NSA Reportedly Exploited Heartbleed For Spying — But Strongly Denies the Allegation

Because the agency hasn’t already reportedly done enough.

National Journal
Matt Berman and Dustin Volz
Add to Briefcase
See more stories about...
Matt Berman and Dustin Volz
April 11, 2014, 11:20 a.m.

When it bleeds, it pours.

The Na­tion­al Se­cur­ity Agency re­portedly knew of and ex­ploited the massive In­ter­net bug re­vealed to the pub­lic this week and known now as “Heart­bleed” in or­der to gath­er in­tel­li­gence in­form­a­tion on tar­gets.

This new rev­el­a­tion packs an ex­tra twist that oth­er re­cent NSA leaks have lacked: Re­gard­less of its pur­pose for in­tel­li­gence gath­er­ing, the NSA may have known for years about a his­tor­ic se­cur­ity flaw that may have af­fected up to two-thirds of the In­ter­net. In­stead of try­ing to re­pair that flaw—which has po­ten­tially im­pacted count­less people—the NSA re­portedly ma­nip­u­lated it in secret.

“Put­ting the Heart­bleed bug in its ar­sen­al, the NSA was able to ob­tain pass­words and oth­er ba­sic data that are the build­ing blocks of the soph­ist­ic­ated hack­ing op­er­a­tions at the core of its mis­sion, but at a cost,” Bloomberg first re­por­ted Fri­day, cit­ing two people “fa­mil­i­ar” with the mat­ter. “Mil­lions of or­din­ary users were left vul­ner­able to at­tack from oth­er na­tions’ in­tel­li­gence arms and crim­in­al hack­ers.”

In a state­ment late Fri­day af­ter­noon, the NSA denied the Bloomberg re­port. “NSA was not aware of the re­cently iden­ti­fied vul­ner­ab­il­ity in OpenSSL, the so-called Heart­bleed vul­ner­ab­il­ity, un­til it was made pub­lic in a private-sec­tor cy­ber­se­cur­ity re­port,” said agency spokes­wo­man Vanee Vines. “Re­ports that say oth­er­wise are wrong.”

In a fol­low-up state­ment, NSC Spokes­per­son Caitlin Hay­den said that the Obama ad­min­is­tra­tion “takes ser­i­ously its re­spons­ib­il­ity to help main­tain an open, in­ter­op­er­able, se­cure and re­li­able In­ter­net. If the Fed­er­al gov­ern­ment, in­clud­ing the in­tel­li­gence com­munity, had dis­covered this vul­ner­ab­il­ity pri­or to last week, it would have been dis­closed to the com­munity re­spons­ible for OpenSSL.”

Un­like pre­vi­ous state­ments about al­leged NSA activ­it­ies, the state­ments made by the NSA and White House today are defin­it­ive, with little room for dif­fer­ing in­ter­pret­a­tions.

The Heart­bleed bug was re­vealed pub­licly for the first time earli­er this week, and has been de­scribed by nu­mer­ous cy­ber­se­cur­ity ex­perts as one of the worst se­cur­ity glitches the web has ever en­countered. Heart­bleed is caused by a minor two-year-old flaw in soft­ware cod­ing of a pro­gram known as OpenSSL that is meant to provide ex­tra pro­tec­tion to web­sites.

Con­sid­er­able at­ten­tion has been paid to Heart­bleed’s po­ten­tial use by crim­in­al hack­ers to col­lect war chests filled with on­line pass­words, per­son­al in­form­a­tion and bank­ing data, but it re­mains un­clear wheth­er any such bad act­ors knew of or ex­ploited it pri­or to its dis­clos­ure. A fix was rolled out five days ago, but con­cerns per­sist that much of the In­ter­net’s se­cur­ity has been com­prom­ised.

