The Post and ZDF, a German public broadcaster, have collaborated on a story about Crypto AG. It’s a true-life spying success story:
For more than half a century, governments all over the world trusted a single company to keep the communications of their spies, soldiers and diplomats secret.
The company, Crypto AG, got its first break with a contract to build code-making machines for U.S. troops during World War II. Flush with cash, it became a dominant maker of encryption devices for decades, navigating waves of technology from mechanical gears to electronic circuits and, finally, silicon chips and software.
The Swiss firm made millions of dollars selling equipment to more than 120 countries well into the 21st century. Its clients included Iran, military juntas in Latin America, nuclear rivals India and Pakistan, and even the Vatican.
But what none of its customers ever knew was that Crypto AG was secretly owned by the CIA in a highly classified partnership with West German intelligence. These spy agencies rigged the company’s devices so they could easily break the codes that countries used to send encrypted messages.
Bobby Ray Inman, former NSA director, is quoted in the story as saying, basically, “fuck yeah we did that, good for us”. I never liked that guy.
As an older software guy, I remember how much of a pain in the ass crypto was in the 80’s and 90’s, compared to the relative ease of using crypto today. (For example, this page was served to you over an encrypted connection, which is absolutely commonplace today, but it would have been a big deal back then.) Part of that pain was the NSA’s effort to impose their versions of cryptographic algorithms onto the market, which at that point included export controls which treated strong crypto like munitions. A lot of us assumed this effort was because they wanted to be able to break messages coded in NSA-approved algorithms quickly. This article makes that supposition seem much more reasonable.
That all said, you don’t need to know much about cryptography to understand the story.
Cheryl Rofer
We know that our current President has made careless statements, for example releasing a highly classified photo of an Iranian missile launch site that allows others to infer US satellite capabilities. It’s the ones we don’t recognize because their content is so highly classified that will do us damage.
Patricia Kayden
Good.
Zinsky
I still assert that American democracy died with the passage of the National Security Acts of 1946 and 1947. After that, the US government became impervious to citizen scrutiny and “national security” became the be-all and end-all of American foreign policy. I say, “HORSESHIT”! The US government should not have one secret from their citizens. Not. One. Period.
Cheryl Rofer
Love the IBM “Think” plaque in the photo of the Army Signals Intelligence Service in the 1930s.
download my app in the app store mistermix
@Cheryl Rofer: I like to use old pics of 50s/60s/70s computer rooms in presentations. The youngs seem to appreciate them.
Dupe1970
@Patricia Kayden: It’s so weird that Republicans fight so hard to keep up monuments of Democrats. Very weird.
Jay Noble
I worked at Best Buy in Lincoln, NE in the mid 90’s. I was in charge of software. The encryption rules as interpreted to us were “If it has a password, it can’t be exported so no selling to foreigners.” This being a College Town with the attendant numbers of foreign students and visiting professors and home to a significant number of refugees we were put in a profiling mode which was pretty weird but typical because just about everything from Windows 95 to the latest screensavers had password capability. I don’t recall any incidents of irate customers but we did deny a couple of sales to some visiting groups from the middle east and China.
The kicker to all this was at the time the US software had weaker password protection than the same programs abroad.
guachi
@Dupe1970:
The Confederate monuments are the heritage of Democrats, right? So Democrats should get to decide on what happens to their own heritage.
MattF
@Jay Noble: And the lesson that those furriners drew from the restrictions is that if you want to encrypt something, learn how to do it yourself.
Roger Moore
@Zinsky:
Nonsense. We have gone way, way too far in hiding things, but there is a legitimate need to keep stuff secret. For a non-military example, when we’re negotiating a trade agreement, it makes sense to keep the details of our negotiating position a secret. Not letting the other guy know what value you place on various things is a key to effective negotiations. The public can judge the negotiations based on the agreement we reach without needing to know the details of how it was reached.
Kent
@Patricia Kayden: Elections have consequences. Too many people forget that
MattF
@Zinsky: I’d agree that the combination of secrecy and bureaucracy is extremely toxic, but the notion that gentlemen do not read each other’s mail doesn’t even make it to ‘quaint’.
