Intel subsidiary fined for unlawful export of software that enables encryption

http://www.goodwinprocter.com/Publications/Newsletters/Client-Alert/2014/1015_Software-Companies-Now-on-Notice-That-Encryption-Exports-May-Be-Treated-More-Seriously.aspx

by aburan28 • 12 years ago

314 120 12 years ago

goodwinprocter.com

MattSteelblade• 12 years ago

Correction: "against Wind River Systems, an Intel subsidiary" not Intel.

sillysaurus3• 12 years ago

If this type of thing is interesting to you, here's some lovely historical perspective about government restrictions on crypto: http://www.foia.cia.gov/sites/default/files/DOC_0006231614.p...

In particular, related to this $750k Wind River violation:

Bidzos realized that there was a simple way to skirt the export limitation laws. Both the AECA and the ITAR are US laws, and, as, such, they pertain only to US companies. Bidzos went to Japan and established a Japanese subsidary, Nihon RSA. Nihon RSA qualified as a distinct Japanese company, subject only to Japanese law, and Bidzos was able to do whatever he wanted with his strong encryption technologies. Knowing that his encryption technology was a desired commodity, he shopped it around the Japanese marketplace. He promptly struck a deal to produce encryption chips for Nippon Telephone and Telegraph Corporation.

If the US government continues to fine Wind River, then couldn't they just set up a foreign corporation?

Taek• 12 years ago

That is likely going to be a consequence of these actions. Digital security is a huge industry and is going continue being a huge industry for a long time. US companies are decreasingly in a position to market themselves as genuinely secure companies.

Companies that want to have credibility in the industry are going to need to bring themselves out of the jurisdiction of restrictive laws, or lose business to companies that have set themselves up in more friendly jurisdictions.

rasz_pl• 12 years ago

This is no longer possible with all the international trade agreements.

Lets take for example UK company selling their stuff manufactured in Asia on the Australian market - secret US blacklists still apply:

http://www.eevblog.com/2014/02/24/element-14-holding-orders-...

willk• 12 years ago

It was an Intel subsidiary. The article is not very informative. It appears as if Wind River didn't file for an export permit and the BIS fined the because of it; moreover, they voluntarily disclosed it [0].

[0] http://www.theregister.co.uk/2014/10/17/intel_subsidiary_cry...

the_ancient• 12 years ago

Yes because one should have to file for a permit to export math (or anything else)

LLWM4• 12 years ago

The law says you do. If you want to change that law, fine. But if you choose not to comply, don't complain when you get fined for it.

tptacek9• 12 years ago

Wind River is the vendor behind vxWorks, which is one of the most widely-used embedded operating systems in the world. vxWorks isn't especially common in consumer products (although you can find SOHO-type routers running it) but it's very important in industry, aerospace, manufacturing, RF and telecom, and things like that.

The "sharp departure" Goodwin refers to here is the detente between industry and the USG for the past ~12 years. In the late '90s, crypto export controls were vigorously enforced. When you went to download Netscape, you had to select the US-specific installer to get cryptography that wasn't trivially brute-forced. If you shipped products that included SSL/TLS, or even just MD5, you had forms to fill out.

It seems like there'd need to be a backstory on this Wind River enforcement action. Surely there's quite a bit of crypto code in various vxWorks distributions, but it pales in comparison to the cryptography shipped by Mozilla and the Chromium projects. Maybe the issue is "enabling technology" versus consumer products?

It's also unclear to me whether this is a return to form or the BIS being especially aggressive about deliberate exports to specific countries.

maxerickson3• 12 years ago

The BIS press release seems to narrow the scope a little:

http://www.bis.doc.gov/index.php/component/content/article/1...

It talks about the software in question being on some list and says some of the export recipients in China are on the BIS Entity List.

Edit: "on some list" is a dumb way of saying that they decided some of the software was subject to "Export Administration Regulations".

ganzuul• 12 years ago

Incorrect... You sometimes had to download binaries from a source outside the US. Usually not, since the user was simply expected to click the link for the non-US version.

