{"id":4839,"date":"2013-06-07T07:17:31","date_gmt":"2013-06-07T07:17:31","guid":{"rendered":"http:\/\/praag.org\/?p=4839"},"modified":"2013-06-07T07:17:31","modified_gmt":"2013-06-07T07:17:31","slug":"they-can-watch-your-ideas-form-as-you-type","status":"publish","type":"post","link":"https:\/\/praag.org\/?p=4839","title":{"rendered":"‘They can watch your ideas form as you type’"},"content":{"rendered":"

\"\"<\/a>The National Security Agency and the FBI in the US are tapping directly into the central servers of nine leading U.S. Internet companies, extracting audio and video chats, photographs, e-mails, documents, and connection logs that enable analysts to track foreign targets, according to a top-secret document obtained by The Washington Post.<\/p>\n

The program, code-named PRISM, has not been made public until now. It may be the first of its kind. The NSA prides itself on stealing secrets and breaking codes, and it is accustomed to corporate partnerships that help it divert data traffic or sidestep barriers. But there has never been a Google or Facebook before, and it is unlikely that there are richer troves of valuable intelligence than the ones in Silicon Valley.<\/p>\n

Equally unusual is the way the NSA extracts what it wants, according to the document: \u201cCollection directly from the servers of these U.S. Service Providers: Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube, Apple.\u201d<\/p>\n

PRISM was launched from the ashes of President George W. Bush\u2019s secret program of warrantless domestic surveillance in 2007, after news media disclosures, lawsuits and the Foreign Intelligence Surveillance Court forced the president to look for new authority.<\/p>\n

Congress obliged with the Protect America Act in 2007 and the FISA Amendments Act of 2008, which immunized private companies that cooperated voluntarily with U.S. intelligence collection. PRISM recruited its first partner, Microsoft, and began six years of rapidly growing data collection beneath the surface of a roiling national debate on surveillance and privacy. Late last year, when critics in Congress sought changes in the FISA Amendments Act, the only lawmakers who knew about PRISM were bound by oaths of office to hold their tongues.<\/p>\n

The court-approved program is focused on foreign communications traffic, which often flows through U.S. servers even when sent from one overseas location to another. Between 2004 and 2007, Bush administration lawyers persuaded federal FISA judges to issue surveillance orders in a fundamentally new form. Until then the government had to show probable cause that a particular \u201ctarget\u201d and \u201cfacility\u201d were both connected to terrorism or espionage.<\/p>\n

In four new orders, which remain classified, the court defined massive data sets as \u201cfacilities\u201d and agreed to certify periodically that the government had reasonable procedures in place to minimize collection of \u201cU.S. persons\u201d data without a warrant.<\/p>\n

In a statement issue late Thursday, Director of National Intelligence James R. Clapper said \u201cinformation collected under this program is among the most important and valuable foreign intelligence information we collect, and is used to protect our nation from a wide variety of threats. The unauthorized disclosure of information about this important and entirely legal program is reprehensible and risks important protections for the security of Americans.\u201d<\/p>\n

Clapper added that there were numerous inaccuracies in reports about PRISM by The Post and the Guardian newspaper, but he did not specify any.<\/p>\n

Jameel Jaffer, deputy legal director of the American Civil Liberties Union, said: \u201cI would just push back on the idea that the court has signed off on it, so why worry? This is a court that meets in secret, allows only the government to appear before it, and publishes almost none of its opinions. It has never been an effective check on government.\u201d<\/p>\n

Several companies contacted by The Post said they had no knowledge of the program, did not allow direct government access to their servers and asserted that they responded only to targeted requests for information.<\/p>\n

\u201cWe do not provide any government organization with direct access to Facebook servers,\u201d said Joe Sullivan, chief security officer for Facebook. \u201cWhen Facebook is asked for data or information about specific individuals, we carefully scrutinize any such request for compliance with all applicable laws, and provide information only to the extent required by law.\u201d<\/p>\n

\u201cWe have never heard of PRISM,\u201d said Steve Dowling, a spokesman for Apple. \u201cWe do not provide any government agency with direct access to our servers, and any government agency requesting customer data must get a court order.\u201d<\/p>\n

It is possible that the conflict between the PRISM slides and the company spokesmen is the result of imprecision on the part of the NSA author. In another classified report obtained by The Post, the arrangement is described as allowing \u201ccollection managers [to send] content tasking instructions directly to equipment installed at company-controlled locations,\u201d rather than directly to company servers.<\/p>\n

Government officials and the document itself made clear that the NSA regarded the identities of its private partners as PRISM\u2019s most sensitive secret, fearing that the companies would withdraw from the program if exposed. \u201c98 percent of PRISM production is based on Yahoo, Google and Microsoft; we need to make sure we don\u2019t harm these sources,\u201d the briefing\u2019s author wrote in his speaker\u2019s notes.<\/p>\n

