[intslack]

Guess I should've been clearer: any equipment they're interested in that ships from the US is at risk. They don't need to go after all equipment. They only need to go after equipment being shipped to backbone providers abroad, and specific targets they are interested in that are "tough to crack."

Further, if one believes that TAO is limiting themselves to terrorists buying Cisco equipment, I have a bridge to sell you. That's absurd considering they produly boast about their economic espionage, their spying on activists such as Wikileaks supporters and other "radicals," and their partners bragging about how they DDoS IRC chat rooms of hacktivists.

One example: http://justsecurity.org/2013/11/29/nsa-sexint-abuse-youve-wa...

All of this is summarized in Greenwald's new book.

[csandreasen]

I don't expect them to be limiting themselves to terrorists - they're a foreign intelligence agency. I expect them to be gathering info on foreign governments, militaries, etc. (along with spying on terrorists).

I've written about the NSA porno article before, so I'll just post the link to that thread[1]. The TLDR is that Greenwald seems to have left a good deal out of his reporting in order to both sensationalize and avoid discrediting his own argument. I haven't read his new book; maybe he addresses it in there.

[1] https://news.ycombinator.com/item?id=6885325

[intslack]

No, but that's their justification the vast majority of the time. They don't limit it to foreign governments or militaries either. They do engage in economic espionage, fact. They do single out anyone they don't like which isn't limited to terrorists in these campaigns: "radicals", among them Wikileaks supports, fact.

Stewart Baker has discredited himself[1], his opinion is worth jack shit frankly. I wouldn't trust anything he says, not only because he was behind many of these programs as council but also because of Eben Moglen's interactions with him during the almost-prosecution of Phil Zimmerman, and suggest you do the same.

That the documents are 'sensationalized' is the favorite refuge of NSA goons: when Keith Alexander's comment about collecting it all became public, SEXINT, PRISM, etc. He talks about all of those and leaves no doubt that this characterization is horse shit after the third chapter.

[1] http://www.skatingonstilts.com/skating-on-stilts/2014/04/hid...

[csandreasen]

Wow, thanks for accusing me of being an NSA goon. For the record, I said the reporting was sensationalized, not the documents.

On the economic espionage front, I really don't care if the NSA spies in order to shape national policy. Things get a lot murkier when intelligence agencies spy and then hand off that data off to private companies. Huawei was caught red-handed using stolen source code from Cisco[1]. Cisco probably lost millions because Huawei was able to undercut them and skimp on R&D costs. Frankly, I don't want any foreign companies willing to steal trade secrets managing the same internet backbones I conduct business on, just like China probably doesn't want their internet backbones running on American equipment. If there is evidence that the NSA has been handing Huawei source code to Cisco, or any kind of data to any private organization for that matter, in order to gain a competitive advantage, then Greenwald has yet to show it.

You can consider Stewart Baker's opinion to be worth jack shit, but apparently Glenn Greenwald, Ryan Gallagher and Ryan Grim thought his opinion was good enough to quote extensively for the SEXINT article that they wrote. But that's not even the point - they could have been quoting Glenn Beck for all I care. The issue is that they quoted him very selectively in order to not discredit their argument. That wasn't even the first time: right off the bat they omitted slides from the PRISM presentation in order to make the argument that the NSA had direct access to Google/Yahoo/Microsoft/etc.[2] I can see in the PDF file for Greenwald's book that he still extensively cites the Boundless Informant slides, despite the fact that they've been thoroughly discredited[3]. I'm honestly curious - did he mention that part in the book?

The Washington Post silently corrected their initial reporting without issuing a public statement[4][5], and as far I know Glenn Greenwald has never issued any retractions. I'm sure that there's probably plenty of interesting information in the Snowden cache, but I don't trust most of the reporting up until now.

[1] http://blogs.cisco.com/news/huawei-and-ciscos-source-code-co...

[2] https://medium.com/state-of-play/8ebc878074ce

[3] http://electrospaces.blogspot.com/search/label/BoundlessInfo...

[4] http://www.forbes.com/sites/jonathanhall/2013/06/07/washingt...

[5] http://www.zdnet.com/how-did-mainstream-media-get-the-nsa-pr...

[intslack]

Sorry for the wall of text, but I quoted verbatim from the book below.

>Wow, thanks for accusing me of being an NSA goon.

I didn't accuse you of being an NSA goon. Stewart is definitely one though.

> If there is evidence that the NSA has been handing Huawei source code to Cisco, or any kind of data to any private organization for that matter, in order to gain a competitive advantage, then Greenwald has yet to show it.

