|
NSA – Access It All
Some very damaging additional stuff about the NSA domestic spying will come up this week. A preview was given today on Face The Nation and on Meet The Press. The emphasis is now not on "collect it all" but the much more interesting question of how to "access it all". How does the NSA get the information out of the raw data.
@FaceTheNation
"The is literally collecting every phone record of every American every day…that is a violation of Americans' privacy"
Senator Udall says that all "phone records" are collected. But that is only half the beef. The NSA is collecting much more.
"Phone records" are the metadata of a call: Date/time of call, call length, originating number, location of originating number, destination number, destination location. If the implicated phones are mobiles additional information about the phone type and serial as well as location changes during the call may be included.
This metadata is useful to find connections between people, to reconstruct where they have been when and to find out about certain habits of the people involved.
But the content of the calls may be much more interesting.
As reckless and untruthful as the people at the head of the NSA have been proven to be there is absolutely no reason to believe that they do not also record the content of every call (and email and web access etc) of everything they could possibly get.
One internal document quotes the head of the NSA, Lieutenant General Keith Alexander, on a visit to Menwith Hill in June 2008, asking: "Why can't we collect all the signals all the time? Sounds like a good summer project for Menwith."
Today 99% of call and internet traffic is transported through optical fiber cables. The NSA has access to every major fiber cable hub in the United States and in parts of Europe. It additionally taps into various undersea and land cables by clandestine means. It uses optical splitters that leave the original line working as before but copy the raw datastream onto an NSA line and feed it to some NSA datacenter where all will be recorded. As General Alexander planned five years ago the NSA it is by now really recording nearly all communication data.
But how can one use this data? How can one even access it? This is where the metadata comes in. Any name can be easily connected to a phone number and vice versa. Any IP address can be easily connected to a name. An IP address, a phone number, an email address, a name can then be used to automatically search through the recorded raw data streams to find and display the content data hidden in it. As Glenn Greenwald explained today on Meet The Press:
“The NSA has trillions of telephone calls and email in their databases. What these programs are are very simple screens, like the ones that supermarket clerks or shipping and receiving clerks use, where all an analyst has to do is enter an email address or an IP address, and it does two things: it searches that database and lets them listen to the calls or read the emails of everything that the NSA has stored, or look at the browsing histories or Google search terms that you’ve entered; and it also alerts them to any further activity that people connected to that email address or connected to that IP address do in the future. And it’s all done with no need to go to a court, with no need to even get supervisor approval on the part of the analyst.”
Access to these search programs is not restricted to NSA personal. The NSA spends 70% of its budget on contractors. They do have, like Edward Snowden had, access to the search capability and thereby access to the meta- and content data.
Thinking further there is no reason to believe that these capabilities is restricted to certain facilities or just small circle of people. It is already known that U.S. and NATO soldiers in Iraq and Afghanistan had and have access to these systems and abused them. Does the State Department have access? Has the White House? Do political operatives have access? The very likely answers are "yes", "yes" and "yes".
The NSA claims that it can not search its own emails. I actually believe that to be somewhat true. The NSA task is to spy on others not on itself. Its internal email search capabilities may well be underdeveloped compared with its capabilities to search through the emails of others.
Likewise I doubt that its internal security is as developed as its external security. Trusted people with security clearance will have relative free access to its system (just ask Snowden) while any access from the outside will be heavily guarded.
So how much internal logging and controlling does the NSA have? Will every fishing through the accumulated data by trusted personal be recorded, logged and reviewed? I very much doubt this. Abuse then is likely to be widespread. Look up your nasty neighbor? Look up your former girlfriend? A political enemy? The urge to so will be great and the chance of getting rebuked over it will be small. Herein lies the mother of all scandals still to be unearthed.
b
To avoid misinterpretation: I’m by no means “picking” on you, quite the contrary, it’s a compliment (and one that should be told openly).
Actually I perceive you as a man with lots of experience, not at last in reconnaisance. No matter how foggy the grounds and with red herrings around, you usually don’t miss to reach a good understanding of the situation.
Sure enough, this is one of the reasons why many come and stay here.
That said, I sometimes see points where I feel I’d like some more details or point where I feel something escaped your view or plain and simple where my personal and professional experience puts me in a good position to carve out some issue somewhat more.
Do not take that as “picking on you”, please, but rather as a compliment, as a situation where you’ve prepared fertile grounds and someone else takes on 😉
—
It uses optical splitters that leave the original line working as before but copy the raw datastream onto an NSA line and feed it to some NSA datacenter where all will be recorded.
Actually I think this “revelation” is politically motivated bullsh*t.
The line (the transmission line, cable) is the unknown, the one part outside the controlled environment of a data center. Accordingly (and for other reasons) the line is the one part that actually is the paranoically observed. Sure, it’s feasible to install optical splitters somewhere but it’s also an operation that is guaranteed to be discovered and to trigger alerts.
Let’s look at the issue with a spies eyes: You can do it openly that is, with the carriers knowledge, you can do it half covertly or you can do it fully covertly.
The line splitter approach basically comes down to an open or, at most, half covert approach. Inserting that line splitter can’t be done really covertly; those stories are, Pardon me, fairy tales.
And why go to that length? All one needs to do (being a government) is to demand certain equipment that, be it overtly or covertly, already has everything needed built in. Being at that, one wouldn’t take the burden of grabbing data at the optical end, one would simply grab them at the electronic end which btw. typically has (for technical reasons) “mirror” capability built in anyway.
