Despite having front-door access to communications transmitted across the biggest Internet companies on Earth, the National Security Agency has been secretly tapping into the two largest online entities in the world, new leaked documents reveal.
Those documents, supplied by former NSA contractor Edward Snowden and obtained by the Washington Post, suggest that the US intelligence agency and its British counterpart have compromised data passed through the computers of Google and Yahoo, the two biggest companies in the world with regards to overall Internet traffic, and in turn allowed those country’s governments and likely their allies access to hundreds of millions of user accounts from individuals around the world.
“From undisclosed interception points, the NSA and GCHQ are copying entire data flows across fiber-optic cables that carry information between the data centers of the Silicon Valley giants,” the Post’s Barton Gellman and Ashkan Soltani reported on Wednesday.
The document providing evidence of such was among the trove of
files supplied by Mr. Snowden and is dated January 9, 2013,
making it among the most recent top-secret files attributed to
the 30-year-old whistleblower.
Both Google and Yahoo responded to the report, with the former's response being the most forceful.
Google's chief legal officer, David Drummond, said the company was "outraged" by the allegations.
"We have long been concerned about the possibility of this kind of snooping, which is why we have continued to extend encryption across more and more Google services and links, especially the links in the slide," said Drummond, implying the web giant had been caught by surprise by the revelations..
"We do not provide any government, including the US government, with access to our systems. We are outraged at the lengths to which the government seems to have gone to intercept data from our private fiber networks, and it underscores the need for urgent reform."
Yahoo likewise implied it was not actively cooperating with the NSA in granting the agency access to its data infrastructure.
"We have strict controls in place to protect the security of our data centers, and we have not given access to our data centers to the NSA or to any other government agency," the company said via statement.
Gen. Keith Alexander, the head of the NSA, told reporters
Wednesday afternoon, "I don't know what the report is,"
according to Politico, and said his agency is "not
authorized" to tap into Silicon Valley companies. When asked
if the NSA tapped into the data centers, Alexander said, "Not
to my knowledge."
Earlier this year, separate documentation supplied by Mr. Snowden disclosed evidence of PRISM, an NSA-operated program that the intelligence company conducted to target the users of Microsoft, Google, Yahoo, Facebook, PalTalk, YouTube, Skype, AOL and Apple services. When that program was disclosed by the Guardian newspaper in June, reporters there said it allowed the NSA to “collect material including search history, the content of emails, file transfers and live chats” while having direct access to the companies’ servers, at times with the “assistance of communication providers in the US.”
According to the latest leak, the NSA and Britain’s Government Communications Headquarters are conducting similar operations targeting the users of at least two of these companies, although this time under utmost secrecy.
“The infiltration is especially striking because the NSA, under a separate program known as PRISM, has front-door access to Google and Yahoo user accounts through a court-approved process,” the Post noted.
And while top-brass in the US intelligence community defended PRISM and said it did not target American Internet users, the newest program — codenamed MUSCULAR — sweeps up data pertaining to the accounts of many Americans, the Post acknowledged.
The MUSCULAR program, according to Wednesday’s leak, involves a process in which the NSA and GCHQ intercept communications overseas, where lax restrictions and oversight allow the agencies access to intelligence with ease.
“NSA documents about the effort refer directly to ‘full take,’ ‘bulk access’ and ‘high volume’ operations on Yahoo and Google networks,” the Post reported. “Such large-scale collection of Internet content would be illegal in the United States, but the operations take place overseas, where the NSA is allowed to presume that anyone using a foreign data link is a foreigner.”
To do as much, the NSA and GCHQ rely on capturing information being sent between company data centers around the globe, intercepting those bits and bytes in transit by tapping in as information is moved from the “Public Internet” to the private “clouds” operated by the likes of Google and Yahoo. Those cloud systems involve the linking of international data centers, each processing and containing huge troves of user information for potentially millions of customers. Intelligence officers who can sneak through the cracks when information is decrypted — or never encrypted in the first place — can then see the information sent in real time as take “a retrospective look at target activity,” according to documents seen by the Post.
“Because digital communications and cloud storage do not usually adhere to national boundaries, MUSCULAR and a previously disclosed NSA operation to collect Internet address books have amassed content and metadata on a previously unknown scale from US citizens and residents” Barton and Soltani reported.
“Data are an essentially global commodity, and the backup processes of companies often mean that data is replicated many places across the world,” The Post’s Andrea Peterson added in a separate report. “So just because you sent an e-mail in the US, doesn't mean it will always stay within the nation's borders for its entire life in the cloud.”
As data goes into those facilities outside of the US, the NSA and GCHQ have more tactics to deploy in order to obtain private communications. Additionally, Yahoo has not nor do they now have any plans to deploy encryption technology to secure communications, suggesting the data of their millions of users was passed in-the-clear through international data centers, ripe to be intercepted by the intelligence community.
“Google and Yahoo generally connect their data centers over
privately owned or leased fiber-optic cables, which do not share
traffic with other Internet users and companies, to enable the
tasted connections and keep information secure,” Gellman
added in a separate article authored alongside the Post’s Todd
Linderman. “Unit recently, these internal data networks were
not encrypted. Google announced in September, however, that it is
moving quickly to encrypt those connections. Yahoo’s data center
links are not encrypted.”
“It’s an arms race,” Eric Grosse, Google’s vice president
for security engineering, told the Post last month. “We see
these government agencies as among the most skilled players in
this game.”
After hearing ot the MUSCULAR program by the Post, Google said in a statement that they were “troubled by allegations of the government intercepting traffic between our data centers, and we are not aware of this activity.”
“We have long been concerned about the possibility of this kind of snooping, which is why we continue to extend encryption across more and more Google services and links,” the company said.
“We have strict controls in place to protect the security of
our data centers, and we have not given access to our data
centers to the NSA or to any other government agency,"
insisted Yahoo.
Only hours before the latest Snowden leak was made public, NSA Director Keith Alexander told a Congressional panel that the illegal, unconstitutional revelations helped terrorist intent on killing Americans. Answering a question from Rep. Michele Bachmann (R-Minnesota) about the effect of the leaks on national security, Alexander and Director of National Intelligence James Clapper both said the disclosure have and will continue to cause major damage to the US.
At that same hearing, Alexander admitted that the NSA “compels” telecommunication companies to provide the government with user intelligence.
"Nothing that has been released has shown that we’re trying to do something illegal or unprofessional,” Alexander added.