How NSA and GCHQ are tapping internet cables

http://electrospaces.blogspot.com/2014/11/incenser-or-how-nsa-and-gchq-are.html

by zecg • 12 years ago

231 60 12 years ago

electrospaces.blogspot.com

a3n• 12 years ago

It's not apparent from the post or a skim of the linked article, but "via Schneier" is apparently because Schneier links the article here:

https://www.schneier.com/blog/archives/2014/12/putting_nsagc...

nly• 12 years ago

He obviously missed this guy sneaking in the side:

https://goo.gl/maps/CsUJE

thewarrior• 12 years ago

"First, the data stream is filtered through what is known as MVR (Massive Volume Reduction), which immediately rejects high-volume, low-value traffic, such as peer-to-peer downloads. This reduces the volume by about 30%."

So all ye folks can start disguising your packets as BitTorrent porn downloads now :)

higherpurpose• 12 years ago

It's also how they tried to mislead the public by saying NSA only collects "4 percent" of the world's data" or something - but "forgot" to mention that data could be emails, chats and urls (essentially the content itself), while the majority of the data is stuff like Youtube/Netflix content and torrents.

_up• 12 years ago

Probably 4% of max cable capacity. But the cables have a lot of unused capacity.

toomuchtodo• 12 years ago

A Truecrypt container shared by Bittorrent would be a bad idea.

Phlarp2• 12 years ago

Why specifically? I always considered this a relatively safe way to transmit encrypted data. Assuming you have secure key exchange worked out, which is always the harder part anyway.

mahyarm• 12 years ago

So long-password protected multipart rar files then!

avn21092• 12 years ago

If you're at all important/a threat, they're paying particular attention to your porn habits so as to bolster their dossier on you. This is for later public release/blackmail purposes.

lorddoig2• 12 years ago

Isn't it interesting that governments can get their act together and come up with big distributed systems crunching tens of Gbps in real time but still continue to implode spectacularly when it comes to large-scale webapps (e.g. Obamacare, UK NHS systems, UK taxation systems.)

ShinyCyril• 12 years ago

I'd say UCAS should be on that list too (always buckled on results day), however I'm not sure that it's government affiliated.

objclxt• 12 years ago

You'd assume that if a GCHQ/NSA IT project went spectacularly off the rails (and I can virtually guarantee it has at some point or the other: you'd have to assume so given how often it happens with defense projects we know about) we wouldn't hear about it anyway.

secfirstmd3• 12 years ago

Ha, yeh right. They have proven themselves just as bad as mangaging those projects. In fact it is one of the only areas where the UK Parliament Intelligence and Security Committee has really given them a bit of a kicking.

"MI5 abandons multi-million pound IT project" http://www.telegraph.co.uk/technology/10053240/MI5-abandons-...

cryoshon• 12 years ago

Different command structures could be part of the cause. Obamacare was a non-classified civilian project, under the leadership of civilians. The primary fumble was (due to corruption) using a federal-friendly (corrupt and ineffective but known to be loyal) contractor rather than an actual development firm.

NSA etc are military operations with honeycombed classification schemes and cellularized access to information. Even if there were failures and waste, we'd never hear of it. I assume that corruption plays less of a role since the concern is on effectiveness, but I have nothing to base that on.

lostlogin• 12 years ago

The military isn't that well organized. Anyone here can name at least a dozen snafu from the last decade. A purchase, an invasion, a process a project. You name it.

psykovsky• 12 years ago

I suspect all the secrecy only makes it easier for corruption to flourish. Military and secrecy is a sure recipe for corruption everywhere.

Nanzikambe• 12 years ago

when it comes to large-scale webapps (e.g. Obamacare, UK NHS systems, UK taxation systems.)

There's absolutely no reason to believe the spy tech isn't as poorly implemented and terrible value for money as the examples you mention. Given their secretive nature it's even more likely to be the case I'd suspect.

drzaiusapelord• 12 years ago

This is my thinking as well. A lot of what spy tech is, is the ability to throw a warrant or NS letter into someone's face and force them to open the gate. The mythical uber-competent security services seem to be a pretty questionable premise. The few criminals caught via these tools are almost always the low hanging fruit of unconnected crazies, who seem to be harmless cranks and not real terrorists. Five eyes didn't stop or predict Snowden, Assange/Manning, Boston bombers, the rise of ISIS, Putin's advance on Crimea and Eastern Ukraine, the massive cyberwar Russia and China have declared on us, etc. In fact, all these things were major surprises to these security services, at least from what we can tell.

There's a lot of federal tax money spent on what is cargo cult science and cargo cult intelligence. The NSA has the ability to buy a lot of PhD's but they are stuck with the same batch of incompetent and profiteer federal contractors the rest of the government is stuck with.

colordrops• 12 years ago

Why does every post on this subject always have someone come in to slam home the notion that the government is always inept in everything they do? Its really good propaganda for keeping the public pacified. But it doesn't reflect reality. The government as well as its component organizations are not monolithic, and are made up of both bafoons and geniuses. Based on conversations I've had with people that have been part of the apparatus, the CIA is known to be somewhat incompetent when it comes to computer tech, but the NSA is phenomenal.

