NSA Is Building the Country’s Biggest Spy Center

[DrEvil]

NSA taps in to user data of Facebook, Google and others, secret files reveal

• Top secret PRISM program claims direct access to servers of firms including Google, Facebook and Apple
• Companies deny any knowledge of program in operation since 2007

http://www.guardian.co.uk/world/2013/ju ... s-nsa-data

[NeonLX]

Well, freedom isn't free, y'know...

[Bruce Dazzling]

Here's Greenwald talking about PRISM on Democracy Now!

I'm sort of surprised that they didn't just call it SPECTRE. I mean, why bother with pretense at this late stage...

[seemslikeadream]

just change the logo

\

[Allegro]

RESOURCE

The NSA Watch report following the excerpt immediately below contains these keywords—region, hub, nodes—that might refer to the excerpt from Program Executive Office Command Control Communications-Tactical.

< begin excerpt >

RHNs innovatively use baseband and satellite communications capabilities that enable regionalized reach-back to the Army’s global network. The RHNs operate “in sanctuary,” or out of the fight zone, and were designed to provide division, brigade combat teams and below early access to the Global Information Grid, the infrastructure and services that move information through the global network. The RHN gives the Soldier in the field immediate access to secure and non-secure internet and voice communications, and it allows them to do their job anywhere on the globe. To provide tactical users with secure, reliable connectivity worldwide, the Army has positioned RHNs in five separate strategic regions: Continental United States (CONUS) East and CONUS West, Central Command, European Command, and Pacific Command.

< end excerpt >

Examples of other keywords for research on such topics include but not limited to: grid, information grid, global, infrastructure, microwave, network, data sets, large data sets, satellite, surveillance, security, national security, national priority, position, positioning system, timing. (European Grid Infrastructure)

_________________
EAVESDROPPING 101: WHAT CAN THE NSA DO?
NSA Watch | ACLU

The recent revelations about illegal eavesdropping on American citizens by the U.S. National Security Agency have raised many questions about just what the agency is doing. Although the facts are just beginning to emerge, information that has come to light about the NSA’s activities and capabilities over the years, as well as the recent reporting by the New York Times and others, allows us to discern the outlines of what they are likely doing and how they are doing it.

The NSA is not only the world’s largest spy agency (far larger than the CIA, for example), but it possesses the most advanced technology for intercepting communications. We know it has long had the ability to focus powerful surveillance capabilities on particular individuals or communications. But the current scandal has indicated two new and significant elements of the agency’s eavesdropping:


1. The NSA has gained direct access to the telecommunications infrastructure through some of America’s largest companies
2. The agency appears to be not only targeting individuals, but also using broad “data mining” systems that allow them to intercept and evaluate the communications of millions of people within the United States.

The ACLU has prepared a map (see below) illustrating how all this is believed to work. It shows how the military spying agency has extended its tentacles into much of the U.S. civilian communications infrastructure, including, it appears, the “switches” through which international and some domestic communications are routed, Internet exchange points, individual telephone company central facilities, and ISPs. While we cannot be certain about these secretive links, this chart shows a representation of what is, according to recent reports, the most likely picture of what is going on.

Corporate Bedfellows

One major new element of the NSA’s spying machinery is its ability to tap directly into the major communications switches, routing stations, or access points of the telecommunications system. For example, according to the New York Times , the NSA has worked with “the leading companies” in the telecommunications industry to collect communications patterns, and has gained access “to switches that act as gateways” at “some of the main arteries for moving voice and some Internet traffic into and out of the United States.


click for larger image or open pdf (500k)

This new level of direct access apparently includes both some of the gateways through which phone calls are routed, as well as other key nodes through which a large proportion of Internet traffic passes. This new program also recognizes that today’s voice and Internet communications systems are increasingly converging, with a rising proportion of even voice phone calls moving to the Internet via VOIP, and parts of the old telephone transmission system being converted to fiber optic cable and used for both data and voice communications. While data and voice sometimes travel together and sometimes do not, and we do not know exactly which “switches” and other access points the NSA has tapped, what appears certain is that the NSA is looking at both.

And most significantly, access to these “switches” and other network hubs give the agency access to a direct feed of all the communications that pass through them, and the ability to filter, sift through, analyze, read, or share those communications as it sees fit.

Data Mining

The other major novelty in the NSA’s activities appears to be the exploitation of a new concept in surveillance that has attracted a lot of attention in the past few years: what is commonly called “data mining.” Unlike the agency’s longstanding practice of spying on specific individuals and communications based upon some source of suspicion, data mining involves formula-based searches through mountains of data for individuals whose behavior or profile is in some way suspiciously different from the norm.

Data mining is a broad dragnet. Instead of targeting you because you once received a telephone call from a person who received a telephone call from a person who is a suspected terrorist, you might be targeted because the NSA’s computers have analyzed your communications and have determined that they contain certain words or word combinations, addressing information, or other factors with a frequency that deviates from the average, and which they have decided might be an indication of suspiciousness. The NSA has no prior reason to suspect you, and you are in no way tied to any other suspicious individuals -- you have just been plucked out of the crowd by a computer algorithm’s analysis of your behavior.

Use of these statistical fishing expeditions has been made possible by the access to communications streams granted by key corporations. The NSA may also be engaging in “geographic targeting,” in which they listen in on communications between the United States and a particular foreign country or region. More broadly, data mining has been greatly facilitated by underlying changes in technology that have taken place in the past few years (see below).

This dragnet approach is not only bad for civil liberties -- it is also a bad use of our scarce security and law enforcement resources. In fact, the creation of large numbers of wasteful and distracting leads is one of the primary reasons that many security experts say data mining and other dragnet strategies are a poor way of preventing crime and terrorism. The New York Times confirmed that point, with its report that the NSA has sent the FBI a “flood” of tips generated by mass domestic eavesdropping and data mining, virtually all of which led to dead ends that wasted the FBI’s resources. “We’d chase a number, find it’s a schoolteacher with no indication they’ve ever been involved in international terrorism,” one former FBI agent told the Times . “After you get a thousand numbers and not one is turning up anything, you get some frustration.”

Combining Telecommunications and Other Private Data?

The NSA has historically been in the business of intercepting and analyzing communications data. One question is whether or not this communications data is being combined with other intimate details about our lives. A few years ago, the Pentagon began work on an breathtaking data mining program called Total Information Awareness, which envisioned programming computers to trawl through an extensive list of information on Americans (including, according to the program’s own materials, “Financial, Education, Travel, Medical, Veterinary, Country Entry, Place/Event Entry, Transportation, Housing, Critical Resources, Government, Communications”) in the hunt for “suspicious” patterns of activity. Congress decisively rejected this approach, voting to shut down the program, at least for domestic use -- but we know Congress allowed elements of the program to be moved undercover, into the bowels of the Pentagon, while supposedly being restricted to non-Americans. We also know that the NSA is sharing its information with other security services. What we do not know is whether any of information from TIA-like enterprises is being combined with the NSA’s communications intercepts.

How the NSA searches for targets

There are a range of techniques that are probably used by the NSA to sift through the sea of communications it steals from the world’s cables and airwaves:


. Keywords. In this longstanding technique, the agency maintains a watch list or “dictionary” of key words, individuals, telephone numbers and presumably now computer IP addresses. It uses that list to pick out potentially relevant communications from all the data that it gathers. These keywords are often provided to the NSA by other security agencies, and the NSA passes the resulting intelligence “take” back to the other agencies or officials. According to the law, the NSA must strip out the names and other identifying information of Americans captured inadvertently, a process called “minimization.” (According to published reports, those minimization procedures are not being properly observed.) In the 1990s, it was revealed that the NSA had used the word “Greenpeace” and “Amnesty” (as in the human rights group Amnesty International) as keywords as part of its “Echelon” program (see below).

. Link analysis. It is believed that another manner in which individuals are now being added to the watch lists is through a process often called “link analysis.” Link analysis can work like this: the CIA captures a terrorist’s computer on the battlefield and finds a list of phone numbers, including some U.S. numbers. The NSA puts those numbers on their watch list. They add the people that are called from those numbers to their list. They could then in turn add the people called from those numbers to their list. How far they carry that process and what standards if any govern the process is unknown.

. Other screening techniques. There may be other techniques that the NSA could be using to pluck out potential targets. One example is voice pattern analysis, in which computers listen for the sound of, say, Osama Bin Laden’s voice. No one knows how accurate the NSA’s computers may be at such tasks, but if commercial attempts at analogous activities such as face recognition are any guide, they would also be likely to generate enormous numbers of false hits.

A three-stage process

So how are all these new techniques and capabilities being put into practice? Presumably, “The Program” (as insiders reportedly refer to the illegal practices) continues to employ watch lists and dictionaries. We do not know how the newer and more sophisticated link analysis and statistical data mining techniques are being used.

But, a good guess is that the NSA is following a three-stage process for the broadest portion of its sweep through the communications infrastructure:


1. The Dragnet: a search for targets. In this stage, the NSA sifts through the data coursing through the arteries of our telecom systems, making use of such factors as keyword searches, telephone number and IP address targeting, and techniques such as link analysis, and “data mining.” At this stage, the communications of millions of people may be scrutinized.

2. Human review: making the target list. Communications and individuals that are flagged by the system for one reason or another are presumably then subject to human review. An analyst looks at the origin, destination and content of the communication and makes a determination as to whether further eavesdropping or investigation is desired. We have absolutely no idea what kind of numbers are involved at this stage.

3. The Microscope: targeting listed individuals. Finally, individuals determined to be suspicious in phase two are presumably placed on a target list so that they are placed under the full scrutiny of the NSA’s giant surveillance microscope, with all their communications captured and analyzed.