In cases where the server actually looked at your source IP you could either proxy or just download the binary from a source in Europe. The dev teams were and still are seldom located in the US alone, but distributed all over the world. The authors of encryption packages were often not US citizens, either.

The rest of the world looked at the US policy on encryption with wide-eyed disbelief due to the horrifying ignorance that just had to lie behind it.

psykovsky• 12 years ago

The rest of the world looked at the US policy on encryption with wide-eyed disbelief due to the horrifying ignorance that just had to lie behind it.

http://en.wikipedia.org/wiki/Authoritarianism

tptacek9• 12 years ago

The US is far from the only western country that had laws restricting the use of cryptography, and export rules governing crypto were common throughout Europe as well.

pvg• 12 years ago

It could be that the crypto part is just incidental, the BIS press release doesn't really make much of a fuss about it. They focus on the duration and repeated non-compliant actions.

It sounds almost like they're saying 'if you screw up once or twice up but self-report quickly, we'll send you a sternly worded note but if you tell us you've been violating the regulation for years we're obliged to give you a firm but not too painful slap on the wrist'

perlpimp• 12 years ago

does this mean if I have developed a product based on encryption it is better to incorporate outside of USA? and perhaps register a satelite in US only to import said products?

AlyssaRowan• 12 years ago

It is better to not be in the US as a crypto developer, yes (especially since there are some concerns that CALEA, National Security Letters and other provisions have been used to strongarm people into backdooring crypto products as described in the classified "SIGINT Enabling Project" budget, although so far I have not seen any backdoors that were not put in willingly).

That has pretty much always been true. The crypto export laws are weaker than they used to be back in the PGP days, when PGP 2.6.2 was exported as a book to call the bluff of the whole thing, but they're still there and of some concern (especially if you intend your software to be used by citizens inside oppressive regimes which might be on The Export List).

I don't see why you'd need a 'satellite' to 'import'. There are no import restrictions I'm aware of in the US?

For a brief, non-normative summary of crypto law, please see: http://www.cryptolaw.org/

nathanm412• 12 years ago

This might be an attempt to use existing means to pressure mobile device manufacturers from enabling full device encryption by default. I know the executive branch hasn't been too happy with the latest announcements from Google and Apple.

maxerickson3• 12 years ago

I would speculate they did something closer to providing source code to Chinese defense contractors.

(Which probably doesn't really matter in the scheme things, but it's the sort of thing that will really piss off the U.S. Government)

Someone1234• 12 years ago

How utterly pathetic.

Encryption export restrictions are an absolute joke. I can go read a Wikipedia article right now that heavily details the inner workings of most block ciphers. They're still fining people for exporting anything over 64 bits (which is most things), even if almost every individual let alone government has access to the technological knowledge to reproduce such encryption at home.

Seems like this fine is about them exporting a custom Linux distro' with all the normal encryption libraries still in-place (e.g. 256 AES).

Why do I get the strong sense that this fine isn't really about exporting encryption and is really about Wind River failing to place backdoors into this equipment? Because frankly that makes a lot more sense than what it appears to be on the surface.

Wind River got fined for "something" to do with encryption. Now you can either take the government at their word and assume that that thing is just exporting AES 256 within a standard OS, or maybe consider it a little deeper and wonder if it was punishment for something else Wind River did or didn't do.

api• 12 years ago

Not only that, but anyone in any embargoed country can trivially redirect through a VPS or Tor and bypass any controls.

It's sort of like the war on drugs if pot could be sent electronically. Hilarious security theater...

tptacek9• 12 years ago

If the USG wanted to coerce Wind River into backdooring vxWorks, they have better ways to do it than a newsworthy enforcement action regarding cryptography exports.

Export controls for crypto are stupid and counterproductive, though; I agree with you there.

Kalium2• 12 years ago

The amount in question doesn't make sense for that. Nor does the voluntary disclosure. 750k isn't a scary and punishing fine when you have Intel backing you.

lotsofmangos4• 12 years ago

This could be just meant as a message to other firms. Intel might even be getting the money back through routes like tax breaks and just be playing along.

