11 ms·

Swiss report reveals new details on CIA spying operation

234 points by tpurves 6y ago

Irishsteve 6y ago
CIA And the German government
gitweb 6y ago
Dang, typical CIA though sell the company and not disclose that it was basically a shell company for shady operations where they happily charged countries lots of money and then bragged about it to essentially spy on them. I feel really bad for whoever bought the company not knowing about its secrets this greatly devaluing the name and forever tarnishing the brand. There's got to be some type of repercussions and avenue for their deceit to the innocent people that ended up suffering here.
- acqq 6y ago
  Regarding "not knowing about its secrets" -- There were much earlier reports, as an example, from the Wikipedia article, there was an article in The Baltimore Sun, 1995: "America's National Security Agency hid what may be the intelligence sting of the century. For years, NSA secretly rigged Crypto AG machines so that U.S. eavesdroppers could easily break their codes, according to former company employees whose story is supported by company documents." And also in the same Baltimore Sun article a much earlier report about the company founder, Boris Hagelin (1982) is mentioned: "Writer James Bamford added more clues in his 1982 book on NSA, "The Puzzle Palace." Discovering in Mr. Friedman's letters references to a mysterious "Boris project," Mr. Bamford concluded that Mr. Friedman had extracted from Boris Hagelin an agreement to cooperate with American eavesdroppers."
  - vmception 6y ago
    But then all the FOIA requests got sent to the wrong agency! hahaha nice misdirection, top notch trolling everyone!
mroche 6y ago
https://archive.is/S1qzE https://archive.is/S1qzE
jjd33 6y ago
US spying on their "friends" Germany Austria Switzerland wow that's some news I would have not expected. Also Washington Post.
- partiallypro 6y ago
  Did you just not read the article at all?
totalZero 6y ago
Kind of highlights that in this age, it's not enough to say "I'm neutral." You need to be able to say "I can guarantee that I'm neutral." The difference is that the latter promise doesn't break when a malicious actor has access. Consider two VPNs, one of which promises never to misuse client-side IP data, while the other refuses to store that data in the first place. If both VPNs are infiltrated by a bad actor, the one that doesn't store data can guarantee slightly more privacy than the one that keeps data but promises not to use it. Similar case: I think it's interesting to note that German usage of Tor dropped off when the Snowden revelations took place, while many other countries experienced greater uptake. Perhaps they recognized that Tor may not be as secure as it's claimed to be -- especially considering who initially funded it. If you want an encryption product/service to be truly secure, you can't buy it on reputation alone. You have to think about where it came from and how it works.
- slg 6y ago
  >Kind of highlights that in this age, it's not enough to say "I'm neutral." You need to be able to say "I can guarantee that I'm neutral." >The difference is that the latter promise doesn't break when a malicious actor has access. Consider two VPNs, one of which promises never to misuse client-side IP data, while the other refuses to store that data in the first place. Why do you trust either company? Can you verify the claim that no data is logged intentionally or potentially even accidentally? Even companies that have been taken to court and shown an inability to produce logs in the past could have made recent changes behind the scenes that change this. There is a huge degree of information asymmetry when it comes to VPN providers and as a result you shouldn't completely trust them if logging is a make or break issue for you.
  - im3w1l 6y ago
    I think it's important to be realistic about VPN's. They can't keep you safe from Nation State Adversaries. They can keep you safe from spiteful nobodies or smaller orgs.
    - Loughla 6y ago
hiddenforest 6y ago
There are people who think that Protonmail is a government front. I don't think so, but who am I? What's a little bothersome is the new administration is more likely to push for the impossible backdoor into encryption. Swiss companies are under an MLAT, so yes, they will cooperate with American government agencies if they request information. CTemplar looks promising, but in a way, all of these "secure" email hosting companies are really pushing security theater. It's difficult to trust third parties with your data, even if you are not a dissident, journalist, or someone who actually needs to protect their life. I'm not looking forward to this upcoming administration's tactics as regards big tech. I didn't like Trump's administration much (what there was of it). Biden is looking to put Eric Schmidt somewhere up high as relates tech. He's buried into the American military industrial complex already and just purchased Cypriot citizenship. Conflict of interest? I'd be lying if I said I wasn't at least more concerned over the Democrats and their view of encryption/back doors and company compliance. Why can't we have a transparent government like Finland?
- DarthGhandi 6y ago
  > but in a way, all of these "secure" email hosting companies are really pushing security theater The nature of email means the to/from/subject fields are always in the clear. How exactly is an open source mobile app or a webpage that you can see the source code is clearly sending encrypted text over the wire considered "security theatre"? You'd certainly make a big name for yourself proving them wrong. https://github.com/ProtonMail https://github.com/ProtonMail
- effie 6y ago
  > Why can't we have a transparent government like Finland? In case this is a genuine question, I think it is because U.S. government has the largest power in the world and this is a benefit to many people who want that power protected and available to them. In a transparent government, this control by would bother regular citizens more and would destabilize things.
- segfaultbuserr 6y ago
  > There are people who think that Protonmail is a government front. I don't think so, but who am I? It seems that many people have a wrong (read: unrealistically high) expectation of security on Protonmail to begin with. If you are just using Protonmail as a plain mail service, it's nearly as vulnerable as any other emails providers: all incoming mails can be monitored at the originator's mail provider, or at Protonmail, all outgoing mails can be monitored at Protonmail or at the receiver's mail provider. These security properties are natural conclusions from the architecture of SMTP. No backdoor is needed. If the government wants to subpoena your mail, they can simply require Protonmail to intercept all incoming traffic at the SMTP server before it's encrypted locally. Also, the fact that Protonmail is subjected to subpoenas is publicly announced on their website, and they state that they'll cooperate as far as the degree allowed by cryptography. No backdoor conspiracy is even needed to begin with. End-of-end encryption is only used in-browser when you're sending mails to another Protonmail user. Don't get me wrong. I use Protonmail and I'm a paying user. The only major advantage of Protonmail is data-at-rest encryption, once the plainmail arrives to your inbox, it's not possible to be leaked retroactively without your passphrase. And this advantage alone is enough for me to use it, since it's as insecure as any other mails at worst, and a bit more secure at best, I have nothing to lose. If a higher degree of security is desirable, it's still your own responsibility to use end-to-end encryption, preferable, one should also use Protonmail's official client (with source code) to access Protonmail locally, which ensures that malicious JavaScript can't be injected from the server side to reveal the passphrase to your inbox. Finally, if you must find a credible conspiracy from it (I'm not a fan of doing it, 90% of the time the arguments are all vague "backdoor" or geopolitics rather than a technical security analysis), Protonmail can be considered a PR hack supported by the NSA that misleads non-technical users to think it as a silver bullet, thus actually impeding the progress of developing better end-to-end encryption for email communication.
andreasley 6y ago
The actual report, in german: https://www.parlament.ch/centers/documents/de/bericht-gpdel-2020-11-10-d.pdf https://www.parlament.ch/centers/documents/de/bericht-gpdel-... Interestingly, the report states that the collaboration of the Swiss Intelligence Service with the CIA and BND was known to only a small group of people; even the Federal Council supposedly did not know about it.
- deleted 6y ago
  [deleted]
- markus_zhang 6y ago
  This reminds me of Operation Gladio. In each country only a selected group knows about its existence and many politicians had no idea that it existed in their country.
  - dboreham 6y ago
    Illuminati.
  - jnurmine 6y ago
    Indeed, though the only commonality is high secrecy. Operation Gladio meant NATO's stay-behind armies. The original intention was that in the event of a Soviet/Warsaw Pact attack the stay-behind armies could organize guerrilla resistance and fight back. Crypto AG was essentially a clever intelligence operation.
    - 082349872349872 6y ago
      > Operation Gladio meant NATO's stay-behind armies. We aren't a NATO member, so there was a scandal after the cold war ended, when it came to light that NATO had been operating a stay-behind in our country as well.
vmception 6y ago
This sheds a lot of light on why statutory declassifications keep getting extended and reinstated here in the US, as the sources continue to have effects on national security and it isn't just an excuse.
- xxpor 6y ago
  Automatic declassification is largely governed by executive order in the US. This stems from the fact that the president has more or less unilateral constitutional authority to determine what's classified and what isn't. More about DOJ automatic declassification, as an example: https://www.justice.gov/archives/open/declassification/declassification-faq https://www.justice.gov/archives/open/declassification/decla...
  - vmception 6y ago
    Littered with exemptions, determined unilaterally by each federal agency. Let's look at a few in the context of Crypto AG > 25X1 – reveal the identity of a confidential human source, a human intelligence source, a relationship with an intelligence or security service of a foreign government or international organization, or a non-human intelligence source; or impair the effectiveness of an intelligence method currently in use, available for use, or under development; > 25X3 – reveal information that would impair U.S. cryptologic systems or activities; > 25X6 – reveal information including foreign government information, that would cause serious harm to relations between the U.S. and a foreign government, or to ongoing diplomatic activities of the U.S; > 25X8 – reveal information that would seriously impair current national security emergency preparedness plans or reveal current vulnerabilities of systems, installations, or infrastructures relating to the national security; This doesn't require a court or tribunal, it just requires the passing rationale of a random pencil pusher in any agency to stonewall the archivist and anyone else.
    - xxpor 6y ago
      And if you do try to bring a FOIA lawsuit, the government just says the magic words "national security" and the whole thing gets thrown out.
vmception 6y ago
Props to Zug and Leichtenstein for being the best vassal states known to man!
- sm4rk0 6y ago
  What makes them better vassal states than any of the EU/NATO and the rest of the democratic™ first world countries? They were/are just doing what Uncle Sam says because "You're with us or you're against us." I'd say they deserve the "best hypocrite" award.
  - sm4rk0 6y ago
    My attitude is sponsored by NATO bombing of my country (Serbia).
    - vmception 6y ago
      I understand what you are saying, but if you really want to know I can draw a distinction. So Leichtenstein is not in NATO, or the EU, while being geographically surrounded and it uses this flexibility opportunistically. It functions more-so as a vassal state of Switzerland, as it is not Switzerland either nor bound by its constitution or direct democracy, while using its currency directly via the Swiss Central Bank instead of the Euro. Leichtenstein lawyers arranged for the purchase and management of Crypto AG shares, this is no accident, and the entrepreneurs in Leichtenstein (the lawyers and many other services providers there) are willing participants in this geopolitical financial game. Zug is nice because of the general optimization towards science and technologies. Cantons in Switzerland enjoy a high degree of autonomy and decision making while being relatively sparsly unpopulated. So getting something approved really means the agreement of the 2 people acting as regulator in a town of 100,000 people, and inheriting the brand and sovereignty of Switzerland. It is great for business, practically unparalleled.
      - sm4rk0 6y ago
        Thanks for the explanation. That shed a different light on those two vassal "states".
bromquinn 6y ago
Serious question. How does one know that any secure communications provider is secure? I use tools like Signal and protonmail, but this article has me thinking that those might as well be government ops. Presumably the governments who purchased systems from Crypto AG had people educated in security do some due diligence on Crypto AG's products before purchasing them. If they didn't realize that the products were compromised by the US, what chance do I have?
- fsflover 6y ago
  > How does one know that any secure communications provider is secure? I use tools like Signal and protonmail, but this article has me thinking that those might as well be government ops. We need independent crowdfunded external audits for that like the one performed for TrueCrypt.
  - DSingularity 6y ago
    TrueCrypt Rest In Peace.
    - fsflover 6y ago
      Actually AFAIK it still works fine except privilege escalations (which do not concern users caring about security and using Qubes OS).
      - edm0nd 6y ago
        VeraCrypt is what most moved to iirc. I still actually wonder what actually happened to TrueCrypt. Did a dev get threatened with a NSA or FBI NSL? Did they get asked to implant a bug so they shut it down instead? So many questions.
        RcouF1uZ4gsC 6y ago
        Conspiracy theory me says it was the NSA. From their home page warning. > WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues. The phrase “not secure as” is interesting as the first letter spell out NSA.
rjsw 6y ago
Someone had written [1] about breaking a Hagelin crypto machine in 1975. [1] https://www.bell-labs.com/usr/dmr/www/crypt.html https://www.bell-labs.com/usr/dmr/www/crypt.html EDIT: changed the date to that of when it was done rather than that of the document.
BlueTemplar 6y ago
Now consider what this suggests about Intel processors (IME) and GAFAM's software (including Raspberry Pi's firmware, ThreadX ?). In completely unrelated news, OVH, Europe's biggest hosting provider, has announced a new partnership : OVH is going to use Google's closed(?) source software, Anthos, for its "Hosted Private Cloud" offering.
- fedreserved 6y ago
  https://youtu.be/8ZNjUiP0p6I https://youtu.be/8ZNjUiP0p6I Video by Brendan O'Connell showing how Intel is infiltrated and compromised. He would be considered fringe, but there's plenty of info to be gleamed. Don't shoot the messenger
  - pc86 6y ago
    First image is literally dramatic music, a menorah, Netanyahu, and flames. How can anyone take this guy seriously?
    - throw0101a 6y ago
      > How can anyone take this guy seriously? In the timeline where flat earthers hold annual conventions, why are you surprised?
    - BuildTheRobots 6y ago
      FYI, the menorah is actually the Mossad logo, though it doesn't change the point you're making. I've not watched the video yet, but as it's entitled "How Russia and Israel Destroyed the Intel Corporation" I'm not sure what else I'd be using as an intro graphic. edit: Having watched about 10min of the video please don't take my defence of the title screen as defence of the contents of the video.
      - pc86 6y ago
        Thanks, I didn't realize that! I'm not sure why that seems "better" (but still pretty bad).
neonate 6y ago
https://archive.is/S1qzE https://archive.is/S1qzE
xhkkffbf 6y ago
It's worth remembering that it was the Baltimore Sun that first reported this back in 1995. https://www.baltimoresun.com/news/bs-xpm-1995-12-10-1995344001-story.html https://www.baltimoresun.com/news/bs-xpm-1995-12-10-19953440...
beloch 6y ago
Perhaps the reason the U.S. is pushing its allies to ban Huawei from 5G networks is because of their own past (and possibly current) experiences using puppet corporations for spying.
- vinay427 6y ago
  I would suspect the EU to be complicit, not a victim, considering their companies (e.g. Ericsson and Nokia) stand to benefit as the US-proposed alternatives.
partiallypro 6y ago
All thing aside, the final graph describes how the company was bought from the CIA by an entrepreneur...except he didn't know it was CIA owned at the time and now that company he bought is probably effectively worthless. That sucks pretty bad.
- jeffrallen 6y ago
  That Crypto AG had sold vulnerable machines was not a secret when he bought it. He either didn't want to know, or was so stupendously bad at due diligence that he didn't find out what anyone with 15 years history on cryptography could have told him. Either way, I'm not crying for him. But the revocation of unrelated export licences this year by Switzerland out of embarrassment was deemed illegal, and that really is too bad. Bern killed a company, and cost Zug 80 jobs. Not cool.
  - anthony_r 6y ago
    You think that losing 80 jobs is really the biggest problem here?
    - LanceH 6y ago
      To 80 people and their families, yes. And to many others who are concerned they may be next. Repeat this enough times and you have a large contingent voting for the other guy, regardless of how awful he may seem.
  - 082349872349872 6y ago
    Crypto AG probably cost Zug much more than 80 net present jobs in reputation damage.
demosito666 6y ago
The thing that stands out in the article for me is that it wasn't such a well hidden secret after all. From the article I got the impression that an interested party could actually know that devices were rigged and pour disinformation into the channel. From the main article [1]: > The engineer, Peter Frutiger, had long suspected Crypto was collaborating with German intelligence. He had made multiple trips to Damascus to address complaints about their Crypto products and apparently, without authority from headquarters, had fixed their vulnerabilities. > Frutiger “had figured out the Minerva secret and it was not safe with him,” according to the CIA history. Even so, the agency was livid with Wagner for firing Frutiger rather than finding a way to keep him quiet on the company payroll. Frutiger declined to comment for this story. So not only Syrian customers discovered the vulnerabilities and complained about them, they actually got them fixed and then the engineer was fired for that, so things likely got ugly. Possessing the knowledge about a compromised system that you know was sold to dozens of governments, is itself a valuable diplomatic asset. I have hard time imagining it was never acted upon by no one. Which makes me think that the customer who'd actually done his homework could discover a lot of suspicious stuff. [1] https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/?itid=lk_interstitial_manual_5 https://www.washingtonpost.com/graphics/2020/world/national-...
- neilv 6y ago
  > > Frutiger “had figured out the Minerva secret and it was not safe with him,” according to the CIA history. Even so, the agency was livid with Wagner for firing Frutiger rather than finding a way to keep him quiet on the company payroll. And, at that point, Frutiger might've suspected what kind of perceived liability he might be, and been terrified. :(
- dingaling 6y ago
  Crypto AG was selling knowingly-weak products for decades in conjunction with US and UK agencies. Post-war they commercially sold an Enigma variant, C-52, with documented vulnerabilities to nations that were considered to be 'of interest'. Cracking their encrypted messages was trivial. Meanwhile, trusted nations were allowed to buy the otherwise secret and secure CX-52. Rumours of this arrangement surfaced in the 1970s and again in the 1990s. Why anyone still bought from them is a mystery.
wdb 6y ago
This sounds similar to the PX1000 story: https://www.cryptomuseum.com/crypto/philips/px1000/nsa.htm https://www.cryptomuseum.com/crypto/philips/px1000/nsa.htm and https://www.vpro.nl/argos/lees/nieuws/2020/cryptoleaks-in-the-netherlands-former-philips-top-cryptographer-admits-to-compromising-encryption-devices.html https://www.vpro.nl/argos/lees/nieuws/2020/cryptoleaks-in-th... PX-1000 was a handheld message terminal, also known as a pocket telex, developed in 1980 by Text Lite in Amsterdam (Netherlands) and sold worldwide by Philips and others. Some versions of it had built-in encryption capability. In the initial version, the DES algorithm was used, but this was later replaced by another algorithm at the request of the US National Security Agency (NSA).
ThePowerOfFuet 6y ago
https://archive.vn/S1qzE https://archive.vn/S1qzE
sebmellen 6y ago
I lived in Zug, Switzerland, also known as the "Crypto Valley", for a while between 2018 and 2019. The investors in my startup are based in Zug, as are many other large conglomerates (Siemens, Johnson & Johnson, Glencore, etc.). My apartment was a short walk away from Crypto AG's headquarters. Zug is a very strange and interesting town, brimming with the sort of energy you'd expect from a little tax haven (also known as the "Cayman Islands of Switzerland"). It's now well known for the cryptocurrency foundations located there, from Ethereum to Tezos to Cardano. Of course, at the time Crypto AG was founded, the Crypto Valley had nothing to do with cryptocurrency, but how interesting that cryptography was a key export since so long ago. To think I lived so close to a covert CIA operation — I had no idea!
us0r 6y ago
I'm guessing its programs like these which make some Senators completely ignore experts on the whole backdoor into encryption thing. They don't know the difference they just see results from the NSA. > Crypto’s international business was purchased by a Swedish entrepreneur, Andreas Linde, who said in an email exchange with The Post earlier this year that he was not aware of the CIA’s ownership when he purchased the assets. Export controls imposed by Swiss authorities in the aftermath of public disclosures about Crypto earlier this year have threatened the company’s survival. If Andreas Linde is not a cover that's pretty fucked up. They couldn't have just run the "business" into the ground?

234 points by tpurves 6y ago

CIA And the German government

Dang, typical CIA though sell the company and not disclose that it was basically a shell company for shady operations where they happily charged countries lots of money and then bragged about it to essentially spy on them. I feel really bad for whoever bought the company not knowing about its secrets this greatly devaluing the name and forever tarnishing the brand. There's got to be some type of repercussions and avenue for their deceit to the innocent people that ended up suffering here.

acqq 6y ago
Regarding "not knowing about its secrets" -- There were much earlier reports, as an example, from the Wikipedia article, there was an article in The Baltimore Sun, 1995: "America's National Security Agency hid what may be the intelligence sting of the century. For years, NSA secretly rigged Crypto AG machines so that U.S. eavesdroppers could easily break their codes, according to former company employees whose story is supported by company documents." And also in the same Baltimore Sun article a much earlier report about the company founder, Boris Hagelin (1982) is mentioned: "Writer James Bamford added more clues in his 1982 book on NSA, "The Puzzle Palace." Discovering in Mr. Friedman's letters references to a mysterious "Boris project," Mr. Bamford concluded that Mr. Friedman had extracted from Boris Hagelin an agreement to cooperate with American eavesdroppers."
- vmception 6y ago
  But then all the FOIA requests got sent to the wrong agency! hahaha nice misdirection, top notch trolling everyone!

mroche 6y ago

https://archive.is/S1qzE https://archive.is/S1qzE

jjd33 6y ago

US spying on their "friends" Germany Austria Switzerland wow that's some news I would have not expected. Also Washington Post.

partiallypro 6y ago
Did you just not read the article at all?

totalZero 6y ago

Kind of highlights that in this age, it's not enough to say "I'm neutral." You need to be able to say "I can guarantee that I'm neutral." The difference is that the latter promise doesn't break when a malicious actor has access. Consider two VPNs, one of which promises never to misuse client-side IP data, while the other refuses to store that data in the first place. If both VPNs are infiltrated by a bad actor, the one that doesn't store data can guarantee slightly more privacy than the one that keeps data but promises not to use it. Similar case: I think it's interesting to note that German usage of Tor dropped off when the Snowden revelations took place, while many other countries experienced greater uptake. Perhaps they recognized that Tor may not be as secure as it's claimed to be -- especially considering who initially funded it. If you want an encryption product/service to be truly secure, you can't buy it on reputation alone. You have to think about where it came from and how it works.

slg 6y ago
>Kind of highlights that in this age, it's not enough to say "I'm neutral." You need to be able to say "I can guarantee that I'm neutral." >The difference is that the latter promise doesn't break when a malicious actor has access. Consider two VPNs, one of which promises never to misuse client-side IP data, while the other refuses to store that data in the first place. Why do you trust either company? Can you verify the claim that no data is logged intentionally or potentially even accidentally? Even companies that have been taken to court and shown an inability to produce logs in the past could have made recent changes behind the scenes that change this. There is a huge degree of information asymmetry when it comes to VPN providers and as a result you shouldn't completely trust them if logging is a make or break issue for you.
- im3w1l 6y ago
  I think it's important to be realistic about VPN's. They can't keep you safe from Nation State Adversaries. They can keep you safe from spiteful nobodies or smaller orgs.
  - Loughla 6y ago

hiddenforest 6y ago

There are people who think that Protonmail is a government front. I don't think so, but who am I? What's a little bothersome is the new administration is more likely to push for the impossible backdoor into encryption. Swiss companies are under an MLAT, so yes, they will cooperate with American government agencies if they request information. CTemplar looks promising, but in a way, all of these "secure" email hosting companies are really pushing security theater. It's difficult to trust third parties with your data, even if you are not a dissident, journalist, or someone who actually needs to protect their life. I'm not looking forward to this upcoming administration's tactics as regards big tech. I didn't like Trump's administration much (what there was of it). Biden is looking to put Eric Schmidt somewhere up high as relates tech. He's buried into the American military industrial complex already and just purchased Cypriot citizenship. Conflict of interest? I'd be lying if I said I wasn't at least more concerned over the Democrats and their view of encryption/back doors and company compliance. Why can't we have a transparent government like Finland?

DarthGhandi 6y ago
> but in a way, all of these "secure" email hosting companies are really pushing security theater The nature of email means the to/from/subject fields are always in the clear. How exactly is an open source mobile app or a webpage that you can see the source code is clearly sending encrypted text over the wire considered "security theatre"? You'd certainly make a big name for yourself proving them wrong. https://github.com/ProtonMail https://github.com/ProtonMail
effie 6y ago
> Why can't we have a transparent government like Finland? In case this is a genuine question, I think it is because U.S. government has the largest power in the world and this is a benefit to many people who want that power protected and available to them. In a transparent government, this control by would bother regular citizens more and would destabilize things.
segfaultbuserr 6y ago
> There are people who think that Protonmail is a government front. I don't think so, but who am I? It seems that many people have a wrong (read: unrealistically high) expectation of security on Protonmail to begin with. If you are just using Protonmail as a plain mail service, it's nearly as vulnerable as any other emails providers: all incoming mails can be monitored at the originator's mail provider, or at Protonmail, all outgoing mails can be monitored at Protonmail or at the receiver's mail provider. These security properties are natural conclusions from the architecture of SMTP. No backdoor is needed. If the government wants to subpoena your mail, they can simply require Protonmail to intercept all incoming traffic at the SMTP server before it's encrypted locally. Also, the fact that Protonmail is subjected to subpoenas is publicly announced on their website, and they state that they'll cooperate as far as the degree allowed by cryptography. No backdoor conspiracy is even needed to begin with. End-of-end encryption is only used in-browser when you're sending mails to another Protonmail user. Don't get me wrong. I use Protonmail and I'm a paying user. The only major advantage of Protonmail is data-at-rest encryption, once the plainmail arrives to your inbox, it's not possible to be leaked retroactively without your passphrase. And this advantage alone is enough for me to use it, since it's as insecure as any other mails at worst, and a bit more secure at best, I have nothing to lose. If a higher degree of security is desirable, it's still your own responsibility to use end-to-end encryption, preferable, one should also use Protonmail's official client (with source code) to access Protonmail locally, which ensures that malicious JavaScript can't be injected from the server side to reveal the passphrase to your inbox. Finally, if you must find a credible conspiracy from it (I'm not a fan of doing it, 90% of the time the arguments are all vague "backdoor" or geopolitics rather than a technical security analysis), Protonmail can be considered a PR hack supported by the NSA that misleads non-technical users to think it as a silver bullet, thus actually impeding the progress of developing better end-to-end encryption for email communication.

andreasley 6y ago

The actual report, in german: https://www.parlament.ch/centers/documents/de/bericht-gpdel-2020-11-10-d.pdf https://www.parlament.ch/centers/documents/de/bericht-gpdel-... Interestingly, the report states that the collaboration of the Swiss Intelligence Service with the CIA and BND was known to only a small group of people; even the Federal Council supposedly did not know about it.

deleted 6y ago
[deleted]
markus_zhang 6y ago
This reminds me of Operation Gladio. In each country only a selected group knows about its existence and many politicians had no idea that it existed in their country.
- dboreham 6y ago
  Illuminati.
- jnurmine 6y ago
  Indeed, though the only commonality is high secrecy. Operation Gladio meant NATO's stay-behind armies. The original intention was that in the event of a Soviet/Warsaw Pact attack the stay-behind armies could organize guerrilla resistance and fight back. Crypto AG was essentially a clever intelligence operation.
  - 082349872349872 6y ago
    > Operation Gladio meant NATO's stay-behind armies. We aren't a NATO member, so there was a scandal after the cold war ended, when it came to light that NATO had been operating a stay-behind in our country as well.

vmception 6y ago

This sheds a lot of light on why statutory declassifications keep getting extended and reinstated here in the US, as the sources continue to have effects on national security and it isn't just an excuse.

xxpor 6y ago
Automatic declassification is largely governed by executive order in the US. This stems from the fact that the president has more or less unilateral constitutional authority to determine what's classified and what isn't. More about DOJ automatic declassification, as an example: https://www.justice.gov/archives/open/declassification/declassification-faq https://www.justice.gov/archives/open/declassification/decla...
- vmception 6y ago
  Littered with exemptions, determined unilaterally by each federal agency. Let's look at a few in the context of Crypto AG > 25X1 – reveal the identity of a confidential human source, a human intelligence source, a relationship with an intelligence or security service of a foreign government or international organization, or a non-human intelligence source; or impair the effectiveness of an intelligence method currently in use, available for use, or under development; > 25X3 – reveal information that would impair U.S. cryptologic systems or activities; > 25X6 – reveal information including foreign government information, that would cause serious harm to relations between the U.S. and a foreign government, or to ongoing diplomatic activities of the U.S; > 25X8 – reveal information that would seriously impair current national security emergency preparedness plans or reveal current vulnerabilities of systems, installations, or infrastructures relating to the national security; This doesn't require a court or tribunal, it just requires the passing rationale of a random pencil pusher in any agency to stonewall the archivist and anyone else.
  - xxpor 6y ago
    And if you do try to bring a FOIA lawsuit, the government just says the magic words "national security" and the whole thing gets thrown out.

vmception 6y ago

Props to Zug and Leichtenstein for being the best vassal states known to man!

sm4rk0 6y ago
What makes them better vassal states than any of the EU/NATO and the rest of the democratic™ first world countries? They were/are just doing what Uncle Sam says because "You're with us or you're against us." I'd say they deserve the "best hypocrite" award.
- sm4rk0 6y ago
  My attitude is sponsored by NATO bombing of my country (Serbia).
  - vmception 6y ago
    I understand what you are saying, but if you really want to know I can draw a distinction. So Leichtenstein is not in NATO, or the EU, while being geographically surrounded and it uses this flexibility opportunistically. It functions more-so as a vassal state of Switzerland, as it is not Switzerland either nor bound by its constitution or direct democracy, while using its currency directly via the Swiss Central Bank instead of the Euro. Leichtenstein lawyers arranged for the purchase and management of Crypto AG shares, this is no accident, and the entrepreneurs in Leichtenstein (the lawyers and many other services providers there) are willing participants in this geopolitical financial game. Zug is nice because of the general optimization towards science and technologies. Cantons in Switzerland enjoy a high degree of autonomy and decision making while being relatively sparsly unpopulated. So getting something approved really means the agreement of the 2 people acting as regulator in a town of 100,000 people, and inheriting the brand and sovereignty of Switzerland. It is great for business, practically unparalleled.
    - sm4rk0 6y ago
      Thanks for the explanation. That shed a different light on those two vassal "states".

bromquinn 6y ago

Serious question. How does one know that any secure communications provider is secure? I use tools like Signal and protonmail, but this article has me thinking that those might as well be government ops. Presumably the governments who purchased systems from Crypto AG had people educated in security do some due diligence on Crypto AG's products before purchasing them. If they didn't realize that the products were compromised by the US, what chance do I have?

fsflover 6y ago
> How does one know that any secure communications provider is secure? I use tools like Signal and protonmail, but this article has me thinking that those might as well be government ops. We need independent crowdfunded external audits for that like the one performed for TrueCrypt.
- DSingularity 6y ago
  TrueCrypt Rest In Peace.
  - fsflover 6y ago
    Actually AFAIK it still works fine except privilege escalations (which do not concern users caring about security and using Qubes OS).
    - edm0nd 6y ago
      VeraCrypt is what most moved to iirc. I still actually wonder what actually happened to TrueCrypt. Did a dev get threatened with a NSA or FBI NSL? Did they get asked to implant a bug so they shut it down instead? So many questions.
      - RcouF1uZ4gsC 6y ago
        Conspiracy theory me says it was the NSA. From their home page warning. > WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues. The phrase “not secure as” is interesting as the first letter spell out NSA.

rjsw 6y ago

Someone had written [1] about breaking a Hagelin crypto machine in 1975. [1] https://www.bell-labs.com/usr/dmr/www/crypt.html https://www.bell-labs.com/usr/dmr/www/crypt.html EDIT: changed the date to that of when it was done rather than that of the document.

BlueTemplar 6y ago

Now consider what this suggests about Intel processors (IME) and GAFAM's software (including Raspberry Pi's firmware, ThreadX ?). In completely unrelated news, OVH, Europe's biggest hosting provider, has announced a new partnership : OVH is going to use Google's closed(?) source software, Anthos, for its "Hosted Private Cloud" offering.

fedreserved 6y ago
https://youtu.be/8ZNjUiP0p6I https://youtu.be/8ZNjUiP0p6I Video by Brendan O'Connell showing how Intel is infiltrated and compromised. He would be considered fringe, but there's plenty of info to be gleamed. Don't shoot the messenger
- pc86 6y ago
  First image is literally dramatic music, a menorah, Netanyahu, and flames. How can anyone take this guy seriously?
  - throw0101a 6y ago
    > How can anyone take this guy seriously? In the timeline where flat earthers hold annual conventions, why are you surprised?
  - BuildTheRobots 6y ago
    FYI, the menorah is actually the Mossad logo, though it doesn't change the point you're making. I've not watched the video yet, but as it's entitled "How Russia and Israel Destroyed the Intel Corporation" I'm not sure what else I'd be using as an intro graphic. edit: Having watched about 10min of the video please don't take my defence of the title screen as defence of the contents of the video.
    - pc86 6y ago
      Thanks, I didn't realize that! I'm not sure why that seems "better" (but still pretty bad).

neonate 6y ago

https://archive.is/S1qzE https://archive.is/S1qzE

xhkkffbf 6y ago

It's worth remembering that it was the Baltimore Sun that first reported this back in 1995. https://www.baltimoresun.com/news/bs-xpm-1995-12-10-1995344001-story.html https://www.baltimoresun.com/news/bs-xpm-1995-12-10-19953440...

beloch 6y ago

Perhaps the reason the U.S. is pushing its allies to ban Huawei from 5G networks is because of their own past (and possibly current) experiences using puppet corporations for spying.

vinay427 6y ago
I would suspect the EU to be complicit, not a victim, considering their companies (e.g. Ericsson and Nokia) stand to benefit as the US-proposed alternatives.

partiallypro 6y ago

All thing aside, the final graph describes how the company was bought from the CIA by an entrepreneur...except he didn't know it was CIA owned at the time and now that company he bought is probably effectively worthless. That sucks pretty bad.

jeffrallen 6y ago
That Crypto AG had sold vulnerable machines was not a secret when he bought it. He either didn't want to know, or was so stupendously bad at due diligence that he didn't find out what anyone with 15 years history on cryptography could have told him. Either way, I'm not crying for him. But the revocation of unrelated export licences this year by Switzerland out of embarrassment was deemed illegal, and that really is too bad. Bern killed a company, and cost Zug 80 jobs. Not cool.
- anthony_r 6y ago
  You think that losing 80 jobs is really the biggest problem here?
  - LanceH 6y ago
    To 80 people and their families, yes. And to many others who are concerned they may be next. Repeat this enough times and you have a large contingent voting for the other guy, regardless of how awful he may seem.
- 082349872349872 6y ago
  Crypto AG probably cost Zug much more than 80 net present jobs in reputation damage.

demosito666 6y ago

The thing that stands out in the article for me is that it wasn't such a well hidden secret after all. From the article I got the impression that an interested party could actually know that devices were rigged and pour disinformation into the channel. From the main article [1]: > The engineer, Peter Frutiger, had long suspected Crypto was collaborating with German intelligence. He had made multiple trips to Damascus to address complaints about their Crypto products and apparently, without authority from headquarters, had fixed their vulnerabilities. > Frutiger “had figured out the Minerva secret and it was not safe with him,” according to the CIA history. Even so, the agency was livid with Wagner for firing Frutiger rather than finding a way to keep him quiet on the company payroll. Frutiger declined to comment for this story. So not only Syrian customers discovered the vulnerabilities and complained about them, they actually got them fixed and then the engineer was fired for that, so things likely got ugly. Possessing the knowledge about a compromised system that you know was sold to dozens of governments, is itself a valuable diplomatic asset. I have hard time imagining it was never acted upon by no one. Which makes me think that the customer who'd actually done his homework could discover a lot of suspicious stuff. [1] https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/?itid=lk_interstitial_manual_5 https://www.washingtonpost.com/graphics/2020/world/national-...

neilv 6y ago
> > Frutiger “had figured out the Minerva secret and it was not safe with him,” according to the CIA history. Even so, the agency was livid with Wagner for firing Frutiger rather than finding a way to keep him quiet on the company payroll. And, at that point, Frutiger might've suspected what kind of perceived liability he might be, and been terrified. :(
dingaling 6y ago
Crypto AG was selling knowingly-weak products for decades in conjunction with US and UK agencies. Post-war they commercially sold an Enigma variant, C-52, with documented vulnerabilities to nations that were considered to be 'of interest'. Cracking their encrypted messages was trivial. Meanwhile, trusted nations were allowed to buy the otherwise secret and secure CX-52. Rumours of this arrangement surfaced in the 1970s and again in the 1990s. Why anyone still bought from them is a mystery.

wdb 6y ago

This sounds similar to the PX1000 story: https://www.cryptomuseum.com/crypto/philips/px1000/nsa.htm https://www.cryptomuseum.com/crypto/philips/px1000/nsa.htm and https://www.vpro.nl/argos/lees/nieuws/2020/cryptoleaks-in-the-netherlands-former-philips-top-cryptographer-admits-to-compromising-encryption-devices.html https://www.vpro.nl/argos/lees/nieuws/2020/cryptoleaks-in-th... PX-1000 was a handheld message terminal, also known as a pocket telex, developed in 1980 by Text Lite in Amsterdam (Netherlands) and sold worldwide by Philips and others. Some versions of it had built-in encryption capability. In the initial version, the DES algorithm was used, but this was later replaced by another algorithm at the request of the US National Security Agency (NSA).

ThePowerOfFuet 6y ago

https://archive.vn/S1qzE https://archive.vn/S1qzE

sebmellen 6y ago

I lived in Zug, Switzerland, also known as the "Crypto Valley", for a while between 2018 and 2019. The investors in my startup are based in Zug, as are many other large conglomerates (Siemens, Johnson & Johnson, Glencore, etc.). My apartment was a short walk away from Crypto AG's headquarters. Zug is a very strange and interesting town, brimming with the sort of energy you'd expect from a little tax haven (also known as the "Cayman Islands of Switzerland"). It's now well known for the cryptocurrency foundations located there, from Ethereum to Tezos to Cardano. Of course, at the time Crypto AG was founded, the Crypto Valley had nothing to do with cryptocurrency, but how interesting that cryptography was a key export since so long ago. To think I lived so close to a covert CIA operation — I had no idea!

us0r 6y ago

I'm guessing its programs like these which make some Senators completely ignore experts on the whole backdoor into encryption thing. They don't know the difference they just see results from the NSA. > Crypto’s international business was purchased by a Swedish entrepreneur, Andreas Linde, who said in an email exchange with The Post earlier this year that he was not aware of the CIA’s ownership when he purchased the assets. Export controls imposed by Swiss authorities in the aftermath of public disclosures about Crypto earlier this year have threatened the company’s survival. If Andreas Linde is not a cover that's pretty fucked up. They couldn't have just run the "business" into the ground?