Expanding surveillance as technology changes

Today’s NSA spying is a response to, and has been made possible by, some of the fundamental technological changes that have taken place in recent years. Around the end of 1990s, the NSA began to complain privately -- and occasionally publicly -- that they were being overrun by technology as communications increasingly went digital. One change in particular was especially significant: electronic communications ranging from email to voice conversations were increasingly using the new and different protocols of the Internet.

The consequence of this change was that the NSA felt it was forced to change the points in the communications infrastructure that it targeted -- but having done that, it gained the ability to analyze vastly more and richer communications.

The Internet and technologies that rely upon it (such as electronic mail, web surfing and Internet-based telephones known as Voice over IP or VOIP) works by breaking information into small “packets.” Each packet is then routed across the network of computers that make up the Internet according to the most efficient path at that moment, like a driver trying to avoid traffic jams as he makes his way across a city. Once all the packets -- which are labeled with their origin, destination and other “header” information -- have arrived, they are then reassembled.

An important result of this technology is that on the Internet, there is no longer a meaningful distinction between “domestic” and “international” routes of a communication. It was once relatively easy for the NSA, which by law is limited to “foreign intelligence,” to aim its interception technologies at purely “foreign” communications. But now, an e-mail sent from London to Paris, for example, might well be routed through the west coast of the United States (when, for example, it is a busy mid-morning in Europe but the middle of the night in California) along the same path traveled by mail between Los Angeles and San Francisco.

That system makes the NSA all the more eager to get access to centralized Internet exchange points operated by a few telecommunications giants. But because of the way this technology works, eavesdropping on an IP communication is a completely different ballgame from using an old-fashioned “wiretap” on a single line. The packets of interest to the eavesdropper are mixed in with all the other traffic that crosses through that pathway -- domestic and international.

Echelon

Much of what we know about the NSA’s spying prior to the recent revelations comes from the late 1990s, when a fair amount of information emerged about a system popularly referred to by the name “Echelon” -- a codename the NSA had used at least at one time (although their continued use of the term, if at all, is unknown). Echelon was a system for mass eavesdropping on communications around the world by the NSA and its allies among the intelligence agencies of other nations. The best source of information on Echelon was two reports commissioned by the European Parliament (in part due to suspicions among Europeans that the NSA was carrying out economic espionage on behalf of American corporations). Other bits of information were gleaned from documents obtained through the U.S. Freedom of Information Act, as well as statements by foreign governments that were partners in the program (the UK, Australia, Canada, and New Zealand).

As of the late 1990s/early 2000s, Echelon swept up global communications using two primary methods:


. The interception of satellite and microwave signals. One way that telephone calls and other communications are sent from the United States to Europe and other destinations is via satellite and microwave transmissions. ECHELON was known to use numerous satellite receivers (“dishes”) -- located on the east and west coasts of the United States, in England, Australia, Germany, and elsewhere around the globe -- to vacuum up the “spillover” broadcasts from these satellite transmissions.

. Transoceanic cable tapping. ECHELON’s other primary eavesdropping method was to tap into the transoceanic cables that also carry phone calls across the seas. According to published reports, American divers were able to install surveillance devices onto these cables. One of these taps was discovered in 1982, but other devices apparently continued to function undetected. It is more difficult to tap into fiber-optic cables (which unlike other cables do not “leak” radio signals that can be picked up by a device attached to the outside of the cable), but there is no reason to believe that that problem remained unsolved by the agency.

We do not know the extent to which these sources of data continue to be significant for the NSA, or the extent to which they have been superseded by the agency’s new direct access to the infrastructure, including the Internet itself, over which both voice and data communications travel.

Unanswered questions

The bottom line is that the NSA appears to be capable not only of intercepting the international communications of a relatively small number of targeted Americans, but also of intercepting a sweeping amount of U.S. communications (through corporate-granted access to communications “pipes” and “boxes”), and of performing mass analysis on those communications (through data mining and other techniques).

Despite the fuzzy picture of “The Program” that we now possess, the current spying scandal has highlighted many unanswered questions about the NSA’s current activities. They include:


. Just what kinds of communications arteries has the NSA tapped into?
. What kinds of filters or analysis is the NSA applying to the data that flows through those arteries? How are data mining and other new techniques are being used?
. Which telecom providers are cooperating with the NSA?
. How are subjects selected for targeted intercepts?
. What kinds of information exchange are taking place between the NSA and other security agencies? We know they probably turn over to other agencies any data turned up by watch list entries submitted by those other agencies, and they are also apparently passing along data mining-generated “cold hits” to the FBI and perhaps other security agencies for further investigation. Does information flow the other way as well -- are other agencies giving data to the NSA for help in that second phase of deciding who gets put under the microscope?
. Is data that NSA collects, under whatever rubric, being merged with other data, either by NSA or another agency? Is communications data being merged with other transactional information, such as credit card, travel, and financial data, in the fashion of the infamous “Total Information Awareness” data mining program? (TIA, while prohibited by Congress from engaging in “domestic” activities, still exists within the Pentagon -- and can be used for “foreign intelligence purposes.)
. Just how many schoolteachers and other innocent Americans have been investigated as a result of “The Program”? And just how much privacy invasion are they subject to before the FBI can conclude they are not “involved in international terrorism”?

Rarely if ever in American history has a government agency possessed so much power subject to so little oversight. Given that situation, abuses were inevitable -- and any limits to those abuses a matter of mere good fortune. If our generation of leaders and citizens does not rise to the occasion, we will prove ourselves to be unworthy of the heritage that we have been so fortunate to inherit from our Founders.

Eric Lichtblau and James Risen, “Spy Agency Mined Vast Data Trove, Officials Report,” New York Times , December 24, 2005; http://select.nytimes.com/search/restricted/article?res=FA0714F63E540C778EDDAB0994DD404482

Lowell Bergman, Eric Lichtblau, Scott Shane and Don Van Natta Jr., “Spy Agency Data After Sept. 11 Led F.B.I. to Dead Ends,” New York Times , January 17, 2006; http://www.nytimes.com/2006/01/17/politics/17spy.html.

[Allegro]

Edward Snowden NSA: Guardian Reveals Identity Of Whistleblower Behind NSA Revelations (VIDEO)
Huffington Post, Rebecca Shapiro | Updated 06/09/2013 7:12 pm EDT


^ NSA whistleblower | Edward Snowden
Interview dated June 6, 2013
Glenn Greenwald, interviewer
Laura Poitras, filmmaker

[Belligerent Savant]

.

http://gawker.com/heres-the-nsas-suppos ... -512177941

Glenn Greenwald and the Guardian have another leak: Meet "Boundless Informant" the NSA tool that records and analyzes where NSA intelligence comes from, including over 3 billion pieces of intelligence from US computer networks in just a 30-day period.

This is a direct contradiction to the NSA's assurance to congress that it does not collect any type of data at all on millions of Americans. In fact, according to the NSA documents, America is one of its most surveilled countries behind Iran, Pakistan, Jordan, and other Mid-Eastern countries.

"The tool allows users to select a country on a map and view the metadata volume and select details about the collections against that country," the NSA factsheet obtained by The Guardian says about the program.

Metadata, which has been downplayed by security officials and politicians as not actually containing that much data, is in reality an incredibly useful tool for monitoring Internet users. As Jane Meyer points out in the New Yorker, Metadata can help you know who is being emailed and CC'd, where (not exactly, but pretty close) they are emailing from, and in what sequence emails are being sent.

Speaking with a former data system engineer, Meyer observes that "Metadata... can be so revelatory about whom reporters talk to in order to get sensitive stories that it can make more traditional tools in leak investigations, like search warrants and subpoenas, look quaint."

Boundless Informant shows that the NSA has been collecting metadata, on a massive scale, on Internet users inside of America. It also shows that the NSA, which has said it has no way to process all the information of Internet users (if they had it), has developed (and is improving) a system to do exactly that.

So who is leaking this information to Greenwald and why are they leaking it? The data shows that the NSA, while obviously spying on Americans, is also doing some pretty serious work on foreign soil, especially where America is supposedly looking for terrorists. Do they want to show off that the NSA is both covering its bases in terms of terrorism and not spying as much on tenuous allies like China and Russia, or is someone risking their freedom to expose the decline of civil liberties in the United States?

Or, alternately, is someone just hacking the NSA?

On top of that, can Greenwald ever come back to the United States without getting put in front of a grand jury and asked to name his source?

Update 3:00 PM: It's option #1. Edward Snowden, a 29-year-old technical assistant is the whistleblower.

[chump]

I saw this on Kenny's Sideshow


http://nsa.gov1.info/index.html

Your Data: If You Have Nothing to Hide, You Have Nothing to Fear

Our value is founded on a unique and deep understanding of risks, vulnerabilities, mitigations, and threats. Domestic Surveillance plays a vital role in our national security by maintaining a total information awareness of all domestic activities by using advanced data mining systems to "connect the dots" to identify suspicious patterns.

Why We Collect Your Data

Under the authority of Homeland Security Presidential Directive 6, which defines the integration and use of screening information to protect against terrorism, the NSA is authorized to collect and disseminate information about suspected foreign and domestic terrorists. In the past, this meant gathering information AFTER a target had been identified. This often led to missed intelligence and lost opportunities.

But what if we could collect the information in advance, before the target was known? What if the mere act of collecting information could result in the identification of new targets? What if we could build a national data warehouse containing all available information about every person in the United States? Under the authority of the classified Homeland Security Directive 15 (U.S. Strategy and Policy in the War on Terror), we can.

What Data We Collect

Every day, people leave a digital trail of electronic breadcrumbs as they go about their daily routine. They go to work using electronic fare cards; drive through intersections with traffic cameras; walk down the street past security cameras; surf the internet; pay for purchases with credit/debit cards; text or call their friends; and on and on.

There is no way to predict in advance which crucial piece of data will be the key to revealing a potential plot. The standard operating procedure for the Domestic Surveillance Directorate is to "collect all available information from all available sources all the time, every time, always".

