CIA Director John Brennan Pretends Foreign Cryptography Doesn't Exist

https://www.schneier.com/blog/archives/2016/06/cia_director_jo.html

268 98 10 years ago

chopin3• 10 years ago

As commented somewhere in the Schneier thread:

Presumably Brennan refers to the big players, Apple, Google, Microsoft, Facebook, Intel (ME) et al. These companies are delivering crypto and/or hardware for the masses and could be subverted maybe with small short term effect.

Of course, the terrorists will switch. And Mr. Brennan knows that. This is the revealing part: It's about mass surveillance of people who are not terrorists by any means.

peteretep• 10 years ago

What's the motivation for mass surveillance of people who aren't terrorists in the US?

CapitalistCartr• 10 years ago

Control. Power. Authoritarianism. Corporate paternalism.

div• 10 years ago

Knowledge is power.

yarper2• 10 years ago

They're all terrorists until proven otherwise!

sleepychu• 10 years ago

Perhaps not using the ubiquitous products makes you a terrorist?

It's a tradeoff, if you really believe that the government are motivated solely for your protection then of course you would allow them unlimited access into your personal life (as long as it was invisible to you, via your phone/computer, why would you care? They only use that information to help you. Think Doctor and seeing you naked, you trust that they don't care about seeing you naked, they just want to help you.)

If you're the director of the CIA maybe you really believe that the government having unlimited invasion of privacy is the correct way to keep everyone safe.

Torai• 10 years ago

Identifying the transcendent people and activities that could undermine the status quo the CIA works to defend.

Now we could argue if the CIA works for the well being of the majority of US citizens, or to defend the obscure interests of some minority. And discuss the historical role of the CIA "fighting terrorism".

TheCondor• 10 years ago

Money. It's all subcontracted out. It costs tons to do a full nation the size of the US and it's dramatically cheaper than a foreign nation.

There are also the conspiracy type reasons but I think it's just a jobs program for white upper middle class men.

arca_vorago• 10 years ago

1) Money. As William Binney revealed, they scrapped his multi-million dollar system that protected privacy (I still disagree with him that the collection was constitutional in the first place) for a multi-billion dollar system that wasn't nearly as effective. So in essence, one motivation would be to line the pockets of various entitles around McLean, VA and other good ol boys.

2) Control. This level of surveillance is key in the primary purpose of dissident control. This is why they are harping so much on "lone-wolf radicals" who are "radicalised by the internet". Because they want to say wolf so loud and so much that nobody has the chance to remind them about the constitution. This is also part of why you will see a huge increase in bad legislation written and passed by corrupted good ol boy house/senate. The internet is a threat to the global order due to it's decentralized nature and it's encouragement of anarchistic freedom of thought. The oligarchy are moving against the internet.

3) Fall-guys. The more sinister, grander chessboard for the supranational oligarchs is one of de-legitimizing American power and principles. I'll let you digest the details of this.

Always remember where the Company got it's start. Wall Street international lawyers. I'm pretty sure McCarthy, despite his unconstitutional antics, was actually on to something... but he just didn't aim high-enough in the chain. Corruption in the three-letters is top down.

http://www.maebrussell.com/Prouty/Harry%20Truman%27s%20CIA%2...

ionised• 10 years ago

Control I'm guessing.

If massive financial fraud, corruption and widening inequality continue to get worse, there is going to be a lot of unrest in the western developed nations.

There's only so much shit people can take, so much of their shit that can be taken from them before they realise their entire financial system and wars waged are a giant ponzi scheme set up to suck resources from the many up to the few.

This shit happens in cycles. The upper echelons of society know this is coming again.

RogtamBar2• 10 years ago

You have heard of the concept of 'three felonies a day'.

Well, combine that with knowing almost everything about everybody, and you can use the threat of charges or actually having them charged to deal with dissidents.

I once knew a gun rights' activist in the US. He has friends who were targeted this way by the Federal gov't. It's not just a theoretical thing.

jernfrost• 10 years ago

But these have often bought solutions from foreign companies and integrated them. One example would be Skype. The question is with the kind of regime CIA envisions would Skype ever have gotten bought by Google?

tremon2• 10 years ago

Of course, the terrorists will switch

Not only terrorists will switch. Everyone who has the option will switch. This is just another nail in the coffin for US technology companies.

