Latest Leak: UK Spies Tap Internet Cables, Collect Nearly Everything With Little Oversight, Then Shares It With NSA

from the and-another-thing dept

Another day, another leak released from the Ed Snowden files. The latest: evidence that the UK's equivalent of the NSA is tapping into fiber optic cables to hoover up all sorts of internet data, similar to the NSA. The UK group, GCHQ, literally has called these program: "Mastering the Internet (MTI)" and "Global Telecoms Exploitation (GTE)." They're not much for nuance or code names across the pond, I guess. Apparently, they're collecting a ton of data:

By 2010, two years after the project was first trialled, it was able to boast it had the "biggest internet access" of any member of the Five Eyes electronic eavesdropping alliance, comprising the US, UK, Canada, Australia and New Zealand.

UK officials could also claim GCHQ "produces larger amounts of metadata than NSA". (Metadata describes basic information on who has been contacting whom, without detailing the content.)

And, GCHQ and the NSA are teaming up to go through it all:

By May last year 300 analysts from GCHQ, and 250 from the NSA, had been assigned to sift through the flood of data.

But that's not all who have access to the data. The article claims 850,000 NSA employees and contractors with top secret clearance can access the GCHQ database. The report also notes that the UK spooks admit that they "have a light oversight regime compared with the US." Considering how light US oversight already is... In the US, there are those very weak minimization rules. In the UK, the analysts (including the American analysts working on the data) are told "it's your call."

The close releationship between GCHQ and the NSA is pretty clear. NSA boss Keith Alexander apparently visited the NSA's own Menwith Hill intercept station in the UK a few years ago and said: "Why can't we collect all the signals all the time? Sounds like a good summer project for Menwith."

The details in the report suggest that the data collection here is on a fairly epic scale. When discussing revealing how many people have had their data scooped up under the program, GCHQ's lawyers apparently said "this would be an infinite list which we couldn't manage." Think about that for a second.

As for how GCHQ is tapping directly into fiber optic cables? Apparently, they keep that under much tighter wraps than they do the information they're collecting on everyone:

This was done under secret agreements with commercial companies, described in one document as "intercept partners".

The papers seen by the Guardian suggest some companies have been paid for the cost of their co-operation and GCHQ went to great lengths to keep their names secret. They were assigned "sensitive relationship teams" and staff were urged in one internal guidance paper to disguise the origin of "special source" material in their reports for fear that the role of the companies as intercept partners would cause "high-level political fallout".

The source with knowledge of intelligence said on Friday the companies were obliged to co-operate in this operation. They are forbidden from revealing the existence of warrants compelling them to allow GCHQ access to the cables.

The tapping is done on transatlantic cables. If you want a sense of just who's likely to be playing along, why not check out this amazing interactive map of all 244 submarine cables around the globe. You can look up the names of the various cables to see who owns them, and you can pretty quickly get a fairly good sense of the companies who are likely "intercept partners." Here's a snippet... Yet again, it appears that all the assurances that the NSA and the government have been giving us are not fully forthcoming about the extent of surveillance operations and what the NSA has access to. The NSA claims it gets rid of US persons from its own data, but says nothing about US persons' data collected by this data in the UK. And while the UK claims that it gets rid of UK data (though, with little oversight), assuming the NSA provides similar access back... that's all kind of meaningless, isn't it?