For security reasons, it is unrealistic to expect a complete list of information we collect for our national citizen database. In the spirit of openness and transparency however, here is a partial list:

internet searches
websites visited
emails sent and received
social media activity (Facebook, Twitter, etc)
blogging activity including posts read, written, and commented on - View our patent
videos watched and/or uploaded online
photos viewed and/or uploaded online
music downloads
mobile phone GPS-location data
mobile phone apps downloaded
phone call records - View our patent
text messages sent and received
online purchases and auction transactions
bookstore receipts
credit card/ debit card transactions
bank statements
cable television shows watched and recorded
commuter toll records
parking receipts
electronic bus and subway passes / Smartpasses
travel itineraries
border crossings
surveillance cameras
medical information including diagnoses and treatments
prescription drug purchases
guns and ammunition sales
educational records
arrest records
driver license information

How We Collect Your Data

For information on how we collect your data, including our PRISM program, visit Our Surveillance Strategy page on this website. For information about our new state-of-the-art Surveillance Data Center, visit our Utah Data Center information page.

How We Use Your Data

We treasure the U.S. Constitution and the rights it secures for all the people. In a world in which privacy has become illusory in so many areas of our lives, the Domestic Surveillance Directorate maintains the highest standards of integrity and lawful action. Your private data is safely secured using our custom database software called Cloudbase, which has fine-grained security to control access down to the cell level.

Threat Matrix Processing

Incoming transactional data is analyzed against a continually evolving threat matrix and is assigned an action code. The vast majority of these transactions are routed directly to a permanent static storage state. In fact, for most Americans, your data is never accessed or viewed by anyone within the US Government unless some future event triggers an inquiry. We work closely with our partners in the Intelligence Community to ensure that your stored data is released only as a result of a "national security" request.

Continuity of Government

Our strong commitment to keeping the Nation safe includes an important role in maintaining the Continuity of Government. Since the early 1980s, the federal government has used its secret Main Core database to track dissidents and watchlisted Americans in the event of a national emergency. The roots of the Domestic Surveillance Directorate can, in fact, be traced back to the early days of this program. We are proud to continue this tradition by sharing our data with the modern-day COG program. Learn more about this.

Future Uses of Domestic Intelligence Data

In 2006, the Intelligence Advanced Research Projects Activity (IARPA) was created to invest in high-risk, high-payoff classified programs uniquely designed to provide research and technical capabilities for the Intelligence Community. IARPA-funded researchers are currently studying novel ways of processing and analyzing the explosive growth of domestic data.

The Aladdin Program seeks to extract intelligence information from the high volume of videos uploaded to the internet.

The Babel Program is developing agile and robust speech recognition technology that can provide effective search capability for analysts to efficiently process massive amounts of real-world recorded speech.

The Knowledge Discovery and Dissemination (KDD) program will develop advanced analytic algorithms that can effectively draw inferences across multiple databases to allow the Intelligence Community to create virtual fusion centers enabling analysts to produce actionable intelligence.

The Socio-cultural Content in Language (SCIL) Program will develop novel algorithms, techniques and technologies to uncover the social actions and characteristics of members of a group (ie; within discussion forums, online comment sections, social media, etc.) by examining the language used in relation to acceptable social and cultural norms.

The Reynard Program starts from the premise that "real world" characteristics are reflected in "virtual world" behavior. The program seeks to identify behavioral indicators in online virtual worlds and "massively multiplayer online games" that are related to the real world characteristics of the users. Attributes of interest include gender, age, economic status, educational level, occupation, ideology or "world view", and physical geographic location.


Fusion Centers


Fusion Center Location Map

http://www.nfcausa.org/default.aspx?Men ... uGroup=Map

http://nsa.gov1.info/partners/index.html

Suspicious activity reporting - fusions centers

The Nationwide Suspicious Activity Reporting (SAR) Initiative (NSI) is a collaborative effort led by the U.S. Department of Justice in partnership with the Department of Homeland Security, the FBI, and state and local law enforcement partners. This initiative establishes a national capacity for gathering, documenting, processing, analyzing, and sharing SAR information gathered by fusion centers across the county.

Located in states and major urban areas, fusion centers are uniquely situated to empower front-line law enforcement, public safety, fire service, emergency response, public health, and private sector security personnel to gather and share domestic threat-related information.

National Counterterrorism Center

The National Counterterrorism Center (NCTC) operates as a partnership of more than 16 organizations including the CIA, FBI, State Department, Defense Department, Homeland Security; and other agencies that provide unique expertise such as the Departments of Energy, Treasury, Agriculture, Transportation, and Health and Human Services.

The NCTC is the primary organization for analyzing and integrating all foreign and domestic terrorism-related intelligence possessed or acquired by the United States. It was also recently given the authority to examine the government files of U.S. citizens for possible criminal behavior, even if there is no reason to suspect them...

FBI Terrorist Screening Center

The FBI Terrorist Screening Center (TSC) was established in 2003 by Homeland Security Presidential Directive 6 which directed that a center be established to consolidate the government's approach to terrorism screening. The TSC maintains the U.S. government's consolidated Terrorist Watch list, a single database of identifying information about those known or reasonably suspected of being involved in terrorist activity.


Other Partners we can publicly disclose

FBI - Information collected from the use of National Security Letters authorized by the PATRIOT Act; Phone calls and text messages from the FBI Digital Collection System (DCSNet); "Google-like" search capability of citizen information from the FBI Law Enforcement National Data Exchange Program; Cell phone location tracking from the Stingray "IMSI catchers" (International Mobile Subscriber Identity) masquerading as cell phone towers.

CIA - The Central Intelligence Agency has publicly committed to increasing its data collection efforts. CIA Chief Technology Officer Gus Hunt explains why: "The value of any piece of information is only known when you can connect it with something else that arrives at a future point in time. Since you can't connect dots you don't have, we fundamentally try to collect everything and hang on to it forever."

DHS - TSA airline passenger data; surveillance data from unmanned domestic Predator B drones patrolling the northern and southern borders

Treasury - Cash Transaction Reporting and Suspicious Activity Reporting data

State/Local government - Electronic transit cards; electronic toll collectors; vehicle information and location data captured by license plate readers; public transportation video/audio surveillance systems

This is a parody of nsa.gov and has not been approved, endorsed, or authorized by the National Security Agency or by any other U.S. Government agency.

[Asta]

This year's Boston Marathon proves how well the NSA data mining, surveillance programs work. They're doing one heck of a job!

[Allegro]

Criminals will be able to crack UID system easily: Jacob Appelbaum
Indulekha Aravind, Business Standard | Interview with WikiLeaks activist
Bangalore | June 1, 2013 Last Updated at 00:56 IST

He prefers that the audio recorder is not switched on during the interview because “whenever there’s an audio recording, there’s a file to be subpoena-ed”. And, he’s stuck a band-aid over the camera of the laptop he’s been working on. All these precautions are not without reason – Jacob Appelbaum, computer security researcher, hacker, activist, and a spokesperson for WikiLeaks, who also co-authored Cypherphunks: Freedom and Future of the Internet with WikiLeaks’ founder Julian Assange, talks to Indulekha Aravind about the potential pitfalls of India’s ambitious UID project.

Excerpts:

What is your view of India’s UID/Aadhaar programme?
UID will create a digital caste system because going by the way it is now being implemented, if you choose not to be part of the system, you will be the modern-day equivalent of an outcast. In theory, you are supposed to have the freedom to choose but in reality, the choice will only be whether to be left out and left behind.

What about the benefits it is supposed to offer, such as tackling corruption and protection against terrorism?
I don’t dispute that there will be benefits but I dispute whether UID will end corruption and whether one will be able to opt out of the system with dignity. Criminals will be able to subvert this system easily. In Germany, for example, a group of hackers were able to duplicate the fingerprint of Schauble (Germany’s finance minister, a proponent of collecting biometric data). And, it now costs less than a dollar to get a transferable fingerprint. About the question of containing terrorism, imagine a situation where a terrorist gets access to the central UIDAI (Unique Identification Authority of India) database — he will be able to get all the details of every individual he wishes to target.

Considering that the programme has already been rolled out, what can the government now do to safeguard individual privacy?
First of all, there should be no centralised database. The information should be just on the cards. This can easily be done with smartcards. If you link all the information, that amounts to surveillance. There should also be legislation to prevent discrimination against people who have not registered with UIDAI.

What is your current involvement with WikiLeaks?
I like that to remain ambiguous (smiles). I’ve given talks on behalf of Julian (Assange) when he was unable to. After one particular talk I gave in 2010, my life changed. I was repeatedly harassed by US authorities.

What are the other projects you’re currently involved with?
I do computer security-related research, I work with human rights activists, and work with open software. I’m also involved with the Tor project, which aims at improving users’ privacy and security on the internet. If an Indian businessman goes to China, for example, and does not want his internet usage to be monitored, he can do that with Tor. (The Wall Street Journal termed Tor “an anonymous, and controversial, way to surf the Net”).

You have been dubbed a “hacktivist”...
I started working with open software and hacking before I was 15, after I realised I wanted to live in a world free from state surveillance. I’m a human being who does investigative journalism, research, and even works on international policy – I prefer not to be pigeon-holed.

Name: Jacob Appelbaum
Age: 30
Associations: Spokesperson for WikiLeaks, core member and developer of Tor, a free software that protects users from network surveillance and traffic analysis, co-founder of Noisebridge, a space for hackers in San Francisco
Interests: Computer security, open software, international policy, investigative journalism

[seemslikeadream]

Connecting the Dots on PRISM, Phone Surveillance, and the NSA’s Massive Spy Center
BY JAMES BAMFORD06.12.136:30 AM

An aerial view of the NSA’s Utah Data Center in Bluffdale, Utah. The government is secretly collecting the telephone records of millions of Verizon customers and gathering data from tech companies including Apple, Microsoft and Google. The Obama Administration defends the National Security Agency’s need to collect such records, but critics call it a huge over-reach. Photo: Rick Bowmer/Associated Press
Physically, the NSA has always been well protected by miles of high fences and electrified wire, thousands of cameras, and gun-toting guards. But that was to protect the agency from those on the outside trying to get in to steal secrets. Now it is confronting a new challenge: those on the inside going out and giving the secrets away.

While the agency has had its share of spies, employees who have sold top-secret documents to foreign governments for cash, until the last few years it has never had to deal with whistleblowers passing top-secret information and documents to the press because their conscience demanded it. This in a place where no employee has ever written a book about the agency (unlike the prolific CIA, where it seems that a book contract is included in every exit package).

As someone who has written many books and articles about the agency, I have seldom seen the NSA in such a state. Like a night prowler with a bag of stolen goods suddenly caught in a powerful Klieg light, it now finds itself under the glare of nonstop press coverage, accused of robbing the public of its right to privacy. Despite the standard denials from the agency’s public relations office, the documents outline a massive operation to secretly keep track of everyone’s phone calls on a daily basis – billions upon billions of private records; and another to reroute the pipes going in and out of Google, Apple, Yahoo, and the other Internet giants through Fort Meade – figuratively if not literally.

But long before Edward Snowden walked out of the NSA with his trove of documents, whistleblowers there had been trying for years to bring attention to the massive turn toward domestic spying that the agency was making. Last year in my Wired cover story on the enormous new NSA data center in Utah, Bill Binney, the man who largely designed the agency’s worldwide eavesdropping system, warned of the secret, nationwide surveillance. He told how the NSA had gained access to billions of billing records not only from AT&T but also from Verizon. “That multiplies the call rate by at least a factor of five,” he said. “So you’re over a billion and a half calls a day.” Among the top-secret documents Snowden released was a Foreign Intelligence Surveillance Court order proving the truth to Binney’s claim and indicating that the operation was still going on.

I also wrote about Adrienne J. Kinne, an NSA intercept operator who attempted to blow the whistle on the NSA’s illegal eavesdropping on Americans following the 9/11 attacks. “Basically all rules were thrown out the window,” she said, “and they would use any excuse to justify a waiver to spy on Americans.” Even journalists calling home from overseas were included. “A lot of time you could tell they were calling their families,” she says, “incredibly intimate, personal conversations.” She only told her story to me after attempting, and failing, to end the illegal activity with appeals all the way up the chain of command to Major General Keith Alexander, head of the Army’s Intelligence and Security Command at the time.

Without documents to prove their claims, the agency simply dismissed them as falsehoods and much of the mainstream press simply accepted that. “We don’t hold data on U.S. citizens,” Alexander said in a talk at the American Enterprise Institute last summer, by which time he had been serving as the head of the NSA for six years. Director of National Intelligence James Clapper made similar claims. At a hearing of the Senate Intelligence Committee last March, he was asked, “Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?” To which Clapper responded, “No, sir.” The documents released by Snowden, pointing to the nationwide collection of telephone data records and not denied by government officials, prove the responses untrue.

The deception by General Alexander is especially troubling. In my new cover story for Wired’s July issue, which will be published online Thursday, I show how he has become the most powerful intelligence chief in the nation’s history. Never before has anyone in America’s intelligence sphere come close to his degree of power, the number of people under his command, the expanse of his rule, the length of his reign, or the depth of his secrecy. A four-star Army general, his authority extends across three domains: He is director of the world’s largest intelligence service, the National Security Agency; chief of the Central Security Service; and commander of the U.S. Cyber Command. As such, he has his own secret military, presiding over the Navy’s 10th Fleet, the 24th Air Force, and the Second Army.

The article also sheds light on the enormous privatization not only of the intelligence agencies but now also of Cyber Command, with thousands of people working for little-known companies hired to develop the weapons of cyber war, cyber targeting, and cyber exploitation. The Snowden case demonstrates the potential risks involved when the nation turns its spying and eavesdropping over to companies with lax security and inadequate personnel policies. The risks increase exponentially when those same people must make critical decisions involving choices that may lead to war, cyber or otherwise.

At a time when the NSA has lost its way and is increasingly infringing on the privacy of ordinary Americans, it shouldn’t come as much of a surprise that NSA employees — whether working for the agency or for one of its contractors — would feel the obligation to alert the public to the secret acts being carried out in its name. The only surprise is that we haven’t seen more such disclosures. General Alexander will surely use all his considerable power to prevent them. Don’t be surprised if he fails.

[stevie ray]

This year's Boston Marathon proves how well the NSA data mining, surveillance programs work. They're doing one heck of a job!

hear, hear

[Allegro]

RESOURCE

I’ve underscored some keywords, and [bracketed some explanations], below, and links have been omitted from the wiki page of origin.

Refer General Keith Alexander; retired Admiral Bobby Ray Inman.

_________________
United States Naval Research Laboratory Research

NRL has researched the development of gamma-ray radiography and radar [determines the range, altitude, direction, or speed of objects; it can be used to detect aircraft, ships, spacecraft, guided missiles, motor vehicles, weather formations, and terrain], the Large Angle and Spectrometric Coronagraph Experiment (LASCO) and Dragon Eye, a robotic airborne sensor system [unmanned aerial vehicle]. The laboratory first proposed a nuclear submarine in 1939, and developed over-the-horizon radar in the late 1950s. The details of GRAB 1, deployed by NRL as the nation’s first intelligence satellite [spy satellite], were recently declassified. The laboratory is responsible for the identification, friend or foe (IFF) system. In the late 1960s, NRL researched low-temperature physics, achieving for the first time a temperature within one millionth of a degree of absolute zero in 1967.[9] In 1985, two scientists at the laboratory, Herbert A. Hauptman and Jerome Karle, won the Nobel Prize for work in molecular structure analysis. The projects developed by the laboratory often become mainstream applications without public awareness of the developer; an example in computer science is onion routing [a technique for anonymous communication over a computer network]. The Timation system, developed at NRL, provided the basis for the Global Positioning System.[10]

A few of the laboratory’s current specialties include plasma physics, space physics, materials science, and tactical electronic warfare.

[seemslikeadream]

https://media.grc.com/SN/sn-408-lq.mp3

Steve and Leo examine the operation and technology behind the NSA's previously secret PRISM Internet surveillance program.


Steve: Well, and it occurred to me that one of the reasons that he gave them to both outlets is because there was a prior instance where this kind of information was sat on for a year. And so that didn't - that wouldn't allow Edward to get the goal of getting this stuff disclosed. He says in the complete video, which I would commend people to watch, it's very interesting, that he does not want the story to be about him, to whatever degree possible. To some degree it is. He wants it to be about what's going on.
Okay, so with that little bit of sort of backgrounding, let's look at the James Clapper video. It's only 48 seconds. This is taken from the video record of congressional testimony that was open, obviously, to cameras exactly three months ago, on March 12th, where with prior notice of the question, the Director of National Intelligence was asked what the NSA is doing.

[Begin clip]

GEORGE STEPHANOPOULOS: ...is the desire for more public information. Now, he believes that the administration has not been misleading generally the committee and the public. But I want to play an exchange that was in the Intelligence Committee in March when James Clapper was questioned by your colleague, Senator Wyden.

[Begin embedded clip]

SEN. RON WYDEN: Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?

JAMES CLAPPER: No, sir.

SEN. WYDEN: It does not.

JAMES CLAPPER: Not wittingly. There are cases where they could inadvertently perhaps collect, but not wittingly.

[End clip]


Leo: All right.

Steve: So there it is. That's our...

Leo: That's not even a non-denial denial. That's a denial.

Steve: [Laughing] There's no way.

Leo: There's no way.

Steve: There's no way to walk yourself out of that one.

Leo: Yeah.

Steve: And, I mean, and then Andrea Mitchell interviewed him for "Meet the Press" on Sunday. And I'm looking for where it was he - he actually said to her, "I thought, though in retrospect, I was asked a 'when are you going to ... stop beating your wife' kind of question, which is ... not answerable necessarily by a simple yes or no." So this is - he said to Andrea, "So I responded in what I thought was the most truthful, or least untruthful, manner by saying, 'No.'"

Leo: Okay.

Steve: Oh, I know. It's just painful.

Leo: Okay.

Steve: I know. There's a great - if anyone's curious, there's a great take on this. Fred Kaplan wrote an article in Slate.com, and it says, "Fire DNI James Clapper. He lied to Congress about NSA surveillance." And I don't know whether the guy has to go, but he certainly did lie because we now know much more than we did three months ago when this was said to - when he was asked this openly. And the EFF, of course, the Electronic Frontier Foundation, is all over this, happily, or I'm happy to say. I really thought that their summation of this was perfect.
They said, quoting from a longer article, they said: "All of this would be amusing if the administration's main argument to defend the NSA's massive spying program" - and "spying" is their word, not mine. Certainly it is surveillance. Spying requires a judgment. "All of this would be amusing if the administration's main argument to defend the NSA's massive spying program is that Congress has been informed of all their activities. Democracy can't function when Congress is 'informed' by the 'least untruthful' statements of the administration, using unusual definitions that are designed to given an impression that is the polar opposite of the truth."

I skipped part of this that explains, when he responded this way, Andrea said, well, but how can you answer no, that you're not collecting information? And then he said, "Clapper's deceptions don't" - I'm quoting from the Slate article. "Rambling on in his rationalization to Andrea Mitchell, he focused on Wyden's use of the word 'collect,' as in, 'Did the NSA collect any type of data ... on millions of Americans?' Clapper told Mitchell that he envisioned a vast library of books containing vast amounts..."


Leo: Oh, please.

Steve: "...of data on every American. 'To me,' he said, 'collection of U.S. persons' data would mean taking the book off the shelf and opening it up and reading it.'"

Leo: But this is interesting because all of these things he's saying really are an acknowledgment that "no" was a lie.

