<story><title>Sources: NSA sucks in data from 50 companies</title><url>http://theweek.com/article/index/245311/sources-nsa-sucks-in-data-from-50-companies</url><text></text></story><parent_chain></parent_chain><comment><author>brown9-2</author><text>Marc Ambinder (the author) posted a new article late last night which goes into much more detail: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;theweek.com&amp;#x2F;article&amp;#x2F;index&amp;#x2F;245360&amp;#x2F;solving-the-mystery-of-prism&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;theweek.com&amp;#x2F;article&amp;#x2F;index&amp;#x2F;245360&amp;#x2F;solving-the-mystery-...&lt;/a&gt;&lt;p&gt;&lt;i&gt;Each data processing tool, collection platform, mission and source for raw intelligence is given a specific numeric signals activity&amp;#x2F;address designator, or a SIGAD. The NSA listening post at Osan in Korea has the SIGAD USA-31. Clark Air Force Base is USA-57.&lt;p&gt;PRISM is US-984XN.&lt;p&gt;Each SIGAD is basically a collection site, physical or virtual; the SIGAD alphanumerics are used to indicate the source of intelligence FOR a particular report.&lt;p&gt;The NSA often assigns classified code names to the product of SIGADs. These can be confused with the nicknames or proper names of the collection platforms themselves, which may or may not be classified. What PRISM does is classified; the fact that there is a &amp;quot;PRISM&amp;quot; tool that does something is not.&lt;p&gt;...&lt;p&gt;So: An analyst sits down at a desk. She uses a tool, like PRISM, to analyze information collected and deposited in a database, like CONTRAOCTAVE. Then she uses another tool, perhaps CPE (Content Preparation Environment), to write a report based on the analysis. That report is stored in ANOTHER database, like MAUI. MAUI is a database for finished NSA intelligence products. Anchory is an intelligence community-wide database for intelligence reports.&lt;/i&gt;&lt;p&gt;---------------&lt;p&gt;And here is the core of it:&lt;p&gt;&lt;i&gt;This is all very complicated, and that is on purpose. But this brief tutorial is important. PRISM is a kick-ass GUI that allows an analyst to look at, collate, monitor, and cross-check different data types provided to the NSA from internet companies located inside the United States.&lt;p&gt;The programs that use PRISM are focused, as the government said yesterday, on foreign intelligence. A lot of foreign intelligence runs through American companies and American servers.&lt;p&gt;...&lt;p&gt;Now, these accounts are being updated in real-time. So Facebook somehow creates a mirror of the slice of stuff that only the NSA can access. The selected&amp;#x2F;court-ordered accounts are updated in real-time on both the Facebook server and the mirrored server. PRISM is the tool that puts this all together. Facebook has no idea what the NSA is doing with the data, and the NSA doesn&amp;#x27;t tell them.&lt;/i&gt;&lt;p&gt;So, PRISM is the name of the software application(s) used by an analyst that allows them to pull together all the various pieces of data that they receive from these companies, along with other sources, for their analysis.&lt;p&gt;Which of course, explains why the companies have never heard of this name. There is no reason for them to have.&lt;p&gt;And what the NSA has isn&amp;#x27;t necessarily &amp;quot;direct access&amp;quot; to the servers - PRISM gives the analyst &amp;quot;direct access&amp;quot; to the data that has already been collected by many different means.</text></comment>
<story><title>Sources: NSA sucks in data from 50 companies</title><url>http://theweek.com/article/index/245311/sources-nsa-sucks-in-data-from-50-companies</url><text></text></story><parent_chain></parent_chain><comment><author>codeulike</author><text>Here&amp;#x27;s a section that seemed important to me:&lt;p&gt;&lt;i&gt;One official likened the NSA&amp;#x27;s collection authority to a van full of sealed boxes that are delivered to the agency. A court order, similar to the one revealed by the Guardian, permits the transfer of custody of the &amp;quot;boxes.&amp;quot; But the NSA needs something else, a specific purpose or investigation, in order to open a particular box. The chairman of the Senate intelligence committee, Sen. Dianne Feinstein, said the standard was &amp;quot;a reasonable, articulatable&amp;quot; suspicion, but did not go into details.&lt;p&gt;Legally, the government can ask companies for some of these records under a provision of the PATRIOT Act called the &amp;quot;business records provision.&amp;quot; Initially, it did so without court cognizance. Now, the FISC signs off on every request.&lt;p&gt;Armed with what amounts to a rubber stamp court order, however, the NSA can collect and store trillions of bytes of electromagnetic detritus shaken off by American citizens. In the government&amp;#x27;s eyes, the data is simply moving from one place to another. It does not become, in the government&amp;#x27;s eyes, relevant or protected in any way unless and until it is subject to analysis. Analysis requires that second order.&lt;/i&gt;&lt;p&gt;So, the govt and NSA distinguish between &amp;#x27;having the data&amp;#x27; (receiving a van full of boxes, in the metaphor above) and &amp;#x27;subjecting the data to analysis&amp;#x27; (opening a box, in the metaphor). They have a broad order for having the data, but need more specific sign-off to process or analyse the data.&lt;p&gt;This differentiation between &amp;#x27;having data&amp;#x27; and &amp;#x27;analysing data&amp;#x27; is not one we&amp;#x27;d generally make in the IT world - because if they already have the boxes in their possession, how do we know they are getting the right permission before they open the boxes? How is any oversight possible in that situation?</text></comment>