In all the stories surrounding mass interception, recording (and abuse) of every form of private electronic communication by the NSA, there was always one missing link: encryption. After all, the NSA's primary task has always been to decrypt data, not to record and store every bit of communication traversing the ether or the internet. And yet, with the advent of recent encryption technologies, it would, or at least could, have made such pervasive interception by the spying agency problematic at least. However, according to a just released exposed by the NYT and ProPublica, it turns out the NSA had that base covered too. Presenting Bullrun, or "there's a hack for that."
Where this story is going should be immediately obvious: over the past two decades as the advent of personal encryption capabilities arose at ever higher ciphers, the NSA scrambled to stay on top of recent encryption developments, and if possible, ahead of the curve. Not surprisingly, after "having lost a public battle in the 1990s to insert its own “back door”
in all encryption, it set out to accomplish the same goal by stealth. Beginning in 2000, as encryption tools were gradually blanketing the Web, the N.S.A. invested billions of dollars in a clandestine campaign to preserve its ability to eavesdrop."
And while the NSA decrypting communications is not surprising, the way it went about doing this, often times illegally, is disturbing.
From ProPublica [7]:
The N.S.A. hacked into target computers to snare messages before they were encrypted. And the agency used its influence as the world’s most experienced code maker to covertly introduce weaknesses into the encryption standards followed by hardware and software developers around the world.
“For the past decade, N.S.A. has led an aggressive, multipronged effort to break widely used Internet encryption technologies,” said a 2010 memo describing a briefing about N.S.A. accomplishments for employees of its British counterpart, Government Communications Headquarters, or GCHQ. “Cryptanalytic capabilities are now coming online. Vast amounts of encrypted Internet data which have up till now been discarded are now exploitable.”
When the British analysts, who often work side by side with N.S.A. officers, were first told about the program, another memo said, “those not already briefed were gobsmacked!”
Among the more conventional means of maintaining the NSA was ahead of the encryption standards were the following approaches:
Some of the agency’s most intensive efforts have focused on the encryption in universal use in the United States, including Secure Sockets Layer, or SSL, virtual private networks, or VPNs, and the protection used on fourth generation, or 4G, smartphones. Many Americans, often without realizing it, rely on such protection every time they send an e-mail, buy something online, consult with colleagues via their company’s computer network, or use a phone or a tablet on a 4G network.
Paul Kocher, a leading cryptographer who helped design the SSL protocol, recalled how the N.S.A. lost the heated national debate in the 1990s about inserting into all encryption a government back door called the Clipper Chip.
“And they went and did it anyway, without telling anyone,” Mr. Kocher said. He said he understood the agency’s mission but was concerned about the danger of allowing it unbridled access to private information.
Incidentally, doing things "without telling anyone", one can safely say is what the NSA's modus operandi is all about.
But while the above is to be expected from any espionage agency, where it gets worse is how the agency goes about directly peddling influence using money from the same taxpayers it then proceeds to spy on:
Because strong encryption can be so effective, classified N.S.A. documents make clear, the agency’s success depends on working with Internet companies — by getting their voluntary collaboration, forcing their cooperation with court orders or surreptitiously stealing their encryption keys or altering their software or hardware.
According to an intelligence budget document leaked by Mr. Snowden, the N.S.A. spends more than $250 million a year on its Sigint Enabling Project, which “actively engages the U.S. and foreign IT industries to covertly influence and/or overtly leverage their commercial products’ designs” to make them “exploitable.” Sigint is the abbreviation for signals intelligence, the technical term for electronic eavesdropping.
By this year, the Sigint Enabling Project had found ways inside some of the encryption chips that scramble information for businesses and governments, either by working with chipmakers to insert back doors or by surreptitiously exploiting existing security flaws, according to the documents. The agency also expected to gain full unencrypted access to an unnamed major Internet phone call and text service; to a Middle Eastern Internet service; and to the communications of three foreign governments.
In one case, after the government learned that a foreign intelligence target had ordered new computer hardware, the American manufacturer agreed to insert a back door into the product before it was shipped, someone familiar with the request told The Times.
The 2013 N.S.A. budget request highlights “partnerships with major telecommunications carriers to shape the global network to benefit other collection accesses” — that is, to allow more eavesdropping.
...
Simultaneously, the N.S.A. has been deliberately weakening the international encryption standards adopted by developers. One goal in the agency’s 2013 budget request was to “influence policies, standards and specifications for commercial public key technologies,” the most common encryption method.
Cryptographers have long suspected that the agency planted vulnerabilities in a standard adopted in 2006 by the National Institute of Standards and Technology, the United States’ encryption standards body, and later by the International Organization for Standardization, which has 163 countries as members.
Classified N.S.A. memos appear to confirm that the fatal weakness, discovered by two Microsoft cryptographers in 2007, was engineered by the agency. The N.S.A. wrote the standard and aggressively pushed it on the international group, privately calling the effort “a challenge in finesse.”
“Eventually, N.S.A. became the sole editor,” the memo says.
It gets worse: ultimately the NSA, in order to have the upper hand would be forced to hack the very companies that it was trying to be close with.
At Microsoft, as The Guardian has reported, the N.S.A. worked with company officials to get pre-encryption access to Microsoft’s most popular services, including Outlook e-mail, Skype Internet phone calls and chats, and SkyDrive, the company’s cloud storage service.
Microsoft asserted that it had merely complied with “lawful demands” of the government, and in some cases, the collaboration was clearly coerced. Executives who refuse to comply with secret court orders can face fines or jail time.
N.S.A. documents show that the agency maintains an internal database of encryption keys for specific commercial products, called a Key Provisioning Service, which can automatically decode many messages. If the necessary key is not in the collection, a request goes to the separate Key Recovery Service, which tries to obtain it.
How keys are acquired is shrouded in secrecy, but independent cryptographers say many are probably collected by hacking into companies’ computer servers, where they are stored. To keep such methods secret, the N.S.A. shares decrypted messages with other agencies only if the keys could have been acquired through legal means. “Approval to release to non-Sigint agencies,” a GCHQ document says, “will depend on there being a proven non-Sigint method of acquiring keys.”
In other words, while one can be arrested for sending an encrypted email if the NSA hacked it "legally", if it had to obtain the hack to the hack in an illegal fashion, said information will be confined to the NSA for fear of exposing its "illegal" practices. Yeah right.
What happened next is unclear, but it is safe to say the NSA can now hack virtually everything but the highest (512+ bit: assume AES-256 is now terminally violated) cipher with impunity.
A 2010 document calls for “a new approach for opportunistic decryption, rather than targeted.” By that year, a Bullrun briefing document claims that the agency had developed “groundbreaking capabilities” against encrypted Web chats and phone calls. Its successes against Secure Sockets Layer and virtual private networks were gaining momentum.
And so on.
The full grotesque details of just how far an out of control, totalitarian state in absolute fear of civil liberty and privacy will go to spy on all of its citizens can be read here [7]. None of it should be a surprise to anyone at this point. The good news is that like every collapsing totalitarian, centrally-planned regime in the final stages of its fear-driven lifecycle, this can only continue for a little longer.
In the meantime, we hope that George Orwell's coffin is spacious. Guy must be spinning at GETCO market manipulation frequencies by now.