Schneier on Security

Skeptical • February 25, 2015 4:49 PM

The entire event is fairly remarkable. There are not many, if any, other countries where the head of the nation’s signals intelligence agency voluntarily invites questions, uncensored and unscreened, from a diverse audience that includes highly technically literate civil liberties advocates.

Regardless of whether one agrees at all with Rogers – and it’s perfectly possible to agree with some of what he says but not all of it – it’s striking how willing they are to engage in a public discussion about the issue. That, in itself, is noteworthy and a very good thing.

@Dino: Since major CPU producers are americans, AMD, Intel, Qualcomm, is anyone that naive to believe that these processors don’t have kill switches or full backdoor access hardware code? It’s just practically impossible to check them…

I’m far from naive, and I don’t believe that. And I’ll give you four good reasons.

First, if what you’re talking about existed, you wouldn’t have any need for interdiction. You wouldn’t have a crew painstakingly unsealing packages and then resealing them. That the NSA is doing that kind of thing is a strong indicator that such backdoors don’t exist.

Second, more so than any other form of cooperation between private companies and the government that has come to light, that would very likely be a game over proposition if one of those companies did something like that and the fact were exposed. It’s very hard for me to imagine any of those companies taking that level of risk with their enterprise. Frankly it’s hard for me to imagine the US Government ever even approving such a request.

Third, the US Government has no legal power to force those companies to insert any such backdoors. This would all have to be in the nature of a voluntary action by the company, and there would be a significant number of people who would know about it within the company. Something of this nature would leak fairly quickly. And good luck getting a company’s attorneys to sign off on something like that.

Fourth, as much grief as we give the US Government for doing more cyber offense than cyber defense, the kind of thing you’re talking about would be… it’s very hard to see how the upside risks could ever approach the neighborhood of the downside risks.

And this brings us back to the question Schneier asked at the conference. Why, or how, can Americans products be trusted over other products? The four reasons I’ve given answers the question to some extent. And if we’re just comparing American products to foreign products, then those four reasons suggest additional considerations:

1 – US companies are less closely intertwined with the US Government than are most foreign companies with their respective foreign governments. To the extent US companies lobby the US Government, it’s usually for less regulation and less government control.

2 – The US Government does not conduct commercial espionage. A foreign firm can do research without any fear that the US Government will be taking the fruit of its labors and handing it to a US company. That is emphatically not the case with most other governments around the world.

3 – The US Government is far more restricted in what it can do on US soil than in what it can do outside of US jurisdiction. Within the United States, companies and products enjoy the full panoply of US legal protections. Outside the United States, they do not.

4 – If you’re a foreign company or individual, you have much more to fear from your own government than you do the US Government (unless you’re doing something like plotting attacks against the US or its allies on behalf of a violent non-state actor in a place where you can’t easily be arrested – in which case the expected value of your lifespan is somewhat shorter than average). The US Government isn’t going to hand off your research efforts to the guys at your competitor who have closer ties to the party currently controlling parliament than you do.

The US has one of the most open, self-critical, innovative societies on earth. You should buy any product from the US with the same wariness as a customer that you would buy a product from anywhere. But from a privacy and intellectual property vantage, if everything else were equal (that is, that we’re comparing products of similar grade and quality), I’d be more confident in a US product than in one from outside the US, though for certain countries the difference may be too minimal to ever show an effect on my purchasing decisions.

😉 And hey, if there are any backdoors, odds are they’re better made than those you’d find from most companies elsewhere. At the very least there will have been more attempts to find them, and thus greater likelihood that they would be or would become known.

Skeptical • February 26, 2015 7:07 AM

@Nick: Now, saying things like 2 and 3 are why people think you’re paid to deceive. You’ve seen the documents on this blog that said the opposite and yet you reiterate those points speculatively. (first set) You’ve seen on this blog leaks showing companies taking large bribes to work with NSA.

No, we’ve seen that RSA was paid a sum to create a product that, among other things, included a certain algorithm as a default in the API (while documenting the existence of alternatives to that default – and most apparently used the alternatives). It’s never been shown that the money was given to put in place a compromised algorithm.

Far as compelling, two different documents at the TS/ECI level say FBI compells U.S. companies to backdoor products to support FISA and SIGINT activities. Those were also in SAP’s where most people with TS clearance can’t even know they exist. NSA/CIA are also allowed to lie about SAP activities to protect secrecy. So we know they do it but not many specifics.

The documents note that the FBI compels cooperation from companies. That means subpoenas, warrants, and NSLs, none of which could be used to force Intel or AMD to install backdoors into their chips.

That leaks show FBI is compelling backdoors

Nick, the commenter asked how we can trust chips made by Intel and AMD – not whether you should trust that your communications aren’t subject to lawful intercept. The FBI can and does compel companies to hand over information and to provide wiretaps. But the FBI cannot compel Intel or AMD to insert backdoors into their products.

and they’re still doing interdictions has obvious implication: they don’t have them all.

Which makes ridiculous the claim that the FBI can compel Intel or AMD to insert backdoors. If the US Government had that power, Cisco routers would certainly not require interdiction.

@Wesley: Everyone who’s ever read even the shortest history of that conflict knows that the CIA were caught with their trousers down by the Tet Offensive, which then surely must mark their greatest success in HUMINT to date.

That certainly proves your point. Just like the 1973 Arab-Israeli War “proves” that the Israelis are also incompetent at HUMINT.

Or maybe it’s just a bit ridiculous to deduce the competence of a nation’s intelligence services based on the existence of a surprise attack nearly half a century ago?

Skeptical • February 28, 2015 2:59 PM

@Clive: “Collect it all” does not require “active surveillance” passive surveillance will be just as effective.

Yes. My point is that backdoors in every chip and device – to the extent we’re referring to backdoors that would require active surveillance to exploit – would not fit into what “collect it all” refers to.

Your point that there could be “backdoors” that enable decryption of what is sent from a device, where what is sent can be collected passively and then decrypted, is indeed a fair point (and I appreciate the illustration you provided in your comment). But at least insofar as implanting such a type of “backdoor” in all chips and devices, it would be completely impractical and for a substantial subset of chips and devices not provide much payoff. And even here I might quibble as to the extent to which this is truly passive (inasmuch as the expected operation of a component or machine has been deliberately altered, there are elements to this that would likely fall into the active category – but neither category seems very precise).

In any event, this is a quite minor point compared to the other points to consider as to whether the Universal Backdoor Theory is plausible, which I don’t think it is.

Skeptical • March 2, 2015 10:10 AM

@Dirk: Make that “no existing legal mechanism we know of”. Before Snowden, the public didn’t know about the secret interpretations of PA 215 and FISA 702. Even in Congress, there seemed to be quite some folks completely unaware of it.

For many laws, as applied to particular circumstances, one may not be completely certain as to how a court will rule on the question of its application. There’s a zone of uncertainty that exists, the size of which varies depending upon how a law is written and upon how frequently the question has come before courts before and upon how well the courts have answered the question.

The telephony metadata program falls into that zone. I can understand the rationale of the court for issuing orders enabling it; and I would equally understand the rationale of a court for NOT issuing orders enabling it.

But that doesn’t mean that suddenly everything is possible. Hey, do I have to pay my taxes next year? Maybe not – maybe there’s some secret rule or law that exempts… No, there isn’t. No, there is no reasonable interpretation of a law that would allow you to do so.

So what about the government forcing manufacturers like Intel and AMD to insert backdoors? There’s no law under which a court would be able to issue such an order. Period. There is no zone of uncertainty around any law in which such a power could exist. And the attorneys – both in-house and outside counsel – used by these companies are as high-powered as they come. Try to legally compel Intel to insert a backdoor into all of its products? Their lawyers would go to war, and they’d win.

What I could see is Intel cooperating in very specific cases of high importance – but these would be cases we would all likely agree with. And the cooperation would be voluntary.

Listen, I’m not the least bit naive about American law or the American legal system. It has a lot of warts, and elements of it are unnecessarily inefficient and, in the case of criminal justice, unnecessarily brutal. I can list dozens of ways it can be improved. But if my only question were whether a national government can legally compel a manufacturer to insert backdoors, I would very comfortably buy a product manufactured in the United States over one manufactured anywhere else.

Indeed, quite frankly if security were my main concern, and I was not conducting a criminal enterprise or a foreign intelligence operation, and I was operating within the United States, then assuming two products to be equivalent on a technical level, I would take the American product every time.

And by the way – I would fully expect, over the next 10 years, a massive increase in security for all companies operating within the United States. I expect the USG to take much broader responsibility for shielding the private sector from foreign attacks. Sony was the wakeup call for much of the private sector that Titanium Rain may have been for defense and government contractors.

So long as this is done with appropriate privacy protections included, this would be a very good thing for industry everywhere.

We’re actually in a very strange state of affairs right now. On the one hand, there’s a lot of noise and effort directed at trying to restrict the USG in certain ways. On the other hand, there’s increasing effort directed at trying to get the USG to take broader responsibility for cyber-security. There’s nothing inconsistent about this – one may want the USG to stop the telephony metadata program while also more aggressively preventing, deterring, and if necessary actively disabling, foreign intrusions and attacks.

In some ways the advocates of “reining in” the NSA have it wrong. You don’t want to rein them in, and you don’t want to diminish their funding. Instead you want them to increase their efforts in some areas (which will likely require much more funding) and stop certain other programs (which are unlikely to cost that much).