Revelations from National Security Administration (NSA) documents released by Edward Snowden just keep getting worse. The Washington Post reported last week that the NSA has secretly broken into the main connection links that connect Yahoo and Google data centers around the world. Under a program code-named MUSCULAR, the NSA worked with its British counterpart to access hundreds of millions of user accounts stored in these global data centers.
Internet giants like Google, Facebook and Apple have denied their knowledge of similar mass data mining programs operated by the NSA. Companies that have participated in NSA spying have taken to the courts for permission to release more information about the mandatory data requests they receive from US intelligence agencies. Last week, six major tech companies–Apple, Yahoo, Google, Apple, Facebook and AOL–wrote to the Senate Judiciary Committee demanding reform.
When it comes to tech firms, no target is too small for the NSA. In August, the encrypted email service used by Edward Snowden shut down rather than comply with a NSA warrant. The service, Lavabit, used encryption codes to prevent messages from being read by anyone other than the sender or the recipient. Lavabit founder Ladar Levison wrote on the service’s home page:
I have been forced to make a difficult decision: to be complicit in crimes against the American people or walk away from nearly ten years of hard work by shutting down Lavabit. After significant soul searching, I have decided to suspend operations.
Levison had complied with government requests for information relating to individual account holders in the past, but felt that giving them the keys to over 400,000 user accounts and jeopardizing the security of his service was going too far. Levison was under a government gag order until October and has appealed the search warrants and subpoenas demanding access to his service.
A Pew Research poll at the end of July found that for the first time in a decade, the majority of Americans are much more concerned about the government infringing on their civil liberties than about a potential terrorist attack. Other recent studies have reached similar conclusions about increased opposition to government surveillance. The shift in sentiment isn’t surprising; the Snowden leaks exposed enormous intrusions on individual privacy rights, and clear violations of Fourth Amendment search and seizure laws.
But its not just individual rights that are at stake; tech companies are feeling the burn as well. Companies have asked Congress not only for greater public transparency about the government’s authority to compel these companies to disclose user data, but also for increased privacy protections, oversight and accountability for government surveillance. There’s also an economic concern; other countries have shown significant backlash towards the recent surveillance exposures in the United States, and as a result, may not want to do business with U.S. online services.
Is this an opportunity for businesses to rethink the data they collect and the ways they protect it? Absolutely. But, according to Levison in an interview with the Guardian, it’s also an opportunity for Congress to set up rules that allow companies to protect their private intellectual properties and prevent the government from commanding businesses to alter their products in ways that will make them less secure.
In response to the Washington Post report on the MUSCULAR program, Google’s chief legal officer David Drummond said in a statement,
We do not provide any government, including the U.S. government, with access to our systems. We are outraged at the lengths to which the government seems to have gone to intercept data from our private fiber networks, and it underscores the need for urgent reform.
Blogger davidl published a video on Firedoglake of Levison speaking at a CNET/Electronic Frontier Foundation event last week. Levison’s story reveals the extreme lengths the government went to in order to compel him to become an informant. Whether or not these companies were aware of the NSA snooping, Levison’s case makes clear that without reform, they can either be forced to comply with intrusive and overly broad NSA requests, or forced to shut down.