NSA chief asks tech firms to team on cybesecurity

Gen. Keith Alexander, head of the embattled National Security Agency (NSA), says he is willing to share cyberattack information with the private sector—an offer seen as a Trojan horse by at least one expert.

Gen. Keith Alexander

Last week, Alexander told attendees of his keynote at the Billington Cybersecurity Summit that the NSA, the FBI, the Department of Homeland Security (DHS), and the CIA are ready to pass information back and forth with a select group of private organizations, provided they get the authorization from Congress.

"We need the authority for us to share with them and them to share with us," Alexander said, reported Kaspersky Labs' ThreatPost security website.

Alexander's comments came a day after U.S. Sen. Dianne Feinstein, chairwoman of the Senate Intelligence Committee, told The Hill newspaper that she planned to move forward with a draft of the Senate's version of the Cyber Intelligence Sharing and Protection Act (CISPA). The House version passed in April.

In general, CISPA would remove the threat of privacy lawsuits companies face in sharing cyberattack data with each other and the government. The legislation would also set the rules for the government to share sensitive information.

Most experts agree that information-sharing would bolster the defenses of the nation's financial institutions and critical infrastructure providers, such as utilities, water facilities, and oil and gas pipelines. The disagreement is over how the transfer of data to the government can be done without compromising privacy.

Revelations of massive NSA data gathering from telecom and Internet companies has sparked a fierce national debate on whether the spy agency's antiterrorism activities have gone too far in collecting information on innocent Americans.

In claiming the NSA has done nothing illegal, Alexander blamed calls from Capitol Hill to restrict government surveillance on "sensationalized" reporting and "media leaks," Politico reported he said in his speech.

Instead of less information, the NSA needs more from the private sector to stop cyberattacks against key industries before they start. "Right now, what happens is the attack goes on and we're brought in after the fact," ThreatPost reports Alexander as saying. "And I can guarantee you 100 percent of the time we cannot stop and attack after the fact."

However, Jerry Brito, senior research fellow with the Mercatus Center at George Mason University, said the NSA already had the authority to share data if it really wanted to. The agency could declassify information on its own and pass it along to companies.

"There's nothing stopping them today from sharing data from the NSA to these companies," said Brito, who heads Mercatus' Technology Policy Program. "What they really want is more information about the communications of Americans under the rubric of cybersecurity information sharing."

Kevin Coleman, strategic management consultant at SilverRhino, was supportive of Alexander, saying information from the NSA and other federal agencies would help companies take the "proactive approach" needed to improve their cyberdefenses.

"This is a great step forward and if properly used by the nation's critical infrastructure providers will substantially improve their ability to defend against cyber threats that are growing in frequency and complexity," Coleman said. SilverRhino provides cybersecurity services to government agencies.

Alexander defended U.S. Internet companies including Google, Facebook, and Microsoft, whose images have been tainted by media reports of them sharing user information with the NSA. While referring to the companies only as the "industry," he said they "have taken a beating on this, and it's wrong."

View the original article here

Tech firms' responses to latest NSA disclosures cloud the truth, experts say

Technology companies may be hiding behind legal jargon to avoid being more forthcoming in their responses to new documents on government surveillance that were disclosed Friday, some experts say.

Internet and software companies including Microsoft, Yahoo, Google and Facebook “are legally compelled to lie,” said security expert Bruce Schneier, citing national security letters that companies are prohibited from disclosing.

Some similar statements were made in interviews with the IDG News Service following a report published Friday in The Guardian alleging that the National Security Agency paid millions of dollars to companies such as Google and Facebook to cover costs involved in surveillance.

The tech companies incurred these costs in fulfilling tighter certification requirements after a 2011 court ruling said the government’s data collection was unconstitutional, according to documents obtained by The Guardian.

That ruling, which was handed down by the Foreign Intelligence Surveillance Court and was made public on Wednesday, said that the way the NSA collected data violated the Fourth Amendment because the agency did not effectively design its collection efforts to target only foreigners of interest to national security.

