Slashdot Mirror
Training Materials for NSA Spying Tool "XKeyScore" Revealed
dryriver writes with news of the latest document release on NSA spying programs. Quoting The Guardian: "A top secret National Security Agency program allows analysts to search with no prior authorization through vast databases containing emails, online chats, social media activities and the internet browsing histories of millions of individuals, according to documents provided by whistleblower Edward Snowden. The NSA boasts in training materials that the program, called XKeyscore, is its 'widest-reaching' system for developing intelligence from the Internet. The latest revelations will add to the intense public and congressional debate around the extent of NSA surveillance programs. They come as senior intelligence officials testify to the Senate judiciary committee on Wednesday, releasing classified documents in response to the Guardian's earlier stories on bulk collection of phone records and Fisa surveillance court oversight. The files shed light on one of Snowden's most controversial statements, made in his first video interview published by the Guardian on June 10. 'I, sitting at my desk,' said Snowden, could 'wiretap anyone, from you or your accountant, to a federal judge or even the president, if I had a personal email.' U.S. officials vehemently denied this specific claim. Mike Rogers, the Republican chairman of the House intelligence committee, said of Snowden's assertion: 'He's lying. It's impossible for him to do what he was saying he could do.'"
The slides in question. Looks like it was Mike Rogers that was lying and not Snowden. So much for the NSA's attempt at quieting public fear by releasing information on the Verizon phone data collection program before Congressional hearings today.
"They don't want the voice of reason spoken, folks, 'cause otherwise we'd be free. Otherwise we wouldn't believe their fucking horseshit lies, nor the fucking propaganda machine, the mainstream media, and buy their horseshit products that we don't fucking need, and become a third world consumer fucking plantation, which is what we're becoming. Fuck them! They're liars and murders. All governments are liars and murderers, and I am now Jesus. Now. And this is my compound."
- Bill Hicks, Live at Laff Stop in Austin
...yes. It runs Linux.
b&
All but God can prove this sentence true.
First off, almost anything "publicly" done on the Internet or through a third party server is suspect. Second, the idea that the NSA isn't doing this is patently absurd. Third, if you believe the NSA when they deny doing things like this, you are an idiot. Espionage agencies are basically required to lie. It's in their job description. Quite literally, their job is to deceive people.
In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
They run themselves. They have a secret court where defendants are not allowed to attend, and are not even told they are on trial. They lie to congress. They lie to the president. They have an unlimited secret budget that nobody can check. They appear to be mostly controlled by the contractors and companies that sell them services. It's a giant graft. Private parties are helping themselves to public money, creating a surveillance state for unknown reasons under the guise fighting terrorism.
This is going to end badly. People with money and lots of power don't give up their toys easily. Expect to see the following soon: Lots of assassinations, or the NSA being raided by another enforcement branch of govt. Or maybe both.
Every public statement they make is a fucking lie. If they tell you it's sunny outside, you can bet that it's raining. They lie to Congress, they lie to the public, they lie to the President. When they go home at night, they lie to their wives and kids. They tell their dying grandmothers that they're fine and don't need chemo. They take down "Road Closed" signs and laugh when people wreck their cars as a result. They will climb a tree to lie when they could stand on the ground and tell the truth.
They always lie. They always WILL lie.
The cow says "Moo." The dog says "Woof." The Timothy says "Thanks, valued customer. We appreciate your input."
Lovely bullet point:
* Show me all the VPN startups in country X, and give me the data so I can decrypt and discover the users.
Translation: not only do you have no privacy, doing what you think will make you hidden will just shine a spotlight on yourself.
b&
All but God can prove this sentence true.
Why would anyone assume the database includes only suspects that they're authorized to track? Given the track record of the NSA it is less likely that that is the case and it is more likely that they have anyone they want in it.
Modern copyright is theft of culture from everyone and it retards the progress of the useful arts and sciences.
Bogus! It's a congressional coverup designed to rationalize all this bullshit, with people like Pelosi on her knees before the NSA. Of course what makes it worse is the idiot public who believes all this crap and reelects these bums. How do we stop them from voting away our rights?
“He’s not deformed, he’s just drunk!”
