Why Does The NSA Focus So Much On 'TERROR!' When PRISM's Success Story Is About Cybersecurity?

from the odd dept

We've mocked the NSA for the way it always reverts to FUD about "terrorists" to show how "successful" programs like PRISM have been, but then also reverts to talking about cybersecurity as a focus to make the surveillance seem more like it's about protecting people, rather than spying on them. However, as some of the latest revealed documents show, perhaps the NSA has its talking points all mixed up. There's plenty to discuss concerning the revelations about the NSA spying on French phone calls, but some people have noticed that, while some of the presentation documents revealed with that story were revealed before, there are a few new ones as well, including this one: The key thing here is the report that the NSA was able to use its FAA authority (apparently via both PRISM and "upstream collection" -- which is tapping directly into the backbone via telcos) to figure out that someone, perhaps the Chinese, had gotten access to a defense contractor's network and was either preparing to, or at least had the ability to get 150 gigs of important data out. The NSA alerted the FBI which alerted the contractor and they plugged the hole the same day. While that certainly seems like a good thing, it's not entirely clear stopping such hacking is really worth giving up a ton of privacy, though it does show, again, why Keith Alexander keeps demanding access to pretty much everything. Of course, you'd think that the NSA would be a bit more forward in promoting this success story, rather than its bogus claims about stopping terrorist attacks, which have fallen apart under scrutiny.

The other interesting slide is this one: It shows some of the differences between PRISM and the upstream collections, both of which the NSA believes are authorized under Section 702 of the FISA Amendments Act. PRISM involves being able to collect specific data from the 9 specific companies which have been named (Google, Facebook, Microsoft, Yahoo, Apple, Skype, AOL, Paltalk, YouTube), while "upstream" is what the NSA gets from tapping the backbone via telcos. "DNR Selectors" are the phone call metadata collected under a different program (Section 215 of the Patriot Act) which they apparently can filter the upstream data collection against. "DNI" is internet data (email addresses and such). Once again, it looks like tapping the backbone provides a hell of a lot more data, but it lacks the ability to "access stored communications," which they get via PRISM.

The other interesting tidbit to me, is the "direct relationship" claim. Note that with PRISM, it says "only through FBI," which suggests a reason why the PRISM companies have insisted that they've never been involved in any NSA program. It looks like they may have only had to deal with FBI requests (and associated FISA court orders). It's just that the data the FBI gets is then shared with the NSA.

Filed Under: cybersecurity, nsa, nsa surveillance, prism, terror, upstream collection

Feds Begged Washington Post Reporter Not To Name Companies In PRISM, Because It Worried They'd Stop Cooperating

from the not-to-protect-national-security... dept

At a recent event held by the Cato Institute concerning the NSA's surveillance overreach, Washington Post reporter Barton Gellman, who broke the PRISM story and (of course) has been one of the three key reporters on all of the Snowden docs, noted that the feds begged him not to reveal the nine companies listed as participants in the PRISM program. Gellman and the Post refused, noting that the government's reasons for wanting to keep the names out didn't raise any legitimate security concerns, but rather had to do with making life easier for the NSA:

The thing that the government most wanted us to remove was the names of the nine companies. The argument, roughly speaking, was that we will lose cooperation from companies if you expose them in this way. And my reply was "that's why we are including them." Not in order to cause a certain result, or to get you to lose your cooperation but if the harm that you are describing consists of reputational or business damage to a company because the public doesn't like what it's doing or you're doing, that's the accountability we are supposed to be promoting.

Right. That's called journalism: revealing information that the public should know about in order to make its own decisions about what they're doing with their information and privacy, which has been kept from them. Yes, it makes sense for the press to refrain from revealing direct sources and methods of surveillance that create a real national security issue -- but keeping the public in the dark about how the government has been able to compromise these companies isn't a national security issue at all. As we've pointed out in the past, there are plenty of tools in the surveillance toolbox that the public knows exists, which don't make the methods useless any more. For example, traditional phone wiretaps. It's no secret that those exist, and the public can debate the standards under which they're used. And law enforcement still uses them because they're useful.

