NSA Has Planted Surveillance Software Deep Within Hard Drives Since 2001: Kaspersky

The U.S. National Security Agency(NSA) has been planting surveillance software deep within hard drives made by top manufacturers, allowing it to eavesdrop on almost every computer in the world, according to Kaspersky Lab, aMoscow-based software security company that announced its findings Monday.

Kaspersky did not explicitly name from which country or intelligence agency the spying software was found, but former operatives from the NSA confirmed that the findings correlated with NSA activity, Reuters reported.

The NSAs spyware lies within drives manufactured by Western Digital and Seagate, who deny that they had any knowledge of such programs. Samsung and Toshiba drives also contained the code, but both declined to comment.

Kaspersky said that PCs in 30 different countries were infected by the most advanced hacking operation ever uncovered, with the most in Iran, Russia, Pakistan, Afghanistan and China. The NSA has a number of ways in which it can obtain the drives source code, which it requires to embed the spyware. The NSAs methods include posing as software companies or asking for it directly, Reuters reported. The government can also request it for a security audit from manufacturers who wish to sell hard drives to the Department of Defense, and then use it to infect the manufacturers products.

The NSA also would intercept mailed items, such as CDs or USB drives, to infect them, according to a report from Ars Technica. The infections also affect iPhones and other Apple products.

The NSA is targeting a number of organizations, including government and military offices, telecommunication, energy and media companies as well as nuclear research facilities and Islamic activists. Institutions with infected hard drives should be able to detect the NSA spyware using technical details that Kaspersky published Monday.

Those details could impair the NSAs surveillance programs, which were already affected by the revelations made by former NSA contractor Edward Snowden. The disclosures have already slowed sales of U.S. technology products internationally, especially in China.

Excerpt from:

NSA Has Planted Surveillance Software Deep Within Hard Drives Since 2001: Kaspersky

Posted in NSA

NSA burying spyware within firmware of disk drives made by Seagate, Western Digital and other major manufacturers

The US National Security Agency (NSA) has been hiding spyware within the firmware of hard-disk drives made by Seagate, Samsung, Toshiba, and Western Digital - and other major manufacturers - in a spy programme that has been running for almost 20 years, according to security software company Kaspersky.

Kaspersky claims to have found the spyware lurking in the firmware of PC hard-disk drives in as many as 30 countries worldwide, with Iran the most affected country. PCs in Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria were also affected. The targets included government and military institutions, telecoms companies, banks, energy companies, nuclear researchers, media, and Islamic activists.

Kaspersky claims that the attacks - which it has dubbed "the Equation group" - may date back to as long ago as 1996 - but were certainly being conducted from 2001. "The Equation group uses multiple malware platforms, some of which surpass the well-known 'Regin' threat in complexity and sophistication. The Equation group is probably one of the most sophisticated cyber attack groups in the world; and they are the most advanced threat actor we have seen," claims the report from Kaspersky.

It continues: "In general, the Equation group uses a specific implementation of the RC5 encryption algorithm throughout their malware. Some of the most recent modules use RC6, RC4 and Advanced Encryption Standard (AES) too, in addition to other cryptographic functions and hashes.

"One technique in particular caught our attention and reminded us of another complex malware, Gauss. The GrayFish loader uses SHA-256 one thousand times over the unique NTFS object ID of the victim's Windows folder to decrypt the next stage from the registry. This uniquely ties the infection to the specific machine, and means the payload cannot be decrypted without knowing the NTFS object ID," explains the report.

The company claims to have identified several malware platforms within the Equation group. These include:

A victim doesn't immediately get infected with EquationDrug, claims Kaspersky. First, the attackers infect them with DoubleFantasy, which is a validator-style plug-in. If the victim is confirmed as interesting to the attackers, the EquationDrug installer is delivered.

"GrayFish is the most modern and sophisticated malware implant from the Equation group. It is designed to provide an effective (almost "invisible") persistence mechanism, hidden storage and malicious command execution inside the Windows operating system," claims Kaspersky.

It continues: "By all indications, GrayFish was developed between 2008 and 2013 and is compatible with all modern versions of Microsoft's operating systems, including Windows NT 4.0, Windows 2000, Windows XP, Windows Vista, Windows 7 and 8 - both 32-bit and 64-bit versions.

"To store stolen information, as well as its own auxiliary information, GrayFish implements its own encrypted Virtual File System (VFS) inside the Windows registry. To bypass modern OS security mechanisms that block the execution of untrusted code in kernel mode, GrayFish exploits several legitimate drivers, including one from the CloneCD program. This driver (ElbyCDIO.sys) contains a vulnerability which GrayFish exploits to achieve kernel-level code execution. Despite the fact that the vulnerability was discovered in 2009, the digital signature has not yet been revoked," claims the report.

Read more here:

NSA burying spyware within firmware of disk drives made by Seagate, Western Digital and other major manufacturers

Posted in NSA

NSA hiding Equation spy program on hard drives

Kaspersky Labs

Equation infection: Kaspersky Labs says the highest number of machines infected with Equation programs were in Iran, Russia and Pakistan.

The US National Security Agency has figured out how to hide spying software deep within hard drives made by Western Digital, Seagate, Toshiba and other top manufacturers, giving the agency the means to eavesdrop on the majority of the world's computers, according to cyber researchers and former operatives.

That long-sought and closely guarded ability was part of a cluster of spying programs discovered by Kaspersky Lab, the Moscow-based security software maker that has exposed a series of Western cyberespionage operations.

Kaspersky said it found personal computers in 30 countries infected with one or more of the spying programs, with the most infections seen in Iran, followed by Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria. The targets included government and military institutions, telecommunication companies, banks, energy companies, nuclear researchers, media, and Islamic activists, Kaspersky said.

Kaspersky Labs

The areas of government Equation has been able to infect by nation.

The firm declined to publicly name the country behind the spying campaign, but said it was closely linked to Stuxnet, the NSA-led cyberweapon that was used to attack Iran's uranium enrichment facility. The NSA is the agency responsible for gathering electronic intelligence on behalf of the United States.

A former NSA employee told Reuters that Kaspersky's analysis was correct, and that people still in the intelligence agency valued these spying programs as highly as Stuxnet. Another former intelligence operative confirmed that the NSA had developed the prized technique of concealing spyware in hard drives, but said he did not know which spy efforts relied on it.

NSA spokeswoman Vanee Vines declined to comment.

Continued here:

NSA hiding Equation spy program on hard drives

Posted in NSA

Suite of Sophisticated Nation-State Attack Tools Found With Connection to Stuxnet

CANCUN, MexicoThe last two years have been filled with revelations about NSA surveillance activities and the sophisticated spy tools the agency uses to take control of everything from individual systems to entire networks. Now it looks like researchers at Kaspersky Lab may have uncovered some of these NSA tools in the wild on customer machines, providing an extensive new look at the spy agencys technical capabilities. Among the tools uncovered is a worm that appears to have direct connections to Stuxnet, the digital weapon that was launched repeatedly against centrifuges in Iran beginning in late 2007 in order to sabotage them. In fact, researchers say the newly uncovered worm may have served as a kind of test run for Stuxnet, allowing the attackers to map a way to targeted machines in Iran that were air-gapped from the internet.

For nearly a year, the researchers have been gradually collecting components that belong to several highly sophisticated digital spy platforms that they say have been in use and development since 2001, possibly even as early as 1996, based on when some command servers for the malware were registered. They say the suite of surveillance platforms, which they call EquationLaser, EquationDrug and GrayFish, make this the most complex and sophisticated spy system uncovered to date, surpassing even the recently exposed Regin platform believed to have been created by Britains GCHQ spy agency and used to infiltrate computers belonging to the European Union and a Belgian telecom called Belgacom, among others.

