No they didn't.

"The Guardian has not revised any of our articles and, to my knowledge, has no intention to do so. That's because we did not claim that the NSA document alleging direct collection from the servers was true; we reported - accurately - that the NSA document claims that the program allows direct collection from the companies' servers. Before publishing, we went to the internet companies named in the documents and asked about these claims. When they denied it, we purposely presented the story as one of a major discrepancy between what the NSA document claims and what the internet companies claim, as the headline itself makes indisputably clear:"

http://www.guardian.co.uk/commentisfree/2013/jun/14/nsa-part...

Either way: the original notion that NSA had direct access to the servers that actually operate Google Mail has been found to be unsupported by the evidence published thus far.

I call this out continuously and obnoxiously on HN because it is very much not the mainstream view on HN; most of the people commenting on the NSA story on HN say things that make it clear that they believe NSA continues to have the direct access to Google's systems that Google and the Guardian say they do not have.

You're mincing words. Your comments clearly indicate that you think "direct access" unambiguously means "access to servers that run GMail that the NSA can snoop on any time they like." But from what I've seen, most comments on HN adopt and acknowledge a more ambiguous definition.

The one you propose is the extreme. But other definitions include an interface for the NSA to request data and have it deposited in some "drop box" that can then be accessed by the NSA (all without a warrant). It's reasonable to call this "direct access", particularly if the audience is not tech savvy. (Which is something we don't know.)

Moreover, most folks here seem painfully aware that "direct access" really hasn't been qualified. It seems reasonable your definition isn't really true, but that doesn't mean the Guardian's reporting is incorrect. (The Guardian never put forward a precise definition---either because they didn't have one or were unwilling to release it.)

Personally, I think you are attributing way too much certainty to the HN crowd.

* NSA (or some other USG agency) issues a directive to the provider under authorization from FISA. No court order is required for NSA to issue directives under FISA.

* If the provider is Google, Yahoo, or Facebook†, that directive is reviewed manually by the provider.

* In at least the case of Yahoo, where this step is supported by court documents, but probably all the other cases too based on provider public statements, the provider has the option of refusing to comply with the directive, at which point they send lawyers to FISC.

* For all intents and purposes USG never loses at FISC.

* Some process happens at the provider in which data pertaining to the directive is collected, marshalled into some kind of bundle, and placed on a secure drop box server ("similar to an FTP server"); it is NSA's access to these servers that "PRISM" refers to.

If you're telling me that this is the understanding most HN people have about what "direct access" means, I'd direct your attention to this very thread to rebut that argument. I'm accused upthread of "mincing words" but would respond by arguing that any attempt to characterize the process in this post as "direct access" is a much finer mince; a brunoise of words, if you will.

† Because those providers have publicly stated that.

I'm actually curious how you rationalize this worldview given the bizarre news over the last few days that the Fed is insisting on burying NSA FISA requests among requests from every other law enforcement agency when reporting statistics?

Leaving aside the point that aggregated and anonymized information seems to pose absolutely zero security risk and should not be classified in the first place, there seems a fairly obvious reason for the move that contradicts at least one if not more of your assumptions above.

Put another way, why on earth does NSA seem to care so much about aggregating its FISA requests with other law enforcement agencies when reporting statistics to the public?

This is the only reasonable explanation I can think of for why the NSA would be trying to hide its request volume in the larger volume of overall requests from law enforcement: an attempt to massage the average user-accounts-compromised-per-request downwards when reported to the public. If there are any other explanations you can think of for why it matters how the aggregate statistics are reported, I would be curious to hear of them.

And obviously, abuse of the FISA process renders splitting hairs about what constitutes direct/indirect access meaningless. FISA abuse plus an automated dropbox provides exactly the sort of data access that Snowden and the NSA repeatedly insist they have, while reconciling Google's claims with those of the NSA.

My point isn't that NSA's FISA directives are surgical; like you, I doubt that they are. My point is that upon receiving them, a lawyer at Google approves or rejects them, not a SQL query.

If you read all my comments on this whole annoying story I think you'll find that I'm rarely (maybe never?) sticking up for NSA, but I am happy to stick up for Google anywhere that I can. Google is actually (in this instance) fighting for your privacy, and then getting shellacked on message boards like this; what's worse, they're prevented by the USG from explaining what's happening. They're being equated with companies like AT&T, companies that appear to be sharing bedding with NSA. That belief is wrong, it's unfair, and it's counterproductive.

Your comments have repeatedly attacked the credibility of whistleblowers, derided their claims as factually and technically impossible, and asserted that NSA statements about NSA capabilities are wrong.

> My point is that upon receiving them, a lawyer at Google approves or rejects them, not a SQL query.

I don't think Google has much say in this, but what do I know? Only that your assertion otherwise is in open conflict with claims by Snowden and the NSA officials who have briefed Congress, both of whom tell us that authority over which targets to tap is in practice delegated to security analysts.

I'm glad I'm not the only one who's noticed tptacek's tendency to defend "The Establishment" at every turn, whatever naughtiness comes up. There he goes again. I wouldn't be surprised if he had some ties to the government.

.. While happily shitting on their privacy behind their backs by giving a copy of all their communications to the NSA? -That kind of "fighting"?

Yes, to whatever extent that slide deck said NSA has direct access to the servers that run Google Mail, I am arguing with the slide deck.

Swearing at me isn't the solution in any case. If you want to stop taking flack on HN, you should stop attacking the credibility of whistleblowers on the rhetorical basis that you know more about what the NSA is doing than the NSA does.

It does not follow logically that because one interpretation of an NSA slide deck is that they have direct access to the servers operating Google Mail that that's the only reasonable interpretation of the slide deck. In fact, in the week since we found out about the deck, it's looking less and less and less likely that the original interpretation is reasonable at all.

I don't mind flak (as I'm sure you can tell), but I do mind being drawn into unproductive discussions; when I asked if you disagreed with the post I made above, and you disagreed with only a small part of it in one comment but then the whole premise of it in a later comment, I got frustrated, because why take the time to reply to your comments if you're just going to move the goalposts around?

