The US National Security Agency's cyberspies may have used network infrastructure of carrier companies that operate internet backbones to get access to data flowing between data centers of some of the largest internet companies, including Google and Yahoo.
The spies bypassed the layers and layers of security companies had implemented inside their data centers by tapping directly into the infrastructure of network operators that carry traffic between those data centers, the New York Times reported Tuesday, citing anonymous sources familiar with Google's and Yahoo's infrastructure.
The article lists Verizon, BT, Vodaphone and Level 3 as carriers that may have been tapped but singles out Level 3 as the largest backbone provider. Both Google and Yahoo! use the Colorado company's services, the sources told the Times.
The news that the NSA was spying on network links between the two internet giants' data centers broke at the end of October. The Washington Post wrote a story based on documents it received from the former NSA contractor Edward Snowden, indicating that the security agency was tapping the infrastructure and was able to collect data from “hundreds of millions of user accounts, many of them belonging to Americans.”
These efforts were in addition to the NSA's so-called “front-door” access to some user data from the internet companies, which involves court approvals that require the agency to make the case for data collection in each case. Stories by the Post and the Times suggest tapping into carrier infrastructure enables the agency to go around that process.
Following publication of the Post's story, both Google and Yahoo announced they were boosting the level of encryption of data that flowed between their data centers.
Yahoo CEO Marissa Mayer announced that the company would introduce encryption with a 2048-bit key across its entire network and all of its products. All information moving between Yahoo data centers will be encrypted by the end of the first quarter of 2014, she wrote in a blog post.
The company's users will have an option to encrypt all data that flows between them and Yahoo by the end of Q1 as well. The firm also promised to work with its international partners that put the Yahoo brand on mail accounts to make sure all those accounts are enabled for this level of encryption.
“I want to reiterate what we have said in the past: Yahoo has never given access to our data centers to the NSA or to any other government agency. Ever,” Mayer wrote.
Speaking at an event in London Monday, Google's executive chairman Eric Schmidt told a group of government officials and corporate executives that the Mountain View, California, company had “tightened” security between all of its operations and was “working hard to make it tighter,” according to a report by the Wall Street Journal.
Schmidt said Google's response to the news that the NSA may have been collecting data from networks between its facilities was along the same lines as its response to the revelation that the Chinese government was spying on its infrastructure in 2010.
“One way to say it is that we’re now protected against the Chinese and the NSA,” he was quoted as saying.