NSA vacuuming down Internet traffic

-----BEGIN PGP SIGNED MESSAGE-----

WRT:

    "...the same article had Madsen stating that the NSA is 
    vacuuming down Internet traffic. he gave the likely entry 
    points that they are doing this."

It's a virtual lead-pipe cinch that this is being done and
probably has been going on for longer than anyone would like to 
think.

In the 1960's - 1970's when international cable traffic was in 
its computer infancy, access was had to EVERY CABLE MESSAGE 
passing through the message switches of U.S. common carriers.
This means no only every international cable message originating 
from or destined to a U.S. point, but also included every message 
ROUTED THROUGH the U.S., such as Europe <--> South America. 

There was no great skullduggery involved -- the common carriers 
simply made copies of their own log tapes and handed them to 
messengers from the, ah, FCC (ahem). It was on the operations 
checklist and no one thought twice about it. It may be urban 
legend to some, but I've seen it with my own eyes, handled the 
tapes with my own hands. 

If anyone else wishes to move this from the status of urban 
legend to something more solid, all they have to do is locate and 
ask people who worked in message switch operations at RCA Global 
Communications, ITT World Communications, or Western Union 
International, the three common carriers of that time.

Knowing this, I would assume something similar was done at 
overseas locations of the same carriers and at such other access 
points as could be compromised. An organization such as NSA that 
viewed this as SOP would have to be brain dead not to be doing
the same thing with the Internet. The only question in my mind is 
how far they have gone beyond USENET and the newer, fertile 
ground of web sites. Are they vacuuming packets and reassembling 
email? Just how many laser discs have been filled with coherent 
traffic?

Time to exercise those plain, brown envelopes.


We Jurgar Din
(that will have to suffice: I do not yet live in a free country)

+"The battle, Sir, is not to the strong alone. It is to the+
+vigilant, the active, the brave. Besides, Sir, we have no +
+election. If we were base enough to desire it, it is now  +
+too late to retire from the contest." -Patrick Henry 1775 +


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQBVAwUBMP9XX0jw99YhtpnhAQEH1gH+KiIxJ3eXZCNGq5mG9UB1A68+TOLe9tCk
NG170tzIBtwjlXw09B83Oxx16WineBqlZ7NJJiRazssBpFqDnWEh4A==
=tUWW
-----END PGP SIGNATURE-----

If I were standing in one of the places where NSA has it's taps of the 
Net - what would I see? Alligator clips across terminal strips, leading 
to a bunch of T3 lines?

Is there any open source - or otherwise - knowledge or speculation about
which words/phrases the Terra-cycle cpu's are text-searching *for*?  If it
were your responsibility to eavesdrop on Iranian terrorists - or French
Commercial Attache reports to Paris - or to have UK nationals, off in
their private room of your building, write down the name of every in
America who expresses a libertarian dissatisfaction with the Republicrat
regime - would you know for sure which words/phrases to key on?   It 
doesn't sound like a tractable problem to me.

Of course, some people don't need to worry about the GAO doing their own 
evaluation of how well an agency is doing its assigned mission!

Alan Horowitz
alanh@norfolk.infi.net

Alan Horowitz asks ...
> 
> If I were standing in one of the places where NSA has it's taps of the 
> Net - what would I see? Alligator clips across terminal strips, leading 
> to a bunch of T3 lines?
> 

	I can't say I have a reliable answer to your question (although
I can say fairly confidently that it is unlikely to be done with alligator
clips at T3 and Sonet rates).

	In the past a good bit of this stuff was apparently done by
intercepting microwave tail circuits (such as on the older FDM type
undersea cables).  For some random reason all the traffic on the
undersea cable just happened to always be routed via a microwave link
(sometimes as a "backup" to a cable link sent to a satellite ground
station in case it had to carry the traffic if the cable failed).    
It is remarkable how many of the undersea cable terminals have microwave
links to the rest of the world.  

	Now with everything digital and almost always on fiber, one
would probably expect that the main Internet backbone Sonet or FDDI
rings have little diversions or bridges that feed undocumented fibers
going somewhere that nobody at the carriers quite knows where.  There is
a great deal of dark fiber installed (around the Beltway area
especially) for the spook agencies that was put in without any normal
cable records being kept by the carriers regarding where the fibers in
the bundle terminate or what they are used for or even where the actual
cables really go.  The amount of fiber going into some of the beltway
CIA sites is truly impressive (several major runs).

	The DACS digital crossconnect points (high speed space/time
division DS-1/DS-3 switches used for routing and and interconnecting digital
circuits from one fiber pipe to another) could certainly be programmed 
to route a copy of the traffic on some interesting backbone T3 line
out another port as well - and like all complex software driven devices
this capability could be covertly activated and controlled without notice to
the normal operators who certainly don't have source code or the 
expertise to vet it.

	As one might expect I've so far not met anyone at a carrier
who knows exactly where the NSA taps are, but other possibilities
certainly exist at repeater sites (where used) and even by optical
taps (bending the fiber to make it leak a little light) in some 
manhole somewhere.   And obviously buggering the firmware in central
routers to forward selected packets is available as a last ditch option.

						Dave

> Is there any open source - or otherwise - knowledge or speculation about
> which words/phrases the Terra-cycle cpu's are text-searching *for*?  If it
> were your responsibility to eavesdrop on Iranian terrorists - or French
> Commercial Attache reports to Paris - or to have UK nationals, off in
> their private room of your building, write down the name of every in
> America who expresses a libertarian dissatisfaction with the Republicrat
> regime - would you know for sure which words/phrases to key on?   It 
> doesn't sound like a tractable problem to me.

To me it does sound completely feasible (you don't need very good
accuracy).  I've personally run packet filters (for statistical
purposes only) on busy 10-mbit ethernets using BPF, FreeBSD, and 486
or pentium machines.  They easily keep up with little packet loss.

I understand T3 is 34 mbits, so only three times faster.  No problem
to optimize that much by specially written software, especially if you
can do some of the low level stuff in hardware.

As for the keyword search problem, it would easily be possible to scan
much of the data (say, tcp ports smtp, nntp, login, exec, ident) in
real time against a million-phrase dictionary (containing keywords,
e-mail addresses, names, abbreviations, etc.).  If there are
performance problems, you can first limit by
source/destination/protocol/port.  Only intercepts (e.g., entire tcp
connections) that pass this initial screening are passed on to other
machines for more complicated analysis.

Note also that many parts of the filtering problem parallelize quite
nicely.  For example, you can split the traffic to a number of
machines based on the value of the numerically smaller of the
source/destination addresses.

I don't see any technical problems in doing large-scale internet
monitoring.  The equipment needed is even cheap enought to be done by
motivated amateurs/individuals, assuming they can get a copy of the
raw data from the T3.

This is one of the reasons why strongly encrypting internet data is so
important.

    Tatu

See http://www.cs.hut.fi/ssh for information on SSH, the secure remote
login program.

See http://www.cs.hut.fi/crypto for information cryptography available
to anyone worldwide.