But that's not what happened with PRISM. Instead, the whole concept was kept entirely secret -- including the overbroad gag orders on the tech companies. That's the troubling part here. There was no ability to have a public discussion over the standards of use. There's a difference between having the press say "wiretaps exist" and "the feds are wiretapping so-and-so right now." The revelation of the PRISM members was more the former, rather than the latter, but the intelligence community keeps pretending it was the latter.

Filed Under: bart gellman, nsa, nsa surveillance, prism
Companies: washington post

And Here Comes The NSA-Themed Ransomware

from the featuring-scary-logos,-acronyms-and-third-party-money-services dept

It was only a matter of time before this happened. The latest government agency to have its name and logo splashed across some clumsy ransomware is none other than everyone's least favorite intelligence agency, the NSA. This ransomware specifically mentions the NSA's preferred web data harvester and interceptor, PRISM, in its shake down of users who snag the triplines of malware-infested websites. (via)

While many individuals are concerned about privacy in light of PRISM, some malicious actors are using the program to scare naive users into installing ransomware. Since August 23rd, we have seen about 20 domains that carry FakeAV and Ransomware. These websites seem to have been hijacked. They are all hosting the malicious content over port 972 and use similar URL patterns. Here are a couple examples:

kringpad.websiteanddomainauctions.com:972/lesser-assess_away-van.txt?e=20
miesurheilijaaantidiabetic.conferencesiq.com:972/realism_relinquish-umbrella-gasp.txt?e=21
squamipi.worldcupbasketball.net:972/duty_therefore.txt?e=21

The malicious files seem to be changing. It started with the classic FakeAV, then switched to a fake PRISM warning. In both cases, the goal is to scare the target into paying the attacker to "fix" their computer.

Preying on vague, unverifiable fears is what ransomware specialists do best. These particular criminals started out by pushing Fake AV [not its real name], which would return "reports" stating the unfortunate user's computer was literally overrun with viruses. In exchange for perfectly good money, the software would rid itself of problems the user never had while inserting other malware and spybots.

But nothing makes money like topical fears, especially for users who are only slightly aware of the NSA scandal and have picked up just enough knowledge to be dangerous… to themselves. A quick read of the ransomware screen should alleviate the fears of anyone halfway familiar with nefarious web tactics, but the uninitiated may be scared enough to just start throwing money at the screen.

In addition to throwing as many official logos as it can at the user, the lockscreen also dumps a large number of scary looking (and eerily misspelled) words onto the screen for good measure. If the misspellings don't tip the user off, chances are they won't question why the government would essentially take a lowball bribe of $300 rather than prosecute them and pursue a "mandatory term of imprisonment for 6 month to 10 years [all sic]" and a $250,000 fine.

This will presumably be an effective tactic even if the NSA is no longer considered newsworthy by the mainstream media. Users who are cowed by a handful of logos probably aren't going to be tuned into the nuances of these various federal agencies. But the point that should be driven home to every user is that no federal agency is going to allow you to buy your way out of a serious criminal charge and very definitely won't be collecting fines through third-party services.

Filed Under: nsa, prism, ransomware, scams

Though Wrong About 'Treason', Yahoo's Marissa Mayer Shows Why It's Hard To 'Just Say No' When The NSA Comes Calling

from the that's-not-true dept

We were just having a discussion in our comments about how companies should respond to NSA (and other law enforcement) requests for information. Many of our commenters take the extreme positions that companies should never abide by such requests and should always reveal them publicly. I tend to take the view that this is a counterproductive approach that is much more likely to destroy a company and have the execs end up in jail. So, I can kind of see where Yahoo CEO Marissa Mayer is coming from when she was asked about the NSA efforts and falsely stated it would be "treason" to disobey:

"Releasing classified information is treason. It generally lands you incarcerated," she said, clearly uncomfortable with the turn of the conversation.

She repeated that claim again later, so it wasn't a one-off thing:

"I'm proud to be part of an organization that from the very beginning in 2007, with the NSA and FISA and PRISM, has been skeptical and has scrutinized those requests. In 2007 Yahoo filed a lawsuit against the new Patriot Act, parts of PRISM and FISA, we were the key plaintiff. A lot of people have wondered about that case and who it was. It was us ... we lost. The thing is, we lost and if you don't comply it's treason."

