WA Post Publishes 4 More Slides On Data Collection From Google, Et Al

anagama writes "Lots of new program names, flowcharts, and detail in four previously unreleased PRISM slides published by the Washington Post today. These slides provide some additional detail about PRISM and outline how the NSA gets information from those nine well known internet companies. Apparently, the collection is done by the FBI using its own equipment on the various companies' premises and then passed to the NSA where it is filtered and sorted."

Comments

As a concerned Canadian

[Anonymous Coward]

I've already quit Google. Now how about you?

Re:As a concerned Canadian

[guruevi]

Check the HTML - Google gets notified of every page you visit on here, in detail.

Re:As a concerned Canadian

[Wookie Monster]

Ghostery blocked five trackers on this page. http://www.ghostery.com/

Re:As a concerned Canadian

[Nerdfest]

... and go where? Assuming it's true, all of the big players are there. Anyone who gets big enough will just get added to the list. I block javascript and cookies for the most part and encrypt any data I want kept save if I put it in 'cloud' storage. I'm not even sure if these companies had any way to refuse or warn the public about this, but I'm disappointed that someone didn't pull a 'Snowden'. The real problem here is not the companies, it's the government. People need to go to prison for this, from the FBA/CIA all the way up to the Whitehouse.

Re:As a concerned Canadian

[flyingfsck]

OK and how can I block Ghostery's snooping?

Re:As a concerned Canadian

[Anonymous Coward]

OK and how can I block Ghostery's snooping?

I think Ghostery Busters is the place to start.

Re:As a concerned Canadian

[fustakrakich]

The real problem here is not the companies, it's the government.

Oh please, the companies write the rules for the government to enforce. The problem here is us. We let them do it. And only dangerous people should be in prison.

Re:As a concerned Canadian

[Anonymous Coward]

You've quit on Google, but Google hasn't quit on you.

Re:As a concerned Canadian

[fustakrakich]

How would you suggest these people be punished?

Chain gang... Oh, seriously? Loss of their position and benefits and forfeiture of other assets and income would be sufficient. Maybe the word 'thief' tattooed on their forehead... I'd rather make them face the stares and curses of the people they betray.

*What's the best way to get revenge against a rich man? Make him a poor man.*

Re:As a concerned Canadian

[Mike Frett]

Are you ready to quit Microsoft also? They were one of the first to jump on board with all this nonsense. Quitting one and not the other would make no sense.

Re:As a concerned Canadian

[anagama]

All that plus a little time in PMITA Federal Prison would be nice. I mean they've built and profited from the largest prison industry in the world. They should experience it because it's theirs.

Re:As a concerned Canadian

[Gr8Apes]

Run TOR on various occassions, do it randomly - you'll add to your traffic pattern and help others stay anonymous.

Re:As a concerned Canadian

[DigiShaman]

In Soviet Russia, Google searches YOU!

Well that validates the 'weasel word' disclaimers.

[Anonymous Coward]

Google et al. said something, IIRC, like 'we do not collect and pass on any info to the NSA'. Technically true, but also completely irrelevant to whether or not the NSA was actually collecting data.

Asking corps or government about what they do and don't collect is like asking a genie for a wish: one must phrase the question perfectly, or they'll twist it any way they can in order to answer what you asked, but not what you really wanted to know.

Re:confusion

[The Second Horseman]

Actually, I'm glad they're leaking these a bit at a time - in some cases, it's exposing the denials as BS. For example, we've known about the FBI CALEA infrastructure for years. The fact that it's being used to wholesale grab information and pass it to the NSA shows the hair splitting that's going on in the denials.

And actually, the FBI probably does have some CALEA hooks into providers. Google Voice and Skype are almost certainly set up to handle requests, even as the FBI is attempting to get CALEA formally expanded. That's likely not being handled at the ISP level. Further evidence of that? Microsoft wanted to provide statistics about how many requests they get for each service, and the government said "no". The "unnamed sources" complaint from inside Microsoft is that the government doesn't want people to know the extent to which Skype is being targeted.

