Mail Watch

[Formaldehyde]

Yes, the NSA has definitively stated that they need more than the entire world's GDP worth of storage capacity.

Nope. That is your own hyperbole with no actual basis in fact.

Fox News:

This top-secret data warehouse could hold as many as 1.25 million 4-terabyte hard drives, built into some 5,000 servers to store the trillions upon trillions of ones and zeroes that make up your digital fingerprint.

NPR

The estimated power of those computing resources in Utah is so massive it requires use of a little-known unit of storage space: the zettabyte. Cisco quantifies a zettabyte as the amount of data that would fill 250 billion DVDs.

The NSA's Utah Data Center will be able to handle and process five zettabytes of data, according to William Binney, a former NSA technical director turned whistleblower. Binney's calculation is an estimate. An NSA spokeswoman says the actual data capacity of the center is classified.

Business Insider:

But given the fact the NSA already reportedly intercepts 1.7 billion American electronic records and communications a day, it makes sense that they would need to expand operations beyond its sprawling headquarters at Fort Meade, Maryland.

Here's James Bamford of Wired, author of the book "The Shadow Factory: The NSA from 9/11 to the Eavesdropping on America":

"Once it's operational, the Utah Data Center will become, in effect, the NSA cloud. The center will be fed data from the agency's eavesdropping satellites, overseas listening posts, and secret monitoring rooms in telecom facilities throughout the U.S."

Reams of data will be handled by NSA hackers — who harvest 2.1 million gigabytes of data per hour — and they'll get help from the most powerful computer the world has ever known.

That machine, the Titan Supercomputer, is capable of churning through more than 20,000 trillion calculations each second or 20 petaflops. (1 petaflop = 1 quadrillion instructions per second).

The Guardian:

A spokesperson at NSA headquarters in Maryland did not welcome a Guardian request to visit its western outpost. "That is a secure facility. If you trespass on federal property security guards will be obliged to do their jobs." An interview was out of the question.

Welcome to the Utah Data Center, a new home for the NSA's exponentially expanding information trove. The $1.7bn facility, two years in the making, will soon host supercomputers to store gargantuan quantities of data from emails, phone calls, Google searches and other sources. Sited on an unused swath of the national guard base, by September it will employ around 200 technicians, span 1m sq ft and use 65 megawatts of power.

Outside experts disagreed on the centre's potential. Some said it will just store data. Others envisaged a capacity to not just store but analyse and break codes, enabling technicians here to potentially snoop on the entire population for decades to come.

William Binney, a mathematician who worked at the NSA for almost 40 years and helped automate its worldwide eavesdropping, said Utah's computers could store data at the rate of 20 terabytes – the equivalent of the Library of Congress – per minute. "Technically it's not that complicated. You just need to work out an indexing scheme to order it."

Binney, who left the agency in 2001 and blew the whistle on its domestic spying, said the centre could absorb and store data for "hundreds of years" and allow agencies such as the FBI to retroactively use the information.

A rack of servers the size of a fridge can store 100 TV channels' annual output, said Kahle. "What's slow to dawn on people is that this level of surveillance is technologically and economically within our grasp."

"The intelligence people I've spoken are warning of data crunch – a polite way of saying they're drowning. They say they don't have enough capacity and will be back to Congress looking for more money to expand." If so the site can do so. "It's designed to be modular, you can add clip-ons. There is plenty of land."

But you are already simply ignoring the facts presented in the Wired article, so I imagine you will continue to do the same no matter how many hundreds of sources have stated essentially the same thing.

 

[Zelig]

Fox News: Yes, 1.25 million of those drives would put them at 0.005 zettabytes, or .1% of the 5 zettabyte total.

NPR: Binney's estimate is impossible, there's nothing supporting the 5 zettabyte figure as being remotely realistic for the present.

BI: Yes, the Titan is pretty fast, about half the speed of the fastest Chinese supercomputer, I've never debated that the NSA has stuff that's about as fast as everyone else.

The Guardian: They just talk throughput, 20 TB of throughput locally is nothing special, and is meaningless without further context.

You haven't linked a single source other than some random dude who clearly has no grasp on the technical realities of the situation suggesting that the 5 zettabyte figure is at all in the realm of possibility.

You've also done nothing to address any one of my points about how 5 zettabytes would require far more budget, power, and space than is present in the Utah center, in the United States, and probably in the entire world.


Even if all the data was offline on high-density tapes, and all the buildings labelled for administration were actually used for simply storing tapes, they still wouldn't have enough storage space for 5ZB worth of tapes.

 

[Formaldehyde]

Granted, the zettabyte "leak" is quite inconceivable using known existing disk technology.

But the points you keep missing are these.