Stop apologizing for the government, whether conscious or not.

fixxer• 12 years ago

Well said. And even more of a reason to insist they respect your privacy. Even if you think "you don't have anything to hide," you still don't want your personal information held on a system designed by anyone with that government contractor level of QA/QC.

alexqgb3• 12 years ago

There's no need to merely suspect. You can be (depressingly) sure thanks to Thomas Drake, who blew the whistle on the NSA for not only not doing things the right way, but for spending gargantuan sums of money to do things in a way so wrong that the only thing done at all was something that flatly violated the Constitution.

rayiner2• 12 years ago

It's much easier to write software that does something, than it is to write software that does the right thing every time. If an NSA system fails to see 10% of traffic, that's acceptable. If an NHS system incorrectly rejects 10% of claims, that's a disaster.

EthanHeilman• 12 years ago

Actually the TRAILBLAZER project was the NSAs attempt and it was a total failure, costing around 3 billion dollars. They abandoned it in 2006. SAIC the contractor that "built" it for the NSA got pretty rich though.

"Trailblazer was a United States National Security Agency (NSA) program intended to develop a capability to analyze data carried on communications networks like the Internet.

In 2005, NSA director Michael Hayden told a Senate hearing that the Trailblazer program was several hundred million dollars over budget and years behind schedule. In 2006 the program was shut down, after having cost billions of US Dollars. Several anonymous NSA sources told Hosenball of Newsweek later on that the project was a "wasteful failure". The new project replacing Trailblazer is called Turbulence." - http://en.wikipedia.org/wiki/Trailblazer_Project

xorcist• 12 years ago

That's a very interesting question.

My pet theory is that it has to do with outsourcing and the widespread belief in the private market that software development is a product just like any other that you buy on the market.

When your average intelligence agency has a million dollars to spend on a project, it will keep a house full of smart people and tell to forth and create, paying their bills and keeping their backs. We might call this the academic model, if it wasn't so far from how academia works today.

When a civilian government agency (or any large private entity for that matter as they are completely similar in this regard) have a million dollars to spend on a project they immediately start phoning the big boys: We've got a million to spend on this project, can do do it?

It is all a bit exaggerated of course, but in this made up example one will get a working, if perhaps shoddy product, and one will get a server filled with very important powerpoints while the product itself tends to be late and slow.

Or to put things in a simpler way and less of a rant: I suspect it is a lot easier to spend a million dollars on a highly specialized system, than to do the same on a very generic system anyone could build. The corollary is that the same intelligence agency would fail in the same way a private or civilian organization would when implementing a new payroll system.

secfirstmd3• 12 years ago

Let me help ya there "No one ever got fired for hiring IBM" :)

runjake• 12 years ago

It's not that the Intelligence Community has their act together any better, it's that they have more money to throw at the problems. Less regulation and oversight probably "help" things, too.

Istof• 12 years ago

They fixed Obamacare's website and they probably have even more incentives to fix the spying applications (if they are broken)... catching "terrorists" might be a low priority goal on their list which would explain why the reporters say that the NSA surveillance played little role in foiling terror plots.

chicofarm• 12 years ago

Government department may be incompetent, private defense contractors are some of most capable organizations in the world. Different US government operations are being increasingly privatized. One difference between private contractors and government organizations, is contractors are not held accountable to oversight (to congress for example) as the government entities are.

pdkl95• 12 years ago

While the other replies here have some very good ideas, there might be another reason for this (perceived? real?) difference that is far simpler: running a webapp on the scale of Obamacare/NHS is probably a much harder job than tapping the internet backbone.

For the NSA/GCHQ/etc, the actual engineering task of setting up some DPI boxes, beam-splitters, and other wiretap equipment is not particularly complicated on the engineering side[1]. The difficulty with that kind of project is access and legality. Even their massive DB in Utah, while (very) large, is probably a fairly simple schema compared to a many business DBs.

Compare that to a healthcare website, that has to implement many random features mandated by law in a way that is compatible with a giant list of "standards", medical jargons, insurance requirements of all sorts, financial regulations, to name just a few of the details. And it has to work, because lives are going to rely on it. While this kind of website might be simple in concept, the random, contradictory, poorly-specified, "design by committee" project requirements are going to be nasty.

[1] crypto may be different, but very little of what the NSA is currently doing has anything to do with crypto. They don't even need side-channel attacks when it's all in plaintext... sigh

sjtgraham• 12 years ago

FLAG 1 Terminus station on Google maps - https://goo.gl/maps/2kM89. Note the black clad security guard standing watch.

knowaveragejoe• 12 years ago

Well, you'd expect that from any such facility whether it's involved in spying or not.

rl3• 12 years ago

It must suck being the people assigned to damage control on these continual document releases.

I wonder if NSA and GHCQ are changing program code names as they become compromised, or if at some point they just changed all code names regardless. I suspect the latter. If that is the case, I imagine it was probably a bureaucratic nightmare of biblical proportions.

How NSA and GCHQ are tapping internet cables

Related Stories