The NSA was “misusing its authority” by collecting the digital communications of U.S. citizens for years, the ruling said.

The documents revealed Friday describe the problems that the agency experienced after that ruling and the resulting efforts required to bring companies into compliance, according to The Guardian. The list of involved companies includes Google, Yahoo, Microsoft and Facebook, its report said.

The documents were passed on to The Guardian by former NSA contractor Edward Snowden, the man behind the original leaks of various government surveillance programs such as Prism. The documents provide the first evidence of a financial relationship between technology companies and the NSA, the Guardian report said.

The FISA court is required to sign annual certifications that provide the legal framework for surveillance operations, the report said. After the 2011 ruling, those certifications were only being renewed on a temporary basis as the NSA worked to fix its data collection methods that the court deemed unconstitutional.

This adjustment process entailed huge costs, according to a 2012 NSA newsletter entry, excerpts of which were published by The Guardian. “Last year’s problems resulted in multiple extensions to the certifications’ expiration dates which cost millions of dollars for Prism providers to implement each successive extension,” the newsletter said.

The Guardian did not give an exact figure for the costs.

The latest disclosure raises serious questions around the use of taxpayer money to finance government surveillance, the Guardian said. But another issue is the growing discrepancy between the information contained in leaked government documents and technology companies’ responses to it.

Snowden’s original leaks revealing Prism described a program aimed at the mass collection of data owned by U.S. citizens through direct access to company servers. Google and other tech companies have denied cooperating with the NSA to allow the mass collection of data.

They gave similar denials on Friday in response to questions from the IDG News Service.

“Facebook has never received any compensation in connection with responding to a government data request,” a Facebook spokeswoman said.

“We think the continued misreporting on this matter by The Guardian and others is troubling,” she added in an email.

Google said it has “not joined Prism or any government surveillance programs.”

“We do not provide any government with access to our systems and we provide user data to governments only in accordance with the law,” a spokeswoman said.

Both Yahoo and Microsoft offered more legalistic, complicated responses. Their responses make it clear that the companies’ deals for government compensation are more complicated than something they can simply confirm or deny.

“Microsoft only complies with court orders because it is legally ordered to, not because it is reimbursed for the work,” a spokesman said. “We could have a more informed discussion of these issues if providers could share additional information, including aggregate statistics on the number of any national security orders they may receive,” he said.

Microsoft asked for permission in June to aggregate statistics about the number of requests for data it receives under the U.S. Foreign Intelligence Surveillance Act.

Currently, companies can reveal the number of FISA requests they receive only if they lump them together with all other requests from U.S. law enforcement agencies.

Yahoo said it had nothing to add beyond the statement that the company supplied to The Guardian, which said “federal law requires the U.S. government to reimburse providers for costs incurred to respond to compulsory legal process imposed by the government.”

“We have requested reimbursement consistent with this law,” the company said.

Semantics are at play in companies’ responses, experts said.

Friday’s leaked documents “say that these companies cooperate with bulk NSA data collection,” said Schneier. “The companies deny it, but their denials are precisely worded with a lot of wiggle room,” he said.

Also, if companies are compelled by a National Security Letter to comply, they are prohibited from talking about their compliance, Schneier said.

In its response Friday, Google said it continues to await the government’s decision on the company’s petition to publish more national security request data, “which will show that our compliance with American national security laws falls far short of the wild claims still being made in the press today.”

Roger Kay, an IT analyst and founder at Endpoint Technologies Associates, said he was not surprised by the documents that were revealed Friday. Though the companies don’t say whether they provided information to the government, the legalistic language in some of their responses suggests they did, he said.

Also, companies’ responses to the growing number of leaks, whether they are flat-out denials, chock full of complicated legalese, or just plain vague, are probably damaging some users’ trust in the companies, Kay argued.

But for Internet users with short attention spans, disclosures like the ones revealed Friday may just blow over, he added.