I'm pretty sure that when this gets through, the non-US companies will be bought en-masse by US companies, like Microsoft did with Skype.

chopin3• 10 years ago

Everyone who has the option will switch

This might be difficult. With iOS, Android or Windows you have to trust the OS Vendor. I assume especially on iOS it might be difficult to supply any meaningful encryption at all if Apple decides to not supporting it.

Hermel• 10 years ago

This is just another nail in the coffin for US technology companies.

What are the other nails in your opinion? To me it seems that the Silicon Valley is doing quite well.

paganel• 10 years ago

the non-US companies will be bought en-masse by US companies, like Microsoft did with Skype.

I'm glad I'm not the only one having that opinion about MS's acquisition of Skype. There's this article from July 2012, after the MS acquisition and before the Snowden leaks: https://www.washingtonpost.com/business/economy/skype-makes-...

The FBI, whose officials have complained to Congress about the “going dark” problem, issued a statement Wednesday night saying it couldn’t comment on a particular company or service but that surveillance of conversations “requires review and approval by a court. It is used only in national security matters and to combat the most serious crimes.”

and most importantly

But changes allowing police surveillance of online chats had been made since late last year, a knowledgeable industry official said Wednesday.

As an anecdote, just wanted to add that I live in an Eastern European country which has started to at least try to put up a fight against endemic corruption, with the help of some Western countries (i.e. the American and the UK ambassadors issuing worrying statements from time to time saying "corruption is bad" and meeting the head of the Anti-Corruption body).

Anyway, in a couple of anti-corruption cases investigated by our local anti-corruption prosecutors there were mentions of the authorities having access to the corrupt people's Skype conversations. Now, our NSA-like structure is no way as powerful as the real NSA, computationally speaking, so I don't see them breaking Skype's built-in encoding all by themselves, unless given that information on a silver plate by our friends from across the Atlantic Ocean. In exchange, we might help them with keeping nasty terrorists locked in an improptu prison, because that's how friends help each other out. (http://www.independent.co.uk/news/world/europe/inside-romani...)

nxzero9• 10 years ago

> "non-US companies will be bought en-masse by US companies"

Sounds like an "exit strategy" - TrueCrypt might even be an example of this.

ikeboy4• 10 years ago

Open source encryption has been available for decades. Yet, whatsapp got a billion users before they enabled end-to-end encryption.

The data shows you're wrong: lack of encryption does not prevent a significant number of people from using a product.

I'm mostly repeating what I said in https://news.ycombinator.com/item?id=10580829. Further down I had several links supporting the claim that even people who have a lot to gain from encryption will often not use it if it's not enabled by default.

cschmidt3• 10 years ago

Schneier made an interesting point at his talk at DEFCON last year. He suggested people use encryption from the big players, rather than more niche crypto products. He said he thought the NSA etc. monitor users of those niche software closely, essentially getting lots of metadata about them. He suggested "hiding" in the mass of other people using big player products.

Maybe the NSA wants terrorists to switch, since it would make them stand out from the crowd, creating a much smaller pool of people (terrorists and crypto geeks) to watch.

saiya-jin• 10 years ago

this sort of hiding sounds a bit like desperate attempt to save a lost battle of credibility of major US IT companies... no, thank you

Johnny5552• 10 years ago

Sounds like the best solution is to use the niche encryption software to encrypt your data, then wrap it up in encryption by the big players, so you keep your everyday activity under wraps, but if they can break the big-player encryption, you have another layer of protection.

nxzero9• 10 years ago

Hard to believe Schneier would say something like that, are you sure that's what he said?

RogtamBar2• 10 years ago

How is Facebook, a company which has probably almost since the start operated as a data collection system for CIA (see http://www.abovetopsecret.com/forum/thread291893/pg1 ) .. in the busienss of providing crypto?

Rathor1• 10 years ago

He is not dumb, he is deliberately lying.

nxzero9• 10 years ago

Always possible that he is dumb and deliberately lying.

alanwatts• 10 years ago

Which one is worse?

mikro2nd• 10 years ago

"Never ascribe to malice that which is adequately explained by stupidity"?

throwaway2048• 10 years ago

you don't become a CIA director while being that ignorant of SIGINT

nolepointer• 10 years ago

Isn't this guy whose AOL account (yep, AOL) was breached?

yarper2• 10 years ago

Interestingly it seems that GPG is originally from Germany [0] (a headline act from the first crypto war, I expect there are many other examples!)

