Evidence that the NSA Is Storing Voice Content, Not Just Metadata

http://www.schneier.com/blog/archives/2013/06/evidence_that_t.html

by Libertatea • 13 years ago

283 90 13 years ago

Anyone else getting this..?

Technical Details

        www.schneier.com uses an invalid security certificate.

The certificate expired on 18/06/13 11:55. The current time is 18/06/13 14:02.

(Error code: sec_error_expired_certificate)

captn3m0• 13 years ago

Yup, its expired.

pge• 13 years ago

another reminder of false security of certificates, because no one pays attention to them. Here's a security blog, so I will speculate that many of its readers are security conscious users, yet most probably went to the site anyway despite the security warning of an expired certificate.

ctdonath• 13 years ago

Funny, I'm seeing a lot of threads about NSA violations which mention comparable "don't go to this site" warnings. I've seen more in the last few days than the prior several years.

fnordfnordfnord2• 13 years ago

Yes.

dfc• 13 years ago

I am assuming that everyone who got the SSL cert expiration warning is using HTTPSEverywhere by the EFF?

ohwp• 13 years ago

The more I read about the subject the more I believe all this data is primary used for commercial reasons.

What else is to gain from monitoring loads of targets without obvious security reasons?

motters• 13 years ago

The biggest component of espionage is always industrial espionage.

malandrew• 13 years ago

Exactly. Personally, I'd be playing the currency markets if I had access to all this data. I'm curious how many people who are monitored are politicians and financiers (bankers/investors). The potential to abuse other economic markets relative to your own is enormous.

greyman• 13 years ago

But if you investigate something and a new suspect emerges, you want to hear and analyze his calls in the past, don't you? And how can you achieve this if not by collecting all phone calls?

PavlovsCat• 13 years ago

But if you investigate something and a new suspect emerges, you want to hear and analyze his calls in the past, don't you?

I do? If they are suspect in a crime for specific reasons, why are those specific reasons not enough leads to follow?

As Chomsky said, if you're so worried about terrorism, stop participating in it... as in, The Iraq "War" alone killed so many more people than 9/11, and nobody could even be arsed to look at the debris of the latter before destroying it. This is akin to a wolf saying the chicken need to tell him where they are at all times, to better protect them. Feel free to fall for that once, but then please join the rest of us in the real world.

ianstallings2• 13 years ago

1. To stop dissent.

More likely:

2. To award huge government contracts to the collectors and grow the institution at the same time.

im3w1l• 13 years ago

Blackmailing. Determining who is likely to whistle blow.

kaoD2• 13 years ago

http://www.guardian.co.uk/uk/2013/jun/16/gchq-intercepted-co...

alimoeeny• 13 years ago

security certificate expired!

doki_pen2• 13 years ago

CNN already broke this story in early May. http://www.youtube.com/watch?v=vt9kRLrmrjc&feature=share

rlpb• 13 years ago

It is considerably more credible when an accepted industry expert commentates, over the mainstream media.

doki_pen2• 13 years ago

Did you watch the interview? They have an FBI agent talking about it. Do you think he's not really an FBI agent?

Mordor• 13 years ago

Surely a compressed call recording is also 'metadata'?

genwin• 13 years ago

Major media reported that the Boston bomber's wife's phone calls she made prior to the bombing were listened to, after the bombing.

ck2• 13 years ago

NSA is testifying right now in front of congress BTW

Oh wait no, it's the Deputy Attorney General

He says the 4th amendment doesn't apply to phone records.

Footer says "NSA director to reveal terror plots stopped by surveillance"

fnordfnordfnord2• 13 years ago

http://www.c-span.org/flvPop.aspx?id=10737440108

dpeck3• 13 years ago

Lossy compression turns any data into metadata.

diminoten• 13 years ago

This isn't evidence the NSA is storing voice content, this is Schneier saying, "One reason I used to discount the idea that the NSA was storing all phone conversations was that it'd be too much data but now I don't think it is."

Not new evidence.

sshconnection• 13 years ago

I wouldn't be shocked to learn that their interpretation of "not listening in" does not include reading speech-to-text transcripts of conversations.

OldSchool• 13 years ago

Agreed. While speaker-independent speech recognition has ever-so-slowly progressed to the point where it only mostly sucks it's probably good enough to log a general transcript. Combine that with the temptation to store compressed audio at 1KB/sec and 1.5GB/year would likely easily cover fully documenting every conversation you have without "somebody listening in." This assumes 2000 minutes/month, way more than I use, but I need to average in females... Divide that by two if you simply log per-conversation instead of per-phone and we're at 0.75GB/year/person.

