Comments

rdm • August 1, 2014 7:38 AM

The car seat patent looks to me like fallout from having deep access to data about risks affecting americans.

Winter • August 1, 2014 10:10 AM

Is the point of these patents to prevent companies from selling secure equipment? So, if they do, the NSA will sue them?

Nick P • August 1, 2014 10:38 AM

@ Hamza

Itanium uses the shadow stack method. I had no idea it was patented by NSA. Thanks for the info!

Clive Robinson • August 1, 2014 11:46 AM

@ yuri,

That patent by W. Freeman obviously predates the NSA and is if I remember correctly one of the patents the US Gov effectivly stole, from someone trying to sell crypto equipment to the US Gov.

The idea for irregular stepping of rotors was around some time befor that as David Khan’s research showed.

I suspect there will be quite a few other disputed patents in the list, it’s just a matter of fishing them out.

Nick • August 1, 2014 11:55 AM

Here’s one that allows them to calculate a minimal set of changes to edge weights in a graph that will put a chosen node into a shortest path.

https://www.google.com/patents/US8233397

Given the ability to modify the weights used by a routing algorithm (What all was on those “NSA upgraded” Cisco routers?) I see no reason this couldn’t be part of a system to redirect network traffic through monitoring stations. Where have we seen that before?

https://www.schneier.com/blog/archives/2014/07/how_traffic_sha.html

WhatWereTheyThinking? • August 1, 2014 12:14 PM

How long before that list of patents becomes “Top Secret” and anybody holding that information is placed on the terror watchlist?

Or, is this a honeypot to seek out those the spooks believe should be on the terror watchlist.

What are we thinking?

Clive Robinson • August 1, 2014 12:25 PM

@ Winter,

Many of these patents would not be obtainable in jurisdictions outside of the US and are thus not ordinarily enforcable outside of the US.

However your view point might explain why the FBI amongst other US TLA’s gave supposadly secret briefings about what they considered “necessary” patent changes in Europe which included the likes of software and non tangible processes.

Bur it is also something that appears to be currently happening with both the TTIP (US-EU) and TPP (US-PacRim) “ultra secret except to US companies” treaties. Where the US has insisted that even elected politicians of countries that might become party to these trade treaties cannot be told about the ever changing US Corp driven clauses, they are required in effect to “sign blind” or be discriminated against by US trade policy… Some of the terms alow US corps to sue not companies they claim are infringing their patents etc but the governments of those companies, and this is done through US courts. There are atleast 57 of these Investor-State Dispute Setelment (ISDS) cases filed in 2013, a significant percentage are actually where US corps are trying to bust quite legitimate government regulations.

Czerno • August 1, 2014 12:31 PM

I’m surprised that a “secret” service (“no such” agency…) would publish a list of the patents it owns (or claims to own) – but I’m just an Alien in US paralnce, so what do I know ?

In my own Country, and – I guess – other European Nations, there exist such things as “secret patents” that cover inventions made at or owned, or ‘seized’ by the Government during the patenting process before public disclosure, especially those deemed useful to the Military. Yes, i know the concept of a secret patent is oxymoronic, but it’s a fact…

Doesn’t the US legal system also provide for “secret” patents for inventions useful to the Military and whose disclosure is deemed potentially dangerous to national security ? If it does, we could assume the non secret patents listed are NOT the most ‘interesting’ ones.

Clive Robinson • August 1, 2014 12:50 PM

Who realy thinks this patent,

http://www.google.com/patents/US8380485

Is about training linquists? A cursory read sugests it’s for automaticaly transcribing and translating phone calls and the like, without a human being in the loop. Thus the NSA loop hole of “we don’t listen in…” is easily implemented.

Speaking of phone calls this patent would be usefull if you wanted to do very rapid person identification from voice pattern. Thus being able to handle a significant number more identifications in a given time period for a particular “power” of hardware,

http://www.google.com/patents/US8396912

Chris • August 1, 2014 12:56 PM

Stepping rotors might have been english invention, its worldwar2 stuff, and the american used it long time, until some spy gave the sovjets the blueprints. Then some israeli? mathematician had some algorithm which might be mumbo jumbo but I do recall that
and eather that or that the computers did it faster and easier all the machines went obsolete.