First off, let's get this out of the way: she's wrong. It's not treason. Not by any stretch of the imagination. Treason is defined in 18 USC 2381, and revealing classified info isn't there:

Whoever, owing allegiance to the United States, levies war against them or adheres to their enemies, giving them aid and comfort within the United States or elsewhere, is guilty of treason and shall suffer death, or shall be imprisoned not less than five years and fined under this title but not less than $10,000; and shall be incapable of holding any office under the United States.

Releasing classified information to the public is not covered. She is right that Yahoo fought a key FISA court lawsuit and lost -- and she's right that if Yahoo didn't comply, it (and its executives) would be in serious trouble, but not treason-level trouble.

That said: this does raise a serious question about what companies can do. I know that many don't trust any other process to get this information out there. And, like everyone else, I'm happy that some individuals such as Ed Snowden and Chelsea Manning had the courage to blow the whistle and reveal government misdeeds. And I'd likely support other individuals and companies that choose to take a stand and reveal government wrongdoing. But it's a step too far to claim that it's a requirement when it's not your life on the line. And, for many companies it's not hard to recognize that there are strategies that are likely to be much more effective than flat out breaking the law. Doing so would not just open them up to a lawsuit that would be expensive, but would also open them up to being tarred and feathered by a large portion of the population. And that would likely make any "statement" they were making much less effective.

Even Lavabit, which many of us respect for choosing to shut down in the face of a government order, has not revealed the nature of that order, knowing that doing so would be monumentally stupid in the long run and counterproductive.

Strategy involves thinking multiple moves ahead, not just making the one big move upfront. That's how you lose. These fights and the efforts to stop government surveillance will die an early death if companies just flat-out ignore FISA Court orders. First off, many of them are legit, even if some people don't want to recognize that. But, more importantly, there are multiple ways you fight back against these programs, and blowing the entire strategy upfront by publicizing a single request like that is almost certainly destined to backfire. Snowden didn't just reveal the first document he came across. He planned out a detailed strategy. Assuming companies should blow a ton of goodwill and the power to effect real change by revealing the first FISA Court order that comes along, even if it's legitimate, is a quick way to destroy the company, the lives of execs, and do little to create actual change.

Marissa Mayer is wrong to claim that it's treason, but she's right that there are limits to what a single company can do. Yes, we can hope that more companies fight back against more secret orders, but at some point reality has to be a part of the discussion.

Filed Under: fisc, marissa mayer, nsa, nsa surveillance, prism, tech industry, treason
Companies: yahoo

How Many Lies Can A Politician Stuff Into A Single Sentence About NSA Surveillance?

from the is-this-a-new-record? dept

In a recent comment on the site, reader PT pointed us to a statement from Representative Joe Heck explaining why he voted against the Amash Amendment. The statement was from back in July, soon after the Amash Amendment to defund certain NSA activities was narrowly defeated. While the statement is now a couple months old, what amazes me is the statements of fact that are flat out false in there. And we're not just talking about statements that were later proven to be false. These are things that were known to be false at the time -- from a Representative who is on the House Intelligence Committee and who must have known these statements were lies. Just for simplicity's sake, let's focus on the main one and stand back in amazement at just how many flat out lies Rep. Heck told in a single sentence:

The Amash amendment would have eliminated Section 215 of the Patriot Act which we know has thwarted 54 terrorist plots against the US (and counting).

This is a lie. It's not a half truth. It's not a misstatement. It's not confusion. It's an out and out lie. Actually, it's a whole series of lies. Almost nothing in that statement is true. In fact, I can't find anything in that statement that is true. Every single part is a lie. At no point has anyone in the Intelligence Community stated that Section 215 thwarted 54 terrorist plots against the US. First off, the 54 number, which was first released by the NSA's Keith Alexander, wasn't about "terrorist plots" but rather "potential terrorist events." Yes, that language is purposely broad and opaque. What counts as a "terrorist event"? A meeting? A party? It's not at all clear that these were actual "terrorist plots." In fact, a month before Heck's totally bogus claim above, the NSA clarified that only 42 "plots" were involved in that 54 number. The other 12 weren't plots, but rather "material support to terrorists" whatever that might mean.