For me the only viable solution is making the NSA's work/effort and all of their data capture completely transparent with audit trails, Etc. not to stop them, but so when the abuses do come we can figure out who did want and seek redress.
http://www.hawknest.com/
What part of PRISM didn't you get? The part where they hoover up data on everyone without a warrant or the part where they don't have to justify it to anyone?
Wikipedia has an entry on it: X-Keyscore
Good background story: Solving the mystery of PRISM
Spiegel Online covered it: 'Key Partners': Secret Links Between Germany and the NSA
Oddly enough it appears that news about intelligence programs used by America and its allies is reported in Persian. Go figure.
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
I take it you either failed to read or comprehend the presentation then. Unless I'm misunderstanding, slide 18 makes it pretty clear.
Because they have been saying they need to collect everything so that when they know what they're looking for it's already there.
They've been steadily expanding into the "record everything" domain for years now.
I see no reason to doubt that they're grabbing everything they can get and then deciding if it's pertinent later. That's been their stated goal for a long time.
Lost at C:>. Found at C.
It's shocking to discover that the government can actually accomplish anything, as opposed to wasting $800 million in taxpayer money with nothing to show for it.
But I'm sure if they would just show us the redacted slides, it would clear everything up... right?
Seriously though, I kind of expected things to be this bad, and they may even be worse, but this really does add frightening perspective. If they release enough information about their systems, perhaps one day someone or some group will come up with a way to at least partially work against it, or at least muddy up the data they are collecting.
Brought to you by Carl's Junior.
They've already cop'd to mapping networks out to (n>2) degrees of contact. It's the "implicit authorization to track people networked to a suspect" that makes this all so dangerous.
I'm not the first to refer to the lame "Kevin Bacon" jest.
Rep. Mike Rogers may not have been lying, exactly, with what he stated earlier. He may have been misinformed (e.g., lied to) by whoever briefed him on NSA's capabilities and available data. Which is not surprising, given the blatant lies and deception exhibited over and over again by the highest levels of NSA executives.
I heard the NSA has had trouble complying with a recent FOIA request, something about not being able to read their own emails. Someone should tell them about this "XKeyScore" thingamajig!
A database containing only suspects they are authorized to track would be worthless to them in the context they're trying to sell it. Every argument they have made makes it clear that they see it as searching for a needle in the haystack, and all of us, all of us, are the hay.
In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
That the data is collected has already been established, by more than one whistleblower. That's old news.
The new revelation here is that a relatively low-level guy could easily search through the database looking for everything they want. That lapse in security is actually surprising, even if you have a low opinion of the NSA.
From a legal perspective, it seems they are allowed to collect the data, but they can only look at it if authorized (ie, crtain requirements are met). What Snowden is saying is that the authorization method wasn't very robust, which means that someone somewhere probably has actually abused this to check up on his girlfriend or something.
"First they came for the slanderers and i said nothing."
I wonder how much of an accident it is that Chrome's Incognito mode tells you:
Going incognito doesn't affect the behavior of other people, servers, or software. Be wary of:
well.. it's only people they're authorized to track(EVERYONE OUTSIDE USA!) and then people with connections to them..
soo.. yeah, figure it out.
yes, I am aware that it is a bit of a hyperbole because they've only admitted to two levels of separation between persons of interests.. those being anyone with ties to iran, middle eastern groups, unwanted groups etc.
besides, how the fuck do you think you add people to the system? that the judge reviews the data on the case, ponders and then the judge gives an authorization key that lets them add a contact? fuck no. you just add their addresses while making a single promise holding up your pinky that you "believe" you have rights to to add that tap. they don't have the manpower to go through every tap added.
world was created 5 seconds before this post as it is.
You seem to be under the impression that they do not have the content. There have been several reports from NSA Whistleblowers prior to Snowden that have come right out and said they have the ability and they do listen in on phone calls. Why you are believing an agency who consistently lies to the public is beyond me. The bill of rights id over, which means the Constitution is done. Our government has no authority beyond might anymore.
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
If you tell a kid that it should not steal cookies and when it does you do nothing about it, it will assume that it is allowed to take the cookies. The longer you allow it, the harder it will be to enforce the rule.
The defense of the parent could be anything from "Because I said so." to "My house, my rules."
So who has told the NSA to stop it and what actions have been taken to punish them? If I were the NSA, I would assume that all I do is authorized, until somebody stops me.