“Could very well be that snowden put them back in use 🙂 ”

There are some historical homepages that has all the evolments of the machines with working emulators.
Very cool
One nice link to start with: http://www.cryptomuseum.com/crypto/index.htm

Also this link that mainly has spy crypto from the stasi archives is VERY intresting
and should keep you busy, click on the LINKS page and dont get scared of the german language
its worth it. http://scz.bplaced.net/

Clive Robinson • August 1, 2014 12:59 PM

@ Bruce,

If you find something good, tell us all in the comments

How about you build another DB where such comments could be added in and used to build up capability assesments, or linked to code named technology etc?

Nick P • August 1, 2014 1:19 PM

Anyone interested in spook tech should look at the In-Q-Tel portfolio:

https://www.iqt.org/portfolio/

CIA a long time ago realized government solutions weren’t working out. So, they created this venture capital company that funded private firms that produced government tech with a dual-use property. The sales to companies would pay for ongoing development of each tool, maybe also paying for development of future tools. It’s worked quite well and NSA’s mere patent portfolio looks quite behind them.

One fun thing for readers interested in this thread to do is to compare the NSA patents to both their leaked program capabilities and the In-Q-Tel capabilities. Might broaden the mind as to how they’re being used or could be used.

albert • August 1, 2014 1:54 PM

Patents are a two-edged sword for the NSA. Since the USPTO opened the floodgates for algorithm patents, i.e., math (disguised as ‘method’ or ‘method & apparatus’), scores of technically unpatentable method patents have been granted. If a method is not fully disclosed, then a patent cannot be granted. Many such patents are granted anyway, leaving the task of the determination of validity to the courts.
.
You can bet the NSA has lots of algorithms, methods, and hardware devices that will forever remain classified. I believe @Winter is right; it’s difficult and very expensive to defend against patent infringement suits. Patents are the playground of the big corporations. In addition to stifling innovation, patents effectively restrict development to a few big guys, all of whom have uneasy relationships with the NSA. Some succumb easily (Microsoft), some unwilling (Google), but all, eventually.
.
Since algorithms are patentable, the NSA can use the patent system to ‘regulate’ encryption schemes. Such schemes are disclosed, but disclosure doesn’t affect ‘crackability’ very much.
.
Besides, who wants to piss off the NSA?
.
I gotta go…

Winter • August 1, 2014 2:16 PM

@Clive
“Bur it is also something that appears to be currently happening with both the TTIP (US-EU) and TPP (US-PacRim) “ultra secret except to US companies” treaties.”

No need to invoke TLAs.

The global patent system has long been changed into a system for trade barriers and a US tax on foreign industries. These treaties are needed to enforce more such patent taxes now the USA are losing their hub position in global trade.

Just read that India blew up the treaty.

Mukund Rathi • August 1, 2014 3:37 PM

The car seat patent is a mistake. From the article:

*Correction, July 30, 2014. An eagle-eyed reader (sadly) points out that the NSA did not actually invent a car seat. Becuase of a clerical error, the patent was never changed to refelct the actual asignee, Chrysler Corporation. At the end of this document is a “certificate of correction” from 1993 that was, apparently, never processed. The U.S. Patent and Trademark Office’s Web site still lists the NSA as the car seat’s patent holder.

Anura • August 1, 2014 3:42 PM

@Nick P

I’m currently interested in NTRU. I don’t know how far off general purpose quantum computers are, but I think it’s prudent to start focusing on post-quantum cryptography. I just hate that everything is getting patented; it’s become such a hinderance to progress.

Anura • August 1, 2014 3:53 PM

That said, for abandoned projects I worked on, I went with ECC just because I like Diffie-Hellman which provides both identity verification and key exchange for either online or offline communication (NTRUSign being broken means that you cannot provide authentication without both parties providing a nonce).

Name (required) • August 1, 2014 4:20 PM

What we can see in the list is only the middle of the pile, not cool enough to be classified yet still worth being preserved as a patent.

Nick P • August 1, 2014 7:48 PM

@ Anura

http://en.wikipedia.org/wiki/Post-quantum_cryptography

That’s a decent link on the subject summarizing what we have now. If I were US, I’d offer $100+ million in reward money for anyone that comes up with a new public key method that’s efficient and provably secure from classical/quantum computers. The money would be given after a few years of analysis without problems. Such a large reward might incentivize investment in the basic research that would be necessary.

Meanwhile, I’ll still advocate symmetric systems wherever possible. I’m also a fan of third party protocols. The trick is to put more effort into tamper-resistant, secure computers. The key exchange runs on them. It might even be a secure multiparty protocol run on many types of security-enhanced computers with hardware from different countries. My high assurance SCM design was like that. This horribly inefficient protocol would be used for exchanging master keys between two parties. Master keys would then use symmetric crypto to protect keys used for sessions, authentication, key exchange, etc. A number of us in the security community already do this sort of thing with preshared master keys and secure command tools.

Note: I’ve also used secret splitting with the resulting key pieces sent by a combination of transports, including the postal service. I also used a text and numeric encoding that got rid of the problem where two characters look alike. That and spaces added every 5-6 letters. That helps for the manual entry.

Anura • August 1, 2014 9:08 PM

@Nick P

Wow, someone did some work. Last I looked that page was one or two paragraphs.

Nick P • August 1, 2014 10:04 PM

@ Anura

Yeah. I tried to find my comment listing most of that on this blog but it must have never been submitted. Sometimes I do a lot of previews and think I submitted but I didn’t. Anyway, I resorted to the Wikipedia page with a sigh thinking it would mention 3-4 schemes. Then I behold a huge page of post-quantum crypto information. “Hmm… GREAT!”

Nick P • August 1, 2014 10:18 PM

re NSA using patents on the attack

I should note advice from our blog’s hardware guru: steal the stuff and hide it in your product. If they notice it and you’re barely successful, then they probably won’t put any effort into going after you. If you’re making money, you’re dominating a new market they barely get and have better negotiating terms. Or they’re wanting money and you’re making enough to give them some if they win in court. Just make sure you avoid patenting it in the USA to beat triple damage style rules and ensure a US attack goes through international scheme, isolating its effects to just US. He also said it’s best not to do business in US as you can make plenty of money elsewhere without the problems.

He wasn’t talking about the NSA. Yet, that strategy might work to a degree. You build chips the accomplish something while hiding the specifics (besides select reviewers). They start selling enough to pay back the development and give you lawyer/security money. You’re based outside the US and not dependent on them. Worst case scenario, assuming you’ve avoided subversion, is you loose your main U.S. market and still make some money via a black market of people smart enough to pay good money for what you offer. If you hit rock bottom altogether, you’ve got a design worth putting on the Internet to give them the big middle finger. So, the strategy has some value even against the NSA.

Clive Robinson • August 2, 2014 3:21 AM

@ Nick P,

Whilst going abroad was still viable just a few years ago it is not going to be the case very much longer, arguably it’s not even viable today.

The reason is that the US are pushing trade treaties via the WTO and other negotiating platforms. In these treaties despite the desperate attempts of the US Gov at the very highest level to keep it secret, it’s been shown that there are ISDS requirments that basicaly favour US Corps over not just other states companies but also the states legislation. Currently the US are pushing these ISDS time bomb laden treaties into Europe and the Pacific Rim, using the usual faux investment carrot and military stick. If successful now doubt it will be “coming to every other nation near real soon”.

Thus there is a lot more than cockroach slime oozing out from under the rocks of the “usuall –DHS and DOJ– suspects” with the MIC propensity of being “on the make”, it is now a game for all major US corps to play “like good old boys in the southern states” where by far the majority of US presidents come from. As was observed a few years ago when the “Kippling ‘White Man’s Game’ question” was raised post-9/11 “The US want’s all the benifits of Empire, but none of the costs or moral obligations of Empire”.

However all of these patents are paid for by the US tax dollar, and the research they are based on was paid for by the US tax dollar, and the US has legislation with regards the open and unncumbered availability of “The Fruit” of tax dollar paid for research and other activities. Thus a clever lawyer may well be able to argue the case that the tax payer owned NSA portfolio be made available unencumbered to US companies and other entities that pay US tax…

Thus it may still be possible to set up an “entity structure” where by the use of these patents by a US entity becomes “licenced for use” in products produced by an entity in another country but with out the TLA issues that apply only to US jurisdiction currently. However, the question then arises as to when –not if– the US starts to walk down the path the Russian Government are currently “trail breaking” –under Putin’s less than delicate touch– what effect it would have on an entity structure using licencing as a “fire break” method on information.

Wesley Parish • August 2, 2014 4:04 AM

I was under the impression that in the US, anything made on the public dollar was public domain. At least that’s the impression several years reading and re-reading Groklaw left me.

I think that since these patents were made on the public dollar, that they are invalid, lock-stock-and-barrel.

65535 • August 2, 2014 11:04 AM

@ Jason

This looks like an escrow key system allowing the NSA to identify the sender of an encrypted x.509 message and then get the “escrow key” to decrypt the message [or some how forming it via the Galois Field in a x.509 certificate – the x.509 certificate, or it contents including the escrow key, is presumably gotten from the Certificate Authority who issued it by the NSA or other TLA].

With the “escrow key” the NSA may be able to forge a session key to decrypt encrypted messages via a MITM attack or other methods.

This “Galios Field” is assumed to be in all SSL/TLS Certificates by any Certificate Authority who created and sold the SSL/TLS certificate to a user.

@ Nick P, Clive, and Bruce S. and others who are experts in cryptography,

Is this NSA invention an actual method of decrypting SSL/TLS messages on the fly – or is it just a theory that doesn’t really work?

There appears to be a “Galois Field” in the IETF’s X.509 PKI RFC. The “Galois Field” is mentioned many times the NSA patent US 5631961. Could this Galois Field be the method of decrypting message by the NSA?

Would this method necessitate the NSA getting certain information from all CA’s under their jurisdiction?

Would this Galois Field work on PGP or other non-x.509 certificate style of encryption?

Dose the Galois Field work on Perfect Forward Secrecy enabled SSL/TLS encryption?

[US 5631961 A]
http://www.google.com/patents/US5631961

“Field of the Invention”

“This invention relates to a device for and a method of cryptography and, more particularly, to a device for and method of cryptography that allows third party [Possibly the NSA] access to encrypted messages between a first and second party.”

“SUMMARY OF THE INVENTION”

“The object of the present invention is to eliminate the vulnerability of losing a secret key via reverse engineering from an encryption device. This object is realized by disclosing a encryption device and method that uses public-key techniques to encrypt and store the secret key. The secret key is encrypted using a commutative one-way function that makes the secret key irretrievable without knowing the associated decryption algorithm.”

“For an escrowed encryption system to work, more than a sender and a receiver may be involved. There may be an authority who signs public keys, an authority who signs secret keys, and escrow agents who hold parts of the secret keys.
The present invention envisions at least three parties to an encrypted communication, a sender, a receiver, and a third party who may eavesdrop on the communication between the sender and the receiver. The sender and receiver are each given an element g in a field (e.g., a Galois Field), a public device unique key Yi that is unique to each device, and a public family key Yf that is known by all users of the present invention. The sender and receiver agree on a session key sk that will be used to encrypt and decrypt a communication between the sender and the receiver…”

http://www.google.com/patents/US5631961

‘RFC 2459’

http://www.ietf.org/rfc/rfc2459.txt

[Relevant portion of the x.509 RFC]

“DomainParameters ::= SEQUENCE {
“p INTEGER, — odd prime, p=jq +1
“g INTEGER, — generator, g
“q INTEGER, — factor of p-1
“j INTEGER OPTIONAL, — subgroup factor
“validationParms ValidationParms OPTIONAL }

“ValidationParms ::= SEQUENCE {
“seed BIT STRING,
“pgenCounter INTEGER }

“The fields of type DomainParameters have the following meanings:

“p identifies the prime p defining the Galois field…”

http://www.ietf.org/rfc/rfc2459.txt

Anura • August 2, 2014 12:58 PM

@Wesley Parish

That’s true for copyright (although I’m not sure how that works if the government contracts the work out), but I don’t think a public domain concept exists for patents. However, I don’t think it makes sense for the government to own patents.

Mocae • August 2, 2014 1:02 PM

Are there any reliable calculations on whether or not AES256 would resist quantum computing brute force cracking, and, if so, how many bits we’d need on the passphrase for reasonable peace of mind?

Anura • August 2, 2014 1:54 PM

@Mocae

Symmetric algorithms are not especially vulnerable to quantum computing, but there are algorithms that can effectively halve the key length. 64 bit keys are possible to break in a reasonable time with enough computers today, but when quantum computers are first available they will be really expensive and the actual execution speeds will be much slower, to the point where 128-bit keys are not going to be feasible to break for probably a matter of decades after they first become available, and even then they will only be worth it for very high value targets. Even then, most high value systems use 256 bit keys, which will probably never be directly brute forcible.

If AES is to be broken, it will be through traditional cryptanalysis and not breakthroughs in technology.

Benni • August 2, 2014 3:35 PM

@65535 That TLS is referring to a galois field might not mean much, since a galois field is present in diffie hellman.