> when I asked if you disagreed with the post I made above, and you disagreed with only a small part of it

But I don't disagree with your third through fifth statements. I suspect you're wrong to assume that (1) the FISA process is providing reasonable judicial oversight over requests and that (2) providers manually review the appropriateness of individual data requests. As far as the rest goes, this statement of yours is the core point:

> It does not follow logically that because one interpretation of an NSA slide deck is [X] ... that that's the only reasonable interpretation of the slide deck.

Assuming you believe this, I do not understand why you are so hell-bent on attacking Snowden's credibility and dismissing the concerns many other people have raised about excessive surveillance. There are clearly reasonable interpretations of the released materials which make his statements (and those of the NSA and other whistleblowers) perfectly compatible with Google's own statements.

But, then, revelations come out that it is more than metadata being captured. It's actual call content and no warrant is required for a run of the mill "analyst" to listen to those calls.

So, now the goalpost is being moved to whether the NSA has "direct" or "indirect" accesss to gmail servers--a specious and inconsequential debate over some subjective semantics.

What will it take for the apologists to actually grow concerned about what's really happening here?

For me, it's simply a matter of valuing truth over privacy.

OTOH, of course, that posture is all the more stupefying. Which "truth", exactly, is so important that we should all be willing to give up our privacy?

And, how is it that you find it so easy to trust our government with such power? After all, if it is untoward human beings who make truth-finding so difficult that these drastic, privacy-defiling measures are necessary, then why do you have so much trust for other fallible human beings to wield this power?

I don't trust them to wield that power because I don't need to trust them. I hope that by wielding that power, they destroy it by making it clear to the world that privacy no longer exists.

> Because the same legal standards that apply to phone calls also apply to e-mail messages, text messages, and instant messages, Nadler's disclosure indicates the NSA analysts could also access the contents of Internet communications without going before a court and seeking approval.

Meaning the US Gov't believes it has as much legal right to access e-mail as it does phone calls. Claims that they've done so in the same way (that is, in massive numbers with very little oversight or attention) are speculation. As more evidence begins to surface, it seems like telephone companies like AT&T and Verizon have been far more complicit in the NSA's indiscriminate surveillance programs than companies eg. Google that control e-mail - when's the last time you saw AT&T publish a transparency report detailing government requests for user data?

The slide deck was always very ambiguous. But it was very interesting that it said that analysts should use both methods (PRISM and interception)

I'm not at all saying that. I'm saying that most HN folks do not share your definition of what "direct access" means. I specifically said that it seems like most people are quite aware of the ambiguity of the meaning of "direct access" in a couple slides and that we can only guess at what it precisely means.

Your comment clearly indicates otherwise:

    Either way: the original notion that NSA had direct access to the servers that 
    actually operate Google Mail has been found to be unsupported by the evidence 
    published thus far.
    
    I call this out continuously and obnoxiously on HN because it is very much not 
    the mainstream view on HN

Undeniably. What tptacek thinks though is that those people are "most" people on HN.

burntsushi thinks this is plainly false, and I agree with him. I think tptacek is seeing whatever it takes to stroke his ego.

That doesn't change the fact that they're wrong.

Google couldn't possibly give the NSA "direct access" in the way you're defining it without creating a subsystem to service it--like, say, a secure staging server that requires being populated by processes which run and pull the data from disparate parts of their system, whose access would most easily be accesses via FTP. Anyone technologically literate who considers what "direct access" could mean deeper than a surface level should arrive at the obvious conclusion that "direct access" does not mean the Google equivalent of a MySQL console.

For most of the world -- those who have never SSH'd into a machine, nor had machine 'root' access -- that rapid-batch-dump access still would be fairly described as "direct access". Word meanings vary based on context and the expertise of the discussion participant; the slide deck and the journalistic reports were all written at the level of fuzzy understanding, not technical precision. Practitioner nitpicks about the implementation details don't refute them.

You keep implying that The Guardian is making unsubstantiated claims, but their article is full of "NSA claims" and quotation marks, and it would take someone intentionally trying to read something else into it to ascribe these claims to The Guardian.

Are you claiming The Guardian is lying or mistaken about what the NSA documents says?

Because if you are not, then your beef should not be with The Guardian articles, but with the NSA documents.

It's possible the NSA documents are technically incorrect, but if that is what you believe, then complain about the NSA rather than attack the reporting, as in that case attacking the reporting just seems like a weak attempt at making your arguments seem more credible by attaching the claims about "direct" access to the reporters rather than the NSA.

Yet, you are arguing some mundane semantics?

Instead of smearing the people responsible for these revelations, why not try to focus on the big picture? That is, all of this is leading to long overdue appropriate dialogue, that is engaging our representatives in the oversight that is required to uphold our Constitution. Big picture!

You think these are mundane semantics. I think they're more meaningful than that. People on HN can't get me to shut over the right fix for a CSRF bug or how taxicabs can be licensed; why would anyone think I'd back down on an issue like this?

In the absence of more evidence about what exactly PRISM does, what we have is guesswork, but guesswork where believing some interpretation of the NSA documents becomes easier the more revelations of extensive NSA surveillance via other channels that are coming out.

For all the promotion they put into two-factor authentication for account-safety, "suspicious login attempt" notifications, etc, if they had done the same for GPG in GMail/Chrome, that would have been a huge step towards giving the mainstream a taste of actually being in control of their own privacy, I'm not saying we wouldn't have this problem right now, but we'd be in a way better position of dealing with it, for sure.

edit: to be clear, that is one of the many reasons why I think this arguing about whether this access is "direct" or whether it's "sorta kinda direct" distracts from the real issue: access.

And like you yourself mention, to add security to prevent automated hacking scripts from 0wning accounts to add to a botnet (attempts that happen orders of magnitude more often than an NSL or FISA warrant) they have to add IP tracking for individual accounts.

You talk about GPG but there's little safe way to do that from client-side JS, would defeat most of the point of offering free email for Google in the first place, and is already supported just by offloading that onto a real email client.

Here we have revelations by the NSA, that analysts can listen to anyone's phone calls. In America. This subverts just about the entire spirit of the Constitution and some of the letter.

But, you would rather spend your time isolating some relatively minute detail that Snowden or others may or may not have gotten wrong.

And the thing is, neither you nor anyone here even knows enough to draw conclusions as to these minute details. A few weeks ago, we didn't know that the NSA was collecting metadata on so many calls. A few days ago, we didn't know that analysts were eavesdropping without warrants. Yet people like yourself would argue vehemently on behalf of the government. The more that comes out proving you wrong, the more you dig in and move the goalposts. It makes one wonder what the government would have to do to actually concern you.