The new platforms, which appear to have been developed in succession with each one surpassing the previous in sophistication, can give the attackers complete and persistent control of infected systems for years, allowing them to siphon data and monitor activities while using complex encryption schemes and other sophisticated methods to avoid detection. The platforms also include an innovative module, the likes of which Kaspersky has never seen before, that re-flashes or reprograms a hard drives firmware with malicious code to turn the computer into a slave of the attackers. The researchers, who gave WIRED an advance look at their findings and spoke about them today at the Kaspersky Security Analyst Summit in Mexico, have dubbed the attackers the Equation Group and consider them the most advanced threat actor theyve seen to date.

The researchers have published an initial paper on their findings and plan to publish more technical details over the next few days, but theres still a lot they dont know about the Equation Groups activities.

As we uncover more of these cyber espionage operations we realize how little we understand about the true capabilities of these threat actors, Costin Raiu, head of Kasperskys Global Research and Analysis Team told WIRED.

Although the researchers have no solid evidence that the NSA is behind the tools and decline to make any attribution to that effect, there is circumstantial evidence that points to this conclusion. A keywordGROKfound in a keylogger component appears in an NSA spy tool catalog leaked to journalists in 2013. The 53-page document detailswith pictures, diagrams and secret codenamesan array of complex devices and capabilities available to intelligence operatives. The capabilities of several tools in the catalog identified by the codenames UNITEDRAKE, STRAITBAZZARE, VALIDATOR and SLICKERVICAR appear to match the tools Kaspersky found. These codenames dont appear in the components from the Equation Group, but Kaspersky did find UR in EquationDrug, suggesting a possible connection to UNITEDRAKE (United Rake). Kaspersky also found other codenames in the components that arent in the NSA catalog but share the same naming conventionsthey include SKYHOOKCHOW, STEALTHFIGHTER, DRINKPARSLEY, STRAITACID, LUTEUSOBSTOS, STRAITSHOOTER, and DESERTWINTER.

Other evidence possibly pointing to the NSA is the fact that five victims in Iran who were infected with Equation Group components were also key victims of Stuxnet, which was reportedly created and launched by the U.S. and Israel.

Kaspersky wouldnt identify the Iranian victims hit by the Equation tools, but the five key Stuxnet victims have been previously identified as five companies in Iran, all contractors in the business of building and installing industrial control systems for various clients. Stuxnet targeted industrial control systems used to control centrifuges at a uranium-enrichment plant near Natanz, Iran. The companiesNeda Industrial Group, Kala Electric, Behpajooh, CGJ (believed to be Control Gostar Jahed) and Foolad Technicwere infected with Stuxnet in the hope that contractors would carry it into the enrichment plant on an infected USB stick. This link between the Equation Group and Stuxnet raises the possibility that the Equation tools were part of the Stuxnet attack, perhaps to gather intelligence for it.

But the newly uncovered worm created by the Equation Group, which the researchers are calling Fanny after the name of one of its files, has an equally intriguing connection to Stuxnet.

It uses two of the same zero-day exploits that Stuxnet used, including the infamous .LNK zero-day exploit that helped Stuxnet spread to air-gapped machines at Natanzmachines that arent connected to the internet. The .LNK exploit in Fanny has a dual purposeit allows attackers to send code to air-gapped machines via an infected USB stick but also lets them surreptitiously collect intelligence about these systems and transmit it back to the attackers. Fanny does this by storing the intelligence in a hidden file on the USB stick; when the stick is then inserted into a machine connected to the internet, the data intelligence gets transferred to the attackers. EquationDrug also makes use of the .LNK exploit. A component called SF loads it onto USB sticks along with a trojan to infect machines.

View original post here:

Suite of Sophisticated Nation-State Attack Tools Found With Connection to Stuxnet

Posted in NSA

Interview with NSA / FBI Whistleblowers on encryption & surveillance (german subtitles) – Video


Interview with NSA / FBI Whistleblowers on encryption surveillance (german subtitles)
On January 22nd, the Ceremony for the Sam Adams Award was held in Berlin. This year #39;s awardee William Binney gave us an interview, as well as the Whistleblow...

