NSA's access to Microsoft's services detailed

[takeru]

http://www.bbc.co.uk/news/technology-23285642

Microsoft helped the NSA get around its encryption systems so the agency could more easily spy on users of its services, reports suggest.

Papers given to The Guardian newspaper allege there were close links between the security agency and the tech firm.

Microsoft said its collaboration with the NSA only took place because legal obligations required it to do so.

The revelations come as some technologists start work on services they say will be impervious to spying.
Secure view

The information published in The Guardian comes from documents it said were given to the paper by whistle blower Edward Snowden and shed more light on how closely tech firms work with the US National Security Agency and its Prism programme.

The documents show that the NSA had access to most of Microsoft's flagship products including Hotmail, Outlook.com, SkyDrive and Skype. In the case of Outlook.com, Microsoft reportedly worked with the NSA to help it get around its own data-scrambling scheme that would have concealed messages from the agency.

In addition, soon after Microsoft bought Skype it had helped the intelligence agency "triple" the number of calls passing through the web phone service that could be intercepted.

Even before Skype was bought by Microsoft it was providing information on some of its users through Prism.

The documents seen by The Guardian are reportedly from the NSA's Special Source Operations office which oversees the links between the agency and tech firms. The documents show that the access the NSA enjoyed made it far easier for intelligence workers to get at accounts on many Microsoft services.

In a statement released in the wake of the Guardian story, Microsoft said "legal obligations" forced it to work with the NSA and provide access to its services.

"We have clear principles which guide the response across our entire company to government demands for customer information for both law enforcement and national security issues," it said.

In some cases when it upgraded or updated products, it said, these legal obligations meant it had to preserve the access that law enforcement and intelligence agencies enjoyed with older versions of those services.

It said it only complied with orders relating to "specific accounts and identifiers" rather than more wide-ranging requests.

"Microsoft does not provide any government with blanket or direct access to SkyDrive, Outlook.com, Skype or any Microsoft product," it said.

The revelations come as three Swedish technology entrepreneurs seek donations for a smartphone messaging app that, it is claimed, will be impervious to the type of spying used by the NSA. In less than two days, more than $137,000 (£90,000) has been raised for the Heml.is app which has the backing of Pirate Bay co-founder Peter Sunde.

"We're building a message app where no one can listen in, not even us," the entrepreneurs said in a video explaining how Heml.is would work.

 

[lxskllr]

I'm shocked! I never would have guessed closed source software would conceal backdoors and bugs. I thought money made everything right.

 

[mmntech]

What surprises people the most is not that companies are doing it. We've known about it for years. It's the sheer scale of it all and how openly complicit tech companies were with government authorities. These same companies who have attacked foreign nations like China for doing the same thing. I'm looking at you Google.

The one positive about Snowden's leak, it's got people asking questions. Especially given that terrorism is such an abstract concept. Who are these terrorists? Why must all US and foreign citizens be monitored? It's really hard to justify that while at the same time attacking the lack of free speech and privacy rights in other countries. It paints the US government as the hypocrites they are. What do you do as an American? It's a two party system and both parties have been equally complicit in this issue.

It's trite to say it's a slippery slope, but I will anyway. There's a rumour going around that the NSA has been "monitoring" political protests within the United States, and sending agents out to them. Some are saying it's an intimidation tactic. It sounds silly at first until you recall the IRS-Tea Party scandal. An arm of the government being used to allegedly harass a powerful political opponent of the president. That should worry liberals and conservatives alike.

 

[OlafSicky]

Most tech savvy people knew this for years or at lest suspected. It looked like the public might raise their eyebrows but they haven't this simply isn't a water cooler conversation. People just don't care it's the I have nothing to hide scenario.
I would be interested to know if Firefox and Linux have worked with NSA and what is a secure mail app these days.

 

[SunnyD]

So, who here is actively using Microsoft NSADrive?

 

[mshan]

What is sad is comments original NSA leakers made in USA Today article when Snowden leak was just occurring (data base is not encrypted, and I think original leakers said there is no system to document who makes attempts to log into database):

"Q: Is there a way to collect this data that is consistent with the Fourth Amendment, the constitutional protection against unreasonable search and seizure?


Binney: Two basic principles you have to use. ... One is what I call the two-degree principle. If you have a terrorist talking to somebody in the United States — that's the first degree away from the terrorist. And that could apply to any country in the world. And then the second degree would be who that person in the United States talked to. So that becomes your zone of suspicion.

And the other one (principle) is you watch all the jihadi sites on the Web and who's visiting those jihadi sites, who has an interest in the philosophy being expressed there. And then you add those to your zone of suspicion.

Everybody else is innocent — I mean, you know, of terrorism, anyway.

Wiebe:Until they're somehow connected to this activity.

Binney: You pull in all the contents involving (that) zone of suspicion and you throw all the rest of it away. You can keep the attributes of all the communicants in the other parts of the world, the rest of the 7 billion people, right? And you can then encrypt it so that nobody can interrogate that base randomly.

That's the way of preventing this kind of random access by a contractor or by the FBI or any other DHS (Department of Homeland Security) or any other department of government. They couldn't go in and find anybody. You couldn't target your next-door neighbor. If you went in with his attributes, they're encrypted. ... So unless they are in the zone of suspicion, you won't see any content on anybody and you won't see any attributes in the clear. ...

It's all within our capabilities.

Drake: It's been within our capabilities for well over 12 years.

Wiebe:Bill and I worked on a government contract for a contractor not too far from here. And when we showed him the concept of how this privacy mechanism that Bill just described to you — the two degrees, the encryption and hiding of identities of innocent people — he said, "Nobody cares about that." I said, "What do you mean?"

This man was in a position to know a lot of government people in the contracting and buying of capabilities. He said. "Nobody cares about that."


http://www.usatoday.com/story/news/...istleblower-nsa-officials-roundtable/2428809/

 

[lxskllr]

So, who here is actively using Microsoft NSADrive?

The file size limits are too small. I'd use it to backup unimportant data, but it's hard working within their constraints. Some time I'll get around to seeing if I can do anything useful with it.

 

[Nintendesert]

I'm shocked! I never would have guessed closed source software would conceal backdoors and bugs. I thought money made everything right.

Just wait until you realize who is running all the tor exit nodes. :whiste:

 

[lxskllr]

Just wait until you realize who is running all the tor exit nodes. :whiste:

That's fine. Tor's for anonymity, and can be used anonymously when properly used.

 

[bradley]

Remember when they used to call people who believed these things tin-foil wearing conspiracy theorists?

 

[Golgatha]

Remember when they used to call people who believed these things tin-foil wearing conspiracy theorists?

I've been called cynical and worse for saying these types of things for years. Even though the leaks are out, it makes me sad there seems to be little, if any, outrage or rising up of the populous.

 

[bradley]

I might have to switch back to Linux. Obviously Microsoft cannot be trusted.

 

[Sonikku]

Xbox One. Official video game console of the White House.

 

[mshan]

"Apple appears to be immune from this unprecedented breach of customer loyalty, if only for now, although open-sourced Linux may not be as lucky:

“Apple (AAPL) does not accept source code from any government agencies for any of our operating systems or other products,” says Kristin Huguet, a spokeswoman for the company.

It’s not known if any other proprietary operating systems are using NSA code.

SE for Android is an offshoot of a long-running NSA project called Security-Enhanced Linux. That code was integrated a decade ago into the main version of the open-source operating system, the server platform of choice for Internet leaders including Google, Facebook (FB), and Yahoo! (YHOO).

Jeff Zemlin, the executive director of the Linux Foundation, says the NSA didn’t add any obvious means of eavesdropping.

“This code was peer-reviewed by a lot of people,” he says."​

http://www.zerohedge.com/news/2013-...oid-os-bugging-three-quarters-all-smartphones

​

 

[lxskllr]

http://www.zerohedge.com/news/2013-...oid-os-bugging-three-quarters-all-smartphones

​

Because promises from a malevolent company whose only interest is in making money is better than a code review :^S

 

[Jeff7]

The revelations come as some technologists start work on services they say will be impervious to spying.

Unless the government subtly threatens someone high in a chain of management, possibly with something as simple as financial damage (Headlines of "Company-A Concealing Terrorist Plot" = crumbling stock prices), or maybe something even more coercive. Even just the threat of legal action against the company, such as a government subpoena to gain access, or even a lawsuit, could make big shareholders nervous.

What surprises people the most is not that companies are doing it. We've known about it for years. It's the sheer scale of it all and how openly complicit tech companies were with government authorities. These same companies who have attacked foreign nations like China for doing the same thing. I'm looking at you Google.

The one positive about Snowden's leak, it's got people asking questions. Especially given that terrorism is such an abstract concept. Who are these terrorists? Why must all US and foreign citizens be monitored? It's really hard to justify that while at the same time attacking the lack of free speech and privacy rights in other countries. It paints the US government as the hypocrites they are. What do you do as an American? It's a two party system and both parties have been equally complicit in this issue.
...

It seems we're progressing toward defining it as, "Anyone who can conveniently and believably be labeled as a terrorist."

I've been called cynical and worse for saying these types of things for years. Even though the leaks are out, it makes me sad there seems to be little, if any, outrage or rising up of the populous.

So often it's the "I have nothing to hide" excuse.

"Really now? So you follow every law on the books which apply to your particular region?"

 

[lxskllr]

So often it's the "I have nothing to hide" excuse.

