Rackspace Response to PRISM

https://community.rackspace.com/general/f/34/p/791/1347#1347

by BikalpT • 13 years ago

221 73 13 years ago

community.rackspace.com

Dmitry's followup at the bottom of the page is both insightful and indicative of our nitpicking attitude to this. Is metadata covered under this? How about their routing and network equipment's logs? In the same time, when do we stop asking clarifying questions and arguing about the semantics of the message, a process that might turn into legalese and then lawyers talking to each-other?

femto• 13 years ago

Strip away the accompanying material and the statement reduces to:

"We have never been served with a blanket warrant, or anything close to it, that requires us to give data owned by multiple customers."

Those are the words that need to be examined for loopholes.

purephase• 13 years ago

Probably one of the better responses that we've seen.

Regardless of my earlier posts, I'm actually inclined to believe these service providers.

I'm curious, has anyone seen/heard anything from CA's? I imagine it would be much easier to just create a split network route at the ISP layer and decrypt all traffic.

Wouldn't be that crazy if you had all of the root keys.

jackowayed• 13 years ago

Ugh, this keeps coming up. No amount of cooperation from Certificate Authorities will enable passive attacks on SSL.

All the CA does is cryptographically certify "this is the public key that the Company (eg. Google) gave me"; they never see the corresponding private key.

Cooperation from the CA might give the NSA their own certificates for Google, which would allow for an active man-in-the-middle attack. Certificate pinning would defeat that, and doing that on the fly in the Internet at large would be a serious undertaking.

But if they want to decrypt traffic passively and they don't know about serious SSL vulnerabilities, they would have to have Google's private key. And with Perfect Forward Secrecy, even that is not sufficient. (PFS requires an active attack because the session key can only be determined if you're actually one of the two doing the handshake, or you know how to factor very large numbers.)

mentat• 13 years ago

1) Generating certificates on the fly for arbitrary domains has been the usual operating mode for transparent proxies for at least 8 years. 2) There have been many public SSL vulnerabilities in the last year. To think that there might be some non-public ones is not a stretch. 3) If anyone can factor very large numbers, it is the NSA. The move to ECC for Suite B has been interpreted to imply this may be becoming more feasible.

blhack• 13 years ago

The attack is to generate a certificate, sig. it themselves as valid, and then man in the middle the target. it's not about decrypting somebody else's session, it's about creating their own, seemingly valid one.

marshray• 13 years ago

No amount of cooperation from Certificate Authorities will enable passive attacks on SSL

Actually, it's quite common for CAs to do the site admins a favor and generate the keypair for them. The admin then downloads the private key and installs it on his server.

On TLS connections where the client and server do not negotiate the use of Ephemeral Diffie-Hellman (EC)DHE (sometimes called EDH), then the CA could have retained the private key data which could be used to decrypt the packet capture after-the-fact.

Google should be applauded for configuring their servers to prefer (EC)DHE on their TLS services. It also means they can fight a law enforcement subpoena for their private key.

micah94• 13 years ago

What I think you're driving at is what this device (and others like it already do) http://www.nextgigsystems.com/netronome/ssl_inspector_SI-800.... However, you must be sitting in between the client and server and inject into the exchange (be a proxy). You can't just listen to both sides and reconstruct it later. Well, that is if you believe the NSA has not straight-up cracked SSL -- which I don't believe it has above 128-bit keys. Their cpu cycles are better used elsewhere, plus they have so much unencrypted data to analyze. But the race continues...

j2d3• 13 years ago

I would imagine the tech used in the device you linked to has been in use for quite some time. Nothing stated in the Rackspace or other ISPs posts says anything about the routers in place at these facilities. They're all quite careful to say how secure the customer's "stored data" is safe on the "servers" - nothing is said about data flows through routers.

icambron• 13 years ago

A blanket warrant covering thousands of customers cannot possibly comply with the Fourth Amendment

How about a blanket FISA order?

mehmehshoe• 13 years ago

I saw the word "blanket" and cringed as well.

vertr• 13 years ago

The thing most bothering me right now is the lack of meaningful response from the companies that really matter: Google, Microsoft, Apple, and others. The responses we do have seem to be downright lies.

sneak4• 13 years ago

These sorts of things are gag-ordered. It may be that the top brass doesn't even know, for plausible deniability's sake, or that they've been told and now immediately face federal felony charges if they tell anyone (spouses and PR flacks included).

