NSA paid millions to cover Prism compliance costs for tech companies (2013)

http://www.theguardian.com/world/2013/aug/23/nsa-prism-costs-tech-companies-paid

by teawithcarl • 12 years ago

86 40 12 years ago

dougb• 12 years ago

Old news from Aug 2013.

aikah• 12 years ago

Yet still relevant,even if you dont like it.Because trust me foreign businesses using US based internet services still care about that huge scandal.

digitalengineer5• 12 years ago

Thanks to mr Snowden we now all know the massive influence of the NSA and the way they can change/delete trends in the online media. HN is a big website with lots of influence (as is Reddit). Question: Has Ycombinator come forth with a statement they are not under the spell of the NSA?

adventured2• 12 years ago

Given the persistent, and intense criticism on HN of all things NSA since the original Snowden reveal, to say that your question is absurd would be putting it gently.

In fact I've seen no other platform that has had more negative + rational + informed discussion regarding the NSA than Hacker News.

digitalengineer5• 12 years ago

It's not so absurd because all NSA articles dive off the front page when about 15 comments (or something of that nature) are reached.

smtddr• 12 years ago

">>Has Ycombinator come forth with a statement they are not under the spell of the NSA?"

Considering the existence of "Gag orders", would they even be allowed to tell us? It's not like HN even has any private data really. It's not an Email service, it's not Facebook with privacy-settings. All our comments are very public and as far as I can tell pretty anti-NSA. It would be crazy to think the NSA isn't watching this site. HN, Reddit and Twitter are like the most likely places an uprising would start from.

If you're worried about the email-address you signed up with on HN, just assume the NSA has it(and whatever IPaddress you login from) and go from there.

digitalengineer5• 12 years ago

Not worried, just curious. I'm here with a direct link to my old blog with name and everything...

yen223• 12 years ago

We can read the link, and we can read your comment. If Y Combinator is 'under the spell of the NSA', they aren't doing a very good job at it.

imaginenore• 12 years ago

Or they don't care about moderating a tiny programmer website.

krapp2• 12 years ago

YCombinator is an American company which is required to obey the law and comply with the government. The 'spell' you're referring to is for the moment a matter of law.

So yes, they are under the spell of the NSA. That YC still exists and hasn't been pursued ala Lavabit suggests that any requests, if they have been received, have been complied with to the government's satisfaction.

If one doesn't trust Facebook, Google, etc on principle, there is no reason to trust YCombinator or any startup they fund, other than personal bias, because the same principles apply. No one would trust such a statement from another company. YC should be no different in that regard.

Although, as is mentioned elsewhere, HN itself doesn't keep much private data. It probably wouldn't be worth their time to do anything more than monitor this site and inject the occasional bit of propaganda.

mhurron• 12 years ago

Can we stop pretending these companies were not complicit in these programs now?

dredmorbius3• 12 years ago

To be fair: they have no choice in whether or not to participate.

Whether or not they're participating willingly or not is another question.

Breaking the model under which they operate is the only real way to ensure that

Maciej Cegłowski's "The Internet With a Human Face" is one of the best examinations of what's wrong, and how to fix it, I've read (though Bruce Schneier and Eben Moglen also do a good job).

http://idlewords.com/bt14.htm

gurkendoktor• 12 years ago

To be fair: they have no choice in whether or not to participate.

That depends on whether there is another country that they could move their companies to, but which does not have similar laws in place :)

adventured2• 12 years ago

If we're going to get specific about who is complicit, the vast majority of all people in the US are complicit. They keep electing the same politicians in D.C. (Pelosi, Reid, Boehner, Boxer, Graham, Feinstein, McConnell, McCain etc.), and constantly turn a blind eye to government abuses. Tons of leaders around the world are complicit.

It stands to reason, and should be unsurprising, that the vast majority of all relevant US technology companies would be complicit, seeing as they're under direct forced compliance.

There is broad electorate support for what the NSA does ('keeping America safe from terrorists' - Joe Public), which is why it has escaped an incredible scandal almost entirely un-altered. It's the same reason the Patriot Act still exists, despite the fact that you're historically more likely to die by choking on a hotdog than at the hands of a terrorist.

mikeash• 12 years ago

Yes, yes, and yes. We should stop blaming government officials for this. For all the flaws of American democracy, we still mostly get the government we (collectively) want.

A lot of techies seem to look around at their fellow techies, see little support for ubiquitous surveillance and other erosions of civil liberties, and assume the general population feels the same. They then conclude that the government is doing this for nefarious reasons against the wishes of the people, and that the solution is to make government more representative of popular sentiment.

As far as I can tell, government is already representative of popular sentiment here. If we want to change these things, we need to convince people in general that change is a good idea.

leoc4• 12 years ago

How does this establish their complicity? Surely agreeing to cover these costs out of their shareholders' pockets would be complicity, rather than pushing them onto the government?

csandreasen2• 12 years ago

Moderators - Could you please add [2013] to the title?

