Apple, Google and AT&T meet Obama to discuss NSA surveillance concerns (2013)

Silicon Valley companies concerned at effect on business as revelations over US government spying spread more widely

Barack Obama hosted a summit on government surveillance and digital privacy attended by Apple chief executive Tim Cook, Google vice-president Vint Cerf and the boss of US telecoms network AT&T on Thursday.

The US president attended in person, sources told the Politico blog, as did other technology company executives. Additional attendees included representatives of the Center for Democracy and Technology and Gigi Sohn, leader of internet campaign group Public Knowledge.

The meeting was apparently prompted by growing concerns among US technology companies that revelations from the Guardian and others about the extent and depth of surveillance by the National Security Agency, and the companies’ obligation to allow access to data under secret court rules, could be damaging their reputation and commercial interests abroad.

The gathering followed a closed-doors meeting earlier this week with Obama’s chief of staff Denis McDonough and general counsel Kathy Ruemmler at the White House.

On the agenda at Tuesday’s meeting were the surveillance activities of the NSA, commercial privacy issues and the online tracking of consumers.

“This is one of a number of discussions the administration is having with experts and stakeholders in response to the president’s directive to have a national dialogue about how to best protect privacy in a digital era, including how to respect privacy while defending our national security,” one official told Politico.

McDonough and Ruemmler met members of the Information Technology Industry Council, TechNet and Tech America, which represent a range of companies from defence contractors to digital giants Facebook, Google and Microsoft.

Campaigners including the American Civil Liberties Union and the Electronic Privacy information Center were also present, Politico’s Tony Romm reported.

The Guardian’s revelations about the breadth of the NSA’s access to data, particularly relating to foreign individuals, has created PR problems for US companies. Apple has set its sights on China as a huge potential growth market, but if people there fear eavesdropping by the US government it could harm sales. And Google stands to lose business in cloud computing to European rivals if customers fear similar eavesdropping. Cloud computing companies have estimated they could lose billions of dollars of business as a result.

The White House is also battling to respond to growing unrest over surveillance of citizens by the state and the vast caches of data many digital giants are now storing about individual consumers.

Obama has promised more public debate about the country’s counterterrorism activities and privacy safeguards in general amid signs of widespread support for NSA whistleblower Edward Snowden, but officials have so far declined to provide details about this week’s technology summits.

The meetings came as a wave of Americans posted messages of support to the former security contractor, whose leaks exposed the extent of government sponsored surveillance in the US and Europe.

A website launched by the digital rights group Fight for the Future on Wednesday has attracted more than 10,000 posts expressing support for Snowden’s actions. Billed as an exercise to put faces to statistics, the website features a combination of photographs of individuals holding up signs and written words of support.

In June, Reuters/Ipsos found 31% of respondents believed Snowden was a patriot, while 23% thought he was a traitor. Another 46% said they did not know. Gallup found in June that 53% of respondents disapproved of government snooping programmes, while just 37% approved and 10% had no opinion.

In a statement, Fight for the Future cofounder Tiffiniy Cheng said: “We’ve seen an unbelievable response already – the messages keep streaming in. The government reads the same polls that we do. They know that Snowden has the public’s support. But now we’re adding faces to those statistics. As someone who volunteered and worked for Obama’s election, I feel totally burned by the president’s civil liberties and human rights records. If he truly cares about representing the American people, he should turn his attention to shutting down the NSA’s illegal surveillance programs, and leave Mr Snowden alone.”

The website was launched shortly before Obama pulled out of a presidential meeting with Russia’s leader Vladimir Putin in Moscow next month. This followed Russia’s decision to grant Snowden asylum.

Juliette Garside
theguardian.com, Friday 9 August 2013 17.37 BST

Find this story at 9 August 2013

© 2014 Guardian News and Media Limited or its affiliated companies. All rights reserved.

BT and Vodafone among telecoms companies passing details to GCHQ (2013)

Fears of customer backlash over breach of privacy as firms give GCHQ unlimited access to their undersea cables

Some of the world’s leading telecoms firms, including BT and Vodafone, are secretly collaborating with Britain’s spy agency GCHQ, and are passing on details of their customers’ phone calls, email messages and Facebook entries, documents leaked by the whistleblower Edward Snowden show.

BT, Vodafone Cable, and the American firm Verizon Business – together with four other smaller providers – have given GCHQ secret unlimited access to their network of undersea cables. The cables carry much of the world’s phone calls and internet traffic.

In June the Guardian revealed details of GCHQ’s ambitious data-hoovering programmes, Mastering the Internet and Global Telecoms Exploitation, aimed at scooping up as much online and telephone traffic as possible. It emerged GCHQ was able to tap into fibre-optic cables and store huge volumes of data for up to 30 days. That operation, codenamed Tempora, has been running for 20 months.

On Friday Germany’s Süddeutsche newspaper published the most highly sensitive aspect of this operation – the names of the commercial companies working secretly with GCHQ, and giving the agency access to their customers’ private communications. The paper said it had seen a copy of an internal GCHQ powerpoint presentation from 2009 discussing Tempora.

