Decryption, Public Trust and Civil War

British intelligence office GCHQ is now hiring, with a public call to anyone who can break a series of codes on its Web site: "The Can You Find It? competition is designed to test both experienced and self-taught techies to crack a series of cryptic codes." (Daily Mirror report from 11 September 2013). Image Source: GCHQ via The Daily Mirror. If you crack the codes, the GCHQ promises "You can win 1 of 100 Raspberry Pi or 1 of 5 Google Nexus 7 tablets."

Do not discuss the NSA decryptions, please. There's nothing to see, move along. On 5 September 2013, Matthew Green, Assistant Research Professor in Computer Science (with a specialty in applied cryptography) at Johns Hopkins University, wrote a blog post about a sensational joint report from The Guardian (here) and the NYT (here). These reports claimed that the American National Security Agency and British Government Communications Headquarters (GCHQ) have decrypted a whole spectrum of Web software and communications and monitor them with the Sigint Enabling Project. The NYT remarks that Sigint involves: "industry relationships, clandestine changes to commercial software to weaken encryption, and lobbying for encryption standards it can crack."

This is a huge story, and Mr. Green discussed the large implications of what this means (here) on his blog, A Few Thoughts on Cryptographic Engineering; more curiously, he described how he was interviewed by a reporter from ProPublica about NSA decryptions before the NYT/Guardian story was published. He wondered at the semi-conspiratorial tone of the interview:

Let me tell you the story of my tiny brush with the biggest crypto story of the year.

A few weeks ago I received a call from a reporter at ProPublica, asking me background questions about encryption. Right off the bat I knew this was going to be an odd conversation, since this gentleman seemed convinced that the NSA had vast capabilities to defeat encryption. And not in a 'hey, d'ya think the NSA has vast capabilities to defeat encryption?' kind of way. No, he'd already established th[at] ... . We were just haggling over the details.

Oddness aside it was a fun (if brief) set of conversations, mostly involving hypotheticals. If the NSA could do this, how might they do it? What would the impact be? I admit that at this point one of my biggest concerns was to avoid coming off like a crank. After all, if I got quoted sounding too much like an NSA conspiracy nut, my colleagues would laugh at me. Then I might not get invited to the cool security parties.

All of this is a long way of saying that I was totally unprepared for today's bombshell revelations describing the NSA's efforts to defeat encryption. Not only does the worst possible hypothetical I discussed appear to be true, but it's true on a scale I couldn't even imagine. I'm no longer the crank. I wasn't even close to cranky enough.

And since I never got a chance to see the documents that sourced the NYT/ProPublica story -- and I would give my right arm to see them -- I'm determined to make up for this deficit with sheer speculation. Which is exactly what this blog post will be. ...

If you haven't read the ProPublica/NYT or Guardian stories, you probably should. The TL;DR is that the NSA has been doing some very bad things. At a combined cost of $250 million per year, they include:

1. Tampering with national standards (NIST is specifically mentioned) to promote weak, or otherwise vulnerable cryptography.
2. Influencing standards committees to weaken protocols.
3. Working with hardware and software vendors to weaken encryption and random number generators.
4. Attacking the encryption used by 'the next generation of 4G phones'.
5. Obtaining cleartext access to 'a major internet peer-to-peer voice and text communications system' (Skype?)
6. Identifying and cracking vulnerable keys.
7. Establishing a Human Intelligence division to infiltrate the global telecommunications industry.
8. And worst of all (to me): somehow decrypting SSL connections.

The only catch to Matthew Green's blog post was that, as Pro Publica later noted, Green's employer, Johns Hopkins University

is [a] short drive from the NSA’s headquarters at Fort Meade, works closely with the spy agency ... [and] does many projects with the NSA.

So maybe it should have come as no surprise that Mr. Green posted this tweet on 9 September:

I received a request from my Dean this morning asking me to remove all copies of my NSA blog post from University servers.
— Matthew Green (@matthew_d_green) September 9, 2013

This tweet provoked a storm of protest on Twitter. The Chronicle of Higher Education, which follows what is going on in academia, decided to chase down the Dean, Dr. Andrew Douglas. The Chronicle intended to ask him why an encryption expert was not permitted to blog about NSA-related reports in the papers.