Re:confusion

[anagama]

The FBI equipment is for CALEA and is on site in ISP's, not content providers such as google and yahoo.

The third slide has this annotation:

The PRISM case notation format reflects the availability, confirmed by The Post's reporting, of real-time surveillance as well as stored content. ... Depending on the provider [referencing the infamous 9], the NSA may receive live notifications when a target logs on or sends an e-mail, or may monitor a voice, text or voice chat as it happens (noted on the first slide as "Surveillance").

So who should I believe -- the government's own claims or that of an AC?

Illegal power without Constitutional authority

[roman_mir]

This is an unconstitutional power that the USA federal government usurped from the people, it doesn't actually matter how they grab most of it, however what does matter is that they do and it looks like it's not going to stop until the system crashes and there is no more money to run it.

Encrypt your communications, encrypt everything you can. Use self signed certificates, by the way, avoid Certificate Authorities, AFAIC they only make it easier to create a MITM attack, not harder. They can confirm to your device that a certificate is valid even if it is not the certificate that you want to use. Of-course if you use CAs do not let them generate your keys for you.

At this point the behaviour of browsers to treat self-signed certificates as worse than plain text should be suspect to everybody, there is no rational explanation to that sort of attitude except: we don't want you to use certificates that authorities can't revoke and replace.

Re:Illegal power without Constitutional authority

[mcgrew]

He wasn't modded down. Roman mir posts so much incoherent schitzophrenic babble that his karma is in the toilet. Look at the moderation (click on the number on a comment to see how it was modded). He's at +1 now with 100% insightful. Moderation worked.

OTOH you should be modded offtopic. Moderation failed on your comment. It wasn't informative, it was incorrect. Mods, please pay attention! If someone's sitting below 1, don't assume he'd been modded down.

Re:Illegal power without Constitutional authority

[roman_mir]

Funny story, a few years back when I wrote this, I added in the functions to encrypt and decrypt text in browser input elements with a predetermined password. At the time when I was working on it, FF was some much older version and to my surprise when I was debugging the code, I realised that I could use Javascript to read input characters from password fields in my code from ANY page. That was unfortunate (I think they fixed that by now). But of-course today if you use something like gmail or hotmail, they can capture keystrokes and document change events and send them back to the servers individually, so at this point if you are going to use something like leetkey for encryption, you have to use the function (that is provided in my addon at least) to open a new browser window or tab with a text area where you can type something and encrypt it first and then cut and paste into your email window's text area.

Re:Illegal power without Constitutional authority

[anagama]

That's very interesting. A friend of mine was talking about doing a similar thing recently so I'm going to let him know about this.

One of the problems with encryption, is that even if the content is secret, who it was sent to and who sent it isn't necessarily so. That makes me think that perhaps one the scourges of the internet, spam, could be turned into a secure means of communication, because if a message is delivered to 50m people, figuring out who it was intended for is pretty hard. Couple that with an encryption system that instead of using random letters and characters to represent the plain text content, it would use common words to randomly represent each letter, making the text readable but gibberish so it wasn't obviously encrypted data at a glance. Throw in an advert for Viagra and the text would look like an attempt to evade spam filters.

Anyway, I'd love to see someone work on that end of secure communications, in particular, obscuring sender and receiver information. One hard part would be figuring out how to get the emails to spammers in a way that is not traceable, but once spammed, the message would be pretty anonymous both in content and at least for recipient. The spammer would probably get grilled if found out, so that IS a weak link.

Re:Illegal power without Constitutional authority

[pilot1]

At this point the behaviour of browsers to treat self-signed certificates as worse than plain text should be suspect to everybody, there is no rational explanation to that sort of attitude except: we don't want you to use certificates that authorities can't revoke and replace.

I agree that everyone would be better off if everyone encrypted everything. I also agree that CAs shouldn't be trusted.

But seriously? You can't see any reason to distrust self-signed certificates? They aren't trusted because the browser has no way to verify their authenticity, which makes them dangerous. Trusting them would make man-in-the-middle attacks against SSL too easy; many studies have shown that users ignore the warnings. This _IS WORSE_ than plaintext because the user believes they have a secure connection when they don't. With plaintext the user at least doesn't expect the connection to be secure.

