IBM Distances Itself From the NSA and Its Spy Activities

An anonymous reader writes "NSA surveillance has raised concerns among customers globally about the safety of their data from U.S. government spying. More organizations, companies and countries are looking for ways to distant themselves from the NSA activities to safeguard the information of internet users. IBM is the latest to fall into the category of companies that do not want to be associated with the NSA spy activities."

Comments

Lip service?

[Anonymous Coward]

Are they also stopping donations to politicians who support the NSA activity?

Re:Lip service?

[Frobnicator]

It isn't just that.

Snowden documents and news reports do the affiliation they need. They proudly proclaim that they use IBM's cloud-based processing systems for processing.

If IBM really wants to distance themselves, they should cancel these contracts.

Re:Lip service?

[MrBigInThePants]

Not at all lip-service. Just the plebs using the wrong context.

When the plebs say "distance" they mean financially, contractually and to uncomfortably avoid eye contact at dinner parties and whisper nasty about them behind their back.

When IBM says it they mean in terms of marketing/PR/Branding only.

This whole NSA fiasco is only a minor inconvenience that has exposed a few flaws in the way they keep their evil shit hidden. It will in the long term only serve to make them better at it. There is already talk of new systems and procedures that do essentially the same thing using legal loopholes and new laws to create more holes to hide in.

This will only make the police/surveillance state stronger.

Re:Lip service?

[Anonymous Coward]

If IBM really wants to distance themselves, they should cancel these contracts.

IBM cancel a government contract? That right there is why funny comments deserve karma.

But they can't tell you

[bob_super]

"IBM promised to challenge the U.S national security via court procedures if ordered to provide information and data from an enterprise client through a gag order which prohibits them from discussing the order with the client."

Sure, I've got THOUSANDS of lawsuits already in secret court against the big bad abusive government!
Nope, can't give you details. It's secret, you know.
Just trust me...

Re:But they can't tell you

[davester666]

This is nothing. If they are willing to help Hitler [yay, I godwin'd the thread] track Jews, they will do anything for a buck. And the NSA carries it around in trucks.

They just are doing this public distance thing, so they can get the NSA dollars AND the dollars from non-US companies.

Re:But they can't tell you

[cavreader]

IBM conducted normal business actions when the sold IBM systems to Germany before the war and the death camps were known. Has it come to point where those who sell computer systems are responsible for what others will use the systems for?

Re:But they can't tell you

[davester666]

It's not like there are a bunch of people happy to stand up and say "Hey, we made all this great hardware and software for the NSA. Just think of what we can do for you!"

No. The people who did/are doing this are very quiet, but busy selling that same technology to everybody else who wants to oppress their population.

Re:But they can't tell you

[Threni]

You're missing the point. From Wikipedia:
---
The 1933 census, with design help and tabulation services provided by IBM through its German subsidiary, proved to be pivotal to the Nazis in their efforts to identify, isolate, and ultimately destroy the country's Jewish minority. Machine-tabulated census data greatly expanded the estimated number of Jews in Germany by identifying individuals with only one or a few Jewish ancestors. Previous estimates of 400,000 to 600,000 were abandoned for a new estimate of 2 million Jews in the nation of 65 million.[15]
---

Don't think of Nazi activities as the time of the war (1939-45) only because their evil started long before then, and IBM were there to help.

Re:But they can't tell you

[DarkOx]

Has it come to point where those who sell computer systems are responsible for what others will use the systems for?

No not in general but I think there is an individual moral obligation to not enable others to do something evil.

Imagine you are running a gun shop. A normal looking guy comes into the store, he is not terribly over or under dressed, does not seem agitated, seems like he has done his homework asks to look at a specific model and than to buy it. You don't ask a whole lot of followup questions and conduct the sale. Have you done anything wrong and are you responsible if he does something wrong later; I would say no.

No Imaging you are running a gun shop. A guy walks in wearing a dirty t-shirt, he seems really jumpy, a says "I need something cheap to off my bitch and her stupid kid". You pull up something from behind the counter and complete the sale. Have you done anything wrong and are at least partly responsible if he does something wrong later; I would say yes you had good cause to think this guy was going to something really really bad and you just made it easier for him.

So yes in the post Snowden context if you are selling equipment to the NSA you know can be used to aide in the abuse of others rights; until there is evidence real reforms I think it makes you a collaborator.

