Microsoft unveils German data plan to tackle US internet spying
ft.com
ft.com
(a) The number of intentional leaks in Microsoft products (esp new Window's) that might be inspired by NSA surveillance
(b) The leaks showing German BND and Five Eyes cooperate very closely on SIGINT with BND letting them use selectors that no patriot of German government or industry should've tolerated.
Many articles, esp Der Spiegel, also indicate that German intelligence is lap-dogging so hard in an attempt to join Five Eyes club. Additionally, remember that the TAREX teams in ECI leaks were focusing on Germany, South Korea, and China. Yeah, not all the terrorism they talk about on TV: one opponent and two seeming partners. What do all three have in common? They're among the biggest economies competing with American (and Five Eyes') business interests. Makes sense among scheming intelligence agencies to use assets against them to get privileged few tight with Washington a competitive advantage and do counter-intelligence against their agencies doing the same.
So, Microsoft are either a bunch of idiots that have no awareness of Snowden leaks or reporting on the situation with NSA and Germany. Or they knew that while subverting their European offering to give NSA every chance to hit the customers' data as a favor to them to avoid pressure and keep lucrative contracts. I'm betting on the latter to be safe and continuing a boycott of Microsoft tech where possible.
At some point our options really become: relying on tech providers without presence in "unsafe" jurisdictions (if there are any), relying on tech providers willing to disobey the law (and ideally capable of convincing us they disobey them in our favor. Via: open-source, audits, etc) or pursuing reform of those laws.
[1] https://www.eff.org/who-has-your-back-government-data-reques...
A step away.
> Nothing by itself.
Not so.
> Solving these problems is a tad more difficult than merely using Linux.
True. But it's swallowing the red pill, just something you have to swallow to know how deep the rabbit hole goes.
"Not so." Prove it. Linux still shows your communications on plaintext online by default. They have zero days in popular apps and kernel for Linux. They have attacks below firmware if you get clever with OS security. So, no, using Linux by itself doesn't change anything for bulk collection as proven by the Snowden leaks. It can be an improvement over Windows for targeted collection but will still be hit in default state. And most people hearing "Use Linux" aren't qualified to get it anywhere near bulletproof. So, they'll be easy targets.
Using any standard, mainstream system when nation-states are after you equals much higher chance of getting your box owned. It's just economics: they focus on attacks w/ highest ROI. Windows, Mac, and Linux kernels are highest ROI for desktop. People on an Amiga are probably less likely to get hacked by automated system despite inferior security just because of its obscurity and attackers' focus. It's why my old trick of BSD or UNIX on non-popular ISA's (eg Alpha) stopped so many attacks despite their apparent sophistication.
The only method of securing your data is to make sure it never leaves your computer without your consent and using Linux is one of many possible things you can do to ensure that. Sure, if you're running Skype, Chrome, Steam, etc. on your Linux laptop then the benefit is pretty marginal but still technically better than if it was on Windows.
https://www.schneier.com/blog/archives/2014/05/friday_squid_...
Might explained why a few closed source products achieved high assurance security (B3/A1/EAL6/EAL7) that survived years of NSA pentesting while FOSS... see Snowden leaks. You can get those freedoms with proprietary models via contracts, esp with non-profits. Most just are about money though. Likewise, FOSS communities rarely deliver high-quality, maintained software and never deliver highly assured software.
So all this philosophical crap serves nobody if we're talking about making software trustworthy. For that, we need capable people building it while utilizing every security-enhancing method we know, trustworthy people reviewing it whether closed or open, ability to know you possess what was reviewed in that configuration, and continual maintenance esp of bugfixes. That's the baseline we need to push whether FOSS or a proprietary version of open-source.
http://www.europe-v-facebook.org/EN/Complaints/PRISM/Respons...
If Microsoft would just keep the data there, that would be a good thing. But I suspect it will transfer the data from Deutsche Telekom back to US servers, where the US government will be able to request it anyway. I'm hoping Microsoft won't do that, though.
If Microsoft were actually interested in privacy, they'd design their products in such a way that Microsoft would have no technical ability to get to users' data without the end user's permission. A true zero knowledge data center whereby Microsoft does not have the technical ability to restore users' data is the only viable solution.
Considering that many encryption systems around seem to get broken, I don't think that's the only solution needed.
Client-side encryption using C libraries on Linux or whatever is just asking to be hacked. Best will be secure hardware, drivers, kernel, and trusted components. See CHERI processor [4], EROS documentation [5] (esp "Principle-driven...") and Mikro-SINA VPN [6] for examples of The Right Thing in security-critical development. Need more like that.
[1] http://pastebin.com/y3PufJ0V
[2] https://www.schneier.com/blog/archives/2014/09/identifying_d...
[3] https://github.com/maqp/tfc-otp
[4] https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/
Yes. Client-side encryption for cloud storage, end-to-end encryption for instant messaging? Now it does not matter where the servers are.
This is just a show to regain customer trust, but the added privacy is marginal.
You can have/do that. What is the problem?
Wrt client side encryption, how would you expect MS to run ML/SQL/DocDb/Office on their German servers without reading the data? MS offers some of those products on premise, so that's client side in my view. ie you can run Office, SQL, Service Bus, Skype, Active Directory on your own machines, actually MS still makes most of its income selling software. If there are companies not offering that flexibility those are Google, think Gmail/Docs/Hangout, and Amazon.
(This for one microsoft-applicable meaning of "cloud". It baffles me why tech people have so eagerly adopted such an ill-defined marketing term)
How do we know? Is Microsoft planning to release the source code?
> If the German government can access that data so what? Do you really expect to escape from that?
Yes.
I agree with your general point that this is a step forward, but I am also wary that people will perceive this as solving the massive problems we have with securing ourselves from pervasive surveillance.
Keep in mind this is basically just a promise from Microsoft that they'll keep your data in your country, so it's only as good as Microsoft's willingness and ability to keep that promise. If you trust it it's a step forward, but Microsoft is far from being worthy of that trust, so it's a very small step forward, so small it's barely worth talking about.
The US government is still undoubtedly going to get the data no matter who stores it, but they're going to have to risk pissing off the German government to get it.
Ahahaha. Our government is knee-deep in the dungheap. The GCHQ spies on Americans to avoid US protections, the GCHQ spies on every European country and the BND is also in the mix.
All that our "government" did was a couple harsh words towards the US, faking a "no spy deal", and behind the records a "continue with spying" to the BND and MAD.
There's also another reason for why I prefer a local government to the US. My country does not have spy agencies with a 50 billion USD yearly budget. The NSA can get in places where my government cannot simply because of resources available. Oh, and most of us are software developers and the NSA is probably engaged in industrial espionage, so you know, if you're an European company, that would be something to think about.
Maybe from the point of view of a European software developer the greatest concern is industrial espionage, I don't know. But let's say you are someone exposing the corruption in the local police force. Would you rather host your anonymous website in your country -- knowing that the local police can threaten the company hosting it, then knock on your door and "get you to stop" --, or would you rather put it on some server in the USA, where they have no power?
This is the first mover. Next wave will be SaaS companies (Email e.g.) guaranteeing data stays in the EU. At the end of January no EU company can transfer email addresses, IP addresses or HR data into the US. Only if there is a Safe Harbor II coming where the US guarantees to not spy on data without warrant/open procedure and legal recourse by EU citizens.
PS: I know this EUGH ruling does not make sense with UK and France having the same intransparent all-people are spyed on. But this are the rules now.
That guarantee would be completely unbelievable at this point.
> I know this EUGH ruling does not make sense with UK and France having the same intransparent all-people are spyed on.
The EUGH ruling makes perfect sense, it's just a partial solution instead of a complete one.
Given the US is believed to be the most powerful of the bad actors (i.e., they NSA have the most backdoors and other capabilities) removing them from the system is not an insignificant step. Shutting out UK and France as bad actors will be more complicated.
Deutsche Telekom is still owned by the Federal Republic (31% iirc) so one could argue that most substancial decisions, like preventing FTTH, undermining net neutrality and the lack of innovation, is either accepted or even enforced by the biggest single shareholder.
Or it's just another sign, that politics should get out of the business as they are not qualified and not independent enough to control their stakes in corporations which also includes a technological perspective for the foreseeable future to secure the business.
Deutsche Telekom has no such perspective in its home country business, only the US mobile business keeps growing. At home, Deutsche Telekom is just fighting an rearguard battle. Whatsapp killed SMS, Skype killed Voice, AWS kills the mid/large enterprise datacenter outsourcing business, margins fall, jobs got cut. Venture Capital business "T-Venture" failed, was shut down, only some SV investments will be made in the future, no focus on local/German startups anymore.
Even their marketing department has no clue about "that cloud thingy", releasing official media materials like:
"Cyber Security in German: Hackers need to stay out" https://www.telekom.com/static/-/106374/2/Foto-04_850x550-bi
and more: https://www.telekom.com/medien/bild-ton-und-infografiken/fot...
It's a shame that Germany has no investor person like Carl Icahn who is able to force the management to deal with the consequences: Shutting down/selling dying T-Systems, selling T-Mobile USA, revamping local access business to make money and stay competitive.
Usually the next wave of technology also implies new investments into the network and less profits, so IMHO right now it would be a great time to sell as much of the T-Mobile USA stocks as possible.
[ads]Btw, if you need to store sensitive data in EU then you should use chino.io[/ads]
"Will be interesting to see whether customers will agree to pay a premium for a risk that they do not understand much less can quantify.
The elephant in the room is that all European companies engaged in international commerce are breaching European data protection laws in some way on any given day. The vagueness and subjectivity of many obligations under the legislation leave businesses in an almost impossible position. And most citizens have no idea what benefits the legislation bestows on them because it is so complicated and philosophical. The regime has been in place since 1995 and since that time the average Jo, Jean, Juan and Johannes have all had their 'privacy' massively eroded, however you define that term. The one benefit it was meant to have was harmonisation to make the single market work, but that hasn't really worked either. Frankly, it is a complete sham and failure.
Whilst the single market is powerful force for good, it is continually under attack from this sort of well-intentioned but barmy 'social' protection initiative. All it seems to benefit is the army of regulators at a national and European level who engage in endless navel gazing, looking out for the next hapless target to keep them gainfully employed."
Yes, Government surveillance is a problem. That doesn't make data protection law worthless.
It's thanks to the Data Protection Directive that you can force Facebook to hand over the data it's secretly collecting on you despite not using it, for example.