#Cryptoleaks: what we know, open questions, and a path forward

What we know #

The three media outlets @srf¹ @zdf² and the @washingtonpost³ jointly reported that #CryptoAG from 1970 onwards was owned by the CIA and the German BND, and sold cryptographically weakened devices, based on the internal histories of the CIA and the BND of the operation.

crypto ag.PNG
Image source: WashingtonPost

Between the 1970s and 1990s, the partnership made up for over 40 per cent of NSA’s machine decryptions, and for 90 per cent of BND’s diplomatic product reports.

Who knew? #

The WashingtonPost claims “the documents show that at least four countries - Israel, Sweden, Switzerland, and the United Kingdom - were aware of the operation or were provided intelligence from it by the United States or West Germany.” SRF showed documents claiming that the secret was shared, over the years, with Denmark, France, the United Kingdom, Israel, Netherlands, Sweden, and (unidentified) others (1:20:30h in the Swiss documentary). Yugoslavia had spotted the weaknesses and demanded them to be fixed, according to a Crypto AG engineer, who knows that they were fixed. Notably, this led to discontent on the owners’ sides during the Yugoslav Wars. Austria too noticed the flaw in the devices and stopped using them in the late 1970s, according to a retired Austrian diplomat.

Switzerland #

SRF found an archival file detailing allegations by an ex-CryptoAG engineer from 1977, in which he claimed that CryptoAG is engaged in espionage and fraud by selling devices with manipulated key generators, which allowed the US and West Germany to decrypt the traffic. This is a very specific allegation by a qualified source, which, in my opinion, would have to be taken very seriously by any signals intelligence agency. We do not know, however, whether this message found itself to intelligence.

The Source & Documents #

According to the Swiss journalist Res Strehle, who had previously written a book about Crypto AG and claims to have access to the primary documents, the source seems to be in the orbit of the BND. This would line-up with the on-the-record interview that the ex-intel-coordinator of Germany, Bernd Schmidbauer, gave to the ZDF, in which he took credit for the operation. It would also explain the underlining in the original source documents displayed in the WashingtonPost article.

Note: the documents seem to be operational histories of the HUMINT part of the operation. There exists, presumably, an equally large and compelling story of the SIGINT aspects of this story. The operation to weaken the cypher machines is of no use if you cannot get access to the actual signals (worldwide?). Hence, we have only touched upon the enabling operation and not on the actual spread and use of the outcome.

Open Questions #

General Questions #

Questions for Switzerland: #

A path forward #

The operation dates back to the Cold War, where encryption was used in dedicated devices, mostly by governments (i.e. legitimate targets of espionage). Today, encryption is used as one of the foundations of cybersecurity. Thus, should we demand from intelligence agencies a commitment towards strong, open-standards, cryptography, including a commitment to not undermine key crypto-devices? How would we know that such a commitment is credible?

References #

¹ SRF:
With access from Switzerland (geofenced): https://www.srf.ch/play/tv/rundschau/video/weltweite-spionage-operation-mit-schweizer-firma-aufgedeckt?id=2351eb00-7656-4515-b5f8-615a12083eeb

² ZDF:

³ Washington Post:


Now read this

Readings 2020: James M. Olson (2019). To Catch a Spy

In 2020 I commited to writing short thoughts on my readings (see e.g. on the Austrians). Today it’s to Catch a Spy (2019) by James M. Olson, a former CIA case officer and chief of counterintelligence (CI) at the CIA. The book offers an... Continue →