One of the most worrying, but certainly not surprising, things is that the NSA can bypass almost any encryption. The surprise may be in one of the ways it does this.
The latest leaks indicate that it works closely with most (apparently all) major software vendors to leave backdoors and vulnerabilities in their products, ensuring that the NSA will always have a way to break into the system it wants.
It can now be assumed that all commercial encryption software, especially from US companies, has been compromised or is vulnerable.
The NSA spends about $250 million a year trying to persuade or coerce the companies that make this software to allow some kind of side access to the service or trying to influence the design of their software so that it is vulnerable to attack. This can be done with cash, threats of destruction of the business, or even without the company's knowledge.
The NSA aims to “introduce vulnerabilities in commercial encryption systems.” These vulnerabilities make it possible for the NSA to decrypt communications in real time or near real time.
“The changes to the design of the encryption products make these systems exploitable via Sigint [signals intelligence] if someone knows about the modification in advance. However, for the consumer, the security of the systems remains intact,” the leaked document states.
The big problem with this is that apart from the fact that the US government can spy on anyone it wants, the same vulnerabilities, if known, can also be exploited by anyone, such as criminals, foreign governments and so on.
The NSA hopes that all of these vulnerabilities will remain secret, just as it has with its secrets.
