This entry reflects a down-to-earth discussion with security guru Bruce Schneier about how the NSA endangers regular PC users while spying on alleged adversaries.
– Alright, joining me now here on the Matthew Filipowicz show is Bruce Schneier. Bruce is a security technologist and encryption specialist. He’s written for the Guardian, the Economist, Wired and more. He’s the author of 12 books; his latest is Liars and Outliers: Enabling the Trust Society Needs to Survive, all of which and more you can find at schneier.com. You can also find him on Twitter @Schneierblog. Bruce, thank you so much for being on this show today!
– Thanks for having me!
– Alright. So, Bruce, you have been working with the Guardian and have seen many of the documents leaked by Edward Snowden. Last week the Guardian, along with the NY Times, reported on how the NSA has not only been breaking encryption, but also working with technology companies to insert weaknesses that the NSA can exploit. Do us a favor: describe for us in greater detail what the NSA has actually done here when it comes to encryption and why we should all be concerned.
– Sure. When we think of the NSA, we think of spying in general. We imagine them going out and spying on our enemies, right? We like when they do that, when they spy on foreign governments we don’t like or the terrorists or militants, that they’re going out and breaking in their systems and eavesdropping on them. That’s the good part of what the NSA does.
But it turns out what they’re doing in addition is breaking security for everybody, including all of us. So, instead of going to – and I’m making this up – China and eavesdropping on the Chinese systems, they are systematically putting vulnerabilities in commonly used software because the Chinese might use them.
So, for example, you might be using Microsoft Windows – and we don’t know company names here, so I am just making them up for illustration – you might use MS Windows, Windows will include some security features. The NSA tries to break those features for everybody. And they do that not through advanced mathematics, but through cheating.
So they go to software and hardware vendors and get them to insert vulnerabilities not in the software being sold to China, but in all software being sold to everybody. So all the products we buy are potentially tainted. And they do this through several ways: they do this through agreements – asking nicely: “Can you please do this for us?” They do this through threatening: “Play with us nicely or we’ll do these bad things to you”. They do this, we believe, through national security letters: “We forced you to do this and you can’t tell anybody”. And this is probably the most amazing part of the documents: they occasionally do it through moles. The government has secret employees working in companies, in US companies, we think, that are deliberately subverting these systems. And the reason this is so bad is that it breaks the security for everybody, not just for the bad guys. We are all less secure, because the NSA has decided that its mission of eavesdropping is more important than all of our security on the Internet.
– Unbelievable. And you actually wrote that you’ve resisted saying this up till now, you’re saddened by it, but the US has proven to be an unethical steward of the Internet. I mean, you’ve kind of described what that actually means, but so much of our lives are online now; the fact that so much of this is compromised, that every little thing, all of the programs have these weird backdoors that have been forced upon or hiddenly put into these programs. If you’re even a business trying to run in the US, you should be furious about how the NSA is making your business less secure.
– And that’s correct. We all trust the Internet for so many things: for personal things, for business things, our human rights groups trust the Internet, dissidents trust the Internet – everybody trusts the Internet. And to have it systematically weakened for this very narrow espionage purpose is just madness. We’re ok with the NSA going after the bad guys, but leave us alone when you do it.
– Absolutely. So, you’ve written a couple of posts on trying to fix this. And two of them are very, very interesting, one when it comes to engineers themselves, because people who actually built the Internet and built the guts of the Internet and actually did all the coding – talk about what engineers could do, because I know that something you’re working on right now is actually trying to get more engineers to come forward and actually talk about: if they were approached into being told to build some type of backdoor, what should engineers be doing right now?
– Sure. Now, to be said, I believe this is primarily a political problem, that the real solutions are going to be political. The NSA is exceeding its authority; its mission is taking over the rest of the government and they need to be put back. And it’ll only happen through the President, through Congress, through the courts. So those are primarily the challenges against this.
And what I’m talking about is really kind of on the fringes. There’s some stuff the engineers can do, but it really has to be political. I am an engineer and I speak to engineers, and the question we’re going to ask is: “What can we do independently?”And there are several things. The first one is transparency. We need to know which systems are good and which systems are tainted. Presumably, the NSA hasn’t gotten to everything, so there are going to be some secure systems out there. So what I want is stories. People who have been in contact with the NSA, people who have agreed to make changes – I want them to step forward and say what they did. In some cases there will be employer agreements, but in many cases there won’t. These people are not bound by government secrecy agreements, they don’t have clearances; these are just normal programmers and, maybe, managers working in these companies who have been approached by government to add backdoors.
We want to hear their stories. And to that end I’ve heard a few of them. I know two of them were in the process of being published by different reporters. I have two more who have decided at this point they don’t want to come forward, and one more that will but he’s busy right now. I hope to get more.
– Well, I can’t imagine why anyone wouldn’t want to come forward.
– There’s a lot of reasons you wouldn’t want to come forward. You’ll be embarrassed you did it; you don’t want to embarrass your company; you’re afraid of retribution from your peers – there’s a lot of reasons why people would keep this quiet. I’m hoping that their safety in numbers; and the more people that do talk, the more people will talk.
There’s other things we can do as engineers, and in my writings I called the Internet engineering a taskforce – they’re basically geeks that run the Internet. They make the standards that make the Internet work to take up this charge.
And I’m not sure exactly what we can do. But I think, in one case, we have to figure out how to design systems that are resilient to that kind of tampering. So, certain systems are easy to tamper with; closed source systems are easy to tamper with, proprietary systems are easy to tamper with; systems that have random number generators are easy to tamper with. So the question is: what design principles can we come up with that are harder to tamper with? What protocols can we create that are harder to tamper with?
And we, as engineers, can make this a harder problem for the NSA. We can also go into all the existing systems and start looking at them. Let’s find the problems. Again, I’m making this up; I don’t know company names – Microsoft’s Bitlocker. This is Microsoft’s proprietary closed source hard drive encryption program. Were I the NSA, this would be a prime target for me. Is it tainted? We don’t know. But if Microsoft will make the code for that system public, we can now look and we can figure it out.