New Snowden Documents Expose NSA's 'Core Secrets:' Infiltration Of Foreign Companies Aimed At 'Exploiting Network Technology'

from the NSA:-doing-more-with-more dept

It appears the NSA is much more than a domestic agency with many digital tentacles. It also has agents operating in other countries, much like the CIA and the FBI. New Snowden documents released by The Intercept show that the agency has "under cover" agents embedded in foreign companies for the purpose of extending its surveillance reach.

The National Security Agency has had agents in China, Germany, and South Korea working on programs that use “physical subversion” to infiltrate and compromise networks and devices, according to documents obtained by The Intercept.

The documents, leaked by NSA whistleblower Edward Snowden, also indicate that the agency has used “under cover” operatives to gain access to sensitive data and systems in the global communications industry, and that these secret agents may have even dealt with American firms. The documents describe a range of clandestine field activities that are among the agency’s “core secrets” when it comes to computer network attacks, details of which are apparently shared with only a small number of officials outside the NSA.

Judging from the documents posted (and the commentary by Peter Maass and Laura Poitras), this doesn't seem to be slanted towards industrial/economic espionage as much as it is a very broad expansion of its Tailored Access Operations -- in which the agency intercepts shipments of electronics to add backdoors, using implanted hardware or inserted code.

The documents also indicate that the NSA has worked with several domestic and foreign companies to weaken encryption, something that isn't exactly news, but is revealed here to be far more extensive than the $10 million paid to RSA to push weakened encryption.

In addition to so-called “close access” operations, the NSA’s “core secrets” include the fact that the agency works with U.S. and foreign companies to weaken their encryption systems; the fact that the NSA spends “hundreds of millions of dollars” on technology to defeat commercial encryption; and the fact that the agency works with U.S. and foreign companies to penetrate computer networks, possibly without the knowledge of the host countries.

Underneath it all is a package of six programs, running under the title of Sentry Eagle. All of these are cybersecurity-related and work together to break encryption and "exploit networks." The program itself is highly secretive, even within the agency itself. [pdf link]

“You are being indoctrinated on Sentry Eagle,” the 2004 document begins, before going on to list the most highly classified aspects of its various programs. It warns that the details of the Sentry Eagle programs are to be shared with only a “limited number” of people, and even then only with the approval of one of a handful of senior intelligence officials, including the NSA director.

The document also makes reference to the fact that details of Sentry Eagle are only to be shared with "a limited number of select government officials," but doesn't go into any greater detail on who these officials might be. Nor is there any mention of additional oversight, like the FISA court or the two intelligence committees.

Presumably, the NSA is more focused on foreign companies than domestic ones and is perhaps even working in concert with local governments to improve surveillance capabilities (in exchange for being given unlimited access to the collected data). If this is true, then buying foreign products to avoid dealing with NSA-sabotaged goods and services is a futile effort. In the wake of Snowden's leaks, many foreign businesses have stated their intent to network and communication equipment/services from non-US companies. These documents imply there may be nowhere else to go.

Filed Under: core secrets, ed snowden, infiltration, nsa, surveillance, tao

Microsoft To Encrypt Data Center Links; Says NSA Hacking Would Be Unconstitutional

from the and-now-what? dept

We were somewhat surprised to see Microsoft recently admit that in the wake of the revelation that the NSA had infiltrated the private data links between Yahoo and Google's data centers that it had not yet decided to encrypt its own such links. Google had very quickly moved to encrypt those links and Yahoo has recently done so as well (though it took a little while). Now Microsoft is saying that it's going to do the same thing.

While the revealed documents did not directly point to a similar infiltration of Microsoft, there's reason to believe it was also compromised. Other Snowden documents mentioned in the linked article above note that Microsoft is listed as having data accessible under the same program, referred to as MUSCULAR. Perhaps more interesting is Microsoft making it clear that it believes any such infiltration would be a serious legal violation:

When asked about the NSA documents mentioning surveillance of Microsoft services, Smith issued a sharply worded statement: “These allegations are very disturbing. If they are true these actions amount to hacking and seizure of private data and in our view are a breach of the protection guaranteed by the Fourth Amendment to the Constitution.”

Of course, just because something is a Constitutional violation doesn't necessarily mean that there's much of a legal remedy. Any lawsuit would immediately lead to claims of sovereign immunity and national security to try to kill off any such lawsuit. It's the same thing the feds have done every time they've been challenged on this stuff. The only real way to deal with this is to make sure that the companies actually protect user data in a manner that makes it nearly impossible for the government to break in as it has in the past.

Filed Under: brad smith, datacenters, encryption, infiltration, nsa, nsa surveillance
Companies: microsoft

Microsoft Admits Its Datacenters Are Wide Open To NSA Attacks

from the uh,-guys... dept

When the NSA news started breaking this past summer, it was noted that Google quickly realized where the NSA might be hacking in, and rushed to encrypt the links that connect their data centers. While some may criticize this, it's easy to see why companies never bothered to encrypt these links. They're internal networks, with no direct access to the outside world. The threat likelihood was quite low... unless you're a giant government spying operation. That said, once it was revealed that, indeed, this is how the NSA hacks in, no company has an excuse for not encrypting such links. Some Google engineers stated a direct "fuck you" to the NSA, as they were making sure that those links were encrypted (they claimed the job was done, though Google officially has said it's an ongoing process, suggesting they may still be finishing up).