Some In­ter­net free­dom and pri­vacy groups began spec­u­lat­ing that in­tel­li­gence agen­cies may have ex­ploited Heart­bleed for sur­veil­lance pur­poses shortly after news of the bug broke earli­er this week. The Elec­tron­ic Fron­ti­er Found­a­tion sug­ges­ted earli­er ex­ploit­a­tions of the bug de­tec­ted in Novem­ber of last year “makes a little more sense for in­tel­li­gence agen­cies than for com­mer­cial or life­style mal­ware.”

Earli­er Fri­day, the De­part­ment of Home­land Se­cur­ity is­sued guid­ance on Heart­bleed, say­ing that “every­one has a role to play to en­sur­ing [sic] our na­tion’s cy­ber­se­cur­ity.”

This post was up­dated Fri­day af­ter­noon after the NSA state­ment was re­leased.

What We're Following See More »
TRUMP CONTINUES TO LAWYER UP
Kasowitz Out, John Dowd In
6 hours ago
THE LATEST

As the Russia investigation heats up, "the role of Marc E. Kasowitz, the president’s longtime New York lawyer, will be significantly reduced. Mr. Trump liked Mr. Kasowitz’s blunt, aggressive style, but he was not a natural fit in the delicate, politically charged criminal investigation. The veteran Washington defense lawyer John Dowd will take the lead in representing Mr. Trump for the Russia inquiry."

Source:
ALSO INQUIRES ABOUT PARDON POWER
Trump Looking to Discredit Mueller
6 hours ago
THE LATEST

President Trump's attorneys are "actively compiling a list of Mueller’s alleged potential conflicts of interest, which they say could serve as a way to stymie his work." They plan to argued that Mueller is going outside the scope of his investigation, in inquiring into Trump's finances. They're also playing small ball, highlighting "donations to Democrats by some of" Mueller's team, and "an allegation that Mueller and Trump National Golf Club in Northern Virginia had a dispute over membership fees when Mueller resigned as a member in 2011." Trump is said to be incensed that Mueller may see his tax returns, and has been asking about his power to pardon his family members.

Source:
INCLUDES NY PROBE INTO MANAFORT
Why Yes, Mueller Is Looking into Trump Businesses
11 hours ago
THE LATEST

In addition to ties between Russia and the Trump campaign, Robert Mueller's team is also "examining a broad range of transactions involving Trump’s businesses as well as those of his associates, according to a person familiar with the probe. FBI investigators and others are looking at Russian purchases of apartments in Trump buildings, Trump’s involvement in a controversial SoHo development in New York with Russian associates, the 2013 Miss Universe pageant in Moscow, and Trump’s sale of a Florida mansion to a Russian oligarch in 2008, the person said. The investigation also has absorbed a money-laundering probe begun by federal prosecutors in New York into Trump’s former campaign chairman Paul Manafort."

Source:
Mueller Expands Probe to Trump Business Transactions
17 hours ago
THE DETAILS

Special Counsel Robert Mueller's team is "is examining a broad range of transactions involving Trump’s businesses as well as those of his associates", including "Russian purchases of apartments in Trump buildings, Trump’s involvement in a controversial SoHo development with Russian associates, the 2013 Miss Universe pageant in Moscow and Trump’s sale of a Florida mansion to a Russian oligarch in 2008."

Source:
ANALYSIS FROM CBO
32 Million More Uninsured by 2026 if Obamacare Repealed
19 hours ago
THE LATEST

"A Senate bill to gut Obamacare would increase the number of uninsured people by 32 million and double premiums on Obamacare's exchanges by 2026, according to an analysis from the nonpartisan Congressional Budget Office. The analysis is of a bill that passed Congress in 2015 that would repeal Obamacare's taxes and some of the mandates. Republicans intend to leave Obamacare in place for two years while a replacement is crafted and implemented."

Source:
×
×

Welcome to National Journal!

You are currently accessing National Journal from IP access. Please login to access this feature. If you have any questions, please contact your Dedicated Advisor.

Login