Why the Latest NSA Leak Is the Scariest of All

The National Security Agency programs revealed on Sept. 5 in three media reports were perhaps the most important revelations yet this summer, and have profound implications for everyone who uses the Internet.

The reports make clear that the NSA and its British counterpart Government Communications Headquarters (GCHQ), have been methodically undermining the vast encryption-based “web of trust” that makes possible secure online financial transactions, communications and other sensitive transmissions.

The spy agencies’ activities have gone on for more than a decade. Like a silent but pervasive cancer, they have penetrated and weakened every corner of the Internet.

“Not only does the worst possible hypothetical … appear to be true,” wrote Johns Hopkins cryptographer Matthew Green on his blog last night, “but it’s true on a scale I couldn’t even imagine.”

“The companies that build and manage our Internet infrastructure, the companies that create and sell us our hardware and software, or the companies that host our data: We can no longer trust them,” wrote American encryption expert Bruce Schneier on the website of the British newspaper The Guardian.

Subterfuge by any means necessary

The surveillance programs, named “Manassas,” “Bullrun” and “Edgehill” after battles in the American and English civil wars, not only built powerful computers to crack encryption protocols.

They also coerced technology companies into handing over encryption keys, infiltrated NSA and GCHQ personnel onto corporate staffs, broke into the computer servers of uncooperative companies to steal information and ensured that some companies built “backdoors” into their technology so that the spy agencies would always have access.

Perhaps most egregiously of all, the NSA and GCHQ deliberately poisoned publicly distributed encryption standards, used by hundreds of millions of people across the world every day, so that the standards would be secretly — but fatally — flawed.

“The (actually substantial) goodwill that NSA built up in the public crypto community over the last two decades was wiped out today,” tweeted University of Pennsylvania cryptography expert Matt Blaze.

See Also

New Instagram-style App Pixelates Faces to Protect Privacy

The implications are that, if they wanted to, the spy agencies could access nearly every Internet-based purchase, money transfer, email, Internet phone call, instant message or file transfer made by anyone, anywhere.

Read more . . .