"Really now? So you follow every law on the books which apply to your particular region?"

http://www.wired.com/opinion/2013/0...-is-the-wrong-way-to-think-about-surveillance

 

[mshan]

Who's the dude to the left of Assange?


To me, the bigger issue than executive overreach / government overreach, is that there are no real safeguards of the database (encryption, logs of anyone attempting to query data base?) or real oversight by Congress:

"Radack: Congress has been a rubber stamp, basically, and the judicial branch has been basically shut down from hearing these lawsuits because every time they do they are told that the people who are challenging these programs either have no standing or (are covered by) the state secrets privilege, and the government says that they can't go forward. So the idea that we have robust checks and balances on this is a myth.

Binney: But the way it's set up now, it's a joke. I mean, it can't work the way it is because they have no real way of seeing into what these agencies are doing. They are totally dependent on the agencies briefing them on programs, telling them what they are doing. And as long as the agencies tell them, they will know. If they don't tell them, they don't know. And that's what's been going on here.

And the only way they really could correct that is to create billets on these committees and integrate people in these agencies so they can go around every day and watch what is happening and then feed back the truth as to what's going on, instead of the story that they get from the NSA or other agencies. ...

Even take the FISA court, for example. The judges signed that order. I mean, I am sure they (the FBI) swore on an affidavit to the judge, "These are the reasons why," but the judge has no foundation to challenge anything that they present to him. What information does the judge have to make a decision against them? I mean, he has absolutely nothing. So that's really not an oversight."


http://www.usatoday.com/story/news/...istleblower-nsa-officials-roundtable/2428809/

What Snowden disseminated would seem to be a great deterrant against potential homegrown terrorists who might or might not ultimately be pushed to act by radicalization. Real professional terrorists must have assumed all of this monitoring a decade ago, and like the Zero Dark Thirty movie mentioned, it is their tradecraft (?), or how extensively they go to stay off the grid with cell phones, etc that identifies them for drone strike.

I also definitely don't give Obama any sort of pass on this. Question is how much did he know (e. g. was his confidante Susan Rice put in as NSA chief so he can better gauge what has been hidden from him), did he just go with the flow, and probably most importantly, what is he going to do now that Snowden has made these revelations (he is a constitutional lawyer and he has only been in presidential bubble for four years. He presumably has some grounding from not growing up in an environment of excess wealth and presumed privilege, such as David Rockefeller (one of the sons of the son of original Rockefeller, who from what I recall of PBS show, was like richest man in world because breakup of Standard Oil made holdings even more valuable).

This whole program does seem it it is just a continuation of Bush / Cheney / General Richard Haydn and his total awareness program.

And as far as what is publicly known, this vast program didn't detect Tsaranev in time to stop the plot... (older brother seemed really radicalized, so sounds like he wouldn't have been dissuaded from attack by knowing extent of NSA spying. Younger brother seems like it might have been able to deter him (if he truly wasn't willing to die for his cause, knowing that he will eventually be found, tried, and spend rest of his life in prison should be pretty good deterrant for some potential home grown terrorists conceivably vulnerable to radicalization).

 

[lxskllr]

Who's the dude to the left of Assange?

Richard Stallman. Founder of the GNU operating system, and leader of the FSF.

https://en.wikipedia.org/wiki/Richard_stallman

I hold Obama more accountable than Bush. Not only has he gone back on his campaign rhetoric, he's extended Bush's policies. Bush was dumb as a rock, and believed in voodoo. He did what he said he'd do, and his actions could be inferred by his words. What's Obama's excuse?

 

[mshan]

"What's Obama's excuse?"

I don't know, and I definitely don't give him a pass.

But ultimately, it is probably more important what he does now that the beans have been spilled, rather than just continuing to go with the flow / become part of the elite establishment / or even just being deliberately kept out of loop on extent of government overreach (e. g. one of his closest confidantes, Susan Rice insertion as NSA chief recently, I think just days before the Snowden story was all over the news).

I remember Papa Bush warning "W" about the people he was dealing with when they approached him about presidential run in 2000 (Cheney, etc.). Bush, like you said, was all to willing to truly believe he was the messiah and all the you're either with us or against us rhetoric from 9/11 (vs. his father, who may have been ruthless, but understood levels of grey in world politics and at least gave us competent governance, just like Obama).

 

[colonelciller]

sinking ship

 

[halik]

http://www.zerohedge.com/news/2013-...oid-os-bugging-three-quarters-all-smartphones

​

So? If the source is open, what's the big deal?

 

[Vdubchaos]

I wonder how much of this NSA crap effects business and their relationship with companies like MS and even Google.

One would think this entire thing has IT Security scrambling....

 

[mshan]

So? If the source is open, what's the big deal?

I just put up that link in response to Bradley's comments about switching back to Linux.

Just thought he should know.

Nothing more, nothing less.