Kent
The US government knows your social security number, your employer, your income and taxes paid and deductions made going back decades. And a huge amount of other information on you. Do you want all that made public?
BellyCat
Both brilliant – – “we spy on you and you pay us to do it“ – – and disturbing, in too many ways to contemplate optimistically.
No wonder Trump thinks that other countries should pay us for our military installations there!
Roger Moore
This kind of thing is at the core of any important spy operation: using the information you gain threatens the source. The more important and higher placed the source is, the harder it can be to use the information they send without revealing where it came from. There are often entire secondary operations to launder critical intelligence to protect its source.
Redshift
Hurrah! Alexandria (right across the river from DC in NoVa) has a Confederate monument right in the middle of the major thoroughfare, and I can remember a time not too long ago when the city government wanted to move it just because it’s a frickin traffic hazard, and there were threats from the Republican legislature that they would mandate even more restrictions if they did.
(At least that one dates from 1889 and not the Civil Rights era.)
Mandalay
@Zinsky:
As a practical matter, if 325 million American citizens know everything about what our government is up to, then Russia, Iran, Israel, China, North Korea, Cuba, Venezuela et al would also know.
Your idea doesn’t seem prudent.
WaterGirl
@Patricia Kayden: Payback is a bitch. Let’s hope the R senators get their turn to experience it soon.
Matt McIrvin
Remember how right after 9/11, some venerated foreign-policy analyst wrote an article saying that the US should locate any ISP passing an encrypted packet and destroy it with cruise missiles?
Good times…
Roger Moore
@Redshift:
A lot of them do. There was a huge burst of putting up Confederate monuments during the post-Reconstruction era when Southern governments were creating the Jim Crow system.
?BillinGlendaleCA
@Kent: Back when I was a young’n I applied for a job at OMB, when I went in for my interview(a block from the White House), I gave the guard at the desk my driver’s license and he entered the number into his computer. The printer started printing and kept going and going. They know pretty much anything you’ve done.
download my app in the app store mistermix
@BellyCat: One thing that stood out in the piece was that the West Germans and the Americans were constantly fighting over which countries got the easy-to-break machines. The Americans wanted to give them to everyone but our closest allies, and NATO countries like Turkey got them. Another example of why we shouldn’t be surprised when these “little countries” ally themselves with our perceived or real enemies.
mrmoshpotato
OT – Oh Zergnet, you pile of hippopotamus asses.
mrmoshpotato
@Zinsky: Psst…. you’re free to tell the world all by yourself about that box labeled “Not Sexy Wombat Pictures.”
Redshift
@Roger Moore:
Yeah, I guess I was thinking of the battle flag stuff.
Darrin Ziliak (formerly glocksman)
Did the Soviets know about Crypto?
Given how heavily infiltrated the BND was, I suspect that they learned early on and didn’t expose it in order to protect their own sources.
Obvious Russian Troll
@Matt McIrvin: Dear god, who the hell was that? I don’t remember it, and since I was working for a company that was trying to get out of the ISP business at the time you’d think I would have.
Barbara
@Redshift: There were a couple of spurts. One was the 50th anniversary of secession or some other date associated with the war, basically in between 1910 and 1920. There were additional efforts at naming and monuments to counter the Civil Rights movement but especially school desegregation. At least one middle school in Fairfax County that was recently renamed (JEB Stuart) was named in the 1950s as part of the resistance to desegregation. To say that it is an inappropriate name for a school in Fairfax County now is an understatement.
TomatoQueen
@Redshift: That statue you’re thinking of may or may not come down, because like many others it is owned by the United Daughters of the Confederacy, which sodality is responsible for much of the manifestation of the Lost Cause, including inventing it out of whole cloth, and of which these excrescences form a large part of the blight on the public square. May they be snatched bald-headed, soonest.
bughunter
Part of that pain was the NSA’s effort to impose their versions of cryptographic algorithms onto the market, which at that point included export controls which treated strong crypto like munitions.
I’ve always had a nagging feeling about how the US government’s (NSA, CIA, DOD-led) opposition to PGP just quietly and suddenly evaporated right around the same time the WWW (and its SSL protocol) replaced things like AOL, usenet and fidonet.