Unfortunately, it's not clear that other companies are following suit. When asked about this right after the infiltration was revealed, Yahoo gave a non-committal answer:

"We have strict controls in place to protect the security of our data centers, and we have not given access to our data centers to the NSA or to any other government agency."

Yeah, but that doesn't say they encrypt the links between data centers, or even that they're planning to do so. Since then, Yahoo has basically said nothing as far as I can tell. Over in Europe, however, Microsoft has now admitted that it still is not encrypting those links, and is only now investigating the idea.

Dorothee Belz, EMEA VP for Legal and Corporate Affairs made the remark when answering a question from Claude Moraes, MEP during a meeting at the European Parliament on Monday.

"Generally, what I can say today is server-to-server transportation is generally not encrypted," she said. "This is why we are currently reviewing our security system."

Sure, it's not something that can be done overnight, but large internet companies who use multiple data centers now need to assume that all of their data is compromised if they're not encrypting the links. Whether or not it's done yet, these companies have a responsibility to get that process started as soon as possible. Hell, they all probably should have started doing this as soon as the news broke that Google was rushing to do this, since it was pretty clear they'd figured out what was going on.

It's especially ironic that Microsoft is now admitting that it's not encrypting the data leaks, because the company has been on a rampage trying to present itself as protecting users privacy and that Google is a privacy nightmare. But, given these admissions, Microsoft has now basically said that its made all of your data available to the US government and it's still thinking about what to do about it, while Google has been rushing to protect its users privacy.

Filed Under: datacenters, encryption, infiltration, nsa, nsa surveillance, surveillance
Companies: google, microsoft, yahoo

Privacy Groups Want The Government To Investigate Google Over The NSA's Hacking

from the really-now? dept

The Electronic Privacy Information Center (EPIC) has this unfortunate habit of making absolutely insane arguments that really destroy its credibility elsewhere. At times it does good work in responding to egregious violations of privacy, but at times it just makes itself look like a total kook organization -- such as when it sued the FTC for not investigating Google over EPIC's ridiculously bizarre claims of privacy violations just because Google changed its privacy policy. EPIC is never one to let go, and its latest self-defeating strategy is to demand the FTC investigate Google and Yahoo... for letting the NSA hack their data centers.

As was widely discussed last month, the NSA had found a backdoor way to effectively hack into the networks that connect Google and Yahoo's data centers, allowing the NSA to pull down all sorts of data, without either company knowing about it. It seems quite reasonable to go after the NSA and the US government about this, but in the twisted mind of EPIC, this is a violation of Google's privacy policy. I'm not joking. EPIC, along with a number of other privacy groups (some of whom focus nearly their entire efforts on trying to make Google less useful) have sent a ridiculous letter to the FTC. It points out that the FTC has previously ordered these companies to "adopt comprehensive privacy programs," and then argues that those privacy programs have been violated because of the NSA hacks.

These companies have represented that user data is only disclosed to law enforcement subject to a lawful process. But there is every reason now to believe that millions of consumer records were unlawfully obtained by the National Security Agency. Of course, once the records are in possession of these firms there is nothing that users can do to limit the subsequent improper release or avoid the misuse. And there is clearly no benefit to users in the improper and unlawful disclosure of their personal information.

[....] Finally, the Commission should pursue this investigation because it routinely holds itself out as the defender of consumer privacy in the United States. It is inconceivable that when faced with the most significant breach of consumer data in U.S. history, the Commission could ignore the consequences for consumer privacy.

Talk about taking a blame the victim approach. EPIC, CDD, Consumer Watchdog, Privacy Rights Clearinghouse, Consumer Federation of America, Public Citizen (?!?) and the Privacy Times, who all signed onto this letter look ridiculous. They're saying that the FTC needs to investigate Google and Yahoo for violations of their privacy policies, because the NSA hacked into their data centers. Go after the NSA and the rest of the US government for doing that. But blaming the companies who didn't even know about this isn't just ridiculous, it's counterproductive.

These groups are so focused on trying to do anything to attack Google that they're making the situation worse. Based on this kind of ridiculous attack, pretty much any company is now better off making their privacy policies worse. The crux of EPIC's stupid argument is that this violates their privacy policies. You know the best way to avoid that? Change your privacy policy so that revealing as much information as possible isn't a violation. Furthermore, blaming the hacking victims for the hack takes the attention away from where it belongs: on the NSA and the administration for doing this in the first place.

Given that the FTC and the NSA are both a part of the administration, it's not impossible to imagine a scenario where the only ones actually punished for hacking into these data centers are Google and Yahoo, while the NSA gets away with the whole thing. Is that really what these organizations want? EPIC, CDD and Consumer Watchdog in particular like to set themselves up as "defending consumers." But they're doing the opposite here. They're inevitably making life worse for consumers. Hopefully, as it has in the past, the FTC sees through these ridiculous arguments.