But can somebody who is more used to TLS than me weigh in and compare TLS with this NSA encryption patent?

Benni • August 2, 2014 3:55 PM

In order to be more specific, mathematically speaking, diffie hellman is this:

A galois field GF(p) is the field (Zp,+,*), where Zp are the residues modulo p and + and * are addition and multiplication module p, necessary and sufficient is the requirement that p is the power of a prime.

1) let g the generating element regarding to * of a subbield U of GF(p), and q is the order of U.

2) A generates a random number x between 1 and q including 1 and q.
3) A computes e=(g^x) mod p
4) B generates a random number y between 0 and q, including 0 and q.
5) B computes f=(g^y) mod p
6) A sends e to B which recives e
7) B sends f to A which recives f
9) A computes k = (f^x) mod p = (g^yx) mod p.
10) B computes k = (e^y) mod p = (g^xy) mod p.

I hope I translated the mathematical names from german to english correctly.

Anyway, in order to do this computation, you have to announce p and q, where g is the generating element of a subfield of the galois field….

So that IETF announces a galois field is not surprising…

Benni • August 2, 2014 4:02 PM

Actually, what this patent is, is described in the patent itself:

“Federal Register Vol. 59, No. 27 announced approval of Federal Information Processing Standards Publication 185 (FIPS-185), Escrowed Encryption Standard (EES). This standard specifies a technology developed by the Government of the United States of America for providing strong encryption of unclassified information and to provide for escrowed keys.”

I think it just shows that NSA had patented their clipper_chip.

Please note that they write about a “device id” several times….

http://en.wikipedia.org/wiki/Clipper_chip

Anura • August 2, 2014 4:04 PM

Galois field is just a mathematical concept. AES S-Boxes are based on inverse multiplication in a Galois field, Twofish uses matrix multiplication in a Galois Field, it’s heavily used for error correcting codes, Galois Counter Mode (a very fast mode of operation that provides message authentication), Diffie-Hellman is done in finite fields, ECC is done on Galois Field. The important thing about them is Galois Field 2^n is very efficient on computers, since addition is just the XOR operation; newer intel processors have special instruction sets to allow efficient multiplication in GF(2^n) which can be used to speed up ECC and Galois Counter Mode encryption.

https://en.wikipedia.org/wiki/Finite_field_arithmetic

In that patent, there is nothing you have to worry about with TLS. That’s for an encryption protocol with a backdoor that would be very obvious if implemented, and is probably targeted at something like cell phones.

Anura • August 2, 2014 4:14 PM

“The important thing about them is Galois Field 2^n is very efficient on computers, since addition is just the XOR operation”

That was extremely poorly worded. There are a lot of reason why they are important, like being finite fields – this means that math in GF(2^8) always produces results in the range 0-255, regardless of exponentation, addition, subtraction, or multiplication, and multiplication by a non-zero constant is always invertible.

Twofish and AES use multiplication by a 4×4 matrix in GF(2^8) (which operates on a 32-bit integer) for diffusion, since it’s easy to find invertible matrices such that if you change one input byte every output byte changes (and if you change k inputs then a minimum of (4-(k-1)) outputs change).

Vance • August 2, 2014 4:46 PM

@Czerno

Believe it or not, even today the presumption in the U.S. is that government information is considered to be collectively owned by the people, not the private property of government officials. As an example, works created by the U.S. government are not eligible for copyright. Also, subject to a list of exceptions, any government document can be requested and obtained under the Freedom of Information Act (FOIA). In practice, FOIA doesn’t result in quite the level of transparency one would like, but at least the principle is established.

To address your question directly, yes, the U.S. Patent and Trademark Office can keep certain patents and applications secret on the grounds of national security. The ones in this database are those that have been made public.

Anura • August 2, 2014 9:18 PM

The guy that does calendars messed up and accidentally added an extra leap year; to compensate there was no Friday this week.

Andrew • August 3, 2014 2:37 AM

I have to tell you that strange things happened to me yesterday, after I have searched several patents. My home router has some kind of random behavior, not connecting to some sites time to time, my phone drained a lot of power in standby, then when I tried to call someone I’ve got ‘not registered on network” error message (never had this before), even more, looks like someone was looking for my name on Google. Of course, it could be a coincidence, but I think its not. Just wanted to let you know.

Czerno • August 3, 2014 5:25 AM

@Vance : thank you ! Now waiting for a Snowden disclosure of the NSA’s portfolio of sekrit patents !