By: netzpolitik

More:

Interview with NSA / FBI Whistleblowers on encryption & surveillance (german subtitles) - Video

Posted in NSA

NSA shows off hypocritical Valentines Day tweets – NY …

Ymo6^|XYDCtbhP&vwl$(]]Dm?lrDcg"X[Q*br%,crm"QN0('v[- Q9<% |_Qd9CN8nhl&!0/)8||< %6v); u'L`B"L'XirgP55zM1}-U-R$F87}"iiy[?jyWEC[S,`AE7m%+eb"gk|"r*G h'xTa^eEX"t"G2+4* 6.gd4,1Yq-$DuOiFbJ2[Ko^uR-m:Jhd$f*!6R3;f-7&9]@]Bgy>m^MSzS+[d**HO nqUL ' / E8~&n:#rrK@(]FuH(HB5Or2?4l by^@~y=yf jZW8)LucJN-VKlNIGOu&v^W^o^7 v0fWgGJi$AKFo{P |t%H&D(3~{c>]"5>8t+W!1CLSSpiU==a,YDoWyEQPRGwN |vK,OPd3s+ZG!sH_zjmO2g&FaT.9+'[}73F n4zL61&}vs)L^`]wP:WQ~o~` yI^ b*3L|[<UiDCWA!#)kfU( zXmSAKb';Iv Br3$nc+@g%`bJJH; Gq|!~ymyX_-:-$8fcn{v{+Z!=?=v+[w[{zdN@!x;&pj}C,GwQG3znjPZ84lSbfK9ZFnl3VFm &iZN#L:9l[5Uuzn&Fktkuymo;G)YS;BE(/( vu^&DV&g+c?g4 dl6)rjx,LBTtCV$R RbsVtC,'~@sCO#d<8Nu[{5"8SrVF[{vJ,)/-XM' jMc]*]l:>#!DED6Kf,K#AHX]=d4| ,>_?,3 ,_^4$8,X3L:JW]K9/%7FIc< !)[0> FCrv(@j X)!KBX,>]lX"_P51U%_M`z@#4d`:$,`qou I8qh k^f[y33o%[24o_qqg4^@mG<6%*^8KbJ'U ,fs,~gV 3SYW6LV g+- rH}IPqZ5xs;;;: ZN>#;M'3E2%UoTSWks$pEv~":6DUG"D;A~^Z6%lr~:$l6s}oef:xn!D-u=xAum:pmcg[|My'.A-c2P9ECaG"YeAh'R #^:a+$ph#,*'_U`aDB6epErW$E nxfL#EZIRcHb.5k+9>q#xL,8sB,a`tg,]B k.LzJ%o,* JeqPQ$$Ff1bj0&WNg"DBm'I99Er|']|=g B(s/sA*>{=WS#[wx`0p=cdQ UhQ},W3cxs"@$>6p(- NE=!H$8ocZOjS, bVnS3ZlnYIVg=|kTl:(TN r6y1b]'}+RCv{]9ts),UZaYo8|?0:l$o#v;zMa Zm&%i;sR6}9f84Y7w{[?6j/_gs=R)|!)rhOg~%%"&,EQ;~P#FxdHCr0ivp*'d.J@-|Cwatf"ic~3jg#V&./OU={6D9AY8[N+5v%qE|OU ,G: 01oBLIB$;$JOj-+;L0V()Vo(Eo@cHZgR*J,)7`b>(q,}:{Q9'7KaBY =#/Wd>"w4.u$ d OGCd>%|aiyS_:A1#6qYC_x80@XEK=|Ox/#C >N",S([!W: ' .7 Ns4)PQhnR-xr23p)TJCc?v@qmYopzH%'=i)WP $5UpSL}qi$5%>z:[{]D8^]G :1{$<.h2(PX^8p+W;^LD6{H7^x '[zCmT5_c>M"rBVN7Tnj&59db6 ]`IjG'RL!|=Wr%zh]6RrH * #c;&[!Z|,1TRr )FbFjj @RI8AZ;kjaix/Tg]-QcVlq[ aMOgN>BEa5m>5h pRGGC

See original here:

NSA shows off hypocritical Valentines Day tweets - NY ...

