The NSA Called Me After Midnight and Requested My Source Code

https://medium.com/datadriveninvestor/why-the-nsa-called-me-after-midnight-and-requested-my-source-code-f7076c59ab3d

by imglorp • 8 years ago

140 132 8 years ago

mtgx• 8 years ago

This guy had dubious ethics right from the start by offering most users a free version with weak encryption just so they can pay for the premium version. The export control excuse is bogus as by then DJB had already won the lawsuit against the U.S. government over this issue.

So all in all, I could see it coming that he would be offering the source code on the silver platter to the NSA after reading the first couple of paragraphs from the post.

I also like how he calls that guy a "dumb criminal" for not buying his military-grade encrypted software, as if he hadn't already admitted that he was giving the source code for the full version to the NSA anyway. In other words, he didn't just break the trust of the free users, but also of those paying him to keep their conversations private. This is why I said he had dubious ethics.

jawns2• 8 years ago

I don't see why it's any different than a photo-editing app that applies a watermark to the free version. It's intended to let people give the software a try, and if it seems to meet their needs, they buy the actual product.

As for sharing the source code with the NSA, I think you have a better argument there. That said, it's kind of like helping someone install a secure lock on their door to keep out criminals, yet being willing to share a master key with police if it's a matter of life and death.

web007• 8 years ago

It's not a master key, it's a blueprint of the lock with no combination or exact pin layout.

Mithorium3• 8 years ago

not the master key, the schematics to the lock maybe. Assuming no bugs, I don't see how the source code could help in any way, they may as well have downloaded the source code for openssl.

He also didn't bother to verify whether it was a matter of life or death, he just immediately assumed he was helping break into a file containing the deactivation code for a bomb or something, who knows what the NSA was actually doing.

dabernathy89• 8 years ago

offering most users a free version with weak encryption just so they can pay for the premium version

As long as that wasn't a hidden fact from the users, I don't see the issue.

michaelmrose10• 8 years ago

People are stupid. Seat belts that appeared to work but didn't actually keep you safe would be illegal even if labeled.

imglorp• 8 years ago

Furthermore, if the government calls someone a criminal, their target may well be a dissident, journalist, whistleblower, etc. Things aren's so black and white any more.

SimonPStevens• 8 years ago

Good security isn't based on keeping source code secret. There is plenty of the most secure encryption software that is open source. I don't really see any ethical issue in handing over the source code.

pavritch15• 8 years ago

Exactly. TrueCrypt was the big open source product at the time. A great product used by many hundreds of thousands of people -- I know, because I used to track their progress.

tantalor• 8 years ago

How does access to the source code help?

AdamJacobMuller• 8 years ago

attempting to find bugs (likely cryptographic weaknesses) that will let them crack the encryption faster.

Mithorium3• 8 years ago

I should hope he didn't roll his own encryption, pretty sure openssl existed in 2000, the NSA could have gotten a copy of that easily

a3n• 8 years ago

Looking for bugs. Promising avenues of attack.

djhworld• 8 years ago

the cynic in me thinks they could use the source to plant a backdoor in, then try to manipulate known targets into installing the tampered software under the guise of an update

brohee• 8 years ago

Gives them a few hours headstart over reverse engineering to get the details of the binary format, and most likely, if the application was password based, which KDF was used. Because even if it was indeed 256 bits encryption, a weak KDF was all too common...

In any case, they didn't need the source if their goal was as some say, not to decrypt files a bit faster but to produce a backdoored version.

lucb1e2• 8 years ago

Speed. You can look through disassembled code and find the algorithm in due time, but having the source code could make your job take literally five minutes if all you need is the right parameters (e.g. bcrypt with cost factor 11 as input for DES). Knowing those, and assuming it's reasonably small, you can just fire up your cracking station at that point. If it's too strong, you'll have to look for weaknesses in the code, which is still much faster to do with source code than with assembly.

For backdooring, getting it to compile might take longer than putting the right jumps in and linking the desired dll, depending on how standard the compilation toolchain is and how experienced you are in backdooring.

This is all assuming that they have the program in the first place and not only the encrypted file, though it sounds like they did.

jerkstate• 8 years ago

So, the NSA was able to build and deploy a backdoored version of this software to their targets without the trouble of reverse engineering and modifying it. Nice

lurquer• 8 years ago

All for the cost of a coffee cup.

jbyers• 8 years ago

  "But there’s still one thing that continues to nag me after all these years  -
  how the hell did Dave track me down 3,000 miles away from home after midnight
  on that hot summer’s eve in Bristol, Connecticut?"

Assuming the author flew cross-country from California and his brother had a phone number in the family name, it doesn't seem too hard to piece together with good old fasioned detective work - on top of good old fashioned databases open to the NSA. I wonder if Dave got it right on the first call?

pavritch15• 8 years ago

I'm the author. They found me on the firsts call. I have a unique name - the footprint was there. But, I had 5 relatives in the same town. Nobody else got a call. Were they just lucky?

bigmonads• 8 years ago

This person is either lying or delusional, or got pranked really hard. The "details" provided, while they make great story, simply don't cohere with how the NSA operate.

devoply• 8 years ago

https://www.amazon.com/11-ounce-NSA-NATIONAL-Multi-color/dp/...

In case you need to ever thank anyone for helping you.

flavor8• 8 years ago

I noticed one internally inconsistent detail, although possibly he just mis-remembered. They called him "after midnight" in Connecticut. He called them back, which took less than 10 minutes. After some discussion he calls his employee in Oregon - "by then it was after 4AM on the west coast." Midnight in Connecticut is 9PM on the West Coast, so unless the conversation went on for 7 hours before he called Ron, he's wrong about one or the other of the times.

apple4ever• 8 years ago

18 years is a long time ago, and memories fade and get corrupted even after a short period of time, much less that long (its on reason we have statutes of limitations on most crimes).

dsjoerg• 8 years ago

Care to explain? When the NSA calls me how will I know if it's really them? Do you have anything to share?

iiv• 8 years ago

Hang up and wait for a court order.

jawns2• 8 years ago

I think we can rule out prank, because of the way that the caller had him get back in touch, starting with 411.

Unless the pranker had complete control of his phone and could route dialed numbers to anywhere.

dragontamer5• 8 years ago

I mean, Bethesda is like 20-miles away from where the NSA operates. So straight up, the location is immediately wrong.

A funny thing about people who live in Maryland: the NSA has a big sign that says "NSA" on the highway. We all know where it exists, and there are funny local stories about ignorant criminals taking the wrong road and ending up in the NSA checkpoint. Its a famous local landmark.

http://www.capitalgazette.com/news/ph-ac-cn-carjacking-suspe...

People tell me that you can even drive up and go to a public gift-shop they have out front, by the National Cryptologic Museum (which is run by the NSA). Its literally a public place and they let anyone in to see some cool stuff. https://www.nsa.gov/about/cryptologic-heritage/museum/

----------

The thing is: the guy seems to have been called by Naval Support Activity, Bethesda.

https://www.cnic.navy.mil/regions/ndw/installations/nsa_beth...

This is a "different" NSA, and not "THE NSA" that people talk about.

Whether or not its actually part of protocol: I dunno. But maybe "Naval Support Activity" dudes like to pretend they are "the NSA" as a prank. Or maybe they really are part of national security (I mean, the US Navy is still... technically national security, right?)

---------

In short: my expectation.

1. Naval Support Activity called this guy up to ask for a favor. They misrepresent themselves (but without lying: they are the "NSA" after all) to kinda encourage this guy to do something for them.

2. They feel bad about pranking the dude. So they drive to the Cryptographic Museum and buy him the first "real NSA"-branded gear that they find. Then they ship it to him.

philipodonnell• 8 years ago

He says they sent him a blue NSA mug afterwards and "I’ve had that top secret coffee cup for 18 years now. It’s the same one pictured at the top of this article.". The picture of a blue mug on the post says National Security Agency. Hard to imagine one agency pretending to be another like that. Not sure what to make of it.

amatecha• 8 years ago

The Naval Support base in Bethesda was just the "entry point" to the chain of calls - note he was asked to then ask for a sequence of additional people/lines to get to his eventual contact. Probably those reroutes were to separate facilities, eventually landing at "Dave" with the National Security Agency.

Animats2• 8 years ago

Yes. In 2015, two drugged-out tranny hookers in a stolen SUV went down the employee entrance road. They tried to crash through the gate. They didn't get very far.[1][2]

[1] https://www.nbcnews.com/nightly-news/video/feds-say-nsa-gate... [2] https://abcnews.go.com/US/injured-nsa-headquarters-fort-mead...

jki2753• 8 years ago

I can't imagine what in the world the Naval Support Activity would need the code for that application for. They're literally nothing more than a facilities command.

It is odd that the writer refers to them specifically, they have no connection with the actual NSA of which I'm aware.

Rebelgecko• 8 years ago

I mean, Bethesda is like 20-miles away from where the NSA operates

The NSA exists beyond Ft Meade

_asummers3• 8 years ago

I encourage people to go to the crypto museum if they're in the area! It's really neat with all sorts of old cipher texts, old super computers (original Cray etc), and they have an Enigma machine that you can play with. The tour guides are knowledgeable and it's a worthwhile time.

lucb1e2• 8 years ago

Then why don't you share with us what is wrong about it? It seems a fairly legit way to prove identity (I was thinking about it and the easiest would be to suggest the wrong number as directory services, hoping the person doesn't use DS and doesn't know the number that well, or is to sleepy to notice). Some parts are a little overdone, like, "Was Dave even his real name?" (of course not), but I don't know any better so instead of just making a short remark, why don't you share your wisdom?

dx87• 8 years ago

As others have noted, NSA isn't in Bethesda, and those mugs, along with keychains and tshirts, are available in the gift shop. Also, there's a 0% chance that the NSA would call him up afterwords to let him know that everything worked.

Animats2• 8 years ago

Yes, I wonder about that, too. NSA hasn't been that mysterious about contacting them in decades. Their people have business cards. There was a time when you did something for them and got paid with a check from a furniture store in Maryland. But that was back when the USSR was still a thing. They have a web site now. You can call NSA's main number.[2] The "chain of calls" thing sounds totally fake.

The coffee cup is from the NSA gift shop at the National Cryptologic Museum.

[1] https://www.businessinsider.com/nsa-gift-shop-2016-5#right-a... [2] https://www.nsa.gov/about/contact-us/

lbj2• 8 years ago

My guess is that this is a marketing ploy designed to convey the message that the author's skills are above the NSA's and as such his software should be bought by anyone and everyone interested in great security. Considering the shareware version was 40bit encrypted, I highly doubt the NSA couldn't crack it before making that phonecall.

pavritch15• 8 years ago

All commercial encryption software uses the same public ciphers. Do you really think nearly 20 years after the fact I'm trying to impress anyone? But, they were impressed at the time about my user interface which wrapped the ciphers, and they later had a group visit me in California about some internal uses of that same UX; but nothing came of it in the end.

lbj2• 8 years ago

Yeah that was the impression the blogpost left me with. If I'm in the wrong I apologize but as always I feel that honesty is the best policy.

michaelmrose10• 8 years ago

People use encryption so that their files are secure in situations where failure would be disastrous. Ranging all the way from protecting your credit card number to protecting your sources from being tortured and killed for talking to you.

Offering broken encryption that appears to work is dangerous, unethical, and stupid.

The author ought to be ashamed and people ought to be smarter.

StavrosK4• 8 years ago

Yes, but offering non-broken encryption was illegal at the time.

zelon88• 8 years ago

As the author stated, encryption was export controlled for a long time. The legal fight was very intense. If I recall any encryption stronger than 40 bits needed a license to export outside of the USA until about 2000 or so.

michaelmrose10• 8 years ago

Pretty sure this isn't accurate. I thought the government dropped their lawsuit against PGP in the 90s.

strictnein3• 8 years ago

40 bit encryption in 2000 wasn't seen as bad, it was seen as decent. It would have required a fair amount of computer power to break in a short time.

It was also what was legally exportable at the time.

Providing some security is better than providing none. You lock your doors but have glass windows.

Mithorium3• 8 years ago

Arguably stronger than the locks on most home doors, that could be picked in under a minute

joekrill• 8 years ago

But I don't buy a lock for my front door expecting the manufacturer to simply give the key to anyone that asks nicely for it.

michaelmrose10• 8 years ago

Given moores law the only encryption that has ever been acceptable is that which is impossible to break within any reasonable time frame.

Taking slightly longer for a computer to open your files while I put my feet up and drink coffee doesn't suggest an increased degree of security unless it requires a truly substantial investment in hardware or time. The encryption in question could have been broken on a home computer 4 years later in 2 weeks.

Seen as bad is a poor benchmark it WAS bad.

The legal limitations on crypo export is a bad argument on so many fronts its hard to pick one.

- The legal matter of exporting encryption was well on its way to settled by 2000 see https://en.wikipedia.org/wiki/Bernstein_v._United_States where such restrictions were found to be illegal in 1999.

- Author sold a higher grade of encryption including abroad

- Author either didn't care about the law or would have been afoul of it with his paid version.

- The laws against exporting encryption were a useless farce that never did anything useful

pavritch15• 8 years ago

I'm not ashamed! The product was not broken. As others have correctly pointed out, there were export restrictions for public shareware downloads. The product is still sold and has never been reported to have been broken. The ciphers used are all public domain - that's how people trust them. Nothing about a cipher can be secret.

clubm8• 8 years ago

What a dingus. Maybe there was no emergency, they just wanted your original source to look for imperfections in your implementation. Maybe 256 is secure, that doesn't mean your 256 is secure.

neilk3• 8 years ago

Assume the 411 call is legit, and this really was the NSA. The author has no evidence there was a ticking time bomb scenario underway. Other than the fact that he was called late at night.

Calling him at his parents’ place late at night seems less like a coincidence and more like an ominous demonstration of their power. I know that would influence me, and I’d feel more disposed to cooperate.

I could forgive someone making a rash decision after midnight while traveling. But here it is, some time later, and the author still seems to think it’s a cool story. Nice to know that a maker of privacy software doesn’t think skeptically about the government.

jhall14683• 8 years ago

He gave away the source code, not the master keys to unlock every single version of the software. At best, the source allowed the NSA to derive the binary format used by the files. Whoopie.

tdbgamer2• 8 years ago

Yeah so if there are any vulnerabilities in his software, he just gave them all they need to exploit them...

_asummers3• 8 years ago

Not quite. Not that source code secrecy should be relied on, but the source code not being secret increases the changes of e.g. side channels being discovered that jeopardize all the users of the author's software.

sixstringtheory• 8 years ago

With source in hand, couldn’t they just distribute backdoored copies of said software?

devy• 8 years ago

Also, author didn't mention how his programmer securely transmitted source code to NSA. Did NSA publish their public keys anywhere on Contact Us form?

AnIdiotOnTheNet2• 8 years ago

You have to take into account the temporal setting of the story. 18 years ago is pre-9/11 and all the reveals that happened between then and now.

neilk3• 8 years ago

The 1990s were the era of the cypherpunks, the Clipper chip, and, as the author alludes to, some fairly inane export restrictions on cryptography. This was not some innocent time.

If you want to go further back, there's the Church Committee (which concluded that security agencies were way out of control and had to be reined in).

tdbgamer2• 8 years ago

This article seems like a great argument for using open source encryption software. This guy handed over his source code to the NSA without a warrant or anything? So any idiot that steals your laptop can just call him up and exploit his software to get to your files. Great.

ghewgill• 8 years ago

Looks like weak security is a trend with this software.

You attempted to reach www.safehousesoftware.com, but the server presented a certificate signed using a weak signature algorithm (such as SHA-1). This means that the security credentials that the server presented could have been forged, and the server may not be the server that you expected (you may be communicating with an attacker).

AnIdiotOnTheNet2• 8 years ago

But seriously, this laptop idiot was planning to blow up a building, or something equally as bad, but wasn’t smart enough or flush enough to pop for the $39.99 to step up to the maximum-strength encryption?

Boy, you sure seem confident in your assessment of the severity of the situation. It's not like the NSA would have any idea how to get information out of people by convincing them the situation was something other than what it actually was.

Granted 18 years ago was a much different time than today. It's a shame that these agencies have proven their motives so untrustworthy.

sabarn01• 8 years ago

Lets also assume there is a selection bias. The things the do right with the right intentions you never hear of. Its only when things go wrong do we know.

mtw2• 8 years ago

There's nothing to be proud of and writing a blog post about it.

Your users used the software to protect them, or even paid for it. Now this "Dave" can crack files generated by this shareware. Maybe "Dave" had a genuine national security situation. But was it really? What if Dave just wanted to prank the author, during a boring afternoon? What if it were a couple of guys parked outside who hijacked the phone system, so even if you call 411, it would route to their van outside? Or what if Dave already did the same demand to dozens of other security vendors, effectively having the source code of all encryption software? And even if it was a national security situation, what is the legal basis of giving up source code and keys?

What I get is "I was just a regular computer programmer and overnight, I was actually important enough to be useful for the NSA"

metildaa• 8 years ago

The ethical implications are often not considered by software developers, thus you get cases like this where the author did not stop to push back, acting as a useful idiot for the NSA.

There are way too many people like that in tech, who don't stop to take in the bigger picture before performing the requested action.

Taniwha• 8 years ago

I agree, the first thing he should have asked for is a warrant signed by a judge, and then independently verified it was real.

Latteland• 8 years ago

At the very least there are many circumstances where reporters who were reporting on pretty underhanded activities in the us were targeted by the us govt, and what if this situation happened to them. My govt is generally good here in the us, but we know plenty of cases where they didn't have good intentions, this is done to intimidate. So if you are an author of security software, you might keep this in mind. And other countries like Russia and China would definitely put pressure on people to help them.

StavrosK4• 8 years ago

Let's be a bit more realistic, the title might as well have been "how I open-sourced my encryption software at the request of someone".

Yes, the author was way too quick to give up the source code, but it was just source code, not a backdoor key.

apeace• 8 years ago

The code was not open-sourced. It was only given to one party, and presumably did not come with a license to redistribute the source code.