And the thing is, while you argue things you couldn't possibly know, there are now enough solid facts coming out (including admissions by the NSA) that should be of grave concern to you. Yet, here you are again focused on trivial, unprovable details.

I won't argue the subjective notion of whether the details are mundane. That's opinion. But, I don't understand how anyone can have such a skewed sense of scale when comparing the relative importance of what you choose to argue versus that of the astonishing revelations being brought to light about our government.

When the FAA was first enacted, defenders of the statute argued that a significant check on abuse would be the NSA's inability to obtain electronic communications without the consent of the telecom and internet companies that control the data. But the Prism program renders that consent unnecessary, as it allows the agency to directly and unilaterally seize the communications off the companies' servers.

Every part of this graf appears to be false!

The phrasing "directly and unilaterally seize" seems exaggerated given the preponderance of current revelations and denials, but if Prism includes other not-yet-revealed acquisition methods, might still be substantially true. After all, the denials you're relying on are from company leaders who also said they've never heard of Prism.

I can believe Greenwald got overexcited in that phrasing, and trusted the slide deck (including as-yet-unreleased slides) too much. Just like perhaps Obama was a bit clumsy and overeager to reassure with his phrasing, "Nobody is listening to your telephone calls."

It bothers people that the USG virtually always wins these cases. But I think it shouldn't bother people as much as it does, for a couple of reasons:

* It's also the case that state governments win most attempts to get Title III wiretaps; in those cases, it's because getting a Title III wiretap is an expensive process that involves a shitload of paperwork, and prosecutors don't waste the time going for them unless they're sure they're going to win. It appears easier to get a FISA directive upheld, but it's not free.

* It's what you'd expect to see happen if the USG was only using FISA to conduct foreign surveillance, which, while I wouldn't take NSA's word for it, is not at all hard to believe; what is the motivation for them to set up a paper trail with the FISC of doing something else?

Yes, but that's close to being a tautology: what outlandish claim might not turn out to be true if in future startling new revelations supported it? In fact, direct access in the NSA-has-root sense is less likely in light of the PRISM slides: why file 702 orders and dicker with webco lawyers if you're able and willing to get whatever you want through some kind of back channel? Why create a Top Secret overview and training resource for Internet surveillance and apparently not mention this backdoor?

So while of course, we can't assume every covert acquisition method darkly imaginable is happening, it would also be foolish to assume that exactly what has been clearly documented so far is the full story.

Why the trouble of extra legal orders and a paper trail if the NSA already had deeper covert access? Well, the government isn't efficient and different levels can't always work together. For example, why did the DoJ use more normal procedures to get AP phone records, when the NSA already had all that data? Also, when you have a treasure trove of info obtained in illegal ways, or in ways you don't want to admit, and you want to act in ways revealing that you have that info, you can try to get it again in a second, redundant way: one that you can explain, and maybe legally rationalize.

And when nobody inside or outside your organization has the whole picture, the fact that there's some legal process for getting some info from, for example, Google, might serve as plausible cover deflecting questions about how exactly so much more info winds up in the system.

In fact, that's one possible mechanism for the PRISM slides' author thinking that the access to Google et al is so much more powerful and 'direct' than the companies' own measured response process can explain. They're each blind men feeling different parts of the elephant.

And unless I've missed some major revelation, it "appears to be false" on the basis of press releases from companies with an interest in not being caught with their pants down.

Forgive me for not being so willing to jump to conclusions about which claims to believe.

E.g. "direct and unilateral access". Unilateral means exactly that only one party needs to decide, the reality is that it is bilateral access (both parties must agree).

So that's at least one thing Greenwald managed to screw up in his "book review" of a single slide. The question is whether blame lies with Greenwald alone, or if Snowden mislead him into that by stupidity or malice.

How do you know this on the basis of the slides alone?

As far as I can see (IANAL) most forms of FISA order do require a court order. FAA 702 orders are issued by the government rather than the FISC court, but still have to be reviewed and approved by the FISC. It's just that the nature of the court's review affords no protection to non-resident aliens (except by chance).

> For all intents and purposes USG never loses at FISC.

Well, it has lost at least one signficant case at FISC, it's just not letting us see the ruling.

"NSA Prism program taps in to user data of Apple, Google and others • Top-secret Prism program claims direct access to servers of firms including Google, Apple and Facebook • Companies deny any knowledge of program in operation since 2007"

The first sentence states:

"The National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants, according to a top secret document obtained by the Guardian."

Emphasis on according to a top secret document obtained by the Guardian. If you read on, the content of the article supports this title and summary. It doesn't matter what Emily Bazelon has said, it don't matter what others have said, and it certainly doesn't matter what the mainstream criticism is when determining whether or not the statements in the article are accurate. The slides say the NSA can "collect data directly from the servers" of these companies. Guardian states the the slides state that the NSA can collect data directly from the servers of these companies.

That is a demonstrable fact. In fact, I just demonstrated it.

Now, I'm in the camp of people who think that whoever wrote the slides just didn't know what they were talking about. Neverthess, I'm also in the camp of people who think that the Guardian was accurate in their reporting--because the reporting is right there to be read.

We could, of course, argue over the congruace between the phrases "direct access" and "collect data directly from the servers," but you said you weren't interested in semantics.

[1]: http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-n...

The slides do say the NSA can "collect data directly from the servers" of these companies. (Well, they say that the NSA uses "collection directly from the servers" of these companies, to get the quotation exactly right.) But the Guardian stated the the slides state that the NSA has root access (or similar) on the servers of these companies. It was wrong about this.

The Grauniad didn't publish a story saying "the NSA has a PowerPoint presentation in which the phrase 'collection directly from the servers' appears, but we do not pretend to offer any interpretation of what may have been meant by this". What it published was a story which said (in paraphrase) "the NSA has a PowerPoint presentation in which the phrase 'collection directly from the servers' appears. What the NSA means by this is that it has root access on Google, Facebook and friends." The NSA writer was correct; the Guardian's reporting of what he said was wrong, both in the sense that it misreported what the NSA writer was claiming, and the claim it misreported him/her as making was (unsuprisingly) untrue.