AnimalMuppet• 12 years ago

I can go read a Wikipedia article right now that heavily details the inner workings of most block ciphers.

Yes, you can. And from that, you can go implement those cyphers. And the NSA is probably OK with that, because it's really hard to implement crypto correctly. If I understand correctly, more crypto systems are broken because of implementation flaws than because of protocol flaws. So if you have to implement it yourself, odds are that you will make a mistake that makes it insecure, especially if you aren't an expert on crypto.

bruce511• 12 years ago

I know this is a common belief, but I'm not completely sure it's true. I mean crypto is an algorithm, and there are reference vectors for most common types, so you can be pretty sure you got the basics right.

Now sure, you need to worry about other things, like the entropy of andomm number generators and so on, but this stuff isn't exactly rocket science.

So does experience help? Sure. And maybe you need to be I the upper quartile to get it right, but programming is programming and yes it's going to take some time and effort, but clearly it's do'able...

Now I'm not recommending you do your own - I'm just not sure I buy the idea that it's impossible for mere mortals to pull it off...

Then again, maybe I'm just an NSA employee wanting to make you think it's safe...

trhway• 12 years ago

And from that, you can go implement those cyphers [...] If I understand correctly, more crypto systems are broken because of implementation flaws than because of protocol flaws.

That is compare with high professional flaw-less implementations with high professional back doors built in like the RSA products.

So if you have to implement it yourself, odds are that you will make a mistake that makes it insecure, especially if you aren't an expert on crypto.

It of course depends on who you're, whether somebody would go to the lengths of custom cracking your custom implementation vs. buying an "off-the-shelf" crack/backdoor if you use off-the-shelf software.

pera2• 12 years ago

is really about Wind River failing to place backdoors into this equipment?

I also felt some bad vibes from this story. There are probably hundreds of US based companies exporting embedded crypto, but how many are exporting to China and Russia a RTOS for the aerospace and defense industries?

tptacek9• 12 years ago

Careful: vxWorks applications to military/industrial work might be what got BIS's attention, but that's not what vxWorks is "for"; it's just a very popular RTOS.

jgwest• 12 years ago

Dude. $750K for Intel. They spend more per day on psychological counseling for their chip geek employees who think they're living in the Matrix. Ain't gonna force them to backdoor nothin'... ain't gonna be punishment either for not doing a backdoor job when they were told nicely to do a nice backdoor job.

Sure, my tinfoil is as good as anybody's... REYNOLDS WRAP HEAVY DUTY... best there is... but this seems to be a clear case of some bureaucrat applying the rules he or she has been given to the case he or she has been given... Nothing else...

marincounty• 12 years ago

I laughed too hard. I'll get down voted?

runeks• 12 years ago

Encryption export restrictions are an absolute joke. I can go read a Wikipedia article right now that heavily details the inner workings of most block ciphers.

You are right. Encryption exports are a joke. Not because of Wikipedia, however, but rather because of open source software.

It's trivial to find instructions on how to build OpenSSL from source, especially for a foreign government with all the power and money they have. This makes the law in question nonsensical in theory and ineffective in practice.

tptacek9• 12 years ago

As a public policy matter, and if I had to guess, these controls have more to do with retarding the flow of any high-end technology to the USG blacklist. The policy goal isn't to prevent organizations on the blacklist from being able to deploy RSA encryption, but rather to prevent them from sourcing technology of any sort from US companies.

Blacklisted organizations can obviously still source RSA, along with whatever platform they want to run it on, but it's presumably more expensive for them to do so.

joe_the_user• 12 years ago

This idiocy also give you the feeling that the Federal government is on such a roll forward that every agency that ever lost a battle on security wants to come back and re-win it.

DenisM4• 12 years ago

Encryption export restrictions are an absolute joke.

