美国安全局“肌肉发达” 被指“行窃”谷歌雅虎

This undated photo provided by Google shows a Google data center in Hamina, Finland.

The National Security Agency has secretly broken into the main communications links that connect Yahoo and Google data centers around the world, The Washington Post reported Wednesday, citing documents obtained from former NSA contractor Edward Snowden.

A secret accounting dated Jan. 9, 2013, indicates that NSA sends millions of records every day from Yahoo and Google internal networks to data warehouses at the agency's Fort Meade, Md., headquarters. In the last 30 days, field collectors had processed and sent back more than 180 million new records — ranging from "metadata," which would indicate who sent or received emails and when, to content such as text, audio and video, the Post reported Wednesday on its website.

The latest revelations were met with outrage from Google, and triggered legal questions, including whether the NSA may be violating federal wiretap laws.

"Although there's a diminished standard of legal protection for interception that occurs overseas, the fact that it was directed apparently to Google's cloud and Yahoo's cloud, and that there was no legal order as best we can tell to permit the interception, there is a good argument to make that the NSA has engaged in unlawful surveillance," said Marc Rotenberg, executive director of Electronic Privacy Information Center. The reference to 'clouds' refers to sites where the companies collect data.

The new details about the NSA's access to Yahoo and Google data centers around the world come at a time when Congress is reconsidering the government's collection practices and authority, and as European governments are responding angrily to revelations that the NSA collected data on millions of communications in their countries. Details about the government's programs have been trickling out since Snowden shared documents with the Post and Guardian newspaper in June.

The NSA's principal tool to exploit the Google and Yahoo data links is a project called MUSCULAR, operated jointly with the agency's British counterpart, GCHQ. The Post said NSA and GCHQ are copying entire data flows across fiber-optic cables that carry information between the data centers of the Silicon Valley giants.

The NSA has a separate data-gathering program, called PRISM, which uses a court order to compel Yahoo, Google and other Internet companies to provide certain data. It allows the NSA to reach into the companies' data streams and grab emails, video chats, pictures and more. U.S. officials have said the program is narrowly focused on foreign targets, and technology companies say they turn over information only if required by court order.

In an interview with Bloomberg News Wednesday, NSA Director Gen. Keith Alexander was asked if the NSA has infiltrated Yahoo and Google databases, as detailed in the Post story.

"Not to my knowledge," said Alexander. "We are not authorized to go into a U.S. company's servers and take data. We'd have to go through a court process for doing that."

It was not clear, however, whether Alexander had any immediate knowledge of the latest disclosure in the Post report. Instead, he appeared to speak more about the PRISM program and its legal parameters.

In a separate statement, NSA spokeswoman Vanee Vines said NSA has "multiple authorities" to accomplish its mission, and she said "the assertion that we collect vast quantities of U.S. persons' data from this type of collection is also not true." At no point did the NSA deny the existence of the MUSCULAR program.

The GCHQ had no comment on the matter.

The Post said the NSA was breaking into data centers worldwide. The NSA has far looser restrictions on what it can collect outside the United States on foreigners and would not need a court order to collected foreigners' communications.

Cybersecurity expert James Lewis said it is likely that the Google and Yahoo data was part of a larger collection of communications swept up by the NSA program from the fiber-optic pipeline. He said that while the collection was probably legal, because it was done overseas, the question is what the NSA did with the data linked to U.S. citizens.

To meet legal requirements, the NSA has to distinguish between foreign and U.S. persons, and must get additional authorization in order to view information linked to Americans, said Lewis, who is with the Center for Strategic and International Studies. He said it's not clear from the reports what the NSA did with the U.S. data, and so it's difficult to say whether the agency violated the law.

David Drummond, Google's chief legal officer said the company has "long been concerned about the possibility of this kind of snooping."

"We do not provide any government, including the U.S. government, with access to our systems," said Drummond. "We are outraged at the lengths to which the government seems to have gone to intercept data from our private fiber networks, and it underscores the need for urgent reform."

Google, which is known for its data security, noted that it has been trying to extend encryption across more and more Google services and links.

Yahoo spokeswoman Sarah Meron said there are strict controls in place to protect the security of the company's data centers. "We have not given access to our data centers to the NSA or to any other government agency," she said, adding that it is too early to speculate on whether legal action would be taken.

The MUSCULAR project documents state that this collection from Yahoo and Google has led to key intelligence leads, the Post said.

Congress members and international leaders have become increasingly angry about the NSA's data collection, as more information about the programs leak out. A delegation from the European Union Parliament came to Washington this week to conduct intense talks about reported U.S. spying on allied leaders, including the collection of phone records. And a German delegation met with U.S. officials over allegations that the NSA was monitoring Chancellor Angela Merkel's cellphone.

