Sophos Cloud Optix
The only thing US surveillance needs to read the contents of your email, with no prior authorization whatsoever, is your email address.
The only thing US surveillance needs to read your private Facebook chat or private messages is your user name and a date range.
In fact, according to newly revealed documents given to The Guardian by Edward Snowden, one program, called XKeyscore, enables the National Security Agency (NSA) to see “nearly everything a user does on the internet”.
The NSA’s training materials boast about XKeyscore being its “widest-reaching” system for squeezing intelligence from the internet, The Guardian reported on Wednesday.
On that same day, senior US intelligence officials testified to the Senate judiciary committee amidst the raging debate over mass surveillance.
The Guardian once again turned to documents revealed by whistleblower Edward Snowden to detail XKeyscore.
Those documents depict how XKeyscore allows NSA analysts to search, with no prior authorization, through vast databases of emails, online chats and browsing histories of millions of individuals.
In early June, The Guardian had revealed that the NSA collects telephone records of millions of Verizon’s US customers under a top-secret order issued on April 25 by the secret Foreign Intelligence Surveillance Court (FISA) to the Federal Bureau of Investigation (FBI).
In alerting the media regarding the phone records collection, amidst other things, Snowden in early June had made statements—published by The Guardian in this video interview—that initially sparked controversy but which have now been illuminated by the newly revealed documents.
To wit:
"Any analyst at any time can target anyone [depending on an agent's authorities]... I, sitting at my desk, certainly had the authorities to wiretap anyone, from you or your accountant, to a federal judge to even the president, if I had a personal email".
At the time, US officials vehemently denied that claim.
Mike Rogers, the Republican chairman of the House intelligence committee, said this of Snowden’s assertion:
"He's lying. It's impossible for him to do what he was saying he could do."
The Guardian’s account of the Xkeyscore program, if it bears out, would prove that Snowden most certainly was not lying.
While US law requires the NSA to obtain a Fisa warrant to target a “US person”, no such warrant is necessary for intercepting communications between Americans and foreign surveillance targets.
But regardless of legal authority, Xkeyscore puts a dead simple interface in front of analysts that gives them the technology to enable the type of wiretapping Snowden describes, if not the legal authority.
The only thing the analysts needs, The Guardian reports, is identifying information such as an email address or an IP address.
Beyond email or IP address, the documents show that intelligence analysts can search by name, telephone number, keywords, the language in which the internet activity was conducted, or the type of browser used.
The Guardian describes one slide from a 2012 document entitled “plug-ins” that details the various fields of information that can be searched.
From The Guardian:
[The slide] includes 'every email address seen in a session by both username and domain', 'every phone number seen in a session (eg address book entries or signature block)' and user activity – 'the webmail and chat activity to include username, buddylist, machine specific cookies etc'."
The program can search within email bodies, webpages and documents, including the “To, From, CC, BCC lines” and the ‘Contact Us’ pages on websites”.
Beyond email, analysts can search HTTP activity by keyword, which gives its analysts what the NSA calls “nearly everything a typical user does on the internet”, whether it’s searching terms on Wikipedia, interacting on Facebook or Twitter, or reading the news on CNN.
The amounts of data collected by the NSA with this program is “staggeringly large”, The Guardian says.
In fact, XKeyscore is continually engorged by ongoing data collection to such an extent that it can only be stored for a brief time: three to five days, with metadata staying around for 30 days. The documents claim that at some sites, the amount of data collected per day—20+ terabytes—can only be stored for as little as 24 hours.
One slide shows the agency’s method for handling it all: a multitiered system of four separate programs, with one each dedicated to storing metadata, “content selected from dictionary tasked items,” user activity metadata, and “unique data from beyond user activity from front end full take feeds”.
It is this last subset that is by far the largest, and it is stored in XKeyscore. The Guardian reports that in 2012, there were at least 41 billion total records collected and stored in XKeyscore for a single 30-day period.
In response to revelations about XKeyscore, the NSA told The Guardian that its activities are “focused and specifically deployed against—and only against—legitimate foreign intelligence targets in response to requirements that our leaders need for information necessary to protect our nation and its interests.”
Its statement continues:
"XKeyscore is used as a part of NSA's lawful foreign signals intelligence collection system.