It's quite possible Guardian journalists and editors summarised some points in a sloppy way due to lack of understanding (in particular using direct access instead of directly from), but the broad thrust of everything I've read from them has been surprisingly accurate (as journalism goes), and Snowden's claim to have access to any account at will (given enough clearance) is now sounding far more plausible after these recent revelations that calls recorded and can be accessed without a warrant by any agent with the clearance to do so, and according to cnet, perhaps emails too. To an analyst asking for calls/emails, this would seem very much like 'direct and unilateral access', even if from google's end they only respond to lawful orders and don't allow universal tapping as the phone companies do.

I'm surprised that people are talking up minor quibbles over the interpretation of one slide as if all debate hinges on them given the scale of the surveillance which has been exposed. We don't know for sure exactly how the PRISM process works, and what matters is not the process but the legal safegaurds in place (or lack of them), and the extent of surveillance. Why not debate facts we do know and have confirmed?

The story made it sound like an NSA analyst could just open an xterm and copy any data about any Google/Facebook/Hotmail/Skype/etc. user, whether the company agreed or not. That is the part that is not only false, but which Greenwald has refused to back down on by just pounding the slides over and over.

I don't know why I'm so surprised that a writer reporting on tech-heavy privacy issues would be so clueless about technology but it just gives me even more reason to be jaded about activists in general.

Oh well, at least we still have the EFF and ACLU.

Since Greenwald provided the sources for his statement and the article clearly indicates which quotes are attribution and which bits are commentary I didn't interpret it the way you did, and do think it's highly misleading to characterise this as a fundamental flaw in the article, or as something the guardian has 'walked back' - the guardian is not a monolithic entity and features content from all sorts of contradictory viewpoints. The writer wasn't clueless about technology necessarily - remember this sort of writing goes through many hands on the way to publication, and attempts to synthesise knowledge from various sources for a non-technical audience, while not revealing damaging details which could leave them open to prosecution. That process is going to result in text which is not as precise or illuminating as we or the writer would like.

So I'm all for correcting reporters like Greenwald where they over-reach or imply too much, and I do think he should have clarified this particular detail which has been left very vague, but we should clarify or correct, not attack and patronise, reporters who don't specify technical details, and bear in mind that technical questions of mechanism are not the only story here; there are far more important legal and ethical questions.

> In a statement, Google said: "Google cares deeply about the security of our users' data. We disclose user data to government in accordance with the law, and we review all such requests carefully. From time to time, people allege that we have created a government 'back door' into our systems, but Google does not have a back door for the government to access private user data."

A backdoor pretty much implies unfettered (as well as clandestine) access - a limited-privileges backdoor is conceivable, but unlikely. Note that the Guardian didn't say 'here's a weaselly statement that doesn't deny what we're alleging' - it said 'here's a denial of what we are alleging'.

'In a statement, Google said'

You paraphrase this as the article saying:

'Here's a denial of what we are alleging'

The article said or implied no such thing, as your direct quote shows, it merely attributed the quote, without comment. It didn't talk about back doors or denials, Google did, probably in response to more fantastic speculation around the Internet prior to this.

In the interests of precision, let me first amend the Guardian non-paraphrase and paraphrase above to 'here's a weaselly statement that doesn't deny what the NSA document claims' and 'here's a denial of what the NSA document claims'. This matters because the article deliberately sets out to report the NSA slides instead of setting out to explicitly report the NSA slides as accurate, and Greenwald later made much of this.

> The article said or implied no such thing, as your direct quote shows, it merely attributed the quote, without comment.

The immediately preceding paragraph is:

> Although the presentation claims the program is run with the assistance of the companies, all those who responded to a Guardian request for comment on Thursday denied knowledge of any such program.

This makes it clear that the next paragraph is, to the Guardian's understanding, Google denying knowledge of any such program.

Personally I thought the article did an OK (though far from perfect) job of summarising the puzzling gaps between the slides and the company statements, and didn't imply all the things people have read between the lines, but wish it had gone into more detail, however I don't feel that's a hugely important part of this story. It sounds like we might hear a bit more detail over the coming weeks.

This just simply isn't true. The article doesn't say that. Your support for this claim below is that this is what they meant by "direct and unilateral," which you cannot know to be true.

If Google et. al. setup dedicated servers which aggregate the relevant user data the NSA wants, and gave the NSA FTP access, then this would be--by definition--direct and unilateral access. FTP falls under any reasonable definiton of direct, and Google would not have to be involved in any data transmission, thereby making it unilateral.

And can't we all just agree that the idea of giving root access is so outright ridiculous that nobody would intend that as a meaning? Maybe read only access, but root access? Ridiculous.

The simple case is that of the NSA document ("collection directly from the servers of these US service providers") against google ("The U.S. government does not have direct access or a “back door” to the information stored in our data centers"). These are two competing claims, neither of which have been supported by evidence and hence the burden of proof rests equally with both cases.

Anything else (By the Guardian, Slate, the 'mainstream view on HN' or yourself) is purely speculative.

You seem to place the burden of proof on one claim over another and hold a very specific view on what 'direct access' means.

You also seem to hold a strange interpretation of the Guardian's reporting, but I won't get into that as its largely immaterial to the real subject.

Steve Gibson has proposed a scenario that makes both claims credible: that the NSA has installed fiber optic splitters (hence the name "prism") directly upstream from Google, Apple, etc and therefore can sniff all the packets headed to their servers without their knowledge.

Notes from Gibson's podcast: https://www.grc.com/sn/sn-408.txt

This scenario would be a large expansion of what Mark Klein testified was being done at AT&T in 2006 (https://www.eff.org/files/filenode/att/presskit/ATT_onepager...). It would also explain why the NSA slides showed service providers being added gradually: it would take time to carry out these secret installations.

If Gibson's analysis is right, Google et al would have no knowledge of the taps, yet the NSA would have most of their traffic.

Yes, SSL traffic is still impenetrable. However, 1) it can be stored for cracking in the future (perhaps in the Bluffdale facility) and 2) lots of traffic, like email traveling between hosts, is not encrypted.

I appreciate that it seems you are responding to a lot of comments but I really find this comment lazy and borderline offensive.

They don't.

In NSA-speak this is "collection directly from the servers of $FOO" because there is no wiretap or other SIGINT or ELINT shenanigans. They ask, or the FISA Court compels by warrant, for a company to turn over information they have, the company sends it over electronically.

