WingNews logo WingNews GitHub [2]
top | item 22500231

Uncovering the CIA's Crypto AG operation

195 points| zengid | 6 years ago |npr.org | reply

91 comments

order
[+] saagarjha|6 years ago|reply
> The Iranian government then arrested Crypto AG's top salesman, Hans Buehler, in March 1992 in Tehran. It accused Buehler of leaking their encryption codes to Western intelligence. Buehler was interrogated for nine months but, being completely unaware of any flaw in the machines, was released in January 1993 after Crypto AG posted bail of $1m to Iran. Soon after Buehler's release Crypto AG dismissed him and sought to recover the $1m bail money from him personally.

Sounds like a great employer. Knowingly sells backdoored equipment to foreign governments, allows their employees to be arrested and held for nine months even though they know nothing about it, pays the bail, then immediately fires them and tries to recoup the bail.

[+] pjc50|6 years ago|reply
See the Matrix-Churchill fiasco, whereby:

- UK government secretly changes its own rules on arms to Iraq

- encourages a company to ship such weapons to Iraq

- they get caught by UK Customs

- this gets all the way to the trial and potential jailing of the directors

- UK government (in particular, Kenneth Clarke) directs suppression of vital evidence through "Public Interest Immunity Certificates"

- Judge refuses to go along with the coverup and jail innocent people, and the whole thing blows up in the newspapers.

https://www.independent.co.uk/news/uk/scott-report-the-essen...

[+] gregoryl|6 years ago|reply
Given it was run by the CIA, possibly something more going on behind the scenes there.
[+] classified|6 years ago|reply
The takeaway is to never get involved with those fuckers. Spies are cool in James Bond stories but not in read life.
[+] chiefalchemist|6 years ago|reply
> Sounds like a great employer

The employer was US Intelligence anencies. That is how they operate. The ends justifies the means. Collateral damage, be it physical, emotional, personal or professional is seen as part of the role.

I'm not saying I agree. But it's important to point out how skewed (usually mistakenly) most ppl's perception is of those three-letter outfits.

[+] strangerw|6 years ago|reply
Shows how much you can rely on spies to value their relationships. Just fraudsters. All talk, but unreliable. No wonder the profession attracts so many deceptive sociopaths. Optimizing for people who won't have your back is a "virtue" apparently...Can't even take care of their own. Pathetic.
[+] notlukesky|6 years ago|reply
This is a real old story. Was fleshed out in German and Swiss media in 1994:

https://en.m.wikipedia.org/wiki/Crypto_AG

And there were many suspicions going even back to a “tell all” by Ronald Reagan

[+] schoen|6 years ago|reply
I thought so too, at first, but the new information is not just that some Crypto AG products were somehow compromised for some customers (widely reported since the 1990s), but that the company was literally owned by the BND and CIA. Not in a metaphorical sense of owned.
[+] refurb|6 years ago|reply
How come I've never heard of this???

It also makes sense why the US is banning Huawei equipment. If the US can do it, why can't the Chinese?

[+] wahern|6 years ago|reply
One answer is that you don't need to manufacture custom equipment with escrowed keys to infiltrate communication systems any longer. The Israeli's were using stingrays in Washington, DC just last year to spy on officials. You could probably build a stingray using open source software and a software-defined radio USB stick.

You can't trust the network. Rather than trying to avoid Huawei, energy should be spent engineering things so Huawei equipment doesn't need to be trusted. Until then, China and everybody will continue to be able to snoop, regardless of who built the network components.

[+] anticodon|6 years ago|reply
In case of Huawei is not about spying - its about money. Building 5G networks will require installing lots of equipment on every building in every country. This will allow to make astronomical amount of money. US doesn't want all those money to go to Huawei - hence the witch hunt.
[+] xorcist|6 years ago|reply
> If the US can do it, why can't the Chinese?

This might well be a plausible reason why this old story resurfaced recently.

[+] dade_|6 years ago|reply
Ban Huawei because the it doesn't have back doors for the right government.
[+] ColanR|6 years ago|reply
This makes me wonder how many presently existing encryption & security projects / organizations are owned or influenced by government agencies.
[+] augstein|6 years ago|reply
… yes, and how many (open-source) software projects in general.
[+] markus_zhang|6 years ago|reply
Pretty much all of them, I'd assume. Basically there is no secret that a major state player cannot crack open unless 1) it doesn't care 2) it's protected by another equally strong state player.
[+] tbyehl|6 years ago|reply
Nice to finally have some exploration of how this tied into geopolitics.

What I'd still like to see is... how did this influence domestic crypto policy and export controls? It seems entirely too coincidental that right after the cat is fully out of the bag with the Iran thing, the US is suddenly easing export restrictions on crypto, trying to shove Clipper / Key Escrow down our throats, coming for Zimmerman, etc.

[+] chriselles|6 years ago|reply
This is not the only encryption/communications technology company that has been compromised by national intelligence services.

I’m aware of another(potentially) where an employee credibly alleged it.

From the perspective of a national intelligence service, it is likely a far better return on investment to proactively catalogue compromised communications at root, rather than intercept and brute force it later.

[+] KCUOJJQJ|6 years ago|reply
As a Swiss I would say that you can put Swiss cryptography into the garbage bin, together with US-American cryptography, unless there is quality control. My country needs a food inspector for cryptography. The inspector should talk to employees, check source codes, look at who owns a company etc.
[+] sschueller|6 years ago|reply
We need open source. Threema is one of those that concerns me. Used by the government but source is closed and distributed via Google Play and Apple App Store.
[+] stebann|6 years ago|reply
USA hypocrisy again. Oh! We will ban Huawei while we sing racist slurs in every country around the world!
[+] aschatten|6 years ago|reply
On my way home I tuned in on this interview, caught the end of it. Had my dinner and decided to google the story, but before checked Hacker News. And here it is on the from page.
[+] JabavuAdams|6 years ago|reply
Why do we trust Tor and Protonmail, again? Ugh.
[+] xorcist|6 years ago|reply
Tor places limits on how much of the network must be owned by an adversary in order for them to extract useful information from it. They are quite transparent about it.
[+] Fnoord|6 years ago|reply
Who said we do? That's up to each person to (consder to) construct a threat analysis.

Protonmail uses JavaScript, which can theoretically be serving nonsense to a specific client. There's no way you will audit the source every time you use it. I use it, for larping, and because I like the though that there is still some competition in the e-mail landscape.

Tor is a completely different league... but I don't consider the actions I (might) perform there to be confidential for the rest of my life, so I act accordingly. YMMV.

[+] upofadown|6 years ago|reply
We don't. Trust is relative, not absolute.
[+] ta999999171|6 years ago|reply
Tor is open source/not a vendor.

But a good point, for Tor hosts.

[+] BurningFrog|6 years ago|reply
Amusing how the CIA is "audacious", while foreign agencies are pure evil.
[+] steve19|6 years ago|reply
Within the context, this is about the spying and signals intelligence. We don't usually talk about an foreign agency being pure evil when they tap fiber lines, we do when they murder or massacre.
[+] lern_too_spel|6 years ago|reply
It depends on what the information is used for. If it's to stop nuclear proliferation, it's audacious. If it's to monitor and then disappear political dissidents, it's pure evil.