New Style Codebreaking

I refrained - barely - from comments on the notorious Snowden case for many months. Unless you were involved in a NASA settlement project on Mars, you will know Edward Snowden by now, the former National Security Agency contractor who blew the whistle, or better, the lid from NSA's Pandora box.

I waited because I believed that the initial headlines would quickly fade away - as they did - and the really interesting bits were still to come in the following months, both directly by the Snowden papers and indirectly through tremors all over the security and intelligence branches.

Although only a fraction has surfaced by now, the available information already proved more than enough to make spectacular headlines that - as also expected - hardly appear in the news, are completely ignored and underestimated, not only by the average user, but even - and this is far worse - by professional organisations and governments.

Intelligence historian Matthew Aid just published an enlightening article on NSA's New Code Breakers (alternative read via Fortuna's Corner), detailing how NSA shifted in the past decade its focus from codebreaking to non-cryptanalytic techniques, as there are, black bag operations (surreptitious entry, theft...), hacking and - this a nice euphemism - Tailored Access Operations (sophisticated spyware).

In other words: why decrypt it when you can steal it before it is encrypted. Now, the problem isn't NSA's capability to intercept and cryptanalyse your communications. After all, this is (or at least was) their primary task. The problem is that they now, on a massive scale, steal your data from on-line services or by breaking into your computer. They call it data mining, but it's actually data theft, and NSA is not to blame for that.

Several years ago, I wrote about how insecure computers are, the flawed security of public key cryptography (used all over the world for virtually everything), the current so-called state-of-the-art crypto algorithms and why it is useless to run crypto or anti-virus software on personal computers to protect your privacy. The security guru's (the experts after all) surely disagreed... until now.

Of course, anyone with only a bit of knowledge about security knows (but not all admit) that there's no such thing as a secure computer or privacy on the Internet. I always tried to convince people that secure communications meant putting your personal computer aside and use alternative "old school" methods.

These include personal conversation, dedicated off-line crypto devices or even return to one-time pad encryption, the unbreakable system (yes also unbreakable for NSA) which was - for good reasons - very popular until the 1980's for military and government communications. Solid and secure communications, even unbreakable, isn't new. It was already available half a century ago.

Crypto developers don't like to hear this, but the truth is that secure communications is pretty easy. Crypto security is not a complex mathematical problem but a technical-logistical problem. If you can get enough key material to the correspondents, you can provide perfect security. Today, mass key distribution and truly unbreakable encryption are perfectly possible with current hardware technology, albeit not when running it on the junk computers they sell today. However, it's also perfectly possible to develop secure computers for the commercial market.

Of course, it would present an enormous challenge to switch from the current insecure systems to solid encryption technology. But who's to blame for that? This would also require a new architecture for computers, focused on performance and watertight security, not focused on all kinds of legalised commercially driven back-doors to sell slash fed you with updates, spam and addware.

Computers don't install malicious software by themselves. They do exactly what you tell them to do, and they never do what they are not programmed for. It's that simple. Computer security is easy to accomplish, both in hardware and software, without compromising performance or comfort, if you're willing to.

The problems with our computers already started in the 1980s, with the rapidly expanding computer business. The cryptologists had to devise new solutions to cope with the exponentially expanding communications and the related key distribution However, that's exactly where it went wrong. Badly wrong.

Instead of focusing on how to solve secure key distribution for highly secure crypto algorithms, they choose the path of developing easy-to-use and so-called unbreakable public key cryptography: use traditional (yes, insecure) crypto algorithms to encrypt data, under control of a shared key of limited size. Instead of large keys and secury encryption they choose small keys and mathematical (at least in theory) secure encryption. They chose lazy over hard.

It's obvious that practical is quite different from secure. Recent events and the collapse of digital privacy and security - because that's exactly what happens now - proves the cryptologists approach to be a fatal mistake. I don't hear them boast about their crypto security now, nor do I see them provide solutions to today's eavesdropping catastrophe. Because they can't. And they know it.

The computer companies and their software developers are also to blame for the incompetence of the cryptologists, and some are even accomplices to the current privacy collapse. They decided to build in all kinds of processes, running behind our backs, to automatically install software, change system files and send information about your system and your data. And all this at the request of virtually anyone. Of course, some of these processes are useful to improve performance and compatibility. But the computer should only run trusted useful software, and yes, it's perfectly possible to tell the computer to do only that.

However, most open-the-backdoor processes are developed for nothing more than purely commercial proposes (yes, also those updates for so-called compatibility) or even developed by intelligence agencies that take a walk with your privacy. Even more worrying, some well known companies are kind enough to provide assistance to those agencies who believe privacy is the right to pry. Oh well, isn't privacy a conjugation of piracy? I don't hear them boast about their anti-virus and firewalls now, nor do I see them provide solutions to today's eavesdropping catastrophe. Because they don't want to. And they don't care.

