http://www.washingtonpost.com/blogs/the-switch/wp/2013/12/10/nsa-uses-google-cookies-to-pinpoint-targets-for-hacking//?print=1NSA uses Google cookies to pinpoint targets for hacking
By Ashkan Soltani, Andrea Peterson, and Barton Gellman, Updated: December 10 at 8:50 pm
The National Security Agency is secretly piggybacking on the tools that enable Internet advertisers to track consumers, using "cookies" and location data to pinpoint targets for government hacking and to bolster surveillance.
The agency's internal presentation slides, provided by former NSA contractor Edward Snowden, show that when companies follow consumers on the Internet to better serve them advertising, the technique opens the door for similar tracking by the government. The slides also suggest that the agency is using these tracking techniques to help identify targets for offensive hacking operations.
For years, privacy advocates have raised concerns about the use of commercial tracking tools to identify and target consumers with advertisements. The online ad industry has said its practices are innocuous and benefit consumers by serving them ads that are more likely to be of interest to them.
The revelation that the NSA is piggybacking on these commercial technologies could shift that debate, handing privacy advocates a new argument for reining in commercial surveillance.
According to the documents, the NSA and its British counterpart, GCHQ, are using the small tracking files or "cookies" that advertising networks place on computers to identify people browsing the Internet. The intelligence agencies have found particular use for a part of a Google-specific tracking mechanism known as the “PREF” cookie. These cookies typically don't contain personal information, such as someone's name or e-mail address, but they do contain numeric codes that enable Web sites to uniquely identify a person's browser.
In addition to tracking Web visits, this cookie allows NSA to single out an individual's communications among the sea of Internet data in order to send out software that can hack that person's computer. The slides say the cookies are used to "enable remote exploitation," although the specific attacks used by the NSA against targets are not addressed in these documents.
The NSA's use of cookies isn't a technique for sifting through vast amounts of information to find suspicious behavior; rather, it lets NSA home in on someone already under suspicion - akin to when soldiers shine laser pointers on a target to identify it for laser-guided bombs.
Separately, the NSA is also using commercially gathered information to help it locate mobile devices around the world, the documents show. Many smartphone apps running on iPhones and Android devices, and the Apple and Google operating systems themselves, track the location of each device, often without a clear warning to the phone's owner. This information is more specific than the broader location data the government is collecting from cellular phone networks, as reported by the Post last week.
"On a macro level, 'we need to track everyone everywhere for advertising' translates into 'the government being able to track everyone everywhere,'" says Chris Hoofnagle, a lecturer in residence at UC Berkeley Law. "It's hard to avoid."
These specific slides do not indicate how the NSA obtains Google PREF cookies or whether the company cooperates in these programs, but other documents reviewed by the Post indicate that cookie information is among the data NSA can obtain with a Foreign Intelligence Surveillance Act order. If the NSA gets the data that way, the companies know and are legally compelled to assist.
The NSA declined to comment on the specific tactics outlined in this story, but an NSA spokesman sent the Post a statement: "As we've said before, NSA, within its lawful mission to collect foreign intelligence to protect the United States, uses intelligence tools to understand the intent of foreign adversaries and prevent them from bringing harm to innocent Americans."
Google declined to comment for this article, but chief executive Larry Page joined the leaders of other technology companies earlier this week in calling for an end to bulk collection of user data and for new limits on court-approved surveillance requests. "The security of users' data is critical, which is why we've invested so much in encryption and fight for transparency around government requests for information," Page said in a statement on the coalition's Web site. "This is undermined by
the apparent wholesale collection of data, in secret and without independent oversight, by many governments around the world."
How consumers are tracked online
Internet companies store small files called cookies on users' computers to uniquely identify them for ad-targeting and other purposes across many different Web sites. This advertising-driven business model pays for many of the services, like e-mail accounts, that consumers have come to expect to have for free. Yet few are aware of the full extent to which advertisers, services and Web sites track their activities across the Web and mobile devices. These data collection mechanisms are invisible to all but the most sophisticated users -- and the tools to opt-out or block them have limited effectiveness.
Privacy advocates have pushed to create a "Do Not Track" system allowing consumers to opt out of such tracking. But Jonathan Mayer of Stanford's Center for Internet and Society, who has been active in that push, says "Do Not Track efforts are stalled out." They ground to a halt when the Digital Advertising Alliance, a trade group representing online ad companies, abandoned the effort in September after clashes over the proposed policy. One of the primary issues of contention was whether consumers would be able to opt out of all tracking, or just not be served advertisements based on tracking.
Some browsers, such as Apple's Safari, automatically block a type of code known as "third-party cookies," which are often placed by companies that advertise on the site being visited. Other browsers such as Mozilla's Firefox are also experimenting with that idea. But such settings won't prevent users from receiving cookies directly from the primary sites they visit or services they use.
Google's PREF Cookie
Google assigns a unique PREF cookie anytime someone's browser makes a connection to any of the company's Web properties or services. This can occur when consumers directly use Google services such as Search or Maps, or when they visit Web sites that contain embedded "widgets" for the company's social media platform Google Plus. That cookie contains a code that allows Google to uniquely track users to "personalize ads" and measure how they use other Google products.
Given the widespread use of Google services and widgets, most Web users are likely to have a Google PREF cookie even if they've never visited a Google property directly.
That PREF cookie is specifically mentioned in an internal NSA slide, which reference the NSA using GooglePREFID, their shorthand for the unique numeric identifier contained within Google's PREF cookie. Special Source Operations (SSO) is an NSA division that works with private companies to scoop up data as it flows over the Internet's backbone and from technology companies' own systems. The slide indicates that SSO was sharing information containing "logins, cookies, and GooglePREFID" with another NSA division called Tailored Access Operations, which engages in offensive hacking operations. SSO also shares the information with the British intelligence agency GCHQ.
