PRISM: "Collection directly from the servers"

https://twitter.com/ggreenwald/status/343421926057861121

by anon1385 • 13 years ago

74 18 13 years ago

rasterizer2• 13 years ago

The gulf between these slides and the issued denials and other theories represented by the likes of the NYT (an automated system to speedup compliance) is widening.

Could it be that the slides were made by a non-technical person who was over-selling this? "direct access" could mean "straight from the source".

cpleppert• 13 years ago

Yes, that is what I think. The slide is making a distinction between passive listening posts and direct collection from companies. "Collection directly from the servers" could simply be a nontechnical phrase that contrasts with wiretaps of telecommunications data.

ISL2• 13 years ago

Agreed. The reticence of the leaking reporters to release the entire powerpoint in an effort to control the debate is scary. The world is now primed to accept more documents titrated from the Guardian.

If the most powerful country in the world is getting trolled with one pdf and five powerpoint slides, this is a masterwork. It would appear that the phone tapping is real, or functionally real, based on the reaction of the Senate and the telecoms. The internet companies replies, especially Google's, are quite different. Simply causing FUD is sufficient to disrupt a lot of US companies' dominance in the internet market.

A lot of countries stand to benefit from a crippled United States position in internet architecture. One of them is holding an internet security summit with the President today. All of them have powerpoint, and many of them have active intelligence programs of their own.

Skepticism is warranted... The long term effects of this hubbub should act to strengthen privacy and security worldwide.

cpeterso• 13 years ago

Couldn't "the companies" be unaware of direct access to user data, but individual employees could be NSA moles providing data access? What kind of privacy protection do companies like Google and Facebook have in place to keep user data secure from company employees?

danso• 13 years ago

I think that's a really important question in this current debate...several years ago, Google fired a senior site reliability engineer who had allegedly stalked teens and read their inboxes...apparently, his role was of one that required deep access into these databases:

http://techcrunch.com/2010/09/14/google-engineer-spying-fire...;

That was three years ago though...a lot may have changed about Google's infrastructure...I'm thinking, for example, whatever work has been done to unify login systems between Google Apps, GMail, Youtube, and of course, Google Plus. Presumably, as complexity has arisen, so has the need for better access-control infrastructure, which would (hopefully) prevent someone even at Eric Schmidt's level to lose his wits and trample around in the system without many, many flags going off first.

So with that said, that's why I'm skeptical (in the layman sense of, this is all more complicated than I can dream of) that this surveillance alleged in the PRISM reports could occur with just a few dedicated employees in the know (or a few moles).

It's not just the data transfer that has to go unnoticed, but the successful navigating of the access control infrastructure. And even if Google were to be completely in cahoots with the NSA and built a backdoor, wouldn't there have to be a testing suite that would make sure whatever normal changes to Google's code base also didn't inadvertently restrict (or reveal) the back door logic? And then wouldn't there also have to be at least one layer of oversight to make sure that that testing suite itself was maintained but otherwise unnoticed?

But I'm speaking as a layperson here who thinks that the kind of infrastructure Google has would require a framework that would make backdoor access awkward to implement. Just so many things could break across all of Google's servers, otherwise...like this fun incident that most people probably still remember, if you happened to be awake early one morning 3 years ago:

http://googleblog.blogspot.com/2009/01/this-site-may-harm-yo...

If you did a Google search between 6:30 a.m. PST and 7:25 a.m. PST this morning, you likely saw that the message "This site may harm your computer" accompanied each and every search result. This was clearly an error, and we are very sorry for the inconvenience caused to our users. > We periodically update that list and released one such update to the site this morning. Unfortunately (and here's the human error), the URL of '/' was mistakenly checked in as a value to the file and '/' expands to all URLs. Fortunately, our on-call site reliability team found the problem quickly and reverted the file.

hannibal52• 13 years ago

How do we realistically expect companies and government to react for these revelations if they would turn out to be true? Is it realistic to assume that they go "Oh, you caught us, here is what we are doing"?

PRISM is not system handling common law enforcement issues. Those documents reveal very large scale secret government intelligence collecting tool. If companies are involved, they are forbidden to reveal it and there will be spin, of course.

rasterizer2• 13 years ago

Then how do you explain the difference between Verizon's statement (http://publicpolicy.verizon.com/blog/entry/from-the-desk-of-...) in which they basically acknowledge the reports and point to their gag-order and tech company execs going on record to strongly deny the reports?

trevelyan• 13 years ago

If a non-technical person can reasonably understand the service to have "direct access", perhaps the technical distinction between "direct" and "indirect" access that everyone is using to CYA is meaningless semantic babble.

greenyoda• 13 years ago

Link to the actual Guardian article referenced by the tweet:

http://www.guardian.co.uk/world/2013/jun/08/nsa-surveillance...

PRISM: "Collection directly from the servers"

Related Stories