There was a fight (which was won) to get the gag-order provisions of PATRIOT NSLs lifted, at least for speaking to one's own lawyer, which is a protected right (spouses and coworkers are still out, tho). Who knows if those rights extend to FISA orders, though we've seen how they interpret other constitutionally protected rights.

It's not their fault that they don't want jail time. Blame your government. Support courageous people like Snowden. Tell your friends.

skwirl• 13 years ago

I haven't read all the responses, but Google's seems pretty meaningful and clear. How do you know it is a "downright lie?"

dmourati4• 13 years ago

SCOTUS says Fourth Amendment does not apply to third parties. Smith v. Maryland - 442 U.S. 735 (1979). Third party doctrine.

magicalist• 13 years ago

That is most definitely incorrect. The third party doctrine is shaky judicial construction at best (see, for instance, US v Warshak for the latest example and a case many can now use to justify holding off court orders until the Supreme Court or Congress weighs in on the ECPA), it is not held universally (wiretaps being the longest existent example), and Smith v Maryland would only get you things like call metadata at best anyways. Certainly not server contents. And certainly not with an indefinite gag-order on the service provider.

dmourati4• 13 years ago

The sixth circuit court of appeals can decide whatever it wants but they can in no way overturn a decision of the Supreme Court.

gergles• 13 years ago

Someone trots this horse out of the barn every time privacy issues come up.

I don't give a fuck what SCOTUS said in 1979. They could have gotten it wrong. Their interpretation could disagree with a plain reading of the Constitution, or they could have based their decision on inaccurate or incomplete data. Even if neither of those things are true, times have changed; issues at hand are wildly different than would ever have been conceivable in 1979.

Going "SHUT UP, SCOTUS DECIDED THIS ALREADY" does nothing for the discussion, and it comes out every single time there's an ECPA or 4th Amendment thread.

dmourati4• 13 years ago

Whoa!

I responded to one point in the Rackspace response I thought was a bit off-base, specifically that their general counsel thinks the fourth amendment applies to them ... "Based on our interpretation of the Fourth Amendment ". It does not.

You may not give a * about what the SCOTUS decided in 1979 but the SCOTUS does, it is called legal precedent.

Times may have changed, but Smith v Maryland is still controlling law.

Please try to be more civil.

tomasien• 13 years ago

Ok to be fair: that's how judicial rulings work, based on precedence. There may be (and I believe to be) far MORE precedence saying the opposite, but don't dismiss precedence's power.

einhverfr7• 13 years ago

I don't think that is quite right. Smith v. Maryland did not actually merely say it does not apply there. Smith v. Maryland said that installing a pen register to to record call detail information regarding an individual under surveillance did not need a warrant because:

1. The information was willingly shared with a third party.

2. The individual relied on the sharing for many other services including being able to trace harassing phone calls, and the like, and

3. The information was not deeply revealing.

The much more important case regarding 3rd Party Doctrine is California Bankers Association v. Shultz (1974), which established that there is no reasonable expectation to privacy in routine surveillance of bank records of transactions above a certain amount (set at $10k under the statute then as now). The thing is that the dissent was worried specifically about dragnet surveillance and the majority more or less swept that one under the rug.

