Their Denials are Meaningless!

I occasionally listen to Security Now! with Steve Gibson and Leo Laporte, a tech webcast about security and privacy, because it is relevant to my profession. It is about computer security and how things like encryption work. This is not a political series. So I was quite surprised when I heard this exchange on episode SN410:

Steve: Okay. So The New York Times article, this is Bruce writing: "This article on the cozy relationship between the commercial personal-data industry and the intelligence industry has new information on the security of Skype." So now switching to The New York Times article, quoting from that: "Skype, the Internet-based calling service, began its own secret program, Project Chess, to explore the legal and technical issues in making Skype calls readily available to intelligence agencies and law enforcement officials, according to..."

Leo: This is way pre-Microsoft. This is under eBay.

Steve: Yes. Years, years. Yes, yes, "...according to people briefed on the program who asked not to be named to avoid trouble with the intelligence agencies. Project Chess, which has never been previously disclosed, was small, limited to fewer than a dozen people inside Skype, and was developed as the company had sometimes contentious talks with the government over legal issues, said one of the people briefed on the project. The project began about five years ago, before most of the company was sold by its parent, eBay, to outside investors in 2009. Microsoft acquired Skype in an $8.5 billion deal that was completed in October 2011. "A Skype executive denied last year in a blog post that recent changes in the way Skype operated were made at the behest of Microsoft to make snooping easier for law enforcement. It appears, however, that Skype figured out how to cooperate with the intelligence community before Microsoft took over the company, according to documents leaked by [none other than] Edward J. Snowden, a former contractor for the NSA. One of the documents about the PRISM program made public by Mr. Snowden says Skype joined PRISM on February 6, 2011." So about six months prior to Microsoft's closing their acquisition deal.

So back to Bruce Schneier, who continues his blog, saying, "Reread that Skype denial from last July, knowing that at the time the company knew that they were giving the NSA access to customer communications. Notice how it is precisely worded to be technically accurate, yet leave the reader with the wrong conclusion." And this is Bruce speaking, saying, "This is where we are with all the tech companies right now. We can't trust their denials, just as we can't trust the NSA - or the FBI - when it denies programs, capabilities, or practices. Back in January, we wondered whom Skype lets spy on their users. Now we know."

Leo: He points out, he says, Bruce says, you can't trust the NSA, and you can't trust these companies. Their denials are meaningless. So we just don't know what's going on.

Steve: We just, yeah, we don't know. In that article, as I mentioned before, was a quote from Dan Auerbach, who's a technology analyst with the EFF, the Electronic Frontier Foundation. And I thought this was the best thing I read. He said, "We reached a tipping point, where the value of having user data rose beyond the cost of storing it. Now we have an incentive to keep it forever." And I think that's just exactly it. We know what's happened to the cost of storage in the last few years. It's just - it's ridiculous how large drives have become and how inexpensive per byte storage has become. At some point the cost to store drops so low that the perceived value of keeping everything outweighs it. And as he says, we've crossed that tipping point.

There is a lot more detail. You can read the entire show transcript here, or listen to the entire podcast here. Here is more information about Project Chess.

Now, what's really important to me is that this isn't just about Skype. Skype is just the one smoking gun. As the article says, "Their denials are meaningless." Until (if and only if) this is all really sorted out - with the transparency We the People all deserve, we can't trust anybody.