Alexander told lawmakers that the U.S. did not collect European records, and instead the U.S. was given data by NATO partners as part of a program to protect military interests.

Congress members, however, are working on plans that would put limits data collection. And Sen. Dianne Feinstein, chairwoman of the Senate Intelligence Committee, has called for a "total review of all intelligence programs"

More broadly, Alexander on Wednesday defended the overall NSA effort to monitor communications. And he said that as Congress considers proposals to scale back the data collection or provide more transparency to some of the programs, it's his job to lay out the resulting terrorism risks.

"I'm concerned that we give information out that impacts our ability to stop terrorist attacks. That's what most of these programs are aimed to do," Alexander said. "I believe if you look at this and you go back through everything, none of this shows that NSA is doing something illegal or that it's not been asked to do."

Pointing to thousands of terror attacks around the world, he said the U.S. has been spared much of that violence because of such programs.

"It's because you have great people in the military and the intelligence community doing everything they can with law enforcement to protect this country," he said. "But they need tools to do it. If we take away the tools, we increase the risk."

美国《华盛顿邮报》10月30日援引爱德华•斯诺登文件称，美国国家安全局

***曝光

日期为2013年1月9日的机密报告显示，NSA每天从雅虎和谷歌的内部网络截取数百万条信息，并将这些信息发送回马里兰州米德堡的NSA总部的数据库中。在此之前的30天里，数据收集人员曾处理并发回1.8亿多条新记录，这些数据包括电子邮件的发件人、收件人、时间等“元数据”，还有文本、视频、音频等内容信息。

NSA和英国政府通信总部

此前曝光的“棱镜”项目通过法院指令强迫谷歌、雅虎以及其他互联网企业提供特定数据。NSA因此接触到这些公司的数据流，抓取电子邮件、视频聊天、图片等信息。美国官员曾表示“棱镜”只针对外国目标，科技公司则称他们只有收到法院指令才移交信息。

***否认

美国国家安全局局长基思•亚历山大10月30日否认NSA侵入谷歌和雅虎数据库。他说：“据我所知并非如此。我们没有权利访问美国公司的服务器并搜集数据，除非获得法庭许可。”

美国国家安全局发言人范尼•瓦因斯发布声明中说，“有关我们以这种方式搜集海量美国公民数据的说法是不真实的。”但声明没有否定“肌肉发达”项目的存在。英国政府通信总部拒绝发表评论。

***争议

最新披露的文件激起了谷歌公司的愤怒，且引起了法律争议，如美国国家安全局是否可能违反了联邦窃听法案。

“尽管

美国战略与国际研究中心的网络安全专家詹姆斯•刘易斯表示，谷歌和雅虎的数据只是NSA搜集到海量数据中的一部分。他认为，搜集行动发生在海外，所以很有可能合法，但问题是NSA拿这些和美国公民有关的数据做了些什么。刘易斯说，按照法律要求，NSA需要区别外国人和美国人，且浏览有关美国人的信息时必须获得额外的授权。但报告中没有明确指出NSA如何处理美国数据，是否违法也很难说。

谷歌首席法律顾问戴维•德拉蒙德说，谷歌“长期以来一直担心此类监听的可能性……我们没有授权包括美国政府在内的任何政府进入我们的系统。我们对美国政府的行为感到愤慨。此事也凸显了迫切改革的必要性。”素来以数据安全著的谷歌表示，该公司一直在努力将加密技术拓展到谷歌越来越多的服务和连接中。

雅虎发言人萨拉•梅龙也说，雅虎对数据中心有严格控制。“我们不允许NSA或任何其他政府机构访问我们的数据中心。”不过，她表示现在还不急于考虑是否采取法律行动。

随着越来越多监听项目的曝光，美国国会成员和国际上的领导人对NSA搜集数据的行为愈发愤怒。欧洲议会代表团本周抵达华盛顿，就监听监听领导人一事进行紧张谈判。德国也派代表就窃听默克尔手机一事会晤了美国官员。

***辩护

NSA局长亚历山大表示美国并没有搜集欧洲数据，相反是北约盟国为了保障军事利益向美国提供情报。不过，国会正致力于起草法案，限制数据搜集。参议院情报委员会主席黛安娜•范斯坦已呼吁“彻查所有的情报项目”。

亚历山大30日在为NSA行为辩护时说：“我担心，公布信息会影响我们的反恐能力。而这是大部分监控项目的目标……我相信，如果你看过这些信息，再回顾整件事，会发现没有任何迹象显示NSA有违法或越权行为。”

他指出，这些项目让美国避免了不少恐怖袭击。“这是因为，我们的军队、情报人员和执法部门一起，尽一切努力依法保护这个国家。但是他们需要工具。如果我们剥夺这些工具，风险就会增加。”

“肌肉发达”项目文件显示，从雅虎和谷歌搜集的信息提供了关键的情报线索。