I also wrote, years ago, about the consequences of these wide open gates: crypto and security software developers have absolutely no clue, I say again, no clue whatsoever, of all unidentified spyware, add-ons,  plug-ins and - as we recently discovered - government made "tailored access operations" hardware and software that is running on your computer. Consequently, security vendors are constantly one step behind, thus promising what they cannot deliver. They tell you that you need them. Indeed, their software is so bad that your computer constantly crashes or leaks like a sieve, if you don't constantly plug it... with their other software, of course.

Can you imagine buying a car that requires a daily check by the constructor to solve ever returning security issues? Hopefully not the breaks today? Dooh! You'd sue them! We all know what the problem is. Commercial profit. Forget all their excuses, they are unwilling to provide a solid and secure product. Is there another word for it than money driven arrogance towards the customer? By now it should be clear that they really screwed you, in your wallet and in your privacy. Does it sound harsh? It should.

Note that there are many excellent security experts who deserve our respect, but give me one good computer security slash crypto expert (the problem solving kind of expert, not problem exploiting expert). They now roll themselves in poor excuses ranging from "it's a complex problem" over "the algorithm is fine but the platform bad" to "the current threats are illegal practises", but that's exactly what they are supposed to protect us from.

Computer security and privacy are currently non-existent, and this also count - even more - for tablets and smart phones. It's about time that everyone starts realising that we completely depend on those machines for all our communications and that politicians, who - I am told - represent us, start to act and make laws that protect us. Until then (and "then" won't be the near future) you should think about what you type on your keyboard. In plain English: nothing you type or store digitally is safe from being read, exploited and misused by others. Get it? Just ask, from all people, that poor former CIA chief, general Petraeus. The Russian clearly got the point.

Do not misunderstand. I'm not against legally authorised surveillance (only on the bad guys), nor do I oppose to intelligence agencies and their work. However, some agencies and companies forget that privacy is a basic human right and all to easily use the pretext of fight against crime and terror as an excuse to snoop on you and me. Make sure to read Matthew Aid's piece on NSA's capabilities. Frode Weierud presented an excellent view on the PRISM and OCEO data mining programs, another dubious NSA surveillance trick. The Guardian has an excellent interactive page with discussions on NSA and privacy (scroll down their page to watch all interviews). More on NSa's collection programs and crypto backdoors in Bruce Schneier's November Crypto-Gram issue and his post on metadata. More detailed information on NSA's capabilities and operations at Electrospaces.

Update: with new information continuously surfacing and being confirmed, it seems that the U.S. war on terror backfires and NSA will get blamed for that. More allies are questioning the unrestricted dragnet collection of data on their country, its government agencies and citizens, and do not accept the excuse of war on terror.

While NSA can still claim to respect all U.S. laws and denies eavesdropping on its own citizens, their allies, especially those in Europe with a tradition of strict laws on privacy, are turning against the no-rules collection of intelligence. By now, this also affects the carefully build relations between the U.S. and its allies. Has NSA shot itself in the cyber foot? Even the U.S. public concern grows on both their own privacy and the effects of the international turmoil on their country.

It is not because the technology allows to collect information on a massive scale that you should actually do this, or that it is smart to do so. When even U.S. congressional oversight has no clear picture of NSA's operations, then how can, for instance, Europe be sure that the same technology is not used for industrial or corporate espionage, or to obtain foreknowledge on economic negotiations? Nothing new there. Technology equals power and history has shown, and will continue to show, that power corrupts. The intelligence archives are full of such examples.

However, if their allies (just as U.S. citizens by the way) have no idea of what information was collected and whether it was misued or not, then there is a crisis of confidence between partners. Answers like "we cannot discuss sensitive issues", "we assure you we do nothing wrong" or "we confirm nor deny" are hardly conducive to restore trust. Eavesdropping on friendly heads of states has nothing to do with war against terror, it's blunt offensive espionage. In the end, such a policy can have more adverse than beneficial political and economical effects to the U.S. (and the terrorists will be glad to hear that).

Intelligence collection on both friend and foe isn't new, but the technology has changed enormously since ECHELON, the first worldwide SIGINT collection network. Is the wide scale data mining proportional to the goal? Doesn't damaging international relations and redefining basic rights on privacy gets pretty close to admitting that the terrorists won? Of course, it's not up to NSA to justify anything, they only execute what they are told to do (if otherwise, there's a serious problem). Only the politicians are accountable.

Is the Foreign Intelligence Surveillance Act (FISA) in need of an update that includes rules on intelligence gathering abroad? In any case, given the possible impact on international relations, no intelligence agency should independently determine the means and rules to achieve the goals that were set by the politicians, because inappropriate or disproportional means will eventually do more harm than good. Since NSA and U.S. laws (and for that matter also GHCQ, GCSB, ADSD, DGSE, BSI and many others) perceive privacy and secrecy differently than the friends they snoop on, there might be a need for a different (not necessarily more) oversight, with new rules that addresses the distrust and concerns about privacy. Case far from closed.

Despite all the sorrow, a bit of cheerfulness (well, sort of): the story of the humorous logo that is not to be confused with the NSA logo!