Still, many questions remain about the type of data collection that was paid for in the millions of dollars in compliance costs that companies reportedly incurred.

It’s not clear how the NSA gathers data from companies, Kay said. “Is it like a direct stethoscope into the main artery, or a broader snapshot?”

Getting answers to those kinds of questions may also boil down to semantics. “Perhaps different people mean different things by ‘direct access,’” said Seth Schoen, senior staff technologist at the Electronic Frontier Foundation.

In another new development, The Guardian and The New York Times announced on Friday that they would work as partners to give the U.S. paper access to other documents leaked by Snowden. Both papers will be working together to publish more stories tied to the documents.

View the original article here

Tech firms' responses to latest NSA disclosures cloud the truth, experts say

Technology companies may be hiding behind legal jargon to avoid being more forthcoming in their responses to new documents on government surveillance that were disclosed Friday, some experts say.

Internet and software companies including Microsoft, Yahoo, Google and Facebook “are legally compelled to lie,” said security expert Bruce Schneier, citing national security letters that companies are prohibited from disclosing.

Some similar statements were made in interviews with the IDG News Service following a report published Friday in The Guardian alleging that the National Security Agency paid millions of dollars to companies such as Google and Facebook to cover costs involved in surveillance.

The tech companies incurred these costs in fulfilling tighter certification requirements after a 2011 court ruling said the government’s data collection was unconstitutional, according to documents obtained by The Guardian.

That ruling, which was handed down by the Foreign Intelligence Surveillance Court and was made public on Wednesday, said that the way the NSA collected data violated the Fourth Amendment because the agency did not effectively design its collection efforts to target only foreigners of interest to national security.

The NSA was “misusing its authority” by collecting the digital communications of U.S. citizens for years, the ruling said.

The documents revealed Friday describe the problems that the agency experienced after that ruling and the resulting efforts required to bring companies into compliance, according to The Guardian. The list of involved companies includes Google, Yahoo, Microsoft and Facebook, its report said.

The documents were passed on to The Guardian by former NSA contractor Edward Snowden, the man behind the original leaks of various government surveillance programs such as Prism. The documents provide the first evidence of a financial relationship between technology companies and the NSA, the Guardian report said.

The FISA court is required to sign annual certifications that provide the legal framework for surveillance operations, the report said. After the 2011 ruling, those certifications were only being renewed on a temporary basis as the NSA worked to fix its data collection methods that the court deemed unconstitutional.

This adjustment process entailed huge costs, according to a 2012 NSA newsletter entry, excerpts of which were published by The Guardian. “Last year’s problems resulted in multiple extensions to the certifications’ expiration dates which cost millions of dollars for Prism providers to implement each successive extension,” the newsletter said.

The Guardian did not give an exact figure for the costs.

The latest disclosure raises serious questions around the use of taxpayer money to finance government surveillance, the Guardian said. But another issue is the growing discrepancy between the information contained in leaked government documents and technology companies’ responses to it.

Snowden’s original leaks revealing Prism described a program aimed at the mass collection of data owned by U.S. citizens through direct access to company servers. Google and other tech companies have denied cooperating with the NSA to allow the mass collection of data.

They gave similar denials on Friday in response to questions from the IDG News Service.

“Facebook has never received any compensation in connection with responding to a government data request,” a Facebook spokeswoman said.

“We think the continued misreporting on this matter by The Guardian and others is troubling,” she added in an email.

Google said it has “not joined Prism or any government surveillance programs.”

“We do not provide any government with access to our systems and we provide user data to governments only in accordance with the law,” a spokeswoman said.

Both Yahoo and Microsoft offered more legalistic, complicated responses. Their responses make it clear that the companies’ deals for government compensation are more complicated than something they can simply confirm or deny.

“Microsoft only complies with court orders because it is legally ordered to, not because it is reimbursed for the work,” a spokesman said. “We could have a more informed discussion of these issues if providers could share additional information, including aggregate statistics on the number of any national security orders they may receive,” he said.

