Russia Has Banned VPNs

from the who-needs-privacy-anyway dept

We've noted for some time that Russia has been engaged in a slow but steady assault on privacy tools like VPNs. As with most countries that have an adversarial relationship with the truth, the entire effort has been couched as necessary to protect national security and cultural morality, though the real agenda is to help prop up the country's domestic surveillance efforts and Putin's ham-fisted internet filters. This push accelerated with a new surveillance bill last year that not only mandated new encryption backdoors, but also imposed harsh new data-retention requirements on ISPs and VPN providers.

But that was only the opening salvo in Russia's assault on citizen privacy. The country has since accelerated efforts to ban anonymity on messaging apps, while simultaneously pushing new legislation that would make operating as a VPN provider in Russia all but impossible. The legislation, which would require that ISPs ban the use of VPNs sailed through the Russian Parliament:

The State Duma on Friday unanimously passed a bill that would oblige Internet providers to block websites that offer VPN services. Many Russians use VPNs to access blocked content by routing connections through servers outside the country. The lawmakers behind the bill argued that the move could help to enforce Russia's ban on disseminating extremist content online. The bill has to be approved at the upper chamber of parliament and signed by the president before it comes into effect.

Over the weekend, Putin signed the bill into law, and that story notes this bizarre "explanation" of the bill:

Leonid Levin, the head of Duma's information policy committee, has said the law is not intended to impose restrictions on law-abiding citizens but is meant only to block access to "unlawful content," RIA news agency said.

Needless to say, this wasn't received particularly well by Russian citizens that enjoy having something vaguely-resembling privacy, with 1,000 or so protesting in Moscow last weekend over the looming law:

Pavel Rassudov, 34, the former head of the Pirate Party campaign group, said at the march that "restrictions on the internet began in 2011," as the opposition to Putin held mass rallies in Moscow. "The authorities realised the Internet was a tool for mobilisation, that it brings people out onto the streets," Rassudov said. Another marcher, Lyudmila Toporova, 56, said she came to the rally because "Freedom is the most important thing in life. That's why I'm here."

Of course the end result of this kind of ridiculous policy is that encryption itself is undermined, and everybody winds up less secure. And while you'd like to think this sort of thing wouldn't happen here in the States, if you've watched the endless efforts to undermine encryption and demonize VPNs, the last five years or so, we're probably only a domestic terrorist attack or two away from voters being scared into supporting similar idiotic policy for the "safety and security" of the republic.

Filed Under: bans, dumas, encryption, privacy, russia, security, vladimir putin, vpns

Indian ISPs Continue Futile Effort To Prevent Subscribers From Using Decent Encryption

from the good-luck-with-that dept

The global war against privacy tools, VPNs and encryption continues utterly-unhinged from common sense, and the assault on consumer privacy remains a notably global affair. Reddit users recently noticed that India's fifth largest ISP, YOU Broadband, is among several of the country's ISPs that have been trying to prevent customers from using meaningful encryption. According to the company's updated terms of service, as a customer of the ISP you're supposed to avoid using encryption to allow for easier monitoring of your online behavior:

"The Customer shall not take any steps including adopting any encryption system that prevents or in any way hinders the Company from maintaining a log of the Customer or maintaining or having access to copies of all packages/data originating from the Customer."

Of course enforcement of such a requirement is largely impossible. But You Broadband isn't just being randomly obtuse, and while the ISP's TOS is making headlines, this effort isn't really new. Most Indian ISPs are simply adhering to a misguided (and still not adequately updated) set of 2007 guidelines imposed by India's Department of Telecommunications (word doc) demanding that ISPs try and prevent their subscribers from using any encryption with greater than a 40 bit key length if they want to do business in India:

"The Licensee shall ensure that Bulk Encryption is not deployed by ISPs connecting to Landing Station. Further, Individuals/Groups/Organizations are permitted to use encryption upto 40 bit key length in the symmetric key algorithms or its equivalent in other algorithms without having to obtain permission from the Licensor. However, if encryption equipments higher than this limit are to be deployed, individuals/groups/organizations shall do so with the prior written permission of the Licensor and deposit the decryption key, split into two parts, with the Licensor."

