[What we ended up with was] a little box in our systems room that was capturing all the traffic to this customer. Everything they were sending and receiving.

And yet his lawyer could have written a truthful denial that they'd given the govt "direct access to the server". See how that works?

Thinking back about it, again, this seems a lot of how the feds can keep things like this from getting out. The people that know are given the gag orders, the sysadmins racking and unracking know it's better for their careers, and their not staying out of jail, not to say that they have weird boxes on their network which have mirrored ports going to them. It's there, it's suspect, but the consequences for discussing a suspect box make it difficult to really discuss things.

Now make access to the cameras public.

"What's that new box?"

"We can't say."

"Ooohh, I see. Noted."

Watch the watchers watching.

https://mayfirst.org/fbi-returns-server

Though, I suppose if a company suddenly had to take down their datacenter video feed for unspecified reasons, that would be tell tale.

You could trivially defeat that by injecting noise.

You could less trivially defeat that by looking for "random" behavior in the datacenter, such as people walking by, vibrations caused by folks moving about, blinking patterns of the ubiquitous network activity LEDs in your rack and other racks, etc.

I think a loop is trivial to detect.

[I despise the fact that I am making a joke like this, and that it's probably true. I'm writing my folks in congress again.]

Or, the government simply says, "You have to say that the new server is a web server".

This is why I'm always skeptical of things like "warrant canaries" and the like. If the government can require you lie to your customers about whether they're being monitored, surely they can control the terms of disclosure about what's going on?

But honestly, this is getting so ridiculous. How would people know that you'd stopped donating? If you had a webpage that said, "We donated this week", the government could just require you keep putting it up. You could give the EFF the ability to disclose your donation - but what, your customers are going to call the EFF every week? The EFF is going to set up a webpage that your customers are going to go to, in order to verify that your donation was received?

Then, let's say you have 500k customers. You get a FISA request or whatever for 1 of them. You stop donations, some webpage somewhere gets updated, and....what happens, exactly?

First off, the customer would have to want to check however mechanism is available, since you certainly can't notify them. So once they check, what do they know, other than someone on the service has received a government request.

Then, now that they know this, what do they do about it? Migrate off? To whom? If all it takes is one request for customer data to trigger the warrant canary, shit, all the government has to do is make one request for every company with a warrant canary. Now there are no available services.

At which point what do your users do? Do you go with an un-canaried provider? Hope that you're not the target of the warrant?

Then, look at it this way, someone, perhaps a less scrupulous provider, will simply lie about not having received a warrant, in order to get the business.

While it's a fun thought exercise, there's absolutely no practical way to do what people are suggesting without using a system that would be so vulnerable to manipulation as to be useless.

Sometimes it seems like the rabbit hole just keeps going deeper, but then you realize it's a damned sewer!

Surveillance by government is the same way. Police and three-letter agencies are using engineer time, bandwidth, and potentially rack space of service providers complying with warrants. They compensate providers for those resources.

Similarly, if the police kick down an apartment door, they're supposed to compensate the landlord for the cost of a new door. If your municipal police department wanted to wiretap your cell phone, they would have to pay Verizon/AT&T/whatever a monthly fee just like you do.

You can't pay Google for private information unless you have a court order, and Google is compelled to hand over data whether or not the feds can pay. The data is not being sold. Google is only being paid for resources it is already legally obligated to spend.

Everything follows in a logical order when viewed from one perspective, but seen from the perspective of a normal person who cares less about internal procedures and more about general governance it is obvious the emperor has no clothes.

http://www.guardian.co.uk/world/2013/jun/28/us-army-blocks-g...

If the government wanted to have a room in an office building for a long period of time to spy on a company in the sam building it is reasonable to charge rent & for utilities. I don't see how this is different?

(I agree in principle that warrantless spying is wrong. But if a warrant is issued I certainly don't see why a company shouldn't charge for their resource use)

Parent broke down why the companies ask for compensation, and it's reasonable. Why should the government get to take up resources for free?

You create a ghost. Create fear of the ghost. Tell people that only you can protect them from the ghost. But you don't tell them how they plan to protect them from the ghost, nor are you willing to disclose how much you spend to protect people from this ghost.

People should realize that only bringing focus to the real issues and not blanket regulations and restrictions on freedom is going to have some real effect.

Why don't governments create the new laws or policies time bound and specific to particular issues. If they see Al Queda activity in US, make it public. Release information on the organizations. People behind these organizations, the people helping to fund these organizations. Create embargoes on countries and organizations funding these organizations. And do them more effective and open manner than how it is done now.