Prism, on the NSA end, takes care to feed that information that is sent over to whichever analyst is working the case, patches up company-specific details so the analyst doesn't have to worry about it, etc. But they don't have feelers onto every datacenter owned by those 9 companies so there is no "direct access to data", as has been errorneously and loosely parroted around.

I'm not trying to single you out, sorry.

To me the terminology of the document probably (though not necessarily) indicates something more serious, but I'm not sure its necessarily 'cables into gmail' (which you seem to indicate as the only alternate). For instance, potentially someone working for Google may transfer selected records out manually without the knowledge of Google.

Thanks but I'm not so concerned to be 'singled out' as 'lumped in'. I want to get to understand your views more than simply disagree. I hope my previous posts haven't seemed too argumentative either.

Other reports have corroborated this.

Declan McCullagh, who has covered this beat for CNet for something like 10 years and is most notable on HN for jumping into threads and arguing the EFF's side of any given story against me (in other words: not a guy prone to support of the establishment), ran a story last week with sources that also denied that NSA had unilateral access to Google Mail.

The NYT just a few days ago ran a story with a linked FISA court order that documented Yahoo's attempt to push back on a FISA directive, a process that would not have been necessary (for the government) had NSA had direct access to Yahoo's servers; the court order demanded that Yahoo turn over data.

And, of course, Google categorically denies that NSA has direct unilateral access to their servers and, for that matter, that they've been able to obtain records for large fractions of their user base. Those denials have come from multiple levels of the company, from the CEO to the General Counsel to their tech leaders to people on their security team.

I'm not simply supposing that NSA doesn't have this access. Based on the evidence available, I am drawing the obvious conclusion that they do not.

That would not contradict the Guardian reporting, or even what the NSA's slides claim.

The rest of what you state also does not contradict Guardians reporting: They make specific claims about specific subsets of these companies data.

You keep arguing about an expansive interpretation of the reporting even when faced with much more restricted alternative interpretations.

When comes to relying on press releases with denials, I'm clearly more cynical than you - I assign them pretty much zero value as evidence. I'd expect these companies to issue denials whether the claims are true or not, so I don't see the press releases as containing any useful information to draw inferences from.

Anyway, I've disagreed politely with <tptacek> before, but he is 100% correct here.

(Further, the fact that Greenwald couldn't figure this out from looking at the You Should Use Both slide by himself - instead, actually producing the slide in the belief that it was evidence which undermines the FISA-API theory - and still can't or won't get it after having it explained to him, undermines the thesis that he's both able and willing to interpret the PRISM presentation carefully and accurately. Though he wasn't the only journalist to (apparently) misinterpret the "direct access" claim at first.)

I'm not sure on the requirement for a FAA702 directive to be issued to Google however. Surely the upstream operations (which come under the same heading of FAA702 in the slide) don't require a FAA702 directive? I'm no expert but the directives seem to serve as a means to access the information, not as a necessity for disclosure of information should it be available by other means....

No evidence has been published, and who is talking about Google Mail anyway?

I'm not averse to all semantic arguments.

Whether the initial reports were 100% accurate or not is irrelevant. What does matter is that this now out in the open and hopefully something changes.

Moreover, it's not meaningless whether its illegal or not. Indeed, it makes all the difference in the world. Laws can be changed if we don't like their outcomes--a government that's ignoring the law is something else entirely.

It is a peculiar brand of corporatism that thinks the privileges afforded to corporations should somehow be considered when talking about the privileges given to governments. Quite the opposite of what one normally sees, but still curiously the same.

Is there a more direct, refutable way you could construct your claim? How would anyone falsify your argument otherwise? You know what else is a (very) peculiar brand of corporatism? "Not corporatism".

A traditional corporatist could be accused of trying to bring corporations up to the same level as governments. Rayiner seems to be playing at the idea of bringing governments up to the level of corporations. Despite appearing to be opposing positions, it should not take a rocket scientist to find the common ground.

Of course if you have no interest in doing so, it should not be surprising that you won't.

Back to the point: people freely give their personal data to Facebook. Facebook now knows that information and can publish it, sell it, whatever. The people have no expectation of privacy which would be necessary for a 4th Amendment defense. Anybody can go to Facebook and just ask for the data, government agents included. It is Facebook's choice to give it away, set a price, or refuse.

Ah, I was wondering why you were doing this.

Personally I prefer to believe, when it is hinted that the NSA might have access to my emails, that this is true and later be proven wrong (which IMO hasn't been done conclusively yet), rather than the other way around: assuming everything is fine, and then piece by piece being proven wrong as more evidence trickles in.

Note that the above is a hypothetical example, since, being a EU citizen, I already know for a couple of months that the NSA in fact does have the ability to request any of my data without a warrant, given that it resides on a US server.

... Come to think of it, could it be that also influences your perception of what is "the mainstream view" on HN? A lot of people do not explicitly state they are not US-citizens every time they mention how upset they are the NSA can read their emails.

The gov't somehow manages to compel people to lie despite the absence of some "Federal Pants on Fire Act"

1. Place a Warrant Canary.

2. Receive NSL.

Even those who've conceived of the Warrant Canary know that it depends upon the notion that the gov't will not coerce the NSL recipient to leave the Canary unmodified.

We don't have to use the Warrant Canary hypothetical to see that the US gov't has in the past used force to compel individuals to lie in the furtherance of its goals. Police forced Rachel Hoffman to arrange a drugs buy and wear a surveillance device to the proposed exchange. This is a common police practice carried out by government agents at every level of government. If the government will use such tactics for drugs, they will most certainly use them for national security.

I didn't say that the NSL compels each recipient to lie, in every case. I said the gov't can and does compel individuals to lie. That's not a "fictitious belief" it's a fact. Then I offered a concrete example of widespread gov't conduct supporting that claim.

If you keep waiting to see it spelled out in black and white, "Be it ordered on this day the NSA under the authorization of Congress and President Obama (with all their signatures) that you shall go on the Today Show and Charlie Rose's show and tell everyone that we can't read everyone's email and that we're all a great bunch of guys." you're likely to have to wait a while. You're being obtuse and I think you know that. It probably works well in other areas of your life, but it makes you ill-suited to make judgments about non-trivial issues because it is rare that all relevant facts become obvious as an atomic operation.