There's absolutely nothing stopping you from using self-signed certificates in a secure way. Configure your browser to trust specific self-signed certificates that you can verify are authentic, and you're good. It's incredibly insecure to trust _ANY_ self-signed certificate; your assertion that "the authorities" are trying to prevent you from using them is nothing but paranoia. There are plenty of things to be paranoid about these days. This isn't one of them.

Re:Illegal power without Constitutional authority

[roman_mir]

You can't see any reason to distrust self-signed certificates?

- I trust them much more than I trust governments and certificate authorities. I trust that using an encrypted connection with self signed certificate is NOT WORSE than using plain text and I don't trust that the browser behaviour regarding self signed certificates is without suspect, without a bias.

IF your argument had any merit, THEN browsers could at least use the self signed certificate and NOT show the 'secure' icon, show whatever you like, don't break browsing experience for users. Don't say that the connection is perfectly secure, but don't make it look like the user is about to access a virus infected site or something to that effect, that's where my mistrust of benevolent browser behaviour comes from.

Re: Illegal power without Constitutional authority

[Anonymous Coward]

How long before we find out that CAs are part of the whole spying industry also?

Re:Illegal power without Constitutional authority

[roman_mir]

It is worse. Using an encrypted connection with a self signed certificate is worse than plain text in terms of security. With HTTP a man-in-the-middle can see everything you send. With HTTPS using a self-signed certificate a mitm can substitute their certificate for yours and see everything you send.

- nonsense and it is dangerous nonsense given the facts that we now are aware of about the governments recording all communications to look at a LATER DATE.

If somebody, especially government is specifically targeting you for MITM attack, no CA will stop them, worse, AFAIC CAs are are highly suspect, CAs are a perfect target for government 3LAs to create an easy way to penetrate security.

In fact there cannot be 'secure' icon on a browser if a CA is used! The only way to have highest order of security that we can achieve right now is to install self signed certificates where we know the fingerprint and to prevent CAs from authorising anything at all on our computers.

Again, given what we know about government snooping on people making it ANY more difficult for users to have encrypted communications to any server is only helping government secret police to go back in time and retrieve and search through any communications that are happening on the Internet.

Plain text is the worst possible way to transfer data that should be secured and AFAIC at this point all communications need to be secured, there shouldn't be ANY plain text communications on the Internet, plain text communications is the worst possible thing that is happening right now given what the governments are doing.

Once again, I completely, 100% disagree with your idea that self signed certificates are in any way worse than plain text, that's pure nonsense and dangerous given our times.

Re:Illegal power without Constitutional authority

[icebike]

Don't be ridiculous. As a well documented historical relic, the paper is worth much more than you think.

Re:Illegal power without Constitutional authority

[roman_mir]

I saw your post, I understand what encryptions is, what certificates are, what self signing is, I develop with it and use it all the time. Again, unless you are working for CAs and have a dog in this fight or you are NSA, you wouldn't want people to use self signed certificates, that's true. Otherwise it is a nonsensical irrational position to state that self signed certificates EVEN when are not deployed manually, when the fingerprint is not checked by the end client are worse in any way than plain text given the fact that governments are recording everything for assessment and for looking at it when time comes later.

When time comes later, the information may still be recovered if the government is really really interested in finding out what it was that you wrote there, however it's going to be much more difficult than if it was plain text, there is nothing to recover with plain text, it's out in the open.

Saying that self signed certificates are worse than plain text is either propaganda for some ulterior motive or it is an irrational position, because the end user does NOT even have to be AWARE that a self signed certificate is used!

In fact if the browser doesn't even tell the user that there is a self signed certificate, then to the user it looks like a plain text connection and maybe that's how browsers really should treat self signed certificates that are not manually authorised by the user.

Do not even bother telling the user that a self signed certificate is used, whatever. Treat it EXACTLY like a plain text connection, so that the user is not even aware that there is a self signed certificate UNLESS he goes into the properties of the page and specifically checks for that.

But doing what the browsers are doing today is in fact completely counter productive and it's done to scare people away from websites that use self signing certificates and this just may be profitable for CAs and excellent for the government spies, but it's terrible for the users.

Re:Illegal power without Constitutional authority

[pilot1]

... given the fact that governments are recording everything for assessment and for looking at it when time comes later. When time comes later, the information may still be recovered if the government is really really interested in finding out what it was that you wrote there, however it's going to be much more difficult than if it was plain text, there is nothing to recover with plain text, it's out in the open.

There are two scenarios here: either the government performs mitm attacks or they don't.

If they do perform mitm attacks, using an untrusted self-signed certificate is equivalent to using a CA-signed certificate in terms of what the govt can see. The govt can perform a mitm on the self-signed connectino by using their own self-signed cert, and the govt can perform a mitm on the CA-signed connection by forcing the CA to give up the CA cert and signing a new cert with the CA cert.

If they don't perform mitm attacks, the govt needs the website's cert to view the traffic. This means they either need foo.com's self-signed cert or bar.com's CA-signed cert. Either way, the CA's cert alone isn't good enough.

If you don't agree with those two scenarios, please explain which details are technically correct. (I'm fairly certain that none are.)

If you do agree, then it follows that you agree that using an untrusted self-signed cert is no better than using a CA-signed cert. The secure thing to do would be to use a trusted self-signed cert; that is, a self-signed cert whose fingerprint has been verified through a secure channel.

Saying that self signed certificates are worse than plain text is either propaganda for some ulterior motive or it is an irrational position, because the end user does NOT even have to be AWARE that a self signed certificate is used! In fact if the browser doesn't even tell the user that there is a self signed certificate, then to the user it looks like a plain text connection and maybe that's how browsers really should treat self signed certificates that are not manually authorised by the user.

That browser user interface change would create a huge security hole. Consider the following scenario:
1. Alice, the user, accesses https://bank.com/ which uses a CA-signed certificate.
2. Mallory, an adversary, performs a mitm attack on Alice's connection. She replaces the CA-signed certificate with a self-signed certificate, allowing her to view all of Alice's traffic to bank.com.
With the current browser UIs, the browser would show Alice the self-signed certificate warning. Alice should see it, known she's under attack, and decide not to proceed.
With your proposed UI, the browser would show NO WARNING. Unless Alice knows that bank.com should display the HTTPS icon and notices that it isn't, she will proceed and Mallory will be able to view all of Alice's traffic.

It is COMPLETELY UNREASONABLE to expect Alice to notice that the HTTPS icon is missing. Many user studies have shown that users continue after seeing self-signed certificate warnings, which are impossible to miss and explicitly state the dangers of continuing.

Re:Illegal power without Constitutional authority

[roman_mir]

I agree that the SECURITY portion of the https is screwed up, it's out of date, it's not working. However I am not talking about delivering security, I am talking about encrypting all traffic across the entire Internet with as many certificates as possible.

AFAIC it is more relevant today to encrypt all traffic and prevent government from having access to any plain text communications than provide 'security' (or whatever we see as 'security') in the current sense of the word. The security model is broken already as it is and with the government doing what it does, the real threat is the government and the security is just as much a theatre as TSA lines in airports.

Re:Illegal power without Constitutional authority

[roman_mir]

We should get people to encrypt traffic and if that takes self-signed certs then that's what we should be promoting and browsers using ridiculous warnings for self signed certificates do not promote using more of them.

Now, if every connection already had a self signed certificate except for some, that would choose CAs, then I would be talking about something else - how to add actual security to the encryption and security requires that the involved parties know who they are before they can communicate in a secure way (which is what encryption would provide once the identities are established).

However what we have today is a mostly unencrypted Internet traffic, unencrypted emails, unencrypted messages, most things are not encrypted.

As to CAs, I do not trust CAs not to work with governments and I care much more about government destroying individual freedoms than about somebody getting scammed on the Internet. How should identities be established? I think it should be done by consensus, not with someone specifically authorised and thus prone to government attack, but by many people confirming the identity that needs confirming.

