2 ms·
"Speaking as a foreigner, I now have very little trust for basically any major US tech corporation" Speaking as an American, if they do this to US tech compani
by bsullivan01 13y ago
"Speaking as a foreigner, I now have very little trust for basically any major US tech corporation"
Speaking as an American, if they do this to US tech companies, imagine what they do non-US companies.
- pedrocr 13y agoI imagine that a foreign company not operating in the US doesn't give a damn about threats by the US, which is what I assume the OP meant. What do you mean?
- bsullivan01 13y agoNo threats, they'll just copy your data one way or another. If US corps and people have x protections, others have zero.
- pedrocr 13y agoHow does the NSA copy the data from a server hosted in Germany by a German company?
- shabble 13y agoDepends how badly they want it. Use a 0-day remote exploit to get a login, exfiltrate data. Use a known, unpatched exploit to do same. Use 0-day/known local exploit with sophisticated spear-phish trojan to do same. Use leverage over domestic software suppliers to ship a customised exploitable (or directly backdoored) update to target company. Ditto domestic hardware manufacturers. Black-bag (or diplomatic quid pro quo) tap of external or internal comm links, to get either raw traffic or encrypted. If the latter, apply other complementary techniques to obtain keys. Infiltrate company with agent who can deploy local exploit via physical access, or who can bug/exploit workstations of users to obtain privileged access to server. Bully/dupe the German government into raiding & seizing the server as part of an international terror/crime investigation. Acquire disk image from seized machines via direct or complementary techniques. Purchase/acquire German company via a domestic front company. Demand IT infrastructure be 'harmonised' with acquirer and moved to US. ...and many, many more. The only reason not to do most of these things is because the cost/benefit analysis doesn't make it worthwhile to do universally without any prior suspicion.
- pedrocr 13y agoSo to summarize they need to do something else than get a NSL and have the company hand over the data. Which is what's different if the company in the US.