Second, Alexander wasn't talking about Section 215 of the Patriot Act for most of those "events." He admitted that 53 of the 54 cases actually involved Section 702 of the Patriot Act (the PRISM program) which wasn't the part that was up for a vote in the Amash Amendment. So Heck is, once again, lying in claiming that Section 215 stopped those plots.

Third, at no time did Alexander or anyone at the NSA say they were all targeted against "the US" as Heck falsely claims. The very same day that Alexander shared the 54 number, he also admitted that only about 10 involved the US -- a number that was quickly clarified a few days later: only 13 "had a homeland nexus." So, already, it's pretty clear that the claim of "54 thwarted terrorist plots against the US" is completely bogus (and, remember, all of this was public a month before Heck's statement).

Fourth, of those 13 that "had a homeland nexus," almost none required the NSA's surveillance efforts. When confronted by Senator Leahy in a Senate hearing, the NSA's deputy director John Inglis admitted that the surveillance merely "made a contribution" to the efforts against 12 of those plots, but wasn't particularly key to stopping them. Inglis admitted that the surveillance programs were actually only "critical" in a single case: the Zazi NYC Subway case.

So now we're down to just one plot in the US -- and we're not even talking about Section 215 any more, but Section 702. Oh, and as for that one case, multiple press reports have pointed out that the claim that NSA surveillance was needed to catch Zazi just isn't true, because traditional police work was able to do the brunt of the work in identifying Zazi and the plot.

Oh, and finally, the Amash Amendment would not have "eliminated Section 215." It merely would have defunded using Section 215 to justify collecting metadata on every phone call. Section 215 would still be in place, and the government would still be able to use it to access "tangible things" and various "business records" so long as they were actually related to a counterterrorism operation.

So there you have it. A Congressional Representative who is on the Intelligence Committee, who voted against the Amash Amendment, and defended it with a cascading series of flat out lies. While the Amash Amendment would have defunded the data collection of metadata on all phone calls, it did not get rid of Section 215, which was not used to thwart 54 terrorist plots (not even one!) and many of those "plots" weren't "plots" and very few were actually in the US.

What gets me, however, is that few people seem willing to say that he flat out lied. This isn't a case of a misstatement or confusion or even things that were revealed later. Nearly all of the points that I highlighted above were public knowledge nearly a month before Heck made his untrue statement.

Isn't it time that someone actually called out elected officials when they state things that are clearly lies to constituents?

Filed Under: amash amendment, joe heck, justin amash, keith alexander, lies, nsa surveillance, patriot act, prism, section 215, section 702, surveillance, terrorism, zazi

Feds Had Court Reverse Ban On Warrantless Searches On Americans Because 'We Wanted To Be Able To Do It'

from the that-whole-4th-amendment-mean-anything-to-you? dept

Last month, we wrote about the revelation of the infamous backdoor search loophole that allowed the NSA to run searches on the communications of Americans without a warrant, just so long as they collected them under another program -- the so-called 702 program of the FISA Amendments Act, which sucks up a large amount of communications, based on some very broad definitions of words like "target" and "relevance." We noted that this was due to a "rule change" in 2011, but the details of that change weren't entirely clear... until now.

The Washington Post has the story (along with the recently released -- though heavily redacted -- FISA Court ruling about the NSA lying to the court) that shows that back in 2008, the FISC had banned any such searches at the request of the Bush administration, but in 2011 the Obama administration reversed course, and asked the FISA Court to allow such backdoor warrantless searches, and the court did what it was told, issuing a ruling allowing them, despite the fact that it's almost certainly a major 4th Amendment violation. The Obama administration's reasoning? As noted below, a chief administration lawyer explains: "We wanted to be able to do it." The "it" there, for clarification, is run warrantless searches on tons of communications (not just metadata) collected from Americans.

