Risk
10/30/2013
03:07 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

NSA Reportedly Taps Google, Yahoo Data Centers

National Security Agency can intercept traffic from Google's and Yahoo's data centers outside the U.S., according to documents from Edward Snowden.

Iris Scans: Security Technology In Action
Iris Scans: Security Technology In Action
(click image for larger view)
The National Security Agency can collect data as it flows across the data centers operated by Google and Yahoo outside the U.S., without assistance from either company and without the hindrance of security measures.

According to documents obtained by former NSA contractor Edward Snowden and interviews with government sources, The Washington Post reports that the NSA "sends millions of records every day from Yahoo and Google internal networks to data warehouses at the agency's Fort Meade headquarters."

Google chief legal officer David Drummond said in an emailed statement that the company has long been concerned about the possibility of this kind of snooping, which has motivated the company to extend encryption to more and more of its services.

"We do not provide any government, including the U.S. government, with access to our systems," said Drummond. "We are outraged at the lengths to which the government seems to have gone to intercept data from our private fiber networks, and it underscores the need for urgent reform."

Yahoo did not respond to a request for comment.

[ Goodbye, letter Captchas? Read Google Captcha Dumps Distorted Text Images. ]

When reports about the scope of NSA data collection began to appear in June, Google and other Internet companies denied providing open-ended access to customer data or to creating backdoors to allow access. They insisted they provided data only in accordance with legal process. The NSA's Prism system provides the agency and other law enforcement agencies like the FBI with access under the Foreign Intelligence Surveillance Act (FISA).

But it appears the NSA has another option. A document published by the Post describes an NSA project called MUSCULAR, operated jointing with Britain's GCHQ, by which the American and British intelligence agencies can access data flows and copy the data to their servers.

The exact method by which the network security for Google and Yahoo (and perhaps other Internet companies) has been thwarted remains unclear. But a slide from an NSA presentation on "Google Cloud Exploitation" includes a sketch indicating that the agency has the ability to withdraw and restore SSL protection at the point where Google's servers connect to the Internet.

The NSA only copies some of the data in the stream. Citing a top-secret Jan. 9 report, the Post says that 181,280,466 new records, metadata and content, were stored in the preceding 30-day period. And at least with regard to the email messages collected from Yahoo, it appears the NSA finds these messages more trouble than they're worth: The document provided by Snowden says, "analysts have complained of [the existence of the Yahoo mail archive], and the relatively small intelligence value it contains does not justify the sheer volume of collection at MUSCULAR."

At a hearing before the House Intelligence Committee on Tuesday, Gen. Keith Alexander said reports based on documents provided by Snowden misrepresented the scope of U.S. intelligence gathering. Alexander insisted that the gathering of U.S. phone metadata, a separate program, was lawful and that U.S. allies had helped gather metadata about individuals outside the U.S. James Clapper, Director of National Intelligence, defended spying on foreign leaders as a common goal of intelligence gathering. Recent reports indicating that the U.S. spied directly on European leaders have forced U.S. officials to justify the vast reach of U.S. data gathering and to mollify offended allies.

In a blog post on Wednesday, Glenn Greenwald, the journalist who, along with Laura Poitras, helped bring Snowden's revelations to light, characterized Alexander's claims as "unverified NSA accusations," noting that none of the many stories published in major newspapers about NSA spying have faced significant corrections.

"Nobody from the US government ever once — over the last four months — claimed that any of this reporting was inaccurate," Greenwald wrote.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
moarsauce123
50%
50%
moarsauce123,
User Rank: Apprentice
11/1/2013 | 11:00:07 AM
re: NSA Reportedly Taps Google, Yahoo Data Centers
Even oversight will not reign in this self-serving bunch. The NSA exists only to be in existence and amass more funds and power. The only effective way to reign in the reckless spying is to cut funding to the NSA drastically. That will end any programs that are ineffective and with that cut back the Stasi approach of collecting everything.
cbabcock
50%
50%
cbabcock,
User Rank: Apprentice
10/31/2013 | 12:52:50 AM
re: NSA Reportedly Taps Google, Yahoo Data Centers
I don't think there are enough eyes in the federal government to watch all the things that the NSA is claimed to be watching. Nevertheless, the desperate need for oversight and rules governing what it does is self-evident at this point..
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3861
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element.

CVE-2014-3862
Published: 2014-09-02
CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log.

CVE-2014-5076
Published: 2014-09-02
The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as demonstrated by the drozer framework.

CVE-2014-5452
Published: 2014-09-02
CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allows remote attackers to conduct XSS attacks via a document containing a table that is improperly handled during unrestricted xsl:copy operations.

CVE-2014-6041
Published: 2014-09-02
The Android Browser application 4.2.1 on Android allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a \u0000 character, as demonstrated by an onclick="window.open('\u0000javascript: sequence.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.