9 ms·

NSA Chief Stakes Out Pro-Encryption Position, in Contrast to FBI

230 points by sinak 11y ago

macawfish 11y ago
maybe that's cause the NSA has secret algorithms to factor large numbers with quantum computers 0_0 :p
- informatimago 11y ago
  I would think so too. But it should also be noted they have the mandate to protect thru encryption and system security the data and secrets of the US government. On the other hand, the job of the FBI is to catch (some) criminals; they don't care much about anything else.
TerryADavis 11y ago
God says... Janelle's piccolo's fang's Dante's burdens Ireland's Merino Wichita's real cameos postmarks mollification westerner sentimentalism's oleo's lemonade's Dean surceasing adequate admiral Brussels repressing narcissism gladiolus's bode connecter watermelons exhibits pompon's wraparounds Donatello dyslexics
micah94 11y ago
I would hope so. It's kind of their job. They've also published guides for strong encryption and best practices for operating systems for years. You dismiss their wealth of knowledge at your peril. The FBI just wants to throw you in jail. What do they publish? Lists of people they want to throw in jail. Anything that stands in their way of throwing you in jail is bad, including your encrypted phone.
- spacecowboy_lon 11y ago
  That is the problem with the FBI doing ordinary police work and secret squirrel stuff the two roles get in each others way.
  - mst 11y ago
    Right. When I try and figure out how to compare the FBI to british law enforcement I end up with "MI5 smashed together with Special Branch plus SOCA plus a bunch of other specialist bits" ... and I'm pretty sure if we'd done that it'd've been an unmitigated disaster just the same. It was notable that there was a very brief "scandal" that MI5 had found evidence of child molestation but ignored it because they'd only found it via their ability to ignore due process in the name of national security and therefore since the information wasn't a national security issue it was filed under "not usable". Cooler heads pointed out repeatedly that that was how it had to work to preserve due process, and it didn't stay news for long; this was, to me, the correct outcome. (of course GCHQ is a whole different kettle of fish)
    - walshemj 11y ago
      And if you read the official history of MI5 the one time an ex police man was put in charge didn't go well - and that's the official history which is going to be circumspect. The FBI should have been reorganised along with the secret service and BATF after hoover died into two organisations one doing MI5 s role and one as a federal police force.
      - fnordfnordfnord 11y ago
        I think the FBI should have been burned to the ground after what Hoover used it for.
- nickik 11y ago
  We know that they publish stuff with backdoors included. We know that they payed RSA to build backdoors into their crypto. Their is a very good reason that SHA3 is not designed by the NSA. Yes you can learn from them, both from their published stuff and even more from how they attacked people.
exelius 11y ago
The NSA chief should be pro-encryption: the presence of backdoors in encryption (as demanded by some US law enforcement officials) creates a national security threat. Period. If law enforcement needs access to encrypted data, they already have a few different ways. They can subpoena the data and throw the person who controls the key in jail until they release it, or they can just brute-force the encryption in cases of extreme national interest (it's too expensive to do for run-of-the-mill crime, but they have the capability if they really need it). IMO the entire goal of encryption tech should be to make the government incur significant costs for every invasion of privacy they feel they have to perform. That way, they have the power to invade our privacy (and I don't think we as a populace can really stop them from having that power) but it's so expensive / cumbersome to use they really only use it in extreme cases. I'm fine with privacy being broken by the government on a case-by-case basis; the danger is when the government does a dragnet on everyone.
- rosalinekarr 11y ago
  Even on a case by case basis, the power to break encryption raises some serious questions. What if the current President or some future President goes digging through the emails of their opposition in an election year? What if the NSA starts investigating the records of politicians with a anti-NSA stance? With access to passwords and accounts, you even have to ask what if an agency like the GCHQ planted evidence in someone's email or tweeted an embarrassing photo on their behalf? [They have the tools to do so](http://arstechnica.com/security/2014/07/ghcqs-chinese-menu-of-tools-spread-disinformation-across-internet/ http://arstechnica.com/security/2014/07/ghcqs-chinese-menu-o...), and with power like that, they could basically destroy anyone who opposes them before they even start. I don't think perfect encryption is an impossible dream. I think it will be very hard to achieve, and we have a long way to go to getting there, but it's important work, and right now companies, governments and people should be pouring everything they can into making it a reality. We need a lot more research into encryption, especially [information theoretic secure](https://en.wikipedia.org/wiki/Information-theoretic_security https://en.wikipedia.org/wiki/Information-theoretic_security) algorithms.
  - exelius 11y ago
deleted 11y ago
[deleted]
barkingcat 11y ago
They are pro encryption because they can already crack the algorithms (or already have funding to bruteforce them). Of course they'd be Pro-encryption. It's their job. They are also a state-actor.
- deelowe 11y ago
  > They are pro encryption because they can already crack the algorithms Got proof of that?
  - exelius 11y ago
    Nobody has any proof, but it's strongly suspected. The NSA wrote or had a hand in writing every widely-supported encryption algorithm, and they have a military-scale budget (seriously; the NSA's non-clandestine budget is larger than the entire military budget of every country except the US and China) to spend on hardware to brute-force encryption. Cyberwarfare is a top strategic priority of the US Military, and cyberwarfare is made much easier when you can break encryption. They have the motive, the resources, and the knowledge to break encryption routinely. It's also standard tradecraft for a spy agency to hide any proof that they have a capability to create uncertainty among their enemies whether or not they do. So no, nobody has proof that the NSA can break encryption, but we do have proof that they have everything they would need to develop that capability.
    - nickik 11y ago
      The Snowden leaks gave a pretty good picture of what the capabilities are. They do most certainly not have backdoors into every possible crypto system. SHA1 should probably be replaced for example, but thats not all crypto by a longshot. Their are good talks at the C3 confernce about 'Post Snowden Crypto', specially by 'ruedi'. He goes into detail about all the major crypto system and explains how risky they are, and what we know about the NSAs efforts to break them. https://media.ccc.de/search?q=ruedi https://media.ccc.de/search?q=ruedi
      - caskance 11y ago
jostmey 11y ago
A play for political power. The NSA probably doesn't care if data is encrypted---they most likely already have a back-door to take data before its encrypted or after its decrypted. So if encryption is used, the FBI will be dependent on the NSA.
- nickik 11y ago
  I disagree. While they try to build backdoors its not that simple. Even if you have backdoor to every laptop in the world, its not an easy thing to smuggle out lots of data without people noticing. We know from Snowden that they do not have backdoors into everything. Its about economics, if they can listen in on the exchange its essentially free. If they have to backdoor every end user device, its gone cost a literal shit ton of money.
  - throwawayaway 11y ago
    http://tech.slashdot.org/comments.pl?sid=8623643&cid=51315653 http://tech.slashdot.org/comments.pl?sid=8623643&cid=5131565... It's really pretty damn easy. http://tech.slashdot.org/comments.pl?sid=8623643&cid=51313569 http://tech.slashdot.org/comments.pl?sid=8623643&cid=5131356... Win 7, 8 and 10 are done. OSX has spotlight upload to microsoft in plain sight. What else does OSX have under the hood? Phones are pretty much a foregone conclusion in my estimation, with the exception of cyanogen mod or something.
- nickpsecurity 11y ago
  I agree he's screwing around. They do care, though, because encryption makes their job more difficult. They want to be able to go through every potential source of usable intel as quickly as possible. Can't do that if they're having to sneak around with backdoors on a per device basis. They'd rather use the backdoors for attacks on high-priority targets who are dodging other stuff. Snowden leaks confirmed that hypothesis. Probably still true for economic reasons as other commenter noted.
nickpsecurity 11y ago
NSA chief can easily be pro encryption in public while breaking, subverting, and bypassing it in private as they always have. So, it's a smart position from a political standpoint. Action movie equivalent of being perceived as James Bond while pulling off super-villainy at the same time. Win win!
nickik 11y ago
He is most definitely not pro encryption. He is just against legal access by other agencies. He wants the NSA to have a backdoor into every possible crypto system and make them the organization every else has to come to for their data.
JustSomeNobody 11y ago
I am glad to hear someone making sense. All this handwavy let's just outlaw encryption babble is getting old. There are serious consequences to outlawing encryption. Oh, and if terrorists are hell bent on attacking, they will do so with or without encryption. And no amount of data collection is going to stop them if they plan well enough.
kriro 11y ago
Guess we know which agency has the working quantum computers ;P
- ytdht 11y ago
  that should be considered a backdoor, unless they make their findings about quantum computing public (the same goes for undisclosed "0-day" bugs that they discover).
  - caskance 11y ago
    In the house analogy, it's less of a backdoor and more like just walking through the wall.
    - ytdht 11y ago
      I'm not sure about that, but if you are right, that would be even worst ...
mariodiana 11y ago
There are two main points in this debate. Number one, we cannot abide having encryption weakened with back doors. Modern society relies on strong encryption. Number two, no amount of "magical technology" is ever going to replace human intelligence. The front lines in the war on terror is made up of human infiltrators and turncoats, not ones and zeroes.
laotzu 11y ago
If the number one security vulnerability is the human element, then shifting a system's security from autonomous unbiased code to the human element is necessarily decreasing security. Advocates for such are either deliberately malicious or grossly negligent.
jlarocco 11y ago
I'm not sure this means much. Several popular encryption schemes have been developed by or heavily influenced by the NSA (including algorithms mandated by FIPS and other government organizations), and there has been a lot of speculation that they added backdoors to AES and other algorithms. So in reality they've had the ability to add backdoors all along, and it's in their best interest to keep it a secret whether they've added one, so it makes complete sense that their chief would say this.
njharman 11y ago
Probably because NSa can break most encryption.
Golddisk 11y ago
Not particularly surprising, the government has ways to get around the encryption anyways, it just takes longer than if they had the backdoors to go through.
o0o0_ooo 11y ago
Wasn't this the whole situation with Dual_EC_DRBG? As far as I understand (which may not be that far when it comes to cryptography, admittedly), the NSA has already been caught intentionally weakening cryptographic standards via its influence over the NIST and by paying RSA. https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG RSA makes Dual_EC_DRBG the default CSPRNG in BSAFE. In 2013, Reuters reports this is a result of a secret $10 million deal with NSA. According to the New York Times story, the NSA spends $250 million per year to insert backdoors in software and hardware as part of the Bullrun program.
multinglets 11y ago
wait so which department is the FBI under and which department is the NSA under again? ... ah nevermind, I'm sure that doesn't mean anything.

230 points by sinak 11y ago

macawfish 11y ago

maybe that's cause the NSA has secret algorithms to factor large numbers with quantum computers 0_0 :p

informatimago 11y ago
I would think so too. But it should also be noted they have the mandate to protect thru encryption and system security the data and secrets of the US government. On the other hand, the job of the FBI is to catch (some) criminals; they don't care much about anything else.

TerryADavis 11y ago

God says... Janelle's piccolo's fang's Dante's burdens Ireland's Merino Wichita's real cameos postmarks mollification westerner sentimentalism's oleo's lemonade's Dean surceasing adequate admiral Brussels repressing narcissism gladiolus's bode connecter watermelons exhibits pompon's wraparounds Donatello dyslexics

micah94 11y ago

I would hope so. It's kind of their job. They've also published guides for strong encryption and best practices for operating systems for years. You dismiss their wealth of knowledge at your peril. The FBI just wants to throw you in jail. What do they publish? Lists of people they want to throw in jail. Anything that stands in their way of throwing you in jail is bad, including your encrypted phone.

spacecowboy_lon 11y ago
That is the problem with the FBI doing ordinary police work and secret squirrel stuff the two roles get in each others way.
- mst 11y ago
  Right. When I try and figure out how to compare the FBI to british law enforcement I end up with "MI5 smashed together with Special Branch plus SOCA plus a bunch of other specialist bits" ... and I'm pretty sure if we'd done that it'd've been an unmitigated disaster just the same. It was notable that there was a very brief "scandal" that MI5 had found evidence of child molestation but ignored it because they'd only found it via their ability to ignore due process in the name of national security and therefore since the information wasn't a national security issue it was filed under "not usable". Cooler heads pointed out repeatedly that that was how it had to work to preserve due process, and it didn't stay news for long; this was, to me, the correct outcome. (of course GCHQ is a whole different kettle of fish)
  - walshemj 11y ago
    And if you read the official history of MI5 the one time an ex police man was put in charge didn't go well - and that's the official history which is going to be circumspect. The FBI should have been reorganised along with the secret service and BATF after hoover died into two organisations one doing MI5 s role and one as a federal police force.
    - fnordfnordfnord 11y ago
      I think the FBI should have been burned to the ground after what Hoover used it for.
nickik 11y ago
We know that they publish stuff with backdoors included. We know that they payed RSA to build backdoors into their crypto. Their is a very good reason that SHA3 is not designed by the NSA. Yes you can learn from them, both from their published stuff and even more from how they attacked people.

exelius 11y ago

The NSA chief should be pro-encryption: the presence of backdoors in encryption (as demanded by some US law enforcement officials) creates a national security threat. Period. If law enforcement needs access to encrypted data, they already have a few different ways. They can subpoena the data and throw the person who controls the key in jail until they release it, or they can just brute-force the encryption in cases of extreme national interest (it's too expensive to do for run-of-the-mill crime, but they have the capability if they really need it). IMO the entire goal of encryption tech should be to make the government incur significant costs for every invasion of privacy they feel they have to perform. That way, they have the power to invade our privacy (and I don't think we as a populace can really stop them from having that power) but it's so expensive / cumbersome to use they really only use it in extreme cases. I'm fine with privacy being broken by the government on a case-by-case basis; the danger is when the government does a dragnet on everyone.

rosalinekarr 11y ago
Even on a case by case basis, the power to break encryption raises some serious questions. What if the current President or some future President goes digging through the emails of their opposition in an election year? What if the NSA starts investigating the records of politicians with a anti-NSA stance? With access to passwords and accounts, you even have to ask what if an agency like the GCHQ planted evidence in someone's email or tweeted an embarrassing photo on their behalf? [They have the tools to do so](http://arstechnica.com/security/2014/07/ghcqs-chinese-menu-of-tools-spread-disinformation-across-internet/ http://arstechnica.com/security/2014/07/ghcqs-chinese-menu-o...), and with power like that, they could basically destroy anyone who opposes them before they even start. I don't think perfect encryption is an impossible dream. I think it will be very hard to achieve, and we have a long way to go to getting there, but it's important work, and right now companies, governments and people should be pouring everything they can into making it a reality. We need a lot more research into encryption, especially [information theoretic secure](https://en.wikipedia.org/wiki/Information-theoretic_security https://en.wikipedia.org/wiki/Information-theoretic_security) algorithms.
- exelius 11y ago

deleted 11y ago

[deleted]

barkingcat 11y ago

They are pro encryption because they can already crack the algorithms (or already have funding to bruteforce them). Of course they'd be Pro-encryption. It's their job. They are also a state-actor.

deelowe 11y ago
> They are pro encryption because they can already crack the algorithms Got proof of that?
- exelius 11y ago
  Nobody has any proof, but it's strongly suspected. The NSA wrote or had a hand in writing every widely-supported encryption algorithm, and they have a military-scale budget (seriously; the NSA's non-clandestine budget is larger than the entire military budget of every country except the US and China) to spend on hardware to brute-force encryption. Cyberwarfare is a top strategic priority of the US Military, and cyberwarfare is made much easier when you can break encryption. They have the motive, the resources, and the knowledge to break encryption routinely. It's also standard tradecraft for a spy agency to hide any proof that they have a capability to create uncertainty among their enemies whether or not they do. So no, nobody has proof that the NSA can break encryption, but we do have proof that they have everything they would need to develop that capability.
  - nickik 11y ago
    The Snowden leaks gave a pretty good picture of what the capabilities are. They do most certainly not have backdoors into every possible crypto system. SHA1 should probably be replaced for example, but thats not all crypto by a longshot. Their are good talks at the C3 confernce about 'Post Snowden Crypto', specially by 'ruedi'. He goes into detail about all the major crypto system and explains how risky they are, and what we know about the NSAs efforts to break them. https://media.ccc.de/search?q=ruedi https://media.ccc.de/search?q=ruedi
    - caskance 11y ago

jostmey 11y ago

A play for political power. The NSA probably doesn't care if data is encrypted---they most likely already have a back-door to take data before its encrypted or after its decrypted. So if encryption is used, the FBI will be dependent on the NSA.

nickik 11y ago
I disagree. While they try to build backdoors its not that simple. Even if you have backdoor to every laptop in the world, its not an easy thing to smuggle out lots of data without people noticing. We know from Snowden that they do not have backdoors into everything. Its about economics, if they can listen in on the exchange its essentially free. If they have to backdoor every end user device, its gone cost a literal shit ton of money.
- throwawayaway 11y ago
  http://tech.slashdot.org/comments.pl?sid=8623643&cid=51315653 http://tech.slashdot.org/comments.pl?sid=8623643&cid=5131565... It's really pretty damn easy. http://tech.slashdot.org/comments.pl?sid=8623643&cid=51313569 http://tech.slashdot.org/comments.pl?sid=8623643&cid=5131356... Win 7, 8 and 10 are done. OSX has spotlight upload to microsoft in plain sight. What else does OSX have under the hood? Phones are pretty much a foregone conclusion in my estimation, with the exception of cyanogen mod or something.
nickpsecurity 11y ago
I agree he's screwing around. They do care, though, because encryption makes their job more difficult. They want to be able to go through every potential source of usable intel as quickly as possible. Can't do that if they're having to sneak around with backdoors on a per device basis. They'd rather use the backdoors for attacks on high-priority targets who are dodging other stuff. Snowden leaks confirmed that hypothesis. Probably still true for economic reasons as other commenter noted.

nickpsecurity 11y ago

NSA chief can easily be pro encryption in public while breaking, subverting, and bypassing it in private as they always have. So, it's a smart position from a political standpoint. Action movie equivalent of being perceived as James Bond while pulling off super-villainy at the same time. Win win!

nickik 11y ago

He is most definitely not pro encryption. He is just against legal access by other agencies. He wants the NSA to have a backdoor into every possible crypto system and make them the organization every else has to come to for their data.

JustSomeNobody 11y ago

I am glad to hear someone making sense. All this handwavy let's just outlaw encryption babble is getting old. There are serious consequences to outlawing encryption. Oh, and if terrorists are hell bent on attacking, they will do so with or without encryption. And no amount of data collection is going to stop them if they plan well enough.

kriro 11y ago

Guess we know which agency has the working quantum computers ;P

ytdht 11y ago
that should be considered a backdoor, unless they make their findings about quantum computing public (the same goes for undisclosed "0-day" bugs that they discover).
- caskance 11y ago
  In the house analogy, it's less of a backdoor and more like just walking through the wall.
  - ytdht 11y ago
    I'm not sure about that, but if you are right, that would be even worst ...

mariodiana 11y ago

There are two main points in this debate. Number one, we cannot abide having encryption weakened with back doors. Modern society relies on strong encryption. Number two, no amount of "magical technology" is ever going to replace human intelligence. The front lines in the war on terror is made up of human infiltrators and turncoats, not ones and zeroes.

laotzu 11y ago

If the number one security vulnerability is the human element, then shifting a system's security from autonomous unbiased code to the human element is necessarily decreasing security. Advocates for such are either deliberately malicious or grossly negligent.

jlarocco 11y ago

I'm not sure this means much. Several popular encryption schemes have been developed by or heavily influenced by the NSA (including algorithms mandated by FIPS and other government organizations), and there has been a lot of speculation that they added backdoors to AES and other algorithms. So in reality they've had the ability to add backdoors all along, and it's in their best interest to keep it a secret whether they've added one, so it makes complete sense that their chief would say this.

njharman 11y ago

Probably because NSa can break most encryption.

Golddisk 11y ago

Not particularly surprising, the government has ways to get around the encryption anyways, it just takes longer than if they had the backdoors to go through.

o0o0_ooo 11y ago

Wasn't this the whole situation with Dual_EC_DRBG? As far as I understand (which may not be that far when it comes to cryptography, admittedly), the NSA has already been caught intentionally weakening cryptographic standards via its influence over the NIST and by paying RSA. https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG RSA makes Dual_EC_DRBG the default CSPRNG in BSAFE. In 2013, Reuters reports this is a result of a secret $10 million deal with NSA. According to the New York Times story, the NSA spends $250 million per year to insert backdoors in software and hardware as part of the Bullrun program.

multinglets 11y ago

wait so which department is the FBI under and which department is the NSA under again? ... ah nevermind, I'm sure that doesn't mean anything.