@Incredulous “No squid post?” – This one suffices, isn’t the NSA a big squid of sorts ?

Nick P • August 3, 2014 6:13 AM

@ Incredulous

Squid posts don’t expire. You can always post to the most recent one.

Nick P • August 3, 2014 6:19 AM

@ Czerno

The vast majority of patents under that law are by defence contractors doing classified work. I’d be interested in seeing the civilian work that made the list. I’ve long known about the “black patent” problem and it’s one of the reasons I used trade secret law instead. It has other benefits as well.

Benni • August 3, 2014 12:19 PM

As there is no squid post:

Now DER SPIEGEL is getting is grip on the Israeli secret service:

http://www.spiegel.de/international/world/israel-intelligence-eavesdropped-on-phone-calls-by-john-kerry-a-984246.html

“Wiretapped: Israel Eavesdropped on John Kerry in Mideast Talks”
SPIEGEL has learned from reliable sources that Israeli intelligence eavesdropped on US Secretary of State John Kerry during Middle East peace negotiations. In addition to the Israelis, at least one other intelligence service also listened in as Kerry mediated last year between Israel, the Palestinians and the Arab states, several intelligence service sources told SPIEGEL. Revelations of the eavesdropping could further damage already tense relations between the US government and Israel.

Benni • August 3, 2014 2:15 PM

Interesting:
http://www.spiegel.de/politik/deutschland/merkels-handy-bundesregierung-erwog-harte-konsequenzen-a-984162.html

After noting that Merkel’s mobile was tapped, the government discussed the following measures:

summon the ambassador,
trying to get a no-attack declaration of the US government,
trying to get a no spy agreement

additionally, they thought of stopping consultations with amerikan government employees for several weeks

The question whether the free trade agreement between eu and germany which is now in discussion. should be abandoned was answered by: unlikely, but security of electronic communications should be put on topic.

Additionally they wanted to give the 5000 most important german law makers cryptophones.

Then they thought about filing a lawsuit against US at the prosecutor general, which they did several months afterwards.

And then they even thought about questioning Edward Snowden. They thought that this would only be possible in russia because of security reasons.

Indeed, If Snowden would come to germany, I would immediately be put in a temporary prison, where a judge would have to decide whether Snowden should be extradicted. As there is a german law, saying that extradictions are impossible because of political crimes, which is what Snowden did, Snowden would be set free in a very short time. Note that Interpol also rejects to put somebody on its wanting list because of political crimes.

However, the americans have military bases in the US. The german government never could protect Snowden against finding nice “colleagues and friends” in germany, who, after some time, give Snowden a sleeping pill in his glass, and then drive him to their base Rammstein, and when Snowden wakes up he finds himself on an aeroplane flying right towards US. Since the americans coordinate their troop transports from Afghanistan to the US via Rammstein, the germans could not block Snowden’s rendition aeroplane from landing in germany, since it would perhaps be disguised as a regular troop transporter…

In order to counter this, Snowden would probably need bodyguards from the police for his entire life in germany. This is in fact possible. Once in germany, Snowden would just have to go to police and then make a credible case that he is in danger of assassination or something. I just do not know whether Snowden would want this, police officers following him around every day.

DB • August 3, 2014 6:00 PM

@ Benni

Yeah, you’d think that Germany would have to follow their laws and not extradite Snowden because his crime was “political” in nature… but you would also think that the USA would NOT commit acts of war against random South American countries in its quest to get him, yet they did just that via several different European puppets, so who knows what kind of favors they might call in from Germany and other coercion tactics to make them go against their own laws… At this point I see the US government as a totally out of control entity willing to go to ANY length to do what it wants.

Benni • August 3, 2014 7:10 PM

” so who knows what kind of favors they might call in from Germany”

From germany? They could expect nothing in that direction. German authorities do not work this way. Extraditions are not a political matter, just a juridical, like ordinary police work. In germany, such things are decided by judges who follow the book and police man who follow the book and nothing else. German clerks do only follow the book, since they do not know anything else. The book that they follow in these matters, the extradition law, was created in germany 200 years ago and it forbid extraditions because of political crimes. No, a german law which basically has not changed in two world-wars is not altered by the US government anytime soon. Neither will there be there any changes in how they apply this law, probably for the next 200 years.
Here is an article of a german law professor, coming to the clear conclusion that an extradition is completely off the table would snowden touch german ground:

http://www.zeit.de/politik/deutschland/2014-05/snowden-auslieferung-nsa-untersuchungsausschuss-gazeas