The document identified for the first time which telecoms companies are working with GCHQ’s “special source” team. It gives top secret codenames for each firm, with BT (“Remedy”), Verizon Business (“Dacron”), and Vodafone Cable (“Gerontic”). The other firms include Global Crossing (“Pinnage”), Level 3 (“Little”), Viatel (“Vitreous”) and Interoute (“Streetcar”). The companies refused to comment on any specifics relating to Tempora, but several noted they were obliged to comply with UK and EU law.

The revelations are likely to dismay GCHQ and Downing Street, who are fearful that BT and the other firms will suffer a backlash from customers furious that their private data and intimate emails have been secretly passed to a government spy agency. In June a source with knowledge of intelligence said the companies had no choice but to co-operate in this operation. They are forbidden from revealing the existence of warrants compelling them to allow GCHQ access to the cables.

Together, these seven companies operate a huge share of the high-capacity undersea fibre-optic cables that make up the backbone of the internet’s architecture. GCHQ’s mass tapping operation has been built up over the past five years by attaching intercept probes to the transatlantic cables where they land on British shores. GCHQ’s station in Bude, north Cornwall, plays a role. The cables carry data to western Europe from telephone exchanges and internet servers in north America. This allows GCHQ and NSA analysts to search vast amounts of data on the activity of millions of internet users. Metadata – the sites users visit, whom they email, and similar information – is stored for up to 30 days, while the content of communications is typically stored for three days.

GCHQ has the ability to tap cables carrying both internet data and phone calls. By last year GCHQ was handling 600m “telephone events” each day, had tapped more than 200 fibre-optic cables and was able to process data from at least 46 of them at a time.

Each of the cables carries data at a rate of 10 gigabits per second, so the tapped cables had the capacity, in theory, to deliver more than 21 petabytes a day – equivalent to sending all the information in all the books in the British Library 192 times every 24 hours.

This operation is carried out under clandestine agreements with the seven companies, described in one document as “intercept partners”. The companies are paid for logistical and technical assistance.

The identity of the companies allowing GCHQ to tap their cables was regarded as extremely sensitive within the agency. Though the Tempora programme itself was classified as top secret, the identities of the cable companies was even more secret, referred to as “exceptionally controlled information”, with the company names replaced with the codewords, such as “GERONTIC”, “REMEDY” and “PINNAGE”.

However, some documents made it clear which codenames referred to which companies. GCHQ also assigned the firms “sensitive relationship teams”. One document warns that if the names emerged it could cause “high-level political fallout”.

Germans have been enraged by the revelations of spying by the National Security Agency and GCHQ after it emerged that both agencies were hoovering up German data as well. On Friday the Süddeutsche said it was now clear that private telecoms firms were far more deeply complicit in US-UK spying activities than had been previously thought.

The source familiar with intelligence maintained in June that GCHQ was “not looking at every piece of straw” but was sifting a “vast haystack of data” for what he called “needles”.

He added: “If you had the impression we are reading millions of emails, we are not. There is no intention in this whole programme to use it for looking at UK domestic traffic – British people talking to each other.” The source said analysts used four criteria for determining what was examined: security, terror, organised crime and Britain’s economic wellbeing.”The vast majority of the data is discarded without being looked at … we simply don’t have the resources.”

Nonetheless, the agency repeatedly referred to plans to expand this collection ability still further in the future.

Once it is collected, analysts are able to search the information for emails, online chats and browsing histories using an interface called XKeyscore, uncovered in the Guardian on Wednesday. By May 2012, 300 analysts from GCHQ and 250 NSA analysts had direct access to search and sift through the data collected under the Tempora program.

Documents seen by the Guardian suggest some telecoms companies allowed GCHQ to access cables which they did not themselves own or operate, but only operated a landing station for. Such practices could raise alarm among other cable providers who do not co-operate with GCHQ programmes that their facilities are being used by the intelligence agency.

Telecoms providers can be compelled to co-operate with requests from the government, relayed through ministers, under the 1984 Telecommunications Act, but privacy advocates have raised concerns that the firms are not doing enough to challenge orders enabling large-scale surveillance, or are co-operating to a degree beyond that required by law.

“We urgently need clarity on how close the relationship is between companies assisting with intelligence gathering and government,” said Eric King, head of research for Privacy International. “Were the companies strong-armed, or are they voluntary intercept partners?”

Vodafone said it complied with the laws of all the countries in which its cables operate. “Media reports on these matters have demonstrated a misunderstanding of the basic facts of European, German and UK legislation and of the legal obligations set out within every telecommunications operator’s licence … Vodafone complies with the law in all of our countries of operation,” said a spokesman.

“Vodafone does not disclose any customer data in any jurisdiction unless legally required to do so. Questions related to national security are a matter for governments not telecommunications operators.”

A spokeswoman for Interoute said: “As with all communication providers in Europe we are required to comply with European and local laws including those on data protection and retention. From time to time we are presented with requests from authorities. When we receive such requests, they are processed by our legal and security teams and if valid, acted upon.”

A spokeswoman for Verizon said: “Verizon continually takes steps to safeguard our customers’ privacy. Verizon also complies with the law in every country in which we operate.”

BT declined to comment.

James Ball, Luke Harding and Juliette Garside
The Guardian, Friday 2 August 2013 18.36 BST

Find this story at 2 August 2013

© 2014 Guardian News and Media Limited or its affiliated companies. All rights reserved.

Newly declassified documents on phone records program released (2013)

Obama administration officials faced deepening political skepticism Wednesday about a far-reaching counterterrorism program that collects millions of Americans’ phone records, even as they released newly declassified documents in an attempt to spotlight privacy safeguards.

The previously secret material — a court order and reports to Congress — was released by Director of National Intelligence James R. Clapper as a Senate Judiciary Committee hearing opened Wednesday morning in which lawmakers sharply questioned the efficacy of the collection of bulk phone records. A senior National Security Agency official conceded that the surveillance effort was the primary tool in thwarting only one plot — not the dozens that officials had previously suggested.

Read the documents
NSA
Secret FISA court order to Verizon
The Obama administration declassified government documents related to NSA collection of telephone metadata records on Wednesday.
Graphic
How the secret FISA court works Click Here to View Full Graphic Story
How the secret FISA court works
Click here to subscribe.

In recent weeks, political support for such broad collection has sagged, and the House last week narrowly defeated a bipartisan bid to end the program, at least in its current form. On Wednesday, senior Democratic senators voiced equally strong doubts.

“This bulk-collection program has massive privacy implications,” said Senate Judiciary Committee Chairman Patrick J. Leahy (Vt.). “The phone records of all of us in this room — all of us in this room — reside in an NSA database. I’ve said repeatedly, just because we have the ability to collect huge amounts of data does not mean that we should be doing so. . . . If this program is not effective, it has to end. So far, I’m not convinced by what I’ve seen.”

Administration officials defended the collection effort and a separate program targeting foreigners’ communication as essential and operating under stringent guidelines.

“With these programs and other intelligence activities, we are constantly seeking to achieve the right balance between the protection of national security and the protection of privacy and civil liberties,” Deputy Attorney General James Cole said. “We believe these two programs have achieved the right balance.”

Cole nonetheless said the administration is open to amending the program to achieve greater public trust. Legislation is pending in the Senate that would narrow its scope.

The NSA program collecting phone records began after the September 2001 terrorist attacks and was brought under the supervision of the Foreign Intelligence Surveillance Court in 2006. But its existence remained hidden until June, when the Guardian newspaper in Britain published a classified FISC order to a U.S. phone company to turn over to the NSA all call records. Former NSA contractor Edward Snowden leaked the order to the newspaper.

On Wednesday, the Guardian published new documents provided by Snowden that outlined previously unknown features of an NSA data-retrieval system called XKeyscore. The newspaper reported that the search tool allowed analysts to “search with no prior authorization through vast databases containing emails, online chats and the browsing histories of millions of individuals.”

NSA slides describing the system published with the Guardian article indicated that analysts used it to sift through government databases, including Pinwale, the NSA’s primary storage system for e-mail and other text, and Marina, the primary storage and analysis tool for “metadata.” Another slide described analysts using XKeyscore to access a database containing phone numbers, e-mail addresses, log-ins and Internet user activity generated from other NSA programs.

The newspaper said the disclosures shed light on Snowden’s claim that the NSA’s surveillance programs allowed him while sitting at his desk to “wiretap anyone, from you or your accountant, to a federal judge or even the president, if I had a personal ­e-mail.” U.S. officials have denied that he had such capability.

In a statement responding to the Guardian report, the NSA said “the implication that NSA’s collection is arbitrary and unconstrained is false. NSA’s activities are focused and specifically deployed against — and only against — legitimate foreign intelligence targets.” The agency further said: “Access to XKEYSCORE, as well as all of NSA’s analytic tools, is limited to only those personnel who require access for their assigned tasks. . . . Not every analyst can perform every function, and no analyst can operate freely. Every search by an NSA analyst is fully auditable, to ensure that they are proper and within the law.”

On Wednesday, Clapper disclosed the FISA court’s “primary” order that spells out the program’s collection rules and two reports to Congress that discussed the program, which is authorized under Section 215 of the “business records” provision of the Foreign Intelligence Surveillance Act. Administration officials released the documents to reassure critics that the program is strictly supervised and minimally invasive.

For instance, the primary order states that only “appropriately trained and authorized personnel” may have access to the records, which consist of phone numbers of calls made and received, their time and duration, but not names and content. Officials call this metadata. The order also states that to query the data, there must be “reasonable, articulable suspicion,” presumably that the number is linked to a foreign terrorist group.

But the documents fueled more concern about the program’s scope among civil liberties advocates who are pressing the administration to release the legal rationale that might explain what makes such large numbers of records relevant to an authorized investigation. Perhaps most alarming to some critics was the disclosure, in the order, that queries of the metadata return results that are placed into a “corporate store” that may then be searched for foreign intelligence purposes with fewer restrictions.

That disclosure takes on significance in light of Deputy NSA Director John C. Inglis’s testimony last month that analysts could extend their searches by “three hops.” That means that starting from a target’s phone number, analysts can search on the phone numbers of people in contact with the target, then the numbers of people in contact with that group, and then the numbers of people in contact with that larger pool. That is potentially millions of people, said Jameel Jaffer, deputy legal director of the American Civil Liberties Union, who also testified Wednesday.

The Office of the DNI earlier released a statement that fewer than 300 numbers were queried in 2012. That could still mean potentially hundreds of millions of records, Sen. Richard J. Durbin (D-Ill.) said at the hearing.

