Slashdot Mirror
How Big Companies Can Hamper the Surveillance Infrastructure
Trailrunner7 writes "Buried underneath the ever-growing pile of information about the mass surveillance methods of the NSA is a small but significant undercurrent of change that's being driven by the anger and resentment of the large tech companies that the agency has used as tools in its collection programs. The changes have been happening since almost the minute the first documents began leaking out of Fort Meade in June. When the NSA's PRISM program was revealed this summer, it implicated some of the larger companies in the industry as apparently willing partners in a system that gave the agency 'direct access' to their servers. Officials at Google, Yahoo and others quickly denied that this was the case, saying they knew of no such program and didn't provide access to their servers to anyone and only complied with court orders. More recent revelations have shown that the NSA has been tapping the links between the data centers run by Google and Yahoo, links that were unencrypted. That revelation led a pair of Google security engineers to post some rather emphatic thoughts on the NSA's infiltration of their networks. It also spurred Google to accelerate projects to encrypt the data flowing between its data centers. These are some of the clearer signs yet that these companies have reached a point where they're no longer willing to be participants, witting or otherwise, in the NSA's surveillance programs."
If you want large companies to not perform surveillance, move them to a country where the government cant secretly compel them to do what every they want.
Due to US cryptography export restrictions, its likely easier to actually provide some security if you leave the US too.
Outsource freedom: because losing the jobs isn't enough anymore.
They aren't getting *nearly* paranoid enough. They should be encrypting the data on disk, on network connections between machines in the *same* data center, not just between centers. In fact the data should remain encrypted at all times unless absolutely necessary to have in clear-text to process it -- and that should never leave the CPU. It should remain clear-text only for the absolutely minimum time required.
They should assume that hostile agencies (foreign *and* domestic) have tapped every last network link they own. As well as most routers and processing machines. They should also assume that some small percentage of their workforce are working on behalf of one of these adversaries. Given these assumptions they should design a system that can remain as secure as possible given these circumstances.
Merely encrypting the network links between their data centers is not nearly enough to thwart the likes of the NSA, CSEC, GCHQ or other nameless agencies.
Ian Ameline
Too bad secret laws exist to force you, even if you don't want, and to not say that you are doing it. And a lot could want anyway, as could be incentives to make it desirable (like obtained secrets of competitors, "friendly" judges and so on). In any case, American companies can't be trusted, and big enough from other countries on line with this (UK, Australia, Sweden, Israel, maybe whoever signs the TPP, etc) probably should be avoided too.
The genie is out of the bottle. Users, particularly non-USA users, will never again trust American internet service providers. I expect far-reaching ramifications, the extent of which wont be fully known for a couple years.
Mass surveillance and data collection is the business model at companies like Google and Yahoo. If their frustrations are genuine it is only that they are angry that their data is being taken without being properly paid for it.
"If it looks like a duck, ..."
"You probably know that one.
"Please tell me, what is all this drive towards one account, no anonymity, all this cloud ...",
and data storage about?
"You have been convicted of privacy transgressions before, althougn admiitedly minor
compared to the Nefarious Scumbag Assholes".
"Please, Miss Google, get some clue that 'appearances are against you', as they say"
"Why is it that I, a prolific and avid googler, have never seen on your sites, never once
among the many times I pass by on a single day, any statement to the effect that you
despise the NSA, that you will not commit my data to them, that
"well, you know what I mean (actually I suspect you know I'm mean)"
"Dear Google, are you with me or against me".
"Whatever happened to 'Do no evil'. Was that just a hollow PR ploy? An imperative
to the 'other players' and something to pat yourself on the back with now and then?"
"In fact Google --since you started it (the mentioning)-- how do you define evil?"
"it would be nice to get you enlightened insights, preferably with a name under it".
"Nothing personal -- just accountability, you know"
"Thank you".
or maybe their protests and hand-wringing and emphatically blogged thoughts are just business as usual - corporations routinely pay spin doctors to advise them on what to do and how to manipulate opinion whenever they get caught doing stuff they're not supposed to.
to their way of thinking reality is nothing, perception is everything.
Encrypting by the big players is significant, the data streams between their centers effectively mirrors all they have, from the POV of the government sanctioned goons it is about as good as you're going to get without the need to physically enter the server rooms.
A small forum is obviously not using a secure connection to hide their data but instead it's meant to secure the login process.
Yet it shows not only the big enterprises are able to improve security and especially the privacy of their users
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
The big tech companies want to appear to be unwilling to cooperate with spying. But what's to keep them from secretly cooperating all the same?
Distrusted cloud services get abandoned, which costs them money, which costs their stock prices, which costs millions of middle Americans stock price, which drives a stake of fear into the hearts of Congress.
Let the money issue work *for* you.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Microsoft helping NSA to hack your Windows
According to a new report from the corporate press (as corporate as it can get, being Bloomberg), Microsoft tells NSA staff about universal unpatched holes before they are being addressed:
Microsoft Corp. (MSFT), the worldâ(TM)s largest software company, provides intelligence agencies with information about bugs in its popular software before it publicly releases a fix, according to two people familiar with the process. That information can be used to protect government computers and to access the computers of terrorists or military foes.
Redmond, Washington-based Microsoft (MSFT) and other software or Internet security companies have been aware that this type of early alert allowed the U.S. to exploit vulnerabilities in software sold to foreign governments, according to two U.S. officials. Microsoft doesnâ(TM)t ask and canâ(TM)t be told how the government uses such tip-offs, said the officials, who asked not to be identified because the matter is confidential.
Frank Shaw, a spokesman for Microsoft, said those releases occur in cooperation with multiple agencies and are designed to be give government âoean early startâ on risk assessment and mitigation.
Glyn Moody asked, âoewhy would anyone ever trust Microsoft againâ¦?â
Frank Shaw is not a technical man. His job is to lie, e.g. about sales of Vista 8 (quite famously and most recently). He came from Waggener Edstrom, a lying and AstroTurfing company. The above should be read as follows: when new holes exist which permit remote hijacking the unaccountable, cracking-happy NSA is being notified. What can possibly go wrong now that we have proof that the NSA is cracking PCs abroad with impunity?
Some of the back and forth is innocuous, such as Microsoft revealing ahead of time the nature of its exposed bugs (ostensibly providing the government with a back door into any system using a Microsoft OS, but since itâ(TM)s donâ(TM)t ask, dontâ(TM) tell, nobody really knows). However the bulk of the interaction is steeped in secrecy: âoeMost of the arrangements are so sensitive that only a handful of people in a company know of them, and they are sometimes brokered directly between chief executive officers and the heads of the U.S.â(TM)s major spy agencies, the people familiar with those programs said.â
Disobey WHAT?
Taping into data links between corporate data centers was not done with a warrant or a court order.
There is nothing to Obey. It was simply unreasonable search and seizure.
Sig Battery depleted. Reverting to safe mode.
TFA just says tech giants do not want to cooperate with NSA. No real news here. Save your time, skip that one.
Look what happened to Quest and their CEO after refusing to give up data to the NSA.