2. We've learned that many of these requests are bulk demands for many, many people at a time, often demanding data to be delivered indefinitely thereafter on a periodic basis. We also know that the FISA appeals court has favored the government 100% of the time.

3. It was never stated that the "watching your thoughts as you type" portion was part of the PRISM program. This next part is wild speculation on my part, but if the NSA has a database of zero-day exploits, which I would bet that they do, you could theoretically streamline the process of setting up a keylogger on a target's computer if you know their basic system setup. If they've designed this process to coincide with the laws as has been the pattern with other things we've seen, it's certainly conceivable that Snowden could deploy that system from his terminal.

Greenwald has stated that more revelations are coming. I would say to watch this story closely over the next several weeks, but I'm sure you were going to do that anyway.

I was, but at this point he needs to offer actual evidence of his claims. He's effectively claiming there has been an insanely massive data collection program that has somehow gone unnoticed by tens of thousands of security professionals for several years. And while our security professionals may take awhile to find things like Stuxnet/Flame, they at least found vestiges of the programs much earlier, and neither is anything close to the insanely wide scale this would require.

I'm not saying this is impossible, but god damn is a lot of it sounding improbable as hell.

The massive scale of the NSA's operations are hardly being disputed (logging of US-based backbones, underwater cables, foreign fiber, telephone records), what is up for debate is implementation details, specific wording, and the extent of protection for US citizens.[9] The "insanely massive data collection program" has been conducted for years.

PRISM is one of 504 currently active SIGADs, or intel gathering operations. "The Boundless Informant documents show the agency collecting almost 3 billion pieces of intelligence from US computer networks over a 30-day period ending in March 2013." 97 billion were collected in total over that time span.[1] The FAQ for this program clarifies that it applies to metadata. [8]

edit: that's 97 billion computer records. Metadata for 124 billion phone calls was also recorded over those 30 days.

The NSA does not define "collection" as actually obtaining the data or metadata, it is defined as a human analyst viewing the data.[2]

11 FISA court warrant requests have been rejected over it's existence, out of over 33,000 total. The last one rejected was in 2009.[3] Warrants are also only needed retroactively (within a 7 day period), there is no need to obtain one before accessing data.[4] According to the New York Times, "FISA orders can range from inquiries about specific people to a broad sweep for intelligence, like logs of certain search terms, lawyers who work with the orders said." [5]

The Fisa Amendment Act section 702 bars the NSA from collecting data on people "reasonably believed to be located outside the United States."[4] Additionally, data can be intentionally collected on any communication that has at least one foreign recipient or sender.[6] Note also that these warrants specifically contradict the fourth amendment, but as long as the target is "reasonably believed" to be a foreigner, it doesn't matter to the NSA.

The test of whether someone is located outside the US has been interpreted as a keyword-based system indicating that it is at least 51% likely. And if they aren't actually foreigners? It's nothing to worry about, just include it on a quarterly report.[7] It's also possible that a warrant for a foreigner would permit access to data on US citizens up to 2 social "hops" away, but [citation needed].

Additional reading: https://www.eff.org/deeplinks/2013/06/foreign-surveillance-h...

Written primarily for my own benefit, posted in the hope that someone else finds it informative.

p.s. This account is wholly controlled and accessed by a United States citizen.

[1] http://www.guardian.co.uk/world/2013/jun/08/nsa-boundless-in...

[2] https://www.eff.org/nsa-spying/wordgames#collect

[3] https://epic.org/privacy/wiretap/stats/fisa_stats.html

[4] FAA 702.g.1.B, page 6 at http://www.gpo.gov/fdsys/pkg/PLAW-110publ261/pdf/PLAW-110pub...

[5] http://www.nytimes.com/2013/06/08/technology/tech-companies-...

[6] FAA 702.b.4

[7] http://www.washingtonpost.com/investigations/us-intelligence...

[8] http://www.guardian.co.uk/world/interactive/2013/jun/08/boun...

[9] http://bigstory.ap.org/article/secret-prism-success-even-big...

I like that you seem to be making an honest assessment of the program but I really insist that you check this [1] out to see a few whistleblowers who have tried to bring attention to this, only to be rewarded with federal lawsuits. This has created a climate of fear where people ask "Is it really worth it? Or should I continue collecting my 6-digit paycheck and live in Hawaii?"

[1] http://www.usatoday.com/story/news/politics/2013/06/16/snowd...

It was only after stuxnet spread itself onto the wider internet that security researchers picked up on it and then thought "this is weird" when they looked at its behaviour.

How do you suggest a third party security researcher could learn about data transfer between Apple's servers and the NSA's servers? Short of hacking into the system or an Apple/NSA employee whistleblowing, there's no way they could.

Read 109(b)(2). You want option (B).

szc is saying that carriers should include lost business / damaged reputation, when reporting the costs of complying with the legislation.

Say it costs Verizon $10 million to build the infrastructure to let the government listen in. Verizon could claim that the revelation of this program will cost them $10 billion in future lost business. Since the Attorney General is unlikely to approve such an expense, Verizon would be declared compliant without actually having to turn anything over.

It's an interesting loophole in theory, but probably wouldn't actually work.

