Non-US Encryption Is 'Theoretical', Claims CIA Chief In Backdoor Debate (theregister.co.uk) 312
Iain Thomson, writing for The Register: CIA director John Brennan told U.S. senators they shouldn't worry about mandatory encryption backdoors hurting American businesses. And that's because, according to Brennan, there's no one else for people to turn to: if they don't want to use U.S.-based technology because it's been forced to use weakened cryptography, they'll be out of luck because non-American solutions are simply "theoretical." Thus, the choice is American-built-and-backdoored or nothing, apparently. The spymaster made the remarks at a congressional hearing on Thursday after Senator Ron Wyden (D-OR) questioned the CIA's support for weakening cryptography to allow g-men to peek at people's private communications and data. Brennan said this was needed to counter the ability of terrorists to coordinate their actions using encrypted communications. The director denied that forcing American companies to backdoor their security systems would cause any commercial problems.
American Companies (Score:3, Funny)
LOL, how quaint. As if a company belongs to a particular nation state. Freemasons 2016, huyah!
Sir Bush, president and knighted...
Can't decide (Score:5, Insightful)
I can't decide if Brennan is stupid, or if he thinks everyone else is stupid.
I readily admit this is not an uncommon reaction of mine when I read of the things presented by elected and appointed officials. The US government is a madhouse.
Re:Can't decide (Score:5, Insightful)
I can't decide if Brennan is stupid, or if he thinks everyone else is stupid.
Judging by the universal cringe displayed by all the analysts and technicians who an actual understanding of crypto, I'd go with "a little of both". I just can't believe he's so clueless as to not understand that math doesn't recognize lines on a map, nor can I quite believe he didn't expect to get called out on his bullshit. Either way, it was a dumbass thing to say.
Re: (Score:3, Informative)
actually i would say he was telling the 100% truth. The target for backdoor is compliant American citizens that would only purchase approved and not legally blocked soft/hardware. This has nothing to do with terrorists, corporations or any one with any knowledge at all.
Re:Can't decide (Score:5, Insightful)
Well, it isn't HIS cluelessness that is the problem here..is the his audience...the US Senators/CongressCritters that he speaks to in these hearings.
See, they are the ones that pass the laws that could mandate weakening software and forcing backdoors.
He may know perfectly well that this is a false and stupid thing to say, but it IS something the TLA's want badly...so, he tells them this and they think that it won't cause harm to US businesses, and they have, instead, just helped to fight the terrorists...and have their constituents be happy about this.
It is the ignorance of the lawmakers that you have to worry about.....and unfortunately they're getting their information from a guy like this, that wants what he wants, no matter the cost to business or the constitution.
Re:Can't decide (Score:5, Insightful)
I can understand how you'd make that mistake, but he's not clueless. It's much worse than that.
He's a man who knows that no one can challenge the power that he's amassed for himself, because the establishment is on his side. Surveillance is just a fact of life now, some people aren't going to give up their Facebook accounts until they die and he's grinning like the shit-eater he really is, because he's getting paid to take away the same freedoms they claimed they were "defending" after September 11th happened. People are legally required to pay money out of pocket straight into the hands of the same people who are supressing their rights to privacy and free speech.
If you knew that you were taken care of for life and there were no consequences to anything you did, no matter how horrendous, how would you act? These are the same people that had pictures of their torture at Abu Ghraib published around the world, a thousand-plus-page report on their methods published around the world and what did people do? Fuck all nothing, that's what. Brennan has that grin because he knows nobody is challenging him any time soon, period.
Re: (Score:2)
Re:Can't decide (Score:5, Insightful)
If he's incompetent, the President should dismiss him from his post. (Executive)
If he's lying, Congress can impeach him.
Being so severely wrong so often is hazardous to your health.
Re: (Score:2)
If he's incompetent, the President should dismiss him from his post. (Executive)
If he's lying, Congress can impeach him.
Being so severely wrong so often is hazardous to your health.
And when neither happens, then similar rules apply to both the President and Congress. This eventually trickles down to blaming the voters. The majority of voters are currently proving that point quite well in their handling of the current presidential election, so this should be no surprise to anyone that's conscious.
Re: (Score:3)
Trump is good at persuasion and negotiation; it's part of business.
You're assuming the average person cares about policy details, facts, and logic... they don't...
The problem comes when you lay out facts and logic in short, concise form in front of someone people look to for leadership, and his only response is, "Uh, I don't believe that." You can get away with that to a very limited degree, even with the authority of popularity behind you; it's impossible to continue to look good when your attacks are cleanly parried and reversed.
Take Trump's talk about immigration, for example. Trump said we
Re:Can't decide (Score:5, Insightful)
I can't decide if Brennan is stupid, or if he thinks everyone else is stupid.
The two aren't mutually exclusive.
Re:Can't decide (Score:5, Insightful)
He thinks enough people are stupid, and, unfortunately, he isn't wrong about that.
Re:Can't decide (Score:4, Interesting)
It's politics, stupid (Score:2, Interesting)
You have to be not actually dumb to get high up in government. But you do have to have a certain capacity to believe in the institutional lies, or at least repeat them as if you mean them. They still institutionally believe in a rather simplistic device to the point that gaming the thing is a criminal offence, for example.
More to the point, this here is politics in action. He is furthering an agenda in front of an audience that made this agenda-pushing their day-and-night jobs, but who do not necessarily ha
Re:It's politics, stupid (Score:5, Insightful)
o U.S. President George Walker Bush.
o U.S. Senator Ted Stevens.
o U.S. Representative Michele Bachmann.
o U.S. Representative Todd Akin.
o U.S. Representative Joe Barton
I rest my case. I could go on, but it's really quite painful to think about.
Re:Can't decide (Score:4, Insightful)
Why does he have to root for a team? The US has a history, especially in cryptography, of assuming that the rest of the world is hopelessly behind them. Remember the export ban on strong cryptography? Remember the t-shirts with the RSA algorithm printed on them? This is just another aspect of the same thing. If the US doesn't provide the crypto, there's nobody else to get it from. Obviously.
Re: (Score:3)
"The US"? Each individual living here? Including all the US cryptographers pointing out how silly this was, and selling T-shirts?
Stereotyping whole countries by their sillier government acts is fine if were doing patriotic trash-talking, like calling people "Murcans" or "cheese-eating surrender monkeys" or "I know he wasn't Canadian, or he would have apologized afterwards". That's just being silly, but if you're going to do that, it's rude not to identify your side.
Re: (Score:2)
It's fairly common custom to use the name of a country when referring to official actions undertaken by that country. For example, "the US invaded Iraq."
In the specific case of a democracy, official policy is determined by the government, which is elected by the citizenry, so collective responsibility for national activities can be ascribed to those citizens, if you're into that kind of thing.
Re: (Score:3)
"Americans" is the collective term for citizens of the United States of America. "'Murricans" is a mild slur of "Americans." Americans are collectively responsible for this ass holding office. As such, he's representing you to the world when he says that the rest of the world is too dumb to implement encryption without American help.
Use of the slur seems reasonable in this case. If you collectively don't like it, get rid of the jerk. If you individually don't like it, stop taking criticism of the colle
Re:Can't decide (Score:4, Insightful)
I see that you use this slur a lot.
If you're American yourself, please stop taking your self-hatred out on those around you. Find a therapist instead.
If not, carry on. Yay patriotism! But do have the courtesy to call out what team you do root for: it's unfair to mock one team without allowing the same in return.
I honestly don't root for any team. IMO all governments are really just organized crime syndicates.
Re:Can't decide (Score:5, Informative)
Not sure where you're getting Sweden from, as Daemen and Rijmen are from Belgium and work at a Belgian university.
Re:American Companies (Score:4, Interesting)
National companies and multi-national companies *do* belong to a nation-state. It doesn't show much, until they need someone to get their potatoes out of some hot fire somewhere. They can't just move and up, since they need ties on a personal level when you get into the big leagues. Not to mention the fact that if they have a lot of infrastructure somewhere, it's also physically difficult to move.
Let's assume corporations don't belong to a particular nation state. Like Disney. Could be Chinese, right? Mi Lao Shu and security guards with pink rifles. Works quite well in Shanghai - they are a minority shareholder though because, for some reason or another, the local company *does* belong to their nation state and the nation state knows it. Or take Coca Cola. Wouldn't hurt the brand at all if it incorporated as a Nigerian company tomorrow, I think. Or Mercedes. It could easily become an Italian brand. Would do wonders for its design, probably. Volkswagen could move to Rumania - their cars have the same amount of pollution as the old cars they have there so they wouldn't stand out so much.
But seriously: no company can do without the protection of a nation state because in the final analysis, a tug of war between competing business interests will eventually be decided with weapons. And that is the job of the nation state. And it will only defend it's *own* companies. Companies that don't have a protector will be at a severe disadvantage. Just consider what the support of the CIA meant for Boeing when it sank lucrative trade deals in the Middle East for Airbus because they had been tapping the trade negotiations and were able to provide tapes that proved corruption. Do you think that would have happened if it had been Airbus versus Dassault? Not a chance.
Lies from Spies (Score:5, Insightful)
Well of course he's going to say this nonsense, no surprise there. What is surprising is hearing about it from a british newspaper without a bleep in U.S. news. I imagine apple, microsoft, google and the likes will have a response soon.
The "response" should be an indictment. (Score:5, Interesting)
Under 18 U.S.C. ss. 1001 [house.gov], lying to Congress is offense punishable by up to five years in prison (or eight if the lie is terrorism-related). The correct "response" to John Brennon's blatant, politically motivated, criminal lie is to indict him, convict him, and send him to Federal prison where totalitarian freedom-hating enemies of the American public like him belong.
Re:The "response" should be an indictment. (Score:5, Insightful)
In theory, yes.
In practice, not a fucking chance.
Re: (Score:2)
Speaking of "in theory," considering what the news is reporting about how the FBI is going after the wife of the Orlando shooter, wouldn't failure to indict make every member of Congress an accomplice?
Re: (Score:2)
No?
Re:The "response" should be an indictment. (Score:5, Insightful)
O course not. They're exempt under the thoroughly time-tested doctrine of "we have wealth and power, so the law doesn't apply to us unless we piss off someone even wealthier and more powerful"
Re: (Score:2)
In theory, yes.
In practice, not a fucking chance.
If "practice" has been reduced to not-a-fucking-chance-in-hell, then US law is nothing more than a "theory".
I really grow tired of the American people supporting criminals who blatantly ignore the law, especially when those same Americans want to bitch about how fucked up things are.
Re: (Score:2, Insightful)
Well, given the fact that the Chinese are at least as smart and as technological advantage as far as public math goes as the Americans, and have more than enough money to do it and more than enough reason to do it, you could actually argue that this guy is advocating for a position where China can break American encryption, while using non-weakened encryption of their own (which there is no reason to believe to be any worse than the best American encryption).
So, well, what is the punishment for high treason
Re: (Score:2)
High-treason is defined in the U.S. Constitution and is punished by execution.
Re: (Score:2)
As much as I would like to see people like him sent off to federal PMITA prison it isn't going to happen. These guys are part of the protected class and they really need to screw over congress. Even spying and hacking into the Senate Intelligence Committee [cnn.com] servers didn't' get them into trouble, so I doubt anything will ever come of this. I just wonder what they have on the congress critters.
Re: (Score:3)
Under 18 U.S.C. ss. 1001 [house.gov], lying to Congress is offense punishable by up to five years in prison (or eight if the lie is terrorism-related). The correct "response" to John Brennon's blatant, politically motivated, criminal lie is to indict him, convict him, and send him to Federal prison where totalitarian freedom-hating enemies of the American public like him belong.
Oh didnt you know?.. 18 U.S.C. ss. 1001 ONLY applies to the unwashed plebs, ie: Joe and Jane Six-pack.. People like Brennon don't have to worry about violating any of those pesky laws..
Re:The "response" should be an indictment. (Score:5, Informative)
The two Senators from my state plus Ron Wyden got emails from me on this issue before I posted on Slashdot. What did you do about it, mister shit-talking anonymous coward?