Microsoft asked for permission in June to aggregate statistics about the number of requests for data it receives under the U.S. Foreign Intelligence Surveillance Act.

Currently, companies can reveal the number of FISA requests they receive only if they lump them together with all other requests from U.S. law enforcement agencies.

Yahoo said it had nothing to add beyond the statement that the company supplied to The Guardian, which said “federal law requires the U.S. government to reimburse providers for costs incurred to respond to compulsory legal process imposed by the government.”

“We have requested reimbursement consistent with this law,” the company said.

Semantics are at play in companies’ responses, experts said.

Friday’s leaked documents “say that these companies cooperate with bulk NSA data collection,” said Schneier. “The companies deny it, but their denials are precisely worded with a lot of wiggle room,” he said.

Also, if companies are compelled by a National Security Letter to comply, they are prohibited from talking about their compliance, Schneier said.

In its response Friday, Google said it continues to await the government’s decision on the company’s petition to publish more national security request data, “which will show that our compliance with American national security laws falls far short of the wild claims still being made in the press today.”

Roger Kay, an IT analyst and founder at Endpoint Technologies Associates, said he was not surprised by the documents that were revealed Friday. Though the companies don’t say whether they provided information to the government, the legalistic language in some of their responses suggests they did, he said.

Also, companies’ responses to the growing number of leaks, whether they are flat-out denials, chock full of complicated legalese, or just plain vague, are probably damaging some users’ trust in the companies, Kay argued.

But for Internet users with short attention spans, disclosures like the ones revealed Friday may just blow over, he added.

Still, many questions remain about the type of data collection that was paid for in the millions of dollars in compliance costs that companies reportedly incurred.

It’s not clear how the NSA gathers data from companies, Kay said. “Is it like a direct stethoscope into the main artery, or a broader snapshot?”

Getting answers to those kinds of questions may also boil down to semantics. “Perhaps different people mean different things by ‘direct access,’” said Seth Schoen, senior staff technologist at the Electronic Frontier Foundation.

In another new development, The Guardian and The New York Times announced on Friday that they would work as partners to give the U.S. paper access to other documents leaked by Snowden. Both papers will be working together to publish more stories tied to the documents.

View the original article here

Tech firms squirm over their role in Prism surveillance

The disclosures about the National Security Agency's massive global surveillance by Edward Snowden, the former information-technology contractor who's now wanted by the U.S. government for treason, is hitting the U.S. high-tech industry hard as it tries to explain its involvement in the NSA data-collection program.

Last week, a gaggle of 22 large U.S. high-tech firms—including Apple, Facebook, Google, Microsoft, and Yahoo which have acknowledged they participate in NSA data-gathering efforts in some form, if not exactly as Snowden and some press reports have described it—begged to be freed from the secrecy about it in their pleading, public letter to President Obama, NSA director Keith Alexander, and a dozen members of Congress.

The July 18 A letter from America's high-tech powerhouses, which was also signed by almost three dozen nonprofit and trade organizations as well as six venture-capital firms, begged for "greater transparency around national security-related requests by the US government to Internet, telephone, and web-based service providers" in terms of how much information the government demands on high-tech customers and subscriber accounts and how.

The letter begged for the U.S. government to make the amount of requests the government makes related to national security for individual customer information public.

"This information about how and how often the government is using these legal authorities is important to the American people, who are entitled to have an informed public debate about the appropriateness of those authorities and their use, and to international users of US-based service providers who are concerned about the privacy and security of their communications.," the letter to President Obama, Congress, the NSA director and Director of National Intelligence, stated yesterday.

The revelations last month from Snowden about NSA's extensive involvement in U.S. high-tech firms for purposes of information collection has suddenly put the U.S. high-tech industry on the defensive as they struggle to offer an explanation about all this to their global users while still bound by secrecy under the U.S. Patriot Act. There's no indication yet from the White House or others in government that any change in the NSA spying program, which relies on the participation of U.S.-based firms, will change.

