NSA Reportedly Taps Google, Yahoo Data Centers

Iris Scans: Security Technology In Action

The National Security Agency can collect data as it flows across the data centers operated by Google and Yahoo outside the U.S., without assistance from either company and without the hindrance of security measures.

According to documents obtained by former NSA contractor Edward Snowden and interviews with government sources, The Washington Post reports that the NSA "sends millions of records every day from Yahoo and Google internal networks to data warehouses at the agency's Fort Meade headquarters."

Google chief legal officer David Drummond said in an emailed statement that the company has long been concerned about the possibility of this kind of snooping, which has motivated the company to extend encryption to more and more of its services.

"We do not provide any government, including the U.S. government, with access to our systems," said Drummond. "We are outraged at the lengths to which the government seems to have gone to intercept data from our private fiber networks, and it underscores the need for urgent reform."

Yahoo did not respond to a request for comment.

[ Goodbye, letter Captchas? Read Google Captcha Dumps Distorted Text Images. ]

When reports about the scope of NSA data collection began to appear in June, Google and other Internet companies denied providing open-ended access to customer data or to creating backdoors to allow access. They insisted they provided data only in accordance with legal process. The NSA's Prism system provides the agency and other law enforcement agencies like the FBI with access under the Foreign Intelligence Surveillance Act (FISA).

But it appears the NSA has another option. A document published by the Post describes an NSA project called MUSCULAR, operated jointing with Britain's GCHQ, by which the American and British intelligence agencies can access data flows and copy the data to their servers.

The exact method by which the network security for Google and Yahoo (and perhaps other Internet companies) has been thwarted remains unclear. But a slide from an NSA presentation on "Google Cloud Exploitation" includes a sketch indicating that the agency has the ability to withdraw and restore SSL protection at the point where Google's servers connect to the Internet.

The NSA only copies some of the data in the stream. Citing a top-secret Jan. 9 report, the Post says that 181,280,466 new records, metadata and content, were stored in the preceding 30-day period. And at least with regard to the email messages collected from Yahoo, it appears the NSA finds these messages more trouble than they're worth: The document provided by Snowden says, "analysts have complained of [the existence of the Yahoo mail archive], and the relatively small intelligence value it contains does not justify the sheer volume of collection at MUSCULAR."

At a hearing before the House Intelligence Committee on Tuesday, Gen. Keith Alexander said reports based on documents provided by Snowden misrepresented the scope of U.S. intelligence gathering. Alexander insisted that the gathering of U.S. phone metadata, a separate program, was lawful and that U.S. allies had helped gather metadata about individuals outside the U.S. James Clapper, Director of National Intelligence, defended spying on foreign leaders as a common goal of intelligence gathering. Recent reports indicating that the U.S. spied directly on European leaders have forced U.S. officials to justify the vast reach of U.S. data gathering and to mollify offended allies.

In a blog post on Wednesday, Glenn Greenwald, the journalist who, along with Laura Poitras, helped bring Snowden's revelations to light, characterized Alexander's claims as "unverified NSA accusations," noting that none of the many stories published in major newspapers about NSA spying have faced significant corrections.

"Nobody from the US government ever once — over the last four months — claimed that any of this reporting was inaccurate," Greenwald wrote.