C[omp]ute

From: andrew cooke <andrew@...>

Date: Fri, 7 Jun 2013 18:28:21 -0400

The Verizon order requested "information on all calls" - basically, all
metadata (not voice records).
http://www.guardian.co.uk/world/2013/jun/06/nsa-phone-records-verizon-court-order

Denials from Google and Facebook are, presumably, worded very carefully to
present the best possible version while remaining "legally true".  They
admit to complying with "legal requests" but deny "direct access" (that
exact phrase is common to both below) or requests on the scale of the
Verizon order.
https://www.facebook.com/zuck/posts/10100828955847631
http://googleblog.blogspot.com/2013/06/what.html

But if the NSA only requries metadata then they don't need to demand direct
access from Facebook or Google.  It's sufficient to use the data from ISPs
(like Verizon).  In fact, it would be pointless - they would simply be
duplicating data.

Traffic analysis (which seems to be what Prism is) does not require the
cooperation of the companies that provide the endpoints.  Because of the way
the internet works, it's sufficient to take the information from the people
who connect the servers to the clients.

Now things may be complicated by big companies like Google owning their own
CDNs, but it's not clear to me that invalidates the general argument (the NSA
still know if someone is "connecting to Google", no matter which of Google's
endpoints they use).


After doing traffic analysis, the NSA will presumably want to investigate some
conversations in more depth.  And that will be done in a manner consistent
with the statements by Google, Facebook et al - legal, targetted requests.

This is consistent with the different historical attitudes from the two
industries.  Remember how AT&T bent over backwards to support monitoring,
while Google and Twitter have a good record of questioning and resisting
requests.

BUT it doesn't convincingly explain this
http://cdn.theatlantic.com/static/mt/assets/science/assets_c/2013/06/prism-slide-5-thumb-570x427-123899.jpg
(you'd have to argue that this diagram is simply showing when they started
making the legal requests; it seems to be claiming something more).

Andrew