Evidence being "Google denies it"?

I think your analysis is perhaps being biased a bit by the idea that dealing with all the email data would be massively expensive.

Also, consider that phone companies already have existing government granted monopolies, while companies like Google and Facebook are significantly more vulnerable to bad press or some kind of disruption triggered by public mistrust.

Hence one possible strategy for minimizing the impact of Snowden's revelations would be to admit to the phone aspect of the powerpoint and to drastically minimize the relationships with web companies.

Also considering the power of ad network cookies and the amount of information stored, the intelligence value of internet companies' data dwarfs the value of phone call data by several orders of magnitude.

The Guardian has reported that an NSA document says they do, and that Google says they don't. As far as I have seen, the Guardian has not made a claim either way.

You choose to trust Google. A lot of other people here choose to trust the NSA documents more.

My point is that it is irrelevant whether it is true or not that NSA has capability to access to all our emails. The key is whether our legal framework allows that or not. My understanding is that NSA can collect all the data it needs (emails, phone calls, etc.) and they will not break the law - even without FISA court order. So maybe the law needs to be changed...

Stop making one then.

Greenwald is saying, in effect, "Well, I'm not saying the NSA does or doesn't have direct access; I'm just telling you that I saw a powerpoint slide that says that." Uh huh.

Basically I'm agreeing with tptacek's downthread point: the slide deck claims "direct access", but other than that slide deck, there has been no evidence to support this, and some evidence against it.

As I've said before, I think we should assume that slide deck is a little hyperbolic. This is a deck that claims you can real-time monitor all communications in the world for only $20M. I'm not saying it contains no truth; I'm saying it's a _slide_ _deck_.

Also, btw, the Greenwald article you quote is not his finest. From what I've read in the last two weeks, I respect his agenda, and I respect his efforts to air this story, but some of his self-analysis is seriously lacking. If you're interested in my extensive dissection of that article, https://news.ycombinator.com/item?id=5884619

Meanwhile, its also fairly obvious that some security folks sympathetic to the NSA have your ear. You like them, you respect their skills, and social heuristics dictate that you give their opinions due weight. They haven't been overly impressed with the recent leaks and reportage, and why not--we always bristle when the media covers something near and dear, and bristle again when it is sympathetic to the wrong parties.

Back to the contents of email again. How, precisely, it is done is of course very interesting but also an implementation detail. The fact is this kind of content would have been considered very valuable, and therefore effort would have been expended to a) explore the options and b) make it happen.

If you go back over the past few years of leaks, a recurring theme is, it has happened, and it appears to have been achieved via legal compulsion plus some fairly vanilla engineering. However, we may also assume that any serious collection effort would necessarily include redundancy of methods, so if for some reason legal compulsion were to end, the collection could still continue. And this is were we find ourselves today: legal collection at nominal risk, but the program itself secure.

And we know we are here, not from any one specific claim (possibly garbled, possibly wrong), but from the pointillist painting rendered by years of such claims, where the negative space provides as much structure as the positive. So yeah, you don't like Greenwald et al on aesthetic grounds. But Greenwald is also irrelevant to the overall narrative here, which is "when we became cognizant of our pervasive surveillance." Why would they not have the contents of email?

EDIT, quick, and not to make a thread of it: a) NSA is the referent to tea-leaves, not you; b) the rest is advice; and c) lol.

And you know this...how exactly? I can't say they do but it wouldn't surprise me. To say that they don't however is a different story. What's the difference between phone metadata http://www.slate.com/blogs/future_tense/2013/06/06/nsa_veriz... and email metadata? Why one is OK and the other is not, assuming NSA goes to court to get them? In fact, emails over 180 days have very little protection.

Now we know that the Obama administration and NSA intentionally lied and mislead the public. I am certain that with a little bit of luck we will find out how NSA email hacking works in practice. So far the smoke seems long from settling.

Based on how the Obama administration and NSA is handling this issue I see very little reason to expect anything else than the maximum level of intrusiveness possible.

If the law is that the NSA just has to request it, no warrant necessary, there you go.

Furthermore, the IRS appears to operate under the assumption that no email is protected.

> New documents released to the ACLU under the Freedom of Information Act reveal that the IRS Criminal Tax Division has long taken the position that the IRS can read your emails without a warrant—a practice that one appeals court has said violates the Fourth Amendment (and we think most Americans would agree).

http://www.aclu.org/blog/technology-and-liberty-national-sec...

Also, I don't necessarily buy this. I don't think Google's denials are lies, as Google is not a single brain, but thousands of individuals. Hard to prove a negative.

Moreover, having obtained this illicit access, in direct defiance of the corporation that owns and controls those servers, their use of that access is so routinized that it appeared in a "USE BOTH!" Powerpoint deck for NSA analysts?

I think that some of those people have knowledge of a secret program that enables access to the data (maybe without direct access to the servers that house it). That would make it easier to manage without having to bring all the SREs and such into the conspiracy.

I think that most of those people would not allow their lives to be destroyed with federal charges (or maybe even extralegal harassment, who knows - they do run secret prisons) in the process of reporting such a thing.

Tens of thousands of others have chosen to keep quiet about NSA's extralegal collection practices (from the contractors at the IXes installing beam splitters, to the mechanics who welded the fiber grabber arm onto the nuclear sub). Why is it such a stretch to think that 3 or 5 or 10 at Google wouldn't?

It's not even a stretch to think that NSA would have done their homework to know _which_ people inside of Google would be both able to participate and could be coerced into keeping quiet.

People that think the "manual" part in that last sentence doesn't matter should read the court order in the Yahoo case the NYT reported, where Yahoo went several rounds with NSA and the FISC to try to fight a specific FISA directive.

Note that Google, Facebook, and Yahoo have all taken pains to point out that they've pushed back on FISA directives. Which is something you can't do if the system isn't manual.

Just because they've pushed back doesn't mean the system isn't automated. It could have been a matter of "implement the automated system now, per the FISA order, and then we can have a go-round in front of the FISA court with your objections after".

This is military intelligence we're talking about here, they take their mission very, very seriously. I wouldn't be surprised if there were multiple, independent, redundant programs for monitoring this data.

† ... we think; the ultimate Constitutionality of this is up in the air.