Steve: Yes.

Leo: It's only not a lie if you have these bizarre interpretations of what the question meant.

Steve: Well, yeah, I mean, what can he say now with this recording of him three months ago flatly denying what we now know has been true for years?

Leo: Right.

Steve: Okay. So, first, what was authorized under the FISA Article 215, that's the telephony metadata collection. What I found interesting about it was essentially what's going in is that all the telephone companies naturally keep the records that they need for billing. So they're recording so-called "metadata." We've talked about metadata. Metadata is essentially sort of the, not the main content, it's the embellishment. For example, when we talk about a browser query, there's the query, and then there's the headers, and the headers are metadata. They're additional information. Date and time stamp and cookies and so forth are browser metadata. Or in a file system, you know, you're storing files, but it's also keeping track of when you last accessed the file and when it was modified and when it was created and file privileges for example, who's able to access it. That's metadata.
So similarly, telephony metadata is - it's like where you are by, like, which cell tower your call is coming in on; your originating phone number, or actually it's the serial number of your phone; the number you dialed; probably where it is maybe, though if it went off out into a different phone system, they may not have that. But basically it's your call records. It's not your conversation, it's the event features of the call.

Well, what's interesting is that phone companies have no need to retain that in perpetuity. They typically only keep it for 60 to 90 days. So what's happened is, as authorized under this Article 215, the NSA has set up arrangements with all of the domestic phone companies to acquire this data before they delete it. So, and it turns out that it's not against the law to do this. The so-called "business records" have been ruled by the Supreme Court not to be subject to privacy protection. So if AT&T or Verizon's business records, this is just their records for their own purposes, and...


Leo: This is like the billing, the billing information that they would have.

Steve: Yes, exactly. And it's about to be deleted, and the NSA says, oh, oh, oh, hold on a second, let us make a copy of that. Or just send it to us before you hit delete. So in listening to all of the buzz about this, there's this downplaying of, well, but it's not your conversations. It's just the metadata. And I'm sitting here thinking, oh, my god, I mean, do you realize what it means? If there is a facility huge enough to capture and contain all of that, and the computing resources necessary to link it together, what this builds is an incredible graph of all of the connectivity that exists between everybody with a phone in the United States.
And it's funny because in my notes I was already making a note that, well, the history is also really important, and crucially important to the NSA because, for example, if they got, identified a person who was a suspect of something, a terrorist presumably, or a bad guy qualifying for further surveillance, they can query this network. And what the continual collection of the data means is that they can go back in time, they have a time machine that allows them to walk back and look at the history of all past connections over time. That's unbelievably rich. And it happened that Edward, during his interview, said exactly that. So I thought, it's a very short piece, we'd just hear it in his own words.

[Begin clip]

EDWARD SNOWDEN: ...care about surveillance. Because even if you're not doing anything wrong, you're being watched and recorded. And the storage capability of these systems increases every year consistently by orders of magnitude to where it's getting to the point you don't have to have done anything wrong. You simply have to eventually fall under suspicion from somebody, even by a wrong call. And then they can use this system to go back in time and scrutinize every decision you've ever made, every friend you've ever discussed something with, and attack you on that basis to sort of derive suspicion from an innocent life and paint anyone in the context of a wrongdoer.

[End clip]


Steve: So...

Leo: And by the way, I want to point out that, if anybody would say, well, the government would never do that, just there are some pretty good examples with Nixon's enemy list and J. Edgar Hoover's persecution of Martin Luther King.

Steve: Yes.

Leo: That it is not unusual for our government, our republic to do this kind of thing.

Steve: And it doesn't, I mean, these are people who at the time righteously believed that they were doing the right thing. I mean, they were doing it in secret, and that's a problem. And, I mean, secrecy is what we have to worry about because, exactly as you say, Leo, there is ample history of abuses of this kind of data collection. And so I just wanted to shine a little light on this notion that, oh, well, telephony metadata is not useful. Remember we talked about some time ago this new facility that the NSA is building. We were scratching our heads at the time, wondering what is a zettabyte, because this place can store five of them. Five zettabytes worth of...

Leo: Million square feet. Million and a half square feet.

Steve: Yes. It's a million and a half square feet costing $1.2 billion dollars, 26 miles south of Salt Lake City, in a town called Bluffdale, Utah. It uses 65 megawatts of power. It has its own power substation and, like, cooling ponds; and, I mean, it's just phenomenal. And at the time we were thinking, well, what are they going to put in that? What are they going to fill that with? Well, you know, we have an answer to that question now.

Leo: We continue on. Steve Gibson, we're talking about, of course, PRISM and the revelations which continue from the Guardian and The Washington Post and others, about some sort of federal spying. We've heard the word "Echelon" for more than a decade. We knew that after 9/11 President Bush authorized warrantless wiretaps. I remember, don't you remember, the whistleblower that in 2000, I think '6 or '7, told us that the NSA had a secret room at AT&T headquarters in San Francisco so that they could collect this kind of data. So this is not - we're not talking about anything new here.

Steve: No. And I think that, well, there is something new. And that's PRISM. And I'm going to explain what's been done differently than as far as we know anything we had before.

Leo: Excellent.

Steve: Because this may be, this podcast may be viewed by people who are not regular listeners, if people want to send this link to others and so forth, I'm going to give a little bit more background to the way the Internet works than our regular listeners would need. We've had a series of podcasts in the past famously on how the Internet works. And of course I'll keep it brief and aim it at the point that I'm bringing.
So what we have with the Internet, the word "Internet" is interconnected networks. The Internet itself is a global interconnection of privately owned networks. And in some cases they may be government-owned networks. Or, in the U.S., generally we have AT&T and Verizon and Level 3 and large carriers who then supply connectivity to Cox Cable and Cablevision and smaller carriers, and ultimately down connected to our own little network in our homes. And this is all glued together with routers. We've got consumer routers made of plastic in our homes; but there are, as they're called, Big Iron routers, which route vast quantities of data across the Internet.

And I'll just take Google as an example because it's so well known. All over the world, people are sending data to Google. They're putting Google in their browser. They're asking Google to find them things. They're doing searches. Maybe they're using Gmail and establishing a secure connection to a Google server that exists in a Google datacenter somewhere on the planet. So the way that happens is that, with all the people scattered around, they put packets of data onto their own network, the network that they're on, and the router on that network by definition is connected to at least two places. Consumer routers are connected to their home network and to their ISP's network. So there's only two connections.

But the router's job is to forward that data towards its destination. So when someone at home puts a packet of data bound for Google, it goes to their router, and the router sends it to the ISP. The ISP's network looks at the packet's addressing and says, oh, okay, it goes to an ISP router. Now, a big ISP router will have an octopus of connections. It'll be connected to many other routers, not just one other network, many other networks. And so it uses its routing tables to send the packet towards Google.

And this is where the robustness and the strength of the Internet comes from is it's inherently redundant. There are many routes to get to Google from any given place. But there's typically a best one, and so the router will try to use that. If that link happened to be down at the moment, the router would go, oh, and use a next-best route, maybe off in another direction that would then loop back around and eventually get there. So that's how this works. It's an interconnected set of networks that are connected to each other. That is, the interconnection points, you think of sort of like a spider web where the points that the web comes together there's a router there. And the router isn't very smart. It knows just enough to route that data in the proper direction.

Now, there's an interesting phenomenon that occurs, which is, as you get closer to Google, more of the traffic which is being carried by routers will be Google's, as a percentage. If you think about it. Because the Yahoo! traffic, that went off in a different direction. And the Microsoft traffic was headed to Redmond, and the Apple traffic was to Apple's farm, their datacenter in Cupertino or wherever. So the idea is that, with each of these hops, as they're called, across the Internet, the packet is getting closer to its destination. And if you think about it, the percentage of traffic that that router is carrying or forwarding will tend to be concentrated toward, for example, its destination, Google. There will be no Yahoo! traffic if Yahoo!'s routers and their datacenter is off in a different direction. That will have been sent out other links. So there's a concentrating phenomenon.

And the other thing that's interesting is then to ask yourself about the question of ownership. Who owns this data? And again, I don't know, from a legal standpoint. I'm coming from a technology standpoint. But this is still the public Internet. It was the public Internet when it was on your ISP, I mean, it was their network. But the way this all works globally is everybody with connected networks has agreed to provide transit for, to carry everybody else's traffic. So they just said, okay, I'll carry yours, if you'll carry mine. And that's the way the Internet works.

But the packet that a user generated is just this little blob of bits that has an address, a source and a destination IP, the Internet protocol address that is used to send it towards its destination. And so the wires that the packets are moving over belong to the public or private carriers of the data. But the data is sort of - it's public. I mean, you've lost control of it. You've put it on the Internet, and it's gone. So, well, we'll come back to this because it's an interesting question about what this means that what I think it's very clear the NSA has done.

Now, as Leo mentioned a minute ago, back in '07 there was a lawsuit, and I have not had any chance to do any deep research on the lawsuit because it really wasn't relevant to this. But it was about, I think, some privacy complaint that someone had. Testimony was given in deposition of a technician who worked in a facility at 611 Folsom in San Francisco. And Leo, I provided a link to a PDF to you. If you put up the image there, that's useful. I'm just going to read what the EFF's page has. They summarized this, and it is - it's another piece of this puzzle [www.eff.org/NSA-spying].


Leo: This was, by the way, another whistleblower.

Steve: Yes.

Leo: So unfortunately, this is what often has to happen is somebody has to step forward, say I have knowledge of this. This is an employee, I think, of AT&T.

Steve: Yes. And in fact, a few seconds ago, while you were telling people about proXPN, I tweeted five bit.ly links to a set of documents, including the redacted testimony for national security reasons that this comes from [bit.ly/sn408a, bit.ly/sn408b, bit.ly/sn408c, bit.ly/sn408x, bit.ly/sn408y]. So the full testimony is available with photos of the door of the room I'm going to be talking about in a second.