However, this is not the 1970's any more and there are reasons to think the dragnet surveillance concerns that were ignored in 1974 carry more weight today. In 1983, the Supreme Court, in United States v. Knotts included clear dicta differentiating the case of following a car with a beeper installed in something that was sold with suspicion that it would be used illegally, from the dragnet surveillance case. Rhenquist, writing for the majority, said:

    But the fact is that the "reality hardly suggests 
    abuse," Zurcher v. Stanford [460 U.S. 276, 284] Daily, 
    436 U.S. 547, 566 (1978); if such dragnet-type law 
    enforcement practices as respondent envisions should 
    eventually occur, there will be time enough then to 
    determine whether different constitutional principles 
    may be applicable.

The court further narrowed beeper tracking in Karo v. United States to hold it was a search when law enforcement officers determined that a barrel of ether (suspected of being used in making of narcotics) was traced to someone's home. Given that even without GPS, our cell phones are effectively beepers have lead some courts to start pushing back on subpoenas for historical cell site location data.

More recently, you have the 5 concurring justices in Antoine Jones v. United States, opining that long-term surveillance by virtue of time and amount of data collected may well violate the 4th Amendment even if individual pieces may not. I say "opining" rather than "ruling" because Sotomayor refused to rule on that ground, but instead chose Scalia's more narrow rule, while at the same time endorsing Alito's much broader rule. While not the "Opinion of the Court" it is still "an opinion of the majority of the court" and I think this has a certain amount of force on courts below.

We must be confronted that we are at a point where Rhenquist's insistence that dragnet surveillance must be considered separately now mandates that we confront that. A clear majority on the Supreme Court seems to believe that this can violate the Constitution with the other four justices merely having declined to comment on it.

I hope this clarifies both what the court said and what confusions there currently are as this area develops. No I am not a lawyer but I read Supreme Court cases for fun.

sneak4• 13 years ago

Note well that Rackspace offers primarily dedicated server services, which would make it rather difficult for them to participate in PRISM as shown. You'd tend to notice if someone rebooted your box and installed a service. :D

Nothing stopping NSA from splitting their transit fibers on the (3), Telia, and Qwest sides though.

What's going to be really interesting is how PRISM integrates with AWS, once some brave Amazon soul decides to self-immolate for our own intellectual curiosity.

lightknight• 13 years ago

Maybe you would, maybe you wouldn't.

See, that's part of the problem in terms of economic calculation when dealing with a surveillance society -> since it's largely impossible to quantify the amount of lost business due to various surveillance / justice actions, as the methods and individual events in which such actions took place may never see the light of day, a society could be going bankrupt due to an overly large security division, and never know it.

Let's consider a real-life plausible scenario: a DEA agent gets a tip from a questionable source about a large shipment of Molly coming in tonight on the docks (cliche, but let's roll with it). The information isn't good enough to get a warrant, but the DEA hasn't had a bust in a while, and the agents are being pressured to find something to justify their jobs. This DEA agent figures that it wouldn't hurt to have a look around (nothing illegal there, right?), and spotting nothing immediately out on the docks, begins to think that it's a bust. The agent notices that an upper window is open on one of the warehouses, and that there are voices being heard within; it would take a little effort, shimmying up the side, but the agent could peak through the window (questionable)...and maybe even climb inside if the agent sees something. The agent climbs up, and hears rising voices from within. Not seeing anyone, the agent climbs in.

The agent, walking on top of some crates, sees the owners of the voices, and after listening for several moments, realizes that it's just a typical worker's spat. The agent goes to leave, not seeing anything of interest...but as the agent moves, one of the crates topples, pushing the one in front of it, and so on in a domino fashion. The agent manages to leave undiscovered, but not before $30 million in Lowe's Italian Chandeliers are dropped three stories onto a hard concrete floor.

The workers will be blamed for not stacking the crates correctly, and the owner of the warehouse cited. The insurance company will, of course, cover the costs of the damaged merchandise. However, the cost to society, for this overstep, was more than a minor civil rights violation...it was more than those workers make in a decade, possibly their lives.