I don't think you give BIS & NSA the credit they deserve. Experto crede. The restrictions may serve a useful purpose and if you can't see it, that doesn't mean they are the ones missing the point.

Having myself had to pass the export control for one of my apps, and so having the opportunity to pour over the these regulations in great detail, I came to conclusion that the actual purpose of the crypto export regulation is not to control export of the technology. That sort of restrictions is impossible to implement, as you noted, and it's also quite unnecessary.

The actual purpose of the law is to prevent export of expertise. Implementing a crypto system that would be secure end-to-end is pretty much impossible without being an expert, and even then it's exceptionally hard. The best chances belong to a team of experts with a track record of fruitful collaboration and rich history in a particular area. Unlike bits and pieces of code, cohesive teams of experts are relatively easy to keep track of.

The way this control regime works, is that the entirety of the regulation revolves around two questions: 1) Are you supplying a turn-key end-to-end system to the client? 2) Are you supplying services to setup a complete, tailored system for the client? If the answer is "yes" to either question, that raises the red flag for the BIS/NSA, and they want to see what's going on there. Otherwise it's just a minor bureaucratic hoop to jump through. You are certainly welcome to export bunch of crypto code, and they even have a special open-source exception to the paperwork requirements.

So, you may disagree with the goals of this regulation, but it's certainly not a joke you make it out to be.

jackgavigan• 12 years ago

Whilst the ability to implement secure systems is certainly not commonplace, the United States doesn't have a monopoly on encryption and security expertise.

maratd• 12 years ago

The actual purpose of the law is to prevent export of expertise.

You're both right. It can serve dual purposes.

To prevent the export of expertise AND give the government a convenient stick to smack anyone not doing what they want.

tkinom• 12 years ago

BTW, other countries can and do start to apply the same rules against US companies.

China started to have a lot more rules and regulations regarding to the importation of products with any kind of crypto.

They are becoming bigger IT/Mobile product market than US.

I can see in 2-3 years - as soon as the Chinese home grow Mobile SOC are mature, they will start to require Intel/QComm/Apple to disclose everything they do in the Chip/Software level relate to crypto before any of the next gen product are allowed to be sold in Chinese market.

The choice for AAPL/QComm/Intel will be do what the Chinese government wanted or loss access to 30-50% of customers on principle - like Google did a few years ago.

Perseids3• 12 years ago

1) Are you supplying a turn-key end-to-end system to the client?
So, you may disagree with the goals of this regulation, but it's certainly not a joke you make it out to be.

It remains a joke, when you consider how much really good open source software implementations are in the wild already. Think about the crypto in Debian and OpenBSD, including GPG, LUKS, openvpn, OTR, Open/LibreSSL with their support in Apache, nginx, etc. Even for Android, the best end-to-end encryption software (security-wise, not interface-wise) is open source. Let's face it, we have won this crypto "war" long ago. (This is not to say, we don't have other problems to deal with, regarding the immense power the NSA, etc have.)

And even all sufficiently secure software was closed source, as long as it is reasonably widespread, it will be easy to pirate the software instead of importing it from the US.

2) Are you supplying services to setup a complete, tailored system for the client?

What kind of systems do you have in mind? Afaik, the case referred to in the article does not fall into this category.

discardorama• 12 years ago

1) Are you supplying a turn-key end-to-end system to the client?

Apple's iPhones and their iMessage system are end-to-end systems (or so they claim). How can they do this?

thrush• 12 years ago

What is the justification of this law? Seems arbitrary to me. Another question. Is not providing ample security the same as explicitly granting a backdoor?

peterwwillis• 12 years ago

The justification is we don't help our enemies, even if it doesn't make a difference in the grand scheme.

Edit: looks like one of the countries is our ally... so that's weird. For the rest of them makes sense from a geopolitical standpoint.

stan_rogers• 12 years ago

It can get weird. I remember when the export list was significantly expanded for high-bit crypto (2000? 2001?), and France was still on the no-go list - not because the US prohibited export as such, but because France prohibited import (except through authorized channels). Israel may be in the same camp.

barisser• 12 years ago

US Company Fined for Exporting Math.