Leo: Amazing.

Steve: "AT&T's Internet traffic" - I'm reading now from the EFF's summary of this. And this is titled "AT&T's Role in Dragnet Surveillance of Millions of Its Customers: AT&T's Internet traffic in San Francisco runs through fiber-optic cables at an AT&T facility located at 611 Folsom Street in San Francisco. Using a device called a 'splitter,' a complete copy of the Internet traffic that AT&T receives - email, web browsing requests, and other electronic communications sent to or from the customers of AT&T's WorldNet Internet service from people who use another Internet service provider - is diverted onto a separate fiber-optic cable which is connected to a room, known as the SG-3 room, which is controlled by the NSA."

Leo: By the way, this is not cellular data. This is not phone calls. This is ATT as an ISP.

Steve: They - yes.

Leo: It's important because the ISP is the - you mentioned collection point. The ISP is the collection point for everybody. Everything you do goes through that ISP.

Steve: Yes. And the way the Internet is organized in a hierarchy is we have so-called Tier 1 providers like Level 3, like Deutsche Telekom, like AT&T, the really big carriers like Sprint. These are - and there's, like, I think there's a small number, 20, maybe it's 12 or 25. I can't remember the number exactly. But there's a relatively few. And they're sort of the - they're the networks that straddle the globe; or, for example, maybe an entire country. And then they resell connections to their network. They resell bandwidth to Tier 2 providers, then to Tier 3 providers in a hierarchy. So what this is, this is a fiber-optic tap using a splitter in the Folsom building in San Francisco that makes a copy of, essentially receives a copy of all the data passing along this major trunk of AT&T. And it goes into this SG-3 room which, as EFF writes, "is controlled by the NSA. The other copy of the traffic continues onto the Internet to its destination."
Continuing to read from the EFF document: "The SG-3 room was created under the supervision of the NSA and contains powerful computer equipment connecting to separate networks. This equipment is designed to analyze communications at high speed and can be programmed to review and select out the contents and traffic patterns of communications according to user-defined rules. Only personnel with NSA clearances - people assisting or acting on behalf of the NSA - have access to this room.

"AT&T's deployment of NSA-controlled surveillance capability apparently involves considerably more locations than would be required to catch only international traffic. The evidence of the San Francisco room is consistent with an overall national AT&T deployment to from 15 to 20 similar sites, possibly more. This implies that a substantial fraction, probably well over half, of AT&T's purely domestic traffic was diverted to the NSA. At the same time, the equipment in this room is well suited to the capture and analysis of large volumes of data for purposes of surveillance."

Now, this came from sworn testimony by Mark Klein, which he gave under oath on the 26th of May, 2006, so a few years back. And this is lengthy, I'm not going to go over it, but there are a few points I want - I'll just give you a sense for it. He says, "I, Mark Klein, declare under penalty of perjury that the following is true and correct: I am submitting this declaration in support of Plaintiff's Motion for a Preliminary Injunction. I have personal knowledge of the facts stated herein, unless stated on information and belief, and if called upon to testify to those facts I could and would competently do so. For over 22 years I worked as a technician for AT&T Corporation, first in New York and then in California. I started working for AT&T in November 1981 as a Communications Technician." Okay, and blah, blah, blah.

So he's been put in - he became involved in the installation of this room that we were just reading about. It says: "AT&T Corp., now a subsidiary of AT&T Inc., maintains domestic telecommunications facilities over which millions of Americans' telephone and Internet communications pass every day. These facilities allow for the transmission of interstate or foreign electronic voice and data communications with the aid of wire, fiber-optic cable, or other like connections between the point of origin and the point of reception."

He says: "Between 1998 and 2003 I worked in an AT&T office located on [and then it's been redacted] in [redacted] as one of [redacted] computer network associates in the office. The site manager was a management level technician with a title of [that's redacted], hereinafter referred to as FSS #1. Two other FSS people [blah blah blah]." He says: "During my service at the [redacted] facility, the office provided WorldNet Internet service, international and domestic Voice over IP," so forth and so forth.

I'm going to skip down, and he says: "In January 2003, I, along with others, toured the AT&T central office on Folsom Street in San Francisco, actually three floors of an SBC building. There I saw a new room being built adjacent to the 4ESS switch room where the public's phone calls are routed. I learned that the person whom the NSA interviewed for the secret job was the person working to install equipment in this room. The regular technician workforce was not allowed in the room.

"In San Francisco the 'secret room' is Room 641A at 611 Folsom Street, the site of a large SBC phone building, three floors of which are occupied by AT&T. High-speed fiber-optic circuits come in on the eighth floor and run down to the seventh floor, where they connect to routers for AT&T's WorldNet service, part of the latter's vital 'Common Backbone.' In order to snoop on these circuits, a special cabinet was installed and cabled to the secret room on the sixth floor to monitor the information going through the circuits. The location code of the cabinet is [and he gives a number] which denotes the seventh floor, aisle 177, and bay 04.

"The secret room itself is roughly 24x48 feet, containing perhaps a dozen cabinets including such equipment as Sun servers and two Juniper routers, plus an industrial-size air conditioner. Plans for the secret room were fully drawn up by December 2002, curiously only four months after DARPA started awarding contracts for TIA," whatever that is [Total Information Awareness]. And then we have two photos in this deposition, photos showing the room.

And then he says: "While doing my job, I learned fiber optic cables from the secret room were tapping into the WorldNet circuits by splitting off a portion of the light signal." And that's why the program is called PRISM, Leo. What does a prism do?


Leo: Oh, it splits a light signal.

Steve: It splits light. "I saw this in a design document available to me entitled 'Study Group 3, LGX/Splitter Wiring, San Francisco,' dated December 10th, 2002. I also saw design documents dated January 13th, 2004 and [blah blah blah] which instructed technicians on connecting some of the already in-service circuits to the 'splitter' cabinet, which diverts some of the light signal to the secret room. The circuits listed were the Peering Links, which connect WorldNet with other networks and hence the entire country, as well as the rest of the world."
So here is what NSA has done. This is installed in San Francisco. The NSA has installed this technology, this PRISM fiber-optic tapping/splitting technology, just upstream of all of those companies named. It is absolutely true that they probably never knew about it. They may be finding out about it for the first time, listening to this podcast. And I imagine it will suddenly all make sense to them. The NSA has said they had direct access to these companies' servers. Well, and that's the funny thing, the thing I noticed when I realized what was going on is that "server" is the only word anyone knows. My mom knows the word "server." Mika Brzezinski on "Morning Joe" knows about the AOL server or Google's servers. That's in the common parlance.

The word that we should have been using is "router." And that's not a word that people understand. But that's the key to this technology. As I was saying, routers concentrate data. Somewhere, and the NSA knows exactly where it is, Google is buying their bandwidth. And there are routers upstream of Google whose purpose it is to take the disparate packets all coming into Google and route them down fiber-optic lines which finally make the transit into Google's data center. It is unnecessary to have access to the datacenter if you are tapping the fiber-optic line going into and out of the datacenter.


Leo: Okay, but isn't this encrypted traffic?

Steve: Ah. Well, yes and no. So some of it is encrypted. But, for example, how is this useful? We all know that email has never been an encrypted technology. Email SMTP does not involve encryption when we send email from place to place unless an individual deliberately encrypts their email. And even if you were using Google, you may have a secured SSL connection to Google's web server when you're using Gmail. But the moment that email leaves to go to your mom on AOL, or it goes anywhere else outside of Google, it is being sent over SMTP connections which are not, that is, SMTP protocol, which is not encrypted. So even whereas our interchange with Google on their website is encrypted, email transiting the Internet isn't.
So all email outbound from Google is fully readable, and all email incoming to Google is fully readable. It's certainly true, and our surveillance state is unhappy with the growing use of encryption. But a huge, a vast, still the majority, arguably, of data is not encrypted. And then there is other sorts of metadata. We've talked about this on this podcast, for example, DNS queries. When you go to a website, your system has to query a DNS server in order to get the IP address. Well, that's typically not encrypted unless you use the service that OpenVPN offers.

So what we have is we have this system called PRISM. We have this bunch of companies that are absolutely sure that they have never agreed to blanket eavesdropping/wiretapping with the NSA. And I believe them. If the NSA had reason to specifically require data that is specific to a given case, we already know they go to a court, they get a warrant, and under a bond of secrecy they're able to get the data that the company has, if any, and the company is bound not to say it.

I don't believe that's what's going on. The fact that this is called PRISM, the fact that a prism splits light, the fact that we know from this prior testimony that there is a facility on Folsom that the NSA has been doing this - in fact, further on his testimony he quotes the specific routing technology, the gear that's being used. There is a semantic analysis technology. I don't know if I can find it here on the fly. But I just tweeted all the documents that contain this information for anybody who's wondering.

Anyway, I am convinced, from everything that I've seen, that - oh, also the timeline. This is not something you can do instantly. This is going to take time. So what it looks like from the timeline that we saw in one of those slides, where individual corporate entities were added to the PRISM project one at a time, that fits the facts, too. The idea that the NSA would say, okay, now we want to get everything, all of Apple's traffic we want to tap. Essentially what we have is wiretapping of these companies.

Now, remember that I don't know legally where this stands because this is the Internet. You could argue that, if somebody was installing, surreptitiously installing equipment inside Google's facility, well, then it's under Google's control, and it's Google's. All the NSA is doing is tapping the communications, which is still the Internet, it's just been filtered down so that it's nothing but Google's traffic.


Leo: So all they really need to do is find the backbones, the big Tier 1 providers. And you say there are about eight or nine of them? Or how many are there?

Steve: Well, no. What you need is, where you need to place the tap is as close to Google as you can get, or as close to Microsoft, or as close to Yahoo!, because you don't want a lot of other extraneous traffic. You want to get all of that.