"This shows a link between the sort of tracking that's done by Web sites for analytics and advertising and NSA exploitation activities," says Ed Felten, a computer scientist at Princeton University. "By allowing themselves to be tracked for analytic or advertising at least some users are making themselves more vulnerable to exploitation."
This isn't the first time Google cookies have been highlighted in the NSA's attempts to identify targets to hack. A presentation released in October by the Guardian called "Tor Stinks" indicates that the agency was using cookies for DoubleClick.net, Google's third-party advertising service, in an attempt to identify users of the Internet anonymization tool Tor when they switched to regular browsing. "It's similar in the sense that you see the use of an unique ID in the cookie to allow an eavesdropper to connect the activities of a user over time," says Felten.
Leaked location data
Another slide indicates that the NSA is collecting location data transmitted by mobile apps to support ad-targeting efforts in bulk. The NSA program, code-named HAPPYFOOT, helps the NSA to map Internet addresses to physical locations more precisely than is possible with traditional Internet geolocation services.
Many mobile apps and operating systems use location-based services to help users find restaurants or establishments nearby. In fact, even when GPS is disabled, most smart phones silently determine their location in the background using signals from Wi-Fi networks or cellular towers.
And apps that do not need geo-location data may still collect it anyway to share with third-party advertisers. Just last week, the Federal Trade Commission announced a settlement for a seemingly innocuous flashlight app that allegedly leaked user location information to advertisers without consumers' knowledge.
Apps transmit their locations to Google and other Internet companies because ads tied to a precise physical location can be more lucrative than generic ads. But in the process, they appear to tip off the NSA to a mobile device's precise physical location. That makes it easier for the spy agency to engage in the sophisticated tracking techniques the Post described in a story Dec. 4.
Implications for privacy
The disclosures about NSA practices reveal the dilemma facing online companies, which have faced a backlash against tracking for commercial purposes and their role in government surveillance.
"If data is used and it stops the next 9/11 our fellow citizens wouldn't have any problem with it no matter what it is," says Stuart P. Ingis, General Counsel at the Digital Advertising Association. But he says that it is a balancing act to pursue those bad actors "while at the same time preserving the civil liberties."
Other defenders of online advertising companies have argued it is unfair to conflate private companies' ad-tracking activities with the NSA activities revealed in the Snowden leaks. Marvin Ammori, a lawyer who advises technology companies including Google on surveillance issues, wrote in USA Today that "limiting bulk data collection by private companies - whether they advertise or not - would do little or nothing to limit the NSA."
Felten disagrees, noting that the latest documents show that "the unique identifiers that are being placed on users' computers are not only being used by analytic and advertising companies, but also being used by the NSA for targeting." He also says that there are things those companies could do to protect their users from the type of attacks described in the slides, like "not sending tracking IDs, or at least not sending them in the clear" without a layer of encryption.
Similarly, he says, "browser makers can help by giving users better control over the use of third-party tracking cookies and by making sure that their browsers are not sending unique IDs as a side effect of their safe-browsing behavior."
Stanford's Mayer says the revelations suggest the need for limits on the data that companies collect about consumers. "There's increasingly a sense that giving consumers control over the information they share with companies is all the more important," he says, "because you're also giving them control over the information they share with government."
Who would trust them?Just to throw this out but won't this create a new market for the tech companies going forward by promoting anti-NSA products?
It also throws a huge wrench into some plans as well I'm sure and I know most of them are furious over this stuff being revealed because it really does hurt business short term for them.
Knowing everything I know right now certainly not me but your average person really has no idea what is really going on so far except for what little the news has told them.Who would trust them?Just to throw this out but won't this create a new market for the tech companies going forward by promoting anti-NSA products?
It also throws a huge wrench into some plans as well I'm sure and I know most of them are furious over this stuff being revealed because it really does hurt business short term for them.
the sheep?Who would trust them?Just to throw this out but won't this create a new market for the tech companies going forward by promoting anti-NSA products?
It also throws a huge wrench into some plans as well I'm sure and I know most of them are furious over this stuff being revealed because it really does hurt business short term for them.
I mean, they legally can't even protect the data.Knowing everything I know right now certainly not me but your average person really has no idea what is really going on so far except for what little the news has told them.Who would trust them?Just to throw this out but won't this create a new market for the tech companies going forward by promoting anti-NSA products?
It also throws a huge wrench into some plans as well I'm sure and I know most of them are furious over this stuff being revealed because it really does hurt business short term for them.
U.S. cloud providers have already lost business over the NSA leaks, but now the Information Technology and Innovation Foundation (ITIF) has a report putting a dollar amount on the short-term costs: $21.5 to $35 billion over the next three years.
ITIF based these estimates in part on the Cloud Security Alliance survey showing that 10 percent of officials at non-U.S. companies cancelled contracts with U.S. providers and 56 percent of non-U.S. respondents are hesitant to work with U.S. cloud based operators after the leaks.
The cloud computing industry is big business: it’s estimated to be a $131 billion market by the end of 2013, and a $207 billion market by 2016. The U.S. has historically dominated the space. But after the Snowden leaks detailed the level of access the NSA has to data hosted by U.S. companies, European officials and cloud providers raised privacy alarm bells.
This leads ITIF to conclude the NSA leaks “will likely have an immediate and lasting impact on the competitiveness of the U.S. cloud computing industry if foreign customers decide the risks of storing data with a U.S. company outweigh the benefits.”
Even before the NSA leaks, there were rumblings that data given to U.S. companies wasn't safe from U.S. law enforcement thanks to the Patriot Act -- some of which were validated by Microsoft's admission that even E.U.-based cloud data hosted by the company was subject to the law. The European Parliament raised those concerns in an October 2012 report about privacy in the cloud.
http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/07/nsa-snooping-could-cost-u-s-tech-companies-35-billion-over-three-years/
I guess if the media is complicit sure....the sheep?Who would trust them?Just to throw this out but won't this create a new market for the tech companies going forward by promoting anti-NSA products?