What's a little surprising is that I'm pretty sure I called some of this back in June, the day after the first Snowden leak came out, when I pointed out that the NSA likely defines "target" not to mean just the person that they're targeting, but rather the entire investigation. So as long as the goal of the collection was to "target" a particular non-American situation, anything can be collected, and then it can be searched at will without a warrant. Apparently, this includes somewhere on the order of 250 million communications per year.

What's astounding is that Robert Litt, the general counsel for the Office of the Director of National Intelligence, seems kind of proud of the fact that they got this backdoor loophole:

The court in 2008 imposed a wholesale ban on such searches at the government’s request, said Alex Joel, civil liberties protection officer at the Office of the Director of National Intelligence (ODNI). The government included this restriction “to remain consistent with NSA policies and procedures that NSA applied to other authorized collection activities,” he said.

But in 2011, to more rapidly and effectively identify relevant foreign intelligence communications, “we did ask the court” to lift the ban, ODNI general counsel Robert S. Litt said in an interview. “We wanted to be able to do it,” he said, referring to the searching of Americans’ communications without a warrant.

Um. "We wanted to be able to do it" is not exactly a valid reason for violating the clear language of the 4th Amendment. I'm sure plenty of government officials "wanted to be able to do" all sorts of illegal things like throw political foes in jail for dissent, or shut down newspapers for writing things they don't like. But we don't allow it because the Constitution says you can't do that.

But Litt just can't help himself, he's so proud of violating the 4th Amendment.

“If we’re validly targeting foreigners and we happen to collect communications of Americans, we don’t have to close our eyes to that,” Litt said. “I’m not aware of other situations where once we have lawfully collected information, we have to go back and get a warrant to look at the information we’ve already collected.”

The duplicity here is incredible. First, they redefine "target" to allow them suck up American's communications without a warrant, despite the fact that this is expressly prohibited. Then, to ignore the official minimization rules that bar them from looking at any communications that involve Americans, they have a court say "oh fine" and overturn a clear rule that says they can't look at those communications, and Litt doesn't see the problem? Most people would argue (a) the original collection was not, in fact lawful and (b) even if it was lawful to collect, over and over again for the past few months, government officials have insisted that they are careful to make sure searches on Americans don't happen. Yet, now he nonchalantly waves off the issue as being "of course" they search that information because he thinks it's "lawfully collected" despite being almost directly against the plain language of both the law and the Constitution? Wow.

Oh, and as a "bonus" they appear to have tossed in the ability for the NSA to keep Americans' communications for six years, rather than five. Note, of course, that over the past few months, the NSA and its defenders have continued to trot out the five year claim, even though this ruling makes it clear that the timeline had actually been extended to six. So, yet another lie to top it all off.

And, while most of the outrage should be directed at the Obama administration, mainly in the form of Litt and James Clapper who pushed for this, some of it also should be directed at the chief judge of the FISA Court at the time, John Bates, who signed off on this "rule change." Once again, it seems that the administration and the NSA's defenders keep claiming one thing, and only later, as it's pointed out that the opposite is true, do they say something like "oh, yeah, well of course we do that..."

Filed Under: 4th amendment, backdoor loophole, fisa amendments act, nsa, nsa surveillance, prism, robert litt, section 702, warrants

Did New Zealand Spooks Tap Into PRISM To Spy On Dotcom?

from the suggestive dept

As Techdirt has reported, the attempts to extradite Kim Dotcom from New Zealand to the US have turned into one of the most catastrophically bungled legal cases in a long while. One of the biggest scandals to emerge was that New Zealand citizens had been wiretapped in an effort to gain evidence against Dotcom, since domestic spying was forbidden there just as it is in the US (oh, wait...). Unfortunately, rather than rapping knuckles and telling the local spooks not to do it again, the New Zealand government has instead just brought in new legislation to make it legal in the future.

But it seems that the revelations in the Dotcom case aren't over yet. A story on the Australian site ITnews drawing on a blog post by Keith Ng has the following remarkable claim:

Police affidavits related to the raid on Kim Dotcom's Mega mansion appear to show that New Zealand police and spy agencies are able to tap directly into United States surveillance systems such as PRISM to capture email and other traffic.

