Microsoft To Encrypt Data Center Links; Says NSA Hacking Would Be Unconstitutional

from the and-now-what? dept

We were somewhat surprised to see Microsoft recently admit that in the wake of the revelation that the NSA had infiltrated the private data links between Yahoo and Google's data centers that it had not yet decided to encrypt its own such links. Google had very quickly moved to encrypt those links and Yahoo has recently done so as well (though it took a little while). Now Microsoft is saying that it's going to do the same thing.

While the revealed documents did not directly point to a similar infiltration of Microsoft, there's reason to believe it was also compromised. Other Snowden documents mentioned in the linked article above note that Microsoft is listed as having data accessible under the same program, referred to as MUSCULAR. Perhaps more interesting is Microsoft making it clear that it believes any such infiltration would be a serious legal violation:

When asked about the NSA documents mentioning surveillance of Microsoft services, Smith issued a sharply worded statement: “These allegations are very disturbing. If they are true these actions amount to hacking and seizure of private data and in our view are a breach of the protection guaranteed by the Fourth Amendment to the Constitution.”

Of course, just because something is a Constitutional violation doesn't necessarily mean that there's much of a legal remedy. Any lawsuit would immediately lead to claims of sovereign immunity and national security to try to kill off any such lawsuit. It's the same thing the feds have done every time they've been challenged on this stuff. The only real way to deal with this is to make sure that the companies actually protect user data in a manner that makes it nearly impossible for the government to break in as it has in the past.

Filed Under: brad smith, datacenters, encryption, infiltration, nsa, nsa surveillance
Companies: microsoft

Microsoft Admits Its Datacenters Are Wide Open To NSA Attacks

from the uh,-guys... dept

When the NSA news started breaking this past summer, it was noted that Google quickly realized where the NSA might be hacking in, and rushed to encrypt the links that connect their data centers. While some may criticize this, it's easy to see why companies never bothered to encrypt these links. They're internal networks, with no direct access to the outside world. The threat likelihood was quite low... unless you're a giant government spying operation. That said, once it was revealed that, indeed, this is how the NSA hacks in, no company has an excuse for not encrypting such links. Some Google engineers stated a direct "fuck you" to the NSA, as they were making sure that those links were encrypted (they claimed the job was done, though Google officially has said it's an ongoing process, suggesting they may still be finishing up).

Unfortunately, it's not clear that other companies are following suit. When asked about this right after the infiltration was revealed, Yahoo gave a non-committal answer:

"We have strict controls in place to protect the security of our data centers, and we have not given access to our data centers to the NSA or to any other government agency."

Yeah, but that doesn't say they encrypt the links between data centers, or even that they're planning to do so. Since then, Yahoo has basically said nothing as far as I can tell. Over in Europe, however, Microsoft has now admitted that it still is not encrypting those links, and is only now investigating the idea.

Dorothee Belz, EMEA VP for Legal and Corporate Affairs made the remark when answering a question from Claude Moraes, MEP during a meeting at the European Parliament on Monday.

"Generally, what I can say today is server-to-server transportation is generally not encrypted," she said. "This is why we are currently reviewing our security system."

Sure, it's not something that can be done overnight, but large internet companies who use multiple data centers now need to assume that all of their data is compromised if they're not encrypting the links. Whether or not it's done yet, these companies have a responsibility to get that process started as soon as possible. Hell, they all probably should have started doing this as soon as the news broke that Google was rushing to do this, since it was pretty clear they'd figured out what was going on.

It's especially ironic that Microsoft is now admitting that it's not encrypting the data leaks, because the company has been on a rampage trying to present itself as protecting users privacy and that Google is a privacy nightmare. But, given these admissions, Microsoft has now basically said that its made all of your data available to the US government and it's still thinking about what to do about it, while Google has been rushing to protect its users privacy.

Filed Under: datacenters, encryption, infiltration, nsa, nsa surveillance, surveillance
Companies: google, microsoft, yahoo

Privacy Groups Want The Government To Investigate Google Over The NSA's Hacking

from the really-now? dept

The Electronic Privacy Information Center (EPIC) has this unfortunate habit of making absolutely insane arguments that really destroy its credibility elsewhere. At times it does good work in responding to egregious violations of privacy, but at times it just makes itself look like a total kook organization -- such as when it sued the FTC for not investigating Google over EPIC's ridiculously bizarre claims of privacy violations just because Google changed its privacy policy. EPIC is never one to let go, and its latest self-defeating strategy is to demand the FTC investigate Google and Yahoo... for letting the NSA hack their data centers.

As was widely discussed last month, the NSA had found a backdoor way to effectively hack into the networks that connect Google and Yahoo's data centers, allowing the NSA to pull down all sorts of data, without either company knowing about it. It seems quite reasonable to go after the NSA and the US government about this, but in the twisted mind of EPIC, this is a violation of Google's privacy policy. I'm not joking. EPIC, along with a number of other privacy groups (some of whom focus nearly their entire efforts on trying to make Google less useful) have sent a ridiculous letter to the FTC. It points out that the FTC has previously ordered these companies to "adopt comprehensive privacy programs," and then argues that those privacy programs have been violated because of the NSA hacks.