It also throws a huge wrench into some plans as well I'm sure and I know most of them are furious over this stuff being revealed because it really does hurt business short term for them.
I know some of the tech giants are pushing hard for reforms but I think we all know this program isn't going away so I would guess these companies will be trying to invent something that the NSA can't get into or at least put out that perception it is.I mean, they legally can't even protect the data.Knowing everything I know right now certainly not me but your average person really has no idea what is really going on so far except for what little the news has told them.Who would trust them?Just to throw this out but won't this create a new market for the tech companies going forward by promoting anti-NSA products?
It also throws a huge wrench into some plans as well I'm sure and I know most of them are furious over this stuff being revealed because it really does hurt business short term for them.
Sure seems like a pretty split vote to meOnly because we keep conservatives elected.we all know this program isn't going away
The full roll call has now been released, and you'll note that this is not a partisan issue. The vote didn't fall along partisan lines at all. Rep. Mike Rogers (one of the strongest defenders of the program) called the vote "bipartisan" against Amash, but it was equally as bipartisan against the NSA. 94 Republicans and 111 Democrats voted to stop the NSA collectingevery phone record on every phone call.134 Republicans and 83 Democrats voted to let the NSA keep spying on you.
Often they are split at least to some degree, but...Sure seems like a pretty split vote to meOnly because we keep conservatives elected.we all know this program isn't going away
The full roll call has now been released, and you'll note that this is not a partisan issue. The vote didn't fall along partisan lines at all. Rep. Mike Rogers (one of the strongest defenders of the program) called the vote "bipartisan" against Amash, but it was equally as bipartisan against the NSA. 94 Republicans and 111 Democrats voted to stop the NSA collectingevery phone record on every phone call.134 Republicans and 83 Democrats voted to let the NSA keep spying on you.
So why not vote them all out who voted to fund it?Often they are split at least to some degree, but...Sure seems like a pretty split vote to meOnly because we keep conservatives elected.we all know this program isn't going away
The full roll call has now been released, and you'll note that this is not a partisan issue. The vote didn't fall along partisan lines at all. Rep. Mike Rogers (one of the strongest defenders of the program) called the vote "bipartisan" against Amash, but it was equally as bipartisan against the NSA. 94 Republicans and 111 Democrats voted to stop the NSA collectingevery phone record on every phone call.134 Republicans and 83 Democrats voted to let the NSA keep spying on you.
A majority of Dems voted top defund it.
A majority of Repubs voted to keep it running.
If the companies are under the jurisdicition of the US courts, they will not be able to prevent the NSA from accessing their information.I know some of the tech giants are pushing hard for reforms but I think we all know this program isn't going away so I would guess these companies will be trying to invent something that the NSA can't get into or at least put out that perception it is.I mean, they legally can't even protect the data.Knowing everything I know right now certainly not me but your average person really has no idea what is really going on so far except for what little the news has told them.Who would trust them?Just to throw this out but won't this create a new market for the tech companies going forward by promoting anti-NSA products?
It also throws a huge wrench into some plans as well I'm sure and I know most of them are furious over this stuff being revealed because it really does hurt business short term for them.
Thanks for sharing. Glad to see my Congressman (Watt) is on the same side with all the spam I send him about this.Sure seems like a pretty split vote to meOnly because we keep conservatives elected.we all know this program isn't going away
The full roll call has now been released, and you'll note that this is not a partisan issue. The vote didn't fall along partisan lines at all. Rep. Mike Rogers (one of the strongest defenders of the program) called the vote "bipartisan" against Amash, but it was equally as bipartisan against the NSA. 94 Republicans and 111 Democrats voted to stop the NSA collectingevery phone record on every phone call.134 Republicans and 83 Democrats voted to let the NSA keep spying on you.
Not sure...there are plenty in this very thread that don't think it's a big deal in the first place so.......I guess if the media is complicit sure....the sheep?Who would trust them?Just to throw this out but won't this create a new market for the tech companies going forward by promoting anti-NSA products?
It also throws a huge wrench into some plans as well I'm sure and I know most of them are furious over this stuff being revealed because it really does hurt business short term for them.
But I'd bet that the same people who would seek protection would be aware it is hollow.
NSA leaders split on giving amnesty to Snowden
ByJohn Miller CBS News December 12, 2013, 7: 29 PM
CBS News learned Thursday that the information National Security Agency leaker Edward Snowden has revealed so far is just a fraction of what he has. In fact, he has so much, some think it is worth giving him amnesty to get it back.
Rick Leggett is the man who was put in charge of the Snowden leak task force by Gen. Keith Alexander, who heads the NSA. The task force's job is to prevent another leak like this one from happening again. They're also trying to figure out how much damage the Snowden leaks have done, and how much damage they could still do.
Snowden, who is believed to still have access to 1.5 million classified documents he has not leaked, has been granted temporary asylum in Moscow, which leaves the U.S. with few options.
JOHN MILLER: He's already said, "If I got amnesty, I would come back." Given the potential damage to national security, what would your thought on making a deal be?
RICK LEGGETT: So, my personal view is, yes, it's worth having a conversation about. I would need assurances that the remainder of the data could be secured, and my bar for those assurances would be very high. It would be more than just an assertion on his part.
MILLER: Is that a unanimous feeling?
LEGGETT: It's not unanimous.
Among those who think making a deal is a bad idea is Leggett's boss, Gen. Keith Alexander.
GEN. KEITH ALEXANDER: This is analogous to a hostage-taker taking 50 people hostage, shooting 10 and then say, "If you give me full amnesty, I'll let the other 40 go." What do you do?
MILLER: It's a dilemma.
GEN. ALEXANDER: It is.
MILLER: Do you have a pick?
GEN. ALEXANDER: I do. I think people have to be held accountable for their actions. … Because what we don't want is the next person to do the same thing, race off to Hong Kong and to Moscow with another set of data, knowing they can strike the same deal.