Also, according to the order, the NSA does not need to audit the results of searches of the corporate store.

The order asserts that phone metadata could be obtained with a grand jury subpoena. That may be true for one person or even a group of people, but not for all Americans’ phone records, critics said.

Privacy advocates criticized redactions in the reports to Congress of information about the NSA’s failure to comply with its own internal rules. That is “among the most important information that the American public needs to critically assess whether these programs are proper,” said Mark Rumold, a staff lawyer at the Electronic Frontier Foundation.

At the hearing, Leahy voiced upset with the administration for suggesting that the program was as effective in thwarting terrorist plots as another NSA program, authorized under Section 702 of FISA and targeting foreigners’ communications. “I don’t think that’s a coincidence when we have people in government make that comparison, but it needs to stop,” he said of attempts to conflate the two programs’ utility.

He noted that senior officials had testified that the phone logging effort was critical to thwarting 54 plots, but after reviewing NSA material, he said that assertion cannot be made — “not by any stretch.” Pressed by Leahy on the point, Inglis admitted that the program “made a contribution” in 12 plots with a domestic nexus, but only one case came close to a “but-for” or critical contribution.

Carol D. Leonnig and William Branigin contributed to this report.

By Ellen Nakashima, Published: July 31, 2013

Find this story at 31 July 2013

© 1996-2014 The Washington Post

Telekom-Riesen helfen den Geheimdiensten (2013)

Der britische Geheimdienst wurde bei Abhöraktionen umfangreicher von Telekommunikationsfirmen unterstützt als bislang bekannt. Das berichten “Süddeutsche Zeitung” und NDR. Sogar Programmierarbeit soll an die Firmen ausgelagert worden sein.

Berlin – Laut übereinstimmenden Berichten des NDR und der “Süddeutschen Zeitung” (SZ) sind einige private Telekommunikationsunternehmen stärker in die Abhöraktionen ausländischer Geheimdienste verwickelt als bisher angenommen. Der britische Geheimdienst GCHQ etwa, ein enger Partner des US-Diensts NSA, arbeite beim Abhören des Internetverkehrs mit sieben großen Firmen zusammen.

NDR und “Süddeutsche Zeitung” beziehen sich in ihren Berichten auf Dokumente des ehemaligen NSA-Vertragsmitarbeiters Edward Snowden, die sie einsehen konnten. Die interne Präsentation von 2009 nennt neben den internationalen Unternehmen British Telecom, Verizon und Vodafone auch die Netzwerkbetreiber Level 3, Interoute, Viatel und Global Crossing als Schlüsselpartner des GCHQ. Global Crossing wurde inzwischen von Level 3 gekauft.

Gemeinsam spannen die Unternehmen laut NDR und “SZ” ein engmaschiges Datennetz über Europa und weite Teile der Welt. Einige Firmen wie Level 3 betreiben in Deutschland demnach große Datenzentren. Demnach betreibt Level 3 Rechenzentren in mehreren deutschen Städten, ein Transatlantikkabel von Global Crossing ist in Westerland auf Sylt mit deutschen Netzen verbunden. Das Unternehmen Interoute, das den Unterlagen zufolge auch mit dem GCHQ kooperiert, betreibt 15 Netzknoten in Deutschland.

Teilweise sei die Kooperation mit dem Geheimdienst über den einfachen Zugang zu den Datennetzen hinausgegangen, berichten “SZ” und NDR. Einige Firmen sollen laut den Dokumenten sogar Computerprogramme entwickelt haben, um dem britischen Geheimdienst das Abfangen von Daten aus ihren Netzen zu erleichtern. Faktisch habe der GCHQ einen Teil seiner Ausspäharbeit an Privatunternehmen delegiert.

Viatel bestreitet Zusammenarbeit

Die meisten der Unternehmen verwiesen laut NDR und “SZ” auf Gesetze, die Regierungen erlaubten, Firmen unter bestimmten Umständen zur Herausgabe von Informationen zu verpflichten. Viatel widersprach den Angaben und erklärte, nicht mit dem GCHQ zu kooperieren und dem Geheimdienst auch keinen Zugang zur eigenen Infrastruktur oder zu Kundendaten zu gewähren.

02. August 2013, 09:20 Uhr

Find this story at 2 August 2013

© SPIEGEL ONLINE 2013

Agreements with private companies protect U.S. access to cables’ data for surveillance (2013)

The U.S. government had a problem: Spying in the digital age required access to the fiber-optic cables traversing the world’s oceans, carrying torrents of data at the speed of light. And one of the biggest operators of those cables was being sold to an Asian firm, potentially complicating American surveillance efforts.

Enter “Team Telecom.”

In months of private talks, the team of lawyers from the FBI and the departments of Defense, Justice and Homeland Security demanded that the company maintain what amounted to an internal corporate cell of American citizens with government clearances. Among their jobs, documents show, was ensuring that surveillance requests got fulfilled quickly and confidentially.

This “Network Security Agreement,” signed in September 2003 by Global Crossing, became a model for other deals over the past decade as foreign investors increasingly acquired pieces of the world’s telecommunications infrastructure.

The publicly available agreements offer a window into efforts by U.S. officials to safeguard their ability to conduct surveillance through the fiber-optic networks that carry a huge majority of the world’s voice and Internet traffic.