Are we to believe they had a change of heart and just abandoned their position of dominant omniscience?
Roger Moore
@Darrin Ziliak (formerly glocksman):
The article doesn’t say, probably because nobody in Russia is going to talk about it. I wouldn’t be surprised if they did. Even if they didn’t know the details, they had their own spy agencies with top-notch cryptographers. They didn’t have the head start of knowing exactly how the system was crippled, but they were good enough to crack those kinds of broken systems. That meant they were probably reading everything we were.
This is the big danger of weakening cryptography: you can’t keep it to yourself. Anyone who is good at cracking codes will be able to take advantages of the weaknesses you’ve created. If you leave in back doors, hackers can find them and take advantage.
TomatoQueen
@bughunter: Hehehe you what now?
Doug R
Is that why the Manning/Snowden “revelations” hit the USA so hard?
Our sources and methods burned as thoroughly as those Crypto machines?
burnspbesq
@Zinsky:
Zinsky will have a double “I’m dead wrong” with a large side order of condescension.
A Ghost To Most
As a retired software guy, encryption and security came late for me. When I was laying down the first C code in a commercial network switch (circa 1985), just getting it to work was the object. Security came later.
Steeplejack (phone)
@Barbara:
J.E.B. Stuart High School, now Justice High.
WaterGirl
I am watching the debate from the other night. Did anyone else think Joe Biden totally bungled the question about one of his top people in SC saying something racist to one of Steyer’s people?
I really like Joe Biden, but that was hugely disappointing. Am I being too harsh? Seems like his answer was “black people like me and so do the members of the congressional black caucus”. When they pushed Biden on the answer, he kind of mumbled something about having already spoken with the guy mumble mumble who I believe is sorry for what he said. Why couldn’t he say the he disavowed what the guy said? I don’t actually know what Biden’s guy said to Steyer’s guy, but either disavow it for being racist or stand by his guy because it wasn’t.
This doesn’t seem like a very strong debate for Joe Biden.
I am really surprised, but I am liking just about everything Steyer has to say. In the previous debates, I fast forwarded through they guys who bought their way in. Steyer actually seems pretty passionate about wanting to pull the country back from the brink. It doesn’t feel like an ego thing to me.
Roger Moore
@bughunter:
No. There are still plenty of people in the security state trying to sell us on the advantages of weakening cryptography. They’re the ones demanding Apple not encrypt iPhone backups so police can read them, or trying to convince the government to require back doors in encryption algorithms. What really happened when the WWW took off is that the security state stopped being the only major lobby that cared about encryption. Instead of pro-encryption people being a handful of weirdos, it was an organized group of businesses who wanted to use the internet for commerce but were reluctant to do so without strong encryption to protect their businesses.
gvg
@Zinsky: In the years right after the Atomic bomb, you think our government shouldn’t have secrets. Well, that tells me what your judgement is worth. Of course every government goes too far with it, but it’s just a fact of life that a lot of things need to be secret, not to mention our own privacy.
Loose lips sinks ships and ambushes convoys and so on.
Now lets have a real nuanced discussion of what really needs to be secret, needs to be private and how to achieve that. this also has to be revisited by policy makers and citizens fairly often, over and over, forever.
Cacti
So, we should all know the nuclear launch codes then?
Martin
@Roger Moore: Right. Encryption was now needed for all of our credit cards, and it couldn’t be compromised. Once we moved from physical to digital, the power dynamics changed significantly.
Creating strong digital encryption is not hard in the sense that you need an agency to do it. A single very smart person can do it. Then you need to gain adoption of it. So academics can easily compete with the NSA on designing strong encryption. And digital distribution of that algorithm is trivial (unlike distribution of a physical encryption system). So once you had free market agents willing to back adoption, you were done.
Defeating strong digital encryption is the opposite. Nobody at a university is going to do any more than find a flaw in an algorithm that shows it’s weaker than believed, but they aren’t gong to break it – only the NSA has the combination of talent and money to do that (and the NSA folks are crazy smart – I know a few of them).