1) I was merely reposting what others have stated. These are not opinions I have conceived myself. Yet you continue to deliberately misconstrue them as though they are.

2) We have no idea what sort of technology the NSA is using in their new data center, much less the other existing ones. They may very well have a completely different super-secret method to store vastly more data including sophisticated compression schemes and elaborate algorithms to only store a critical subset of the data online. You are assuming they are using conventional off-the-shelf disk drive technology.

For all we know, they may have even trained legions of monkeys to place a vast library of a nearly inconceivable number of DVDs into hundreds of thousands of $20 retail DVD drives upon request. Or they could have built staggeringly large DVD carousel players housed in vast underground silos if they didn't want to have to deal with all the monkey poop.

The NSA has a vast super-secret budget. They have historically been leaps and bounds ahead of conventional technology. You just engaged in absurd speculation yourself by apparently thinking that Titan is the super-secret next generation computer now being used by the NSA when it is clearly nothing of the sort. It was publicly built by Cray to do basic scientific research, and it really has nothing at all to do with what the NSA is secretly building to be able to crack AES.

What we do know is that they are now intercepting all internet traffic in the US and likely the world. And they plan to have much of it available online to data mine.

 

[Zelig]

The NSA budget is classified, but it's still all rolled into the overall intelligence budget. They don't suddenly have a secret $500 billion per year to play with.

They could have secret magic alien technology, but it's not really worth talking about. Iran could have secret piles of thousands of nuclear ICMBs. India could have secretly developed a cure for cancer. I might have a secret FTL drive in my garage.

I've never speculated about Titan being any sort of super secret next generation computer, I don't know where you got that idea. And again, there's nothing credible indicating that anybody is remotely close to cracking AES. That is absurd speculation.

It's simply impossible for the NSA to intercept all the world's internet traffic, there's loads of internet traffic that goes from China to China, never passing through non-Chinese computers.

 

[Formaldehyde]

More evidence that the "absurd speculation" that the NSA hasn't already likely cracked at least 128 bit AES and SSL has already occurred, and that 256 bit AES will soon follow if it hasn't already.

That it has the right to store ANY encrypted communication whether it is foreign or domestic.

That there is no "need to know" when it comes to their true capabilities regarding decryption capabilities, which is known by only a handful of people.

That it has covertly worked to make AES as easy to break as possible.

That it spends over $250M per year creating back doors into various commercial products to be able to spy on the data prior to being encrypted.

NY Times: N.S.A. Able to Foil Basic Safeguards of Privacy on Web

The National Security Agency is winning its long-running secret war on encryption, using supercomputers, technical trickery, court orders and behind-the-scenes persuasion to undermine the major tools protecting the privacy of everyday communications in the Internet age, according to newly disclosed documents.

The agency has circumvented or cracked much of the encryption, or digital scrambling, that guards global commerce and banking systems, protects sensitive data like trade secrets and medical records, and automatically secures the e-mails, Web searches, Internet chats and phone calls of Americans and others around the world, the documents show.

Many users assume — or have been assured by Internet companies — that their data is safe from prying eyes, including those of the government, and the N.S.A. wants to keep it that way. The agency treats its recent successes in deciphering protected information as among its most closely guarded secrets, restricted to those cleared for a highly classified program code-named Bullrun, according to the documents, provided by Edward J. Snowden, the former N.S.A. contractor.

Beginning in 2000, as encryption tools were gradually blanketing the Web, the N.S.A. invested billions of dollars in a clandestine campaign to preserve its ability to eavesdrop. Having lost a public battle in the 1990s to insert its own “back door” in all encryption, it set out to accomplish the same goal by stealth.

The agency, according to the documents and interviews with industry officials, deployed custom-built, superfast computers to break codes, and began collaborating with technology companies in the United States and abroad to build entry points into their products. The documents do not identify which companies have participated.

The N.S.A. hacked into target computers to snare messages before they were encrypted. In some cases, companies say they were coerced by the government into handing over their master encryption keys or building in a back door. And the agency used its influence as the world’s most experienced code maker to covertly introduce weaknesses into the encryption standards followed by hardware and software developers around the world.

“For the past decade, N.S.A. has led an aggressive, multipronged effort to break widely used Internet encryption technologies,” said a 2010 memo describing a briefing about N.S.A. accomplishments for employees of its British counterpart, Government Communications Headquarters, or GCHQ. “Cryptanalytic capabilities are now coming online. Vast amounts of encrypted Internet data which have up till now been discarded are now exploitable.”

When the British analysts, who often work side by side with N.S.A. officers, were first told about the program, another memo said, “those not already briefed were gobsmacked!”

The agency’s success in defeating many of the privacy protections offered by encryption does not change the rules that prohibit the deliberate targeting of Americans’ e-mails or phone calls without a warrant. But it shows that the agency, which was sharply rebuked by a federal judge in 2011 for violating the rules and misleading the Foreign Intelligence Surveillance Court, cannot necessarily be restrained by privacy technology. N.S.A. rules permit the agency to store any encrypted communication, domestic or foreign, for as long as the agency is trying to decrypt it or analyze its technical features.

Some of the agency’s most intensive efforts have focused on the encryption in universal use in the United States, including Secure Sockets Layer, or SSL; virtual private networks, or VPNs; and the protection used on fourth-generation, or 4G, smartphones. Many Americans, often without realizing it, rely on such protection every time they send an e-mail, buy something online, consult with colleagues via their company’s computer network, or use a phone or a tablet on a 4G network.

Paul Kocher, a leading cryptographer who helped design the SSL protocol, recalled how the N.S.A. lost the heated national debate in the 1990s about inserting into all encryption a government back door called the Clipper Chip.

“And they went and did it anyway, without telling anyone,” Mr. Kocher said. He said he understood the agency’s mission but was concerned about the danger of allowing it unbridled access to private information.

“The intelligence community has worried about ‘going dark’ forever, but today they are conducting instant, total invasion of privacy with limited effort,” he said. “This is the golden age of spying.”

The full extent of the N.S.A.’s decoding capabilities is known only to a limited group of top analysts from the so-called Five Eyes: the N.S.A. and its counterparts in Britain, Canada, Australia and New Zealand. Only they are cleared for the Bullrun program, the successor to one called Manassas — both names of an American Civil War battle. A parallel GCHQ counterencryption program is called Edgehill, named for the first battle of the English Civil War of the 17th century.

Unlike some classified information that can be parceled out on a strict “need to know” basis, one document makes clear that with Bullrun, “there will be NO ‘need to know.’ ”

According to an intelligence budget document leaked by Mr. Snowden, the N.S.A. spends more than $250 million a year on its Sigint Enabling Project, which “actively engages the U.S. and foreign IT industries to covertly influence and/or overtly leverage their commercial products’ designs” to make them “exploitable.” Sigint is the acronym for signals intelligence, the technical term for electronic eavesdropping.

By this year, the Sigint Enabling Project had found ways inside some of the encryption chips that scramble information for businesses and governments, either by working with chipmakers to insert back doors or by exploiting security flaws, according to the documents. The agency also expected to gain full unencrypted access to an unnamed major Internet phone call and text service; to a Middle Eastern Internet service; and to the communications of three foreign governments.

In one case, after the government learned that a foreign intelligence target had ordered new computer hardware, the American manufacturer agreed to insert a back door into the product before it was shipped, someone familiar with the request told The Times.

The 2013 N.S.A. budget request highlights “partnerships with major telecommunications carriers to shape the global network to benefit other collection accesses” — that is, to allow more eavesdropping.

At Microsoft, as The Guardian has reported, the N.S.A. worked with company officials to get pre-encryption access to Microsoft’s most popular services, including Outlook e-mail, Skype Internet phone calls and chats, and SkyDrive, the company’s cloud storage service.

N.S.A. documents show that the agency maintains an internal database of encryption keys for specific commercial products, called a Key Provisioning Service, which can automatically decode many messages. If the necessary key is not in the collection, a request goes to the separate Key Recovery Service, which tries to obtain it.

How keys are acquired is shrouded in secrecy, but independent cryptographers say many are probably collected by hacking into companies’ computer servers, where they are stored. To keep such methods secret, the N.S.A. shares decrypted messages with other agencies only if the keys could have been acquired through legal means. “Approval to release to non-Sigint agencies,” a GCHQ document says, “will depend on there being a proven non-Sigint method of acquiring keys.”

Simultaneously, the N.S.A. has been deliberately weakening the international encryption standards adopted by developers. One goal in the agency’s 2013 budget request was to “influence policies, standards and specifications for commercial public key technologies,” the most common encryption method.

Cryptographers have long suspected that the agency planted vulnerabilities in a standard adopted in 2006 by the National Institute of Standards and Technology and later by the International Organization for Standardization, which has 163 countries as members.

Classified N.S.A. memos appear to confirm that the fatal weakness, discovered by two Microsoft cryptographers in 2007, was engineered by the agency. The N.S.A. wrote the standard and aggressively pushed it on the international group, privately calling the effort “a challenge in finesse.”

“Eventually, N.S.A. became the sole editor,” the memo says.

Each novel encryption effort generated anxiety. When Mr. Zimmermann introduced the Zfone, an encrypted phone technology, N.S.A. analysts circulated the announcement in an e-mail titled “This can’t be good.”