We ain't got enough Math in the US to be sending it abroad!

lordbusiness• 12 years ago

"US Company Fined for Exporting Math."

This.

dabockster• 12 years ago

We have enough math, but the bureaucracy keeps us from teaching it effectively.

tzs• 12 years ago

Isn't that like saying someone fined for exporting missiles was fined for "exporting physics", or someone fined for exporting chemical weapons was fined for "exporting chemistry"? If not, how do you distinguish them?

Note: I'm not suggesting that the cryptography export restrictions are useful or make any sense it all. They don't, as far as I can tell. I'm just trying to get some discussion going as to whether reductionist arguments like "exporting math" make sense.

superuser2• 12 years ago

Neither missiles nor chemical weapons are ideas. They are not information; they are tangible.

A better analogy would be someone exporting a piece of paper with the reactions involved in a chemical weapon on it, or the formulas that describe where a missile will land given certain parameters.

djrogers• 12 years ago

Missiles and chemical weapons are physical objects which one can reasonably presume to maintain at least some degree of control over.

Encryption algorithms are math, theory, information. They can be reproduced, copied, and transmitted at-will, for no cost.

If the difference is still non-obvious, google around for instructions to make ricin. Easy to find, and it's not illegal to share that information. Why should it be illegal to share any other data? And how could one reasonably expect to enforce it?

lectrick4• 12 years ago

I like the word "puzzles" instead of "math". Makes it seem even more ridiculous.

lotsofmangos4• 12 years ago

You've already lost the 's'. Any more would be a disaster.

wnevets• 12 years ago

I feel like the title should be updated, a tad misleading IMO.

e40• 12 years ago

Can anyone provide details on what is forbidden to distribute and to where?

maxerickson3• 12 years ago

http://www.bis.doc.gov/index.php/regulations/export-administ...

I guess you have to read it all before you can go back and try to understand part of it (that is, I got a headache looking at a few paragraphs, and don't think I learned anything).

rdtsc• 12 years ago

Could this all be a positive thing if it promotes development of open source libraries and tools ?

Not only that, but I wander how feasible is to create binary APIs for most operating systems and CPU architectures, where you could download, verify (that they were build from a commit id of some know open source implementation), and plug in crypto modules as binaries.

So you buy your software from any vendor, any country. If they implement the use of this API, then get your verified crypto modules and plug them in. Or you build your own in house from source.

I can see how that mechanism would of course be a massive attack target by all kinds of actors, but in theory is that possible? Maybe make it decentralized as much as possible.

billpg• 12 years ago

Sorry, my time machine appears to be on the blink. I appear to be in the 1990s.

revelation• 12 years ago

Seems like they are trying to reignite the crypto wars, what with the FBI talking about mandatory backdoors.

It's just utterly confusing. You would think their reaction to Snowden would be appeasement, not further repression and surveillance. Can't make it too obvious this ain't a democracy.

toyg• 12 years ago

I can actually see their reasoning: "you thought we were being hard on you? So the gloves are off now? Ok, so we'll show you what happens when we really play hard".

cremno• 12 years ago

I'm not sure if it was intended, but using that idiom here looks to me as a clever reference to <blink>.

maerF0x0• 12 years ago

Is it illegal to opensource encryption implementations?

zabcik• 12 years ago

No, however, the export of it is still punishable. The GNU gcrypt tools, for example, are hosted exclusively on European servers for this reason.

http://www.gnu.org/software/libgcrypt/

lectrick4• 12 years ago

What do words like "import," "export," and "country" mean in an Internet context?

jimktrains2• 12 years ago

http://en.wikipedia.org/wiki/Bernstein_v._United_States

jldugger• 12 years ago

What better way to prove that your chips aren't NSA backdoors than to pay a hefty fine to the people you're supposedly in bed with?

sitkack2• 12 years ago

Prove?

makmanalp• 12 years ago

This is exactly what I fear happens when we allow bad laws to stay in a "well it's there but we don't enforce it" state.