The agreements, whose main purpose is to secure the U.S. telecommunications networks against foreign spying and other actions that could harm national security, do not authorize surveillance. But they ensure that when U.S. government agencies seek access to the massive amounts of data flowing through their networks, the companies have systems in place to provide it securely, say people familiar with the deals.

Negotiating leverage has come from a seemingly mundane government power: the authority of the Federal Communications Commission to approve cable licenses. In deals involving a foreign company, say people familiar with the process, the FCC has held up approval for many months while the squadron of lawyers dubbed Team Telecom developed security agreements that went beyond what’s required by the laws governing electronic eavesdropping.

The security agreement for Global Crossing, whose fiber-optic network connected 27 nations and four continents, required the company to have a “Network Operations Center” on U.S. soil that could be visited by government officials with 30 minutes of warning. Surveillance requests, meanwhile, had to be handled by U.S. citizens screened by the government and sworn to secrecy — in many cases prohibiting information from being shared even with the company’s executives and directors.

“Our telecommunications companies have no real independence in standing up to the requests of government or in revealing data,” said Susan Crawford, a Yeshiva University law professor and former Obama White House official. “This is yet another example where that’s the case.”

The full extent of the National Security Agency’s access to fiber-optic cables remains classified. The Office of the Director of National Intelligence issued a statement saying that legally authorized data collection “has been one of our most important tools for the protection of the nation’s — and our allies’ — security. Our use of these authorities has been properly classified to maximize the potential for effective collection against foreign terrorists and other adversaries.”

It added, “As always, the Intelligence and law enforcement communities will continue to work with all members of Congress to ensure the proper balance of privacy and protection for American citizens.”

Collecting information

Documents obtained by The Washington Post and Britain’s Guardian newspaper in recent weeks make clear how the revolution in information technology sparked a revolution in surveillance, allowing the U.S. government and its allies to monitor potential threats with a reach impossible only a few years earlier.

Yet any access to fiber-optic cables allows for possible privacy intrusions into Americans’ personal communications, civil libertarians say.

As people worldwide chat, browse and post images through online services, much of the information flows within the technological reach of U.S. surveillance. Though laws, procedural rules and internal policies limit how that information can be collected and used, the data from billions of devices worldwide flow through Internet choke points that the United States and its allies are capable of monitoring.

This broad-based surveillance of fiber-optic networks runs parallel to the NSA’s PRISM program, which allows analysts to access data from nine major Internet companies, including Google, Facebook, Microsoft, Yahoo, AOL and Apple, according to classified NSA PowerPoint slides. (The companies have said the collection is legal and limited.)

One NSA slide titled, “Two Types of Collection,” shows both PRISM and a separate effort labeled “Upstream” and lists four code names: Fairview, Stormbrew, Blarney and Oakstar. A diagram superimposed on a crude map of undersea cable networks describes the Upstream program as collecting “communications on fiber cables and infrastructure as data flows past.”

The slide has yellow arrows pointing to both Upstream and PRISM and says, “You Should Use Both.” It also has a header saying “FAA 702 Operations,” a reference to a section of the amended Foreign Intelligence Surveillance Act that governs surveillance of foreign targets related to suspected terrorism and other foreign intelligence.

Under that provision, the government may serve a court order on a company compelling it to reach into its networks for data on multiple targets who are foreigners reasonably believed to be overseas. At an Internet gateway, the government may specify a number of e-mail addresses of foreigners to be targeted without the court signing off on each one.

When the NSA is collecting the communications of a foreign, overseas target who is speaking or e-mailing with an American, that American’s e-mail or phone call is considered to be “incidentally” collected. It is considered “inadvertently” collected if the target actually turns out to be an American, according to program rules and people familiar with them. The extent of incidental and inadvertent collection has not been disclosed, leading some lawmakers to demand disclosure of estimates of how many Americans’ communications have been gathered. No senior intelligence officials have answered that question publicly.

Using software that scans traffic and “sniffs out” the targeted e-mail address, the company can pull out e-mail traffic automatically to turn over to the government, according to several former government officials and industry experts.

It is unclear how effective that approach is compared with collecting from a “downstream” tech company such as Google or Facebook, but the existence of separate programs collecting data from both technology companies and telecommunications systems underscores the reach of government intelligence agencies.

“People need to realize that there are many ways for the government to get vast amounts of e-mail,” said Chris Soghoian, a technology expert with the American Civil Liberties Union.

Controlling the data flow

The drive for new intelligence sources after the Sept. 11, 2001, attacks relied on a key insight: American companies controlled most of the Internet’s essential pipes, giving ample opportunities to tap the torrents of data flowing by. Even terrorists bent on destruction of the United States, it turned out, talked to each other on Web-based programs such as Microsoft’s Hotmail.

Yet even data not handled by U.S.-based companies generally flowed across parts of the American telecommunications infrastructure. Most important were the fiber-optic cables that largely have replaced the copper telephone wires and the satellite and microwave transmissions that, in an earlier era, were the most important targets for government surveillance.

Fiber-optic cables, many of which lie along the ocean floor, provide higher-quality transmission and greater capacity than earlier technology, with the latest able to carry thousands of gigabits per second.

