Microsoft Was Right To Worry That Government Snooping Constituted An ‘Advanced Persistent Threat’

Microsoft Was Right To Worry That Government Snooping Constituted An ‘Advanced Persistent Threat’

Dec 30th 2013, 23:02, by Alex Wilhelm

Early this month, Microsoft declared that ”government snooping potentially now constitutes an ‘advanced persistent threat,’” a statement that became ironic this weekend, given that, early this month, Microsoft likened government surveillance to “sophisticated malware and cyber attacks.”
New NSA revelations out this weekend detailed precisely how the NSA’s methods lean on malware and employ cyber attacks in their “snooping,” to use Microsoft’s term. Thus, the NSA’s surveillance efforts are not a potentialadvanced persistent threat, as Microsoft first published.
The term “advanced persistent threat,” by the way, isn’t a casual colloquialism that Redmond invented. According to the Wall Street Journal, the phrase “carries special weight in cybersecurity circles and is often used to describe hacker teams backed by the Chinese government.” That comparison is striking.
As TechCrunch covered yesterday, Der Spiegel has reported new NSA capabilities, much of which were presented in a catalog-like format, with price points and implementation times for the various tools listed along with diagrams indicating how the tool in question works. Need to get into an iPhone? Doable. Get past Juniper and Cisco security? The NSA claims that it can do that, no sweat.
It has become interesting to learn how holistic the NSA’s spying capabilities have become. The phone metadata program in the United States is perhaps (and perhaps wrongly) the most public piece of the NSA’s efforts. Through PRISM it can force user data out of American technology companies. Through MUSCULAR it can tap data cables between foreign data centers of American companies. And through the freshly disclosed ANT team and its book of secrets, it can break the security of American technology hardware companies.
What this means is that the NSA has not only shot the privacy of individual Americans full of holes, but has also broken the spine of security claims of American companies.
Microsoft’s comments were included in a post stating that it was working to bolster its encryption to prevent government incursion. But with the NSA working to harm encryption and backdoor hardware, it’s far from clear that even a concerted effort by large American technology companies can provide peace of mind to their customers.
Now, much of what Der Spiegel unveiled would be incredibly useful for foreign surveillance that would raise no eyebrows. But the fact that the NSA has managed to so pervasively penetrate security raises a follow-up question: Who else? That’s not an indictment of the NSA but more comment on the current technology environment.
The NSA can hack and track your phone. XKeyscore allows it to read your email. And programs as broad as tapping the core fiber cables of the Internet or a toolset to crack a single server of American provenance also allow ways in. What sort of threat to security could be more persistent than that?
Top Image Credit: Flickr