7 ms·
How the CIA used Crypto AG encryption devices to spy on countries for decades (2020)
- jruohonen 3y agoA brilliant scheme, but the big question probably is why governments trusted such a company? Here the state, which was a customer, started to have suspicions already (or as late as?) in the 1990s. The Swedish FRA never warned.
- kratom_sandwich 3y agoThere is a nice documentary by Swiss Public Broadcaster SRF (in German with English subtitles): "Cryptoleaks – Wie CIA und BND mit Schweizer Hilfe weltweit spionierten | Doku | SRF Dok" - https://www.youtube.com/watch?v=VWImO1Qz4Zo https://www.youtube.com/watch?v=VWImO1Qz4Zo
- acqq 3y agoI see there's a whole playlist: https://www.youtube.com/playlist?list=PLrAvDZ9sYjXaF05SYkTJ3tFG3lRp2D1vU https://www.youtube.com/playlist?list=PLrAvDZ9sYjXaF05SYkTJ3... and the automatic translation seems not bad.
- lonelycompiler 3y agoThis article is from 2020.
- sph 3y ago"For decades, the CIA read the encrypted communications of allies and adversaries." Always the past tense for these articles. What, they don't do that anymore? The CIA used to spy on the world, allies and enemies [, install dictators and foment revolts in third world countries]. It still does, but it used to, too.
- bboygravity 3y agoNow they may be using Signal. The utlimate honeypot.
- lima 3y agoThe whole point of Signal is not having to trust them because the protocol is open source and peer-reviewed.
- thx-2718 3y agoYeah but have you viewed it? I haven't. Also what about iPhone blobs or similar? I'm actually curious here as to what we can & can't prove as to being 'secure'.
- lima 3y agoThere have been a number of third party audits and lots of academic research: https://community.signalusers.org/t/overview-of-third-party-security-audits/13243 https://community.signalusers.org/t/overview-of-third-party-...
- bboygravity 3y agoYeah, but the client and/or server are closed source aren't they? AFAIK Signal server source code nor servers themselves are audited. So that means all bets are off: it's entirely possible to implement a perfect peer reviewed protocol in a client and/or server full of backdoors that entirely bypasses the protocol deliberately?
- LewisVerstappen 3y agoAnd get the US into completely insane, destructive wars. You’d think there would be some punitive action for the 2000s intel that Iraq had WMDs. This “intel” got us into a war that cost trillions of dollars and thousands of lives. Nope, instead the CIA just got more money.
- sph 3y agoWhy punitive action? The CIA is the covert tool through which the USA maintains its global hegemony and reach. No US president in their right mind will ever do anything to reduce the powers of its intelligence agency.
- Consultant32452 3y agoThe CIA understands that it doesn't need the approval or even the funding of any member of the US government to carry out whatever deeds it wants. We have military leadership admitting publicly that they falsified reports to a sitting President to maintain wars and there are no repercussions. The idea that the President has any power to combat any of this is a fantasy.
- BSEdlMMldESB 3y agoI think USA congress is also disabled from acting against them, though it probably costs them a bit more to neuter as there are many more people involved
- Consultant32452 3y agoHypothetically the congress could defund them or even outlaw them, but the CIA could operate solely on the funds of its own illegal operations. And only a fool would think they don't have blackmail files on enough key players.
- jjtheblunt 3y agoMeanwhile it seems that the US economy has historically been the overt tool through which the USA maintains its global hegemony and reach. I mention that because the politicians seem determined to break that trend.
- stelonix 3y ago[flagged]
- woodruffw 3y agoWho is “them”? WaPo?
- stelonix 3y agoIf it were only the WaPo the ones saying things such as the comment I was replying to, then "them" would mean the WaPo. But since every corporate news outlet uses the same wording to make it seem like the CIA was "evil back in the day but it's fine now", in this context, "them" means pretty much every corporate outlet out there. Each one of them who pretends Julian Assange is not a political prisoner by orders of Washington. Each and every one of them who publish stories whose source is "unnamed officials" (aka "trust me bro") and are usually just copying verbatim the government narrative without batting an eye. Since that's all of the big ones, NYT, WaPo, Guardian, even Reuters nowadays; might as well consider "them" all of them who do this kind of propaganda.
- woodruffw 3y agoThis comes off as a screed. There’s a significant difference between media biases and state control: major news outlets in the US tend to have pro-corporate and pro-government views, but this doesn’t make them state affiliated. Proper consumption of biased news sources requires a finer-toothed comb than “pro-government is bad, and therefore is compromised by the government.”
- numair 3y agoThis exchange is pretty funny to anyone who knows the background on the extremely cozy relationship between Katherine Graham and the CIA. It seems that, in our post-truth world, facts have become conspiracies and conspiracies have become facts. Alas.
- cmeacham98 3y agoUnlike HN posters, news organizations are generally expected not to promote unproven allegations as fact. Even if you personally believe the CIA is still engaging in these types of behaviors, the news isn't going to claim that without evidence.
- sennight 3y ago> ..the news isn't going to claim that without evidence. You are joking, right? Or maybe your definition for "evidence" includes circular references, because that is what you get when "the news" is functionally captured but the government/uniparty.
- noman-land 3y agoI always read these like the Mitch Hedburg joke. "I used to do drugs. I still do, but I used to, too."
- WhereIsTheTruth 3y agoIndeed, same with the creation of hypertext, google, facebook and now bitcoin,they did, they still do and they will continue to do, that's part of their defense/offense strategy Funny enough, the countries that spend a lot of effort into building their own stack are the ones designated as enemy, Russia/China for example, did they become immune to that strategy?
- rib3ye 3y agoThat’s the point. These stories are recruiting for ongoing and future programs.
- rjsw 3y agoSome more info on that kind of device here [1]. [1] https://www.bell-labs.com/usr/dmr/www/crypt.html https://www.bell-labs.com/usr/dmr/www/crypt.html
- deleted 3y ago[deleted]
- r721 3y agoDiscussion from 2020: https://news.ycombinator.com/item?id=22297963 https://news.ycombinator.com/item?id=22297963 (343 comments)
- photochemsyn 3y agoNice writeup, this story seems to have gotten limited exposure after being written. Incidentally, these kinds of programs continue to the present: > "In September 2013, The New York Times reported that internal NSA memos leaked by Edward Snowden indicated that the NSA had worked during the standardization process to eventually become the sole editor of the Dual_EC_DRBG standard,[7] and concluded that the Dual_EC_DRBG standard did indeed contain a backdoor for the NSA.[8] As response, NIST stated that "NIST would not deliberately weaken a cryptographic standard."[9] According to the New York Times story, the NSA spends $250 million per year to insert backdoors in software and hardware as part of the Bullrun program." https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG There are also notions that the British government ran a similar program after WWII, distributing Enigma machines to all its colonies/ex-colonies, which was part of the reason they kept the codebreaking work on Enigma secret for decades (until the 1970s). I've never seen a similar expose of that, though.
- dathinab 3y agocough cough .... open source + non special hardware is a solution which soo often could have helped countries in all kind of ways weather it's avoiding back doors or if it's cooping with abandon ware, especially in combination with security gaps best it doesn't even have to be truly open source, the source being open (visible, modifiable, etc.) to you (the state) and anyone you want to pass it to is good enough (But truly open source can have benefits, too. But thats a different topic.)
- AHOHA 3y agoSame goes with current days comms, apps like signal, whatsapp, “”privacy first””, whatever are all should assumed to be honeypots, and I always base my comms around that. The only comms I trust are emails+gpg. P.S. before some schmuck die hard fan for signal start defending it: Why do you think still it NEEDS your phone number and relies on a broken protocol (GSM) to authenticate/ID (or even 2F), a protocol easily accessible especially and quickly by 3 litters agencies? Why during the whatsapp (default app in so many countries made by the company who doesn’t respect your data), why during the down time of WhatsApp, Siganl was shilled so heavily on social media as if it was the only viable way of alternative communication? Do you have access to the server-side of signal any time you want? How do you guarantee that there are no side loaded software at the server level with backdoors, or memory injected, non-persistent backdoors/malware? Even if it was audited, no guarantee it didn’t happen after, so you have to “trust” whoever is running that server. E2EE doesn’t encrypt meta data, contacts data, location, etc. and even that encryption with the physical access to the server side, theoretically can be broken.