NSA Targeted “The Two Leading” Encryption Chips
A Redaction Re-Visited: NSA Targeted “The Two Leading”
Encryption Chips
By Glenn Greenwald Jan. 4 2016, 2:47 p.m.
On September 5, 2013, The Guardian, the New York Times
and ProPublica jointly reported — based on documents provided by whistleblower
Edward Snowden — that the National Security Agency had compromised some of the
encryption that is most commonly used to secure internet transactions. The NYT
explained that NSA “has circumvented or cracked much of the encryption, or
digital scrambling, that guards global commerce and banking systems, protects
sensitive data like trade secrets and medical records, and automatically
secures the emails, web searches, internet chats and phone calls of Americans
and others around the world.” One 2010 memo described that “for the past
decade, NSA has led an aggressive, multipronged effort to break widely used
internet encryption technologies.”
In support of the reporting, all three papers published
redacted portions of documents from the NSA along with its British counterpart,
GCHQ. Prior to publication of the story, the NSA vehemently argued that any
reporting of any kind on this program would jeopardize national security by
alerting terrorists to the fact that encryption products had been successfully
compromised. After the stories were published, U.S. officials aggressively
attacked the newspapers for endangering national security and helping
terrorists with these revelations.
All three newspapers reporting this story rejected those
arguments prior to publication and decided to report the encryption-cracking
successes. Then-NYT Executive Editor Jill Abramson described the decision to
publish as “not a particularly anguished one” in light of the public interest
in knowing about this program, and ProPublica editors published a lengthy
explanation along with the story justifying their decision.
All three outlets, while reporting the anti-encryption
efforts, redacted portions of the documents they published or described. One
redaction in particular, found in the NYT documents, from the FY 2013 “black
budget,” proved to be especially controversial among tech and security experts,
as they believed that the specific identity of compromised encryption standards
was being concealed by the redaction.
None of the documents in the Snowden archive identify all
or even most of the encryption standards that had been targeted, and there was
a concern that if an attempt were made to identify one or two of them, it could
mislead the public into believing that the others were safe. There also seemed
to be a concern among some editors that any attempt to identify specific
encryption standards would enable terrorists to know which ones to avoid. One
redaction in particular, from the NYT, was designed to strike this balance and
was the one that became most controversial:
The issue of this specific redaction was raised again by
security researchers last month in the wake of news of a backdoor found on
Juniper systems, followed by The Intercept’s reporting that the NSA and GCHQ
had targeted Juniper. In light of that news, we examined the documents
referenced by those 2013 articles with particular attention to that
controversial redaction, and decided that it was warranted to un-redact that
passage. It reads as follows:
The reference to “the two leading encryption chips”
provides some hints, but no definitive proof, as to which ones were
successfully targeted. Matthew Green, a cryptography expert at Johns Hopkins,
declined to speculate on which companies this might reference. But he said that
“the damage has already been done. From what I’ve heard, many foreign
purchasers have already begun to look at all U.S.-manufactured encryption
technology with a much more skeptical eye as a result of what the NSA has done.
That’s too bad, because I suspect only a minority of products have been
compromised this way.”
NSA requested until 5 p.m. today to respond but then
failed to do so. (Update: The NSA subsequently emailed to say: “It would be
accurate to state that NSA declined to comment.”)
Comments
Post a Comment