Which is and of itself is rather hysterical, given that since 1996 or so, most folks have considered a 40 bit key length to be the security equivalent of wet tissue paper. In fact, Ian Goldberg won $1,000 from RSA for breaking 40 bit encryption in just a few hours way back in 1997, saying this at the time:

"This is the final proof of what we’ve known for years: 40-bit encryption technology is obsolete."

And yeah, that was twenty years ago. But this sort of policy is pretty standard fair in India, which is no stranger to censorship, internet filtering, and blind, often-mindless expansion of surveillance. India's government has also been at the forefront of attempting to impose backdoors in encryption, and there's a recent effort in some corners to attempt to ban Whatsapp as well.

I've yet to see any ISP successfully enforce this ridiculous governmental restriction (if you're in India and you have, let us know in the comment section precisely how). But it's still part of an over-arching mindset that sees standard, intelligent privacy and security practices as an enemy that must be thwarted. Usually either to expand government surveillance, prop up idiot ham-fisted internet filters (as we're seeing in Russia, China and India), or to erode consumer rights in the face of what are endless attempts to monetize your online behavior.

Filed Under: encryption, india, privacy, vpns

The Great Firewall Of China Grows Stronger As China Forces App Stores To Remove VPNs

from the total-information-control dept

Like clockwork, governments eager to censor the internet inevitably shift their gaze toward tools like VPNs used to get around restrictions. We've documented rising efforts to ban the tools use in countries like Russia, where VPN providers are being forced out of business for refusing to aid internet censorship. Whether it's to protect VoIP revenue for state-run telecom monopolies, or to prevent users from tap-dancing around state-mandated filters or other restrictions, VPNs have become the bogeyman du jour for oppressive governments looking to crack down on pesky free speech and open communication.

China's great firewall is a sterling example of draconian censorship, and since 2012 or so China has been trying to curtail both encryption and VPN use. Earlier this year China's Ministry of Industry and Information Technology declared that all VPN providers now needed prior government approval to operate, a move generally seen as the opening salvo of an outright ban. These new restrictions will last until July 2021, impose fines up to $2000 on companies offering unsanctioned VPNs (read: all of them), and feature government warnings sent to users consistently caught using the tools.

But in some areas, the pretense has washed away and VPN usage has been simply banned entirely. And as of July, VPN services began disappearing from both the Android and iOS app stores, with popular VPN providers like Green informing their customers the government has forced them to shut down completely:

"Dear respected Green customers,

We have received notice from the higher authorities. We regret to inform you that Green will cease our service on July 1st, 2017. We apologize for any inconvenience caused.

We will start processing our users’ refund request after service stopped (the amount will be calculated based on the remaining days in your plan). If you need a refund, please make sure to submit your refund request by August 31, 2017. We won’t be able to process any refund request submitted after that date. Since the workload of processing the requests, information verification and money transfer would be huge, we won’t be able to set an exact date for the refund. We plan to process the refund soon after August 31, please wait patiently.

Originally, statements made by the Ministry of Industry and Information Technology seemed to suggest the country's VPN ban wouldn't be fully implemented until March 2018. But these recent reports indicate that the Chinese government has grown tired of the pretense and has expedited its VPN crackdown dramatically. Since around 1-3% of China's 731 million internet users use tools like VPNs to tap dance around internet filters, even with this crackdown this will be a long, difficult, expensive game of Whack-a-Mole for the Chinese government all the same.

While VPNs are not a panacea for our endlessly eroded privacy rights, they remain an incredibly useful tool for those living under repressive regimes. Most legislative VPN bans are of the "death by a thousand cuts" variety, where lawmakers go out of their way to pretend they're not trying to kill VPNs, even if the end goal always remains the same: the elimination of any tool that might let citizens peek through the curtain of draconian efforts at information control.

Filed Under: app stores, china, encryption, great firewall, mobile, privacy, security, surveillance, vpns

Russia Stumbles Forth In Quest To Ban VPNs, Private Messenger Apps

from the feel-safer-yet? dept

Last year we noted how Russia had introduced a new surveillance bill promising to deliver greater security to the country. Of course, like in so many countries, the bill actually did the exact opposite -- not only mandating new encryption backdoors, but also imposing harsh new data-retention requirements on ISPs and VPN providers. As a result, some VPN providers like Private Internet Access wound up leaving the country after finding their entire function eroded and having some of their servers seized.