Re: Illegal power without Constitutional authority

[secondhand_Buddah]

How long before we find out that CAs are part of the whole spying industry also?

There is very high likelihood that they are . Verisign was founded by a group of ex CIA/FBI directors back in the 90's, who resigned to start Verisign. This happened after the Clipper chip program got canned. (The US government wanted to build a legal backdoor into every computer running the Clipper cryptographic system.)

Its the same reason that they bought Thawte from Mark Shuttleworth for about a $1 billion dollars. He controlled a significant amount of HTTPS encryopted HTTPS traffic via his start-up.

I suspect that Most HTTPS traffic can be decrypted on the fly by the US spy organisations.

Re:And how do we know these are legit?

[johnny cashed]

They are making a big deal out of Snowden. Do you think they would do that for a bunch of BS? The guy is stuck in a Russian airport with a revoked US passport and charged with espionage. Would they do that over fake powerpoint slides?

Re:And how do we know these are legit?

[anagama]

It would be pretty easy to create PowerPoint with the requisite markings, logos, etc, on it and then peddle it to various newspapers.

That would explain why Biden called Correa for a personal chat, the White House is orchestrating a smear campaign directed not at the content, but at Snowden and Greenwald, and it's pursing Snowden to the ends of the earth to bring him back for "trial" (he has been indicted you know). That all points to the obvious conclusion that Snowden photoshopped some slides? Are you daft?

Re:confusion

[achbed]

So is the box inside Microsoft that's scanning all Skype-pasted URLs after the fact actually the FBI's collection box? That's one filter that may be easy to implement - redirect all traffic from that box to a honeypot or /dev/null it.

Lies and very very serious problems

[Anonymous Coward]

Lies, Facebook in particular lied about this, even as Obama was confirming it and claiming a [non-existent] warrant is needed to access this data:
"The search request, known as a “tasking,” can be sent to multiple sources — for example, to a private company and to an NSA access point that taps into the Internet’s main gateway switches. A tasking for Google, Yahoo, Microsoft, Apple and other providers is routed to equipment installed at each company. This equipment, maintained by the FBI, passes the NSA request to a private company’s system. Depending on the company, a tasking may return e-mails, attachments, address books, calendars, files stored in the cloud, text or audio or video chats and “metadata” that identify the locations, devices used and other information about a target."

I don't care about the pathetic protections put in place for Americams, I'm not American. I care that these services hand my data to a military structure that works against me. Worse they inevitably turn America into a dictatorship.

"Before an analyst may conduct live surveillance using PRISM, a second analyst in his subject area must concur. "
So any boss that oversees 2 analysts can spy on Americans, simply because he can order 2 of them to concur. And the big boss, General Alexander can even waive this, because its HIS policy not law, i.e. no protections at all.

You want to fix this? Well try running for President and sacking the NSA chief. He'll have record of every mistake you've made, detailed knowledge of who backs you, the campaign team, private communications, strategies, everything. They've made a dictator and people like Dianne Feinstein are so stupid and incompetent they can't see why they've done so much damage.

Completely flipping the system in secret, the system that's kept the US a democracy for the longest time any democracy has survived so far. Those little shits just threw it away.

Re:And how do we know these are legit?

[Anonymous Coward]

Dan Rather showed what he knew to be a fake memo to smear Bush during an election. Even with overwhelming evidence that he lied Rather continued to state that the memo was true. He finally lost his job due to this.
NBC doctored audio to show Gerorge Zimmerman is a racist, once the full audio came out their trick was shown to be an outright lie.
The CNN woman that moderated the debate between Romney and Obama outright lied in the middle of the debate to protect Obama, a week later she admitted to lying, she was congratulated as a hero in CNN.
This week, MSNBC did a story how the "star witness" in the Zimmerman trial did a great job and it was such a slam dunk that Zimmerman will obviously be found guilty, this should be confusing to anyone that listened to what that witness said because the opposite is true.
ABC for their top story a week ago told about thunderstorms in DC, the same time as the NSA information was coming out and heraings about it were going on in the Senate, but the important story was a storm in DC.

Not sure why you would assume any mainstream media would be honest at any time anymore. There is no news outlets in the USA anymore, if you think there are you are biased and found one that only reports stories you think are true.

Re:Well that validates the 'weasel word' disclaime

[number11]

And sometimes, like when you ask if they "collect any information on millions of Americans," they just lie.

Oh, that's so harsh. It's just that you need to get them to precisely define the words "collect", "any", "information", "millions", and "Americans". I'm sure that if you did, you'd reach a point where you thought "oh, 'no' doesn't mean what I thought it meant". (The words "on" and "of" are probably safe, though you never know). It's like how the word "sex" can mean different things depending on who's talking.

WA or DC?

[seyyah]

I'm just a dumb Canadian... Is WA ever used for Washington DC?

Re:WA or DC?

[hydrofix]

I was also baffled by the headline. Though speaking as a non-American, I have still never seen "WA Post" being used for "Washington Post", and deciphering the meaning took a while. This usage seems very original, and is probably erroneous, as "Washington" in "Washington Post" does not refer to Washington state.

Re:And how do we know these are legit?

[gl4ss]

It would be pretty easy to create PowerPoint with the requisite markings, logos, etc, on it and then peddle it to various newspapers.

because the response the gov. took about them... they started arguing about how it is necessary for them to do this. that's how we know.

Re:confusion

[Servaas]

We know we're being watched isnt that enough? Who cares what they call all their programs and who they belong to. They have access to our personal computers, to every chat or email you send. Who cares about semantics?

Re:And how do we know these are legit?

[achbed]

But you have to be a true artist to design a powerpoint deck that horrible. Only Government types invest that kind of effort.

Re:Well that validates the 'weasel word' disclaime

[PolygamousRanchKid]

Oh, be fair. These infamous 9 have a lot of data centers, and you can't expect the CEO to know which equipment from whom is in every corner there? I mean, just walk up to one of their data centers with a router in your hand, and tell them that you need an Internet connection. I'm sure that they'll let you waltz in and connect wherever equipment you want . . .

. . . when monkeys fly out of my ass.

The FBI probably has technical offices and agents in each data center, to maintain all this stuff. Ask them about that!

To give them the benefit of the doubt, they could claim that the FBI installed the stuff clandestinely. You know, a rack in a corner, with a note taped to it: "Do NOT touch. This rack does something important!" Of course, these companies might perform audits once in a blue moon on their data centers . . . but, naw, why bother . . . ?

Re:And how do we know these are legit?

[johnny cashed]

Because Assange has it so good? This whole think will be a case study in how not to react to leaked information. It would be funny if it didn't feel so real. Keystone cops government reaction. Yeah, they are fake slides, whatever helps you sleep at night.

Personally, I think the declassification date is a nice touch.

Re:Well that validates the 'weasel word' disclaime

[messagelost]

Google et al. said something, IIRC, like 'we do not collect and pass on any info to the NSA'. Technically true, but also completely irrelevant to whether or not the NSA was actually collecting data.

They didn't mention the NSA: http://googleblog.blogspot.com/2013/06/what.html That post is unequivocal, and is in direct contradiction to statements by the post like:

The Foreign Intelligence Surveillance Court does not review any individual collection request.

and

The FBI uses government equipment on private company property to retrieve matching information from a participating company

Which directly contradicts a statement here: http://www.wired.com/threatlevel/2013/06/google-uses-secure-ftp-to-feds/ Unfortunately, all such statements in the Post's article aren't on the slides; they are the Post's annotations on the slides, and the author doesn't provide any evidence to support them. Take from that what you will.

Re:confusion

[anagama]

You're totally wrong.

We've SUSPECTED spying. It was even reasonable to suspect that, though you could still be called a foil hatter.

Now we KNOW.

It is like the difference between an untested hypothesis you strongly suspect is true, and experimental results that confirm the hypothesis. The confirmation allows a next step to taken on a fully informed basis rather than belief.

