goshacmd / nsa_panel Goto Github PK

Easily add an NSA backdoor into your Rails app.

License: MIT License

Ruby 94.29% JavaScript 5.71%

nsa_panel's Introduction

NSA Panel

The easiest way to add a special panel for NSA agents to monitor your users' data. Let's ~~destroy the right to privacy~~ fight terrorism together!

Why?

Well, the government wants to protect you and your users from those crazy guys who blow up everything. Everyone wants to be safe. No liberty should be superior to safety, and the government is good!

Besides, you and your users really have got nothing to hide, haven't you?

Example

See sample app at test/dummy.

bundle install
rake db:setup
rails s
Visit localhost:3000/nsa_panel. Use nsa/nsa as credentials.

Install

Add it to your Gemfile:

gem 'nsa_panel'

Mount the panel in your routes:

# config/routes.rb

mount NsaPanel::Engine => "/nsa_panel"

Let it know what's your user class is (any ORM, must respond to .all, .reflect_on_all_associations, #id, and #name):

# config/initializers/nsa_panel.rb

NsaPanel.user_class = 'User'

Configure panel login/password:

# config/initializers/nsa_panel.rb

NsaPanel.username = 'nsa' # ENV['NSA_USERNAME']
NsaPanel.password = 'nsa' # ENV['NSA_PASSWORD']

~~Lie~~ Announce the following to your users:

Dear X users,

You may be aware of reports alleging that X and several other Internet companies have joined a secret U.S. government program called PRISM to give the National Security Agency direct access to our servers. We would like to respond to the press reports, and give you the facts.

X is not and has never been part of any program to give the US or any other government direct access to our servers. We have never received a blanket request or court order from any government agency asking for information or metadata in bulk, like the one Verizon reportedly received. We hadn't even heard of PRISM before yesterday.

When governments ask X for data, we review each request carefully to make sure they always follow the correct processes and all applicable laws, and then only provide the information if is required by law. We will continue fighting aggressively to keep your information safe and secure. Any suggestion that X is disclosing information about our users' Internet activity on such a scale is completely false.

We strongly encourage all governments to be much more transparent about all programs aimed at keeping the public safe. It's the only way to protect everyone's civil liberties and create the safe and free society we all want over the long term. We here at X understand that the U.S. and other governments need to take action to protect their citizens' safety—including sometimes by using surveillance. But the level of secrecy around the current legal procedures undermines the freedoms we all cherish.

Easy, eh?

What it looks like

Similar projects

flask-nsa by @plausibility.
django_nsa by @lvm.

License

MIT.

NSA Eagle Logo credit EFF.

nsa_panel's People

Contributors

Stargazers

Watchers

nsa_panel's Issues

No Warrant button too restrictive

There are at least 2 situations where the No Warrant button is too restrictive:

Your department has a "program warrant", which allows warrantless wiretapping on citizens (Note: this is the typical "happy path" use case).
At least one of the people in the discussion is believed (with 51% certainty) to be currently outside the U.S., or has ever had correspondence with such a person.

"Full Accordance with the Law" compliance check

I'm sorry, as a site operator, I want to make sure the government does not have "direct access" to my servers. I will only allow access "in accordance with law".

Thus, this project needs a page before the NSA may the output that allows them to confirm they've received a FISA warrant.

I wouldn't bother with the whole "accountability" aspect of that feature; and I wouldn't prioritize ~~easy~~ reporting on the use of it either. Actually, a big HTML5 rubber stamp stamping down on something would be kinda cool, as the page submits.

Different roles for users

If a user is high-ranking enough, she may be able to order a drone strike on a user, if content is suspicious enough.

nsa_panel is not efficient enough at usurping information

It would be more accurate and "big data" friendly to ask the helpful NSA people for a hardening guide and request instructions for the exact make and model of the servers and sans your company owns.

They can then note the infrastructure you own and use a username/password combo that the vendor created to grab the log/production.log file without your involvement.

Thus, you can confidently claim you provided no backdoor to the NSA.
http://www.lolware.net/hpstorage.html

http://www.theregister.co.uk/2013/07/09/hp_storage_more_possible_backdoors/

got an intel i7 server that is off? no problem.

TL;DR: this panel should be deprecated. Your hardware vendors already have your back on the war on terrorism.