Re:But they can't tell you

[cavreader]

Sorry but a gun shop example is no where near equivalent to selling computing equipment that can be used for a variety of legitimate reasons. Last time I checked a background check wasn't required to purchase a computer. The Germans bought computer systems from IBM and then put some of them to use with keeping track of people were actively seeking to eradicate. Blaming IBM for selling the systems which also had legitimate uses is a little much. Did IBM provide a "TracktheJews" or "MaximumKill" application for the Germans? The true horror of the holocaust is that at the time Germany was at the forefront of pushing new technologies and had a lot of brilliant scientists, engineers, and highly regarded universities to educate their people. They were one of the most civilized countries on the planet at the time. However these educated and civilized people sat down and used their engineering, medical, and logistical skills to develop the most cost effective way to kill the most people in the shortest amount of time. Someone set down and drafted architectural blueprints for the death factories, highly efficient industrial ovens, and gas delivery systems. Chemists used their skills to figure out which gas or toxin was the most efficient by testing their ideas on sample groups of human beings. Highly trained Medical doctors experimented on human beings to push the boundaries of medical science. These people were not radical psychopaths, one off evil masterminds, or the indoctrinated Islamist lunatics we see running around today indiscriminately killing anyone who looks sideways at them using whatever method is handy. And the kicker is after the war the victors went around a collecting as many of these people they could find so they could use these top engineers and scientists for their own purposes.

Re:But they can't tell you

[drinkypoo]

IBM conducted normal business actions when the sold IBM systems to Germany before the war and the death camps were known.

Was it normal business action when the service contract fees during the war were still being paid directly to Armonk, NY?

Re:But they can't tell you

[cavreader]

Once again. It's a general computer system that can be put to use for all types of normal business and government related tasks. There were no trade sanctions that prevented countries from doing business with Germany. It's not like IBM supplied the actual applications. And you have the advantage of hindsight when forming your opinions. You can't view historical conflicts using today's societal world view.

Re:But they can't tell you

[davester666]

Really? You think IBM supplied them a newfangled computer, one of only what? a couple dozen at the time? and DIDN'T also write the program running on it?

Nothing new for IBM

[Anonymous Coward]

Regarding World War II and Hitler, their spokesperson said "I know NOTHING!"

Re:Nothing new for IBM

[Forbo]

They also had their hand in the pot for the Japanese internment camps in the US.

Re:Nothing new for IBM

[HiThere]

Why does it seem far fetched? I don't know that it's true, but I certainly don't find it unlikely. IBM was born out of the US Census (among other factors), and has always had strong ties to the federal government.

Re:Nothing new for IBM

[Forbo]

Sorry I didn't see this notice until just now, seems that the comment notifications were broken for me. Here's some information on IBM's involvement in World War II: https://en.wikipedia.org/wiki/IBM_during_World_War_II

'His grand design for 1943 was a locator file in which would appear a Hollerith alphabetic punch card for each evacuee. These cards were to include standard demographic information about age, sex, education, occupation, family size, medical history, criminal record, and RC location. However, additional data categories about links to Japan were also maintained, such as years of residence in Japan and the extent of education received there... The punch card project was so extensive and immediate that the War Relocation Authority subcontracted the function to IBM.'

Let's assume for a moment I believe them

[Opportunist]

Because it's, frankly, moot whether they tell the truth or whether they're lying through their teeth. The moment the US government says "gimme", they'll have to roll over. It's not like due process or any outdated junk like that still held a drop of water.

It's nothing personal, nothing "evil", just business. The government wants something from us, we could fight it but the outcome will be that we hand over what they want, we have higher expenses and we have a government grumpy at us that can make our life miserable so... why bother fighting?

Re:Let's assume for a moment I believe them

[Anonymous Coward]

Qwest found out what happens when you challenge the NSA--you mysteriously lose government contacts. And then your CEO goes to prison.

Re:Let's assume for a moment I believe them

[drinkypoo]

You don't fight. You go another direction.

You don't fight for commercial products to be free from backdoors. Another regime can always come in and force people to put them in, later. You build a healthy computing ecosystem resistant to back doors. And that means Open Source and Free Software.

Many eyes may not catch all the back doors, but many eyes are still better than only spying eyes.

Re:Let's assume for a moment I believe them

[Frobnicator]

Qwest found out what happens when you challenge the NSA--you mysteriously lose government contacts. And then your CEO goes to prison.

And if IBM truly does want to distance itself from these government agencies, that is exactly what they should be doing proactively.

The article has the headline IBM Distances itself from the NSA and its Spy Activities. If IBM were truly distancing itself, the article would have had a list of billions, nay, trillions of dollars worth of contracts that IBM was cancelling, along with an announcement that IBM would no longer make bids on NSA projects, and they would prohibit their products from being used as the backend as far as allowed by law.

Instead IBM has released a very specific bullet list of things they didn't do. For example, one of the bullet points is "IBM has not provided client data ... under the program known as PRISM." Which is a wonderfully worded statement. They might have provided other data under PRISM. They might have provided client data outside of PRISM. But in that specific program, that specific data was not provided.

