Feds Put Heat on Web Firms for Master Encryption Keys
The U.S. government has attempted to obtain the master encryption keys that Internet companies use to shield millions of users’ private Web communications from eavesdropping.
But an increasing amount of Internet traffic flowing through those fiber cables is now armored against surveillance using SSL encryption. Google enabled HTTPS by default for Gmail in 2010, followed soon after by Microsoft’s Hotmail. Facebook enabled encryption by default in 2012. Yahoo now offers it as an option.
“Strongly encrypted data are virtually unreadable,” NSA director Keith Alexander told (PDF) the Senate earlier this year.
Unless, of course, the NSA can obtain an Internet company’s private SSL key. With a copy of that key, a government agency that intercepts the contents of encrypted communications has the technical ability to decrypt and peruse everything it acquires in transit, although actual policies may be more restrictive.
If the government obtains a company’s master encryption key, agents could decrypt the contents of communications intercepted through a wiretap or by invoking the potent surveillance authorities of the Foreign Intelligence Surveillance Act. Web encryption — which often appears in a browser with a HTTPS lock icon when enabled — uses a technique called SSL, or Secure Sockets Layer.
Top secret NSA documents leaked by former government contractor Edward Snowden suggest an additional reason to ask for master encryption keys: they can aid bulk surveillance conducted through the spy agency’s fiber taps.
One of the leaked PRISM slides recommends that NSA analysts collect communications “upstream” of data centers operated by Apple, Microsoft, Google, Yahoo, and other Internet companies. That procedure relies on a FISA order requiring backbone providers to aid in “collection of communications on fiber cables and infrastructure as data flows past.”
Leaked NSA surveillance procedures, authorized by Attorney General Eric Holder, suggest that intercepted domestic communications are typically destroyed — unless they’re encrypted. If that’s the case, the procedures say, “retention of all communications that are enciphered” is permissible.