[0] https://en.wikisource.org/wiki/Communications_Assistance_for....

edit: the anchor tag isn't getting parsed correctly: http://bit.ly/14Gbifo

You have to show it would cost too much and the US Government refuses to pay you to do it.

They have teams, hundreds of people, that do that stuff.

http://www.foreignpolicy.com/articles/2013/06/10/inside_the_...

From the statement:

"Regardless of the circumstances, our Legal team conducts an evaluation of each request and, only if appropriate, we retrieve and deliver the narrowest possible set of information to the authorities. In fact, from time to time when we see inconsistencies or inaccuracies in a request, we will refuse to fulfill it."

From Google's:

"Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist. Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false. "

What about that is weasely or unclear to you? They categorically deny providing broad data to the government. Of course they can't say they don't provide any access, because they're obligated by law to comply with warrants. But the accusation was that they provide direct access (those words that you all are so obsessed with appear in the Guardian article), with the implication that the NSA can just go and take whatever data it wants with no oversight.

Unless you believe that Apple, Google, et al. are just plain lying, that is clearly not the case.

Since when would anyone start to lump NSA in with "law enforcement". The focus on law enforcement in general in that statement is curious since that's not really what all the noise has been about.

Maybe their PR team are just a bunch of buffoons that have still not realised that these statements gets dissected, but it is rather odd that they when releasing a statement to try to stem criticism based on their previous choice of words again choose wording that is so ambiguous

In fact, if I were to trust this (and I can't decide if I should), my main reason for trusting them is that I'm wondering if they wouldn't just flat out lie and give a much stronger denial if they are in fact feeding the NSA with tons of data.

I wonder if they serve their requests via that branch, or another. it'd be convenient to serve the requests from a more bureaucratic branch of the agency in order to allow them to fall outside of "law enforcement requests".

Are you bothering to understand what the OP was trying to say or just trolling and calling it a day?

I didn't express any personal opinion on whether Google or Apple leak large amounts of data or not, and in fact I don't have any. I just can understand people wondering about the usage of this phrase and was trying to explain their possible motives.

I also have a hard time believing they're getting DB dumps, even so- Facebook alone would be a DB dump at an insane scale. Unless they're only taking in textual data, which of course could be a lot more manageable.

I also have to wonder what one of the slides means(and maybe this is an opportunity for someone to enlighten me): http://en.wikipedia.org/wiki/File:Prism_slide_5.jpg

What is it referring to as the 'cost' being $20m a year? There's no way that could be the total program cost- that'd barely employ the engineers required to build out the system, let alone the data scientists, analysts, and more that would have to support the system. Nor could it count for hardware costs.

So then in that case, is it an advertising packet for other agencies to hop on? Only $20m to have access to their firehose? Genuinely curious here if anyone's figured this one out.

"Regardless of the circumstances, our Legal team conducts an evaluation of each request and, only if appropriate, we retrieve and deliver the narrowest possible set of information to the authorities."

It may very well be that they have not had to deal with any broad requests from intelligence agencies, but the statement most certainly does not preclude it.

No it doesn't. How would you even start approaching to prove that I can only fathom.

> Most of these companies are effectively saying they're agreeing to subpoenas

While at the same time they are actively supplying exploits so that their software can be compromised for political gain. Their software is unsafe, and anything that they're saying is by law allowed to be false or deceptive information, hence why you can't prove the first part.

> 'watch your thoughts form as you type'

Is that not what Google claimed it could do with its machine learning algorithm?

> a lot more holes in Snowden & Co's story than the opposite

Do you work for the government or tow the party line for fun. All your shit sounds like the old this is not "reasonable" this is a conspiracy theory line. When everyone knows the reality is that nothing reasonable is going on.

I don't even know what to say to this. Are you seriously arguing that having "direct access" to user data doesn't mean anything, and that it can only possibly be talking point words?

> While at the same time they are actively supplying exploits so that their software can be compromised for political gain. Their software is unsafe, and anything that they're saying is by law allowed to be false or deceptive information, hence why you can't prove the first part.

Yeah, y'know, tens of thousands of developers totally are intentionally making hundreds of security exploits, primarily of absolutely zero consequence every year, because the government told them to. Are you a developer? Do you even know how easy it is to accidentally fuck something up in code that leaves an exploit? Criminy sakes alive.

And if you're saying "Yeah but when they find out they let the government know!", I'll also remind you that MAPP supplies that information to several dozen/hundred other companies too.

> Is that not what Google claimed it could do with its machine learning algorithm?

Oh for the love of God are you really going to use BS PR phrases meant to capture the imagination of the lay masses to try and say that the NSA has real-time typing data on all of those companies, not just Google, and even then has such unparalleled software to analyze typing and speaking patterns that they can discern your very thoughts and motivations from them, not just in general, but also in real time?

> Do you work for the government or tow the party line for fun. All your shit sounds like the old this is not "reasonable" this is a conspiracy theory line. When everyone knows the reality is that nothing reasonable is going on.

Neither. I just think that the reason so many in positions of power roll their eyes is because so many of those getting angry sound absolutely ridiculous from any sort of view that could rival reality. There are legit concerns here, but we can't be overstating their position massively and still have any hope of being taken seriously.