We asked Gen. Alexander, Leggett and former NSA Director Michael Hayden why the Russians would give Snowden amnesty if they already have Snowden's information, and they said they would be sadly disappointed in the intelligence services if they hadn't gotten that material.
The question is, for damage control, what's the difference between a couple of foreign governments having it -- that's bad -- or having it out there in the newspapers or across many other governments?
You can see more of this story Sunday on "60 Minutes."
http://www.cbsnews.com/news/nsa-leaders-split-on-giving-amnesty-to-snowden/
White House to preserve controversial policy on NSA, Cyber Command leadership
By Ellen Nakashima, Friday, December 13, 10:13 AM
The Obama administration has decided to preserve a controversial arrangement by which a single military official is permitted to direct both the National Security Agency and the military’s cyberwarfare command, U.S. officials said.
The decision by President Obama comes amid signs that the White House is not inclined to impose significant new restraints on the NSA’s activities — especially its collection of data on virtually every phone call Americans make — although it is likely to impose additional privacy protection measures.
NSA Director Gen. Keith Alexander said Wednesday that his organization is implementing changes to prevent a leak comparable to that committed by Edward Snowden from happening again.
Some officials, including the top U.S. intelligence official, had argued that the NSA and Cyber Command should be placed under separate leadership to ensure greater accountability and avoid an undue concentration of power. The decision also comes despite a draft recommendation by an external review panel appointed by Obama that a civilian head be installed at the NSA, effectively splitting the roles, according to an official familiar with some of the early recommendations.
“Following a thorough interagency review, the administration has decided that keeping the positions of NSA Director and Cyber Command Commander together as one, dual-hatted position is the most effective approach to accomplishing both agencies’ missions,” White House spokeswoman Caitlin Hayden said in an e-mail to The Washington Post.
The announcement comes as an external panel appointed by Obama readies a report on NSA surveillance and the White House nears completion of its own internal review. The White House will take the five-member panel’s recommendations under consideration but is free to reject or modify them.
“The big picture is there’s not going to be that much [additional] constraint” by the White House, one U.S. official said, speaking on the condition of anonymity to discuss internal deliberations. “They’re really not hurting [the NSA] that much.”
NSA officials declined to comment.
Hayden said the internal review focuses on the NSA’s activities around the world with a special emphasis on collection of intelligence about heads of state, coordination with closest allies and partners, and the issue of whether the process of setting national intelligence priorities should be modified.
She declined to discuss details, saying the review was ongoing.
Some officials familiar with the decision to keep one person in charge of both the NSA and Cyber Command expressed disappointment.
“It’s a mistake,” said one U.S. official. “Cyber Command and NSA each needs its own full-time head, and [Obama] could have continued the coordination and close working relationship between the two organizations without them being led by the same individual.”
The current NSA director, Gen. Keith B. Alexander, is due to retire in March after more than eight years at the helm. He has long advocated maintaining the “dual hat” arrangement for the NSA and Cyber Command, arguing that the cyber unit depends heavily on the NSA’s capabilities for its own operations.
“NSA plays a unique role in supporting Cyber Command’s mission, providing critical support for target access and development, including linguists, analysts, cryptanalytic capabilities, and sophisticated technological infrastructure,” Hayden said. “Without the dual-hat arrangement, elaborate procedures would have to be put in place to ensure that effective coordination continued and avoid creating duplicative capabilities in each organization.”
In interagency deliberations in recent weeks, some officials have also advocated for placing a civilian in charge of the NSA. The external review panel was also prepared to recommend such a step, according to one official.
But the cyber organization must be headed by a military official, so the NSA’s director will continue to be a military officer, as has been the tradition since it was launched in 1952.
Cyber Command was established in 2009 but reached full operational capability in 2010.
http://www.washingtonpost.com/world/national-security/white-house-to-preserve-controversial-policy-on-nsa-cyber-command-leadership/2013/12/13/4bb56a48-6403-11e3-a373-0f9f2d1c2b61_story.html?wpisrc=al_national
GEN. KEITH ALEXANDER: This is analogous to a hostage-taker taking 50 people hostage, shooting 10 and then say, "If you give me full amnesty, I'll let the other 40 go." What do you do?
Just stop electing conservatives and this all goes away, right?White House to preserve controversial policy on NSA, Cyber Command leadership
The problem with this is that no one believes Barack Obama anymore. He has lied repeatedly. We're no longer buying your act, con man.Obama: NSA reforms will give Americans 'more confidence' in surveillance programs
By Andrew Rafferty, NBC News
President Barack Obama said he will propose new reforms to the National Security Agency aimed at giving Americans "more confidence" in the organization after various leaks revealed numerous wide-ranging government surveillance programs.
"The NSA actually does a very good job about not engaging in domestic surveillance, not reading people's emails, not listening to ... the contents of their phone calls," the president said Thursday during an interview with MSNBC's Chris Matthews.
"Outside of our borders, the NSA's more aggressive. It's not constrained by laws. And part of what we're trying to do over the next month or so is having done an independent review and brought a whole bunch of folks, civil libertarians and-- lawyers and others to examine what's being done."
"I'll be proposing some self-restraint on the NSA and initiating some reforms that can give people some more confidence."
The president did not specify what the reforms may be. But some U.S. allies were angered by reports accusing the agency of monitoring the phone conversations of 35 world leaders.
Obama's remarks came in the immediate wake of a Washington Post report which charged the NSA with gathering 5 billion records a day as a way to track cellphone locations worldwide.
Obama did not comment on this report, but did say that these leaks, largely perpetrated by former government contractor Edward Snowden, have identified some areas of legitimate legal concern.
The White House, under fire from closest allies, is taking a closer look at the National Security Agency's vast data collection. NBC's Andrea Mitchell reports.
But, he added, "some it has also been highly sensationalized."
While the president said he is looking to reform how the NSA operates overseas, he also defended the importance of the agency's overall mission.
"We do have people that are trying to hurt us, and they communicate through these same systems. ... we've got to be in there in some way to help
protect people even as we're also making sure that government doesn't abuse it," he said.