This year, Russia hopes to deliver the killing blow to the use of VPNs and other privacy-protection tools.

The Duma's (the lower house of the Russian parliament) Information and Technology Committee has approved controversial draft legislation that would ban anonymity on messenger apps entirely. It's part of a crackdown on anonymous journalists that have (stop us if this sounds familiar) been leaking details on many of the sordid occurrences inside the often-corrupt Russian political machinery. Expected to take effect in 2018, the new law would require messenger users to verify their identities using their phone numbers, with Russian mobile phone operators expected to assist the government with this effort.

In concert, a bill has been submitted attempting to effectively ban VPN use entirely. In Russia, broadband users have increasingly turned to VPNs to avoid the growing-list of censored websites. To help thwart such usage, the bill would not only impose steep fines on VPN providers that don't agree to block blacklisted websites, but would require that ISPs terminate these companies' connection to the internet should they not comply:

As it stands, the bill requires local telecoms watchdog Rozcomnadzor to keep a list of banned domains while identifying sites, services, and software that provide access to them. Once the bypassing services are identified, Rozcomnadzor will send a notice to their hosts, giving them a 72-hour deadline to reveal the identities of their operators.

After this stage is complete, the host will be given another three days to order the people running the circumvention-capable service to stop providing access to banned domains. If the service operator fails to comply within 30 days, all Internet service providers will be required to block access to the service and its web presence, if it has one.

In short: help us censor the internet or you won't be allowed to do business in Russia. 100 VPN providers are already blocked in Russia for one reason or another, and Opera scaled back its Russian operations last November after Russian telecom regulator Roskomnadzor pressured it to include website filtering in the integrated VPN (now included in its Opera browser for free). The bill would also levy additional penalties on Russian search engines, forcing them to remove all links to sites Rozcomnadzor determines to be ban-worthy.

Like countless similar efforts across numerous countries, this is all framed as an utterly necessary step to thwart piracy, combat extremism and ensure the safety and security of the Russian people. But as with comparable proposals in the States and elsewhere, these proposals undermine encryption and essential security and privacy tools, making the general public notably less secure. They're also an expensive game of Whack-a-Mole as users looking for privacy simply flee to services like Tor or Zeronet, ensuring these services will be the demonized bogeymen of tomorrow.

Filed Under: encryption, private messaging, russia, vpns

Russia Tries To Deliver The Killing Blow To VPN Use

from the Industrialized-stupdity dept

Last year Russia passed a new surveillance bill that promised to bring greater security to the country. As is par for the course for these types of bills, the legislation did the exact opposite by not only mandating new encryption backdoors, but by also imposing harsh new data-retention requirements on ISPs and VPN providers. As a result, some VPN providers like Private Internet Access wound up leaving the country after finding their entire function eroded and having some of their servers seized. The end result? Russia's pledge to shore up security wound up making everybody in the country notably less secure.

And now Russia appears poised to dramatically up the ante.

Alongside the country's attack on encryption, Russia has dramatically ramped up internet filtering and censorship in the apparent hopes of making the great firewall of China seem reasonable. And a new bill being pushed quickly through the Russian legislature would not only impose fines of up to $12,400 per breach on search engines that still link to these banned sites, but would require VPNs to immediately cease providing access to these blocked domains as well. If they refuse, these VPN providers risk being blocked themselves:

"Russia’s plan is to issue a nationwide ban on systems and software that allow Internet users to bypass website blockades previously approved by telecoms watchdog Roskomnadzor. This means that if a VPN, proxy or similar tool unblocks torrent site RuTracker, for example, it will be breaking the law. As a result, it too will find itself on Russia’s banned site list."