The world’s hundreds of undersea cables now carry 99 percent of all intercontinental data, a category that includes most international phone calls, as well, says TeleGeography, a global research firm.

The fiber-optic networks have become a rich source of data for intelligence agencies. The Guardian newspaper reported last month that the Government Communications Headquarters, the British equivalent of the NSA, taps and stores data flowing through the fiber-optic cables touching that nation, a major transit point for data between Europe and the Americas. That program, code-named Tempora, shares data with the NSA, the newspaper said.

Tapping undersea transmission cables had been a key U.S. surveillance tactic for decades, dating back to the era when copper lines carrying sensitive telephone communications could be accessed by listening devices divers could place on the outside of a cable’s housing, said naval historian Norman Polmar, author of “Spy Book: The Encyclopedia of Espionage.”

“The U.S. has had four submarines that have been outfitted for these special missions,” he said.

But the fiber-optic lines — each no thicker than a quarter — were far more difficult to tap successfully than earlier generations of undersea technology, and interception operations ran the risk of alerting cable operators that their network had been breached.

It’s much easier to collect information from any of dozens of cable landing stations around the world — where data transmissions are sorted into separate streams — or in some cases from network operations centers that oversee the entire system, say those familiar with the technology who spoke on the condition of anonymity to discuss sensitive intelligence matters.

Expanding powers

In the aftermath of the Sept. 11 attacks, the NSA said its collection of communications inside the United States was constrained by statute, according to a draft report by the agency’s inspector general in 2009, which was obtained by The Post and the Guardian. The NSA had legal authority to conduct electronic surveillance on foreigners overseas, but the agency was barred from collecting such information on cables as it flowed into and through the United States without individual warrants for each target.

“By 2001, Internet communications were used worldwide, underseas cables carried huge volumes of communications, and a large amount of the world’s communications passed through the United States,” the report said. “Because of language used in the [Foreign Intelligence Surveillance] Act in 1978, NSA was required to obtain court orders to target e-mail accounts used by non-U.S. persons outside the United States if it intended to intercept the communications at a webmail service within the United States. Large numbers of terrorists were using such accounts in 2001.”

As a result, after White House and CIA officials consulted with the NSA director, President George W. Bush, through a presidential order, expanded the NSA’s legal authority to collect communications inside the United States. The President’s Surveillance Program, the report said, “significantly increased [NSA’s] access to transiting foreign communications.”

Gen. Michael Hayden, then the NSA director, described that information as “the real gold of the program” that led to the identification of threats within the United States, according to the inspector general’s report.

Elements of the President’s Surveillance Program became public in 2005, when the New York Times reported the government’s ability to intercept e-mail and phone call content inside the United States without court warrants, sparking controversy. The FISA court began oversight of those program elements in 2007.

As these debates were playing out within the government, Team Telecom was making certain that surveillance capacity was not undermined by rising foreign ownership of the fiber-optic cables that the NSA was using.

The Global Crossing deal created particular concerns. The company had laid an extensive network of undersea cables in the world, but it went bankrupt in 2002 after struggling to handle more than $12 billion in debt.

Two companies, one from Singapore and a second from Hong Kong, struck a deal to buy a majority stake in Global Crossing, but U.S. government lawyers immediately objected as part of routine review of foreign investment into critical U.S. infrastructure.

President Gerald Ford in 1975 had created an interagency group — the Committee on Foreign Investment in the United States, or CFIUS — to review deals that might harm U.S. national security. Team Telecom grew out of that review process. Those executive branch powers were expanded several times over the decades and became even more urgent after the Sept. 11 attacks, when the Defense Department became an important player in discussions with telecommunications companies.

The Hong Kong company soon withdrew from the Global Crossing deal, under pressure from Team Telecom, which was worried that the Chinese government might gain access to U.S. surveillance requests and infrastructure, according to people familiar with the negotiations.

Singapore Technologies Telemedia eventually agreed to a slate of concessions, including allowing half of the board of directors of a new subsidiary managing the undersea cable network to consist of American citizens with security clearances. They would oversee a head of network operations, a head of global security, a general counsel and a human resources officer — all of whom also would be U.S. citizens with security clearances. The FBI and the departments of Defense, Justice and Homeland Security had the power to object to any appointments to those jobs or to the directors who had to be U.S. citizens.

U.S. law already required that telecommunications companies doing business in the United States comply with surveillance requests, both domestic and international. But the security agreement established the systems to ensure that compliance and to make sure foreign governments would not gain visibility into the working of American telecommunications systems — or surveillance systems, said Andrew D. Lipman, a telecommunications lawyer who has represented Global Crossing and other firms in negotiating such deals.

“These Network Security Agreements flesh out the details,” he said.

Lipman, a partner with Bingham McCutchen, based in Washington, said the talks with Team Telecom typically involve little give and take. “It’s like negotiating with the Motor Vehicle Department,” he said.

Singapore Technologies Telemedia sold Global Crossing in 2011 to Level 3 Communications, a company based in Colorado. But the Singaporean company maintained a minority ownership stake, helping trigger a new round of review by Team Telecom and a new Network Security Agreement that added several new conditions.

A spokesman for Level 3 Communications declined to comment for this article.

