Wednesday, 30 October 2013

NSA Google & Yahoo. How did they do it?

It's quite simple really, and as the WaPo explains, the NSA "has secretly broken into the main communications links that connect Yahoo and Google data centers around the world, according to documents obtained from former NSA contractor Edward Snowden and interviews with knowledgeable officials. By tapping those links, the agency has positioned itself to collect at will from among hundreds of millions of user accounts, many of them belonging to Americans. The NSA does not keep everything it collects, but it keeps a lot."
In a nutshell - 181,280,466 new records in 1 month:
According to a top secret accounting dated Jan. 9, 2013, NSA’s acquisitions directorate sends millions of records every day from Yahoo and Google internal networks to data warehouses at the agency’s Fort Meade headquarters. In the preceding 30 days, the report said, field collectors had processed and sent back 181,280,466 new records — ranging from “metadata,” which would indicate who sent or received e-mails and when, to content such as text, audio and video.

The NSA’s principal tool to exploit the data links is a project called MUSCULAR, operated jointly with the agency’s British counterpart, GCHQ. From undisclosed interception points, the NSA and GCHQ are copying entire data flows across fiber-optic cables that carry information between the data centers of the Silicon Valley giants.

The infiltration is especially striking because the NSA, under a separate program known as PRISM, has front-door access to Google and Yahoo user accounts through a court-approved process.
So, front door for whatever the "court" allows, back door MUSCULAR for everything else.
Visually:

It gets better:
In an NSA presentation slide on “Google Cloud Exploitation,” however, a
sketch shows where the “Public Internet” meets the internal “Google
Cloud” where their data resides. In hand-printed letters, the drawing
notes that encryption is “added and removed here!” The artist adds a smiley face, a cheeky celebration of victory over Google security.

Two engineers with close ties to Google exploded in profanity when they saw the drawing. “I hope you publish this,” one of them said.
And a comprehensive schematic:


Keith Alexander's response was simple: it would be illegal for the NSA to break into Google or Yahoo databases. Because the threshold of illegality always stopped the NSA before and because spies never lie...