Security News

NSA Win Leaves Security of Cell, Cloud Data Uncertain

NSA Win Leaves Security of Cell, Cloud Data Uncertain: The decision of a New York judge that the wholesale collection of cell-phone metadata by the National Security Agency is constitutional ties the score between pro- and anti-NSA forces at one victory apiece.

The contradictory decisions use similar reasoning and criteria to come to opposite conclusions, leaving both individuals and corporations uncertain of whether their phone calls, online activity or even data stored in the cloud will ultimately be shielded by U.S. laws protecting property, privacy or search and seizure by law-enforcement agencies.

On Dec. 27, Judge William H. Pauley threw out a lawsuit filed by the American Civil Liberties Union (ACLU) that sought to stop the NSA PRISM cell-phone metadata-collection program on the grounds it violated Fourth Amendment provisions protecting individual privacy and limits on search and seizure of personal property by the federal government.

Pauley threw out the lawsuit largely due to his conclusion that Fourth Amendment protections do not apply to records held by third parties.

That eliminates the criteria for most legal challenges, but throws into question the privacy of any data held by phone companies, cloud providers or external hosting companies – all of which could qualify as unprotected third parties.

The Pauley case involved the NSA’s PRISM surveillance program to collect metadata identifying all the calls made to or from almost every cell phone in the United States, which Pauley described as a “blunt tool [that] only works because it collects everything,” according to The New York Times.

The NSA didn’t limit its surveillance to metadata on phone calls, however. Revelations by whistleblower Edward Snowden and documents revealed by other government agencies suggest that the NSA eavesdropped on the phone calls of foreign political leaders, collected data on the Internet activity of Americans through the databases of foreign ISPs and tapped directly into the datacenter-network feeds of Google, Yahoo and other U.S.-based Internet giants.

Standard