By Craig Timberg and Ellen Nakashima, Published: July 7, 2013

Find this story at 7 July 2013

© 1996-2014 The Washington Post

Orange Gives All Of Its Data To France’s NSA

Orange has been cooperating allegedly illegally for years with France’s main intelligence agency (the DGSE). According to a newly found report by Edward Snowden and an investigation by Le Monde, the DGSE was given access to all of Orange’s data (not just metadata).

Orange is the leading telecom company in France with more than 26 million clients. These clients have communicated with tens of millions of non-Orange clients. Nearly everyone in France is concerned by today’s revelation. No regulating agency has a say in this special relationship between France’s intelligence agencies and Orange. Data is shared with allies, such as the GCHQ in the U.K.

While the state still owns 27 percent of Orange, Orange has operated as a private company for years. Yet, when it comes to data collecting, it still works as if it was a state-owned company.

Orange employees help the DGSE create and develop new tools to collect and analyze data. Contrarily to PRISM, it’s not just an agreement between the government and big Internet companies, it’s an implicit “joint venture” that has been going on for around 30 years.

Both the government and the DGSE had no comment on the allegations. Orange CEO Stéphane Richard said that he wasn’t aware of what the DGSE was doing. He just granted access to Orange for employees of the DGSE in order to comply with the law. The three other main telecom companies denied the existence of similar programs with them.

Last July, Le Monde discovered that France has a PRISM-like program which collects thousands of trillions of metadata elements, collecting data on call history, recipient and sizes of text message, email subject etc. The program targets phone communications, emails and data from Internet giants, such as Google, Facebook, Apple, Microsoft and Yahoo.

The public outcry has been very moderated so far. These popular Internet services are still dominant. In other words, in France, convenience comes first, privacy second.

Update: An Orange spokesperson sent the following statement.

As is the case for all operators, Orange has relations with the French state’s services that are responsible for national security. This relationship takes place within a strict legal framework, under the responsibility of the state and appropriate legal control by judges.

Posted Mar 20, 2014 by Romain Dillet (@romaindillet)

Find this story at 20 March 2014

© 2013-2014 AOL Inc.

Orange shares all its call data with France’s intelligence agency, according to new Snowden leak

Another day, another round of troubling surveillance news. In a twist, though, today’s nugget has less to do with the US or the NSA but rather, France’s central intelligence agency, the DGSE. According to a leak by Edward Snowden to the French paper Le Monde, Orange, the country’s leading telecom, has been willingly sharing all of its call data with the agency. And according to the leaked document — originally belonging to the UK intelligence agency GCHQ — the French government’s records don’t just include metadata, but all the information Orange has on file. As you might expect, the DGSE then shares this information with other countries, including, of course, the UK, which had this incriminating document in the first place.

In a way, this isn’t surprising: the French government owns a 27 percent stake in the company. But until now, Orange has ostensibly been operating as a private firm. What’s more, the leaked document would suggest that the DGSE’s relationship with Orange has been cooperative, with Orange employees creating new tools to collect and interpret the data. If true, then, this arrangement would go beyond the DGSE merely requesting specific cell phone records and getting them. For now, both the French government and the DGSE have declined to comment, according to TechCrunch, while Orange CEO Stéphane Richard told LeMonde that he isn’t aware of what the DGSE is doing, but that Orange has granted access to the DGSE to comply with the law.

BY DANA WOLLMAN @DANAWOLLMAN MARCH 20TH 2014, AT 3:29:00 PM ET 16

Find this story at 20 March 2014

© 2014 AOL Inc.

Espionnage : comment Orange et les services secrets coopèrent

Selon un document auquel “Le Monde” eu accès, l’opérateur historique France Télécom-Orange est un acteur essentiel du renseignement français.
On apprend souvent davantage de choses sur soi par des gens qui n’appartiennent pas à votre famille. Les Britanniques, un peu malgré eux, viennent de nous éclairer sur les liens hautement confidentiels qui existent entre les services secrets français, la Direction générale de la sécurité extérieure (DGSE) et l’opérateur historique de télécommunication France Télécom, qui a pris le nom d’Orange en février 2012.
Selon un document interne des services secrets techniques britanniques (GCHQ), l’équivalent de l’Agence nationale de sécurité (NSA) américaine, la DGSE entretient une coopération étroite avec « un opérateur de télécommunication français ». L’ancienneté de leurs liens, la description des savoir-faire spécifiques de l’entreprise ainsi que l’enquête du Monde permettent de conclure qu’il s’agit bien de France Télécom-Orange.

Lire les autres éléments de l’enquête Les services secrets britanniques ont accès aux données des clients français d’Orange

Lire les autres éléments de l’enquête Les X-Télécoms, maîtres d’œuvre du renseignement

Lire les autres éléments de l’enquête Surveillance : « Les opérateurs n’ont pas les moyens de résister aux Etats »

Selon le GCHQ, la DGSE et l’opérateur historique français travaillent ensemble pour améliorer les capacités nationales d’interception sur les réseaux de communication et collaborent pour casser les cryptages de données qui circulent dans les réseaux. France Télécom est un acteur important du système de surveillance en France.