And that's kind of at the heart of these infringements...when the intelligence agencies screw up, when the police screw up, it's not like they're shouldered with that debt; it's charged to society as the cost of doing business...no different from what the bankers did recently when they 'privatized the gains, and socialized the losses.'

coolj• 13 years ago

I can't really tell if I agree with you or not, but that was a hell of a story. I feel like I just watched an episode of Magnum P.I.

lawnchair_larry• 13 years ago

You'd tend to notice if someone rebooted your box and installed a service. :D

HBGary's leak included a subcontract involving development of a USB kernel driver exploit to inject a rootkit into kernel memory. Just saying ;)

sneak4• 13 years ago

That's pretty sweet.

Not to engage in the spergy one-upmanship that usually happens now, but one of the best hackers I know got me building kernels without loadable module support of any kind in the 90s after demoing a similar attack. I build my colo machine kernels without most hardware drivers outside of disk and ethernet. (n.b. that you must also patch to deny writes to /dev/mem and /dev/kmem (even for uid0), as you can use these to insert code into a running kernel even without module support.)

There are ways to resist, still.

rachelbythebay• 13 years ago

Rackspace? Look up the history regarding Indymedia in 2004.

Domenic_S• 13 years ago

That was a weird situation. Italian government asks US government for "help" with servers (well, logs) in a UK datacenter run by US-based Rackspace.

They'd still do it today, IMO:

we are of the view that Rackspace is prohibited from accessing and turning over customer data stored on a customer’s server or other storage device in a U.S. data center without a properly issued, lawful request ( e.g. search warrants, court orders, Foreign Intelligence Surveillance Orders)
without a properly issued, lawful request
lawful request

When you write the laws, anything is lawful.

leoc4• 13 years ago

Thanks: here's a decent-looking media report from the time. http://www.theregister.co.uk/2004/10/11/home_office_fbi_mlat...

_pmf_• 13 years ago

"We did not have an unconstitutional relationship with that authority."

leoc4• 13 years ago

From the point of view of any non-resident alien who has US cloud data, this is a very ponderable answer. We know what the Fourth Amendment says. The problem is that apparently (IANAL!) the US courts are upholding the idea that the Fourth Amendment does not apply to the US-based cloud data of non-US-resident non-US-citizens. I've heard a couple of people suggesting that this interpretation is based on the idea of border search, but that's neither here nor there: the upshot is that, unlike for example the US property of non-US-resident non-US-citizens, which is protected by the Takings Clause, the US cloud data of non-resident aliens seems to have no Constitutional protection. This seems to be the Constitutional foundation of FISA http://www.gpo.gov/fdsys/pkg/STATUTE-92/pdf/STATUTE-92-Pg178... 702 http://www.govtrack.us/congress/bills/110/hr6304/text , the law which allows the NSA to get Foreign Intelligence Surveillance Orders against non-resident aliens. Absolutely the only thing the government has to prove to the FISC court to get one of these orders is that the targets are (more likely than not!) non-resident aliens. No probable cause, no standard of suspicion for anything: the government doesn't even have to state its motivation. And the "Notwithstanding any other provision of law" language in 702 seems to sweep away any other statute law you (or Rackspace etc.) might want to use against the order. (Again IANAL.)

So how are we to interpret

"Based on our interpretation of the Fourth Amendment and ECPA, we are of the view that Rackspace is prohibited from accessing and turning over customer data stored on a customer’s server or other storage device in a U.S. data center without a properly issued, lawful request ( e.g. search warrants, court orders, Foreign Intelligence Surveillance Orders) from a U.S. court with appropriate jurisdiction over Rackspace and the data sought."

? Coming right after the recitation of the Fourth Amendment, this gives the impression that Rackspace will only hand out your data in response to a warrant (or warrant-like-thing) that demonstrates probable cause. But in fact, when the customer is a non-resident alien, the order is a FISA 702 order, and the court is the FISC, probable cause never comes into it: the US can (completely properly and lawfully!) get such an order for no stated reason at all. Imagine the following conversation in 1860:

Q: I hear that you have slaves on your Virginia cotton plantation. Is this really true?