What does that have to do with anything? Why is NSA interested in “energy,” “trade,” and “oil” in the PRISM slides? Why is the NSA spying on “heads of international aid organizations, foreign energy companies and a European Union official involved in antitrust battles with American technology businesses.” Why are they “monitor[ing] the communications of senior European Union officials, foreign leaders including African heads of state and sometimes their family members, directors of United Nations and other relief programs [such as UNICEF], and officials overseeing oil and finance ministries.”

The answer is simple:

"When the United States uses the NSA to eavesdrop on the planning strategies of other countries during trade and economic talks, it can gain enormous advantage for American industry. In 2009, for example, Assistant Secretary of State Thomas Shannon wrote a letter to Keith Alexander, offering his “gratitude and congratulations for the outstanding signals intelligence support” that the State Department received regarding the Fifth Summit of the Americas, a conference devoted to negotiating economic accords. In the letter, Shannon specifically noted that the NSA’s surveillance provided the United States with negotiating advantages over the other parties."

It's economic espionage no matter how you spin it. When NSA believes it's pertinent to the "national interests" of the USA, not the "national security" they'll take it.

>You can consider Stewart Baker's opinion to be worth jack shit, but apparently Glenn Greenwald, Ryan Gallagher and Ryan Grim thought his opinion was good enough to quote extensively for the SEXINT article that they wrote.

Two quotes shooting himself in the foot by acknowledging and defending the program is hardly extensively quoting him.

>they omitted slides from the PRISM presentation in order to make the argument that the NSA had direct access to Google/Yahoo/Microsoft/etc.

That was the Gellman and the Washington post that claimed that, without question. The Guardian article framed it as a question. Greenwald never had to issue any retractions.

And just fyi, Gellman is still sticking to the direct access accusations. And Greenwald now thinks that he's right, because analysts can query without staff intervention at Google et al.

I'll quote verbatim from the book:

The companies listed on the PRISM slide denied allowing the NSA unlimited access to their servers. Facebook and Google, for instance, claimed that they only give the NSA information for which the agency has a warrant, and tried to depict PRISM as little more than a trivial technical detail: a slightly upgraded delivery system whereby the NSA receives data in a “lockbox” that the companies are legally compelled to provide.

But their argument is belied by numerous points. For one, we know that Yahoo! vigorously fought in court against the NSA’s efforts to force it to join PRISM—an unlikely effort if the program were simply a trivial change to a delivery system. (Yahoo!’s claims were rejected by the FISA court, and the company was ordered to participate in PRISM.) Second, the Washington Post’s Bart Gellman, after receiving heavy criticism for “overstating” the impact of PRISM, reinvestigated the program and confirmed that he stood by the Post’s central claim: “From their workstations anywhere in the world, government employees cleared for PRISM access may ‘task’ the system”—that is, run a search—“and receive results from an Internet company without further interaction with the company’s staff.”

Third, the Internet companies’ denials were phrased in evasive and legalistic fashion, often obfuscating more than clarifying. For instance, Facebook claimed not to provide “direct access,” while Google denied having created a “back door” for the NSA. But as Chris Soghoian, the ACLU’s tech expert, told Foreign Policy, these were highly technical terms of art denoting very specific means to get at information. The companies ultimately did not deny that they had worked with the NSA to set up a system through which the agency could directly access their customers’ data.

Finally, the NSA itself has repeatedly hailed PRISM for its unique collection capabilities and noted that the program has been vital for increasing surveillance. One NSA slide details PRISM’s special surveillance powers. Another details the wide range of communications that PRISM enables the NSA to access. And another NSA slide details how the PRISM program has steadily and substantially increased the agency’s collection. On its internal messaging boards, the Special Source Operation division frequently hails the massive collection value PRISM has provided. One message, from November 19, 2012, is entitled “PRISM Expands Impact: FY12 Metrics”.

Such congratulatory proclamations do not support the notion of PRISM as only a trivial technicality, and they give the lie to Silicon Valley’s denials of cooperation. Indeed, the New York Times, reporting on the PRISM program after Snowden’s revelations, described a slew of secret negotiations between the NSA and Silicon Valley about providing the agency with unfettered access to the companies’ systems. “When government officials came to Silicon Valley to demand easier ways for the world’s largest Internet companies to turn over user data as part of a secret surveillance program, the companies bristled,” reported the Times. “In the end, though, many cooperated at least a bit.”

[...]

The Internet companies’ claim that they hand over to the NSA just the information that they are legally required to provide is also not particularly meaningful. That’s because the NSA only needs to obtain an individual warrant when it wants to specifically target a US person. No such special permission is required for the agency to obtain the communications data of any non-American on foreign soil, even when that person is communicating with Americans. Similarly, there is no check or limit on the NSA’s bulk collection of metadata, thanks to the government’s interpretation of the Patriot Act—an interpretation so broad that even the law’s original authors were shocked to learn how it was being used.

