Risk
10/30/2013
03:07 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

NSA Reportedly Taps Google, Yahoo Data Centers

National Security Agency can intercept traffic from Google's and Yahoo's data centers outside the U.S., according to documents from Edward Snowden.

Iris Scans: Security Technology In Action
Iris Scans: Security Technology In Action
(click image for larger view)
The National Security Agency can collect data as it flows across the data centers operated by Google and Yahoo outside the U.S., without assistance from either company and without the hindrance of security measures.

According to documents obtained by former NSA contractor Edward Snowden and interviews with government sources, The Washington Post reports that the NSA "sends millions of records every day from Yahoo and Google internal networks to data warehouses at the agency's Fort Meade headquarters."

Google chief legal officer David Drummond said in an emailed statement that the company has long been concerned about the possibility of this kind of snooping, which has motivated the company to extend encryption to more and more of its services.

"We do not provide any government, including the U.S. government, with access to our systems," said Drummond. "We are outraged at the lengths to which the government seems to have gone to intercept data from our private fiber networks, and it underscores the need for urgent reform."

Yahoo did not respond to a request for comment.

[ Goodbye, letter Captchas? Read Google Captcha Dumps Distorted Text Images. ]

When reports about the scope of NSA data collection began to appear in June, Google and other Internet companies denied providing open-ended access to customer data or to creating backdoors to allow access. They insisted they provided data only in accordance with legal process. The NSA's Prism system provides the agency and other law enforcement agencies like the FBI with access under the Foreign Intelligence Surveillance Act (FISA).

But it appears the NSA has another option. A document published by the Post describes an NSA project called MUSCULAR, operated jointing with Britain's GCHQ, by which the American and British intelligence agencies can access data flows and copy the data to their servers.

The exact method by which the network security for Google and Yahoo (and perhaps other Internet companies) has been thwarted remains unclear. But a slide from an NSA presentation on "Google Cloud Exploitation" includes a sketch indicating that the agency has the ability to withdraw and restore SSL protection at the point where Google's servers connect to the Internet.

The NSA only copies some of the data in the stream. Citing a top-secret Jan. 9 report, the Post says that 181,280,466 new records, metadata and content, were stored in the preceding 30-day period. And at least with regard to the email messages collected from Yahoo, it appears the NSA finds these messages more trouble than they're worth: The document provided by Snowden says, "analysts have complained of [the existence of the Yahoo mail archive], and the relatively small intelligence value it contains does not justify the sheer volume of collection at MUSCULAR."

At a hearing before the House Intelligence Committee on Tuesday, Gen. Keith Alexander said reports based on documents provided by Snowden misrepresented the scope of U.S. intelligence gathering. Alexander insisted that the gathering of U.S. phone metadata, a separate program, was lawful and that U.S. allies had helped gather metadata about individuals outside the U.S. James Clapper, Director of National Intelligence, defended spying on foreign leaders as a common goal of intelligence gathering. Recent reports indicating that the U.S. spied directly on European leaders have forced U.S. officials to justify the vast reach of U.S. data gathering and to mollify offended allies.

In a blog post on Wednesday, Glenn Greenwald, the journalist who, along with Laura Poitras, helped bring Snowden's revelations to light, characterized Alexander's claims as "unverified NSA accusations," noting that none of the many stories published in major newspapers about NSA spying have faced significant corrections.

"Nobody from the US government ever once — over the last four months — claimed that any of this reporting was inaccurate," Greenwald wrote.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
moarsauce123
50%
50%
moarsauce123,
User Rank: Apprentice
11/1/2013 | 11:00:07 AM
re: NSA Reportedly Taps Google, Yahoo Data Centers
Even oversight will not reign in this self-serving bunch. The NSA exists only to be in existence and amass more funds and power. The only effective way to reign in the reckless spying is to cut funding to the NSA drastically. That will end any programs that are ineffective and with that cut back the Stasi approach of collecting everything.
cbabcock
50%
50%
cbabcock,
User Rank: Apprentice
10/31/2013 | 12:52:50 AM
re: NSA Reportedly Taps Google, Yahoo Data Centers
I don't think there are enough eyes in the federal government to watch all the things that the NSA is claimed to be watching. Nevertheless, the desperate need for oversight and rules governing what it does is self-evident at this point..
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio