual surveillance'?

propercoil• 14 years ago

in short, yes.

theklub• 14 years ago

Privacy aside... I simply don't trust the government or any of the people who might have access to this data. Assuming you somehow have information about everyone whats to stop you from eventually controlling everything.

m1x1t• 14 years ago

It is implied that the NSA surveilled Petreus' gmail using naris by capturing backbone data which implies that the NSA has cracked 128-bit SSL. Or maybe they just got it from google...

forensic• 14 years ago

Wouldn't it make sense that the NSA owns a few Certificate Authorities and gets access that way? They try to have backdoors installed for them everywhere according to that whistleblower.

janlukacs• 14 years ago

it's a question of time until this will turn against the people. My family has lived in eastern europe and was under survailance during comunist times in the 80's. very sad to see this happen to the US - land of the free.

JabavuAdams• 14 years ago

Does this lead to a functional definition of freedom that's actually more useful for more people than what we're used to?

What is freedom? A functional definition might be -- you're not prevented from doing things when you try to do them.

Interested in electronics? Want to build an igniter for your home-brew rocket engine? Fine ... if we know enough about you to conclude that it's for fun, not for killin'

Want to build a rocket? Great ... if you're not likely to endanger others or sell your knowledge to those who might.

In a perverse way, more detailed profiles could lead to better discrimination between those who have esoteric interests but are unthreatening vs. those whose who are threats.

Of course, if you build it, it will be abused ... but it's an interesting thought experiment.

ussid18• 14 years ago

If you really want to keep NSA busy just add "USSID 18 Violation" to every email you send :P

http://cryptome.org/nsa-ussid18.htm

'Everyone in US under virtual surveillance' - NSA whistleblower

Related Stories