The Guardian published a secret court order requiring Verizon to hand the US National Security Agency the call records of millions of customers. The next day, The Guardian and The Washington Post revealed PRISM, a programme said to give the NSA access to data from major US technology firms.
What happened
- The Foreign Intelligence Surveillance Court order covered call detail records, or metadata, such as numbers dialled and call duration, but not the content of calls.
- Leaked slides named Microsoft, Yahoo, Google, Facebook, PalTalk, YouTube, Skype, AOL, and Apple as PRISM providers.
- The companies denied giving the government direct access to their servers.
- On 9 June 2013, former NSA contractor Edward Snowden identified himself as the source of the leaks.
Why it mattered
The disclosures began a global debate about state surveillance and privacy, strained relations between the US and its allies, and drove wider adoption of encryption by technology firms.
Lessons for organisations
Organisations should understand where their data is stored and which legal regimes can compel access to it, and use encryption and data minimisation to limit exposure. Insider risk controls matter too: the leaks came from a contractor with broad system access.
Sources: Forbes, TechCrunch
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
