The National Security Agency is keen to portray its surveillance efforts as primarily focused on detecting and preventing possible terror attacks. But a new trove of freshly leaked secret documents suggests that the agency also uses its powerful spying apparatus to infiltrate and monitor multinational companies.
On Sunday, Brazilian TV show Fantastico published previously undisclosed details based on documents obtained by Guardian journalist Glenn Greenwald from former NSA contractor Edward Snowden. The 13-minute news segment focused on the revelation that, according to the leaked files, the NSA apparently targeted Brazil’s state-run Petrobras oil producer for surveillance—undermining a recent statement by the agency that it “does not engage in economic espionage in any domain.” The Petrobras detail has been picked up internationally, and is likely to cause a serious stir in Brazil. (The country is still reeling from the revelation last week that the NSA spied on its president.) But Fantastico delivered several other highly significant nuggets that deserve equal attention.
Aside from targeting Petrobras, Fantastico revealed that in a May 2012 presentation reportedly used by the agency to train new recruits how to infiltrate private computer networks, Google is listed as a target. So are the French Ministry of Foreign Affairs and SWIFT, a financial cooperative that connects thousands of banks and is supposed to help “securely” facilitate banking transactions made between more than 200 countries. Other documents show that the NSA’s so-called STORMBREW program—which involves sifting Internet traffic directly off of cables as it is flowing past—is being operated with the help of a “key corporate partner” at about eight key locations across the United States where there is access to “international cables, routers, and switches.” According to a leaked NSA map, this surveillance appears to be taking place at network junction points in Washington, Florida, Texas, at two places in California, and at three further locations in or around Virginia, New York, and Pennsylvania.
Further afield, the NSA has apparently targeted the computer networks of Saudi Arabia’s Riyad Bank and Chinese technology company Huawei for surveillance, the documents show. The agency also operates a program called SHIFTINGSHADOW that appears to collect communications and location data from two major cellphone providers in Afghanistan through what it describes as a “foreign access point.” The targeting of China’s Huawei and phone operators in Afghanistan is perhaps unsurprising, given fears about Huawei’s links to the Chinese government and potential terror attacks on U.S. interests emanating from Afghanistan. But the potential infiltration of Google, in particular, is a controversial development, and the Internet giant will no doubt be demanding answers from the U.S. government.
(Google declined a request for comment. James Clapper, the Director of National Intelligence, has put out a statement not directly addressing any of the latest revelations but saying that the United States “collects foreign intelligence—just as many other governments do—to enhance the security of our citizens and protect our interests and those of our allies around the world.”)
Equally notable, Fantastico displayed a number of leaked secret documents that help shed light on recent reports about efforts made by the NSA and its British counterpart GCHQ to break encryption. In a joint scoop last week, the New York Times, ProPublica, and the Guardian claimed that the spy agencies had “cracked much of the online encryption relied upon by hundreds of millions of people” to protect their online data. However, it was not clear from the reports exactly what encryption protocols had been “cracked” and the tone of the scoops, as I noted at the time, seemed excessively alarmist.
Now, documents published by Fantastico appear to show that, far from “cracking” SSL encryption—a commonly used protocol that shows up in your browser as HTTPS—the spy agencies have been forced to resort to so-called “man-in-the-middle” attacks to circumvent the encryption by impersonating security certificates in order to intercept data.
Prior to the increased adoption of SSL in recent years, government spies would have been able to covertly siphon emails and other data in unencrypted format straight off of Internet cables with little difficulty. SSL encryption seriously dented that capability and was likely a factor in why the NSA started the PRISM Internet surveillance program, which involves obtaining data from Internet companies directly.
However, in some cases GCHQ and the NSA appear to have taken a more aggressive and controversial route—on at least one occasion bypassing the need to approach Google directly by performing a man-in-the-middle attack to impersonate Google security certificates. One document published by Fantastico, apparently taken from an NSA presentation that also contains some GCHQ slides, describes “how the attack was done” to apparently snoop on SSL traffic. The document illustrates with a diagram how one of the agencies appears to have hacked into a target’s Internet router and covertly redirected targeted Google traffic using a fake security certificate so it could intercept the information in unencrypted format.
Documents from GCHQ’s “network exploitation” unit show that it operates a program called “FLYING PIG” that was started up in response to an increasing use of SSL encryption by email providers like Yahoo, Google, and Hotmail. The FLYING PIG system appears to allow it to identify information related to use of the anonymity browser Tor (it has the option to query “Tor events”) and also allows spies to collect information about specific SSL encryption certificates. GCHQ’s network exploitation unit boasts in one document that it is able to collect traffic not only from foreign government networks—but from airlines, energy companies, and financial organizations, too.