Is the way around this to develop crypto systems outside the US?

lucb1e2• 12 years ago

If I remember correctly, someone published a book which contained source code in monospace for PGP so that it would fall under freedom of speech and was allowed to leave the US. But that's from memory, I'm not sure it really did circumvent that law or that it was PGP.

Edit: Ah, AlyssaRowan actually mentions[1] this further down the comment thread:

PGP 2.6.2 was exported as a book to call the bluff of the whole thing

[1] https://news.ycombinator.com/item?id=8552169

rosser• 12 years ago

Yes, it was PGP, and yes, it got around the law. The issue was indeed that exporting it as software made it subject to ITAR, but published as a book, it was considered speech.

The tactic was never tested in court with PGP, but it was upheld in at least one other case I'm aware of, Bernstein v. United States. Thank you yet again, DJB.

LLWM4• 12 years ago

That doesn't prove anything. You can also export a physics textbook without the issues you would run into exporting a nuclear weapon.

DINKDINK• 12 years ago

Laws that aren't actively enforced by the state are solely there exist so that they can be used to persecute undesirables. It creates the illusion of a free society while keeping an implied state of control against the public. The only just act to do is repeal or nullify the law.

mariuolo• 12 years ago

$750,000? That'll show them!

tn13• 12 years ago

All this will eventually amount to American companies losing credibility around the world.

DennisP2• 12 years ago

So if you're a U.S. software developer, perhaps opensource, working on something that uses encryption, how do you stay out of trouble?

Are you ok if you use standard libraries, rather than implementing your own crypto algorithms?

zerpa• 12 years ago

Publicly available encryption source code is exempt from the ECCN[1] according to the License Exception[2], section 740.13(e), provided you notify the BIS. But do read the documents, IANAL. Interestingly, though I'm EU based, but ECCN list is literally the same over here. Have been wading through these documents countless times.

[1] http://www.bis.doc.gov/index.php/forms-documents/doc_downloa...

[2] http://www.bis.doc.gov/index.php/forms-documents/doc_downloa...

yuhong2• 12 years ago

And I think it is fairly easy to "self-classify" many kinds of encryption software, though you may have to file an annual self-classification report.

drderidder• 12 years ago

The damage to the US economy and tech industry caused by this sort of thing seems likely to outweigh any supposed security benefit. Celine's First Law: "National Security is the chief cause of national insecurity." [1] Related stories on HN recently involving Twitter et al [2] are enough to make one wonder how long before some of them relocate overseas.

[1] http://en.wikipedia.org/wiki/Celine%27s_laws#Celine.27s_Firs...

[2] https://news.ycombinator.com/item?id=8422581

DennisP2• 12 years ago

Do we need to go back to Zimmerman's old trick and publish the code in books? What happens if we put the code in non-DRM'd ebooks?

ultramancool3• 12 years ago

Time for DJB and the EFF to bring their old case back?

https://en.wikipedia.org/wiki/Bernstein_v._United_States

"On October 15, 2003, almost nine years after Bernstein first brought the case, the judge dismissed it and asked Bernstein to come back when the government made a "concrete threat"."

This sure sounds like a concrete threat.

tptacek9• 12 years ago

It needs to be a concrete threat to Daniel J. Bernstein.

ultramancool3• 12 years ago

Yeah, you're likely correct. I didn't catch this at first due to my immediate feeling of threat simply for having published a few tools which use high-level cryptography libraries.

learnstats2• 12 years ago

If US tech companies cannot legally offer encryption to international clients then we international clients shouldn't be using US tech companies.

jhallenworld• 12 years ago

The country classifications are interesting https://www.bis.doc.gov/index.php/forms-documents/doc_downlo...

A:1 countries are our friends. E:1 countries are "terrorists". The rest are in between. There is also the list of "Supplement 3" exception countries (friends): see last page of http://www.bis.doc.gov/index.php/forms-documents/doc_downloa...