So you are totally wrong -- this is NOT nothing. This is confirmation and if we don't do something about it now, it will be seen as a free pass to do this and more. That's why you should care -- apathy now absolutely ensures a deteriorating future.

Re:confusion

[anagama]

"OSN is probably online social network."

That sounds more plausible than my guess.

Re:Well that validates the 'weasel word' disclaime

[meta-monkey]

Because the NSA couldn't possibly have their private keys...

LOL

[toby]

If you think Assange is "untouchable" then the past 100 years of fascist history, and even the vaguest grasp of what your government has done and is doing, have passed you by.

Re:confusion

[Somebody Is Using My]

Sometimes I have to wonder if this lack of concern isn't all our fault.

Before Snowden:
Wild-haired man: The gub'ment be spying on us! The NSA, the CIA, the FBI; they all are reading our emails, monitoring our online chat and seeing all the websites we go to! And all of them telecom and internet companiers are involved too!
Common citizen: Oh, you wacky nutcase; you've been going on for years about this. Where's your proof of this great conspiracy, huh? They aren't spying on us! This is America and that sort of thing doesn't happen here!

After Snowden:
Wild-haired man: The gub'ment be spying on us! They see everything you do online, everything! And the big internet and telecom companies are in cahoots with them! And look, now I got irrefutable proof!
Common citizen: Well, of course they were spying on us. Hasn't this been known for years? I remember hearing about it from /somebody/ a while ago. Anyway, it's been going on forever and the only thing different now is that its out in the open, so why make a fuss about it now?

It's sort of like crying wolf, except the warnings were always true. Instead of making people disregard you, it instead acclimatizes them to the threat to the point where it doesn't seem dangerous anymore (also seen in sci-fi movies where the aliens use conspiracy theories to make people ignore the threat of a coming alien invasion).

Perhaps we should dub this tactic "Snowden's Law"?

And on goes the deceit

[Anonymous Coward]

With each new iteration it is clear that the NSA is bullshitting congress (partly under oath), and congress is bullshitting the public by well-chosen weasel-wording.

What those criminals don't understand is that stating technical truths with the explicit intent of causing false beliefs in the recipient is lying. The intent to deceive and mislead is not ameliorated by some technical truth to a statement.

What is intended to convey wrong information is a lie. The bitter truth is that the NSA is trying to test with how little truthful information they can get away with congress and public, and congress and government are trying to test with how little truthful information they can get away with the citizens.

As long as their is no intention to actually and truthfully communicate, the respective entities need to get dissolved. They are out of control, and they like being out of control.

Re:confusion

[DriedClexler]

Perfect example: Economist and professional snob Tyler Cowen: 'I'd heard about this for years, from "nuts," and always assumed it was true,'

Bullshit. How come there's no record of him giving any credence to such claims before then?

Same thing when Climategate broke out.

Re:And how do we know these are legit?

[Raenex]

The CNN woman that moderated the debate between Romney and Obama outright lied in the middle of the debate to protect Obama, a week later she admitted to lying, she was congratulated as a hero in CNN.

Or are you lying or mistaken? From CNN:

ROMNEY: I -- I think interesting the president just said something which -- which is that on the day after the attack he went into the Rose Garden and said that this was an act of terror. [..] I want to make sure we get that for the record because it took the president 14 days before he called the attack in Benghazi an act of terror.

[..]

CROWLEY: He -- he did call it an act of terror. It did as well take -- it did as well take two weeks or so for the whole idea there being a riot out there about this tape to come out. You are correct about that.

[..]

And here is the transcript from Obama's Rose Garden remarks on September 12, the day after the attack:

"Our country is only as strong as the character of our people and the service of those both civilian and military who represent us around the globe," he said. "No acts of terror will ever shake the resolve of this great nation, alter that character, or eclipse the light of the values that we stand for. Today we mourn four more Americans who represent the very best of the United States of America. We will not waver in our commitment to see that justice is done for this terrible act. And make no mistake, justice will be done."

[..]

But, as to the original accusation from the conservative critics that Obama never mentioned "acts of terror" until weeks after the attack, they were wrong. Crowley was right.