PRISM: the first Snowden revelations
Summary
On 6 June 2013 Glenn Greenwald and Ewen MacAskill reported in the Guardian on PRISM, a secret program through which, according to an internal presentation, the NSA retrieved data from Google, Facebook, Apple, Microsoft and other US companies. As became clear three days later, the documents came from Edward Snowden. The article opened a series of revelations that permanently changed encryption, data protection and trust in US cloud services.
What the article reported
It was based on a top-secret 41-slide presentation used to train analysts. According to the slides, PRISM collected search histories, email content, file transfers and chats. Microsoft took part from December 2007, followed by Yahoo in 2008, Google, Facebook and PalTalk in 2009, YouTube in 2010, Skype and AOL in 2011 and Apple in 2012; Dropbox was planned.
All companies asked denied knowing of the program or giving the government direct access to their servers. The legal basis was section 702 of the FISA Amendments Act, which allows surveillance of people reasonably believed to be outside the USA.
Ideas
- Data held by large providers is also reachable for authorities.
- “Outside the USA” affects everyone who is not a US citizen.
- Encryption on the user’s side also protects against the provider.
- Slides show the agency’s view, not necessarily the technology.
Insights
- The revelations accelerated encryption everywhere: HTTPS by default, end-to-end encryption in messengers and projects such as Let’s Encrypt received a strong tailwind after 2013.
- Europe saw legal consequences: in 2015 the European Court of Justice struck down the Safe Harbor agreement for data transfers to the USA.
Facts
- The legal basis was section 702 of the FISA Amendments Act.
- The presentation comprised 41 slides and was classified top secret.
- According to the slides, Microsoft supplied data via PRISM from December 2007 and Apple from 2012.
References
Critique
- The phrase “direct access to the servers” came from the NSA slides and was denied by the companies; later reports suggested that data was delivered via FBI requests. The article presents the slides as technical fact more strongly than they prove.
Remarks
- Snowden revealed himself as the source on 9 June 2013 in a Guardian video.
Recommendations
- Encrypt confidential data yourself before uploading it to a cloud.
- With providers, check which law the data falls under, not just where it is stored.
Links to the original source and the Web Archive open in a new tab.