Leo: I want it all.

Steve: Yes.

Leo: Okay. So would it have to be in Google's facility?

Steve: No. It would be - so, no. Google's going to have fiber that is going to be fed from their provider. Google is buying bandwidth from somebody.

Leo: Let's say it's Level 1. We don't know.

Steve: Level 3.

Leo: Or Level 3, I mean.

Steve: Yes.

Leo: Actually, let's say it's Level 1.

Steve: Okay, good.

Leo: Somebody called Level 1.

Steve: Somebody innocent.

Leo: So you would then go, as the NSA, to Level 1, issue them an NSL, a National Security Letter, which means they can't speak.

Steve: Yup.

Leo: And say we want to - we're just going to plug this little thing into your router. Can you give us a room?

Steve: Yes. We need, yes, we need a secret room, and we're going to staff it with our own people. Oh, at one point the air conditioning, the air conditioner's condensation tray overflowed and was spilling water in the secret room, and it was dripping down to the floor below, so that caused some problem. I guess they hadn't quite figured out how to drain the air conditioning condensate. But, yeah, so give us a secret room. So go ahead, Leo. I want you to restate it.

Leo: No, well, I think that you've answered my question. So they go to the Tier 1 provider, the Level 1 or whoever it is, and say give us...

Steve: Well, no, they go to the bandwidth provider of the company they're targeting. So it's not Tier 1. It might be Tier 3. I mean, it's like...

Leo: Aha.

Steve: Because it's going to come down the hierarchy until it gets to the entity they want to tap.

Leo: And you don't need to tell Google about this.

Steve: No. Google would have no idea.

Leo: And this gives them plausible deniability. They may know about it, but they may just - this gives them plausible deniability. No, no, they don't have access to our servers.

Steve: No, I think they'd be furious, Leo. They're being - this is a wiretap on...

Leo: Yeah, but surely they've figured this out.

Steve: Well, I haven't heard about it anywhere in the news. Nobody else seems to have figured out what PRISM is. And there is - this fits every fact. It's why it's called PRISM. They're using fiber-optic cable splitting. And it fits the whole timeline. They didn't just, bang, do it all at once because it's going to take time. They're going to have to go to the individual carriers who are providing bandwidth to these companies who are - and, I mean, the only thing Apple and Google and Yahoo! represent are major social focal points.

Leo: Right.

Steve: And actually, by tapping those major carriers, those major companies, the NSA is minimizing the work that they have to do because most people are going to use Google or Yahoo! or AOL and Apple and so forth.

Leo: There's precedent for this because remember Carnivore, which was renamed after they realized it was a terrible name, which was the FBI's attempt to get every Internet service provider in the country to put a box in their - again, another focal point. In fact, the best place to collect all this stuff is at the ISP level. And for individuals you can get it in every respect. And there's never really been any proof that this didn't happen. And then of course there's the recent law which was not passed, but might well still be, requiring ISPs to collect 18 months of data for use.

Steve: Well, so, again, I'm...

Leo: This all makes perfect sense. It's exactly how they're operating, and in fact the most efficient way to do it.

Steve: Yes. Yes. This is - if the NSA had come to me and said, Steve, what should we do?

Leo: How would I do this, yeah.

Steve: This is what I would design. I would design this system. I would say, you want to get, you know, if you need to be - you need to keep this a secret. You want to get all the traffic coming in and out of Google. You get as close to Google as you can. You get on the router that is feeding Google, and you clone all of the data. And that's exactly - and that's why it's called PRISM is that now, at this bandwidth level, they're using fiber optic cables, so it splits the light. The power drops by 50% down each of the splits because the power of the light has been split, but that's - there's still plenty. And so it's going to be received easily by the other end. And then it goes off to this secret room controlled by the NSA.
And it also fits what we heard because there was - we heard that there was this notion, I mean, we heard of PRISM, that you can - or maybe it was Edward who said that you could task this equipment to find things. So they're - so an analyst...


Leo: Wow, smarter than just a collector, it's actually sifting.

Steve: Yes, yes. And I'm looking here, if you see the link, it's klein-decl. It's cryptome.org/klein-decl.htm. So it's Klein Declaration. In there he shows the documents about installing the splitter, how to split it, all of the technical details. And he does cite the name of the company providing this - they call it "semantic analysis" equipment. So the idea is that an analyst sitting in Langley is able to task the Google tap to select, I mean, this is a torrential flood.

Leo: Remember, this was years ago, though. And I would guess now, because they have such high-end storage and processing, they probably just send it all to the center; right?

Steve: Well, they're readying five zettabytes.

Leo: Yeah, they'll end up sending it to Utah.

Steve: So why filter it? We may miss something we want.

Leo: Right. Well, precisely.

Steve: Let's just suck...

Leo: Save it all.

Steve: Yeah, suck it all in.

Leo: You never know what you might want.

Steve: Yup. And again, having the history allows them to go back and do research on the past.

Leo: So let me - let's get clear, though. What is it that they have? This is no longer metadata. This is all data that isn't encrypted.

Steve: Yes. So, yes. So, now, at this point, as far as we know, the use of SSL encryption will withstand the NSA's attack.

Leo: But they're saving it anyway, just in case.

Steve: Well, they're saving it because they know in the future your computers will get stronger. Maybe quantum computing technology will actually allow them to just collapse the 128-bit key. I'm uncomfortable with 128 bits. We really need to start thinking 256. And we'll talk about that soon on the podcast because the protocols exist on SSL; but, as we've spoken about the way SSL exists, both ends have to agree. And we've got all these banks out there who are scoring F's on their SSLLabs.com test because they're not using strong encryption. And so the cipher string has to be agreed to by each end.
But the point is certainly there's a percentage of data that the NSA - it is encrypted. They cannot read it. But any email coming into Google, any email leaving Google, which is to say any non-Gmail-to-Gmail communication, does exit - and in fact maybe it still goes, if it's going off to a different physical datacenter in Google, it's going to go out over the Internet. I don't know if Google maintains encryption of email traffic between their datacenters.

But anything, essentially everything coming and going in and out of the companies that were named, is probably now being tapped. And PRISM is the technology that does it. It is sitting just upstream of these companies, monitoring everything that they're doing, everything, I'm sorry, that every of their users are doing. Anything not encrypted is subject to surveillance.


Leo: Quite amazing. And what you say now makes perfect sense. I think you're right. We don't know because, A, anybody who knows probably is enjoined from saying anything by pretty strong federal restrictions.

Steve: Right. It's the only reason I can talk about it is that no one there told me anything, yes.

Leo: But what does make sense and I think is interesting is this is probably too technical for most lay observers to deduce. So they say "have full access to servers." And while Google is certainly, you know, the engineers at Google are certainly smart enough to understand that this is the risk, they're not allowed to say anything anyway. So they're going to say only what's strictly, you know, that they're allowed to say that's strictly true, which is they don't have access to our servers.

Steve: Yes. And it's absolutely true. They do not. Unfortunately, they have access to the pipe connecting your servers to the rest of the world.

Leo: They don't need access to your servers.

Steve: Yes, exactly. And it's funny, too, because the press, in trying to explain this discontinuity between the formal statements that were immediately issued by these companies, they were saying, well, they're parsing their words very carefully, or they've got really good attorneys. It's like, no. They're absolutely not complicit in this. The NSA has installed a tap in their connection to the Internet. And the tap, I'll say again, it's on the Internet. I mean, I don't know about the legality of this, but I was chuckling to myself because the NSA is doing this deliberately. Google did it by mistake when they were collecting unencrypted WiFi with their mapping technology.

Leo: Right, right. Well, so if you want to explain this to your grandma or a layperson, it's really something that I think any layperson can understand. You just say it's an upstream tap.

Steve: Yes.

Leo: They're tapping the Internet, and as a result they're getting...

Steve: Where it connects to the company.

Leo: To these companies.

Steve: Yeah.

Leo: And for all we know they're also tapping it where you connect to the Internet. So they can get you coming and going if they want.

Steve: Well, yes. They would, see, again, being sympathetic to the need for intelligence, I get it that they chose these companies because they are major focal points. So a tap located there would give them the most bang for the buck.

Leo: And the reason we know these companies is this is one of the slides in that slide deck that Snowden released.

Steve: Yes.

Leo: However, I have to think that really it goes much wider than this because, if you're going to Level 1, you might as well just say who else connects through you?

Steve: Well, Leo, we already know because the article that I read was an AT&T facility. This was tapping the so-called backbone. This is the - remember that the way these - at the very, very top we have the so-called Tier 1 providers. And they have what's called peering relationships with, like, so, like Level 3 and AT&T and Sprint have peering relationships with each other, where they are, because they're peers, and so they agree that they will send traffic to each other. What we read in this testimony and on this EFF page is this was the peering pipe at AT&T going to its peers.

Leo: So they did it. This is how they did it.

Steve: Yes. This is the entire Internet being tapped.

Leo: Yeah. If you were a WorldNet user in 2007, they were listening.

Steve: Yeah. Or, if you happen to be at two distant locations, and your traffic goes through AT&T on its way to another network, then it's present there. And I just - there's one more comment I wanted to make that I thought was - I felt, I mean, I understood it, and that is that Europe is very unhappy over this. We're sitting here, and the NSA is saying, and I don't believe them because how can I believe them now, they're saying we're only, I mean...

Leo: No, that's obviously not...

Steve: I mean, their great caveat is that they're only looking at foreign people.

Leo: Well, that's all they're technically allowed to look at.

Steve: Well, and that's nonsense.

Leo: By their charter, yeah.

Steve: Yes, that's nonsense. But even so, that means they're looking at everything outside the U.S. Well, that's half of this podcast's listeners, Leo.

Leo: And the FBI has the charter to do inside the U.S. and is presumably doing this with the help of the NSA.