"Allegations of widespread, unchecked analyst access to NSA collection data are simply not true. Access to XKeyscore, as well as all of NSA's analytic tools, is limited to only those personnel who require access for their assigned tasks … In addition, there are multiple technical, manual and supervisory checks and balances within the system to prevent deliberate misuse from occurring."
"Every search by an NSA analyst is fully auditable, to ensure that they are proper and within the law.
"These types of programs allow us to collect the information that enables us to perform our missions successfully – to defend the nation and to protect US and allied troops abroad."
Snowden, when interviewed by The Guardian in June, portrayed those limitations and that oversight as, basically, window dressing.
He said:
"It's very rare to be questioned on our searches... and even when we are, it's usually along the lines of: 'let's bulk up the justification'."
What do you think?
Are we sick of PRISM yet, or do we still have room for outrage?
UPDATE: Criticism has immediately greeted the XKeyscore revelations.
Writing for The Week, US journalist Marc Ambinder claims that The Guardian’s Glenn Greenwald misunderstood the function and the power of the tool.
Ambinder says XKeyscore is not top-secret, though collection of bulk data is perhaps classified.
Furthermore, he says, XKeyscore is not used for surveillance, and is, rather, simply a search tool for NSA databases that hold data collected through other means.
He writes:
I quibble with the Guardian's description of the program as "TOP SECRET." The word is not secret; its association with the NSA is not secret; that the NSA collects bulk data on foreign targets is, well, probably classified, but at the SECRET level. Certainly, work product associated with XKEYSCORE is Top Secret with several added caveats. Just as the Guardian might be accused of over-hyping the clear and present danger associated with this particular program, critics will reflexively overstate the harm that its disclosure would reasonably produce.
The NSA, for its part, has put out an unsurprisingly “nothing to see here, folks” press release about XKeyscore.
Some commenters are deeming Snowden hyperbolic.
Others have put out a potentially helpful guide (or opinionated spin, depending on your take) to translating the NSA’s legalistic declarations.
If there really is nothing to see here, folks, my apologies for swallowing The Guardian’s interpretation of XKeyscore.
Your thoughts, as always, are welcome in the comments below.
Image of Email icon in opened envelope courtesy of Shutterstock.
O U T R A G E!
It's best to be cynical.
How does such a program exist? Wouldn't the services need to work with the creator of the program to hash out API's, database design/layout, password management? It seems as though there's a large piece not being discussed.
Absolutely staggering – and almost unimaginable. The hubris of the US government is hard to comprehend. Every time they lie to the public, more information is released to expose the lie.
What can the public do about it? No matter who we vote for this kind of thing keeps occurring. All politicians are greedy, unscrupulous traitors who want to monitor us and mine our information for profit (financial or political). The only alternative to big government is small government or Anarchy. History shows that big governments never get smaller and big governments are better than Anarchy (or so I'm told).
Ok, please correct me if I'm wrong, but the NSA has taken FireSheep to a whole new level, and stuck databases behind it?
Firesheep, or more broadly a packet sniffer, captures data as it moves through a network and can easily be defeated by using encryption.
Most email traffic isn't encrypted so a Firesheep/Wireshark/Carnivore-a-like packet sniffer in the right places could certainly capture a lot of email for a system like this.
If it contains information that was encrypted on-the-wire such as content from Facebook or Gmail then something else must have been used.
This could be done by a man-in-the-middle attack if the NSA had access to the right encryption keys. It could also be done using backdoors to the applications and databases themselves – which is seemingly what PRISM does.
I would imagine a system like this is drawing data from a number of different sources and aggregating it.
A program like this requires active participation by service and content providers to work.
So ask yourself why the providers are willing to participate in something so highly unethical and illegal?
When the NSA doesn't get it's way, they call upon regulatory agencies (EPA, OSHA) or the IRS, or the FTC to lean on the company they want cooperation from. A classic example of this is Joe Nacchino, CEO of Qwest, who is still in prison today on "insider trading" charges for refusing to play ball with the NSA (http://www.businessinsider.com/the-story-of-joseph-nacchio-and-the-nsa-2013-6).
As it turns out, its really easy for a large company to turn a blind eye and let the NSA do their thing than to weather out the harassment from not playing ball.