A: The Fifth Amendment to the US Constitution states that 'No person shall [...] be deprived of life, liberty, or property, without due process of law'. No-one is forcibly detained on this plantation except fully in accordance with the law and the Fifth Amendment.

This answer seeks to suggest that the only prisoners on the plantation are convicted criminals, which is false - the plantation is worked by slaves. But in fact the answer is precisely true though devious: slaves have no rights under the law, while the Fifth Amendment does not apply to slaves. I really hope this isn't the correct way to interpret Rackspace's statement as well.

bigiain4• 13 years ago

"The problem is that apparently (IANAL!) the US courts are upholding the idea that the Fourth Amendment does not apply to the US-based cloud data of non-US-resident non-US-citizens."

And further - it's not just "US-based cloud", it's almost certainly "cloud resources physically based _anywhere_ if it's owned/operated by a US based company". I'm pretty sure Rackspace[1] would consider any data that I (a non-US resident/citizen) store on a Rackspace instance intentionally provisioned in their Sydney Australia datacenter to be subject to US law instead of local Australian law[2] - and would most likely hand over any and all of my data with no need for a warrant.

[1] for completeness/fairness, I'm pretty sure Amazon would treat and Sydney AZ instances I spin up exactly the same way. [2] actually, I suspect I'd get the worst-case scenario of the least protection available under either US or Australian law - if push ever came to shove...

ra2• 13 years ago

"[1] for completeness/fairness, I'm pretty sure Amazon would treat and Sydney AZ instances I spin up exactly the same way. [2] actually, I suspect I'd get the worst-case scenario of the least protection available under either US or Australian law - if push ever came to shove..."

Totally. These points completely nail it for me (A non-US consumer of US based services).

Anyone who was concerned about "the subpoena risk" [1] before, but was satisfied if their data resides in (eg) Australian data centres will now be forced to think again.

I see this as a huge opportunity for non-US domestic PAAS / IAAS providers who keep everything in a single juristiction.

[1] http://www.cisco.com/web/about/doing_business/legal/privacy_...

chii2• 13 years ago

But the US of A has absolutely no obligation for the welbeing or privacy of any non-US citizen. if their data happens to be within US jurisdiction, the US gov't can do anything they like, provided that what they do is "lawful".

I m not saying PRISM is lawful (that remains to be seen?), but i think many non-US citizens are feeling too entitled to the protection of US law.

einhverfr7• 13 years ago

Not quite. If you are in the US as a tourist, it doesn't matter what you have signed. They can't go and strip search you just because they felt like it.

What you have to realize is that 4th Amendment law is largely tied to searches for prosecution reasons and so usually the issue is "well, the 4th Amendment is violated and so to punish the government and give them the right incentives, we won't let them use the following set of evidence in their prosecution." It's really hard to make such rules effective regarding surveillance of foreigners conducted overseas.

Non-citizens in the US for whatever reason do have relevant liberties. This does not extend to say buying tv advertisements for candidates in elections, but it does extend to unreasonable searches and seizures. Non-citizens with no real ties to the US, and not in the US are different.

smackay• 13 years ago

I don't think it's a sense of entitlement at all but rather decades of trust (and reliance) that was built after World War II when the only thing standing in the way of Soviet domination was the USA. It was always a little naive to think that the USA had everybody's best interest at heart but now it is now clear and unambiguously painted in big bold letters that the USA* are in it for themselves and only for themselves. All the talk of shared values and common purpose, spreading democracy and freedom, etc. etc. all rings rather hollow.

It's seems stupid that given recent events that the uproar over whether the US government is reading your Facebook posts has rammed the point home to many people but I guess this is just the final prod that woke a lot of people up.

*Purely from the perspective of the government. I've nothing but admiration (mostly) for large parts of the culture, attitude and hard work of the good citizens of the 50 states.

harywilke• 13 years ago

The 5th and the 14th amendment cover all people, not just citizens. Here is an informative read on how and why and the history of the question of non-citizen rights. http://scholarship.law.georgetown.edu/cgi/viewcontent.cgi?ar... Found this after a discussion of the rights of Boston Marathon suspects as non-citizens. Pretty much they have every right of a non-citizen, except the right to vote.

znowi• 13 years ago

Maybe it's time to compile a list of alternative non-US cloud services? I would be particularly interested in a non-US hosting company comparable to Linode.