But there is another problem: If one really mirrored all data one would need the same capacity as the original cable. The problem is that, for instance, the combined capacity uk-zusa cross atlantic capacity is in the terrabits range – and lots and lots within that is more or less useless content (like video streams).
So, for both technical and tactical reasons one would – and almost certainly does – use another approach which is to preprocess data on location and to send “home” (to nsa) only those preprocessed data with maybe 1%-3% of the original bandwith (which is way better feasible).
But the problems go on. With each and every major international fiber ever layed they chose the – then – max available bandwith. For a simple reason. It’s not the cable that is expensive but the laying.
Now one should remember what the limiting factor actually was, at least with fiber cables: it wasn’t the cable, it was the electronics of the endpoint equipment. How much limiting was it? Well, it was difficult and demanding enough that even the best special processors (like network processors) were not good enough; they had to build special circuits (“ASIC”).
And all that just to – “stupidly” – transfer the packets. Those packets were preprocessed and only had to be “packed” and put into the optical stream. *Any* further processing, no matter how minimal, would effectively cut down the bandwith severely.
So how does the nsa do it, what’s the only sensible, feasible and manageable was to do it?
It’s to have “preprocessors” that are specifically built (using ASICS again) and that do the job highly parallel (what a surprise! That happens to also be the was encrypted content is cracked). Those boxes first evaluate and then strip diverse protocoll layers (SONET/SDH, ATM, etc.), then they analyse the TCP/IP or phone headers, grab the metadata and decide whether the content is also grabbed … then they repackage the whole stuff and finally send it over their own virtual channel/fiber.
What does this come down to?
– The carriers and governments in Europe and elsewhere *do* know. With rare exceptions where nsa really has to do it clandestinely, quite probably in less than 1% of all traffic, this all happens with the full knowledge of both carriers/providers and governments.
– Contents can be grabbed but usually are not. Grabbing the meta data only is not a political choice, it’s a technical precondition; grabbing all data simply isn’t feasible but in exceptional cases.
– The whole thing (almost certainly) works like 1 system and it has 3 layers.
The lowest layer is on location and does data mirroring (“grabbing”) and very basic preprocessing and then sends the data to layer 2.
Layer 2 is regional centers with at least 1 per geo region and probably more. Here the preprocessed data is processed, probably mainly for triggers on a rather general and “generous” level, sorting out irrelevant data, and quite probably transposing headers into an internal format. An example for this might be a zusa base near, say, Manila (DeCIX). Also level 2 stations are probably manned 24/7 but only on a small scale.
The highest layer is layer 3. Those are the like of ne new nsa data center or menwith hill in uk. Here on layer 3 they have mid and long term storage, full analysis and more generally what one might call the “spplication” layer. At the same time those centers are the contact points for other agencies and it is here where requess, triggers and the like are fed into the system, and being propagated into layer 2 stations who again control layer 3 points.
Sorry for this lengthy post but I felt that it’s about time someone looked at that question and tried to at least lay it out and roughly sketch the mechanism at work.
While I, of course, do not know any details, I have high confidence in my assessment of the sceleton because I happen to know the relevant technology quite well and, more importantly, its limits.
Posted by: Mr. Pragma | Jul 29 2013 0:58 utc | 13
Anecdotes.
CH > Since about 5 years exists a National Data Base that collects all prescription meds. orders, the pharmacy employee told me. When asked who could consult it, she answered, well, the .. your doctor, and anyone in the pharmacy, as we are here to serve you!
Nothing was ever said about it in the press or afaik on TV and ppl aren’t aware it. I asked about 20 ppl, they only appreciated that their pharmacy knew what they needed and ordered the meds in time and communicated with their health insurance and so on, easier billing, paperwork, etc. Basically, these records are semi – public as anyone who is curious and determined can access them easily ..and that is your med history laid out right there.
From a public health pov (or a corporate drug co. pov) this information is prime. You can track over-subscribers, count the cost of X antibiotic and think about replacing it with generic ABC, calculate how much the insurance is paying for junk meds (which ones to ban), and so on. Potentially, it may lower the cost of health insurance, improve prescription practices, even patient compliance, etc. Good stuff ? Implemented without any public discussion whatsoever.
It is information creep.
US > A huge number of divorces are based on or due to evidence of infidelity (incl. what is called ‘emotional cheating’, just intimacy…) garnered from Facebook, emails, phone records, sms, either accessed by accident or found by ‘snooping‘ which is often considered legit if one has ‘doubts, suspicions..’ What used to be face-to-face flirting (or more), easily hidden, washed over, or denied, evanescent as to precise details, and immaterial, or successfully held secret, is now stark in black and some pastel color. Men track their women (phone records, GPS data, etc.), women look to see passwords typed in and access phone, chat logs, other, to discover He said — Hun I love Your Xx — to some cheap chick… Ka-Boom! Family destroyed, toddlers wailing.
CH > Was member of the board of a large U library when the point was reached that all books borrowed in public U libraries in the country could be tracked. Now, libraries are very concerned with privacy but in CH nobody would dream of using book-reading as ‘evidence’ for ‘terrorism/other’ so that was never a concern, not even an unspoken one. These libraries are desperate about book theft and book defacement. One can easily imagine what could have been done….but it wasn’t. Chinese walls were set up, the info was hyper protected, the higher level agreed – yet the info would potentially have served to catch criminals, reduce losses to libraries which equals more text books for students etc. So from the outside it was a hard call. and probably a rare ex. of self-denying privacy protection…. This is an example of, where to draw the line?
(I am totally against NSA spying and am not justifying or excusing it in any way, nor making light, just describing…)
Posted by: Noirette | Jul 31 2013 13:11 utc | 43
|
