recommended reading

Sorry, You Can’t Really Escape the NSA

Rena Schild/

The world's largest Internet companies and thousands of average Internet users are trying to hide their private information from government snooping.

The goal is to set up technological barriers to the National Security Agency's sweeping surveillance programs. Rather than waiting for Congress to rein in the agency, many people want to take privacy into their own hands.

But the truth is, efforts to improve online encryption and security can't totally thwart the NSA.

Joseph Lorenzo Hall, the chief technologist for the Center for Democracy and Technology, said the idea of becoming "NSA-proof" is "just silly."

"If they want it, they can get it," he said of the NSA's expert spies. The agency can hack or bypass many security measures if it is determined enough, Hall said.

And it doesn't matter how heavily encrypted an email is in transit if the NSA just forces the email provider to turn the message over. While the NSA collects some of its data by surreptitiously tapping into communications, much of the surveillance is done through court orders to Internet and phone companies.

Christopher Soghoian, the principal technologist for the American Civil Liberties Union, said tech companies such as Google could hamstring the NSA if they just stopped collecting so much information about their users. If a company doesn't have information on a person, there's nothing to turn over to the government.

Of course, that's not likely to happen any time soon. Google and other companies depend on collecting detailed data about their users for targeted advertising.

"At the end of the day, you can only expect so much from an advertising company," Soghoian said. "Until we start paying for these services, they're only going to go so far."

While it's impossible to totally escape the NSA, making the agency's job harder could be enough to avoid the dragnet surveillance. Government analysts aren't likely to invest the time and resources to crack encrypted messages unless they really think there could be a connection to terrorism.

Hall recommended that people use a browser plug-in such as HTTPS Everywhere, which ensures that users have a secure online connection when possible. He added that it's particularly difficult for the NSA to track the online activity of people using Tor, a software that reroutes traffic to hide its source.

Major tech companies were shocked to learn last year that the NSA was tapping into the connections between their overseas data centers and siphoning off data. In the wake of the leaks, Google, Microsoft, Yahoo, and Facebook have all taken steps to encrypt their data-center connections.

Google has always tried to encrypt its emails in transit, but that's only effective if both the sender and the receiver support encryption. Recently, Google has started to publish statistics about which providers support encryption in a bid to pressure more companies to step up their security.

Emails that are encrypted in transit aren't as secure as ones that have total end-to-end encryption. Even Google can't read the contents of emails that are totally encrypted. But end-to-end encryption tools such as PGP are complicated and inconvenient to use. Google will soon launch its own end-to-end encryption extension to try to make the process simpler, but the option will still be realistic only for the most dedicated privacy advocates.

According to Soghoian, the No. 1 thing people can do to better protect their privacy is to refrain from using phones for any sensitive conversations.

"Telephone communications are just not secure," he said, adding that people are better off relying on Internet voice services such as Skype and FaceTime. He also warned that stored communications like email are risky because the NSA can go back and get messages even years after they're sent.

Hall recommended that people leave their phones at home or wrap them in aluminum foil when they're not using them. He acknowledged that before the Snowden leaks, recommending that people wrap their phones in foil would have sounded crazy.

"The NSA is giving the tinfoil-hat brigade a run for its money today," he said.

This article appears in the June 17, 2014 edition of NJ Daily.

(Image via Rena Schild /

Threatwatch Alert

Thousands of cyber attacks occur each day

See the latest threats


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.


When you download a report, your information may be shared with the underwriters of that document.