The german government has asked questions to the US government why they want snowden to be extradited. It did not get answers yet. The german government was asked to publish these questions, but the german government answered that it could not publish the questions, because this would show sensitive information on the juridical standards of the united states. The german government wrote that it could endanger future extraditions to the united states, if this information became public (i.e. they fear that they could not extradite anyone to the US after it becomes known the US is a country of low juridical standards, like some african country or north korea)

https://netzpolitik.org/2014/informationsfreiheits-ablehnung-des-tages-antwort-der-usa-wird-beeinflusst-wenn-frage-oeffentlich-wird/

A more reasonable problem is that during Snowden’s flight to germany, they could stop the airoplane if it is flying over Poland. Poland even took place in Iraq war with 2.500 soldiers. And I do not know whether they have judges that are as independent as in germany.

And then, once snowden arrived at german ground, the problem would be that germany could not protect him reliably against illegal CIA renditions.

There already was an american double agent that was kidnapped and flown out of germany to the US. This went over an ordinary german airport. The CIA guys went out of some large car, kidnapped the double agent, put him in the car, drove to the airport, where a chartered jet was waiting, flying him to america:

http://www.focus.de/politik/deutschland/agenten-sechs-cowboys-gegen-kid_aid_164525.html

German authorities did not know anything about this. “The US agents behave like Cowboys here, says a high ranking official from the german domestic secret service for the protection of the constitution”

This was also mentioned by the german minister for economy:

https://netzpolitik.org/2014/asly-fuer-snowden-oder-warum-koennte-deutschland-ihn-nicht-schuetzen/

“germany is a small country where the US government knows who is doing what. I am sure that the american secret service would try to get Snowden in his control once he touches german ground. Who is guaranteeing that he would live securely in germany”

DB • August 3, 2014 9:48 PM

@Benni

As an American myself, I would not be so courteous to say that “US agents behave like Cowboys”… I’d say something like “US agents behave like rabid animals, respecting no borders, treaties, laws, human rights, or morals, committing acts of war on our soil whenever they please.”

You are probably right that this is the bigger and more likely problem Snowden would face, but after seeing so many formerly-proud countries become US puppets I’m not holding my breath with the other either… no offense meant to the German people, I wish them well and hope they really would stand up to evil US aggression as much as Russia has…

So if Germany asked Snowden to go to Germany, do you think they would they send warplanes to escort him there, with orders to fire on any country that tries to interfere (even the US or Poland)? This kind of thing is actually the only way I see him ever getting out of Russia safely, that is, until there are major changes here in the USA.

Benni • August 4, 2014 12:10 AM

@DB, I think this gets off topic, we should continue this on the squid thread:

But, well, there would be a safe way to extract snowden per plane. But this would not be a regular airliner, but a plane that flies over the sea. If no country except from germany and russia are overflown, then no jurisdiction could force the plane to land. The german government could do this if it wanted, for example with its BND aircraft, provided the russians would let that plane into their aerospace.

At the moment, according to spiegel, Snowden is not a wanted person in germany, and thereby he would be able to move around freely. The german police would only be interested in him, if the government passed the extradition request to the them. But at the moment, it did not. Instead the german government send further questions to the US, implying that, without additional details of the crimes that snowden is supposed to have done, the extradition request is invalid. Up to now, the german government did not receive any answers from the US that would render their extradition request valid. Indeed given what Snowden did, extradition is completely off the table.

The problem is illegal kidnapping. Germany is a free country. When you walk down an empty road in the night, you can be kidnapped by professional agents without anyone noticing anything.

For example, here is Jacob Appelbaum, claiming that agents broke into his flat:

http://www.dw.de/snowden-ally-appelbaum-claims-his-berlin-apartment-was-invaded/a-17315069

Snowden would have to go to police, saying he needs bodyguards.

TKS • August 4, 2014 8:41 AM

I’m more concerned about the techniques NOT patented (means they don’t want others to know about them).

enki2 • August 4, 2014 1:35 PM

I’d like to point out that patents are valid for only fifteen years, and that patent protection prevents only commercial use of techniques disclosed in the patent documents. In other words, when the NSA patents something, any hobbyist can go out and read the patent then re-implement it from the description (but a corporation cannot re-implement it from the description then mass produce it to sell, or sell services that depend upon it). So, I applaud whoever in the NSA is going out and pushing in-house developed technology to be patented — particularly if the patent is invalidated quickly (or if it is only ever published as a preliminary patent).Because patent offices tend to suck at research, preliminary patents are the best thing to happen. If you file a preliminary patent, the filing immediately goes into the public domain, and unless you then file an official patent within a year (which would get you patent protection), nobody can ever patent the same thing again — in other words, the invention is immune to patent protection. Furthermore, major patent offices tend to look at each other’s filings for prior art even if they do not themselves enforce those patents — so that someone cannot import american patents to the EU and claim them as his own unless he also owns the US equivalents; filing a preliminary patent means no one can ever gain a world-wide or local state-sponsored monopoly on that invention.

This isn’t quite as good as a leak, but it’s evidence of at least some good will inside the NSA community (and there are definitely some good people stuck in that meat grinder). Since everything in that document having a publication date prior to August of 1999 is completely unprotected, we can hardly criticize the bulk of it!

65535 • August 7, 2014 4:44 AM

@ Benni and Anura

Thank you for the explanation. I don’t see the patent as being very useful in breaking encryption.

I took another direction. I look in to the “Escrow keys” and there doesn’t seem to be any viable database for said “escrow keys”. So, that patent would not be very useful. I do think FIPS-185 is non-disclosed or possibly classified – I can’t find the text.

[Clipper chip not widely adopted]

“Clipper chip was not embraced by consumers or manufacturers and the chip itself was no longer relevant by 1996. The U.S. government continued to press for key escrow by offering incentives to manufacturers, allowing more relaxed export controls if key escrow were part of cryptographic software that was exported. These attempts were largely made moot by the widespread use of strong cryptographic technologies, such as PGP …” – Wikipedia

https://en.wikipedia.org/wiki/Clipper_chip

It maybe possible that the NSA has somehow copied or forged every certificate from all major Certificate Authorities [CA’s] within their jurisdiction and stored the certificates in a database – but that leaves a lot of other keys to obtain. So, this patent doesn’t look that dangerous.

I am still concerned about the media reporting that the NSA can break most encryption. The NSA must break it by side-channel attacks, key logging or other tricks [I assume that goes for CALEA attacks]. That would include Bullrun and Edgehill:

“By 2010, the NSA had developed “groundbreaking capabilities” against encrypted Internet traffic. A GCHQ document warned however “These capabilities are among the Sigint community’s most fragile, and the inadvertent disclosure of the simple ‘fact of’ could alert the adversary and result in immediate loss of the capability.” Another internal document stated that “there will be NO ‘need to know.’” Several experts, including Bruce Schneier and Christopher Soghoian, have speculated that a successful attack against RC4, a 1987 encryption algorithm still used in at least 50 per cent of all SSL/TLS traffic is a plausible avenue, given several publicly known weaknesses of RC4. Others have speculated that NSA has gained ability to crack 1024-bit RSA and Diffie Hellman public keys.” -Wikipedia

https://en.wikipedia.org/wiki/Bullrun_(decryption_program)

Dan Fingerman • August 7, 2014 3:30 PM

I was struck by how many of these NSA patents name a single inventor. The percentage of U.S. patents with one inventor has been declining for many years. Today, less than 1/3 of U.S. patents name a single inventor. These graphs summarize the data:

http://patentlyo.com/patent/2013/01/inventors.html
http://patentlyo.com/patent/2009/07/the-changing-nature-inventing-collaborative-inventing.html

I skimmed a (very nonrandom) sampling of these NSA patents, and the percentage with one inventor was around 60%. I looked mostly at the patents near the top of the list, which are the most recent — the time period when you would expect the lowest percentage of one-inventor patents. The NSA’s rate of one-inventor patents is almost double the “normal” rate of one-inventor patents. Maybe this stems from compartmentalizing of information and work within the agency, which might limit teamwork?

MGS • February 21, 2015 9:49 PM

Me? deep into the Shadow Master’s eternal network. I have been placed on a watch list. Why? the government believes I am holding “Top Secret” information; classified quantum Alien Secrets, at the very highest level, deemed useful to the military. I’m sure Government Agents will probably crack my mind’s “id”; like “the Matrix”, to speed up protocol. Coincidence? This is evidence of a Black secret spy service, and they’re disguised as police. I’m in danger of assassination. Just wanted to let you know.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.