Google ‘outraged’ over NSA datacentre hack

A Leaked Nsa Slide Detailing The “Google Cloud Exploitation”

According to National Security Agency documents recently leaked by former intelligence contractor Edward Snowden, the US intelligence agency has hacked the main communications links between the public internet and Google and Yahoo’s datacentres globally. Google is ‘outraged’ by the reports, saying it underscores the need for urgent reform.

According to a slide leaked from a top secret document, the NSA is able to infiltrate the link between the private and public network connecting Google and Yahoo datacentres to the internet as part of a project codenamed MUSCULAR – which is operated jointly by the agency’s British Counterpart GCHQ under the broader project WINDSTOP.

The recently leaked slide shows how Google’s front end servers can be infiltrated with exploits developed by the security agency, which seemingly allows the agency to add or remove Google’s SSL encryption implementation.

According to NSA documents on MUSCULAR published by the Washington Post, the access point for Google’s servers are outside the United States, and relies on an unnamed telecommunications provider for covert access to cables or switches through which Google and Yahoo traffic passes.

The news is the latest in a series of striking revelations brought to light by Edward Snowden on the national intelligence gathering activities of the United States. Snowden leaked information about the PRISM programme, which was initially thought to have given the US government back door access to the servers of some of the largest internet companies in the world including Google, Yahoo, Facebook and Twitter.

It eventually emerged that PRISM, which is authorized under Section 702 of the FISA Amendments Act and overseen by the Foreign Intelligence Surveillance Court (FISC), was an operation that targeted front-end access, where the government legally compelled these companies to turn over information the communications of its users. But MUSCULAR adds a significant backend dimension to the agency’s intelligence gathering operations, barely a month after it emerged that the NSA infiltrated prominent American standards organisations in order to weaken encryption technologies by inserting backdoors into security algorithms.

The White House and the Office of the Director of National Intelligence have so far refused to comment on the most recent revelations, but President Obama and the NSA have previously defended the intelligence gathering operations revealed under PRISM.

The NSA released a statement to the press defending its intelligence gathering tactics, both domestically and abroad: “NSA applies Attorney General-approved processes to protect the privacy of U.S. persons – minimizing the likelihood of their information in our targeting, collection, processing, exploitation, retention, and dissemination. NSA is a foreign intelligence agency. And we’re focused on discovering and developing intelligence about valid foreign intelligence targets only.”

Yahoo has not responded to requests for comment at the time of writing.

Google has spoken out repeatedly about the “arms race” between government agencies and internet companies as they try to keep their encryption technologies one step ahead of the other, and the latest revelations have been met with outrage.

“We have long been concerned about the possibility of this kind of snooping, which is why we have continued to extend encryption across more and more Google services and links, especially the links in the slide,” said David Drummond, chief legal officer at Google in a statement.

“We do not provide any government, including the U.S. government, with access to our systems,” he said.

“We are outraged at the lengths to which the government seems to have gone to intercept data from our private fiber networks, and it underscores the need for urgent reform,” he added.

Google has previously said that it is moving to encrypt the private links between its datacentre; a majority of the data passing between these datacentres flow in plain text.

The recent revelations are likely to create another peak in what is slowly emerging as crisis of confidence in the US cloud service providers. This summer Head of the European Commission’s Digital Europe agenda Neelie Kroes warned that PRISM would likely impact American cloud service providers adversely – a claim research has since added weight to.

One study published in August by a Washington-based think tank said American cloud service providers could lose between $22bn and $35bn in PRISM-related fallout. And a Cloud Security Alliance study released around the same time suggested that one in ten companies were cancelling contracts with American cloud service providers because of the PRISM revelations.