Steve: Well, and I saw a little blurb yesterday that said that the "Finnish communications minister, Pia Viitanen, has stated bluntly that the NSA may be breaking the laws of Finland. According to the Finnish Constitution, capturing and reading emails or text messages without privileges is illegal."

Leo: I think it's illegal in the U.S.

Steve: "Viitanen plans to take up the issue with the European Commission."

Leo: Wow.

Steve: "Several European countries are apparently considering unleashing Neelie Kroes..."

Leo: Oh, she's great.

Steve: "...the feared European Commissioner for Digital Agenda, in an effort to fight back against the NSA's PRISM program."

Leo: Don't mess with Kroes, that's for sure.

Steve: So hide under a desk.

Leo: Oh, wow. The mind reels.

Steve: And lastly...

Leo: Yes, go ahead.

Steve: Lastly, in reaction to this, a site has been put up that immediately, along with the EFF - stopwatching.us. Stop Watching Us. It's taking signups. There are 63 companies that have already, or organizations that are behind this. And so I suggest that anybody who's interested - they've got a really crappy security certificate. I was disappointed in the security certificate for the site because it's an HTTPS site. I would like to see something better there. But stopwatching.us is someplace that anyone can go who's interested.
And Jon Stewart is off for the summer directing a movie, so John Oliver is standing in for "The Daily Show" on Comedy Central. His opening piece Monday night [June 10, 2013] was wonderful. Basically summed up the political side of this with the typical "Daily Show" comedy. So I wanted to recommend that to our listeners. It was really terrific. So if you can find "The Daily Show" for Monday, which would have been, what, the 10th of June, the beginning of it with John Oliver as the guest host, filling in for Jon Stewart, was great.

And, yes, Leo, you're right, the mind reels. But at least now we know what's going on.


Leo: The next step I would like, and maybe we'll do this on Know How, maybe you can do it, too, is telling people some simple steps you can take to encrypt your email, encrypt your traffic. If you really, I mean, you can't hide who you're sending it to because that has to be public, otherwise it won't get there, although I guess you could use Hushmail or something like that and have private addresses, as well. But I think this, you know, for a long time I used PGP and encouraged people to send me encrypted email. Nobody ever did it.

Steve: Here's what's interesting is the polls came out yesterday morning.

Leo: 56% of Americans don't care.

Steve: I saw 62, 62 versus 34% of Americans say they are okay with this.

Leo: Because it's protecting us against terrorism.

Steve: If it protects us against terrorism.

Leo: Right.

Steve: And then there's always the conundrum, well, if you don't have anything to hide, what do you care?

Leo: I even heard a federal official say that this week, that nobody who's a law-abiding citizen should worry about this.

Steve: So I was very annoyed that Google got in the trouble they did for inadvertently collecting unencrypted WiFi which was being broadcast to them in the air, when here we have the NSA that has used prisms to split the optical cables going to these major companies to install local taps. It's just there's something wrong there. I understand the NSA's need for the data, but - in order to find bad guys. But they have to tell the truth. I mean, they have to tell Congress the truth. They don't have to tell me or you. They have to tell Congress because that's the only way that we have checks and balances.

Leo: Well, and they may. They may have told the House Foreign Intelligence, and they may have told people this. It's my suspicion that some lawmakers, not all, know about it and have approved it. And I think this is the problem is that people want to be safe against terrorism and understand that this has to be done. And I think the fear is, if the federal government admits to this, then the bad guys go, oh, well, that's no problem, we'll just use Cryptocat.

Steve: Well, here's what's really interesting, too, is imagine that you have the dragnet over all phone communications, all telephony metadata. And three clever terrorists say, oh, well, we're going to avoid the system. We're going to get so-called "burner" phones, you know, temporary phones. And we're never going to give the phone number out. We're never going to dial any other phone except these three. And we're only going to use it to talk to each other. Well, how suspicious is that?

Leo: You immediately know.

Steve: Yes.

Leo: Big red flag.

Steve: The NSA would find three little nodes with lots of connections among themselves, but nobody ever phoned into them, and they never phoned out to anyone else. There's a little island there, and that's something to look at. So this is phenomenally powerful, this so-called metadata, powerful information. And as far as I know, Leo, this podcast is the first disclosure of what the NSA's PRISM program is, that it is a tap, an optical fiber tap on these companies. I don't know what results from this. But I imagine now Congress will know how to ask some better questions.

Leo: I hope so.

Steve: And these companies will probably want to find out if this is going on.

Leo: Yeah. Steve Gibson is at GRC.com. That's his website, if you want to spy on him. He gives away many, many wonderful security tools including ShieldsUP!. Make sure you check your Plug & Play status there with the ShieldsUP! program. Make sure your router isn't releasing information to the outside world or access to your inside network. You can also get SpinRite. That's his bread and butter, the world's finest hard drive maintenance and recovery utility. And for people with bandwidth issues, the 16Kb version of the show. And if you would like to send a transcript to your elected officials, that might not be a bad idea, and those transcripts are made by Elaine Farris and made available on Steve's site as well, GRC.com.

Steve: Elaine's a little under the weather at the moment.

Leo: I'm sorry, Elaine.

Steve: She didn't know when we were going to get the audio; but, if it came in time, then she thought she'd be able to start on it. So anyway, the point is that we will have full textual transcripts of the podcast in all of its glory a couple days from now, posted on GRC.

Leo: Good, good. You also can go there to ask questions. And we will do a Q&A episode.

Steve: Yup, I imagine we'll have lots of questions. And we'll probably still be talking about this next week.

Leo: Yeah. And that will be GRC.com/feedback, if you'd like to pose a question to Steve Gibson. We've mentioned before he's on Twitter @SGgrc. Follow him there.

Steve: I was just going to say that I just tweeted five bit.ly links to these documents, to some PDF forms and these redacted and redaction-filled-in documents that exist on the 'Net. If anyone's interested in additional information, I mean, it just - it's riveting stuff, really interesting.

Leo: Yeah, it really is. Thank you, Steve Gibson. We do this show every Wednesday. You can find us right here at 11:00 a.m. Pacific, 2:00 p.m. Eastern time, 19:00 UTC on TWiT.tv. Do watch live. Lot of fun. And you're welcome to visit us in-studio, as well. We always have visitors. People love to see you live, Steve. But if you can't, we always have on-demand audio and video after the fact, not only on Steve's site, but high-quality audio MP3s and video, as well, available at TWiT.tv/sn, or wherever you get your podcasts, like iTunes.

Steve: I think I'm going to be up maybe in August.

Leo: Ooh.

Steve: I think Jenny's going to come up to do her regular summer visit of friends, and I thing I'm going to come up, and I'm planning to synchronize it with a Wednesday so I can do the podcast in-studio with you, Leo.

Leo: Great. That would be a lot of fun.

Steve: Yeah, it would be.

Leo: I look forward to that. And I'll buy you...

Steve: Okay, my friend.

Leo: Dinner's on me. Or lunch.

Steve: Okay.

Leo: Thanks, Steve. We'll see you next time...

Steve: Thank you.

Leo: ...on Security Now!.

[Allegro]

Those of you who use StartPage HTTPS as your primary searcher in Firefox, I noticed this text-link—NEWS: Giant US government Internet spying scandal revealed—at the top of the page of search results, and I’ve copied that content below. Here’s StartPage’s Privacy page.

No PRISM. No Surveillance. No Government Back Doors. You Have our Word on it.
Giant US government Internet spying scandal revealed

The Washington Post and The Guardian have revealed a US government mass Internet surveillance program code-named “PRISM”. They report that the NSA and the FBI have been tapping directly into the servers of nine US service providers, including Facebook, Microsoft, Google, Apple, Yahoo, YouTube, AOL and Skype, and began this surveillance program at least seven years ago. (clarifying slides)

These revelations are shaking up an international debate.

StartPage has always been very outspoken when it comes to protecting people’s Privacy and civil liberties. So it won’t surprise you that we are a strong opponent of overreaching, unaccountable spy programs like PRISM. In the past, even government surveillance programs that were begun with good intentions have become tools for abuse, for example tracking civil rights and anti-war protesters.

Programs like PRISM undermine our Privacy, disrupt faith in governments, and are a danger to the free Internet.

StartPage and its sister search engine Ixquick have in their 14-year history never provided a single byte of user data to the US government, or any other government or agency. Not under PRISM, nor under any other program in the US, nor under any program anywhere in the world. We are not like Yahoo, Facebook, Google, Apple, Skype, or the other US companies who got caught up in the web of PRISM surveillance.

Here’s how we are different:

• StartPage does not store any user data. We make this perfectly clear to everyone, including any governmental agencies. We do not record the IP addresses of our users and we don’t use tracking cookies, so there is literally no data about you on our servers to access. Since we don’t even know who our customers are, we can’t share anything with Big Brother. In fact, we’ve never gotten even a single request from a governmental authority to supply user data in the fourteen years we’ve been in business.

• StartPage uses encryption (HTTPS) by default. Encryption prevents snooping. Your searches are encrypted, so others can’t “tap” the Internet connection to snoop what you’re searching for. This combination of not storing data together with using strong encryption for the connections is key in protecting your Privacy.

• Our company is based in The Netherlands, Europe. US jurisdiction does not apply to us, at least not directly. Any request or demand from ANY government (including the US) to deliver user data, will be thoroughly checked by our lawyers, and we will not comply unless the law which actually applies to us would undeniably require it from us. And even in that hypothetical situation, we refer to our first point; we don’t even have any user data to give. We will never cooperate with voluntary spying programs like PRISM.

• StartPage cannot be forced to start spying. Given the strong protection of the Right to Privacy in Europe, European governments cannot just start forcing service providers like us to implement a blanket spying program on their users. And if that ever changed, we would fight this to the end.

Privacy. It’s not just our policy, it’s our mission.

Sincerely,

Robert E.G. Beens
CEO StartPage.com and Ixquick.com