That asymmetry is important here. Once you can break the legislative barrier to distribution, then basically everyone gets good digital encryption. Mathematicians outside the US can create it and distribute it into the US, so even export controls don’t help.
So, in the same way that encryption intends to be a one-way system allowing easy encryption and difficult to impossible decryption (without the key), implementation of a digital encryption system is similarly a one-way system. It becomes nearly impossible to stop people from implementing strong digital encryption, and designing strong digital encryption isn’t really all that hard.
When I was in grad school studying math, we’d for fun explore how hard it was to design an algorithm that would break export controls, and it was pretty fucking easy even for us – and that wasn’t even our specialty. I don’t pretend those algorithms weren’t weak to attack, but within an hour we could create something the NSA would declare as a munition and was probably good enough to defeat non-state actors.
The DOJ argument for backdoors is fucking crazy. If Apple opened a back door into their encryption, then any country would require that same back door in order to sell phones in their country. The Russians and Chinese would have the keys to US phones. There’s no getting around that. Tim Cook has made that point clear enough, but the DOJ seems to believe that they can legislate other nations.
mrmoshpotato
@Cacti: Michelangelo! Sheepshead fish! Taco Tuesday!
Oh, sorry, you said code – 8675309.
Oops.
Jinchi
We also know he’s had one-on-one conversations with Vladimir Putin, Jared is best buddies with the Saudi Prince and Giuliani is close with every dictator on the planet. I almost wish for the days when a president would only accidentally give away American intelligence.
?BillinGlendaleCA
@mrmoshpotato: You’ve said too much, you’ll be mashed.
Chris Johnson
@mrmoshpotato: Jenny jenny, who can I turn to…
mrmoshpotato
@?BillinGlendaleCA: I prefer to be cut into planks, blanched and fried.
(Does that mean I get multiple primary and general election votes? Aside from living in Chicago…)
Marcopolo
@WaterGirl: My understanding is Steyer wrote a check to an AA politician to the tune of $40k or so and Biden’s #1 SC surrogate Dick Harpootlian (sp) who is Caucasian basically accused Steyer of buying his support.
From an outside view it does look like buying support but I guess that happens a fair amount and a white pol calling out a black pol on it came across as a little racist and a lot hypocritical.
Marcopolo
So this a voter on the street interview in NH & is indicative of why I am somewhat cynical about elections & the average American voter—who is most likely low info (watch it):
Martin
The AUSA prosecutor in the Stone case just withdrew and resigned effective immediately. Maybe Maddow can land him as the interview tomorrow.
trollhattan
In which I find there is a crime named “grand theft dog.” Regardless of being grand, it’s only a misdemeanor, to which dogs everywhere say “Grrrr.”
Robert sneddon
@Martin:
One problem with strong encryption systems is that future discoveries in mathematical research and simple brute-forcing from ever-more-powerful computers can mean that “strong” encryption isn’t always as strong as first thought.
Back in the early days when the development of online encryption systems meant to secure data transmissions resulted in the US government mandating the DES (Data Encryption Standard) for a lot of commercial and Government usage. The NSA stuck their oar in and caused the DES to do some things folks thought weakened it so that the NSA with its basements full of supercomputers could always create a backdoor. Decades later, after some mathematical discoveries were made it was revealed that in fact the NSA had actually hardened the DES and made it more difficult to crack, not simpler. Some of the cryptographic people in the NSA had discovered weaknesses in the DES algorithms but they couldn’t publish the details because they were a secret hence the mandated but unexplained changes to the algorithm.
A number of early crypto systems such as SSL 2.0, widely used on the Internet and the Web have been found to be unsecure with intrinsic flaws and/or they are now crackable with modest amounts of computing effort on modern hardware and especially with cloud-based solutions where anyone with a few thousand bucks can rent a supercomputer’s worth of effort in this direction.
The Moar You Know
@Martin: Barr and Trump just put their meaty thumbs on the scale of justice and got DOJ to walk back the sentencing recommendation (7-9 yrs IIRC). They’ll announce their new recommendation “soon”. The judge can and will tell them to fuck right off, but that won’t matter much because Trump will pardon him anyway.
mrmoshpotato
@trollhattan: Aren’t all dogs emotional support dogs, or are those just the ones people absolutely must take on planes?