Don't fight for your country, if your country does not fight for you.
A database containing only suspects they are authorized to track would be worthless to them in the context they're trying to sell it. Every argument they have made makes it clear that they see it as searching for a needle in the haystack, and all of us, all of us, are the hay.
That is, until someone in some government somewhere decides you look more like a needle.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
How many more lies are we going to put up with until something is actually done?
Too bad the media bought it hook, line, and sinker. They did not build the huge, Soviet-style Utah Data Center to store meta data...
He did also show that they were snarfing up all call data on everyone. Gee, I wonder where they put that mass of data. If only there was some stable base platform for storing data....
Exactly. There is a reason they are called PUBLIC servants, and we are called PRIVATE citizens. Their actions are supposed to be public so that we can make sure they are representing our interests and vote accordingly. A representative democracy in which that is impossible is fundamentally broken, and one in which the privacy of all the private citizens is ignored, even more so.
What changed under Obama? Nothing Good
Which is not surprising, given the blatant lies and deception exhibited over and over again by the highest levels of NSA executives.
You are being unfair to the NSA. Eric Holden, the Attorney General in office, is on record for more perjury before congress than any single NSA official. Once regarded as a felony (and officially still being labelled as that), perjury before congress has become an integral part of playing the representatives of the public, and those are being good sports about it. Nobody crying foul here.
Found a little comment in the Austin,TX paper that is very appropriate to the NSA actions: "If we are to accept that the executive branch of the U.S. government is operating within the bounds of the Constitution in its implementation of the recently disclosed domestic spy program. i.e., having approval through the FISA court and tacit congressional consent, then per the 4th amendment, “no warrants shall issue, but upon probable cause,” the only valid probable cause to surveil the entire domestic population is to declare them likely criminals. The question to answer then becomes, what do the citizens of this land do when their government has wholesale declared them all criminals?" So I put it to you, what is the correct course of action when we citizens of these United States of America are now all criminals in the eyes of the government?
Not only are they spying on you - they also stole all you money a few years back.. remember? Pepperidge Farm remembers..
Besides, there is no rule to prohibit surveillance of non-American or communications between non-American and an American.
President Merkin Muffley: General Turgidson, I find this very difficult to understand. I was under the impression that I was the only one in authority to order the use of nuclear weapons.
General "Buck" Turgidson: That's right, sir, you are the only person authorized to do so. And although I, uh, hate to judge before all the facts are in, it's beginning to look like, uh, General Ripper exceeded his authority.
We don't have a state-run media we have a media-run state.
If tomorrow you become a suspect, they will need to examine all your past data. So all the your data must be there, just in case. QED
Addendum: unless you are out of trial by definition, like being a politician, some middle-to-high management level related to this and other government protegees, in that case your data probably is not there, and never will. Nobody watches the watchers.
Thirty pieces of silver
They have been doing this for years, blaming "Obummer" glosses over the fact that a very many number of people are infringing on constitutional rights.
This is false. He said, and I quote, ""He was lying, He clearly has over-inflated his position, he has over-inflated his access and he's even over-inflated what the actually technology of the programs would allow one to do. It's impossible for him to do what he was saying he could do."
It turns out that he was in fact NOT lying, and Rogers WAS lying by saying Snowden was lying.
Sorry to inform you but it says so in the very document:
"Rolling Buffer" of ~3 days of ALL unfiltered data seen by XKEYSCORE:
- stores full-take data at the collection site - indexed by meta-data
- over 500 servers distributed around the world
Later:
- we can use this traffic to detect anomalies which can lead us to intelligence by itself
- E-mail Addresses, Extracted Files, Full Log, HTTP Parser, Phone Number, User Activity
It appears they take all data and then use that to detect anomalies. It includes data on everyone, and from all of the data they try to pinpoint targets.
Look for anomalous events
- Someone whose language is out of place for the region they are in
- Someone who is using encryption
- Someone searching the web for suspicious stuff
They have example tasks listed such as:
- Show me all the encrypted word documents from Iran
- Show me all PGP usage in Iran
- Swow me all the VPN startups in country X, and give me the data so I can decrypt and discover the users
- Show me all the Microsoft Excel spreadsheets containing MAC addresses coming out of Iraq so I can perform network mapping
- Show me all th exploitable machines in country X
- Show me all the word documents with references to IAEO [International Atomic Energy Organization?]
