I've been an active "UNIX geek" for 20 years, working professionally in that capacity for 17.  Though I'm no Richard McDougall, I have a good general knowledge of how Internet services like Facebook and Google's are put together.  While those companies reserve a lot of "secret sauce" to maintain a competitive edge, one thing an IT engineer learns early on is the same building blocks are used over and over.  Some of the key technologies we rely on -- networking, the GUI, virtualization -- trace their origins back decades.

We know that PRISM was intended to make more efficient the transfer of data under investigation -- the NSA PowerPoint says as much.  Assume for the sake of argument that before PRISM, the NSA followed a process by which it legally requested data from a social media company, and that company's techs manually bundled the data and deposited it in a secure, mutually-agreed-upon "dropbox" for retrieval.

Each of these scenarios might speed that sort of thing up.

"Direct Access" Example 1: The SSH/SCP Relationship

Facebook and the government might negotiate to set up a Linux server on a DMZ -- a narrow-purpose network walled off by firewalls -- to act as a depository for requested data.  Facebook grants limited access to the depository via SSH -- an encrypted "secure shell" that enables the use of a file copy program, SCP, to retrieve the data.  The government makes a request; the request undergoes all the necessary review; and then Facebook furnishes the least data consistent with the law for retrieval.  The government "accesses" the DMZ depository for the sole purpose of retrieving the circumscribed data.

"Direct Access" Example 2: HTTPS/REST and Web Services

HTTP is the protocol that drives the web; HTTPS is HTTP over an encrypted channel.  REST -- Representational State Transfer -- is an architectural approach introduced by one of the inventors of HTTP.  Basically REST presents a model by which services on the web -- that is, applications provided by web servers -- can interact programmatically.  These services often interact through what is generically called an API -- Application Programming Interface.

For example, an online tax preparation service might want to import information -- say, your W2 -- from your bank, and export information - your completed tax forms -- to the government.  It might use APIs to connect its web service to those of banks and the IRS.  Using HTTPS for this is desirable because it is an extremely common protocol that is secure, easy-to-use and firewall-friendly.

The government and, say, Google could have negotiated a means by which one or more government servers, existing outside of Google's network, could use an HTTPS/REST web interface to legally request and obtain data.  Both the government and Google might ask engineers to build web interfaces to execute this process.  On the government side, engineers could build an interface in PRISM.  The request and data transactions would take place in encrypted tunnels.  General searches would not be permitted.  As in Example 1, neither FISC nor corporate review is bypassed, and the data presented is as limited as is consistent with the law.

"Direct Access" Example 3: The Mirror Server

Some of the social media giants warehouse data that can be arranged in standard formats.  The email in Google's Gmail is probably the best example.  As thoroughly commonplace data, it is easy to bundle up and transfer.  Other data the government might request, such as that contained in Facebook accounts, might be arranged in unique formats that could be difficult to move outside of the native environment of Facebook itself.

In order to surmount the difficulty of delivering proprietary data to the government, Facebook could arrange to install a "mirror server" in a DMZ that the government could access.  A "mirror server" is a replica of a main server, usually meant to expand the ability to deliver files or services.  The mirror server could be linked to the Facebook grid through a firewall and retrieve highly circumscribed data in response to lawful government requests.  The server would not be able to access the rest of the Facebook application.  It would not reside on Facebook's network.  It would not allow general searches.  It would receive only what Facebook sent it -- as little data as is consistent with the law, after legal and corporate review.

So, pretend that a mark in Pakistan is communicating with a mark in New York City.  The government obtains a FISA warrant to snoop their Facebook communications.  Facebook receives the lawful request and reviews it.  If it decides to comply, Facebook techs "replicate" the account data of the marks and all of their relevant associates into the mirror server.  The government views it as needed.  When the investigation concludes, the replication stops.

Edward Snowden's main tout, Glenn Greenwald, is threatening to publish more leaked material.  So we can't be sure where this dirigible will crash.  However, lurid claims of government infiltration of social media giants are unsupported by the documents leaked so far.  It is journalistic malpractice to sex up the PRISM revelation with the unqualified jargon "direct access".  It leaves far too much open to interpretation, not least by reporters themselves.

While there have been pieces that have questioned the technical substance of the initial PRISM reports, it is extraordinary that such a profound scoop remains unscrutinized by IT experts.  Has no one realized that a PowerPoint presentation, featuring click-and-save logos and clip art of leprechauns, might not be the strongest foundation on which to rest a major technical scoop?  Snowden worked as some kind of systems administrator, but there are a lot of poseurs in technology.  The quality of IT engineers ranges wildly.  Has no one realized that Snowden, who has warned that "they quite literally can watch your ideas form as you type," might be just the rube for whom such a PowerPoint was intended?

By Unknown (11:43 AM) | View Comments | |
digg this | newsvine | reddit | del.icio.us | stumble it