Is software/hardware of USA based companies a security risk?

[Quintillus]

All of which contain useless data. It's like getting outraged that the government owns a landfill because they might end up poking through some of your garbage. I've made a lot of garbage over my lifetime, just like I've sent a lot of useless texts. If none of my garbage includes ripped up fake passports and none of my texts include murder plans, then nobody cares.

Your communications may only contain useless data; that doesn't mean the same is true for everyone. The landfill comparison isn't the same, either - by and large, there's no practical way to figure out who's responsible for what in a landfill. Unless you suspect the garbage is being sorted though prior to reaching the landfill - IMO that's the realm of paranoia.

It is very significant. A company should not have access to such data unless consent has been acquired. This is because a corporations' stakeholders are the shareholders with a profit imperative.

I agree. But that doesn't mean a government should have access to that data. It's also a door to a whole different topic - how much the access is consent vs just clicking "I agree" / skipping over 5 pages and signing your name - but that's for a different thread.

No it can't. That's why we have the law. For example, the prisoners at Guantanamo are an error because they never received a trial. Should American citizens get treated that way, then we have a problem. But we won't, because it's illegal to arrest somebody for their beliefs.

The problem is that the government doesn't always follow the law. Guantanamo itself being an example - treatment of prisoners there has at times (and possibly currently) violated international law, particularly the Geneva Convention, with the Bush Administration arguing that was OK because in its opinion the prisoners weren't entitled to the protection of international law. The fact that they aren't American citizens shouldn't affect their protections under international law.

As another example, James Clapper has lied under oath to Congress about the NSA's actions, thereby committing the crime of perjury. Given that Congress is partially responsible for oversight of the NSA, this is quite serious - how can you oversee an agency that's lying to you about its actions? If Bill Clinton was nearly impeached for perjury about having sexual relations - a much less important matter - surely James Clapper should be tried for perjury.

There's also the huge issue of the NSA spying breaking the 4th Amendment. Why can the government search your e-mail and phone records without a warrant, when a warrant is required to search your physical mail? They're fundamentally the same, just using different technologies. That's no small part of the issue here - the government is blatantly breaking its own laws.

And when our country becomes a dictatorship, you'll have a point. Until then, we have the rule of law in this land. And no president, no matter how much intimate private information they have on "pro-abortion supporters", will ever be able to simply round them up and arrest them.

The problem is we don't have the rule of the law in significant portions of our government. It is still infeasible for any portion of the government to round up their enemies and squelch them. But this trove of information makes that significantly easier.

----------

tl;dr

The other significant issue in this, besides the lying, perjury, and unaccountability, is that the actions of the NSA go against the protections against government in the Bill of Rights. The 1st Amendment's protections help the citizens prevent their government from becoming overly oppressive in the first place. The 2nd Amendment isn't about hunting or self-sufficiency; it's about protecting the right of citizens to overthrow oppressive governments should the 1st Amendment protections prove insufficient. The 4th Amendment works in tandem with both; its protections allow opposition movements to organize without being hassled (searched) purely for their beliefs. The 6th and 8th Amendments protect those imprisoned but not convicted, including those who may be politically imprisoned. The NSA's actions violate the 4th Amendment, and has a chilling effect on the 1st Amendment. It's very much not the rule of law.

More focused on the topic, at least one European Commissioner thinks this may have a significant impact on American cloud companies:

http://www.guardian.co.uk/world/2013/jul/04/european-us-internet-providers-nsa

 

[TheMeInTeam]

As another example, James Clapper has lied under oath to Congress about the NSA's actions, thereby committing the crime of perjury. Given that Congress is partially responsible for oversight of the NSA, this is quite serious - how can you oversee an agency that's lying to you about its actions? If Bill Clinton was nearly impeached for perjury about having sexual relations - a much less important matter - surely James Clapper should be tried for perjury.

There's also the huge issue of the NSA spying breaking the 4th Amendment. Why can the government search your e-mail and phone records without a warrant, when a warrant is required to search your physical mail? They're fundamentally the same, just using different technologies. That's no small part of the issue here - the government is blatantly breaking its own laws.

