NSA paid tech firms over Prism, says latest Snowden leak

Google, Facebook, Yahoo, and Microsoft all received money to cover costs related to surveillance requests, the UK's Guardian reports, citing documents provided by former contractor Edward Snowden.

 And the NSA worked to rejigger its 

Tech firms including Google, Facebook, Yahoo, and Microsoft received money from the National Security Agency to cover legal-compliance costs related to the NSA's Prism surveillance program, according to the latest Edward Snowden documents published by the UK's Guardian newspaper.

A 2011 ruling by the Foreign Intelligence Surveillance -- or FISA -- Court found unconstitutional the NSA's inability to collect foreign Internet data without also collecting domestic data. And the NSA worked to rejigger its systems to bring them in line with the law. (The 2011 ruling was released this week as the result of a Freedom of Information Act lawsuit by the Electronic Frontier Foundation.)

The Guardian says of the new Snowden documents:

An NSA newsletter entry, marked top secret and dated December 2012, discloses the huge costs [the NSA compliance effort] entailed. "Last year's problems resulted in multiple extensions to the certifications' expiration dates which cost millions of dollars for Prism providers to implement each successive extension -- costs covered by Special Source Operations," it says.

Special Source Operations, described by Snowden as the "crown jewel" of the NSA, handles all surveillance programs, such as Prism, that rely on "corporate partnerships" with telecoms and Internet providers to access communications data.

The Guardian says the revelation "raises new questions" about tech companies' relationships with the NSA. Yahoo and Microsoft, however, say, as they've been saying, that they're simply complying with the law.

"Microsoft only complies with court orders because it is legally ordered to, not because it is reimbursed for the work," a company spokesperson said. "We could have a more informed discussion of these issues if providers could share additional information, including aggregate statistics on the number of any national security orders they may receive."

The spokesperson also pointed to an item in an FAQ tied to Microsoft's 2012 Law Enforcement Requests Report:

Does Microsoft charge law enforcement for providing data and content?

Yes. Pursuant to the Electronic Communications Privacy Act, Microsoft is entitled to seek reimbursement for costs associated with compliance with a valid U.S. law enforcement request. We only charge U.S. law enforcement entities pursuant to industry rates and only in an attempt to recover some costs associated with the need to comply with U.S. legal demands. We do not, however, charge in emergency situations or in known child exploitation investigations.

Yahoo, for its part, said in a statement that "Federal law requires the US government to reimburse providers for costs incurred to respond to compulsory legal process imposed by the government. We have requested reimbursement consistent with this law."

Facebook told the Guardian it had "never received any compensation in connection with responding to a government data request."

And Google sent the following statement to the Guardian: "We await the US government's response to our petition to publish more national security request data, which will show that our compliance with American national security laws falls far short of the wild claims still being made in the press today."

All 4 firms are among the 63 companies, trade groups, and civil liberties groups that are signatories of a letter that calls on President Barack Obama and Congress to allow Internet and telecommunications companies to offermore details about US government requests for user information. And Google, Microsoft, and Yahoo are involved in individual efforts to win this right.

Suspicion over the involvement of tech firms in the Prism program were fired up by the initial reports about Prism in The Guardian andThe Washington Post, which said the NSA had "direct access" to company servers. CNET's Declan McCullagh subsequently reported that there was no evidence of wholesale access to company servers.

Update, August 24 at 8:41 a.m. PT: A Google spokesperson provided the following statement late Friday evening: "We have not joined Prism or any government surveillance programs. We do not provide any government with access to our systems and we provide user data to governments only in accordance with the law." The spokesperson also pointed to Google CEO Larry Page's June 7 blog post about Prism and Google's involvement with government requests for data, and to the company's open letter asking the government to let Google publish information on how many requests it receives.

Read more ...

NSA swept up thousands of U.S. e-mails as part of illegal program, ruling reveals

Newly released 2011 ruling by Foreign Intelligence Surveillance Court found NSA e-mail and data-collection program illegal and decried government's "substantial misrepresentation" of scope of NSA activities

Declan McCullagh

The U.S. government has released a secret court ruling from 2011 that found some surveillance conducted by the National Security Agency illegal and that estimated the NSA collected many thousands of "wholly domestic communications" between Americans.

The Electronic Frontier Foundation heralded as a "victory" Wednesday's release of the 86-page opinion by the Foreign Intelligence Surveillance Court (FISC), set up under the 1978 Foreign Intelligence Surveillance Act.

In a statement following the release of the court opinion, Director for National Intelligence James Clapper announced the establishment of a group that will review the United States' surveillance capabilities and issue a report by mid-December.

The group will assess "whether the U.S. employs its technical collection capabilities in a manner that optimally protects our national security...while appropriately accounting for other policy considerations, such as the risk of unauthorized disclosure and our need to maintain the public trust."

The court document, dated October 3, 2011, found some of the NSA's collections to be in breach of the Fourth Amendment, which protects against unreasonable searches and seizures.

It's not the first time the opinion has been released -- it was published in January, but the document was so heavily redacted it was impossible to read, bar a single sentence that offered nothing of value.

In the readable (albeit still heavily redacted) opinion, the court said it was "troubled" that government revelations had, for the third time in less than three years, uncovered a "substantial misrepresentation" of the scope of NSA data-collection programs involving Internet traffic.

The now-discontinued "upstream" program diverted large quantities of international data from fiber cables running in and out of the U.S. into a data center, where it could be stored and analyzed. 

Investigative reporting by ZDNet in June first detailed how fiber and telecommunications companies were ordered under law to allow vast amounts of data belonging to U.S. citizens and foreign nationals to be wiretapped. 

Realistically, the NSA was unable to filter out the communications of Americans speaking to other Americans.

According to NSA estimates, as many as 56,000 "wholly domestic communications" may have been acquired, and are being acquired, by the government agency per year.

The NSA acquires more than 250 million Internet communications each year under Section 702 of FISA, the document states. Most are obtained from Internet providers. The court opinion also says the NSA's upstream program constitutes only approximately 9 percent of the total Internet communications being acquired under Section 702.

On Tuesday, a report by The Wall Street Journal claimed the NSA could access as much as 75 percent of all U.S. Internet traffic.

"The exceptions to minimization requirements mean information gathered on Americans could be used in ordinary criminal investigations, according to rules approved" by the FISC, the Journal wrote.

One month after the FISC ruled the upstream program unconstitutional, the NSA adjusted its collection process to filter out wholly American traffic from international traffic. It also purged any domestic traffic that it received. 

"Contrary to the government's repeated assurances, [the] NSA had been routinely running [search] queries of the metadata using querying terms that did not meet the required standard for querying," the FISC opinion said.

The court concluded that this requirement had been "so frequently and systematically violated that it can fairly be said that this critical element of the overall [...] regime has never functioned effectively."

In a joint statement (PDF) issued late Wednesday, the NSA and the Office of the Director of National Intelligence said media reports based on the Journal's article "provide an inaccurate and misleading picture of NSA's collection programs."

"Press reports based on an article published in today's Wall Street Journal mischaracterize aspects of NSA's data collection activities conducted under Section 702 of the Foreign Intelligence Surveillance Act," the statement read. "The NSA does not sift through and have unfettered access to 75 percent of the United States' online communications."

Update, 10 p.m. PT: Adds statement from NSA about Wall Street Journal article.

Read more ...