Microsoft (And Others) Deny Being Part of Secret NSA PRISM Program

The National Security Agency (NSA) and the FBI are tapping directly into the central servers of nine leading U.S. Internet companies, extracting audio and video chats, photographs, e-mails, documents, and connection logs that enable analysts to track one target or trace a whole network of associates, according to a top-secret document by the Washington Post.  The program, code-named PRISM, has not been made public until now. Equally unusual is the way the NSA extracts what it wants, according to the document: “Collection directly from the servers of these U.S. Service Providers: Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube, Apple.” Dropbox, the cloud storage and synchronization service, is described as “coming soon.” 

PRISM recruited its first partner, Microsoft, and began six years of rapidly growing collection beneath the surface of a roiling national debate on surveillance and privacy, according to the Post. There has been “continued exponential growth in tasking to Facebook and Skype,” according to the PRISM slides. With a few clicks and an affirmation that the subject is believed to be engaged in terrorism, espionage or nuclear proliferation, an analyst obtains full access to Facebook’s “extensive search and surveillance capabilities against the variety of online social networking services.” Government officials and the document itself made clear that the NSA regarded the identities of its private partners as PRISM’s most sensitive secret, fearing that they would withdraw from the program if exposed. “98 percent of PRISM production is based on Yahoo, Google and Microsoft; we need to make sure we don’t harm these sources,” the briefing’s author wrote in his speaker’s notes.  According to a separate “User’s Guide for PRISM Skype Collection,” that service can be monitored for audio when one end of the call is a conventional telephone and for any combination of “audio, video, chat, and file transfers” when Skype users connect by computer alone. Google’s offerings include Gmail, voice and video chat, Google Drive files, photo libraries, and live surveillance of search terms.

Despite the above reporting, many of the companies (including Microsoft) have released statements denying being part of the program.

Microsoft: “We provide customer data only when we receive a legally binding order or subpoena to do so, and never on a voluntary basis. In addition we only ever comply with orders for requests about specific accounts or identifiers. If the government has a broader voluntary national security program to gather customer data we don’t participate in it.” The company is essentially denying involvement in PRISM. Microsoft owns Skype, another company listed as a participant.

Facebook: “We do not provide any government organization with direct access to Facebook servers,” said Joe Sullivan, chief security officer for Facebook. “When Facebook is asked for data or information about specific individuals, we carefully scrutinize any such request for compliance with all applicable laws, and provide information only to the extent required by law.”

Apple: “We have never heard of PRISM.  We do not provide any government agency with direct access to our servers, and any government agency requesting customer data must get a court order.”

Dropbox: “We’ve seen reports that Dropbox might be asked to participate in a government program called PRISM. We are not part of any such program and remain committed to protecting our users’ privacy.”

Google: “…does not have a ‘back door’ for the government to access private user data” and discloses information about users to government agencies “in accordance with the law, and we review all such requests carefully.”

Yahoo: “We do not provide the government with direct access to our servers, systems, or network.” She added: “Yahoo! takes users’ privacy very seriously.”