Re:Lies from Spies (Score:5, Informative)
I find that the Brits generally do a better job covering the US than the US news does.
Re:Lies from Spies (Score:4, Interesting)
There would just be something like cyanogenmod that hits less than a year later. in fact, CM would probably issue a statement that they wont include the back doors.
CM is based on AOSP, and is wholly open source. If your device supports it, then you can use real crypto, while everyone else in the US gets to enjoy fake crypto.
The issue of course, is that you would need to encrypt so much, (because GSM and other hardware assisted crypto would be backdoored, so you have to put real crypto on top) that your battery goes flat very fast.
IMHO, the solution to that is for eurozone countries to mandate denying US variant GSM devices from working in their countries as an issue of national security. The corporate backlash would be intense.
Re: (Score:3)
Gee, you've completely missed Russia and China. Of course both of those nations would probably applaud such a move on the part of the US, because it makes pursuing their desires easier.
It's time to remember the classification of encryption as a weapon, and invoke our second amendment rights, "If encryption is outlawed, only outlaws will have encryption."
Re:Lies from Spies (Score:4, Informative)
Android itself is open source. Anyone can download it. It's mirrored extensively outside the US. In terms of actual devices, by far the largest providers of those are non-American companies.
Android itself uses a linux cryptography library. Those libraries are likewise open source and extensively mirrored. Of the ones that could actually be said to have a particular nationality, most of them are not the US: https://en.wikipedia.org/wiki/... [wikipedia.org].
Seems like Android is an excellent example of how this guy is wrong.
Dumfounded at the ignorance (Score:2)
This halfwit is the best that the US can come up with to head their "intelligence" apparatus?
Re: (Score:2)
What?!? Hey, guess neither of a new the US was an international leader in technology and encryption.
Um, yeah...
Re:Dumfounded at the ignorance (Score:5, Insightful)
When it comes to intelligence agencies, never attribute to ignorance that which can adequately be explained by malice.
Re:Dumfounded at the ignorance (Score:4, Insightful)
He is worse than the terrorists.
Re:Dumfounded at the ignorance (Score:4, Informative)
This halfwit is the best that the US can come up with to head their "intelligence" apparatus?
You wouldn't come up with the same excuse given the following information:
1. You're standing in front of a group of people who consider you the expert.
2. You stand to gain a lot from forced backdoors and the job for your agency becomes far easier.
3. You have almost zero chance of being punished for lying through your teeth.
What would you have said? Personally I would have come up with the exact same thing and sugar coated it by saying all terrorists use all American technology.
Re: (Score:2)
Jobs Creator (Score:5, Funny)
Glad to see that this fellow has figured out how to create new technology jobs in foreign countries. I didn't realize that was his job, but kudos nevertheless.
Re:Jobs Creator (Score:5, Insightful)
What's the saying? "When strong crypto is outlawed in the US, only non-US companies will have strong crypto"?
Re: (Score:2)
That cart has left the horse. US export laws caused much of the cryptography business to move out of the US decades ago.
Only "theoretical"? (Score:2, Informative)
This guy is smoking some premium shit.
He realizes that many of the Nordic area countries in Europe have some really talented crypto people, and that it would take all of about 2-3 years for some seriously competing cryptographic solutions to hit the commercial space, right?
What will his precious 3-letter agency do when everyone stops sitting on inertia, and is compelled to create cryptography outside their control, while all the people in the US are forced to use the shitty crap he insists on-- you know, wh
Re: (Score:2)
"Purely theoretically" you could just take any OSS encryption implementation, audit the living shit out of it to ensure that none of li'l Jonny's backdoors remain and recompile it.
If that takes a WEEK I'd be surprised.
Re: (Score:2)
Be sure to audit your compiler, the compiler used to compile it, 8 layers of firmware/uefi/bios, and the physical CPU itself.
Good thing all mathematicians are American then (Score:5, Insightful)
Well, it's a good thing that all mathematicians have always been and will always be American then.
Re: (Score:3, Insightful)
Re: (Score:2)
No kidding. The current Advanced Encryption Standard in the US (Rijndael) was even created by two Belgian mathematicians.