Fill the media with real issues and educate people who sympathize with terrorist organizations. Give a platform for these people to redress their grievances. Create more opportunities for leaders of supposedly 'terrorist' organizations and to have more debate and dialogue with others.

Comcast’s pricing list, which was already leaked to the internet in 2007, indicated that it charges at least $1,000 for the first month of a wiretap, and $750 per month thereafter.

[ http://www.wired.com/threatlevel/2009/12/wiretap-prices/ ]

I had a similar experience related to a more typical criminal investigation and an individual computer. There was a warrant signed by a federal magistrate, our counsel reviewed it, and they were professional and respectful of our operational concerns.

The problem here is the secret court, secret warrant, etc. the rest is fine with me, the police should be able to investigate crime with appropriate oversight.

http://www.cbsnews.com/8301-201_162-57593273/verizon-at-t-ge...

"In its letter to Markey, AT&T estimated that it collected $24 million in government reimbursements between 2007 and 2011. Verizon, which had the highest fees but says it doesn't charge in every case, reported a similar amount, collecting between $3 million and $5 million a year during the same period."

I'm not sure how I feel about that (making the companies pay for it doesn't seem fair either), but it certainly doesn't leave us with incentives in the right places.

AT&T had profits of (approximately) $7 billion on revenue of $31 B in 2012. So these reimbursements amount to something like 0.015% of revenue, or 0.1% of profits. For a firm that size, there are much greater incentives to lobby for favorable rules on employee health benefits, spectrum allocation, or consumer relations. I mean, over that time period the CEO of AT&T earned about $100 m, so in theory he could afford to take the hit for all that fee revenue personally and still make more money in a year than most people see in a lifetime.

I'm not expressing support for the NSA's activity here, I think this sort of data vacuuming is quite dangerous. But viewed in the context of actual corporate revenues, I don't think it's realistic to say the government is bribing big business here, because the amount they're paying is trivial, and thus largely reflective of the change in the actual operating cost of the corporate data centers.

I seem to recall they were chasing down online pill vendors this way. One little box with power and two Ethernet ports can collect a whole bunch of evidence, after all. They get what they need, and then they remove it.

This was 10 years ago... or more. I can only imagine what happens now.

"These programs that violate the Bill of Rights can continue because people can’t go out and say, “this is my experience, this is what happened to me, and I don’t think it is right.”"

How do you later prove that you were required by law to make the actions that you did? How do you ensure that you comply completely with the instruction if you can't compare your action to the original warrant?

That seems strange.

The gag order attached to it prevents you from telling anyone but your attorney that you received the court order. Having the paper wouldn't help you prove anything when you are not allowed to acknowledge its existence.

Do they really expect engineers to start ignoring the laws of physics?

Well apparently they have been for a while already.

http://www.buzzfeed.com/justinesharrock/what-is-that-box-whe...

http://news.cnet.com/8301-13578_3-57593538-38/how-the-u.s-fo...

This is directly contrary to what every "larger" company has repeatedly stated in response to Prism. People actually think that the companies are not only forced to keep silent, but release public statements lying?

I am a fervent believer in the power of government to do enormous good - but is necessary that those actions be public or they will invariably be abused. Whenever you contemplate government acting in secret, you must weigh that against the cost of that action being abused - because at some point it will be.

I'm angry and will let you imagine a link to foaas.com.

http://www.forbes.com/sites/andygreenberg/2012/04/03/these-a...

Also, it'd kinda tip off the monitored person(s) if there suddenly was another hop on the route to their server, no?

This is routine activity for police authorities, unfortunately.

And, hypothetically, the FISA authorized box was only getting traffic from the one site, and not the entirety of network traffic. The room 641A attack is far more problematic.

So, if I encrypt something to, say, three layers and sent it to some TOR nodes:

1-2-3

1 knows it came from me and knows to send it to 2

2 knows it came from 1 and to send it to 3

3 knows it came from 2 and to send it to wherever

No one point on the system, IIRC, is meant to have the information necessary to compromise the entire chain. Though, if you could compromise a sizeable portion of the network, you'd be in with a significant chance of compromising any given message - which I find hard to believe that the government hasn't done.

Together we stand, for freedom. For America.

And why do 245 people upvote it without noticing this link bait?

are companies obligated to have a private means of contacting them?

That's where the apathy originates from.

I strongly believe that in the USA of today saying out loudly that a radical change is needed to get the country back on its Constitutional track could make one a terrorism suspect. If they can label 82-year old nun a terrorist and try her in court on this nonsense, then why not me or others who speak out loud ?