It's a slippery slope too IMO. If people are accepting this is going on and that it is OK for the government to explicitly violate the constitution, which particular amendment is next? It doesn't have to be a dictatorship to turn really bad in a hurry, especially if other major political or economic forces emerge sufficiently to turn people desperate. Social security might become a really interesting issue in the next 5-10 years, among other problems. Paranoia of the masses is hard to predict, and with precedent of violating the constitution already set, what happens next? I don't want to be here if that happens that's for sure.

The problem is we don't have the rule of the law in significant portions of our government. It is still infeasible for any portion of the government to round up their enemies and squelch them. But this trove of information makes that significantly easier.

Oh, I don't know. We already have evidence of government-initiated harassment through the IRS on certain companies/groups/etc...and literally during a major election no less. The only reason they don't do that to individuals is that it's too costly and yields basically nothing IMO. How far away is such a model, really?

The NSA's actions violate the 4th Amendment, and has a chilling effect on the 1st Amendment. It's very much not the rule of law.

Chilling indeed, especially when viewed as precedent, and why shouldn't it be?

 

[Kaitzilla]

...


With the point that the USA is spying aggressively on everyone, I'd like to elaborate on the question if any US based company can still be trusted, since even don't-be-evil Google or we-know-what-you-did-last-summer Facebook are cooperating with the NSA to some extent ... and in the case of Microsoft extensively, like Dr Richard Stallman accuses:

http://techrights.org/2013/06/27/techbytes-episode-79/


And really, if Microsoft builds in backdoors for the NSA and informs them of security bugs well before fixing them, how can one assume that ANY security hardware from US companies will protect non-US businesses from corporate espionage or governments from their US "allies".
Take Cisco, Netgear or Symantec who specialize in net-security and whose business is based on trust.

But now there is no trust.
The USA has become inherently untrustworthy and so are its companies, which are forced by law to submit every sensitive data to the NSA if it is deemed necessary.
...

I would consider all hardware and software from the US a security threat if you don't want stuff being read by someone.

The NSA is busy writing code for the next Android operating system, so most smartphones should be nice and packed with spying in the future.
http://www.businessweek.com/articles/2013-07-03/security-enhanced-android-nsa-edition#r=nav-fs

Through its open-source Android project, Google has agreed to incorporate code, first developed by the agency in 2011, into future versions of its mobile operating system, which according to market researcher IDC runs on three-quarters of the smartphones shipped globally in the first quarter. NSA officials say their code, known as Security Enhancements for Android, isolates apps to prevent hackers and marketers from gaining access to personal or corporate data stored on a device. Eventually all new phones, tablets, televisions, cars, and other devices that rely on Android will include NSA code, agency spokeswoman Vanee’ Vines said in an e-mailed statement.

It might have already been discovered as a massive security flaw 5 days ago in this hilarious article:
http://www.bbc.co.uk/news/technology-23179522

A "master key" that could give cyber-thieves unfettered access to almost any Android phone has been discovered by security research firm BlueBox.

The bug could be exploited to let an attacker do what they want to a phone including stealing data, eavesdropping or using it to send junk messages.

The loophole has been present in every version of the Android operating system released since 2009.

Google said it currently had no comment to make on BlueBox's discovery.

Any kind of malware they do write like Stuxnet or Flame will go right through any commercially available virus protection. They take each off the shelf and try them one at a time to make sure nothing gets detected before letting it go in the wild.


Assume Windows has a backdoor for sure.


Hard to estimate if CPU's have some kind of security flaw built into them. I'd say yes.
Intel probably has given the NSA access to all VPro technology CPU chips made in the last 6 years. That means remote access to everything on the computer even when it is turned off.

http://en.wikipedia.org/wiki/Intel_vPro

Intel vPro technology is an umbrella marketing term used by Intel for a collection of computer hardware technologies that enable management features such as remote access to the PC (including monitoring, maintenance, and management) independent of the state of the operating system (OS) or power state of the PC, and security features.

http://communities.intel.com/thread/3490

Intel has also been working closely with the NSA to improve vPro from a DoD security perspective.