Posted in NSA

NSA insists they are not listening to V-Day 'pillow talk'

NSA/Handout/Reuters An undated aerial handout photo shows the National Security Agency (NSA) headquarters building in Fort Meade, Maryland. The National Security Agency (NSA) was officially formed by President Harry S. Truman on Nov. 4. 1953.

PSST! The NSA is sharing its secrets not yours.

Yep, the intelligence agency that once punished its own staff for spying on their lovers insists, in tweets no less, that it doesnt listen to couples most intimate moments. On Saturday, the National Security Agency celebrated Valentines Day by (over)sharing.

#HappyValentinesDay from the #NSA. No, we dont listen to your pillow talk, the observant agencys tweeted.

The agency later took a musical spin on what they are up to.

Every move they make, every step they take. Well be watching our foreign adversaries, the agency tweeted Saturday, quoting The Polices 1983 hit, Every Breath You Take.

The NSA agency had previously unveiled a cache of top secret documents last year that stated an NSA intern tattled on his colleague for allegedly spying on his girlfriend.

The document dump revealed analysts had been spying on spouses and significant others for at least 10 years.

The agencys reports, released through a records request by the American Civil Liberties Union, revealed an employee spied on a spouses telephone records.

nhensley@nydailynews.com

See the original post here:

NSA insists they are not listening to V-Day 'pillow talk'

Posted in NSA

NSA warrantless surveillance (200107) – Wikipedia, the …

The NSA warrantless surveillance controversy ("warrantless wiretapping") concerns surveillance of persons within the United States during the collection of allegedly foreign intelligence by the U.S. National Security Agency (NSA) as part of the touted war on terror. Under this program, referred to by the Bush administration as the terrorist surveillance program,[1] part of the broader President's Surveillance Program, the NSA was authorized by executive order to monitor, without search warrants, the phone calls, Internet activity (Web, e-mail, etc.), text messaging, and other communication involving any party believed by the NSA to be outside the U.S., even if the other end of the communication lies within the U.S. However, it has been discovered that all U.S. communications have been digitally cloned by government agencies, in apparent violation of unreasonable search and seizure. The excuse given to avoid litigation[citation needed] was that no data hoarded would be reviewed until searching it would be legal. But no excuse has been offered the initial seizure of the data which is also illegal[citation needed], according to the U. S. Constitution[citation needed].

Critics, however, claimed that the program was in an effort to attempt to silence critics of the Bush Administration and its handling of several controversial issues during its tenure. Under public pressure, the Bush administration allegedly ceased the warrantless wiretapping program in January 2007 and returned review of surveillance to the FISA court.[2] Subsequently, in 2008 Congress passed the FISA Amendments Act of 2008, which relaxed some of the original FISA court requirements.

During the Obama Administration, the NSA has allegedly continued operating under the new FISA guidelines despite campaign promises to end warrantless wiretapping.[3] However, in April 2009 officials at the United States Department of Justice acknowledged that the NSA had engaged in "overcollection" of domestic communications in excess of the FISA court's authority, but claimed that the acts were unintentional and had since been rectified.[4]

All wiretapping of American citizens by the National Security Agency requires a warrant from a three-judge court set up under the Foreign Intelligence Surveillance Act. After the 9/11 attacks, Congress passed the Patriot Act, which granted the President broad powers to fight a war against terrorism. The George W. Bush administration used these powers to bypass the FISA court and directed the NSA to spy directly on al-Qaeda in a new NSA electronic surveillance program. Reports at the time indicate that an "apparently accidental" "glitch" resulted in the interception of communications that were purely domestic in nature.[5] This action was challenged by a number of groups, including Congress, as unconstitutional.