"I want everybody to be clear. The people at the NSA, generally, are looking out for the safety of the American people. They are not interested in reading your emails. They're not interested in reading your text messages," he added later. "And we've got a big system of checks and balances, including the courts and Congress, who have the capacity to prevent that from happening."
http://nbcpolitics.nbcnews.com/_news/2013/12/05/21776882-obama-nsa-reforms-will-give-americans-more-confidence-in-surveillance-programs
So I am toldJust stop electing conservatives and this all goes away, right?White House to preserve controversial policy on NSA, Cyber Command leadership
NSA Phone Spying Program Ruled Unconstitutional By Federal Judge
A federal judge ruled on Monday that the National Security Agency’s PRISM program, which collects telephone records and metadata and was revealed this summer by whistleblower Edward Snowden, could be unconstitutional.
U.S. District Court Judge Richard Leon, appointed by George W. Bush, ruled that PRISM likely violates the Fourth Amendment’s ban of unreasonable search and seizure. Leon argued that the NSA’s widespread collection of telephone calls made in or to the United States represents an “arbitrary invasion” of the lives of its own private citizens. He also said that the Justice Department has done little to demonstrate that these information-collection efforts actually prevent future terrorist acts.
“Plaintiffs have a very significant expectation of privacy in an aggregated collection of their telephone metadata covering the last five years, and the NSA’s Bulk Telephony Metadata Program significantly intrudes on that expectation,” Leon wrote in the ruling. “I have significant doubts about the efficacy of the metadata collection program as a means of conducting time-sensitive investigations in cases involving imminent threats of terrorism.
“I cannot imagine a more ‘indiscriminate’ and ‘arbitrary invasion’ than this systematic and high-tech collection and retention of personal data on virtually every single citizen for purposes of querying it and analyzing it without judicial approval,” Leon continued.
Leon issued his ruling in response to a lawsuit levied against the NSA and President Obama by conservative activist Larry Klayman. In the ruling, Leon issued a preliminary injunction ordering the NSA to desist its metadata collection efforts, though he stayed the order and allowed the NSA to submit an appeal.
As Politico notes, this is the first significant legal ruling against the NSA’s PRISM program, which was revealed in June and has been upheld by judges on the Foreign Intelligence Surveillance Court.
http://www.ibtimes.com/nsa-phone-spying-program-ruled-unconstitutional-federal-judge-1510756
Yeah I saw this and read it. If this judge is correct, then it appears that I was wrong in my contention that it was constitutional.tom22406 said:NSA Phone Spying Program Ruled Unconstitutional By Federal Judge
A federal judge ruled on Monday that the National Security Agency’s PRISM program, which collects telephone records and metadata and was revealed this summer by whistleblower Edward Snowden, could be unconstitutional.
U.S. District Court Judge Richard Leon, appointed by George W. Bush, ruled that PRISM likely violates the Fourth Amendment’s ban of unreasonable search and seizure. Leon argued that the NSA’s widespread collection of telephone calls made in or to the United States represents an “arbitrary invasion” of the lives of its own private citizens. He also said that the Justice Department has done little to demonstrate that these information-collection efforts actually prevent future terrorist acts.
“Plaintiffs have a very significant expectation of privacy in an aggregated collection of their telephone metadata covering the last five years, and the NSA’s Bulk Telephony Metadata Program significantly intrudes on that expectation,” Leon wrote in the ruling. “I have significant doubts about the efficacy of the metadata collection program as a means of conducting time-sensitive investigations in cases involving imminent threats of terrorism.
“I cannot imagine a more ‘indiscriminate’ and ‘arbitrary invasion’ than this systematic and high-tech collection and retention of personal data on virtually every single citizen for purposes of querying it and analyzing it without judicial approval,” Leon continued.
Leon issued his ruling in response to a lawsuit levied against the NSA and President Obama by conservative activist Larry Klayman. In the ruling, Leon issued a preliminary injunction ordering the NSA to desist its metadata collection efforts, though he stayed the order and allowed the NSA to submit an appeal.
As Politico notes, this is the first significant legal ruling against the NSA’s PRISM program, which was revealed in June and has been upheld by judges on the Foreign Intelligence Surveillance Court.
http://www.ibtimes.com/nsa-phone-spying-program-ruled-unconstitutional-federal-judge-1510756
I just don't see how your original contention makes any sense to begin with. That is, that the NSA should be able to get a single warrant that allows it to capture, store, and search everyone's e-mail, phone records, internet history, etc.Yeah I saw this and read it. If this judge is correct, then it appears that I was wrong in my contention that it was constitutional.tom22406 said:NSA Phone Spying Program Ruled Unconstitutional By Federal Judge
I don't want to repeat my argument here but it was based on some highly respected legal minds who wrote articles which I found compelling and posted here. I still find those arguments compelling, but this judge apparently does not.I just don't see how your original contention makes any sense to begin with. That is, that the NSA should be able to get a single warrant that allows it to capture, store, and search everyone's e-mail, phone records, internet history, etc.Such a warrant is the exact, functional equivalent of no warrant at all.Yeah I saw this and read it. If this judge is correct, then it appears that I was wrong in my contention that it was constitutional.tom22406 said:NSA Phone Spying Program Ruled Unconstitutional By Federal Judge
ExactlyI just don't see how your original contention makes any sense to begin with. That is, that the NSA should be able to get a single warrant that allows it to capture, store, and search everyone's e-mail, phone records, internet history, etc.Yeah I saw this and read it. If this judge is correct, then it appears that I was wrong in my contention that it was constitutional.tom22406 said:NSA Phone Spying Program Ruled Unconstitutional By Federal Judge
Such a warrant is the exact, functional equivalent of no warrant at all.
