Microsoft helped defeat encryption for NSA on Outlook, SkyDrive, Skype
posted at 8:01 am on July 12, 2013 by Ed Morrissey
I’d call this another reason to go Mac, except that Apple also cooperated with NSA in accessing customer activities. Second look at Linux?
Microsoft has collaborated closely with US intelligence services to allow users’ communications to be intercepted, including helping the National Security Agency to circumvent the company’s own encryption, according to top-secret documents obtained by the Guardian.
The files provided by Edward Snowden illustrate the scale of co-operation between Silicon Valley and the intelligence agencies over the last three years. They also shed new light on the workings of the top-secret Prism program, which was disclosed by the Guardian and the Washington Post last month.
The documents show that:
• Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal;
• The agency already had pre-encryption stage access to email on Outlook.com, including Hotmail;
• The company worked with the FBI this year to allow the NSA easier access via Prism to its cloud storage service SkyDrive, which now has more than 250 million users worldwide;
• Microsoft also worked with the FBI’s Data Intercept Unit to “understand” potential issues with a feature in Outlook.com that allows users to create email aliases;
• In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism;
• Material collected through Prism is routinely shared with the FBI and CIA, with one NSA document describing the program as a “team sport”.
These aren’t so much new revelations as they are explanations of earlier ones. From the first exposure of the NSA surveillance programs, we knew that Microsoft (and Apple) facilitated in some way the NSA’s access to information passing through its servers and programs. At first, the reports claimed that the Internet companies provided direct access to their servers, which later details demonstrated was either an oversimplification or flat-out exaggeration. The Guardian says in this report that Microsoft and others denied providing a “back door” into those communications, but that’s not exactly true. They denied providing a back door into the servers themselves, but offered highly nuanced explanations about just about every other possibility.
This explanation also suggests that the NSA didn’t tap directly into the servers. Instead of grabbing the data at the unencrypted hub, Microsoft set up the NSA to decrypt communications as they passed through the backbone. If Microsoft gave the NSA access to the servers, it probably wouldn’t need the decryption keys. Moreover, the issue of encryption access isn’t new. The government has been wrangling with Microsoft for years over that issue, arguing that national security required the government to be able to decrypt communications when necessary. That’s what Microsoft meant in this response:
Privately, tech executives are at pains to distance themselves from claims of collaboration and teamwork given by the NSA documents, and insist the process is driven by legal compulsion.
In a statement, Microsoft said: “When we upgrade or update products we aren’t absolved from the need to comply with existing or future lawful demands.”
We’re still back to the issue of how much surveillance the American people will tolerate. This is just the nuts and bolts of how it worked. Until Congress can exercise effective oversight over the NSA — which will require administration officials to stop lying about it — nothing will have changed. Except, of course, that the Russians have started using typewriters rather than computers.