- Show me all documents that reference Osama Bin Laden
HOW if they do not have a physical access to the major routers?
1) Let's say you had a rootkit-like patch for a popular model of carrier-grade fiber optic switch. Now let's say that you control one or more key employees of an engineering company that installs carrier-grade networking equipment in various parts of the world. Gives it to universities for free. Operates popular chains of internet cafes.
2) Let's say you deploy large numbers of compromised TOR routers in all of your embassies and consulates. Or as a botnet.
3) Let's say you have a team of skilled malware writers that work on creating network sniffing botnets. Let's say the malware is also able to install a sniffer on several popular models of wi-fi access point, with known (and unknown) firmware issues, backdoors, or simply default passwords.
4) Let's say you have massive arrays of wi-fi and cellular antennas installed in all of your embassies and consulates, and 60 years of experience isolating and processing signals from distant enemy transmitters.
Those are four possible scenarios. I'm sure if you think about it you can come up with others.
We all know that the Internet is inherently insecure, and that software is exploitable. Given enough storage to capture everything in real time so they can apply map-reduce to it, the NSA (and presumably other spy agencies) have their work cut out for them.
Tha's what I've been saying every story so far -- the "safeguards" are written process that people are supposed to follow. There is no uncorruptible logging going on, with MD5'd files shipping offsite to multiple storace sites; no alarms going off; no checks that servers don't have extra stuff installed.
If a G. Gordon Liddy operative wanted to do a little political spying on the opposition, nobody would know. And it is exactly this issue, spying on opponents, that half the first 10 amenents exist, not to stop them from spying on hot chicks.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
This.
Same boat here. Nobody cares, really. I say it jokingly - at least I used to - that as long as the average American gets their daily dose of the Kardashians (or whatever other entertainment they fancy), the NSA could install anal probes in their sofas and they wouldn't think once about it.
Nobody I know really truly values their rights, or why we have them. "Who is King George?" is a question I get frequently in response to my explanations of the tyranny that brought this country to revolt.
People really, truly don't care that their government is spying on them because they really, truly believe they are doing nothing wrong - when the average person commits several federal felonies every single day and is none the wiser about it.
Why keep this in the shadows and create all this controversy. If the American public wants this, then just repeal the 4th amendment and have at it. No one would be at all surprised to learn that China monitors all electronic communication, they have made no promises not to.
Now if there aren't enough votes to repeal the 4th amendment, maybe, this isn't what the public wants.
but this was in place before and after 9-11. It didn't stop that, and it didn't stop the boston bombers. It only exists to be abused.
> people sharing an IP address space with criminals and terrorists?
Possibly, if the space you meant was 0.0.0.0/32 .
Be real, it's probably everyone connected by having sent email to each other, posted on the same threads in any forum, or even possibly just visited the same URL even at different times. Or connected to a connection (by the same criteria). Etc.
I personally see a capability within these slides that the US needs to have and would be scared if we didn't.
Seriously? You'd be scared if the US government didn't have the ability to browse through the everyone's email contents for the last 3 days?
Maybe you meant other capabilities. Maybe you meant the ability to have a deep search vs a shallow search on whatever data they happen to have. Maybe you're focusing on the technological capabilities that people would expect from an intelligence organization. Meanwhile, the rest of us are shitting our pants about how blatantly illegal this operation is.
Yes. We'd generally assume that, with a warrant, from a real judge, who gave it because there was probable cause and all that jazz, with a record of who got what warrant to search for what and where, the investigators would be able to quickly get the email, phone, whatnot records from corporations about nefarious people. That's a good thing. It's legal. It helps catch the bad guy.
For me I have no expectation of privacy when on the Internet.
Own and carry a phone? You're always on the Internet.
Likewise, do you have any "expectation of privacy" when you're on a restroom shitter? Those stall doors weren't REALLY designed for privacy. Anyone can stare at you through the cracks or duck their head under the stall. Creepy as hell, but do you think it should be illegal? Do you have an expectation of privacy while shitting? FYI, while email is sent in clear-text, you and I have an expectation of privacy with email... at least for 180 days per the Electronic Communications Privacy Act.... huh... that's kinda disturbing.
how does a government with limited human resources investigate potential threats?