This means all users of the software are less safe. If the NSA can find a bug in the code, they can unlock everyone's files, but nobody else could ever uncover that bug.

pavritch15• 8 years ago

I'm the author of the article. All common ciphers are available as open source already. I just packaged it into a product. Encryption done right does not suddenly become vulnerable if published to an open forum. I gave up nothing. I did not put any customers at risk, nor did I put my product at risk. People who think otherwise do not really know how encryption works. It works because the ciphers are public and tested by time. And for the record -- I would do it again if asked.

tomatotomato372• 8 years ago

If it was for criminal purposes it would have been easier to bribe a janitor at their office to plug a USB drive into one of their machines for a couple minutes before tossing it.

I'm willing to bet Dave was a government employee, though I won't give up the possiblity he wasn't NSA and more likely some other government organization that needed to stop something yesterday but didn't have the clout to get the big 3 letter organizations to pay attention and help them out

pavritch15• 8 years ago

Yeah, makes sense. And I planned it all out even down to timing the post to hit last night after midnight before all the pipe bomb news this morning on TV. Or, much closer to reality, maybe I just wanted to see if I could write a post that got some traction. Don't overthink it.

hnmonkey2• 8 years ago

This is an incredibly condescending and insensitive post... Why would you attack the completely valid opinion from that person in this way?

bb884• 8 years ago

Please. Save the moral judgement for events that happened after Edward Snowden. This happened 18 years ago. And judging his actions back then through the lens of what the NSA has done in recent history is very unfair.

Fast forward a year to 9/11, and the question would be, "What is the legal basis for not doing everything you can to help the NSA?"

mtw2• 8 years ago

For a 9/11 situation, I would ask that the case should be reviewed by a judge who'd mandate an injunction (or similar) to deliver source code. In a national security situation, I'm sure the judge will work quickly, and you will still get your NSA cup. Everyone's happy.

There are laws and a constitution, you can't just throw it out the window at the first phone call.

ElBarto2• 8 years ago

Notice how he masterfully distilled cool details about his software culminating in the 'low' price, all wrapped in a captivating story?

30 minutes later after he has left and you have closed the door to go back to your chores, you're wondering why you ordered 2 magic-mix blenders...

pavritch15• 8 years ago

The only thing I did masterfully was write a Medium article that got some attention. I didn't even include a link to the old software which hasn't been updated in a decade. It's nothing more than an interesting story about one night nearly 20 years ago. Sorry to disappoint.

ElBarto2• 8 years ago

Can I return the blenders?

bitwize• 8 years ago

I think I know his brother. Given his intellectual interests, especially at the time, I bet the phone call from the NSA is something they still talk about.

pavritch15• 8 years ago

Ha ha. We moved on years ago. Our conversations are now typically about the fact he as way more patents than me. I only have two ;)

strictnein3• 8 years ago

The number of commenters who clearly did not read the story and have completely missed that this story was about the year 2000 is pretty stunning.

Plus the complete lack of understanding of the encryption standards that were legally exportable (which is also mentioned in the story) and seen as good enough is kind of stunning. 40 bit encryption in 2000 was decent. It wasn't great, but it would deter almost anyone.

mc_fish• 8 years ago

I get that we all want to feel like something we are a part of is so important that James Bond-esque stuff happens to us. But, the author of this software did a disservice to his users by immediately rolling over to an, essentially, unknown party. I'm wondering what he would have given up if "Dave" had claimed to be Nigerian nobility.

Though, kudos to "Dave" if this was just a ruse to avoid paying for the $39.99 version.

psychedictic• 8 years ago

God bless you for doing what's right for America.

onemoresoop• 8 years ago

Social engineering at its best.

LiamPa2• 8 years ago

Mitnick?

stef25• 8 years ago

I'm about half way through Ghost in the Wires and this sounds exactly like something he'd do. "Hi, this is so-and-so and I'm with this-and-that. Could you send me a copy of the source code? I'm all over your phone line" The book is a continuous stream of anecdotes like this. Love it.

LiamPa2• 8 years ago

Yep so good and the ‘ring this number to prove I am real’ was a walk in the park for him.

notacoward• 8 years ago

If it were me, I'd be very wary about that coffee cup.

no_identd• 8 years ago

Yepp, throw that thing in an x-ray machine.

alexandernst• 8 years ago

I'm not surprised at all seeing all sort of comments from the people of the ethical sect...

I'd really love to see any of these people in such situation. Or maybe even further, in a situation in which they actually have a tangible proof that "something bad is going to happen".

The NSA Called Me After Midnight and Requested My Source Code

Related Stories