I think we can safely assume that you have privacy only when speaking in-person, and that's if you're not under some sort of investigation. Otherwise, find a windy place outdoors (near a large body of water for dramatic effect) and mumble through your conversation even if you're just a Hipster preparing for next weekend's party.

flogic• 13 years ago

I suspect it means "We don't have a guy listening to your line in real time."

mtgx• 13 years ago

Or even better: "We said we aren't listening to your phone calls. We didn't say we aren't listening to a lot of phones, just (probably) not yours.

Their word manipulations are sickening. I just wish all of this went to a trial already and to the Supreme Court. Let's see them lie through their teeth to the judges then, who will actually understand everything they're saying or avoiding saying (unlike most of the press, or people out there).

oceanstone• 13 years ago

Yep! We've actually known this for years. https://www.eff.org/deeplinks/2010/03/wiring-big-brother-mac...

wfunction• 13 years ago

Obama says [1] that if you're a "US person" (whatever that means), "The NSA is not listening to your phone calls."

Does storing them for later use count as listening?

[1] http://www.cbsnews.com/8301-250_162-57589732/obama-on-nsa-pr...

dclowd9901• 13 years ago

Not according to Clapper. I'm sure they're all on message with their phrasing. They are no doubt asserting that when you pick up a phone, someone is probably not listening to your phone call at that moment, as if we need assurance of that.

jules• 13 years ago

Why would the NSA not be able to store all phone calls as audio? If we assume 30 minutes per person per day to store at compressed 20kbps at $0.12 per gigabyte per year (this is what you pay at Amazon), that costs $60 million to store for the data of a year's worth of phone calls of the entire population of the US. The budget of the NSA is more than $10 billion, so that's less than 0.6% of its budget. That is entirely doable. Note that I have grossly overestimated the cost here by assuming that price per gigabyteyear is what you pay Amazon, and 30 minutes per person per day is probably an overestimate, and the compression could be better too. The actual cost is probably closer to $10 million; less than one thousandth of the NSA's budget.

noblethrasher• 13 years ago

Also, Amazon Glacier is only $0.01 per GB.

brudgers8• 13 years ago

The focus on content over meta-data is a red-herring. What you say during the phone call is just that...something you say. The meta-data shows what you do.

A person browses the web at a doctor's office. Forty-five minutes later, that person calls their spouse, then an oncologist. A few days later, their spouse checks email from the oncologists office. An hour later a call is made to a diagnostic center by the first person. The next day, they call their mother and a surgeon. [see interview with Susan Landau: http://www.democracynow.org/2013/6/12/more_intrusive_than_ea... ]

The conclusions which can be drawn from that meta-data are far more solid than can be drawn from listening in to any or all of the phone calls.

Your phone calls don't show what time you get up in the morning, or when you get to work or walk the dog to the park. The meta-data does.

The focus on the content of calls is 50 years out of date. The meta-data show the best time to burgle your house or fake your identity online. They show where you go and who you associate with. There's no need to know what you said.

danbruc4• 13 years ago

I have to disagree. One could probably extract most of the information in your example from one of the phone calls and very likely even more information you can not extract from metadata alone. But there is of course also information you can only extract from metadata because it is never explicitly verbalized.

brudgers8• 13 years ago

[Beep] "Mom, call me."

It's the timing and individuals and the sequence of events which matter.

nkohari• 13 years ago

I don't think people are worried about the NSA breaking into their house or faking their identity, nor do I think anyone is concerned that the NSA will hear them talking about how they have been diagnosed with cancer.

I think people are worried that they will say something well within their first amendment rights on a seemingly private channel, that will then get them marked as a "dissenter" of some kind.

rapind• 13 years ago

It doesn't have to be the NSA that breaks into your house. It could be an outside analyst selling information to a guy who knows a guy etc.

