Privacy Groups Dismiss Microsoft NSA Denial
September 7, 1999 (7:41 a.m. EST)
By Guy Middleton, TechWeb News
Microsoft moved swiftly on Friday to deny allegations that it included an NSA (U.S. National Security Agency) back door into the Windows operating
system.
"The report is inaccurate and unfounded. The key in question is a Microsoft key. It is maintained and safeguarded by Microsoft, and we have not
shared this key with the NSA or any other party," the company said in a statement.
The key, which works with the Microsoft Cryptographic API (MS-CAPI) is labelled as "NSA key".
Andrew Fernandes, chief scientist with Cryptonym of Morrisville, North Carolina, was quoted last week as saying the inclusion of the key made it
easier for the NSA to compromise a Windows user's security, without their knowledge.
"Microsoft takes security very seriously. This speculation is ironic since Microsoft has consistently opposed the various key escrow proposals
suggested by the government because we don't believe they are good for consumers, the industry or national security," said Microsoft.
Microsoft added the key had not, and would not be made available to any third party.
The software company said the key was labeled NSA because the NSA acted as the review body for the restricted export of encryption technology from the
U.S., and that key was designed to be compliant with U.S. export laws. Microsoft said the NSA-labeled key was simply a "back-up" for the one used by
Microsoft to allow it to update cryptography components (labeled "KEY").
But director of the London-based Foundation for Information Policy Research (FIPR), Caspar Bowden said: "Building in a 'back up' key makes no sense
unless there is a revocation method for the primary (key). There is no revocation method."
Microsoft said the back-up key was there should the original ever be lost due to a natural disaster. The company also acknowledged the name of the key
was "unfortunate".
"I don't believe them -- what kind of natural disaster are they talking about? A meteor destroying all the earth's structures?" said Privacy
International director general, Simon Davies."Microsoft's argument is inconsistent with its operating procedure -- it could hold a single key in
multiple locations, that is a standard security procedure." He added that to compromise user security, "it's not necessary to share access with the
NSA -- simply complying with their requirements will do that."
"It goes right to the heart of the deal between (software companies) and global operators. Ultimately we need to be more open about how these systems
are developed. Microsoft should have taken this opportunity to talk to us about the requirements of the U.S. government," said Davies.
A few more links
www.nsclean.com...
www.bluealien.org...
www.idg.net...