The technical aspects of the bill appear to have largely been formulated by the Media Communications Union (MCU), a coalition of Russian media conglomerates hoping to piggyback on the government's crack down of free speech to wage a broader war on piracy. And while the legislation's proponents continue to insist this is all simply necessary to thwart piracy and security threats at home and abroad, most are well aware that this is just pretense for a ham-fisted attempt at information control under the false banner of a safer, more secure nation:

“Naturally, we are against the spread of illegal content, but the law does not violate the rights and freedoms of citizens to access information,” says Sergey Grebennikov, director of the Regional Public Center of Internet Technologies. "Yes, there is a ‘gray zone’ used to carry out illegal activities and the distribution of illegal content using a CGI proxies, but it does not mean that legitimate users have to suffer. It is also important to note that the laws do not violate the rights of users who choose the safe use of the Internet, for example, by using a VPN connection,” Grebennikov concludes."

Those worries are a day late and several thousand dollars short. 100 VPN providers are already blocked in Russia for one reason or another, and Opera scaled back its Russian operations last November after Russian telecom regulator Roskomnadzor pressured it to include website filtering in the integrated VPN (now included in its Opera browser for free). This new assault on VPNs simply takes the entire affair to the next level, bringing Russia more in line with the draconian VPN crackdown we're seeing in China (and, inevitably, here in the west, where VPNs are increasingly demonized).

Of course while VPNs are not a panacea for our endlessly eroded privacy rights, they remain an incredibly useful tool for those living under repressive regimes. Most legislative VPN bans are of the "death by a thousand cuts" variety, where lawmakers go out of their way to pretend they're not trying to kill VPNs, even if the end goal always remains the same: the elimination of any tool that can protect citizens from ever-expanding government surveillance and information control.

Filed Under: russia, vpns

Companies Keep Asking Us To Track You; We'd Rather You Be Protected From Tracking

from the the-ads-biz dept

We've talked in the past about the ridiculousness of the online advertising business. Over the last few years, the dollar value of most online ad revenue has declined drastically. Remember how musicians whined that their revenue dropped precipitously due to changes on the internet? I know how they feel -- though rather than lash out and blame the internet or demand legal changes, I'm hoping that we can find a better way -- and part of that is by reaching out publicly for support. Here's the thing, though: while the dollar value on ads has continued to decline, there's still been an explosion in companies filling up the online ad space. We're contacted by between one and five internet ad companies every single day, asking us to put their ads on our site. They often make bold promises, which few can actually live up to. We ignore most of these requests. Many are obviously scammy or fly-by-night. Others use language that immediately turns us off. For example, there's one company that emails basically every week promising to help us "fix" our "ad blocking problem" by forcing people using ad blockers to see ads. I don't even want to bother letting them know that we let users turn off ads themselves if they want.

We recently received a pitch from a company offering to give us a lot of money if we'd let them track our users in a very specific way. They were, more or less, promising revenue rates that are approximately 3x to 5x what we currently get. After speaking to them, we recognized that they were serious and actually had put a lot of thought into making sure that they were taking users' privacy into account. But, it still felt... sketchy. On top of that, to implement it, it would have required us to change our privacy policy, which just set off alarm bells for us. If we need to change our privacy policy to do something like that, it's probably not worth it, just because we recognize how much many of you value your privacy, and even if they're offering much higher rates, what good is that if we lose the trust of our readership?

In the meantime, we are always looking for ways to help keep Techdirt funded that are good for everyone, rather than ones that undermine trust or treat our community poorly. That's why we have this ongoing partnership with Private Internet Access, the popular and excellent VPN service that helps stop companies from tracking you so carefully. And that's why we'll do things like make money off of affiliate fees from helping protect your privacy, instead of selling out any good will and trust by treating you "as the product" (as the slightly ridiculous saying goes). So we've told the tracking company no thanks and to take a hike. I doubt most other websites would do the same, but we thought it was the appropriate move and, in the interest of transparency, wanted to share our decision with you.

Obviously, I'm also not just writing this to pat ourselves on the back -- but to give you some transparency into the fact that to keep Techdirt strong, we need support from you guys who make up our community. And, again, picking up your Private Internet Access VPN from us is one great way to support Techdirt (and help you protect your privacy). You can also buy stuff from our Deals Store or support us directly via our Insider Shop. And we'll have some other stuff coming in the future (including, yes, more awesome T-shirts). We try to be overly cautious not to be too aggressive in asking for support, but after our experience with this one tracking company, it seemed appropriate to share that story and remind you of ways you can support us that don't require that we change our privacy policy and compromise our values.