Reporter Sharyl Attkisson is a good example:
http://www.cbsnews.com/8301-201_162-57589367/cbs-news-confirms-sharyl-attkissons-computer-hacked/


SSL is probably junk
http://www.zdnet.com/how-the-nsa-and-your-boss-can-intercept-and-break-ssl-7000016573/
http://www.zdnet.com/prism-heres-how-the-nsa-wiretapped-the-internet_p2-7000016565/

In fact, every security certificate authority has probably already been FISA'd by the NSA and then gag ordered so they can man in the middle everything.

And any webcam or internet connected microphone, including your cell or an OnStar speaker can be remotely activated to watch or listen to you secretly too.
Anything put into "cloud" storage will also be permanently recorded I'm sure.


This seems like a decent post on good security precautions if you are concerned:
http://market-ticker.org/akcs-www?singlepost=3204911

AES 256 is also probably still good.

 

[Zelig]

The NSA isn't good enough to indefinitely hide backdoors in open source programs. (And there's no indication that they've ever hid a backdoor in any open source program.)

Access to your computer is pretty obviously impossible when it's turned off - you need to physically power RAM or spin up hard disks to use them.

And barring quantum computing, AES 128 is mostly better than AES 256, the key size is large enough in either case to be irrelevant, but AES 128 has fewer attacks discovered against it.

And "any webcam can be remotely activated" is only relevant in the context of a fully-compromised system, in which case anything can be remotely activated. Furthermore, if you take most any webcam apart, you'll see that it's physically impossible to power it without activating the LED.

 

[TheMeInTeam]

The NSA isn't good enough to indefinitely hide backdoors in open source programs. (And there's no indication that they've ever hid a backdoor in any open source program.

Why would they attempt that?

1. They don't need to do that to get what they're looking for in a vast majority of cases.
2. Judging by everyone's reaction, they have obvious incentive (and are acting a motive) to be discreet. Altering visible code is not very discreet, compared to closed-door dealings.

 

[Zelig]

Yes, I agree with those points.

 

[TheMeInTeam]

It *is* possible to turn on computers remotely, by the way. However, it's also true that you can't do much with any data while it's off, so you'd have the semi-obvious tell that your machines turned themselves on if someone were trying to access information that way.

Of course, they could do it at any time you have a pattern of not using the computer and are unlikely to be aware/near it (like at night if a known entity consistently doesn't show activity then). If you already had a backdoor, doing this would be comparably trivial I suspect.

Scary stuff overall, with the only reassuring thing being that most of us are just grains of sand on the beach.

 

[dutchfire]

If you were particularly interested in keeping certain data away from the NSA, you should not put it on a computer with access to the internet. You should probably also put something in front of the lens of your webcam if you want to do sensitive things in the same room. If you pull the power/battery and internet cables from a computer, it should also be pretty okay.

 

[TheMeInTeam]

If you were particularly interested in keeping certain data away from the NSA, you should not put it on a computer with access to the internet. You should probably also put something in front of the lens of your webcam if you want to do sensitive things in the same room. If you pull the power/battery and internet cables from a computer, it should also be pretty okay.

Yeah, all true. I don't have anything worth hiding nor am I a person of much interest though. I have no real power and would rather enjoy my life than lie in a bed of snakes.

IE as things decline here, I'd rather just move somewhere else rather than resist what I feel is a matter of time systemically no matter what I say or do. The question then becomes "where else"?

 

[Zelig]

If you were particularly interested in keeping certain data away from the NSA, you should not put it on a computer with access to the internet. You should probably also put something in front of the lens of your webcam if you want to do sensitive things in the same room. If you pull the power/battery and internet cables from a computer, it should also be pretty okay.

As I mentioned earlier in this thread, if you take a webcam apart, you'll see that it's physically impossible to power it without lighting the power LED.

 

[dutchfire]

If you take a webcam apart, you don't have a webcam anymore

 

[TheMeInTeam]

If you take a webcam apart, you don't have a webcam anymore

Sounds pretty safe to me!

There are all kinds of things that can go wrong with webcams that have nothing to do with NSA involvement .