Here's why Ng thinks that's the case. On page 13 of the Kim Dotcom affidavits (pdf), which have been released in a redacted form (and are embedded below), there is a request from the Organised and Financial Crime Agency New Zealand (OFCANZ) to the Government Communications Security Bureau (GCSB), New Zealand's signals intelligence unit, to "conduct SIGINT analysis against persons associated with Mega Media Group" -- notably Kim Dotcom.

The police then provided a list of what page 19 of the affidavits calls "selectors" -- precisely the word used by the NSA for PRISM search terms. Page 17 contains some more tantalizing hints of what is going on, as Ng explains:

The selectors were entered into █████, in an email classified as "SECRET//COMINT//REL TO NZL, AUS, CAN, GBR, USA". In other words, the selectors were entered into a secret communications intelligence system, and this secret system was considered related to Five Eyes

"Five Eyes" is the cosy club of Anglo-Saxon countries -- US, UK, Canada, Australia and New Zealand -- that form a kind of inner circle for swapping surveillance information. It's probably fair to say that these documents don't constitute cast-iron "proof" that the New Zealand police drew on information from PRISM supplied through the Five Eyes collaboration, although it is certainly consistent with that. However, what this does show without doubt is that Kim Dotcom's case was being discussed with New Zealand's spy agency in the context of the Five Eyes group.

At the very least, this demonstrates the completely disproportionate lengths to which the New Zealand government was prepared to go in order to try to obtain evidence against Dotcom for a case that was essentially about alleged copyright infringement. It may even be the first indication that PRISM's global surveillance system is also being deployed in areas that have nothing to do with terrorism or serious threats to the US or its citizens.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: kim dotcom, new zealand, prism, privacy

Yes, Of Course The NSA Pays Tech Companies For Surveillance Efforts

from the taxpayer-money dept

The latest Ed Snowden leak from the Guardian shows that after the FISA court had ruled that aspects of the NSA's data collection program were unconstitutional, the NSA had to work with tech companies to change their technology to avoid capturing some of the information they weren't allowed to capture, and, as a result the NSA paid millions to those tech companies via its Special Source Operations. To be honest, this doesn't seem like a huge bombshell in terms of revelations. It's long been known that the government pays companies for law enforcement assistance/surveillance (e.g. wiretaps) -- and as long as that surveillance is legal, that makes sense and is reasonable. The fact that this cost millions of dollars, however, suggests that it's a pretty big program.

Either way, while many of the Snowden leaks have been a pretty big deal, this one seems like nothing new. It's never been a secret that tech companies were required to reveal certain information under court orders, or that the government pays the companies for the cost. The only thing here is that the companies had to change their systems to make sure that the NSA's collection effort was "in line" with what the FISA Court deemed to be Constitutional. If anything, that makes a lot of sense, as we should want the government to have to cover the costs of making sure that their surveillance efforts are Constitutional. Many of the leaks so far have been a big deal, but this one doesn't seem all that interesting.

Filed Under: fees, nsa, nsa surveillance, prism, surveillance
Companies: google, yahoo

No, There Hasn't Been A Big Shift Away From US Datacenters... Yet

from the give-it-time dept

We've been pointing out that the various disclosures about NSA surveillance, and its ability to tap into various servers associated with US companies, should be very troubling to the US tech industry, because it will make it harder and harder to do business -- especially with those outside of the US. Of course, some are claiming that this will all blow over, and while people will make noise about it, they won't actually go anywhere else. And, of course, the latest Netcraft data suggests that there's been little movement so far:

Despite speculation that the recent PRISM revelations would result in a mass exodus from American data centers and web hosting companies, Netcraft has not yet seen any evidence of this. Within the most popular 10 thousand sites, Netcraft witnessed only 40 sites moving away from US-based hosting companies. Contrary to some people's expectations, 47 sites moved to the US, which actually resulted in a net migration to the US.

This trend is also reflected by the entire web server survey, where a net sum of 270 thousand sites moved to the US from other countries (in total, 3.9 million sites moved to the US, while 3.6 million moved from the US). Germany was the most popular departure country, with nearly 1.2 million sites moving from German hosting companies. This was followed by Canada, where 803 thousand sites hopped across the border to the US.

Of course, I think it's way too early to conclude much about this at this point for a variety of reasons. First, we're still learning about the extent of the surveillance, and some of the more damning revelations have really only just started to trickle out. Second, moving your hosting services is not generally something you just do overnight. It can take quite a bit of time. Third -- and this is a big one -- I'd argue the bigger concern is less about companies moving, but that the next generation of users will never agree to use US servers. And, finally (and perhaps most importantly), prior to these revelations, the market for more private and secure hosting and communications was fairly limited. Some have pointed out that even for those who wish to leave US services, it's not clear where to go.

But I am expecting that's going to change. One thing that these revelations have made clear is that current solutions are not as secure or private as people expected and that this is an issue that many, many people and companies are concerned about. As such, it seems quite likely that there will be investment and entrepreneurship focused on these areas over the next few years -- and I fully expect that a number of more secure and private solutions, who actively promote themselves on these features, will hit the market.

Filed Under: cloud computing, datacenters, impact, nsa, nsa surveillance, prism, privacy, us

Then And Now: What The NSA Said About PRISM vs. What Latest Declassified Document Says

from the note:-they're-not-the-same dept

So, Tim Cushing already discussed the magically declassified FISC opinion, concerning how the NSA violated the 4th Amendment for many years with its searches. There's a lot of information in that and the other documents the Director of National Intelligence is finally disclosing (mostly due to FOIA requests, rather than the administration's professed newfound love of transparency). For example, it shows how, once again, the NSA has been incredibly misleading concerning the various revelations over the past few months. Let's take PRISM, for example, the program under Section 702 of the FISA Amendments Act that allows the government to access certain internet communications (not metadata, actual communications).

As you may recall, the NSA and its supporters really tried to play down this program as being small and highly targeted:

According to the NSA fact sheet, this program "does not allow the government to target the phone calls or emails of any U.S. citizen or any other U.S. person anywhere in the world, or any person known to the in the United States. It only allows the targeting of communications of foreigners, and even then only when those communications may have foreign intelligence value." The agency further notes that "any information about U.S. persons that may be incidentally acquired" is subject to "minimization procedures."

Targeted communications of foreigners, only when those communications may have foreign intelligence value. Okay. So, that actually makes some sense. We expect the NSA to be, for example, trying to get access to Al Qaeda bosses' emails. But... the reality as shown in the FISC ruling suggests it's not limited, it's barely targeted and those minimization procedures aren't taken very seriously. As you may recall, this is the very same fact sheet that Senator Wyden called out for being near-complete bullshit and which the NSA then removed.

The Obama administration, however, put up a similar defense:

The Government may only use Section 702 to acquire foreign intelligence information, which is specifically, and narrowly, defined in the Foreign Intelligence Surveillance Act. This requirement applies across the board, regardless of the nationality of the target.

Except, of course, as we've been seeing over and over again, "foreign intelligence information" is not narrowly defined, and it doesn't appear that the NSA is very careful about all of this. From the FISC ruling we learn that this "small" and supposedly "targeted" project is something much much larger:

NSA acquires more than two hundred fifty million Internet communications each year pursuant to Section 702, but the vast majority of these communications are obtained from Internet service providers and are not at issue here..... Indeed, NSA's upstream collection constitutes only approximately 9% of the total Internet communications being acquired by NSA under Section 702.

If you don't follow this closely, it can be a bit difficult to parse out. The "upstream" collection is the stuff we were just talking about concerning snarfing up data directly from telcos. This "non upstream" data that is "obtained from Internet service providers" is PRISM (as noted in a footnote), and is the program that the NSA and the White House kept insisting above are narrow and targeted. Yet, here, they're admitting that via PRISM, they're getting 91% of the internet communications they're collecting -- which is 228 million records. Collected from tech companies via PRISM.

That's not targeted. Those 228 million communications are not "only when those communications may have foreign intelligence value." And I have difficulty seeing how anyone can call it "incidental" given the size. It appears to be an absolutely massive program that, once again, the NSA, the administration and their supporters have continued to misrepresent.

Filed Under: communications, foreign, nsa, nsa surveillance, prism, targeted