Filed Under: ads, journalism, privacy, tracking, vpns

Netflix CEO Says Annoyed VPN Users Are 'Inconsequential'

from the you-mean-nothing-to-me dept

When Netflix recently expanded into 190 different countries, we noted that the company ramped up its efforts to block customers that use VPNs to watch geo-restricted content. More accurately, Netflix stepped up its efforts to give the illusion it seriously cracks down on VPN users, since the company has basically admitted that trying to block such users is largely impossible since they can just rotate IP addresses and use other tricks to avoid blacklists. And indeed, that's just what most VPN providers did, updating their services so they still work despite the Netflix crackdown.

Netflix's frankly over-stated "crackdown" is an effort to soothe international broadcasters, justly worried about licensing content to a company that is demolishing decades-old broadcasting power centers. But even superficial as it may be, Netflix's crackdown on VPNs still managed to erode user privacy and security, since obviously there are countless people using VPNs for reasons other than engaging in global Netflix tourism.

With that in mind, Netflix CEO Reed Hastings probably didn't win any new friends this week when stated on the company's latest earnings call that VPN users are loud but, ultimately, "inconsequential":

There was uproar from customers, some of which simply use VPNs to protect their privacy, with a petition calling for the ban to be lifted attracting over 40,000 signatures. But it seems Netflix, which generally cherishes its user experience, doesn’t seem fussed by this uprising.

“It’s a very small but quite vocal minority,” CEO Reed Hastings said during this week’s earnings call. “So it’s really inconsequential to us, as you could see in the Q1 results.”

And, if looking solely at growth, he's not wrong; the company reported that it now serves 81.5 million members, 42% of whom are now outside of the United States. That's 44,740,000 TV subscribers in the States alone, double Comcast's latest tally of 22,347,000 TV customers. While investors are worried about growing competition from Amazon and grandfathered customers' reaction to next-month's price hike (actually announced two years ago), most customers, VPN or otherwise, aren't leaving.

And while Netflix may be annoying some VPN users now, the company has repeatedly stated that its ultimate goal is to eliminate geographic broadcast restrictions entirely. That not only makes it so Netflix tourism is unnecessary, but it should reduce piracy -- something Netflix Chief Product Officer Neil Hunt reiterated earlier this year at CES:

“Our ambition is to do global licensing and global originals, so that over maybe the next five, 10, 20 years, it’ll become more and more similar until it’s not different”... “We don’t buy only for Canada; we’re looking… for all territories; buying a singular territory is not very interesting any more.... When we have global rights, there’s a significant reduction in piracy pressure on that content. If a major title goes out in the U.S. but not in Europe, it’s definitely pirated in Europe, much more than it is if it’s released simultaneously,” Mr. Hunt says.

In other words Netflix's long-term vision may be to eliminate fractured broadcast licensing so users don't need to use VPNs. But in the short term Netflix should probably try a little harder to avoid alienating its more technically savvy customers. They may be "inconsequential" now during Netflix's heyday, but may prove important once Netflix's streaming battle against Amazon, Hulu, Apple, and countless other companies starts to heat up.

Filed Under: customers, geo blocking, geo restrictions, reed hastings, security, vpn, vpns
Companies: netflix

PayPal Continues To Drive People To Bitcoin And Other Solutions As It Starts Cutting Off VPNs & Open Internet Solutions

from the because-of-course-it-is dept

There's a fairly long history of Paypal being completely obnoxious in shutting down the accounts of basically anyone challenging the status quo in any way. Nearly all of our stories about Paypal follow a similar pattern:

• Paypal cuts off MEGA because it encrypts files
• Paypal cuts of account for supporting Chelsea Manning
• Paypal cuts off Wikileaks
• Paypal cuts off Mailpile, encrypted email program
• Paypal cuts off Smashwords, because it doesn't like some of its ebooks
• Paypal cuts off Diaspora
• Paypal cuts off a charitable secret Santa program
• Paypal cuts off Swedish ISP that stood for user freedoms

See a pattern yet? So, given all that, it's hardly a surprise to find out that Paypal has cut off a VPN service, arguing that because it might possibly maybe be used for copyright infringement, Paypal won't be a part of it. No, this doesn't make any sense, but as you can see from the list above, it seems pretty clear that if there's even a whiff of concern or challenging legacy businesses and beliefs, Paypal will cut you off. Because it can.