MattJ100• 13 years ago

I use Bytemark, based in the UK. They have a cloud service in beta: http://bigv.io/

enriavc• 13 years ago

I second this. Any suggestions appreciated.

vertis3• 13 years ago

I've started a checklist of sites and services that I will need to migrate away from. The list is extensive.

The question of whether to migrate to other cloud services, or to host my own private cloud is up in the air.

Mordor• 13 years ago

Does the US constitution really only apply to US citizens in a global marketplace? Perhaps we'll look back on Bush and Obama as presidents who struggled with a dated viewpoint of the world, who tried to change the constitution into 'no rights for anyone' instead of 'freedom for all'?

callmeed• 13 years ago

I was thinking about Rackspace and PRISM today (I spend > $10K/month at Rackspace) ... and that thread about how all this could harm the startup ecosystem.

If the Govt/NSA wanted access to certain metadata and a company refused (like some claim Twitter did), what's to stop them from going to Amazon or Rackspace and throwing their weight around to get access that way? Or, if that didn't work, they could just keep going up the OSI layers (or tier 1 providers) until they get the access they want OR can force it be threatening to disrupt service.

My point is, even awesome companies like Rackspace are dependent on less-than-awesome companies for some types of infrastructure.

zero_intp2• 13 years ago

DING DING DING we have a winner.

Any company that doesn't comply and hand the data by API will have it's links scraped. Sure it's more costly. That's why they go through the arm twisting.

vertis3• 13 years ago

I would very much like to have the same question answered by Amazon in regards to AWS (maybe it has been already).

vertis3• 13 years ago

So I've opened support cases with both Amazon and Linode, the former will probably get back to me in several days, but as usual Linode has already replied.

---

vertis 29 minutes ago I am an Australian (i.e. Non-US-Resident Non-US-Citizen). While I have nothing of particular interest on my servers, the revelations of the last week have concerned me for multiple reasons.

The Guardian story about the PRISM program suggests there is extensive surveillance and interception of foreign citizens' data without a court order. Do I need to move my servers to a provider that is based in a country that respects my rights to not be surveilled?

lmatos 18 minutes ago Hello,

As an American citizen, I completely understand. With that said, we have to comply with all US law as we are a US based company.

If there is anything else that we can do to help, please do not hesitate to ask.

Regards, Lee M

Zarathust• 13 years ago

Their main defense is that they operate within the boundaries of the law, which the Obama administration also claims. If they ever face a court order telling them to hand over everything, as long as it follows law at face value then their statement is true.

madaxe• 13 years ago

So, they don't do it like google etc. don't do it? Encrypt your disks. Only allow https. Don't let their support anywhere near your kit.

Although then again they could stick a physical intercept in a box.

SeanDav• 13 years ago

They don't address Government back doors into their routers as a result of CALEA etc.

See: http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SR/conf...

and: http://en.wikipedia.org/wiki/Communications_Assistance_for_L...

adinb• 13 years ago

Are the intel services (DIA, CIA, NSA, NRO, etc...) considered actual LEAs? Part of the issue here afaik is the collection of data for intel, not actual LEA. Or else the FBI would be getting all this juicy NSA data to o after actual criminals.

ihsw• 13 years ago

Many USG agencies (Pentagon, NSA, Department of Energy/Justice/Labour/Education, et al) have their own police services[1].

Their training and expertise ranges from glorified security guards to para-military.

[1] http://en.wikipedia.org/wiki/Federal_law_enforcement_in_the_...

zero_intp2• 13 years ago

95/5 splitters.

Rackspace buys service from somewhere. Those fibers are suspect.

Rackspace Response to PRISM

Related Stories