US citizens are apparently spared the watchful eye of their nanny government. As a UK citizen (which is APPARENTLY independent(!)) Why am I automatically treated as a suspect? In fact why does anyone in the world that is not an American automatically get treated as a potential terrorist?
This PRISM thing should certainly be challenged at the very least. It rocks the foundations of a (so called) FREE society.
Apparently all this is in the name of protecting our freedoms? How incredibly ironic.
PRISM, NSA is indeed outrageous.
The events of 9/11 have driven this country to wretched excess. OBL would love to see his effects on our liberties.
Oh, and we are definitely not spared the watchful eyes of our gov't.
What if what they
really want is for us to herd our children into stadiums like were
doing? And put soldiers on the street and have Americans looking
over their shoulders? Bend the law, shred the Constitution just a
little bit? Because if we torture him, General, we do that and
everything we have fought, and bled, and died for is over. And
theyve won. Theyve already won!
first.. scared me to enter my email above.
second. and osama was able to go undetected all by himself?
thirdly. I want one.
Homeland Security/NSA/??? have installed splitters on internet communications at major USA telecom companies like AT&T for years now. Obama/Bush have pardoned the key corporate players already. Obviously, request headers/bodies are being stored for ALL transactions and eventually the response body is deleted to make space if it doesn't include certain keywords. The authorities state something like an IP address would be required for a search… which would tell us where the user's requests are coming from and could be built into the system so as to prevent any -searches- on domestic information.
I see six comments in six hours. If that is any indication of the level of outrage against these programs I'm losing all hope.
People, this is a mind-blowingly huge invasion of the privacy of people the world over. It IS an American problem but it's NOT JUST an American problem; it's an indication that the most basic underlying values of the most technically powerful nation in the world have been systematically and secretly undermined such that virtually the entire Internet can be sniffed, indexed and data-mined by one government — without the understanding of its people or anyone anywhere else.
The American Constitution has been trampled. That is undeniable. But I'm not seeing anything like the anger I'd expect to see here in the US.
And the security of everyone else in the world is being utterly disregarded. Where is the noise? Yes, I'm outraged. Many of the people in my profession of Information Security are outraged. But beyond that I see so much lethargy that I quite simply cannot comprehend it.
Call your elected officials. Petition. Spread the word. Make noise! I can't think of any other single issue in our time that matters more than this.
If that's how you feel I hope you didn't read this: http://nakedsecurity.sophos.com/2013/07/29/prism-…
Michael, it seems that I, as an American, is also a target. It does seem unimaginable, but the proof is before us. It's too bad that the whistle blower is considered a traitor. I believe that some day he will be respected for the abuse he's taken to let the people know.
As an American, I feel like you, why are they targeting everyone?
Jack
First, ANYONE with ANY knowledge of the NSA before this whole thing blew up should NOT be surprised at this or any other (known previously unknown) capabilities of this organization. I read "The Puzzle Palace, Published: 1982 Author: James Bamford" in 1982 when I was in the military working in communications, and it actually cleared up a few things for me then… as I was actively involved, so fast-forward 25 years… what we're hearing about is not that surprising.
Where he (Snowden) says "…I, sitting at my desk, certainly had the authorities to wiretap anyone, from you or your accountant, to a federal judge to even the president, if I had a personal email". that would probably be false, I would say that he more than likely had the ABILITY, but the authority… that implies that he has do this thing before, as directed, and all indications are that he was a SYSAdmin… right?
These are the very reasons as to why I left Facebook, despite Facebook's denial of the activities of the NSA . This entire spying on people has become a joke, at which the governments of each democratic country, should take seriously and take international legal action against the USA, as the US is in breach of Privacy laws in each of those countries. The US must be held accountable in the international courts with fines that will prevent the US government from continuing it's spying policy.
It is one thing to spy on your own people but to do it to countries that have their own Privacy laws is another. Something must be done.