With a warrant. Not a dragnet. See: checks and balances.
Over 300 terrorists captured
Define terrorist. Do you mean those sheep they lead to slaughter by talking them into BECOMING terrorists and accepting fake bombs from undercover agents? Do you mean the Muslim charity that gave money to an organization who helped children, oh and also some terrorists drink from that well? It'd be nice if I could trust them when they claim 300 terrorists were captured thanks to this program, but they have redefined terrorism to the point I can no longer recognize it.
I ask slashdotter's what is the best way for a government to find threats to it's citizens in this digital age?
Find evidence, follow leads, GET A FUCKING WARRANT.
Should the Internet be hands off for our government?
False dichotomy. The government should not keep track of what everyone is doing on the Internet and allow unsupervised surveillance of the masses. Nor should the government ignore the Internet.
Ever since Edward Snowden went public, I have been racking my brain trying to conceive of a catastrophic event involving government surveillance that would motivate a large number of people to march on Washington chanting "Enough!" Say the words "Social security reform" out loud and retirees start boarding buses bound for the capitol. Suggest that limits on gun ownership should be put in place and the NRA is on your doorstep. Point out that the NSA is building a massive repository of every aspect of your very being...and people shrug. They just don't see the value of and power of personal or private information. It's too nebulous a concept for the average person to grasp, and no amount of public awareness is going to help. And those running the program and collecting the data sure as hell aren't going to give up their valuable and powerful tools, no matter how embarrassing it is when they're called out in public. Quite the opposite: they want more tools and they want them yesterday, and they don't want to be told what they can and can't do with them, especially when are busy protecting us from the bogeyman. Very few of us - Mr. Snowden et al - are willing to stop and consider why this is wrong. So does anyone have any ideas of what it will take to turn this indifference into outrage? Or will it take a full-scale and bloody revolution to stop us from being dragged down that path to hell that is paved with good intentions?
"Could be worse...could be raining." Igor
I understand that at first glance this looks like overreach, and depending on who had access and how often it was used, perhaps it is. But the NSA does not do law enforcement, they do threat detection.
Imposing a suspicion-based, after-the-fact scheme would mean terror cells could (and probably already do) host their own encrypted SMTP servers with no archive, thus thwarting any attempt to trace messages sent before a target is identified. So even if a judge finds probable cause and some kind of targeted hack/trace could be established, it would be too late to look at data created before the warrant was issued. Why would we hobble our first line of defense against real, plausible threats in order to avoid theoretical abuses? Wouldn't it make more sense to keep the programs intact and ensure safeguards against abuse?
Even if you are afraid of some hypothetical future fascist regime that has plans to abuse this apparatus on a large scale, please explain why such a regime would have any interest in respecting the Constitution at all? In other words, if things got so bad that the NSA started spying on you because you wrote something to a friend they didn't like, citing the lack of a warrant is not going to help.
Of course there are many (actually just some, but they like to think they are many) who believe the US is already some kind of fascist state, but I would suggest you talk to people living in places like Russia or China before establishing a "Big Brother" standard against which to compare the US.
As for the legality, IANAL, but some obvious observations:
We need to protect ourselves against government overreach and abuse - we are after all a nation of laws, not men. But the notion that the NSA keeping a few days worth of 1s and 0s just in case they are needed is anathema to our way of life is ludicrous. We keep medical, criminal, travel, financial and many other records for years and years. Why is this any different except that its a convenient vector of attack against an arm of government that is charged with doing exactly what XKeyScore is designed to do - seek out and neutralize threats to national security.
But they cannot capture these communications between Americans with a drag net, they have to get individual warrants (presumably secret FISA warrants).
If you had actually seen the contents of this most recent leak you would have noticed that no warrants are necessary to perform a search of the database which includes the actual content of emails, IMs, and telephone conversation audio. Somehow you seemed to have missed the whole point of this leak. All of our worst fears about Big Brother have now been confirmed.
Quite an experience to live in fear, isn't it? That's what it is to be a slave.
You shills are getting desparate I see. Grasping at straws. Snowden wouldn't have sacrificed his life just to release fake slides.
Quite an experience to live in fear, isn't it? That's what it is to be a slave.