And, yes, there now are many other solutions out there, but Paypal still remains one of the easiest and most popular payment systems, even as many other companies try to take that crown away. Still, increasingly shutting off services that help protect users and enable an open internet seems like a piss poor way for Paypal to thank the open internet that made it possible in the first place. It seems likely that the more Paypal cuts these kinds of services off, the more likely it is that alternative payment systems will be deployed. Paypal may not care. After all, it's been doing this for years, but sooner or later, it's going to realize that it's just been opening up a big opportunity for others.

Filed Under: money, open internet, payments, vpns
Companies: paypal

Netflix Pretends It Will Crackdown On VPNs Just Days After Admitting It's Futile To Do So

from the international-whac-a-mole dept

For a few years now, broadcasters have whined endlessly about the use of VPNs to access Netflix in markets where the streaming service had yet to launch. You'll recall that Australian broadcasters in particular loved to throw hissy fits over the use of VPN technology, accusing customers (paying for both Netflix and a VPN) of being "pirates" for refusing to adhere to regional viewing restrictions. Of course, ignored amidst all this whining (and the futile attempts to ban VPNs) was the fact that these users wouldn't be going to these lengths -- if they liked the existing services being made available to them.

Last week, Netflix surprised everybody by announcing the service was now available in 130 additional countries, bringing the grand total of available countries to 190. And while this will certainly force many broadcasters to stop whining about VPNs and start competing, the fact remains that thanks to geographical licensing restrictions, the content being made available to Netflix customers in Canada will look dramatically different to the catalog available to users in Germany. As such, there's been renewed interest in the use of VPNs to engage in what's effectively global Netflix content tourism.

Netflix has made a few token gestures over the last year to appease broadcasters, such as fleeting efforts to thwart VPNs and geo-restriction avoidance tools. Those efforts were already in play in the 60 countries Netflix operated in before this recent expansion. But speaking at CES, Netflix exec Neil Hunt basically admitted that there's not really all that much Netflix can do to stop VPN use, unless they want to waste calories on an international game of Whac-A-Mole:

"We do apply industry standard technologies to limit the use of proxies,” (Netflix chief product officer Neil) Hunt says. “Since the goal of the proxy guys is to hide the source it’s not obvious how to make that work well. It’s likely to always be a cat-and-mouse game. [We] continue to rely on blacklists of VPN exit points maintained by companies that make it their job. Once [VPN providers] are on the blacklist, it’s trivial for them to move to a new IP address and evade."

Clearly Netflix got some blowback for admitting the futility of VPN bans, however, as the company has since posted a new blog post full of non-statements that try to walk back Hunt's comments a little bit:

"Some members use proxies or “unblockers” to access titles available outside their territory. To address this, we employ the same or similar measures other firms do. This technology continues to evolve and we are evolving with it. That means in coming weeks, those using proxies and unblockers will only be able to access the service in the country where they currently are. We are confident this change won’t impact members not using proxies."

Now most of the media read this statement to mean Netflix is implementing some severe new assault on VPNs, but if you read the statement carefully all Netflix is saying is it's going to continue using the same tools they've always used. The same tools one of their key executives just got done publicly admitting don't actually work. It's simply not possible to really ban VPN use, but Netflix wants to make partners in its 190 service countries feel comfortable while it slowly but surely works toward eliminating geo-restrictive licensing entirely. Also said by Hunt at CES:

"Our ambition is to do global licensing and global originals, so that over maybe the next five, 10, 20 years, it’ll become more and more similar until it’s not different"..."We don’t buy only for Canada; we’re looking … for all territories; buying a singular territory is not very interesting any more."...“When we have global rights, there’s a significant reduction in piracy pressure on that content. If a major title goes out in the U.S. but not in Europe, it’s definitely pirated in Europe, much more than it is if it’s released simultaneously,” Mr. Hunt says.

More consistent licensing reduces piracy, but it also forces legacy companies to compete and upsets the status quo by weakening local broadcaster power, so expect 2016 to be jam-packed with oodles more hand-wringing over VPN and proxy use by companies terrified of change.