This charts shows what's allowed if you have crypto in your product: https://www.bis.doc.gov/index.php/forms-documents/doc_view/9...

I assume vxWorks is 5E002 (tools to create non-standard crypto systems), which is banned for D:1 countries. Well there is an exception "‐ 5E002: no D:1 countries (unless HQ'd in Supp. 3)".

demarq• 12 years ago

American tech companies still in america are becoming the unluckiest bunch. Their competitors pay a third of tax, are free from having to answer to the NSA, and generally don't have to put up with cold war nonsense from the likes of the BIS. If it weren't for american talent, many many more companies would make the move.

adventured• 12 years ago

I agree with your comment. There are also a lot more reasons than just talent for why the US tech industry does so well.

It's the largest singular market in the world. A very technologically advanced economy in general. It's a very diverse economy, with the second largest manufacturing sector, the largest agriculture sector, the largest biotech + pharma sectors, as well as the largest space industry and service sectors - which provides for a very diverse tech demand and stimulant. Businesses in the US have very high productivity rates, so they seek out productive gains as a matter of fact, which incubates a higher demand for technology. The US tends to adopt technology rapidly, the culture is mostly accepting of new tech, which plays into that huge market. Businesses can change state locations fairly easily, shifting to jurisdictions that are more friendly in various ways (either for taxes, regulation, weather or talent depending). In the US the tech industry is regulated at a mostly low level, leaving the market free to innovate and change rapidly. There are a lot of other good reasons.

tellor• 12 years ago

So what better software or hardware encryption?

lectrick4• 12 years ago

Is open sourcing the sensitive bits a possible defense against this?

transfire• 12 years ago

Would this include the export of Navajo?

sitkack2• 12 years ago

What do you think the reservations are for?

bigiain• 12 years ago

So vxWorks on the Curiosity Rover is - presumably - exporting strong encryption to Martian terrorists, right?

touseefliaqat• 12 years ago

Few years ago, I was in a team implementing IPSec/IKE protocols for a US based company in Pakistan. Though implemented in Pakistan, that product could not be sold there :)

beatgrass44444• 12 years ago

1 goal: Destroy Mid-size and Small USA business 2 goal: Destroy Software, IoT, embedded software 3 strategy: 2.3.1 Stomp the grass to scare the snake 4 scope: ALL business uses encryption

5 past: destroy short term crypto by brute force 6 present: destroy mid term crypto by Quantum Computing 7 future: destroy long term crypto security aka NTRU

8 open source: sel4 proved secure and safe 9 open source: Post-Quantum Cryptography NTRU 10 open source: secure against D-Wwaavve Goooogle cracking.

11 crime UNnatural: Nature, internet and Cybersecurity 12 crime UNnatural: Big banksters too big to fail. 13 crime UNnatural: Scapegoat the small business software 14 tactic: firing a drone is expensive. 15 tactic: firing malware at Michael Hastings car is easy 16 pretext: Wind River Fined for Encryption Software

17 bibliography 18 --books many titles destruction of middle class USA 19 en.wikipedia.org/wiki/Thirty-Six_Stratagems 20 --[PDF]On the Cryptographic Long Term Security 21 www.scienpress.com/Upload/JAMB/Vol%203_1_1.pdf 22 http://sel4.systems/ 23 http://arxiv.org/abs/1405.2034 24 http://arxiv.org/abs/1410.8317 25 --Insights from the Nature for Cybersecurity 26 --[PDF]Provably Secure LWE Encryption with Smallish Uniform ... 27 eprint.iacr.org/.../164.... 28 https://pqcrypto2014.uwaterloo.ca/.../post-quantu... 29 --[PDF]Making NTRU as Secure as Worst-Case Problems over ... 30 www.iacr.org/.../6632... 31 --Michael Hasting's Car Allegedly hacked? 32 http://www.huffingtonpost.com/2013/06/24/michael-hastings-ca...

Intel subsidiary fined for unlawful export of software that enables encryption

Related Stories