I think given the "direct access" note in the slide, SV's weird focus on the word "direct", the name "PRISM", and the outing of AT&T 641A a few years ago it is definitely within reason to assume they're beam splitting the fiber signal at the ISP level. That provides plausible deniability to Google, FB, etc.

What I want to know is how much of that signal are they (a) storing indefinitely, (b) DPI or SSL decrypting, and (c) merely keyword analyzing. If they're storing it indefinitely and/or utilizing SSL MITM then we're pretty much done as far as privacy is concerned. But if they're just keyword analyzing cleartext packets then honestly who gives a shit.

My gut is telling me they're decrypting SSL. FB and Google moved to HTTPS everywhere a few years ago and they're clearly getting this data somehow so...

>"how much of that signal are they (a) storing indefinitely, (b) DPI or SSL decrypting, and (c) merely keyword analyzing.

I think this probably nails it - but in reverse order:

They peel a stream off, keyword analyze it - in conjunction with other weights (i.e. who is talking, to whom, between where, what medium, when (i.e. the meta data)) and then they store the key ones.

If I am talking to my Grandma, the drop it. If I am talking to an unknown number in [foreign country] they test for keywords, if any are hits - they store it and add more meta-data.

I mean - the whole thing is what I understood the Mythical Project Echelon to be -- but there was never any concrete evidence of Echelon to the degree that it was rumored to be, until now.

Now we know that they definitely trap any packet they can wrangle.

The tech side of HOW they are seeing everything is inconsequential to the fact that they ARE seeing everything crossing the pipes.

They do do "upstream collection", it says so in the released slides. However they also do "direct collection" from the webapp companies ("You Should Use Both"), so it doesn't provide SV with plausible deniability.