1. Google is lying. 2. Prism (or the backend thereof) is genuinely unknown to most Google employees. Those few employees who do know of it are lying. The others (i.e. legal) are ignorant because they have no need to know, and because it provides plausible deniability. 3. There exist NSA agents capable of passing a Google interview and installing backdoors, perhaps with the collusion of other agents.

Companies the size of Google are, in software terms, Borg cubes of interacting systems. No one comprehends the whole thing, and some degree of secrecy between services is normal. Who would notice if, say, Gmail traffic was being replicated onto NSA-controlled hardware? A small part of a small part of the Gmail team. No one else would likely notice even if it was done in an obvious way.

Is it plausible that having gained that access, their use of it is so routine that it has an official name ("PRISM") and a logo and appears in slide decks targeted at NSA analysts and is used a program whose existence is known outside NSA (there are DOD manuals that refer to the same PRISM program)? No. That is not plausible.

We don't know the intended audience of the slides, either, though with a data source as rich as all of Gmail, presumably there'd be tons of analysts capable of accessing it or else it would just be a waste.

I don't see this hypothesis as being anywhere outside the wheelhouse of the NSA. Even outright infiltration (i.e. the hypothesis that not even Page is in the know) is, well, kind of the point of intelligence services, but it's not necessary.

Your point, though, absolutely stands.

FWIR, Google enforcing HTTPS connections to gmail is pretty recent as well: since firesheep, so that's another vector for someone who can read data from the wires.

But I'd be very reluctant to conclude that the NSA doesn't have clear-text for the vast majority of email that gets sent.

Google and other email providers have denied giving the NSA access to their servers, but if you think about it, that would be a lousy way to share data with the NSA, from a purely technical point of view. A company like Google is going to be constantly evolving their infrastructure. Giving the NSA direct access to the servers hampers that, because they'd have to break compatibility with whatever client software the NSA is using. It'd be easier to just send copies of all email that moves in and out of their system to the NSA and let them sort out how to process it. That would be more convenient for the NSA too.

Beyond that, all the denials issued by Google, Facebook et al mention that they do provide the government with information as required by law. We know that there are secret laws at work here, and if the law requires companies hand over everything, then that's what they're doing. The may even be required to lie about it. They're definitely absolved of any legal liability for doing so. I don't doubt that internet companies try to protect their user' privacy as much as they can, but that may amount to "not at all" where the U.S government is concerned.

But even if Google isn't obligated to lie, it might still be lying.

Maybe Google is lying, not because it's obligated to by the law, but because it's immune from the consequences of lying and the government is leaning on them in other ways.

Maybe Google is afraid of the backlash that will follow if they don't lie.

Maybe Google has carefully written their denials to be technically true, but still hide the real extent of the data they're giving to the NSA. This was my original point, which you completely ignored.

And yes, maybe Google is being completely forthright.

We have very little information, and information we do have may be wrong. Given that, I don't think it's wise to conclude that transmitting email over an encrypted channel is enough to keep out of the hands of the NSA.

> NSA doesn't have Google's private key.

And socks come in pairs.

Second, it's unfathomable to me to imagine the NSA isn't doing their damnedest to obtain all private keys. I have no idea how many they do have, but it seems foolish to assume they don't have a specific private key.

Why do you think the NSA would regard private keys as some kind of sacred ground? For example, they could go after it the same way the Chinese do - phishing attacks against employees. They most certainly use those techniques outside the US, how can you be sure they don't within the US?

I could never pretend to be sure they -are- doing it, but it seems a lot more difficult to be sure they -are not-.

(Here it's worth noting that mail between Google Mail users doesn't ever hit the public Internet in plaintext SMTP).

I do not think it's unfathomable that NSA has Google Mail's public key. I do think it's unfathomable that, having illicitly obtained that key, their possession of it wouldn't be one of the most closely guarded secrets in the agency.

The term "direct access" may have been fuzzy speak, and indicative of an "impedance mismatch" between what different concentric layers of the NSA knows. The author of the PRISM deck understood it to be "direct access" based on what he'd been told, and the low-lag operation he'd seen. But perhaps that was still be FISA-order based, just really fast: an analyst flags a name at their terminal. The name is forwarded the Google and the FISA court. Google does its "review" but knows a request of exactly this specific form always wins -- they don't get to challenge the reasons for the request, which they don't even see. Now it's 'reviewed', the SFTP dumps begin... but they aren't one-time, but perhaps daily... or even hourly or faster... to keep up with the target's ongoing mail activity. (They didn't go through the trouble of using one of their thousands of requests just to get old activity, did they?) To the PRISM deck authors, that still feels like "direct access" – and colloquially, it is.

But given compartmentalization within the NSA, what if some of the data is arriving via another, deeper capability? The PRISM deck author, the average analyst may just think it's from the other process. It's not their business to know more; the rows/records appear in their tool, and they get on with their work, happy for the bounty of info from other 'acquisition' programs which sometimes (often!) work in mysterious ways.

Main point - I'd be willing to bet that the NSA collects as many private keys as it can. Can't prove it, don't need to. I'll conduct myself as if they have all the private keys. That's a loss of freedom, and that's not what the authors of the fourth amendment intended.

The same technique used by former CIA Director David Petraeus and Paula Broadwell to communicate.

SSL and TLS are for the purposes of this discussion the same thing; the distinction between the two is actually less important in SMTP than it is with HTTP.

You could more easily and credibly argue that NSA has solved the conventional discrete log problem.

I can't speak to a slide deck; We've only seen some slides for one program (PRISM). I am quite sure that NSA has several different programs variously encompassing collection and decryption. Hopefully in the next few days or weeks we'll see details about more of them.

I don't think it's beyond the realm of possibility for a nation-state adversary with a ca. $10bn annual budget (that happens to be the same country where Google lives) to get a copy of Google's key, no.

This is how other hacked SSL certs have been caught in the wild, remember? Do you think Iran has more GMail users than the U.S.?

Even my own S/MIME private key the NSA wouldn't be able to get a hold of without actually having to take my smartcard, and I'd certainly notice that.

Either way, there's something that the NSA has actually screwed up so I'm honestly a bit surprised that people are still arguing so much about a FISA compliance API. That horse is already essentially dead and buried. So dead and buried that others are saying that tptacek is tearing down a strawman for still mentioning it...