These companies have represented that user data is only disclosed to law enforcement subject to a lawful process. But there is every reason now to believe that millions of consumer records were unlawfully obtained by the National Security Agency. Of course, once the records are in possession of these firms there is nothing that users can do to limit the subsequent improper release or avoid the misuse. And there is clearly no benefit to users in the improper and unlawful disclosure of their personal information.

[....] Finally, the Commission should pursue this investigation because it routinely holds itself out as the defender of consumer privacy in the United States. It is inconceivable that when faced with the most significant breach of consumer data in U.S. history, the Commission could ignore the consequences for consumer privacy.

Talk about taking a blame the victim approach. EPIC, CDD, Consumer Watchdog, Privacy Rights Clearinghouse, Consumer Federation of America, Public Citizen (?!?) and the Privacy Times, who all signed onto this letter look ridiculous. They're saying that the FTC needs to investigate Google and Yahoo for violations of their privacy policies, because the NSA hacked into their data centers. Go after the NSA and the rest of the US government for doing that. But blaming the companies who didn't even know about this isn't just ridiculous, it's counterproductive.

These groups are so focused on trying to do anything to attack Google that they're making the situation worse. Based on this kind of ridiculous attack, pretty much any company is now better off making their privacy policies worse. The crux of EPIC's stupid argument is that this violates their privacy policies. You know the best way to avoid that? Change your privacy policy so that revealing as much information as possible isn't a violation. Furthermore, blaming the hacking victims for the hack takes the attention away from where it belongs: on the NSA and the administration for doing this in the first place.

Given that the FTC and the NSA are both a part of the administration, it's not impossible to imagine a scenario where the only ones actually punished for hacking into these data centers are Google and Yahoo, while the NSA gets away with the whole thing. Is that really what these organizations want? EPIC, CDD and Consumer Watchdog in particular like to set themselves up as "defending consumers." But they're doing the opposite here. They're inevitably making life worse for consumers. Hopefully, as it has in the past, the FTC sees through these ridiculous arguments.

Filed Under: datacenters, ftc, infiltration, nsa hacking, nsa surveillance, privacy, privacy policies
Companies: consumer federation of america, consumer watchdog, epic, google, privacy rights clearinghouse, privacy times, public citizen, yahoo

Pissed Off Google Security Guys Issue FU To NSA, Announce Data Center Traffic Now Encrypted

from the keep-at-it dept

So far, one of the biggest stories of the Snowden NSA leaks, by far, is the revelation that the NSA was infiltrating the private data links between Google and Yahoo data centers (and, it seems likely, other companies as well). Google had clearly suspected this, as it had been reported earlier that they were scrambling to encrypt those data links. As you may recall, the original Washington Post article also noted that two Google engineers who were shown the NSA's slides "exploded in profanity" and anger at the NSA.

It would appear that this sentiment is pretty common across Google's security team, and they're displaying their anger on Google Plus -- but also announcing that all that data is now encrypted. When the news first broke, security engineer Brandon Downey expressed reasonable anger about the news:

Fuck these guys.

I've spent the last ten years of my life trying to keep Google's users safe and secure from the many diverse threats Google faces.

[...] But after spending all that time helping in my tiny way to protect Google -- one of the greatest things to arise from the internet -- seeing this, well, it's just a little like coming home from War with Sauron, destroying the One Ring, only to discover the NSA is on the front porch of the Shire chopping down the Party Tree and outsourcing all the hobbit farmers with half-orcs and whips.

On Tuesday, the Washington Post revealed a few more slides showing more details of the NSA's infiltration of private data links between data centers. In response to that, another security engineer, Mike Hearn, announced that all the traffic shown in those slides is now encrypted, along with his own "fuck you" to the NSA and GCHQ:

I now join him in issuing a giant Fuck You to the people who made these slides. I am not American, I am a Brit, but it's no different - GCHQ turns out to be even worse than the NSA.

We designed this system to keep criminals out. There's no ambiguity here. The warrant system with skeptical judges, paths for appeal, and rules of evidence was built from centuries of hard won experience. When it works, it represents as good a balance as we've got between the need to restrain the state and the need to keep crime in check. Bypassing that system is illegal for a good reason.

Unfortunately we live in a world where all too often, laws are for the little people. Nobody at GCHQ or the NSA will ever stand before a judge and answer for this industrial-scale subversion of the judicial process. In the absence of working law enforcement, we therefore do what internet engineers have always done - build more secure software. The traffic shown in the slides below is now all encrypted and the work the NSA/GCHQ staff did on understanding it, ruined.

Of course, some people might reasonably question the idea that Google is "little people" here. And, while it's good to see Google staffers furious about this, it remains to be seen if Google will actually do more about this. A lawsuit against the US government for hacking into its network seems called for. And, potentially against Level 3 as well, given that it appears Level 3 provided much of the dark fiber Google was using -- and the company gave a giant "if the government comes to us, we can't talk about it" response, that hinted strongly towards "the government came to us and had us tap Google's private links."

Hopefully, we'll start to see that employee anger over this turn into much more: including better privacy tools for users and using Google's political pull to fight the NSA in DC as well.