An internal presentation of 41 briefing slides on PRISM, dated April 2013 and intended for senior analysts in the NSA\u2019s Signals Intelligence Directorate, described the new tool as the most prolific contributor to the President\u2019s Daily Brief, which cited PRISM data in 1,477 items last year. According to the slides and other supporting materials obtained by The Post, \u201cNSA reporting increasingly relies on PRISM\u201d as its leading source of raw material, accounting for nearly 1 in 7 intelligence reports.<\/p>\n

That is a remarkable figure in an agency that measures annual intake in the trillions of communications. It is all the more striking because the NSA, whose lawful mission is foreign intelligence, is reaching deep inside the machinery of American companies that host hundreds of millions of\u00a0American-held accounts on American soil.<\/p>\n

The technology companies, whose cooperation is essential to PRISM operations, include most of the dominant global players of Silicon Valley, according to the document. They are listed on a roster that bears their logos in order of entry into the program: \u201cMicrosoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube, Apple.\u201d PalTalk, although much smaller, has hosted traffic of substantial intelligence interest during the Arab Spring and in the ongoing Syrian civil war.<\/p>\n

Dropbox, the cloud storage and synchronization service, is described as \u201ccoming soon.\u201d<\/p>\n

Sens. Ron Wyden (D-Ore.) and Mark Udall (D-Colo.), who had classified knowledge of the program as members of the Senate Intelligence Committee, were unable to speak of it when they warned in a Dec. 27, 2012, floor debate that the FISA Amendments Act had what both of them called a \u201cback-door search loophole\u201d for the content of innocent Americans who were swept up in a search for someone else.<\/p>\n

\u201cAs it is written, there is nothing to prohibit the intelligence community from searching through a pile of communications, which may have been incidentally or accidentally been collected without a warrant, to deliberately search for the phone calls or e-mails of specific Americans,\u201d Udall said.<\/p>\n

Wyden repeatedly asked the NSA to estimate the number of Americans whose communications had been incidentally collected, and the agency\u2019s director, Lt. Gen. Keith B. Alexander, insisted there was no way to find out. Eventually Inspector General I. Charles McCullough III wrote Wyden a letter stating that it would violate the privacy of Americans in NSA data banks to try to estimate their number.<\/p>\n

\n

Roots in the \u201970s<\/strong><\/p>\n

PRISM is an heir, in one sense, to a history of intelligence alliances with as many as 100 trusted U.S. companies since the 1970s. The NSA calls these Special Source Operations, and PRISM falls under that rubric.<\/p>\n

The Silicon Valley operation works alongside a parallel program, code-named BLARNEY, that gathers up \u201cmetadata\u201d \u2014 technical information about communications traffic and network devices \u2014 as it streams past choke points along the backbone of the Internet. BLARNEY\u2019s top-secret program summary, set down in the slides alongside a cartoon insignia of a shamrock and a leprechaun hat, describes it as \u201can ongoing collection program that leverages IC [intelligence community] and commercial partnerships to gain access and exploit foreign intelligence obtained from global networks.\u201d<\/p>\n

But the PRISM program appears to more nearly resemble the most controversial of the warrantless surveillance orders issued by President George W. Bush after the al-Qaeda attacks of Sept. 11, 2001. Its history, in which President Obama presided over exponential growth in a program that candidate Obama criticized, shows how fundamentally surveillance law and practice have shifted away from individual suspicion in favor of systematic, mass collection techniques.<\/p>\n

The Obama administration points to ongoing safeguards in the form of \u201cextensive procedures, specifically approved by the court, to ensure that only non-U.S. persons outside the U.S. are targeted, and that minimize the acquisition, retention and dissemination of incidentally acquired information about U.S. persons.\u201d<\/p>\n

And it is true that the PRISM program is not a dragnet, exactly. From inside a company\u2019s data stream the NSA is capable of pulling out anything it likes, but under current rules the agency does not try to collect it all.<\/p>\n

Analysts who use the system from a Web portal at Fort Meade, Md., key in \u201cselectors,\u201d or search terms, that are designed to produce at least 51 percent confidence in a target\u2019s \u201cforeignness.\u201d That is not a very stringent test. Training materials obtained by The Post instruct new analysts to make quarterly reports of any accidental collection of U.S. content, but add that \u201cit\u2019s nothing to worry about.\u201d<\/p>\n

Even when the system works just as advertised, with no American singled out for targeting, the NSA routinely collects a great deal of American content. That is described as \u201cincidental,\u201d and it is inherent in contact chaining, one of the basic tools of the trade. To collect on a suspected spy or foreign terrorist means, at minimum, that everyone in the suspect\u2019s inbox or outbox is swept in. Intelligence analysts are typically taught to chain through contacts two \u201chops\u201d out from their target, which increases \u201cincidental collection\u201d exponentially. The same math explains the aphorism, from the John Guare play, that no one is more than \u201csix degrees of separation\u201d from any other person.<\/p>\n