COLLECTE DE DONNÉES LIBRE DE TOUT CONTRÔLE

Cette note, extraite des archives de la NSA par son ex-consultant Edward Snowden, assure que la relation entre la DGSE et l’opérateur français constitue un atout majeur par rapport à ses homologues occidentaux. L’une des forces de la DGSE résiderait dans le fait qu’elle ne se contente pas des autorisations accordées par le législateur pour accéder aux données des clients de France Télécom-Orange. Elle dispose surtout, à l’insu de tout contrôle, d’un accès libre et total à ses réseaux et aux flux de données qui y transitent.

Cette collecte libre de tout contrôle, par le biais de l’opérateur français, portant sur des données massives, concerne aussi bien des Français que des étrangers. Elle est utilisée par la DGSE, qui la met à la disposition de l’ensemble des agences de renseignement françaises au titre de la mutualisation du renseignement technique et de sa base de données. Ces données sont également partagées avec des alliés étrangers comme le GCHQ. Enfin, l’opérateur français développe, en partenariat avec la DGSE, des recherches en cryptologie.

Au plus haut niveau de l’Etat, en France, on se refuse à tout commentaire, mais on indique au Monde que, si la puissance publique est devenue minoritaire (27 %) au sein du capital de France Télécom, le plus ancien opérateur français reste considéré comme « un délégataire de service public ». Le savoir-faire de l’entreprise, qui fut en premier lieu une administration, contribue, de manière essentielle, « aujourd’hui comme hier », à la sécurité du territoire et à l’autonomie de décision des dirigeants français.

« Le rapport entre France Télécom et la DGSE n’est pas de même nature que celui révélé dans le programme Prism de la NSA, qui a des liens contractuels avec les géants d’Internet, explique un ancien chef de service de renseignement français. En France, c’est consubstantiel. » Il n’existe pas de formalisation de cette coopération entre la DGSE et France Télécom-Orange. Elle est portée par des personnes habilitées secret-défense, au sein de l’entreprise, et pérennisée, depuis au moins trente ans, par des ingénieurs, qui font la navette entre les deux institutions.

« USAGE INTERNE ET NON OFFICIEL »

Au quotidien, dans l’entreprise, ce lien est géré par un très petit nombre de personnes au sein de trois services. La direction des réseaux, en premier lieu, gère, notamment, les stations dites « d’atterrissement », où accostent les câbles sous-marins France Télécom-Orange touchant la France et par lesquels transitent les flux massifs de données collectées. Un tri préalable peut aisément être réalisé en fonction des pays et des régions d’origine, puis tout est stocké dans des locaux de la DGSE.

« Le transit massif des données est stocké pour un usage interne et non officiel, détaille un cadre attaché à la direction des réseaux. Mais le point névralgique, c’est l’accès au fournisseur d’accès, comme ça, vous croisez la circulation de la donnée et l’identité de ceux qui l’échangent. C’est pour cette raison que la DGSE est en contact avec l’ensemble des opérateurs français. »

La DGSE s’appuie aussi sur la direction internationale de l’opérateur, qui gère les filiales de téléphonie mobile à l’étranger. Orange joue dans certains cas un rôle stratégique. Il a ainsi accompagné les opérations militaires françaises au Mali et en Centrafrique. Enfin, la direction sécurité, chasse gardée des anciens de la direction technique de la DGSE, est le principal interlocuteur des services secrets. Elle veille, avec Orange Business Services, sur les questions de protection de données et de déchiffrement.

Interrogé, le patron d’Orange, Stéphane Richard, a indiqué que « des personnes habilitées secret-défense peuvent avoir à gérer, au sein de l’entreprise, la relation avec les services de l’Etat et notamment leur accès aux réseaux, mais elles n’ont pas à m’en référer. Tout ceci se fait sous la responsabilité des pouvoirs publics dans un cadre légal ». La DGSE s’est refusée à tout commentaire.

LE MONDE | 20.03.2014 à 11h25 • Mis à jour le 26.03.2014 à 16h14 |
Par Jacques Follorou

Find this story at 20 March 2013

© Le Monde.fr

‘French intelligence agents spy on Orange customer data’

The French intelligence agency in charge of military and electronic spying is massively collecting data and monitoring networks of telecoms giant Orange, Le Monde newspaper reported in its Friday edition.

A picture taken on February 24, 2014 in the French northern city of Lille, shows people walking in front of an Orange store

“The DGSE can read, like an open book, the origin and destination of all communications of Orange customers,” the paper said.

Monitoring operations were being carried out without any external supervision with access “free and total” for spies at the General Directorate for External Security (DGSE).

Le Monde said its report was based on an internal British intelligence document made available by former US intelligence contractor Edward Snowden.

Contacted by AFP, an Orange spokesman said the company “like all (other) operators has relations with state agencies in charge of the country’s and the French people’s security.”

“These relations strictly comply with the laws and are legal under the responsibility of the State and the control of judges,” he added.

The DGSE and agents with military clearance have been working with Orange, formerly known as France Telecom, “for at least 30 years”, said Le Monde.

The DGSE would not comment on the report.

Snowden, who has been charged in the United States with espionage, lives in exile in Russia.

He said earlier this month he had no regrets over his leaks about mass surveillance programmes by the US National Security Agency (NSA), saying they sparked a needed public debate on spying and data collection.

Published: 21 Mar 2014 at 03.49Online news: World

Find this story at 21 March 2014

© 2014 The Post Publishing PCL