"This should be debated in a public setting," said John Dickson, principal at security firm Denim Group and a former U.S. Air Force officer, about the situation in which NSA's global surveillance is tied so clearly to U.S.-based companies. He noted the U.S. government has actually said little but the media much.

This is all putting tremendous pressure on the U.S. high-tech industry, especially abroad in Europe where privacy questions may be making U.S. industry seem less competitive. This week Brad Smith, Microsoft general counsel and executive vice president, legal and corporate affairs at Microsoft, A issued a public statement that sought to clarify Microsoft's participation in the U.S. government's content gathering methods.

""Recent leaked documents have focused on the addition of HTTPS encryption to Outlook.com instant messaging, which is designed to make this content more secure as it travels across the Internet," Microsoft counsel Smith wrote. "To be clear, we do not provide any government with the ability to break the encryption, nor do we provide the government with the encryption keys. When we are legally obligated to comply with demands, we pull the specified content from our servers where it sits in an unencrypted state, and then we provide it to the government agency."

Microsoft's SkyDrive and Skype A is handled somewhat similarly in terms of government requests, Smith said. As far as enterprise and document storage for business customers, "we take steps to redirect the government to the customer directly, and we notify the customer unless we are legally prohibited from doing so," Smith stated in his July 16 post. "We have never provided any government with customer data from any of our business or government customers for national security purposes."

Smith added Microsoft got four requests related to law enforcement in 2012. "We do not provide any government with the ability to break the encryption used between our business customers and their data in the cloud, nor do we provide the government with the encryption keys."

In the meantime, it's safe to assume in this NSA leaks debacle that "the bad guys have switched tactics" and probably wouldn't use U.S.-based high-tech services, Dickson points out. And in this atmosphere of rising cyber-nationalism, the possible role of China's government and its own high-tech industry have to be asked, too, he noted.

Former head of the U.S. Central Intelligence Agency and the NSA, Gen. Michael Hayden, recently charged forward on that topic in an interview with The Australian Financial Review.

Hayden said he believes that China-based network vendor Huawei conducted clandestine activities and shared with the Chinese state "intimate and sensitive knowledge of the foreign telecommunications systems it is involved with." According to the published report, Gen. Hayden said the Huawei is a significant security threat to Australia and the U.S., has spied for the Chinese government, and intelligence agencies have evidence of this.

A Huawei spokesman, John Suffolk, Huawei's global cyber security officer, is quoted by the Australian publication yesterday as calling Hayden's remarks "unsubstantiated and defamatory" and that any critics of the company should present any evidence publicly.In an opinion piece on CNN.com today, Gen. Hayden railed openly against Edward Snowden as a national security threat, saying he "fled to China with several computers' worth of data from NSANET, one of the most highly classified and sensitive networks in American intelligence."

Hayden acknowledged that one aspect of the fallout from Snowden's leaks is that "the undeniable economic punishment that will be inflicted on American businesses for simply complying with American law."

Hayden's remarks on CNN also seem to sarcastically criticize the Europeans now complaining about the NSA activities and how they may violate European data-privacy laws. "Others, most notably in Europe, will rend their garments in faux shock and outrage that these firms have done this, all the while ignoring that these very same companies, along with their European counterparts, behave the same way when confronted with the lawful demands of the European states."

Hayden continued: "The real purpose of those complaints is competitive economic advantage, putting added burdens on or even disqualifying American firms competing in Europe for the big data and cloud services that are at the cutting edge of the global IT industry."

As if all this weren't enough, former President Jimmy Carter also spoke out yesterday on NSA global surveillance, suggesting the NSA data collection practices were harming democracy. Former president Carter also said Edward Snowden's revelations didn't really harm national security and and was actually "beneficial" because "they inform the public."

Ellen Messmer is a senior editor at Network World. She covers news and technology trends related to information security.
More by Ellen Messmer

View the original article here