NSA HAS CORRODED TRUST ESSENTIAL TO SOCIETY

Schneier on Security A blog covering security and security technology. « Friday Squid Blogging: "What Does the Squid Say?" | Main | Report on Syrian Malware » December 23, 2013 NSA Spying: Whom Do You Believe? On Friday, Reuters reported that RSA entered into a secret contract to make DUAL_EC_PRNG the default random number generator in the BSAFE toolkit. DUA_EC_PRNG is now known to have been backdoored by the NSA. Yesterday, RSA denied it: Recent press coverage has asserted that RSA entered into a “secret contract” with the NSA to incorporate a known flawed random number generator into its BSAFE encryption libraries. We categorically deny this allegation. [...] We made the decision to use Dual EC DRBG as the default in BSAFE toolkits in 2004, in the context of an industry-wide effort to develop newer, stronger methods of encryption. At that time, the NSA had a trusted role in the community-wide effort to strengthen, not weaken, encryption. We know from both Mark Klein and Edward Snowden -- and pretty much everything else about the NSA -- that the NSA directly taps the trunk lines of AT&T (and pretty much every other telcom carrier). On Friday, AT&T denied that: In its statement, AT&T sought to push back against the notion that it provides the government with such access. "We do not allow any government agency to connect directly to our network to gather, review or retrieve our customers’ information," said Watts. I've written before about how the NSA has corroded our trust in the Internet and communications technologies. The debates over these companies' statements, and about exactly how they are using and abusing individual words to lie while claiming they are not lying, is a manifestation of that. Me again: This sort of thing can destroy our country. Trust is essential in our society. And if we can't trust either our government or the corporations that have intimate access into so much of our lives, society suffers. Study after study demonstrates the value of living in a high-trust society and the costs of living in a low-trust one. Rebuilding trust is not easy, as anyone who has betrayed or been betrayed by a friend or lover knows, but the path involves transparency, oversight and accountability. Transparency first involves coming clean. Not a little bit at a time, not only when you have to, but complete disclosure about everything. Then it involves continuing disclosure. No more secret rulings by secret courts about secret laws. No more secret programs whose costs and benefits remain hidden. Oversight involves meaningful constraints on the NSA, the FBI and others. This will be a combination of things: a court system that acts as a third-party advocate for the rule of law rather than a rubber-stamp organization, a legislature that understands what these organizations are doing and regularly debates requests for increased power, and vibrant public-sector watchdog groups that analyze and debate the government's actions. Accountability means that those who break the law, lie to Congress or deceive the American people are held accountable. The NSA has gone rogue, and while it's probably not possible to prosecute people for what they did under the enormous veil of secrecy it currently enjoys, we need to make it clear that this behavior will not be tolerated in the future. Accountability also means voting, which means voters need to know what our leaders are doing in our name. This is the only way we can restore trust. A market economy doesn't work unless consumers can make intelligent buying decisions based on accurate product information. That's why we have agencies like the FDA, truth-in-packaging laws and prohibitions against false advertising. We no longer know whom to trust. This is the greatest damage the NSA has done to the Internet, and will be the hardest to fix. EDITED TO ADD (12/23): The requested removal of an NSA employee from an IETF group co-chairmanship is another manifestation of this mistrust. Tags: AT&T, Edward Snowden, encryption, IETF, NSA, privacy, random numbers, RSA, surveillance, trust Posted on December 23, 2013 at 6:26 AM • 67 Comments To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.