I don't think anyone, be it government or corporate, should be capturing and storing detailed data like this for extended periods of time. It's just asking for trouble. I haven't seen any proof of a worse case scenario more severe than ads being a bit less targeted if strict limits were placed on data retention and identification.

pak• 13 years ago

I disagree. You give a situation which is suggestive of the person learning they have cancer, and is a perfect example of how mass tracking can expose personal but information about our lives that we would rather keep private (particularly medical information, which I believe is the most vital kind of privacy threatened by these mass tracking schemes). But I wouldn't say that conclusion that you suggested is solid. It is equally plausible that the diagnostic center told the patient that results were negative, and the call to the mother was to reassure her and to the surgeon to cancel a preemptive appointment made by the doctor.

The conclusions which can be drawn from that meta-data are far more solid than can be drawn from listening in to any or all of the phone calls.

This is just false. If you were a lawyer trying to draw a portrait of intentions with the metadata in court, obviously it would help your case if you could play the tapes and show what was said in each of the calls, so the other side can't propose equally valid situations like I did and create reasonable doubt.

I think we can be so fascinated by the power of having data, that much like the other powerful forensic tools used in the courtroom, we are eager to connect all the dots like we see TV shows like CSI doing. It can be difficult to remind people that more data (particularly meta-data and not content) produces more plausible hypotheses as often as it narrows them down.

janardanyri• 13 years ago

It is equally plausible that the diagnostic center told the patient that results were negative, and the call to the mother was to reassure her and to the surgeon to cancel a preemptive appointment made by the doctor.

The metadata would not end with that phone call - the pattern of continuing activities would make fairly evident what the prognosis had been. (Of course this doesn't meet the "beyond all reasonable doubt" standard of criminal court, but it meets the standard for justifying digging deeper into their affairs, or setting insurance rates for that matter.)

Pr0metheus• 13 years ago

But the problem is that there is no court, and they (NSA or whomever) are left to make their own conclusions and act on them before we have a chance to defend ourselves. In the example, you can draw (at least) two conclusions, the problem is: the NSA gets to pick the one that suits their needs and defend it with misinterpreted "meta data"

ordinary• 13 years ago

While I see and agree with your point (you can derive a lot of information from just meta-data), this is where you go overboard:

The conclusions which can be drawn from that meta-data are far more solid than can be drawn from listening in to any or all of the phone calls.

You cannot derive more information from meta-data than you can from the data itself. That's why we call it meta-data. "Honey, I may have cancer, I'm making an appointment with Dr. O. N'conlogist as soon as possible." is more compact, just as complete, and is more tolerant to missing parts.

brudgers8• 13 years ago

The value of meta-data is why people tag friends in photos and cameras geocode. It's called meta-data because it sits above data in the information hierarchy - just as a digital photograph sits above the bits and bytes on disk from which its image is composed.

"Honey, it's bad news," or "Darling, I need you to hold me," or "<sobbing>" don't say squat...unless you know they were made from the doctor's office and what calls were made afterwards.

sukuriant• 13 years ago

It's also not necessarily correct or trustworthy. However, if you not only say "Honey, I may have cancer", and then go to the doctor and do research and go to the doctor again, and call your loved ones more often than you used to, and continue going to the doctor, now we know it's not just some conversational sarcasm or paranoia that the surveillance programs need to sift through, now we know you're serious, and you're worried, and you're dealing with it.

ImprovedSilence• 13 years ago

So true. Even Target can make simple meta-data conclusions: http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe...

pasbesoin• 13 years ago

At this point, I think that to some extent the concern about voice recording can be reduced to: "Fool me once, shame on you. Fool me twice, shame on me."

The public was lied to. At the least, a lie of omission.

The lying authority figures are now attempting to (re)establish their credibility -- or at least hang on to their authority and power.

Fool me twice?

snowwrestler• 13 years ago

One party can obfuscate meta data by, for example, using a "burner phone" or by routing VOIP calls through 7 proxies.

The only way to obfuscate the content of a call is if both parties agree in advance to speak in code.

"Hi honey, the sparrow has left the nest. There may be a bee in the bathwater."

"John is that you? What the heck are you talking about? How did the cancer test go?"

wisty• 13 years ago

Here's how I'd do it: Everything gets chucked into a secure storage. Meta-data (from processing the data) goes into the dataming system (where it's probably shared with a lot of projects, somewhat securely). If the data mining indicates a "hot" message, the original message (and associated messages) will be sent to an analyst.

Can anyone think of a more likely scenario?