The exact scope of the program remains secret, but the NSA was provided total, unsupervised access to all fiber-optic communications going between some of the nation's largest telecommunication companies' major interconnected locations, including phone conversations, email, web browsing, and corporate private network traffic.[6] Critics said that such "domestic" intercepts required FISC authorization under the Foreign Intelligence Surveillance Act.[7] The Bush administration maintained that the authorized intercepts were not domestic but rather foreign intelligence integral to the conduct of war and that the warrant requirements of FISA were implicitly superseded by the subsequent passage of the Authorization for Use of Military Force Against Terrorists (AUMF).[8] FISA makes it illegal to intentionally engage in electronic surveillance under appearance of an official act or to disclose or use information obtained by electronic surveillance under appearance of an official act knowing that it was not authorized by statute; this is punishable with a fine of up to $10,000 or up to five years in prison, or both.[9] In addition, the Wiretap Act prohibits any person from illegally intercepting, disclosing, using or divulging phone calls or electronic communications; this is punishable with a fine or up to five years in prison, or both.[10]

After an article about the program, (which had been code-named Stellar Wind), was published in The New York Times on December 16, 2005, Attorney General Alberto Gonzales confirmed its existence.[11][12][13]The Times had posted the exclusive story on their website the night before, after learning that the Bush administration was considering seeking a Pentagon-Papers-style court injunction to block its publication.[14]Bill Keller, the newspaper's former executive editor, had withheld the story from publication since before the 2004 Presidential Election, and the story that was ultimately published was essentially the same as reporters James Risen and Eric Lichtblau had submitted in 2004. The delay drew criticism from some in the press, arguing that an earlier publication could have changed the election's outcome.[15] In a December 2008 interview with Newsweek, former Justice Department employee Thomas Tamm revealed himself to be the initial whistle-blower to The Times.[16] The FBI began investigating leaks about the program in 2005, with 25 agents and 5 prosecutors on the case.[17]

Gonzales said the program authorized warrantless intercepts where the government had "a reasonable basis to conclude that one party to the communication is a member of al Qaeda, affiliated with al Qaeda, or a member of an organization affiliated with al Qaeda, or working in support of al Qaeda" and that one party to the conversation was "outside of the United States."[18] The revelation raised immediate concern among elected officials, civil right activists, legal scholars and the public at large about the legality and constitutionality of the program and the potential for abuse. Since then, the controversy has expanded to include the press' role in exposing a classified program, the role and responsibility of the US Congress in its executive oversight function and the scope and extent of presidential powers under Article II of the Constitution.[19]

In mid-August 2007, a three-judge panel of the United States Court of Appeals for the Ninth Circuit heard arguments in two lawsuits challenging the surveillance program. The appeals were the first to reach the court after dozens of civil suits against the government and telecommunications companies over NSA surveillance were consolidated last year before the chief judge of the Northern District of California, Vaughn R. Walker. One of the cases is a class-action lawsuit against AT&T, focusing on allegations that the company provided the NSA with its customers' phone and Internet communications for a vast data-mining operation. Plaintiffs in the second case are the al-Haramain Foundation Islamic charity and two of its lawyers.[20][21]

On November 16, 2007, the three judges M. Margaret McKeown, Michael Daly Hawkins, and Harry Pregerson issued a 27-page ruling that the charity, the Al-Haramain Islamic Foundation, could not introduce a key piece of evidence in its case because it fell under the government's claim of state secrets, although the judges said that "In light of extensive government disclosures, the government is hard-pressed to sustain its claim that the very subject matter of the litigation is a state secret."[22][23]

In an August 14, 2007, question-and-answer session with the El Paso Times which was published on August 22, Director of National Intelligence Mike McConnell confirmed for the first time that the private sector helped the warrantless surveillance program. McConnell argued that the companies deserved immunity for their help: "Now if you play out the suits at the value they're claimed, it would bankrupt these companies".[24] Plaintiffs in the AT&T suit subsequently filed a motion with the court to have McConnell's acknowledgement admitted as evidence in their case.[25]

See the original post:

NSA warrantless surveillance (200107) - Wikipedia, the ...

