News

MUSCULAR Projekt der NSA greift direkt auf unverschlüsselte Daten von Google und Yahoo zu.

Laut Informationen der Washington Post vom 30.10.2013 stehen der NSA Möglichkeiten eines direkten Zugriffes auf unverschlüsselte Daten der Betreiber Google und Yahoo zur Verfügung. Die Reporter Barton Gellman and Ashkan Soltanivon schreiben: “The MUSCULAR project appears to be an unusually aggressive use of NSA tradecraft against flagship American companies.”

The National Security Agency has secretly broken into the main communications links that connect Yahoo and Google data centers around the world, according to documents obtained from former NSA contractor Edward Snowden and interviews with knowledgeable officials.

By tapping those links, the agency has positioned itself to collect at will from hundreds of millions of user accounts, many of them belonging to Americans. The NSA does not keep everything it collects, but it keeps a lot.

According to a top-secret accounting dated Jan. 9, 2013, the NSA’s acquisitions directorate sends millions of records every day from internal Yahoo and Google networks to data warehouses at the agency’s headquarters at Fort Meade, Md. In the preceding 30 days, the report said, field collectors had processed and sent back 181,280,466 new records — including “metadata,” which would indicate who sent or received e-mails and when, as well as content such as text, audio and video.

The NSA’s principal tool to exploit the data links is a project called MUSCULAR, operated jointly with the agency’s British counterpart, the Government Communications Headquarters. From undisclosed interception points, the NSA and the GCHQ are copying entire data flows across fiber-optic cables that carry information among the data centers of the Silicon Valley giants.

The infiltration is especially striking because the NSA, under a separate program known as PRISM, has front-door access to Google and Yahoo user accounts through a court-approved process.

The MUSCULAR project appears to be an unusually aggressive use of NSA tradecraft against flagship American companies. The agency is built for high-tech spying, with a wide range of digital tools, but it has not been known to use them routinely against U.S. companies.

In a statement, the NSA said it is “focused on discovering and developing intelligence about valid foreign intelligence targets only.” “NSA applies Attorney General-approved processes to protect the privacy of U.S. persons — minimizing the likelihood of their information in our targeting, collection, processing, exploitation, retention, and dissemination,” it said.

In a statement, Google’s chief legal officer, David Drummond, said the company has “long been concerned about the possibility of this kind of snooping” and has not provided the government with access to its systems.

“We are outraged at the lengths to which the government seems to have gone to intercept data from our private fiber networks, and it underscores the need for urgent reform,” he said.

A Yahoo spokeswoman said, “We have strict controls in place to protect the security of our data centers, and we have not given access to our data centers to the NSA or to any other government agency.”

Under PRISM, the NSA gathers huge volumes of online communications records by legally compelling U.S. technology companies, including Yahoo and Google, to turn over any data that match court-approved search terms. That program, which was first disclosed by The Washington Post and the Guardian newspaper in Britain, is authorized under Section 702 of the FISA Amendments Act and overseen by the Foreign ­Intelligence Surveillance Court (FISC).

Tobias Höllwarth von Höllwarth Consulting zur Frage: Wie kann man sich gegen solche Vorgangsweisen schützen?

Nicht alle Informationen eines Unternehmens sind schützenswert. Manche betreffen jedoch den Kern der unternehmerischen Tätigkeit und erfordern höchste Vertraulichkeit. Außerdem gibt es eine Reihe von gesetzlichen Vorschriften, die einen sorgsamen Umgang erfordern. Wenn man sicherstellen möchte, dass sensible Unternehmensdaten, Interna oder personenbezogene Datensätze vertraulich und unter der eigenen geschützten Kontrolle bleiben, führt kein Weg an einer Verschlüsselung vorbei, die vor der Cloud stattfinden muss. Und die exklusive Kontrolle über die Schlüssel muss beim Unternehmen selbst bleiben. Tobias Höllwarth: „Weiters ist darauf zu achten, dass nur solche Verschlüsselungssysteme verwendet werden, die Open Source sind bzw. bei denen die Art und Form der Verschlüsselung transparent sind. Andernfalls sollte man besser wissen, wer bei der Programmierung des Verschlüsselungssystems mitgewirkt (mitbezahlt) hat.“

Jede neue Enthüllung von unstatthaften Zugriffen von Behörden und den Versuchen, große Datenmengen zu sammeln, zu speichern und zu analysieren (Big Data), führt zu dem Eindruck, dass man Edward Snowden nur danken kann - er hat einiges an Transparenz ermöglicht.

Originaldokumente: www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html

www.ciphercloud.com/2013/11/01/nsas-muscular-project-and-the-importance-of-encryption-key-management/