Filed Under: datacenters, encryption, engineers, nsa, nsa surveillance, security
Companies: google, level 3

Was Level 3 The Weak Link That Gave The Feds A Way To Hack Into Google's Network?

from the no-comment dept

The NY Times has an interesting and informative story building on yesterday's bombshell about the NSA and GCHQ infiltrating Google and Yahoo's network links between datacenters. Much of the NYT report covers the same ground as the original Washington Post article, but adds a few key details. The key part? That the network cables that connect the various Google datacenters are apparently provided by telco infrastructure giant Level 3 -- and when asked about it, Level 3 seemed to hint strongly that the government may have gotten access via it, but that it was legally gagged from talking about it:

In a statement, Level 3 said: “We comply with the laws in each country where we operate. In general, governments that seek assistance in law enforcement or security investigations prohibit disclosure of the assistance provided.”

That's not a definite confirmation, but you can see how it would raise eyebrows. As the NYT report notes, in an earlier story, concerning claims that Level 3 had helped the intelligence community spy on Germans, the company had denied the report. The fact that it's not denying it here, but rather pointing out that if it had helped there would be a gag order, certainly suggests the potential way in for the NSA. If so, Google might want to look rather closely at its agreement with Level 3.

Filed Under: datacenters, infiltration, networks, nsa, nsa surveillance
Companies: google, level 3, yahoo

Keith Alexander, On Stage While Story Of NSA Infiltrations Breaks, Tries To Mislead With Response

from the servers-or-datacenter dept

In an interesting bit of timing, just as the Washington Post was breaking the news that the NSA had infiltrated Google and Yahoo's cloud data by hacking into the (stupidly) unencrypted data links between data centers, it turned out that NSA boss Keith Alexander was on stage at a Bloomberg Government Cybersecurity conference. He was asked about the report, and he tried to tap dance around it by claiming the NSA doesn't have access to Yahoo and Google's servers. The Guardian has a brief summary:

Alexander, asked about the Post report, denied it. “Not to my knowledge, that’s never happened,” the NSA director said, before reiterating an earlier denial Prism gave the NSA direct access to the servers of its internet service provider partners.

“Everything we do with those companies that work with us, they are compelled to work with us,” Alexander said. “These are specific requirements that come from a court order. This is not the NSA breaking into any databases. It would be illegal for us to do that. So I don’t know what the report is, but I can tell you factually: we do not have access to Google servers, Yahoo servers, dot-dot-dot. We go through a court order.”

But, of course, in typical Alexander fashion, he's choosing his words carefully -- and thankfully people can more easily see through it at this point, since they're getting so used to it. The report didn't say they were accessing those companies' servers or databases, but rather hacking into the network connection between their data centers. That's like a report breaking of the NSA hijacking armored cars with cash, and Alexander claiming "we didn't break into the bank." Nice try.

Filed Under: datacenters, infiltration, keith alexander, network, nsa, nsa surveillance
Companies: google, yahoo

No, There Hasn't Been A Big Shift Away From US Datacenters... Yet

from the give-it-time dept

We've been pointing out that the various disclosures about NSA surveillance, and its ability to tap into various servers associated with US companies, should be very troubling to the US tech industry, because it will make it harder and harder to do business -- especially with those outside of the US. Of course, some are claiming that this will all blow over, and while people will make noise about it, they won't actually go anywhere else. And, of course, the latest Netcraft data suggests that there's been little movement so far:

Despite speculation that the recent PRISM revelations would result in a mass exodus from American data centers and web hosting companies, Netcraft has not yet seen any evidence of this. Within the most popular 10 thousand sites, Netcraft witnessed only 40 sites moving away from US-based hosting companies. Contrary to some people's expectations, 47 sites moved to the US, which actually resulted in a net migration to the US.

This trend is also reflected by the entire web server survey, where a net sum of 270 thousand sites moved to the US from other countries (in total, 3.9 million sites moved to the US, while 3.6 million moved from the US). Germany was the most popular departure country, with nearly 1.2 million sites moving from German hosting companies. This was followed by Canada, where 803 thousand sites hopped across the border to the US.

Of course, I think it's way too early to conclude much about this at this point for a variety of reasons. First, we're still learning about the extent of the surveillance, and some of the more damning revelations have really only just started to trickle out. Second, moving your hosting services is not generally something you just do overnight. It can take quite a bit of time. Third -- and this is a big one -- I'd argue the bigger concern is less about companies moving, but that the next generation of users will never agree to use US servers. And, finally (and perhaps most importantly), prior to these revelations, the market for more private and secure hosting and communications was fairly limited. Some have pointed out that even for those who wish to leave US services, it's not clear where to go.

But I am expecting that's going to change. One thing that these revelations have made clear is that current solutions are not as secure or private as people expected and that this is an issue that many, many people and companies are concerned about. As such, it seems quite likely that there will be investment and entrepreneurship focused on these areas over the next few years -- and I fully expect that a number of more secure and private solutions, who actively promote themselves on these features, will hit the market.

Filed Under: cloud computing, datacenters, impact, nsa, nsa surveillance, prism, privacy, us