Did the US National Security Agency (NSA) trick RSA, the security division of EMC, into including a crypto algorithm that was really an NSA cyber-espionage backdoor into the RSA BSAFE toolkit in order to propagate it through tech industry products?
Not only did the Edward Snowden revelations leaked over the past few months suggest that, but an investigative report last December by Reuters went further based on sources to say RSA had a $10 million (€7.32 million) contract with RSA years ago to include the controversial dual-elliptic curve algorithm developed by the NSA as the default in the BSAFE toolkit.
In a keynote at the RSA Conference attended by upwards of 25,000 security professionals from enterprise, government and industry, RSA executive chairman Art Coviello stepped forward to acknowledge some of these accusations, and accused the NSA of exploiting its position of trust with industry.
In an impassioned speech, Coveillo said RSA, like many in industry, has worked with the NSA on projects. But in the case of the NSA-developed algorithm which he did not directly name, Coviello told conference attendees that RSA feels NSA exploited its position of trust. In its job, NSA plays two roles, he pointed out. In the information assurance directorate (IAD) arm of NSA, it decides on security technologies that might find use in the government, especially the military. The other side of the NSA is tasked with vacuuming up data for cyberespionage purposes and now is prepared to take an offensive role in cyber-attacks and cyberwar.
“We can’t be sure which part of the NSA we’re working with,” said Coviello with a tone of anguish. He implied that if the NSA induced RSA to include a secret backdoor in any RSA product, it happened without RSA’s consent or awareness. Coviello went on to say he supported the recent recommendation in the report from the Presidential board on privacy and the NSA that advised splitting the NSA into two parts. This in theory could result in separating the offensive and defensive roles of the NSA, Coviello said.
“The IAD should be spun out and managed by a separate organisation,” said Coveillo. He said that would be a good step to “re-build trust” with the NSA and the US government. He said it is clear that all over the world that intelligence agencies from many governments do spy on each other. But Coviello said it was his hope that in this situation of competing interests between governments, business and individuals, there will eventually be developed new “societal norms” that will lead to international cooperation and world peace.
“The collision of these agendas reflects the lack of societal norms,” said Coveillo. With that, Coviello said the world is at a turning point in which it must more directly confront the prospect of cyber-weapons and that governments around the world should meet in some kind of forum to take on these issues and devise a “rule of law” in all this for the sake of peace.
Coviello went on to say that he thinks that use of cyber-weapons on the Internet and waging cyberwar should essentially be renounced, and that there should instead be more prosecution of cyber-criminals. He also said the world should be pushing to ensure “economic activity on the Internet goes unfettered” and to respect the “privacy of all individuals.”
Coviello even evoked the days of President John Kennedy and the era when the world had to grapple with nuclear weapons proliferation. “The genie is out of the bottle in the case of cyberweapons, Coviello said. And he added those using cyberweapons can have them turned against them.
Coveillo concluded by urging all of industry to take an active role in all this, saying world leaders need to be “inspired” to do all this for the sake of world peace.
Whether this helps RSA itself, which has faced a significant portion of anger from many security experts since the accusations about the NSA involvement in the BSAFE toolkit surfaced, remains to be seen. But Coviello’s denouncing of government deception and a call to make the world safe from cyberwar did apparently leave a strong impression on some in the audience. “It was amazing,” said Tom Cross, director of security research at Lancope.
Ellen Messmer, Network World US
Ltd