\n

A \u2018directive\u2019<\/strong><\/p>\n

In exchange for immunity from lawsuits, companies such as Yahoo and AOL are obliged to accept a \u201cdirective\u201d from the attorney general and the director of national intelligence to open their servers to the FBI\u2019s Data Intercept Technology Unit, which handles liaison to U.S. companies from the NSA. In 2008, Congress gave the Justice Department authority for a secret order from the Foreign Surveillance Intelligence Court to compel a reluctant company \u201cto comply.\u201d<\/p>\n

In practice, there is room for a company to maneuver, delay or resist. When a clandestine intelligence program meets a highly regulated industry, said a lawyer with experience in bridging the gaps, neither side wants to risk a public fight. The engineering problems are so immense, in systems of such complexity and frequent change, that the FBI and NSA would be hard pressed to build in back doors without active help from each company.<\/p>\n

Apple demonstrated that resistance is possible when it held out for more than five years, for reasons unknown, after Microsoft became PRISM\u2019s first corporate partner in May 2007. Twitter, which has cultivated a reputation for aggressive defense of its users\u2019 privacy, is still conspicuous by its absence from the list of \u201cprivate sector partners.\u201d<\/p>\n

Google, like the other companies, denied that it permitted direct government access to its servers.<\/p>\n

\u201cGoogle cares deeply about the security of our users\u2019 data,\u201d a company spokesman said. \u201cWe disclose user data to government in accordance with the law, and we review all such requests carefully. From time to time, people allege that we have created a government \u2018back door\u2019 into our systems, but Google does not have a \u2018back door\u2019 for the government to access private user data.\u201d<\/p>\n

Microsoft also provided a statement: \u201cWe provide customer data only when we receive a legally binding order or subpoena to do so, and never on a voluntary basis. In addition we only ever comply with orders for requests about specific accounts or identifiers. If the government has a broader voluntary national security program to gather customer data we don\u2019t participate in it.\u201d<\/p>\n

Yahoo also issued a denial.<\/p>\n

\u201cYahoo! takes users\u2019 privacy very seriously,\u201d the company said in a statement. \u201cWe do not provide the government with direct access to our servers, systems, or network.\u201d<\/p>\n

Like market researchers, but with far more privileged access, collection managers in the NSA\u2019s Special Source Operations group, which oversees the PRISM program, are drawn to the wealth of information about their subjects in online accounts. For much the same reason, civil libertarians and some ordinary users may be troubled by the menu available to analysts who hold the required clearances to \u201ctask\u201d the PRISM system.<\/p>\n

There has been \u201ccontinued exponential growth in tasking to Facebook and Skype,\u201d according to the PRISM slides. With a few clicks and an affirmation that the subject is believed to be engaged in terrorism, espionage or nuclear proliferation, an analyst obtains full access to Facebook\u2019s \u201cextensive search and surveillance capabilities against the variety of online social networking services.\u201d<\/p>\n

According to a separate \u201cUser\u2019s Guide for PRISM Skype Collection,\u201d that service can be monitored for audio when one end of the call is a conventional telephone and for any combination of \u201caudio, video, chat, and file transfers\u201d when Skype users connect by computer alone. Google\u2019s offerings include Gmail, voice and video chat, Google Drive files, photo libraries, and live surveillance of search terms.<\/p>\n

Firsthand experience with these systems, and horror at their capabilities, is what drove a career intelligence officer to provide PowerPoint slides about PRISM and supporting materials to The Washington Post in order to expose what he believes to be a gross intrusion on privacy. \u201cThey quite literally can watch your ideas form as you type,\u201d the officer said. – Washington Post<\/p>\n","protected":false},"excerpt":{"rendered":"

The National Security Agency and the FBI in the US are tapping directly into the central servers of nine leading U.S. Internet companies, extracting audio and video chats, photographs, e-mails, documents, and connection logs that enable analysts to track foreign targets, according to a top-secret document obtained by The Washington Post. The program, code-named PRISM, … Continue reading “‘They can watch your ideas form as you type’”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":4840,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,86,10,123],"tags":[1039,2914,2911,2912,2913],"class_list":["post-4839","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","category-technology","category-united-states","category-world","tag-fbi","tag-fisa","tag-national-security-agency","tag-prism","tag-warrantless-domestic-surveillance"],"cc_featured_image_caption":{"caption_text":false,"source_text":false,"source_url":false},"jetpack_featured_media_url":"https:\/\/praag.org\/wp-content\/uploads\/2013\/06\/fbikey.jpg","_links":{"self":[{"href":"https:\/\/praag.org\/index.php?rest_route=\/wp\/v2\/posts\/4839","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/praag.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/praag.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/praag.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/praag.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4839"}],"version-history":[{"count":2,"href":"https:\/\/praag.org\/index.php?rest_route=\/wp\/v2\/posts\/4839\/revisions"}],"predecessor-version":[{"id":4842,"href":"https:\/\/praag.org\/index.php?rest_route=\/wp\/v2\/posts\/4839\/revisions\/4842"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/praag.org\/index.php?rest_route=\/wp\/v2\/media\/4840"}],"wp:attachment":[{"href":"https:\/\/praag.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4839"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/praag.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4839"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/praag.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4839"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}