NSA mimics criminals in bid to infect millions of computers, report says
-
Mark Clayton Staff writer
The National Security Agency is attempting to dramatically expand its espionage activities, implanting malicious software on potentially millions of computers worldwide, according to a new batch of leaked top secret documents.
They show the agency moving far beyond the collection of data flowing across the Internet to include 鈥渋ndustrial scale espionage鈥� that directly targets computer networks and backbone Internet systems like routers.
Such a sweeping campaign to infect millions of users would be so broad that it couldn鈥檛 possibly be a 鈥渢argeted鈥� program against specific individuals. Instead, it suggests that the NSA program is yet another potent part of a global mass-surveillance campaign that has roiled Congress, technology companies, and the public.
鈥淭his is not about targeted surveillance anymore, but wholesale mass surveillance 鈥� the legality of which has been聽questioned by some of its participants,鈥� writes John Shier, a security adviser at Sophos, a global cloud-security provider in Oxford, England, in an e-mail interview. 鈥淭he rapid growth of this program seems to further support the idea that the NSA鈥檚 definition of targeted surveillance is not quite the same as the rest of the world鈥檚.鈥�
The documents come from Edward Snowden, the former NSA contractor who has unveiled many other programs now under scrutiny. Those have included large-scale cyberespionage operations as well as the collection of billions of American鈥檚 phone-call records on Americans.
The new leaks suggest the NSA is 鈥渄ramatically expanding its ability to covertly hack into computers on a mass scale by using automated systems that reduce the level of human oversight in the process,鈥� says the analysis, which appeared Wednesday in The Intercept, an online news outlet run by Glenn Greenwald.
The move represented 鈥渁 major tactical shift鈥� toward 鈥渁 new frontier of surveillance operations,鈥� the story co-written by Mr. Greenwald says.
A top-secret August 2009 presentation suggested that one part of the operation (code-named TURBINE) was designed to operate 鈥渓ike the brain,鈥� the Intercept reported. It manages the various tools in TURBINE and decides which ones to deploy in each machine it infects.
Targets weren鈥檛 limited to foreign adversaries, the report says. They included system administrators of Internet services, foreign phone companies, and backbone routers relied upon by Internet users worldwide. By hacking these routers 鈥� which link computer networks and convey data across the Internet 鈥� the NSA would get secret access to monitor Internet traffic.
The NSA refused to answer questions regarding so-called implants, but referred to a new presidential policy directive.
鈥淪ignals intelligence shall be collected exclusively where there is a foreign intelligence or counterintelligence purpose to support national and departmental missions, and not for any other purposes,鈥� the NSA told The Intercept.
But that may not quell public and political anxiety over the NSA鈥檚 surveillance techniques. Also of note: Signs suggest that overseas agencies including Britain鈥檚 Government Communications Headquarters (GCHQ) were involved, too.
Part of the problem is that such programs not only make infected systems more vulnerable to criminal malware but also undermine public confidence in the Internet.
鈥淟ots of innocent US citizens will be ensnared as a side-effect,鈥� writes Andrew Jaquith, chief technology officer at SilverSky, a cloud-based cybersecurity company, in an e-mail interview. 鈥淚mplantation of malware is useful in targeted cases... If true, [it] would certainly qualify as mass surveillance in my book.鈥�
Other cybersecurity experts say the leaked documents show the NSA is appearing to mimic criminal computer 鈥渂otnet鈥� techniques that infiltrate, infect, and then enslave computers 鈥� turning those 鈥渮ombies鈥� into a computer army that can be used for criminal activity, espionage, or attacks.
鈥淭he TURBINE system detailed by the classified NSA documents does not propose a unique approach to mass exploitation, but instead details a federally funded botnet,鈥� writes Michael Sutton, vice president of security research for Zscaler, a global cloud-based cybersecurity company, in an e-mail interview.
鈥淚t is simply not possible to infect millions of devices for intelligence gathering and not negatively impact innocent victims along the way,鈥� he adds. 鈥淚n doing so, the NSA is placing those individuals at risk by lowering the security of their devices and opening them to further attack by third parties.鈥�
