Feeds

US wiretap plan will leave door open for spooks and hackers

Congress should think again

Using blade systems to cut costs and sharpen efficiencies

A top-drawer American cryptography boffin has expressed grave doubts about Bush administration plans to let spooks build wiretapping capabilities into the US comms infrastructure.

Writing in the Washington Post, Susan Landau, distinguished engineer at Sun Labs, described the capabilities sought by the National Security Agency (NSA) as a serious security vulnerability for America.

"Grant the NSA what it wants and within 10 years the United States will be vulnerable to attacks from hackers across the globe, as well as the militaries of China, Russia and other nations," she writes.

The NSA has recently been awarded temporary powers to conduct massive automated wiretapping in the United States without benefit of a warrant from the secret surveillance court, provided that at least one end of the communication is thought to be outside the USA. In order to carry out its analysis, the spook agency needs to be permanently plugged into most of the American comms backbone.

"NSA will need to build massive automatic surveillance capabilities into telephone switches," says Landau.

"Here things get tricky: Once such infrastructure is in place, others could use it... Intercept capabilities are likely to be managed remotely, and vulnerabilities are as likely to be global as local. In simplifying wiretapping for US intelligence, we provide a target for foreign intelligence agencies and possibly rogue hackers."

In the old days, a lot of voice and data went wirelessly - via microwave, line-of-sight, or satellite. The NSA could listen in on foreigners using expensive hardware which nobody else had: Landau says this was safe enough, as nobody could gain access to America's own comms by these means.

Nowadays, however, bulk info goes mainly by fibre, which needs to be physically tapped into. This is occasionally done overseas; certain parts of the US special forces, for instance, are reputed to have specialists who can sneak into a country of interest and place undetectable taps on fibre lines without being noticed. But a lot of foreign comms passes through America - where it can be tapped safely and simply.

To some degree, the NSA must have already put the systems that so worry Landau in place; the NSA's massive automated trawling of voice and data in and out of the USA began not long after 9/11 and is thought to have ceased only in recent months, when a secret-surveillance judge refused to renew a key warrant. That led to the recent change in the law.

Landau's argument isn't about the wrongness or rightness of spooks listening in on any conversation that any American has with a foreigner - or perhaps, at least in some cases, conversations between Americans. She's simply saying the technology itself will open up a backdoor into US communications which could be used by America's enemies.

"In its effort to provide policymakers with immediate intelligence, the NSA forgot the critical information security aspect of its mission: protecting US communications against foreign interception."

When a heavyweight security brain like Landau says that, you have to pay attention.

This isn't just an American issue. The UK intelligence community doesn't have the computer resources to do massive automated surveillance on an NSA scale, but it does wiretap its own people a lot - and in the case of the UK the warrants have always been signed by politicians rather than (relatively) trustworthy judges. Telecoms companies provide official backdoors in the UK and many another country. These too will be vulnerabilities to a greater or lesser degree.

But Landau suggests that constant massive access, potentially over a period of years, has to be a lot worse than relatively limited and targeted taps, and that does sound reasonable. Noted security heavyweight Bruce Schneier - who provides services to our own British Telecom - agrees with her too, saying:

"Last week, Congress gave President Bush new wiretapping powers. I was going to write an essay on the security implications of this, but Susan Landau beat me to it."

Landau recommends that Washington politicos think hard before rubberstamping the blanket wiretap warrant again.

"Lawmakers granted the warrantless wiretapping only for six months," she says. "They need to look carefully before it endangers US national security for the long term."

The full text is here. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.