The university provided an excuse about Green's use of the copyrighted NSA logo (a Chronicle reader scoffs: "NSA is a government agency funded by taxes, it is in the public domain. One can use it freely as long as it is not used fraudulently."). Plus, they cited security issues, despite the fact that Green linked to documents (see them below) which had already been made public; in the end, Green was allowed to restore the blog post and to discuss the decryptions because newspapers had already published the information. From the Chronicle report:

The tweet immediately drew responses from Mr. Green’s followers, some of whom were surprised and disappointed by what they assumed to be an act of censorship.

“Isn’t the point of being in the academic setting, so that you have an institution to stand behind you?” wrote one respondent.

“WHAT. THE. F***!” wrote another. “So how much higher than the dean does it go?”

Mr. Green responded to say that the post was still online; the dean had simply banished a “mirror” copy that had resided on a university server. “And no,” he added, “this isn’t my Dean’s fault.”

Then whose fault was it? his followers responded en masse. At this point, Mr. Green’s account went silent.

Meanwhile, The Chronicle’s attempt to interview the dean—Andrew Douglas, interim dean of the engineering school at Johns Hopkins—was interrupted and hastily shut down by a member of the university’s communications team. The research professor did not respond to several e-mails.

Perhaps the professor had been spirited off the grid and placed in thumbscrews? And if so, was it the NSA or Johns Hopkins communications officers who had descended in black helicopters?

Several hours later, The Chronicle received a statement from a different member of the university’s public-relations team, Dennis O’Shea.

“The university received information this morning that Matthew Green’s blog contained a link or links to classified material and also used the NSA logo. For that reason, we asked Professor Green to remove the Johns Hopkins-hosted mirror site for his blog,” said the statement.

“Upon further review,” it continued, “we note that the NSA logo has been removed and that he appears to link to material that has been published in the news media. Interim Dean Andrew Douglas will inform Professor Green that the mirror site may be restored.”

Who complained about the logo and the links? Mr. O’Shea said that he was looking into it, but that it was definitely not the federal government. Why did the university respond so credulously to the bogus claims about the “classified” links? Not sure. May The Chronicle ask the dean? No.

Eventually, Mr. Green—or perhaps a person writing in his likeness—did emerge on Twitter to elaborate on what had happened. The complaint allegedly had come from someone at the university’s Applied Physics Laboratory, Mr. Green wrote. (Mr. O’Shea would not confirm this.)

See related reports on this story: here, here, here, here, here, here, here, here, here, here and here.

The above three images are from the NYT: "This excerpt from the N.S.A.’s 2013 budget request outlines the ways in which the agency circumvents the encryption protection of everyday Internet communications."

The origin of this information is the Gen Y whistle blower and former NSA contractor, Edward Snowden. Snowden leaked information on the American and British Web spying programs, respectively codenamed Bullrun and Edgehill. From the IB Times:

The NSA’s decryption program [which is one decade old] was named "Bullrun" after the major [1861] battle in the American Civil War, while the British program was named "Edgehill" after a [1642] battle in the English Civil War. According to the documents leaked by Snowden, Bullrun aims to “defeat the encryption used in specific network communication technologies.” Similarly, Edgehill aimed to decrypt the four major Internet communication companies: Hotmail, Google, Yahoo and Facebook.

Edgehill decrypts information held by some 30 Virtual Private Networks (VPNs) and "GCHQ hopes that by 2015 Edgehill will have decrypted 15 major Internet companies and 300 VPNs." Edgehill also recruited employees in tech companies to act as GCHQ agents and intelligence sources.

Is this all about security and terrorism? Not exactly. The NSA and GCHQ view the public as a source of trouble:

GCHQ knew that the program would damage the public’s trust, and stated that [common knowledge of its activities] it would “raise public awareness, generating unwelcome publicity for us and our political masters ... ."

Thus, the IB Times observes that both surveillance programs are named after battles in the English and American Civil Wars. These choices are ill-omened and betray an unfortunate mindset. The NSA regards members of the public as 'adversaries':

One document leaked by Snowden describes why consumers shouldn’t be aware of backdoor vulnerabilities made to products. “To the consumer and other adversaries, however, the systems’ security remains intact.” Grouping citizens with adversaries indicates how these surveillance agencies view their role in society. It also sheds a bit of light on why both countries named their programs after Civil War battles. 