Sorry Robert C Weber, Senior VP at IBM, your words are too much like a lawyer's wiggling for my tastes. Does IBM really want to distance itself? In that case, actually distance yourself by terminating existing contracts and refusing to bid for future contracts.

Re:Let's assume for a moment I believe them

[Frobnicator]

What I wonder is, what could they write about what they didn't do which would not be so totally general that a huge company like them must have broken that promise hundreds of times ? Or in general, is it possible to write relatively simple texts with promises that are not so overreaching that they must be wrong, and at the same time make "the public" happy ? An example of this would be great.

In this case, not really. IBM's business model is such that they cannot get away from government money.

As for an example, maybe a different bullet point list:

* We attempt to push back against government requests and warrants. See such-and-such site for a list of hundreds of times we have done this.
* Sometimes governments compel us to give them information. Usually the details are required to be kept secret. We do our best to limit the information government demands, but ultimately must comply with government orders.
* To the best of my knowledge as a senior VP and company-wide general council, I do not believe we have ever given such-and-such information to government. IBM has over 400,000 employees globally. It is possible someone at the company has done it without permission, it is possible that spy agencies have infiltrated us, it is possible mistakes were made and it happened by accident without being reported. That is a problem at every large company, and not even the super-secret government agencies are immune from spies and unauthorized leaks. Our policy is that the information is confidential, and we do not give out, sell, rent, or otherwise allow anybody to access that information. To the best of my knowledge, we have not released that information.

That kind of list is probably the best we could see, short of a "cancelling all projects with federal ties" announcement.

Quite simply, when a company reaches a certain size (say, around 5 people) the ability to keep information a secret quickly erodes. I was at a small business with 7 people, and we had entries of "High Profile Family 1", and "High Profile Family 2", yet they still had phone numbers and addresses tied to them so their identities could be discovered trivially. I've been in businesses with 30 people where rumors were uncontrollable and big announcements were seldom surprises. A company with a half million employees globally will have a steady flow of people willing to break the rules, for reasons including patriotism, 'being nice', and the almighty dollar, plus people who wouldn't normally knowingly break the rules but go along with it for any reason such as perceived kindness, ignorance, or social engineering, or other benign reasoning. At IBM's size that type of breach is just SOP.

Unsavory Character

[pitchpipe]

Ha! The NSA has become that unsavory character that you meet in dark alleys to buy your drugs from. Still buying them, just denying it when you go to NA. Lots of corporations in NA (No-spying Anonymous) now.

Maybe IBM's sponsor is GHCQ.

IBM just bitter that Amazon got the NSA contract!

[Anonymous Coward]

IBM didn't have anything bad to say about the NSA until they got passed over for a 300 million dollar contract for a secret database of American's private details. Now that they lost out they found a sense of civic duty? On the other hand...what if they lost the contract because the NSA knew about these lawsuits?

Corporate spying worse

[cyberspittle]

Global companies spend just as much time and effort spying via metadata, etc., not to mention spying on employees. There is no regulation on spying by the private sector.

Fragmenting the internet?

[TubeSteak]

Among the countries, Brazil has considered asking service providers to hold data within the country, a move that Google describes as potentially Fragmenting the internet.

How does that fragment the internet?
Forcing service providers to build infrastructure in-country doesn't fragment anything except Google's business model.

Re:Fragmenting the internet?

[afgam28]

If every website had to be set up in a different data center for each country that they served, most websites would not bother setting up in most countries. They'd just set up wherever is most profitable, and forget about the rest. For big sites like Google and Facebook, they might just go and set everything up everywhere, but smaller sites are probably going to be US-only, or China-only, etc.

For examples of this, look at websites that already need to have separate country-specific sites for other reasons. Amazon doesn't need to have servers in each country, but they kind of need to have local warehouses (part of it is to ensure reasonable shipping times, and another part of it is that some companies refuse to ship products overseas). Netflix doesn't need to have servers in each country, but their content is geoblocked in all but a few select countries.

It's bad enough that we have to deal with things like shipping restrictions and content restrictions, but at least this only affects a few web sites. If every single website out there was forced to set up servers everywhere, the reality is that they would just stop serving most countries, and the Internet would fragment into a bunch of country-specific bubbles.

Re:Fragmenting the internet?

[TubeSteak]

If every website had to be set up in a different data center for each country that they served, most websites would not bother setting up in most countries. They'd just set up wherever is most profitable, and forget about the rest.