Martin
@Robert sneddon: Encryption takes that into account. We can estimate the rate of computational increase through the law of accelerating returns.
Math is relatively immune to future discoveries because it’s an abstract construct. Not completely immune but it’s a provable discipline.
So all encrypted information carries a shelf life. SHA-256 is estimated at under 100 years. But that’s not a problem. For ephemeral information like a browser session, you just switch to a stronger algorithm. For stored information, just re-encrypt everything, which is relatively fast.
trollhattan
@mrmoshpotato:
A murky distinction to be sure, but emotional support iguanas are right out.
lollipopguild
@mrmoshpotato: You mean I cannot take my emotional support skunk on a plane?
mrmoshpotato
@lollipopguild: Emotional support skunk? What foul emotions do you need supported?
catclub
@Redshift: Can they start by renaming Lee Highway?
catclub
@?BillinGlendaleCA: was that when Drivers License numbers were your social security number?
Roger Moore
@Robert sneddon:
Yes and no. Yes, it’s true that subsequent developments can render encryption weaker than it was originally believed to be, and increases in computing power can make it easier to crack even without better cracking techniques. But brute force can cut both ways. Just by going to longer keys, it’s possible to make a real break in a cypher basically impossible. Something like the 256 bit version of AES would require either a catastrophic break in the algorithm or a radical breakthrough in computer technology to be broken for practical purposes.
Zinsky
@Roger Moore: Bullshit. Trade negotiations that are incomplete is not a good example. It’s a work-in-process. Of course you wouldn’t disclose the terms until negotiations are finalized. However, how the final terms were reached, who was involved in reaching them and the reasons for the final terms should absolutely be disclosed to the public. Some will say, well, what about how to build a nuclear weapon? Shouldn’t that be a secret? The answer to that is that building a nuclear weapon isn’t a knowledge challenge, it’s an engineering challenge. The steps in making a hydrogen bomb are well known and can be found all over the Internet. However, it takes an incredible amount of capital investment and engineering sophistication to make the centrifuges, mine, refine and process the uranium and beryllium, fabricate and assemble the components, and test the weapon are items only a wealthy, sophisticated nation-state can muster. No secrets. NONE!
Matt McIrvin
@Obvious Russian Troll: I want to say it was John Keegan, the British military historian, but I can’t find references to the incident any more. It was during the initial flush of post-9/11 jingo foolishness.
Roger Moore
@Zinsky:
So in other words there are some kinds of secrets you think the government should be able to keep: works in progress. I assume this would also have allowed the military to keep the Normandy invasion plans secret.
The problem, of course, is that once you say that a work in progress can be kept secret, you open up a huge can of worms about what exactly constitutes a work in progress. Do contingency plans for something we don’t expect to happen but feel we need to be prepared for (e.g. the targets in event of a nuclear war) count? How about our attempts to spy on other governments who don’t share your attitude toward secrets? How about the information we received by spying on other governments that might compromise the sources and methods we used to acquire that information?
Not quite correct. The general principles of nuclear explosive design are generally available, but there’s a huge difference between knowing general principles and knowing all the details. It turns out there’s a lot about the details of nuclear design that require full scale tests to get it right. So yeah, a single person could design a nuclear device that would go off, but without the experience from actual testing they wouldn’t be able to design an optimized, light weight, high performance nuclear warhead. I think it’s perfectly reasonable to keep that information- and certainly the actual plans of our newest nuclear weapons- secret.
J R in WV
@Zinsky:
@Roger Moore:
Thanks Roger for spelling out so effectively why Zinsky was so totally wrong about government secrets. I would add, why would we want to publish details of the construction of nuclear weapons?
Sounds like a plain old stupid idea to me, along with many other national secrets… I can think of dozens — military dispositions, submarine design details, aircraft design details… hell, even ammunition designs. How to keep our communications on the combat arena secure. There are more than dozens!
J R in WV
@Steeplejack (phone):