As an aside, if you were curious just how fractured Netflix content availability is by country (often because content rights are sold before Netflix can even bid), Finder this week released a pretty amazing breakdown of what's available by country, an accompanying map highlighting global availability, and a breakdown of what percentage of the U.S. catalog is available in each country.

Filed Under: geoblocking, proxies, streaming, vpns
Companies: netflix

If The NSA's Not Complaining About Encryption, It's Likely Because It Has Already Found A Way In

from the we-left-ourselves-a-key-to-the-back-door-under-the-mat dept

The NSA hasn't said much (well... compared to the FBI) over the past several months about the default phone encryption offered by Google and Apple. This lack of public outcry has to do with the NSA's capabilities, rather than a sudden interest in ensuring people around the world have access to secure communications. If it truly felt the world would be a better place with safer computing, it wouldn't have invested so much in hardware implants, software exploits and -- its biggest black budget line -- defeating encryption.

Where there's no smoke, there's a great deal of fire which can neither be confirmed nor denied. The NSA has very likely punched holes in encryption in existing encryption. But how does it do it? A brute force attack on encryption would be largely futile, even with the computing power the agency possesses. Alex Halderman and Nadia Heninger at Freedom to Tinker have a theory, and it involves a "flaw" in a highly-recommended encryption algorithm.

The key is, somewhat ironically, Diffie-Hellman key exchange, an algorithm that we and many others have advocated as a defense against mass surveillance. Diffie-Hellman is a cornerstone of modern cryptography used for VPNs, HTTPS websites, email, and many other protocols. Our paper shows that, through a confluence of number theory and bad implementation choices, many real-world users of Diffie-Hellman are likely vulnerable to state-level attackers.

For the nerds in the audience, here’s what’s wrong: If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number with a particular form. There seemed to be no reason why everyone couldn’t just use the same prime, and, in fact, many applications tend to use standardized or hard-coded primes. But there was a very important detail that got lost in translation between the mathematicians and the practitioners: an adversary can perform a single enormous computation to “crack” a particular prime, then easily break any individual connection that uses that prime.

The belief that these common primes (or at least some of them) wouldn't be cracked relied on the assumption that no one entity would have the money to assemble the computing force needed to break the code. The problem is that the NSA likely has the time, money and power to tackle this enormous project. Here's why it first seemed unlikely:

For the most common strength of Diffie-Hellman (1024 bits), it would cost a few hundred million dollars to build a machine, based on special purpose hardware, that would be able to crack one Diffie-Hellman prime every year.

And here's the reality of the situation, as exposed by documents leaked by Snowden.

The 2013 “black budget” request, leaked as part of the Snowden cache, states that NSA has prioritized “investing in groundbreaking cryptanalytic capabilities to defeat adversarial cryptography and exploit internet traffic.” It shows that the agency’s budget is on the order of $10 billion a year, with over $1 billion dedicated to computer network exploitation, and several subprograms in the hundreds of millions a year.

What was once considered to be beyond the capabilities of even the biggest intelligence agency is obviously well within its reach. As the authors point out, this would explain the other information seen in leaked documents, like the NSA's ability to decrypt some secured connections "on command" or eavesdrop on VPN traffic.

This is still just a theory, but it does seem to explain much of what's been uncovered in leaked documents. It also shows the NSA is still doing what the NSA does best: leaving lots of stuff poorly-secured, despite directives otherwise.

Our findings illuminate the tension between NSA’s two missions, gathering intelligence and defending U.S. computer security. If our hypothesis is correct, the agency has been vigorously exploiting weak Diffie-Hellman, while taking only small steps to help fix the problem.

As the authors point out, the NSA has recommended better encryption methods, but no one's in any hurry to adopt them because no one trusts the NSA to recommend a method it hasn't already weakened, if not completely compromised. If there's any truth to what's covered here, the NSA has sat quietly by and allowed researchers to recommend yet another encryption method that it's already made large strides towards defeating. And, once again, we can see that when the word "security" is combined with the word "national," it means something completely different than when it stands on its own.

Filed Under: alex halderman, backdoors, diffie hellman, diffie hellman key exchange, encryption, hacking, https, nadia heninger, nsa, surveillance, vpns