As I pointed out in my post on the repercussions of 9/11, the destruction of trust in the government goes hand in hand with an erosion of values, a loss of agreement on the common good, all amid growing worries over security. Terror is a tool which makes it impossible to perceive the truth.

The murkiness doesn't stop there. Snowden's critics accuse him of being a double agent for the Russians or Chinese. Snowden's leaks certainly benefited the Russians and the Chinese, among others, who are no standard bearers of human rights. And these were the first countries from which he sought asylum.

Snowden has handed countries which are lousy human violators a PR coup against countries which are lousy human rights defenders. At the same time, Europe has recognized Snowden as a human rights defender. He has just been included among the nominees for the 2013 European Parliament's Sakharov Prize for Freedom of Thought.

I wonder what Andrei Sakharov would say to that. Sakharov was a nuclear physicist "renowned as the designer of the Soviet Union's Third Idea, a codename for Soviet development of thermonuclear weapons." Sakharov also became a human rights activist, who insisted:

Intellectual freedom is essential -- freedom to obtain and distribute information, freedom for open-minded and unfearing debate and freedom from pressure by officialdom and prejudices. Such freedom of thought is the only guarantee against an infection of people by mass myths, which, in the hands of treacherous hypocrites and demagogues, can be transformed into bloody dictatorship.

Sakharov was talking about his experiences in the Soviet Union, where access to information was tightly controlled. What would he see in the extreme opposite system, in which a deluge of free information equally sponsors mass myths, hypocrites, demagogues and dictatorships? Sakharov would undoubtedly disapprove of the NSA and GCHQ spying on private correspondence. But what would he make of Russia using Snowden and the anti-NSA critique to masquerade as a human rights defender, while exploiting the corresponding damage inflicted upon the US and UK to bolster her own anti-human-rights activities?

If Snowden is a double agent, it would mean that he aided the very countries whose authorities effectively oppose the American and British ideals he claims to be defending. Snowden is a classic figure of our times: he can be judged in many different lights. Is he a hero? A traitor? A cynical hypocrite? Or is he a well-meaning cyber-activist playing an impossible system?

Whatever Snowden is, it does not change the fact that, according to his leaks, the American and British governments have compromised their ideals in the name of security. They have married the defense of democratic systems to insidious tendrils of Orwellian scrutiny and control which sink ever deeper into their citizens' private lives. Was this infant surveillance state really the only way to guarantee national security for the world's front line democracies?

Republican Senator Lindsey Graham claimed that Snowden's leaks "probably" got people killed. Wired reveals that Graham may well be correct, given that this point was Snowden's ironic safeguard against CIA plans to assassinate him; this is a so-called 'Dead Man's Switch':

A story in the German publication Der Spieg[e]l ... claims the documents [Snowden leaked] include information “that could endanger the lives of NSA workers,” and an Associated Press ... asserts that they include blueprints for the NSA’s surveillance systems that “would allow somebody who read them to know exactly how the NSA does what it does, which would in turn allow them to evade that surveillance or replicate it.”

But Snowden also reportedly passed encrypted copies of his cache to a number of third parties who have a non-journalistic mission: If Snowden should suffer a mysterious, fatal accident, these parties will find themselves in possession of the decryption key, and they can publish the documents to the world.

“The U.S. government should be on its knees every day begging that nothing happen to Snowden,” Greenwald said in a recent interview with the Argentinean paper La Nacion, that was highlighted in a much-circulated Reuters story, “because if something does happen to him, all the information will be revealed and it could be its worst nightmare.”

In a mere ten years, the Web has become the staging ground for civil war between those who seek to dominate, control and harness the Web for profit, power and exploitation, and those who seek to 'live' on the Internet through communication and the exchange of information. But what do you do when the two become one and the same? What do you do when those who seek to exploit the Web are also some of its most idealistic defenders? What do you do, when you can't tell whether these two opposing camps have overlapped or not?

And what do you do when there is more than one staging ground? Say, there is a staging ground between the NSA (understood in its broadest sense, with all affiliated and subordinated tech interests) and Netizens; but there is also a stand-off between the old, Real Life establishment on the one hand, and emergent, Virtual Reality power systems on the other.

First Battle of Bull Run (1889) by Kurz and Allison. Image Source: Wiki. 

A historical recreation of an English Civil War battle. Image Source: English Historical Fiction Authors.