I'm not sure you're understanding this correctly.
Google's problem, like many other multinationals, is that they set up a local subsidiary.
This puts their in-country operations under local jurisdiction, which means they either play ball or go home (like they did with China).

http://www.bloomberg.com/news/2013-10-29/nsa-spying-allegations-put-google-on-hot-seat-in-brazil.html
2013-10-29

âoeBrazilian users would ultimately be harmed because they couldnâ(TM)t access new tools, new services,â said Marcel Leonardi, public policy director for Google in Brazil, in a telephone interview from Sao Paulo. âoeCompanies would choose to implement those services at a much later stage, if at all.â

This has been an ongoing process since last year, when the spying revelations were first made public.
Google may not be able to afford ignoring Brazil http://en.wikipedia.org/wiki/BRICS
It's kind of a big market for them.

Even with the best of the intentions

[gmuslera]

... they are tied to a country which government can require them to put backdoors in software and hardware, and not to tell anyone about that. The only way to really get clean is really open the source/specifications of everything (including propietary firmware) and let people, companies and countries really be able to check that claims. Until then, you can't decide whether they are telling the truth or not. We already learned what happens when you put blind trust in something even bigger than IBM.

Re:Even with the best of the intentions

[grep -v '.*' *]

"they are tied to a country which government can require them to put backdoors in" ... anything and keep quiet about it.

OK, so fantasy magic wand time: all of the .gov is now 100% trustworthy again from top to bottom. (I said this was a fantasy.) What would it take to make everyone happy? Is there ANYthing that they could do?

Personally, *I* don't think so in the short and mid-term. It'll take a lot of time and effort on their part to regain any of their lost brownie points -- they're hard to earn to start with but then again extremely easy to lose. And that's just with the trust-technology bit, not any of the actual politics.

Of course they're literally the biggest "Too Big to Fail" elephant in the US so it's not like you're going to walk away from them.

Re:Even with the best of the intentions

[HiThere]

There's nothing that they could do that would satisfy everyone, and so what. If the government were honorable, trustworthy, and could be depended to stay that way then they could adopt policies that would convince all reasonable people of their good intentions.

Since the initial conditions cannot be met, however, they probably can't convince anyone who doesn't blindly want to believe them. And rightly so.

No company in the US can be trusted to honor promises to keep your secret from the government. None. No matter what they say.

A reasonable question is "How many other countries are any better?", and I must admit that I don't know of any. But that doesn't mean that it is reasonable to trust a US corporation.

Re:Even with the best of the intentions

[swillden]

they are tied to a country which government can require them to put backdoors in software and hardware, and not to tell anyone about that

Can they? I haven't seen, or even heard of, any provision of the PATRIOT act, Foreign Intelligence Surveillance Act, Electronic Communications Privacy Act, Fair Credit Reporting Act or Financial Privacy Act (the latter three all authorize use of NSLs), or any other law that would enable the government to demand back doors. The law does require companies to hand over specific user data when requested through the appropriate process, and depending on the law used and the procedure followed can also include a gag order, but that's an after-the-fact thing. The Communications Assistance for Law Enforcement Act requires telecommunications carriers to build infrastructure for wiretaps, but I don't see anything in there that would affect anyone other than carriers and ISPs.

I'm not going to say that the legal authority you're claiming doesn't exist, or that the government might not be able to leverage contracts or other relationships to force it regardless of actual legal authority, but I also wouldn't just blandly assert it the way you do. It's an open question what the government can and cannot make companies do.

Re:Even with the best of the intentions

[blackbeak]

The only possible way for IBM to untie from the NSA and spying activities would be to go out of business. Even then, some IBM executives would retain deep ties.

We don't associate with the NSA

[Anonymous Coward]

And even if we did, it's classified and we couldn't tell you anyway.

understandably, months after everybody else

[swschrad]

but it's backed by Global Services monitoring on whatever island is above water this afternoon

It's really saying something...

[SeaFox]

When a company would rather work with Nazis than the NSA.

But will they

[soksabay9499]

still cash the checks? I think they will and still are.

Maybe not the NSA - maybe other agencies

[ron_ivi]

Considering how closely they partner with Lenovo, I'm not sure the US government are the backdoors in IBM people should be most worried about.

Re:IBM just bitter that Amazon got the NSA contrac

[afgam28]

That was for the CIA, not the NSA. Maybe you think they're all the same anyway, but at least get your facts straight.

Assuming you believe anyone else more.

[gelfling]

Because most modern countries among them Brazil, France, the UK don't even have these paper protections and they operate security agencies which are OFFICIALLY unaccountable except to the person of the President or PM. So sure, make yourself feel better that the big bad old USA is horrid. Except of course all the others are as bad or worse.

Whom are the trying to kid?

[no-body]

With NSL's and the mandatory gag order....

Now, they will help India and China

[WindBourne]

At this time, I am sure that IBM has been helping the Chinese and Indian gov.

History repeats itself?

[alexo]

IBM during World War II