But by 2006, an N.S.A. document notes, the agency had broken into communications for three foreign airlines, one travel reservation system, one foreign government’s nuclear department and another’s Internet service by cracking the virtual private networks that protected them.

By 2010, the Edgehill program, the British counterencryption effort, was unscrambling VPN traffic for 30 targets and had set a goal of an additional 300.

A 2010 document calls for “a new approach for opportunistic decryption, rather than targeted.” By that year, a Bullrun briefing document claims that the agency had developed “groundbreaking capabilities” against encrypted Web chats and phone calls. Its successes against Secure Sockets Layer and virtual private networks were gaining momentum.

But the agency was concerned that it could lose the advantage it had worked so long to gain, if the mere “fact of” decryption became widely known. “These capabilities are among the Sigint community’s most fragile, and the inadvertent disclosure of the simple ‘fact of’ could alert the adversary and result in immediate loss of the capability,” a GCHQ document warned.

Since Mr. Snowden’s disclosures ignited criticism of overreach and privacy infringements by the N.S.A., American technology companies have faced scrutiny from customers and the public over what some see as too cozy a relationship with the government. In response, some companies have begun to push back against what they describe as government bullying.

Secret documents recently released about the "Sigint enabling" operations:

Spoiler :

 

[Zelig]

Speculating that the NSA may have broken 128-bit AES and not 256-bit AES just shows a lack of understanding of the numbers involved.

There's really nothing there suggesting they've actually broken AES, rather than getting pre-encryption access, using known attacks/circumvention on SSL, exploiting 0-day attacks, etc.

You've conveniently omitted those relevant quotes from the article:

“Properly implemented strong crypto systems are one of the few things that you can rely on,” he said, though cautioning that the N.S.A. often bypasses the encryption altogether by targeting the computers at one end or the other and grabbing text before it is encrypted or after it is decrypted.

http://everything2.com/title/Thermodynamics+limits+on+cryptanalysis

So, it is clear that a 256-bit key (which, just to be represented while we brute-force it on our ideal computer, would require the energy that 400.000.000.000.000.000.000 suns like our sun radiate in a year

And the amazing thing that we must keep in mind, is that all of the above calculations are completely independent with contemporary and future technology advances... As long as computers are made of matter, 256-bit keys will be secure against brute-force. Except of course... if we break the second law of thermodynamics

http://security.stackexchange.com/q...afely-out-of-reach-for-all-humanity/6149#6149
http://crypto.stackexchange.com/que...brute-force-a-256-bit-key-in-a-year/1148#1148

To sum up: even if you use all the dollars in the World (including the dollars which do not exist, such as accumulated debts) and fry the whole planet in the process, you can barely do 1/1000th of an exhaustive key search on 128-bit keys. So this will not happen.

 

[Rashiminos]

Well the USPS certainly isn't wasting time appealing to the "public's common sense."

I don't object to anything you've said, I just object to Forma's estimates of their technical capacities being more than the entire world's storage and computational resources.

+ There's absolutely no reason for these facilities to be on the surface.

 

[Zelig]

+ There's absolutely no reason for these facilities to be on the surface.

Read my previous post?

Here's a good summary by an actual reputable source: https://www.schneier.com/blog/archives/2013/09/the_nsas_crypto_1.html

 

[Rashiminos]

Read my previous post?

Here's a good summary by an actual reputable source: https://www.schneier.com/blog/archives/2013/09/the_nsas_crypto_1.html

It was more in reference to your New York post, but alright.

 

[Takhisis]

I'm not sure whether they have the computational capacity to analyse all the data they steal, but they're breaking the law of the countries whose citizens they're spying on, including that country called the US of A.

 

[Zelig]

I'm not sure whether they have the computational capacity to analyse all the data they steal, but they're breaking the law of the countries whose citizens they're spying on, including that country called the US of A.

No, they've got secret laws that make it all legal.

 

[Takhisis]

Secret laws aren't legal.

 

[Zelig]

Secret laws aren't legal.

They've got other secret laws making secret laws legal.

 

[Takhisis]

That sounds very Palpatinesque.

 

[hobbsyoyo]

If the President does it then it's not illegal.

 

[Takhisis]

Well I don't see Obama going through all those billions of emails and twitter feeds now, do ya, punk?

 

[hobbsyoyo]

He can always order goons to do it for him.

 

[Borachio]

If the President does it then it's not illegal.

Yeah!

Remember Magna Carta. Did that poor little Dutch girl die in vain?

 

[bhsup]

I'm not sure whether they have the computational capacity to analyse all the data they steal, but they're breaking the law of the countries whose citizens they're spying on, including that country called the US of A.

I really couldn't care less about the laws of those other countries. Spying has always broken those laws. Big whoopy.

 

[Takhisis]

And you want me to vote for that little crappy Mass Effect game of yours after that?