I'm sure there are browsers out there that won't negotiate PFS DHE modes with Google (which were only enabled a year ago serverside anyway). NSA has had long-haul and undersea fibers tapped for many years.

Cert pinning won't help because it's not MITM.

But everything that is plausible is not probable.

Do we not? The only reason to think that the situation for Google and DDG is different is that DDG may be insignificant enough to ignore.

How would we know otherwise?

As you note, that "would be a more outrageous and damning discovery" - so there's more incentive to keep it closely held. It would help the NSA do what it feels it must, simply by using its other network taps. And, it would help minimize the risk of discovery without involving extra employees and ongoing connections, all while retaining the ability for Page/Drummond/etc to deny involvement.

Those add up to making a key compromise more attractive for NSA and Google than the alternatives.

[1] http://security.stackexchange.com/questions/26142/do-client-...

This is why the DHE/EDH modes exist. It uses DH to agree on a session key, then uses the long term key just to ensure the DH agreement hasn't been actively mitm'd. The session key is never transmitted or permanently stored, so once the connection cache expires, nobody can decrypt retroactively, not even the parties to the conversation.

They use a PFS cipher spec: http://googleonlinesecurity.blogspot.com/2011/11/protecting-...

What gives you that belief, and if it's TLS-secured, would you assume it has the same forward-security as (eg) Chrome-to-Gmail? Or might it be something else, because it happens out of sight, that is a little behind-the-times?

I run my own email service (Postfix) on 4 different domains. TLS is properly configured on all of my mailhosts, using certificates issued by StartCom. My servers routinely receive mail from Google, Apple, Yahoo, GNU, and other major email providers. Most of the messages are from various mailing lists.

I occasionally peruse the mail logs, and in the last 3 years, at least, I have never seen an unencrypted SMTP connection. I'm not saying it never happens, I've just never seen it. The most common protocol is TLSv1 with a variant of AES (nearly always 256-bit). Apple's listservs use TLSv1 with 128-bit RC4-MD5, but they're the exception.

I am. I sent this message to my personal domain from my Yahoo Mail account just now:

  Jun 16 01:46:01 shell postfix/smtpd[29319]: connect from nm4-vm6.bullet.mail.gq1.yahoo.com[98.136.218.165]
  Jun 16 01:46:01 shell postfix/smtpd[29319]: Anonymous TLS connection established from nm4-vm6.bullet.mail.gq1.yahoo.com[98.136.218.165]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)

† Where by "we" I mean "the guy who isn't me that found the app that gives you the SSL connection details for arbitrary SMTP addresses"

That Google will "do TLS" is ambiguous. Are we sure Yahoo attempts TLS on their SMTP-connect to Google's MX? It seems unlikely if they don't support it on their own receives, and also unlikely that Gmail would reject all non-TLS SMTP.

If so, NSA wouldn't need Google or Yahoo's private key to record the plaintext of all email between them. And if the Google<->Yahoo interchange is representative, plenty of other email to or from Gmail will be similarly transparent.

Have you and/or your company ever worked for them? If so it would explain a lot.

Once again: I am not sticking up for NSA. I do not trust NSA. I probably share your opinion of NSA, modulo I might not mythologize their capabilities as much as other people on HN do.

I am sticking up for Google. I have friends who work there. I think very highly of their security group. From my vantage point, Google is in this instance fighting for the privacy of their users, at great expense, and getting shellacked in online forums by people who are happy to use the outrage over NSA overreach to tar Google, especially since Glenn Greenwald more or less defamed them in print.

As you are one of the three most common defenders of the state that I have noticed on this site, that would be very surprising to me. But quite interesting if so, it would be some indication that your perspective on the issues and seeming constant defense is an indication of spiraling paranoia in counterparties to your arguments. Is this how you see it?

I'm also not a defender of the state. However, of the subset of HN users who are noisy enough to remember by name, I'm probably the most statist; believing in the utility of law enforcement probably puts me just slightly to the left of center among noisy HN'ers.

In the real world, I'm a liberal.

Be careful about assuming that you know what's in the heads of other people just from how they comment on HN. The things that spark arguments on HN aren't a realistic cross-section of policy debates in the real world.

For the record, there is no doubt in my mind that rayiner is a hell of a lot more of a statist than you.

EDIT: Yahoo does NOT use TLS SMTP[1]. Also, Gmail fails Cert verification...[1]

[1]http://www.checktls.com/perl/TestReceiver.pl

Later

Nice catch. I based the Yahoo thing off message board posts with people getting TLS SMTP working, but from their mail clients, not server-to-server.

The Google Mail certificates don't validate because their hostname doesn't exactly match the host for which the certificate was issued ("mx.google.com"). I don't think that's a huge problem in practice.

Not really. They would only need to get every incoming and outgoing e-mail forwarded/copied to one of their servers. That's not strictly "direct access to Google's servers". At least for incoming e-mails, it would also simply suffice to listen in on some backbone node while having access to Google's private keys to circumvent the TLS encryption (let's ask Larry about those instead).

Or Google could provide the NSA a copy of the data.

However, on the strict point of "metadata" (which would mean IP, time, and little more, but anyway, data), and only guessing, splitters would be useful, would they not? and at the same time make the "direct access" negation stand true, if I read correctly?

I know you are fighting a different battle (that Snowden does not mean this and he is wrong, on which I tend to agree more or less) but this idea would also be useful for the Gov't and not that much of a deal to implement.

Even more, come to think of it, this might be done at the Telcos level, might it not?

EDIT: Just realized this would only give one end of the communication, so not THAT useful, I guess. I see.

EDIT2: Well, with some analysis and some luck you might get the size of a mail, with care and timing and then with more statistics get an idea of who (IP) may have read it when (albeit just STATISTICALLY) but you may get lucky...

Couldn't the NSA sniff packets the major internet hubs like MAE-West and MAE-East? I assume most email is sent as cleartext after it leaves Google's servers. Even if intermediate hops were encrypted, the NSA could easily man-in-the-middle any servers they wanted. I'm sure CAs like VeriSign would be happy to do their patriotic duty issuing forged certificates.

File that under "things you don't do if your goal is to cooperate with NSA surveillance", by the way.

The revelations of the past week seem to put this category of idea back on the map.