Don't worry about what everyone else thinks. This is a question for you, based on simple logic.timschochet said:I don't want to repeat my argument here but it was based on some highly respected legal minds who wrote articles which I found compelling and posted here. I still find those arguments compelling, but this judge apparently does not.Rich Conway said:I just don't see how your original contention makes any sense to begin with. That is, that the NSA should be able to get a single warrant that allows it to capture, store, and search everyone's e-mail, phone records, internet history, etc.Such a warrant is the exact, functional equivalent of no warrant at all.Yeah I saw this and read it. If this judge is correct, then it appears that I was wrong in my contention that it was constitutional.tom22406 said:NSA Phone Spying Program Ruled Unconstitutional By Federal Judge
IMO, no. Though the in perpetuity part bothers me.But so long as the data exists in a collective mass form, searched in a collective mass form, and stored in a collective mass form I don't believe that individual warrants should be necessary. Just my own opinion, we'll see how it plays out.Don't worry about what everyone else thinks. This is a question for you, based on simple logic.Is a warrant that allows the NSA to capture, store in perpetuity, and search everyone's e-mail, phone records, internet history, etc. functionally equivalent to no warrant requirement at all?timschochet said:I don't want to repeat my argument here but it was based on some highly respected legal minds who wrote articles which I found compelling and posted here. I still find those arguments compelling, but this judge apparently does not.Rich Conway said:I just don't see how your original contention makes any sense to begin with. That is, that the NSA should be able to get a single warrant that allows it to capture, store, and search everyone's e-mail, phone records, internet history, etc.Such a warrant is the exact, functional equivalent of no warrant at all.Yeah I saw this and read it. If this judge is correct, then it appears that I was wrong in my contention that it was constitutional.tom22406 said:NSA Phone Spying Program Ruled Unconstitutional By Federal Judge
IMO, no. Though the in perpetuity part bothers me.But so long as the data exists in a collective mass form, searched in a collective mass form, and stored in a collective mass form I don't believe that individual warrants should be necessary. Just my own opinion, we'll see how it plays out.Don't worry about what everyone else thinks. This is a question for you, based on simple logic.Is a warrant that allows the NSA to capture, store in perpetuity, and search everyone's e-mail, phone records, internet history, etc. functionally equivalent to no warrant requirement at all?
This just seems like a complete failure of logic. If I hold a warrant that allows me to seize and search everything, then there is no need for any other warrant, ever. That's the same as never needing a warrant.you still might be right, the federal judge just happens to disagree.Yeah I saw this and read it. If this judge is correct, then it appears that I was wrong in my contention that it was constitutional.tom22406 said:NSA Phone Spying Program Ruled Unconstitutional By Federal Judge
A federal judge ruled on Monday that the National Security Agency’s PRISM program, which collects telephone records and metadata and was revealed this summer by whistleblower Edward Snowden, could be unconstitutional.
U.S. District Court Judge Richard Leon, appointed by George W. Bush, ruled that PRISM likely violates the Fourth Amendment’s ban of unreasonable search and seizure. Leon argued that the NSA’s widespread collection of telephone calls made in or to the United States represents an “arbitrary invasion” of the lives of its own private citizens. He also said that the Justice Department has done little to demonstrate that these information-collection efforts actually prevent future terrorist acts.
“Plaintiffs have a very significant expectation of privacy in an aggregated collection of their telephone metadata covering the last five years, and the NSA’s Bulk Telephony Metadata Program significantly intrudes on that expectation,” Leon wrote in the ruling. “I have significant doubts about the efficacy of the metadata collection program as a means of conducting time-sensitive investigations in cases involving imminent threats of terrorism.
“I cannot imagine a more ‘indiscriminate’ and ‘arbitrary invasion’ than this systematic and high-tech collection and retention of personal data on virtually every single citizen for purposes of querying it and analyzing it without judicial approval,” Leon continued.
Leon issued his ruling in response to a lawsuit levied against the NSA and President Obama by conservative activist Larry Klayman. In the ruling, Leon issued a preliminary injunction ordering the NSA to desist its metadata collection efforts, though he stayed the order and allowed the NSA to submit an appeal.
As Politico notes, this is the first significant legal ruling against the NSA’s PRISM program, which was revealed in June and has been upheld by judges on the Foreign Intelligence Surveillance Court.
http://www.ibtimes.com/nsa-phone-spying-program-ruled-unconstitutional-federal-judge-1510756
Now please remember we're discussing this only theoretically:IMO, no. Though the in perpetuity part bothers me.But so long as the data exists in a collective mass form, searched in a collective mass form, and stored in a collective mass form I don't believe that individual warrants should be necessary. Just my own opinion, we'll see how it plays out.Don't worry about what everyone else thinks. This is a question for you, based on simple logic.Is a warrant that allows the NSA to capture, store in perpetuity, and search everyone's e-mail, phone records, internet history, etc. functionally equivalent to no warrant requirement at all?This just seems like a complete failure of logic. If I hold a warrant that allows me to seize and search everything, then there is no need for any other warrant, ever. That's the same as never needing a warrant.
Uh....what?Now please remember we're discussing this only theoretically:
My argument is meant to be theoretical. In real, practical terms, what I just proposed seems to fall apart in its execution.Uh....what?Now please remember we're discussing this only theoretically:
My argument is meant to be theoretical. In real, practical terms, what I just proposed seems to fall apart in its execution.Uh....what?Now please remember we're discussing this only theoretically:
Can you define "collect the data collectively" and "search the data collectively" versus "look at someone's individual data"? Either my data is being collected or its not.Now please remember we're discussing this only theoretically:IMO, no. Though the in perpetuity part bothers me.But so long as the data exists in a collective mass form, searched in a collective mass form, and stored in a collective mass form I don't believe that individual warrants should be necessary. Just my own opinion, we'll see how it plays out.Don't worry about what everyone else thinks. This is a question for you, based on simple logic.Is a warrant that allows the NSA to capture, store in perpetuity, and search everyone's e-mail, phone records, internet history, etc. functionally equivalent to no warrant requirement at all?This just seems like a complete failure of logic. If I hold a warrant that allows me to seize and search everything, then there is no need for any other warrant, ever. That's the same as never needing a warrant.