Here's my response to your concerns, at least regarding FB and other social media… all that it takes to understand what they will and will not do with information you provide to them is to read their Privacy StatementPolicy andor EULA… because those document do not explicitly say that they WILL NOT of DO NOT share the data you provide with third parties, however, most state that it THEY (social media) who will decide how that information is shared, dispersed or otherwise used… even on this blog you had to agree to "something"…
A few years back I wrote a paper for class, about the Privacy Policies and EULA's for social media sites… there was no way that I would agree to that… because of that policy I found it hard to even setup a fake profile at Facebook, and now they allow their sites to link between and to each other… no thanks.
You all cannot be this naive…. Who actually thought that a system created by the U.S. government (which has evolved to become the internet) for the sole purpose of enhancing military capabilities was not being recorded, documented, and ultimately controlled by the creators?
Even if you are/were that naive which would you rather have:
1. Some level of comfort knowing you can go to a theme park and not have it nuked by some terrorists (international or home grown)
2. keep your electronic communications be it email, phone, internet history 100% private.
Life is a trade-off. Freedom was never and will never be "free." All man-made benefits come at a cost some how, some way.
They can justify spying on any US citizen online because each of us may interact with the citizens of differing countries multiple times online. Often without even knowing about it. Just think, if they had a reason to bring you in for anything, they could cobble it together from the various things someone does online. Any rant could be used for any purpose. Most of us don’t want to live in a panopticon even if you don’t seem to mind.
First, ANYONE with ANY knowledge of the NSA before this whole thing blew up should NOT be surprised at this or any other (known previously unknown) capabilities of this organization. I read "The Puzzle Palace, Published: 1982 Author: James Bamford" in 1982 when I was in the military working in communications, and it actually cleared up a few things for me then… as I was actively involved, so fast-forward 25 years… what we're hearing about is not that surprising.
Where he (Snowden) says "…I, sitting at my desk, certainly had the authorities to wiretap anyone, from you or your accountant, to a federal judge to even the president, if I had a personal email". that would probably be false, I would say that he more than likely had the ABILITY, but the authority… that implies that he has do this thing before, as directed, and all indications are that he was a SYSAdmin… right?
I'm well beyond being outraged by anything of this sort. I have long since ceased having any trust in our government or any three-letter agencies spawned by it and I personally believe it is probably far worse than any of us suspect.
i have just blown up my bicycle tyre. record that and put me in jail you spying ^^^^^bags
Webnet is active,Skynet is coming. All hail our dear Ford.
Hi Lisa,
Regarding the objections I think there is plenty to see here.
I think the general tone of the objections – that there's nothing new here because it's just a database querying tool of the kind that any corporate database might have and it's the data gathering (PRISM) that's important is disingenuous.
That objection is a product of understanding software design; that an interface and an underlying database are generally de-coupled and are not the same thing. For the vast majority of our users the interface *is* the software, no matter if it's Word or XKeyscore, so conflating the interface and the database is probably an important part of helping people understand what's happening without boring them with unnecessary detail.
Most people are better at understanding things through examples and pictures than abstract descriptions. PRISM is an abstract description of pervasive data collection that most lay people seem already to have moved on from. XKeyscore is an illustration of its use and for that reason alone it's an impactful story. I understand the menace of PRISM but the XKeyscore story made my blood run cold in a way the PRISM story didn't for that reason alone.
The XKeyscore revelations contained information about the amount of information being collected (Terrabytes every day), how long it's stored and how it's archived which is detail about PRISM I'd not seen before.
The aforementioned data includes content, not just metadata. Most of it is archived to metadata but some is not. This contradicts what we have been told by official sources (remember Obama's "nobody's reading your email").
The XKeyscore interface had a text box called 'justification'. It looks a lot like you don't need a FISA warrant to sit in front of this thing.
And finally as somebody who isn't a US citizen I am not in the least bit moved by the fact that the USA says don't worry, we're not spying on our own.
"The documents claim that at some sites, the amount of data collected per day—20+ terabytes—can only be stored for as little as 24 hours."
Well now, that's interesting. Maybe we can fight them if we all get together. What if everybody with Internet access got together and sent 3 bogus emails daily. Really big ones. Store them in MS Word and copy them into your email program and send them 3 times a day. Somebody probably has a script that could do that automatically.
Or program them to be sent every 20 minutes that you are online. Imagine the government trying to snatch and archive all those emails around the globe if everybody was doing this. It would turn the government's brand new storage facility in Utah into an information garbage landfill overnight.