The agency has cracked much of the encryption, or digital scrambling, that guards global commerce and banking systems, protects sensitive data like trade secrets and medical records, and automatically secures the e-mails, Web searches, Internet chats and phone calls of Americans.
Since 2000 when encryption systems started to make an appearance the NSA invested billions of dollars in a clandestine campaign to preserve its ability to eavesdrop. It lost a battle in the 1990s to insert its own “back door” in all encryption, but it realised that if it could do the same thing itself. It then had the advantage that everyone was encrypting their messages unaware that the NSA could read them. Sometimes it did not bother. It just hacked into target computers to snare messages before they were encrypted. Companies were often told that they had to handing over their master encryption keys or building in a back door. The NSA also covertly introduced weaknesses into the encryption standards.
There has been a lot off effort in cracking into the Secure Sockets Layer, or SSL; virtual private networks, or VPNs and the protection used on fourth-generation, or 4G, smartphones. But Dave Anderson, senior director at Voltage Security, said that it was unlikely to be the actual encryption that was hit.
Properly implemented strong crypto systems are one of the few things that you can rely on, he said. But he added that it seems likely that any possible way that the NSA might have bypassed encryption was almost certainly due to a flaw in the key management processes that support the use of encryption, rather than through the cryptography itself. He thinks it was only possible if the cryptography that was used to protect the sensitive transactions was improperly implemented through faulty, incomplete or invalid key management processes or simple human error.
“When properly implemented, encryption provides essentially unbreakable security. It’s the sort of security that would take implausibly-powerful supercomputers millions of years to crack. But if it’s carelessly implemented, and the key management processes are not sound, this security can be reduced to the level where a hacker with a mid-market PC can crack in a few hours at most,” he said.