[0] https://en.wikipedia.org/wiki/GNU_Privacy_Guard

rurban• 10 years ago

Practically all public visible encryption had to come from overseas during the crypto wars, because US crypto was not allowed to be exported. So everybody used european or australian crypto, and we still do. gpg, openssl, gnutls, truecrypt, ssleay, ...

nxzero9• 10 years ago

Calling it a "crypto war" is missing the point - and the solution for that matter.

JshWright• 10 years ago

GPG is an implementation of PGP (via the OpenPGP specification). PGP was developed in the US, and was, in many ways, the opening salvo of the "first crypto war".

e12e2• 10 years ago

PGP was also printed in book form and exported (to get around the fact that "software" was considered arms, but books not).

I remember wanting an RSA t-shirt at the time (A t-shirt with the RSA algorithm on it, which is/was considered "munitions" - and not for export).

liw• 10 years ago

SSH is originally from Finland. Unlike GPG, it's not an implementation of a pre-existing spec, so it might make a somewhat better example.

koffiezet• 10 years ago

And AES was developed in Belgium...

Bromskloss• 10 years ago

US companies dominate the international market as far as encryption technologies

When do people turn to "companies" for encryption instead of using publicly available libraries or applications?

lb1lf2• 10 years ago

-Most people(tm) probably couldn't care less and definitely wouldn't be willing to put up with the hassle of making their friends switch from iMessage, Google Talk, Skype, Facebook Messenger or whatever it is called - in order to use an encrypted solution.

If end-to-end crypto is going to become the norm, it needs to be supported by the clients people have chosen to use - not by some obscure (to Joe Q. Average) app.

Brennan obviously knows this - it doesn't matter all that much if .01% of the web population use a client outside US control if the remaining 99.99% do use crippled, US-controlled apps.

Heck, it would probably save them lots of time, as being among the .01% would immediately flag you as a crank, terrorist or both.

nenreme• 10 years ago

E.g. when they use messengers which claim that they are end-to-end encrypted.

golergka• 10 years ago

Well, if he's talking about consumer products, he's absolutely right — Telegram is about the only widely popular non-US consumer product offering encrypted communication I know.

sudocarbon• 10 years ago

Isn't Open Whisper Systems Signal open to foreigners as well?

nxzero9• 10 years ago

Really depends on the requirements for encryption. Unbreakable encryption is easy to do with basic math.

lb1lf2• 10 years ago

Surprisingly tough to get a good implementation of basic math going, though.

It is irrelevant if your cipher is sound and for all intents and purposes unbreakable if you, say, leave the key vulnerable to some side-channel attack.

vaadu• 10 years ago

This is SOP for this administration. If you deny a problem exists it does not exist. The same state of denial exists when they refuse to use the words Islamic terrorists.

0xfeba3• 10 years ago

The limited use of the words Islamic Terrorism is more of Obama walking a tight-rope than denial. It may be futile, but it's not malicious.

Obama and his secretary of state, John Kerry, have said that they don't use terms like "Islamic extremism" or "radical Islam" because they believe doing so would grant undeserved religious legitimacy to terrorist movements such as the Islamic State. Citing Islam as a factor risks framing counterterrorism as a war between the West and Islam, they have said.
"They are not religious leaders -- they're terrorists," Obama said in February. "And we are not at war with Islam. We are at war with people who have perverted Islam."

http://www.nbcnews.com/storyline/orlando-nightclub-massacre/...

mikeyouse• 10 years ago

This hysteria about Obama not saying the correct incantation to defeat terrorism is pretty amusing coming from the anti-PC crowd.. Or don't they realize that forcing someone to say a certain phrase is a perfect mirror image of forcing people to avoid certain phrases?

mwfunk• 10 years ago

It would also grant undeserved legitimacy to those Americans who have never encountered a Muslim in their life who really want to reframe the whole conflict as Islam vs. Christianity, and have convinced themselves that the US stands for Christianity in that conflict. I don't know if this is a failure of the educational system to teach them the actual principles on which the country was founded, or a willful denial of those principles, or just plain willful ignorance, but it's pretty disturbing.

frandroid• 10 years ago

At this point, Brennan knows that there are no consequences to lying to Congress, so why wouldn't he do it?

e12e2• 10 years ago

Really strange. Surely Keccack (SHA-3, among other things) is "foreign" encryption? Although, I suppose it might be a bit theoretical in the sense that no one yet has a product that uses it in a configuration for encryption, rather than just hashing?

I suppose SSH doesn't exist, and isn't from Finland either.

http://keccak.noekeon.org/

CIA Director John Brennan Pretends Foreign Cryptography Doesn't Exist

Related Stories