(Image: file photo)
A new analysis of documents leaked by whistleblower Edward Snowden details a highly-classified technique that allows the National Security Agency to "deliberately divert" US internet traffic, normally safeguarded by constitutional protections, overseas in order to conduct unrestrained data collection on Americans.
According to the new analysis, the NSA has clandestine means of "diverting portions of the river of internet traffic that travels on global communications cables," which allows it to bypass protections put into place by Congress to prevent domestic surveillance on Americans.
The new findings, published Thursday, follows a 2014 paper by researchers Axel Arnbak and Sharon Goldberg, published on sister-site CBS News, which theorized that the NSA, whose job it is to produce intelligence from overseas targets, was using a "traffic shaping" technique to route US internet data overseas so that it could be incidentally collected under the authority of a largely unknown executive order.
US citizens are afforded constitutional protections against surveillance or searches of their personal data. Any time the government wants to access an American's data, they must follow the rules of the Foreign Intelligence Surveillance (FISA) Court, a Washington DC-based court that authorizes the government's surveillance programs.
But if that same data is collected outside the US, the bulk of the NSA's authority stems from a presidential decree dating back more than three decades.
The so-called Executive Order 12333, signed into law by President Ronald Reagan in 1981, went on to become the bulk of the NSA's authority, expanding the agency's collection capabilities to both foreign and domestic targets. The order is far more permissive than the Foreign Intelligence Surveillance Act, as enacted by Congress, as it falls solely under the watch of the executive branch and is not reviewed by the courts.
A former NSA executive turned whistleblower Bill Binney once described the executive order as a "blank check" for the intelligence agencies to conduct surveillance when other laws fail or don't reach far enough.
Although the new research notes that the agency's ability to carry out the traffic shaping technique is unknown due to the highly classified nature of any surveillance program, the NSA can use its legal powers to "sidestep legal restrictions imposed by Congress and the surveillance courts," said Goldberg, who authored the report.
The government's use of traffic shaping exploits a fundamental principle about internet traffic: data takes the quickest and most efficient route, which sometimes means bouncing from different countries around the globe, rather than staying within a country's borders.
That allows the NSA to vacuum up data it treats as an overseas communication -- with little regard for whether or not the data belongs to an American.
One leaked top secret document from 2007 details a technique that allows the intelligence agency to exploit the global flow of internet data by tricking internet traffic into traveling through a set and specific route, such as undersea fiber cables that the agency actively monitors.
Leaked NSA document from 2007. (Image: source document)
The document's example noted Yemen, a hotspot for terrorism and extremist activity but difficult to monitor because the NSA has almost no way to passively monitor internet traffic from the cables that run in and out of the country. By shaping the traffic, the agency can trick internet data to pass through undersea cables that are located on friendlier territory.
Goldberg's research takes that logic and focuses it on US citizens, whose data and communications is out of bounds for the intelligence agencies without a valid warrant from the surveillance court.
The government only has to divert their internet data outside of the US to use the powers of the executive order to legally collect the data as though it was an overseas communication. Two Americans can send an email through Gmail, for example, but because their email is sent through or backed up in a foreign datacenter, the contents of that message can become "incidentally collected" under the executive order's surveillance powers.
"Instead, the NSA could use 'traffic-shaping' techniques to deliberately send traffic from within the US to points of interception on foreign territory, where it could be swept up as part of operations that would be illegal if conducted on US territory," said Goldberg.
To that point, former US State Department official John Tye, who had classified knowledge about how the executive order worked, confirmed in a 2014 interview that the government could "keep and use" the data collected on potentially millions of Americans, even if the sole target was an overseas foreigner.
The research cites several ways the NSA is actively exploiting methods to shape and reroute internet traffic -- many of which are well-known in security and networking circles -- such as hacking into routers, or using the simpler and less legally demanding option of forcing major network providers or telecoms firms, into cooperating and diverting traffic to a convenient location.
Goldberg noted that sans any conclusive legal or public definitions from the FISA surveillance court on whether or not the practice is legal, the loophole remains, and "eliminating it calls for a realignment of current US surveillance laws and policies," she added.
"The modern Internet has changed the way that Americans communicate," said Goldberg. "These changes call for a fundamental realignment of US surveillance law -- specifically, the legal boundaries that distinguish interception of Internet traffic on US territory from interception abroad must be broken down," she said.
"Americans' Internet traffic should enjoy the same legal protections, regardless of whether it is intercepted on US territory, or intercepted abroad."
As it stands, the law that governs the NSA's use of collecting foreign and overseas collection -- the so-called Section 702 statute -- is set to expire at the end of the year, five years after it was first reauthorized after its debut in 2008 under the FISA Amendments Act.
"Congress should not miss this opportunity to consider revising FISA's definition of 'electronic surveillance' in order to eliminate loopholes that allow the executive branch to unilaterally conduct surveillance of American Internet traffic," said Goldberg. "Undertaking this revision is a crucial step toward ensuring that legislative and judiciary branches have a firm hand at protecting the privacy of American communications."
An NSA spokesperson did not respond to a request for comment.
from Latest Topic for ZDNet in... http://ift.tt/2tx6H0t
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.