The Information Policy Blog

The (unofficial) blog of the BCLA Information Policy Committee

Tag Archives: bullrun

Breaking Cryptography Matters

This week we learned that Glenn Greenwald was not exaggerating when he said that there was more in Edward Snowden’s leaked info than we had seen thus far. It turns out the NSA (and the GCHQ, its UK equivalent) has been using many methods to attack ubiquitous encryption on the internet:

Those methods include covert measures to ensure NSA control over setting of international encryption standards, the use of supercomputers to break encryption with “brute force”, and – the most closely guarded secret of all – collaboration with technology companies and internet service providers themselves.

Through these covert partnerships, the agencies have inserted secret vulnerabilities – known as backdoors or trapdoors – into commercial encryption software.

This is different from saying that the NSA had cracked everyone’s encryption, but it appears that they’ve been undermining everyone’s privacy and security with the complicity of major technology companies.

This is a big fucking deal.

Part of the reason is because putting in secret vulnerabilities means that dedicated non-governmental agents can find those vulnerabilities and exploit them.

There are ways to protect your security online, but seriously, if the NSA really wanted something about you (and I’m assuming here that most of this blog’s readers are Canadians, thus foreigners to the NSA and fair game for spying on their information conveniently passing through US data-centres) they can get it. From Bruce Schneier:

This kind of thing is done by its TAO – Tailored Access Operations – group. TAO has a menu of exploits it can serve up against your computer – whether you’re running Windows, Mac OS, Linux, iOS, or something else – and a variety of tricks to get them on to your computer. Your anti-virus software won’t detect them, and you’d have trouble finding them even if you knew where to look. These are hacker tools designed by hackers with an essentially unlimited budget. What I took away from reading the Snowden documents was that if the NSA wants in to your computer, it’s in. Period.

In Wired Kim Zetter lays out a bit of the history of this program, called Bullrun:

The ten-year Bullrun program began after the U.S. government failed in its pla to place a backdoor, the so-called Clipper chip, into encryption that would have allowed it to eavesdrop on communications at will. Without the Clipper chip, the government launched a systematic plan using trickery and other methods to circumvent encryption and achieved an unspecified breakthrough in 2010. In the wake of this, according to one document, “vast amounts of encrypted Internet data which have up till now been discarded are now exploitable.”

Some of the methods involved the deployment of custom-built, supercomputers to break codes in addition to collaborating with technology companies at home and abroad to include backdoors in their products. The Snowden documents don’t identify the companies that participated.

Schneier again:

Basically, the NSA asks companies to subtly change their products in undetectable ways: making the random number generator less random, leaking the key somehow, adding a common exponent to a public-key exchange protocol, and so on. If the back door is discovered, it’s explained away as a mistake.

We don’t have a secure internet. Major corporations have joined up with security agencies to make it that way.

One thing we can and probably should be doing as information professionals is calling for our libraries and other institutions to be using more Free and Open Source Software. These independent, community-based technologies allow us to see inside the code and make it much more difficult for nefarious shadowy agents (governmental or non-) to add in holes specifically to spy on us and our members we’re providing services to.

I work in a public library in a community that isn’t on the cutting edge of technology. For many of our members I’m the public tech support person, and people ask me about using things like online banking and whether it’s safe to do. It’s important for anyone in this kind of position to know about the tradeoffs being made by technology titans, and how we’re selling our members to companies that, even though the language of the internet is cute (“like” “friend” even “google”), those companies don’t have our members’ best interests at heart.

Schneier suggests techniques like using Tor, and encrypting communications with public-domain encryption that’s cross compatible (this makes it less likely to have been NSA compromised). These won’t keep everything you do secret from a determined, well-funded attacker, but it does make you more expensive to target.

Most members of my library probably don’t need to be paranoid about encryption. They’re looking up recipes and sending messages to their kids and reading romance novels or whatever. But our individual uses of the internet shouldn’t really matter. As Byron Holland says in his post NSA Internet surveillance where’s the outrage?:

It’s not that governments should not have the power to monitor citizens under certain circumstances and with the appropriate oversight – it’s an unfortunate necessity to maintain law and order. But we’re not talking about surveillance with appropriate oversight. We’re talking about an opaque and deliberate system to gather and monitor the activities and communications of potentially everyone who is online.

Why should a government feel it is above judicial oversight to monitor its citizens’ activities, just because they’re online?

Because apparently, we’re fine with it. At the very least, we’re complacent with it.

As information professionals we need to be aware of, and ensure our communities have the chance to be learn about the consequences of these surveillance and broken security technologies. That is our way to help fight complacency.