The article seems to mix up the PRISM and Upstream programs. For more information, I'd recommend either the Privacy and Civil Liberties Oversight Board report of Section 702 collection[1] (VERY long) or this post from Top Level Communications analyzing the PRISM program[2] (much more accessible).

[1] http://www.pclob.gov/All%20Documents/Report%20on%20the%20Sec...

[2] http://electrospaces.blogspot.fr/2014/04/what-is-known-about...

EDIT: corrected link

allegory2• 12 years ago

And that is why I host my own shit...

ejr2• 12 years ago

This is in no way a guarantee against surveillance or even compromise, really. We already know blanket persistent monitoring exists so all communication is already collected between your hosted services and any others outside your network. All unencrypted data is analysed in near-real-time and encrypted data is stored for later analysis.

If you're interesting enough to state actors, there's not much you can do.

allegory2• 12 years ago

I'm talking about internal communications, which are kept internal.

I have no assumption about the privacy if something leaves my network, even if it's over SSL (PKI is broken).

mpyne3• 12 years ago

It's not a guarantee, but on the other hand it does give you stronger Fourth Amendment rights (if the NSA is what you're worried about as opposed to Russia or China, at least).

dredmorbius3• 12 years ago

1. The compensation is provided for in the surveillance state legislation which authorized unconstitutional surveillance of American residents, as well as unlimited surveillance of noncitizens outside the US. To that extent, the payments are no real surprise, to the small number of people who've paid attention to this fiasco from the beginning. Yes, awareness has grown post-Snowden.

2. The payments are compensation for costs of complying with mandatory legal orders. To that extent, they likely aren't the reason why Internet companies are complying, but since they must, their costs are covered.

Of course, they may also be full and willing participants, or could be getting dragged kicking and screaming into this. I've heard stories of varying levels of persuasion across the full spectrum.

However both my points are mentioned clearly within the article, if not well articulated in the headline.

leoc4• 12 years ago

Since the existence of the program was first revealed by the Guardian and the Washington Post on June 6, the companies have repeatedly denied all knowledge of it and insisted they only hand over user data in response to specific legal requests from the authorities.

How is this statement anything other than a simple untruth on the part of the Guardian?

frostmatthew2• 12 years ago

How is this statement anything other than a simple untruth on the part of the Guardian?

This article is from last year - IIRC this was the stance of those companies at the time.

leoc4• 12 years ago

Thanks, I stupidly hadn't checked the publication date.

mpyne3• 12 years ago

It was the proper stance too.

These companies wouldn't have known about "PRISM", they would have known about their own individual subsystems used to tie into some NSA warrant system.

All these companies knew that NSA could get NSLs signed out, or even warrants issued by FISA before PRISM was made public, and they had all received such NSLs/warrants before they setup the infrastructure to handle those NSLs/warrants in a more automated fashion. NSA calls this infrastructure "PRISM", but each individual company wouldn't have been privy to it, because none of those companies would have a "need to know" (or a clearance) about the NSA's own special access programs.

sidcool• 12 years ago

The article is from one year ago. Very relevant today, but an year old.

frostmatthew2• 12 years ago

When submitting old[er] content please include the year (2013 in this case) in the submission's title.

dan_bk• 12 years ago

Remember all the "act-surprised-and-disgusted" posts of these involved companies, right after Snowden had started his revelations? Personally, I remember Zuckerberg's "What the F#ck" post very well.

leoc4• 12 years ago

Weren't they justified in that reaction? As best I have been told and can recall, the CEOs recognised neither the "PRISM" name (presumably because it was an internal label which the government hadn't shared with the webcos?) nor the initial description in the press of the PRISM program (apparently because it was highly inaccurate). In that case it's easy to see how their reaction could be genuine.

mpyne3• 12 years ago

None of these individual companies would have known about the NSA end of the webservice NSA calls PRISM.

Does the Zuck have a TOP SECRET clearance with read-ins to all the special access programs that would be needed to know about PRISM? Somehow I doubt it.

There was acting going on with those responses alright, but the acting more about pretending they didn't understand how powerful automating warrant compliance was, instead simply playing along to the crowd of hacktivists.

But none of these companies would have known about the NSA side, all they'd have seen would be the company's end of the operation, which would be nothing more than an archival tool of a user's data within a certain filter set followed by an upload tool to some NSA-controlled server. They wouldn't have even known what NSA calls the whole operation.

csandreasen2• 12 years ago

They were right to be surprised and deny it. The initial reporting in the Guardian and Washington Post all said that NSA had "direct access" to the servers of all of these companies. After a few days, it was revealed that the NSA did not, in fact, have direct access to their networks, but instead had a system in place to retrieve data provided by these companies under court order.[1]

The Washington Post quietly revised its article without issuing a formal correction[2], but to date Glenn Greenwald has yet to retract his statement the NSA has direct access to their networks.

[1] http://thedailybanter.com/2013/06/nsa-story-falling-apart-un...

[2] http://www.zdnet.com/the-real-story-in-the-nsa-scandal-is-th...

plicense• 12 years ago

Lol seems they left out AMZN.

NSA paid millions to cover Prism compliance costs for tech companies (2013)

Related Stories