The mass warrant would allow you to collect the data collectively, and to search the data collectively (using some form of search engine, algorithm, etc.) If you, upon collecting the data, then decided you needed to look at someone's INDIVIDUAL data, then you would need an individual warrant for that, despite the fact that you already had the data in your possession. In other words, if the NSA decided to look at your specific emails, that act would be illegal.
).SAN FRANCISCO (Reuters) - As a key part of a campaign to embed encryption software that it could crack into widely used computer products, the U.S. National Security Agency arranged a secret $10 million contract with RSA, one of the most influential firms in the computer security industry, Reuters has learned.
Documents leaked by former NSA contractor Edward Snowden show that the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products, the New York Times reported in September. Reuters later reported that RSA became the most important distributor of that formula by rolling it into a software tool called Bsafe that is used to enhance security in personal computers and many other products.
Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract. Although that sum might seem paltry, it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year, securities filings show.
The earlier disclosures of RSA's entanglement with the NSA already had shocked some in the close-knit world of computer security experts. The company had a long history of championing privacy and security, and it played a leading role in blocking a 1990s effort by the NSA to require a special chip to enable spying on a wide range of computer and communications products.
RSA, now a subsidiary of computer storage giant EMC Corp, urged customers to stop using the NSA formula after the Snowden disclosures revealed its weakness.
RSA and EMC declined to answer questions for this story, but RSA said in a statement: "RSA always acts in the best interest of its customers and under no circumstances does RSA design or enable any back doors in our products. Decisions about the features and functionality of RSA products are our own."
The NSA declined to comment.
The RSA deal shows one way the NSA carried out what Snowden's documents describe as a key strategy for enhancing surveillance: the systematic erosion of security tools. NSA documents released in recent months called for using "commercial relationships" to advance that goal, but did not name any security companies as collaborators.
The NSA came under attack this week in a landmark report from a White House panel appointed to review U.S. surveillance policy. The panel noted that "encryption is an essential basis for trust on the Internet," and called for a halt to any NSA efforts to undermine it.
Most of the dozen current and former RSA employees interviewed said that the company erred in agreeing to such a contract, and many cited RSA's corporate evolution away from pure cryptography products as one of the reasons it occurred.
But several said that RSA also was misled by government officials, who portrayed the formula as a secure technological advance.
"They did not show their true hand," one person briefed on the deal said of the NSA, asserting that government officials did not let on that they knew how to break the encryption.
A lot of companies use RSA keys for encryption. I wonder if this revelation is going to cause a major dent in their business. .The RSA and NSA connection
SAN FRANCISCO (Reuters) - As a key part of a campaign to embed encryption software that it could crack into widely used computer products, the U.S. National Security Agency arranged a secret $10 million contract with RSA, one of the most influential firms in the computer security industry, Reuters has learned.
Documents leaked by former NSA contractor Edward Snowden show that the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products, the New York Times reported in September. Reuters later reported that RSA became the most important distributor of that formula by rolling it into a software tool called Bsafe that is used to enhance security in personal computers and many other products.
Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract. Although that sum might seem paltry, it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year, securities filings show.
The earlier disclosures of RSA's entanglement with the NSA already had shocked some in the close-knit world of computer security experts. The company had a long history of championing privacy and security, and it played a leading role in blocking a 1990s effort by the NSA to require a special chip to enable spying on a wide range of computer and communications products.
RSA, now a subsidiary of computer storage giant EMC Corp, urged customers to stop using the NSA formula after the Snowden disclosures revealed its weakness.
RSA and EMC declined to answer questions for this story, but RSA said in a statement: "RSA always acts in the best interest of its customers and under no circumstances does RSA design or enable any back doors in our products. Decisions about the features and functionality of RSA products are our own."
The NSA declined to comment.
The RSA deal shows one way the NSA carried out what Snowden's documents describe as a key strategy for enhancing surveillance: the systematic erosion of security tools. NSA documents released in recent months called for using "commercial relationships" to advance that goal, but did not name any security companies as collaborators.
The NSA came under attack this week in a landmark report from a White House panel appointed to review U.S. surveillance policy. The panel noted that "encryption is an essential basis for trust on the Internet," and called for a halt to any NSA efforts to undermine it.
Most of the dozen current and former RSA employees interviewed said that the company erred in agreeing to such a contract, and many cited RSA's corporate evolution away from pure cryptography products as one of the reasons it occurred.
But several said that RSA also was misled by government officials, who portrayed the formula as a secure technological advance.
"They did not show their true hand," one person briefed on the deal said of the NSA, asserting that government officials did not let on that they knew how to break the encryption.
I'm sure it will internationallyjonessed said:A lot of companies use RSA keys for encryption. I wonder if this revelation is going to cause a major dent in their business. .Statorama said:The RSA and NSA connection
SAN FRANCISCO (Reuters) - As a key part of a campaign to embed encryption software that it could crack into widely used computer products, the U.S. National Security Agency arranged a secret $10 million contract with RSA, one of the most influential firms in the computer security industry, Reuters has learned.
Documents leaked by former NSA contractor Edward Snowden show that the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products, the New York Times reported in September. Reuters later reported that RSA became the most important distributor of that formula by rolling it into a software tool called Bsafe that is used to enhance security in personal computers and many other products.
Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract. Although that sum might seem paltry, it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year, securities filings show.
The earlier disclosures of RSA's entanglement with the NSA already had shocked some in the close-knit world of computer security experts. The company had a long history of championing privacy and security, and it played a leading role in blocking a 1990s effort by the NSA to require a special chip to enable spying on a wide range of computer and communications products.
RSA, now a subsidiary of computer storage giant EMC Corp, urged customers to stop using the NSA formula after the Snowden disclosures revealed its weakness.
