U.S. and British intelligence agencies have successfully cracked much of the online encryption relied upon by hundreds of millions of people to protect the privacy of their personal data, online transactions and e-mails, according to top-secret documents revealed by former contractor Edward Snowden.
The files show that the National Security Agency and its U.K. counterpart GCHQ have broadly compromised the guarantees that Internet companies have given consumers to reassure them that their communications, online banking and medical records would be indecipherable to criminals or governments.
The agencies, the documents reveal, have adopted a battery of methods in their systematic and ongoing assault on what they see as one of the biggest threats to their ability to access huge swathes of Internet traffic — “the use of ubiquitous encryption across the Internet”.
Those methods include covert measures to ensure NSA control over setting of international encryption standards, the use of supercomputers to break encryption with “brute force”, and — the most closely guarded secret of all — collaboration with technology companies and Internet service providers themselves.
Through these covert partnerships, the agencies have inserted secret vulnerabilities — known as backdoors or trapdoors — into commercial encryption software.
The files, from both the NSA and GCHQ, were obtained by the Guardian, and the details are being published in partnership with the New York Times and ProPublica. They reveal:
— A 10-year NSA programme against encryption technologies made a breakthrough in 2010 which made “vast amounts” of data collected through Internet cable taps newly “exploitable”.
— The NSA spends $250 million a year on a programme which, among other goals, works with technology companies to “covertly influence” their product designs.
— The secrecy of their capabilities against encryption is closely guarded, with analysts warned: “Do not ask about or speculate on sources or methods.”
— The NSA describes strong decryption programmes as the “price of admission for the U.S. to maintain unrestricted access to and use of cyberspace”.
— A GCHQ team has been working to develop ways into encrypted traffic on the “big four” service providers, named as Hotmail, Google, Yahoo and Facebook.
— The agencies insist that the ability to defeat encryption is vital to their core missions of counter-terrorism and foreign intelligence gathering.
Celebrating success
Classified briefings between the agencies celebrate their success at “defeating network security and privacy”.
“For the past decade, NSA has lead [sic] an aggressive, multi-pronged effort to break widely used Internet encryption technologies,” stated a 2010 GCHQ document. “Vast amounts of encrypted Internet data which have up till now been discarded are now exploitable.” The breakthrough, which was not described in detail in the documents, meant the intelligence agencies were able to monitor “large amounts” of data flowing through the world’s fibre-optic cables and break its encryption, despite assurances from Internet company executives that this data was beyond the reach of government.
The key component of the NSA’s battle against encryption, its collaboration with technology companies, is detailed in the U.S. intelligence community’s top-secret 2013 budget request under the heading “Sigint [signals intelligence] enabling”.
Funding for the programme — $254.9 million for this year — dwarfs that of the Prism programme, which operates at a cost of $20 million a year, according to previous NSA documents. Since 2011, the total spending on Sigint enabling has topped $800 million. The programme “actively engages U.S. and foreign IT industries to covertly influence and/or overtly leverage their commercial products’ designs”, the document states. None of the companies involved in such partnerships are named; these details are guarded by still higher levels of classification.
Among other things, the programme is designed to “insert vulnerabilities into commercial encryption systems”. These would be known to the NSA, but to no one else, including ordinary customers, who are tellingly referred to in the document as “adversaries”.
“These design changes make the systems in question exploitable through Sigint collection ... with foreknowledge of the modification. To the consumer and other adversaries, however, the systems’ security remains intact.”
Technology companies maintain that they work with the intelligence agencies only when legally compelled to do so. The Guardian has previously reported that Microsoft co-operated with the NSA to circumvent encryption on the Outlook.com email and chat services. The company insisted that it was obliged to comply with “existing or future lawful demands” when designing its products.
Influencing standards
The documents show that the agency has already achieved another of the goals laid out in the budget request: to influence the international standards upon which encryption systems rely.
Independent security experts have long suspected that the NSA has been introducing weaknesses into security standards, a fact confirmed for the first time by another secret document. It shows the agency worked covertly to get its own version of a draft security standard issued by the U.S. National Institute of Standards and Technology approved for worldwide use in 2006. “Eventually, NSA became the sole editor,” the document states.
The document reveals that the agency has capabilities against widely used online protocols, such as HTTPS, voice-over-IP and Secure Sockets Layer (SSL), used to protect online shopping and banking.
The document also shows that the NSA’s Commercial Solutions Center, ostensibly the body through which technology companies can have their security products assessed and presented to prospective government buyers, has another, more clandestine role.
It is used by the NSA to “to leverage sensitive, co-operative relationships with specific industry partners” to insert vulnerabilities into security products. Operatives were warned that this information must be kept top secret “at a minimum”.
A more general NSA classification guide reveals more detail on the agency’s deep partnerships with industry, and its ability to modify products. It cautions analysts that two facts must remain top secret: that NSA makes modifications to commercial encryption software and devices “to make them exploitable”, and that NSA “obtains cryptographic details of commercial cryptographic information security systems through industry relationships”.
The agencies have not yet cracked all encryption technologies, however, the documents suggest. Mr. Snowden appeared to confirm this during a live Q&A with Guardian readers in June. “Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on,” he said before warning that NSA can frequently find ways around it as a result of weak security on the computers at either end of the communication.
Intelligence officials asked the Guardian, New York Times and ProPublica not to publish this article, saying that it might prompt foreign targets to switch to new forms of encryption or communications that would be harder to collect or read.
The three organisations removed some specific facts but decided to publish the story because of the value of a public debate about government actions that weaken the most powerful tools for protecting the privacy of Internet users in the U.S. and worldwide. — © Guardian Newspapers Limited, 2013