Re: Good thing all mathematicians are American the (Score:3)
Black Hat Herring (Score:3, Interesting)
The issue isn't whether the rest of the world would use it. The question is how long until the backdoor is hacked. Knowing its there will make it a prime target. Is the US government willing to back up its confidence with a guarantee to reimbursed all losses for everyone using this technology? Only then could the claim that it wouldn't "cause any commercial problems" be at all plausible.
Re: (Score:2)
You do realize that simply ends up being taxpayers footing the bill.
Better to hold CIA director John Brennan, and those congresscritters who support such backdoors personally responsible for the consequences of their actions..
Re: (Score:2)
You do realize that simply ends up being taxpayers footing the bill.
Most people think money is wealth, and don't believe in labor and production. They think you work for money, and don't think about where all the shit they're buying comes from (aside from "CHINA!").
You can't eat money, as much as everyone seems to want to.
Countries outside the US are only theoretical (Score:4, Funny)
Would be only a slight generalization of his view point.
A lot of people think this is how Americans think about the rest of the world.
We've heard it's out there, but it doesn't matter very much, as long as they have a McDonalds, a 7-11, and a Starbucks.
Re: (Score:2)
The irony is that 7-Eleven is a Japanese company.
Isn't GnuPG German? (Score:5, Informative)
Hold up there a minute, Mr SpyMaster. I think GnuPG (open-source implementation of PGP) is German. Or at least: " g10code GmbH, the legal entity employing some of the GnuPG hackers" is German.
My company has been using GnuPG for ten years.
See https://gnupg.org/ .
Re: (Score:2)
Britains GCHQ came up with public key encryption years before others, so its not as if the rest of the world cant do encryption theory...
Re: (Score:2, Informative)
Also AES is based on Rijndael which was created by a couple of Belgium cryptographers lol
Dear Mr. Brennan (Score:2)
Jonny, listen. There is a thing called "compiler". That's a program that lets anyone around the globe take source code, that is like some sort of text that anyone who knows how to program can read (trust me on that one, anyone who can program can read this stuff. Just because you can't doesn't mean nobody else can, there is intelligence outside of your agency on the planet, ya know? Some of it even in people). That source code can also be changed by people who can read it. And then they put that source code
Re: (Score:2)
'Compiler' you say, yeah about that ... https://www.ece.cmu.edu/~gange... [cmu.edu]
Re: (Score:3)
That you audit the compiler first is a given. I mean, no later than this [slashdot.org] it's a given that the first thing you do when auditing source code is auditing the compiler for it.
Re: (Score:2)
Yes and the problem (theoretically) applies even to assembly code on a bare-bone system without an OS. It's actually worse than that for many systems as many have embedded control processors for power control, supporting secure boot etc.
Which is why the idea of open-source hardware is attractive even if it in itself doesn't plug all potential security holes...
what this idiot dont get is (Score:3)
threat assessment (Score:2)
It's not "theoretical." (Score:2)
idioic AND stupid because... (Score:4, Insightful)
No, he's right (Score:5, Funny)
Re: (Score:2)
Hehehehe, nice.
My Apologies (Score:2)
AES is Belgian (Score:5, Informative)
The name of the algorithm behind AES is Rijndael -- a combination of the names of the Belgian cryptographers who developed it.
His utterings are in the running for either biggest lie of the year, or most ignorant.
Re: (Score:2)
Considering how much (Score:4, Insightful)
the various agencies of the US Government tend to lie ( even to Congress ), I'm somewhat puzzled about why they even bother to ask questions of them anymore.
Perhaps Congress should forgo asking questions of the professional liars ( any intelligence agency ) and ask the tech world instead. I'm quite sure the likes of Cisco, Juniper, Apple, Google and many others ( assuming they're not secretly on the Governments payroll ) would have a much different perspective on the issue at hand.
Re: (Score:2)
as an afterthought, it has been shown time and time again that even when they DO have actionable intelligence on a would-be terrorist, they typically fail to act on the information. So, other than spying for different purposes than what they would have us believe, I fail to see the point in giving them access if they're incapable of doing anything with it.