Filed Under: datacenters, ftc, infiltration, nsa hacking, nsa surveillance, privacy, privacy policies
Companies: consumer federation of america, consumer watchdog, epic, google, privacy rights clearinghouse, privacy times, public citizen, yahoo

Bruce Schneier Speculates On NSA Double Laundering Information It Obtains Via Network Infiltration

from the double-reverse-parallel-construction dept

Bruce Schneier has a worth-reading post about the latest reports on the NSA infiltrating the network connections for Google and Yahoo's datacenter, making a number of good points about that story. We'll discuss a few of the points, but I wanted to focus in on this one first:

In light of this, PRISM is really just insurance: a way for the NSA to get legal cover for information it already has. My guess is that the NSA collects the vast majority of its data surreptitiously, using programs such as these. Then, when it has to share the information with the FBI or other organizations, it gets it again through a more public program like PRISM.

While it's just speculation, there is some reason to suggest it might be the case, and that would show just how far the NSA goes in some cases. After all, until June, PRISM itself was a secret. Yet, now, it's possible that the secret PRISM program was really just a way to put a legal-looking coat of paint on far more invasive activities. After all, it's already been revealed that the NSA and others make use of what they call "parallel construction" to "refind" evidence that they found through means they don't want to be challenged in court. As we said, this is just a way of laundering illegally obtained evidence. If Schneier's suspicion is right, then the NSA was actually probably happy that PRISM info came out first, since it does have at least some claims to being legal under Section 702.

But, if he's correct, it would mean that the NSA has secretly backdoored its way into networks, sucking up pretty much everything -- and then when it finds something useful, it will then use Section 702 under the FAA and the FISA Court to come up with some reasoning why that same info should be "collected" via either PRISM or the upstream telco traps, and then it can do more with it. This might not be true, but layering secret programs on top of secret programs to hide how the info was actually obtained would be something.

Other key points from Schneier are that we cannot assume it was just Google and Yahoo infiltrated this way. It's likely that others have been as well, just under different programs. And, more importantly, this demonstrates how legislative change to fix these things likely won't be enough. If you block the NSA from getting the data from door number 1, they're already in doors numbered 2, 3, 4, 5 and 6. Not only does there need to be a full independent investigation of everything the NSA is doing, but we need to build much more secure systems at the same time.

Filed Under: bruce schneier, infiltration, nsa, nsa surveillance, prism

Was Level 3 The Weak Link That Gave The Feds A Way To Hack Into Google's Network?

from the no-comment dept

The NY Times has an interesting and informative story building on yesterday's bombshell about the NSA and GCHQ infiltrating Google and Yahoo's network links between datacenters. Much of the NYT report covers the same ground as the original Washington Post article, but adds a few key details. The key part? That the network cables that connect the various Google datacenters are apparently provided by telco infrastructure giant Level 3 -- and when asked about it, Level 3 seemed to hint strongly that the government may have gotten access via it, but that it was legally gagged from talking about it:

In a statement, Level 3 said: “We comply with the laws in each country where we operate. In general, governments that seek assistance in law enforcement or security investigations prohibit disclosure of the assistance provided.”

That's not a definite confirmation, but you can see how it would raise eyebrows. As the NYT report notes, in an earlier story, concerning claims that Level 3 had helped the intelligence community spy on Germans, the company had denied the report. The fact that it's not denying it here, but rather pointing out that if it had helped there would be a gag order, certainly suggests the potential way in for the NSA. If so, Google might want to look rather closely at its agreement with Level 3.

Filed Under: datacenters, infiltration, networks, nsa, nsa surveillance
Companies: google, level 3, yahoo

Keith Alexander, On Stage While Story Of NSA Infiltrations Breaks, Tries To Mislead With Response

from the servers-or-datacenter dept

In an interesting bit of timing, just as the Washington Post was breaking the news that the NSA had infiltrated Google and Yahoo's cloud data by hacking into the (stupidly) unencrypted data links between data centers, it turned out that NSA boss Keith Alexander was on stage at a Bloomberg Government Cybersecurity conference. He was asked about the report, and he tried to tap dance around it by claiming the NSA doesn't have access to Yahoo and Google's servers. The Guardian has a brief summary:

Alexander, asked about the Post report, denied it. “Not to my knowledge, that’s never happened,” the NSA director said, before reiterating an earlier denial Prism gave the NSA direct access to the servers of its internet service provider partners.

“Everything we do with those companies that work with us, they are compelled to work with us,” Alexander said. “These are specific requirements that come from a court order. This is not the NSA breaking into any databases. It would be illegal for us to do that. So I don’t know what the report is, but I can tell you factually: we do not have access to Google servers, Yahoo servers, dot-dot-dot. We go through a court order.”

But, of course, in typical Alexander fashion, he's choosing his words carefully -- and thankfully people can more easily see through it at this point, since they're getting so used to it. The report didn't say they were accessing those companies' servers or databases, but rather hacking into the network connection between their data centers. That's like a report breaking of the NSA hijacking armored cars with cash, and Alexander claiming "we didn't break into the bank." Nice try.

Filed Under: datacenters, infiltration, keith alexander, network, nsa, nsa surveillance
Companies: google, yahoo