By "secure", I mean "not shared within the agency". Obviously, everything is locked down within the agency, but there'd be a limit to how much the staff would be allowed to see (except the sysadmins, like Snowden, who need wide-ranging access).

anon51234• 13 years ago

In 1998 a colleague of mine received a DARPA request to develop a tape-based recording device that -- it was obvious from some quick calculations -- would be capable of archiving all voice communications going in and out of the country. We could think of no other application for that kind of technology, and assumed that the real client was the NSA.

At the time, storing such a quantity of data was completely infeasible within the physical space & budgetary constraints of the proposed program was completely infeasible. We told them so, and the project went away. However, given that:

1.) They were trying to do this 15 years ago, and

2.) Both their budget and the technological state of the art has improved substantially since then, and

3.) The government these days seems happy to treat citizens' rights with the same general contempt as non-citizens' rights, given some creative re-definitions of terms and rubber-stamp lawyering...

...I would not be at all surprised to learn that a program like this was in fact well-established by this point.

auctiontheory• 13 years ago

My experience has been that commercially available speech-to-text technology doesn't work very well on non-US-accented English. Maybe fixing that tech will be one benefit of PRISM. You know, just like we thank the Apollo space program for Velcro and pens that can write upside down.

CamperBob2• 13 years ago

How about the simple fact that you don't need multiple data centers with capacities measured in exabytes to store "metadata"?

humanspecies• 13 years ago

Warning: this article does not present any evidence.

Schneier is a great cryptologist, I've read his books, I've carried them around, I'm a big fan of his work.

BUT.

He's seriously lagging behind in his coverage of this scandal, it's like he's just reposting what others have already said and often stating the obvious.

So the NSA has the capability to store voice? No, really? Like since 1940????

Sorry, Bruce, but this article is shit.

Havoc• 13 years ago

Well given that youtube can store such vast amounts of video the suggestion that the NSA is storing lots of voice doesn't seem like a massive stretch.

ianstallings2• 13 years ago

I think what this points out clearly, and Schneier has been preaching this for years, is that we need to encrypt everything going forward.

LoganCale• 13 years ago

I agree, but good luck getting the average internet user to do so, and their refusal will prevent you from effectively doing so as well whenever you want to communicate with them.

jes• 13 years ago

Speaking for myself, I'd like to encrypt the content of my communications as much as possible. But I can't control or encrypt the meta-data, such as numbers I dial, how long I talk, etc.

mjt0229• 13 years ago

And, by the way, I hate the term "metadata." What's wrong with "traffic analysis," which is what we've always called that sort of thing?

This has also been bugging me. Metadata is a very general term, and it doesn't explain what the NSA claims its doing (whether they're doing anything else is beside this particular point). Moreover, the use of such a general term seems like it's part of the propaganda, to make us less scared: "We're not collecting data, we're collecting meta-data." Well, it turns out that they are one and the same anyway.

dougk16• 13 years ago

Lots of debate here on what is more powerful, the data or the metadata. I think in the case of voice content, a case can be made that the metadata is more powerful, simply because it's already parsed into a quantitative, objective format that's relatively easy to analyze en masse and find "suspicious" patterns within the public. With voice content, I don't think our natural language processing chops are up to par to deal with the massive amount of data and connect the dots in meaningful ways.

Of course, if you're already targeting a specific individual, and you can get a human to listen to the voice content, the debate is academic - both kinds of data compliment each other and are equally powerful. Metadata still acts as a better "gateway drug" for narrowing down individuals though.

peterwwillis• 13 years ago

To query the database, you need to know the phone number's area code is inside the united states (...? like that's fucking difficult?), then you must get "a further review" to see if they are "just expressing their first amendment rights", and then one of 20 analysts and 2 managers must approve it.

Go check out all the things that are not protected by the first amendment. http://en.wikipedia.org/wiki/United_States_free_speech_excep...

If we held people accountable for all the false statements of fact they make, FOX News would have been off the air years ago and all their newscasters thrown in jail. Basically, millions of people could be subject to database queries, considering how many loopholes there are.

One example they cite using the 215 was the NSA provided a phone number to the FBI, the FBI served notice to the court to find out who the number belonged to, and they then arrested and convicted the guy for giving money to a foreign organization that the USA labels a terrorist organization. So don't do business with anyone who might know a group of freedom fighters.

mikemoka• 13 years ago

So it turns out we should have actually listened to Shia LaBeouf back then:

https://www.youtube.com/watch?v=dNRgP4FVDzA

Evidence that the NSA Is Storing Voice Content, Not Just Metadata

Related Stories