RSA and EMC declined to answer questions for this story, but RSA said in a statement: "RSA always acts in the best interest of its customers and under no circumstances does RSA design or enable any back doors in our products. Decisions about the features and functionality of RSA products are our own."
The NSA declined to comment.
The RSA deal shows one way the NSA carried out what Snowden's documents describe as a key strategy for enhancing surveillance: the systematic erosion of security tools. NSA documents released in recent months called for using "commercial relationships" to advance that goal, but did not name any security companies as collaborators.
The NSA came under attack this week in a landmark report from a White House panel appointed to review U.S. surveillance policy. The panel noted that "encryption is an essential basis for trust on the Internet," and called for a halt to any NSA efforts to undermine it.
Most of the dozen current and former RSA employees interviewed said that the company erred in agreeing to such a contract, and many cited RSA's corporate evolution away from pure cryptography products as one of the reasons it occurred.
But several said that RSA also was misled by government officials, who portrayed the formula as a secure technological advance.
"They did not show their true hand," one person briefed on the deal said of the NSA, asserting that government officials did not let on that they knew how to break the encryption.
It certainly should. When my company goes to token-based security in the near future, I'm going to have a hard time recommending RSA if this turns out to be true.I'm sure it will internationallyjonessed said:A lot of companies use RSA keys for encryption. I wonder if this revelation is going to cause a major dent in their business. .Statorama said:The RSA and NSA connection
SAN FRANCISCO (Reuters) - As a key part of a campaign to embed encryption software that it could crack into widely used computer products, the U.S. National Security Agency arranged a secret $10 million contract with RSA, one of the most influential firms in the computer security industry, Reuters has learned.
Documents leaked by former NSA contractor Edward Snowden show that the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products, the New York Times reported in September. Reuters later reported that RSA became the most important distributor of that formula by rolling it into a software tool called Bsafe that is used to enhance security in personal computers and many other products.
Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract. Although that sum might seem paltry, it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year, securities filings show.
The earlier disclosures of RSA's entanglement with the NSA already had shocked some in the close-knit world of computer security experts. The company had a long history of championing privacy and security, and it played a leading role in blocking a 1990s effort by the NSA to require a special chip to enable spying on a wide range of computer and communications products.
RSA, now a subsidiary of computer storage giant EMC Corp, urged customers to stop using the NSA formula after the Snowden disclosures revealed its weakness.
RSA and EMC declined to answer questions for this story, but RSA said in a statement: "RSA always acts in the best interest of its customers and under no circumstances does RSA design or enable any back doors in our products. Decisions about the features and functionality of RSA products are our own."
The NSA declined to comment.
The RSA deal shows one way the NSA carried out what Snowden's documents describe as a key strategy for enhancing surveillance: the systematic erosion of security tools. NSA documents released in recent months called for using "commercial relationships" to advance that goal, but did not name any security companies as collaborators.
The NSA came under attack this week in a landmark report from a White House panel appointed to review U.S. surveillance policy. The panel noted that "encryption is an essential basis for trust on the Internet," and called for a halt to any NSA efforts to undermine it.
Most of the dozen current and former RSA employees interviewed said that the company erred in agreeing to such a contract, and many cited RSA's corporate evolution away from pure cryptography products as one of the reasons it occurred.
But several said that RSA also was misled by government officials, who portrayed the formula as a secure technological advance.
"They did not show their true hand," one person briefed on the deal said of the NSA, asserting that government officials did not let on that they knew how to break the encryption.
Slapdash was not questioning what you meant. He was questioning why you think that it is us that needs to remember what the discussion is about. It is YOU that needs to remember we're discussing this in reality.My argument is meant to be theoretical. In real, practical terms, what I just proposed seems to fall apart in its execution.Uh....what?Now please remember we're discussing this only theoretically:
As usual, I completely disagree with you. However the NSA appears to be abusing their power, the collection of mass data is not going away. Given the advancing technology, it's going to happen again and again in the coming decades, and I believe it's a necessary tool of security, especially if terrorism continues (as, given the worlds economic conditions, it likely will). The debate we had in this thread was important and it will be made over and over in the years to come. Though I was not the best at presenting my "side", I predict others will do it much better in the future.Slapdash was not questioning what you meant. He was questioning why you think that it is us that needs to remember what the discussion is about. It is YOU that needs to remember we're discussing this in reality.This thread is filled with much evidence of what is occurring in reality. Your hundreds of posts in this thread of a theoretical argument are nothing but annoying noise to those of us discussing what is actually happening. The fact that you recognize that your theory falls apart in execution just shows what a waste your posts have been to this thread.My argument is meant to be theoretical. In real, practical terms, what I just proposed seems to fall apart in its execution.Uh....what?Now please remember we're discussing this only theoretically:
Given that this debate is so important - why do you think our government is still treating Snowden as a criminal as opposed to a hero? And why isn't Clapper indicted?The debate we had in this thread was important and it will be made over and over in the years to come. Though I was not the best at presenting my "side", I predict others will do it much better in the future.
Well... DUH!As usual, I completely disagree with you. However the NSA appears to be abusing their powerSlapdash was not questioning what you meant. He was questioning why you think that it is us that needs to remember what the discussion is about. It is YOU that needs to remember we're discussing this in reality.This thread is filled with much evidence of what is occurring in reality. Your hundreds of posts in this thread of a theoretical argument are nothing but annoying noise to those of us discussing what is actually happening. The fact that you recognize that your theory falls apart in execution just shows what a waste your posts have been to this thread.My argument is meant to be theoretical. In real, practical terms, what I just proposed seems to fall apart in its execution.Uh....what?Now please remember we're discussing this only theoretically:
Thank you Mr Snowden.Given that this debate is so important - why do you think our government is still treating Snowden as a criminal as opposed to a hero? And why isn't Clapper indicted?The debate we had in this thread was important and it will be made over and over in the years to come. Though I was not the best at presenting my "side", I predict others will do it much better in the future.
Without Snowden, we aren't having this debate.