The only thing backdooring encryption will do is ensure the world avoids US made products at all costs. It will likely bankrupt several major companies
Re: (Score:2)
Exactly this. Even if you could somehow, magically, prevent non-backdoored strong encryption from existing (and that would be some serious "rewrite the laws of physics" level magic there), your improved security from terrorists would be exactly 0. However, your vulnerability from criminals exploiting the backdoors for their own nefarious purposes would shoot through the roof. And that's not even getting into government abuse of their backdoor.
That is utter nonsense (Score:3)
For example, AES is a Belgian design. The US has long since lost leadership in this. That is if they ever had it.
Incidentally, when did US TLAs catch any terrorists "coordinating via encryption" the last time? Oh, right, NEVER.
Is he saying that known crypto is broke? (Score:2)
Any possibly that he is actually saying that known crypto algorithms have been broken by the US? I doubt it, but it is interesting to ponder.
Then the tech company becomes non-US (Score:2)
The devil you know (Score:2)
Aiding and Abetting (Score:3)
It would be "aiding or giving comfort to the enemies of the United States" – by encouraging them to take over for the US companies that this type of legislation would kill.
You or I would go to Federal Prison for that.
Gchq (Score:3)
Who actually invented public key encryption first, oh yeah a British fella working for gchq one evening in his head cos he couldnt write it down
Response question (Score:2)
And how long does it theoretically take for some non US entity to grab some existing OSS code out there today, fork it an package it un-crippled?
Re: (Score:2)
Negative twenty years? Lots of open source encryption packages were started by non-Americans and specifically hosted outside the US in the 90s because of US export restrictions.
File under WTF, he seriously said that? (Score:2)
The director denied that forcing American companies to backdoor their security systems would cause any commercial problems.
This is lie, an outright lie [theweek.com], and I hope he was under oath when testifying before congress. Absolute, outright lie! Liar, liar, pants on fire. Everyone email their representative and let them know the director outright lied to their face and cite the CEO of Cisco.
This will hurt American Tech in China. To interoperate, China will steal all corporate America's IP and integrate it into their products.
Dr. Mr. Director of CIA, your reality distortion field is NOT WORKING! I am still in disbelief. This is how
Re: (Score:2)
Re: (Score:2)
'American Companies Dominate' (Score:4, Interesting)
Another article [morningconsult.com] has more of the exchange:
Let's allow the assumption that American companies currently dominate the encryption field. We'll say that's true. How long would that dominance that last if foreign companies used strong encryption and American companies used hobbled encryption left vulnerable to the American government and hackers? Thank goodness for Warner and Wyden for pointing out how idiotic Brennan 's assertion was.
Re: (Score:2)
Let's not. Let's not even allow that COMPANIES dominate any technology. I think the words you want are "worlwide" instead of "American", and "scientists" instead of "companies".
Completely incompetent or lying? No need to answer (Score:2, Insightful)
The AES encryption algorithm is Rijndael, which is Belgian
The runner-up for the contest for becoming the AES standard was Serpent, which was a British/Danish/Israeli collaboration.
Third place went to the Twofish algorithm, designed by Bruce Schneier, a US citizen who happens to be a vocal opponent of backdoors.
The "main" encryption du jour happens to be from outside the USA. The best alternative is also from outside the USA. Of course, the nationality of the creators doesn't matter - the USA is able to make
he is a drooling moron... (Score:2)
Oh dear god, really? This is why we are ineffective. The men in charge are idiots, morons and buffoons.
Re: (Score:2)
The problem with Johnny is that he knows so little that it's hard to say whether he is actually trying to bullshit you or whether he really believes what he says.
Re: (Score:2)
Although it does look like AES 256 has some problems with related key attacks. [iacr.org]
Re: (Score:2)
Re: (Score:2)
It may be time to hav
Re: (Score:2)
Well, banks all over the world use it for the most critical transactions. But since all the money is electronic, I guess in some sense it is "theoretical money" and banking is a "theoretical business".
Re: (Score:2)
Re: (Score:2)
Yeah, I had that thought as well. Except I think I'll start a bank.