> I can see in the PDF file for Greenwald's book that he still extensively cites the Boundless Informant slides, despite the fact that they've been thoroughly discredited[3]

How is that? That has nothing to do with whether the US records are correct.

[csandreasen]

> I didn't accuse you of being an NSA goon.

Sorry, I misinterpreted your tone.

> Sorry for the wall of text

No worries - I'm about to post my own. :)

> How is that? That has nothing to do with whether the US records are correct.

I have no idea how Greenwald brought up the issue of Boundless Informant in his book, I just know that I saw slides in his PDF showing the US and Poland (maybe more - I forget). In that series of articles, they seemed to make pretty clear that the program was showing where the collection came from, not where the targets were. So, for example, the numbers from Norway represented communications collected "to support Norwegian military operations in conflict areas abroad, or connected to the fight against terrorism, also abroad". Same with Germany, France, Spain and Italy (I'm probably missing some). When it comes to the US numbers, I don't see that it's that big of a leap to take the same statement that the Norwegian intelligence service made, and replace all instances of "Norway" with "US".

> That was the Gellman and the Washington post that claimed that, without question. The Guardian article framed it as a question. Greenwald never had to issue any retractions.

From the article published in The Guardian[1]:

The National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants, according to a top secret document obtained by the Guardian.

...

With this program, the NSA is able to reach directly into the servers of the participating companies and obtain both stored communications as well as perform real-time collection on targeted users.

With regards to the provider's denials, I don't see anything evasive about them:

Google: "I'm not sure what the details of this PRISM program are, but I can tell you that the only way in which Google reveals information about users are when we receive lawful, specific orders about individuals -- things like search warrants. And we continue to stand firm against any attempts to do so broadly or without genuine, individualized suspicion, and publicize the results as much as possible in our Transparency Report. Having seen much of the internals of how we do this, I can tell you that it is a point of pride, both for the company and for many of us, personally, that we stand up to governments that demand people's information." [2]

Microsoft: "We provide customer data only when we receive a legally binding order or subpoena to do so, and never on a voluntary basis. In addition we only ever comply with orders for requests about specific accounts or identifiers. If the government has a broader voluntary national security program to gather customer data we don’t participate in it." [3]

Facebook: "Facebook is not and has never been part of any program to give the US or any other government direct access to our servers. We have never received a blanket request or court order from any government agency asking for information or metadata in bulk, like the one Verizon reportedly received. And if we did, we would fight it aggressively. We hadn't even heard of PRISM before yesterday. When governments ask Facebook for data, we review each request carefully to make sure they always follow the correct processes and all applicable laws, and then only provide the information if is required by law. We will continue fighting aggressively to keep your information safe and secure."[4]

AOL: "We do not have any knowledge of the Prism program. We do not disclose user information to government agencies without a court order, subpoena or formal legal process, nor do we provide any government agency with access to our servers." [5]

Every one of them is very clear: the NSA needs a court order to get user's data, and they have only complied with orders for specific users.

[1] http://www.theguardian.com/world/2013/jun/06/us-tech-giants-...

[2] https://plus.google.com/u/0/+YonatanZunger/posts/huwQsphBron

[3] http://www.microsoft.com/en-us/news/press/2013/jun13/06-06st...

[4] https://www.facebook.com/zuck/posts/10100828955847631

[5] http://blog.aol.com/2013/06/07/aol-statement-regarding-nsa-p...

EDIT: Fixed formatting

[intslack]

The two statements from The Guardian are referencing the documents themselves. If you want to talk about out of context, you missed the headline and the multiple paragraphs framing it as a question of what the providers say versus what the NSA documents say.

"Direct access," these are the NSA's own words. The Guardian ran the providers statements versus what the NSA documents said. That's a fact. That's why there are no retractions in The Guardian's story, and as Soghoian says they don't actually deny "direct access" in those statements, legally. What's likely is that the companies allow them to run informal searches to narrow the data down.

As for the "court order," they're just talking about a FISA court order which only "allows the data to be queried when there is a reasonable suspicion, based on specific facts, that the particular basis for the query is associated with a foreign terrorist organization," which they readily ignore, and it's more like a general warrant because NSA relies on self-reporting. As Snowden indicated, and LOVEINT showed, analysts can just use bullshit justifications and cover it up. And if they targetted a U.S. citizen, according to their own documents, it's "not a big deal."