Posted in NSA

Going Underground: Google is privatised NSA, unexamined deaths, & C of E censorship (E173) – Video


Going Underground: Google is privatised NSA, unexamined deaths, C of E censorship (E173)
Afshin Rattansi goes underground on Google #39;s shady privacy record. Kristinn Hrafnsson, lawyer for Wikileaks, warns that it appears Google is #39;not a benign co...

By: goingundergroundRT

See the rest here:

Going Underground: Google is privatised NSA, unexamined deaths, & C of E censorship (E173) - Video

Posted in NSA

Digital Warfare: NSA STUXNET behind attacks on US, allies computers – Video


Digital Warfare: NSA STUXNET behind attacks on US, allies computers
The notorious NSA spying agency is increasingly worried that U.S. cyberattacks have actually taught Iran how to hack. That #39;s according to the latest document leaked by Edward Snowden. RT #39;s....

By: Alittlepart Ofme

See more here:

Digital Warfare: NSA STUXNET behind attacks on US, allies computers - Video

Posted in NSA

The privacy differential – why don't more non-US and open source firms use the NSA as marketing collateral?

The shockwaves generated by Edward Snowden's revelations of the close collaboration between US tech giants such as Microsoft and Apple and the NSA are still reverberating through the industry. Those disclosures, together with related ones such as the involvement of the NSA in industrial espionage, as well as the asymmetric nature of US law when it comes to gathering data from foreign individuals, present something of an open goal for non-US technology companies - or so one might have thought.

On the face of it, then, it is surprising that non-US technology firms and others that can distance themselves from the US law are not proclaiming this fact more loudly. After all, there must be a considerable number of organisations that would dearly love to locate their data as far away from the attentions of the NSAas possible.

Perhaps the lack of fanfare is merely a reflection of the relative sizes of the marketing budgets available to the US tech giants and local contenders; or perhaps the shock of Snowden has yet to translate itself into meaningful action, making such messaging premature.

Can of worms?

Or maybe the alternatives to the US cloud giants are simply wary of making bold promises that may later come back to bite them. Analyst Clive Longbottom of Quocirca certainly believes that organisations need to be very careful about seeking to differentiate themselves from others on the basis of the leaks.

"In my view, trying to market off the back of Snowden would be opening a can of worms," Longbottom said. "To every possibly positive marketing message there will be a few sensible contradictions. 'Hey, we have no back doors on our system!' - bet you use equipment at the hardware level from vendors who Snowden implicated in such backdoors. 'Hey, we're open source, so it's all OK!' Sure - the NSA has never infiltrated any open source group and built in back doors through such means."

Despite the possible "worms", however, there are some companies thatare using the revelations to set themselves apart. One is security firm F-Secure, which is actively involved in promoting privacy via collaboration with pressure groups such asDon't Spy on Us and the Open Rights Group and which uses its very Finnish-ness as an asset.

"Finnish culture is very much about privacy. Freedom of speech is written into their constitution so the technology is built with the idea that people are anonymous and data is protected," said Allen Scott, F-Secure's managing director for UK and Ireland.

Scott acknowledged the dangers of over-promising on the issue, saying that any organisation promoting itself as ethical will become a target for attackers trying to prove it wrong.

"This is the sort of thing that has to be built into your company at an R&D level and a board level. If you're going to say that you're 100 per cent anything you're already open to ridicule. If you say the safest company in the world people try to hack you."

Continue reading here:

The privacy differential - why don't more non-US and open source firms use the NSA as marketing collateral?

Posted in NSA