Report: NSA defeats many encryption efforts

The agency has been working since 2000 to circumvent encryption through a variety of methods, a news report says

The U.S. National Security Agency has been circumventing many online encryption efforts through a combination of supercomputers, back doors built into technology products, court orders and other efforts, according to a new report from The New York Times and ProPublica.

The NSA has cracked much of the encryption that protects global commerce, banking, trade secrets and medical records, according to the report, which cites documents leaked by former NSA contractor Edward Snowden. The NSA has invested billions of dollars in efforts to defeat encryption since 2000, according to the report.

In addition to deploying supercomputers to crack encryption, the NSA has worked with U.S. and foreign technology companies to build entry points into their products, the report said. The agency spends more than US$250 million a year on its Sigint Enabling Project, which engages the IT industry in an effort to get companies to make their commercial products "exploitable," the report said, citing documents from Snowden.

The report did not name companies that have cooperated with the NSA.

Representatives of the NSA and the U.S. Office of Director of National Intelligence didn't immediately respond to a request for comments on the news report.

In addition, British intelligence agency GCHQ, likely working with the NSA, has been attempting to hack into the protected traffic at Google, Yahoo, Facebook and Microsoft's Hotmail, the report said. GCHQ had developed "new access opportunities" into Google's system, according to a document from Snowden.

The NSA has also been working for years to weaken international encryption standards, the report said. NSA memos appear to confirm that the agency planted vulnerabilities in an encryption standard adopted in 2006 by the U.S. National Institute of Standards and Technology, the report said.

The NSA sees the ability to decrypt information a vital capacity, and the U.S. competes with China, Russia and other countries in that area, according to the documents referenced in the report.

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is

Join the CSO newsletter!

Error: Please check your email address.

Tags GooglesecurityEdward SnowdenU.S. National Security Agencygovernmentprivacy

More about EnablingFacebookGCHQGoogleHotmailIDGMicrosoftNational Security AgencyNSATechnologyYahoo

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Grant Gross

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts