As to PROMIS yet...
Have you heard of the SWIFT banking transaction database, that was now taken into use in the whole EU as well, along with the IBAN international bank account numbers?
Now / soon all transactions, national and international, will go through SWIFT. And CIA has long had admitted access to it. What this means is that the western intelligence agencies have access to all bank transactions, all the time. Personally, I presume this to be joint EU/USA venture, at least behind the scenes.
http://www.swissinfo.ch/eng/top_news/de ... 1302785000
The United States has confirmed it has been monitoring international financial transactions, including those in and out of Switzerland, for almost five years.
The Swiss government has remained quiet on the issue, but data protection experts and lawyers are concerned by Friday's revelations in the New York Times.
US Treasury Secretary John Snow defended the secret programme, carried out by the CIA and the Treasury, calling it "government at its best" and a valuable aid for fighting terrorism.
Snow confirmed that since just after the attacks on September 11 2001, the Treasury had been tapping into records of the Belgium-based Society for Worldwide Interbank Financial Telecommunication (Swift) for evidence of potential activity by terror groups.
"The legal basis for this subpoena is routine and absolutely clear," Treasury Under Secretary Stuart Levey told a hastily called news conference, adding that it was "a grave loss" that the surveillance programme had been revealed but indicated that it would continue.
Swift is a cooperative owned by the 7,800 financial institutions in more than 200 countries that use it. Its headquarters are in Brussels.
http://arstechnica.com/business/news/20 ... ecords.ars
CIA could get access to even more EU banking records
Europeans are uneasy about US access to their financial information, but Germany's privacy commissioner fears the situation could soon get worse: the CIA and the Treasury Department might gain access to every single European interbank transaction.
Back in February, the European Parliament expressed its displeasure with the fact that the Society for Worldwide Interbank Financial Telecommunications (SWIFT) system was being regularly accessed by US authorities, including the CIA, as part of investigations into terrorist financing. Legislators wondered if SWIFT (a Belgium-based company) was obeying EU data protection laws, and proposals were floated that would ask SWIFT to stop mirroring its data to the US. According to Germany's Federal Data Protection Commissioner, Peter Schaar, the situation could get a lot messier: SWIFT might soon handle domestic as well as international fund transfers, and US authorities might then have access to every bank transfer in Europe.
SWIFT has rejected the idea of moving its mirrored servers out of the US, though. Francis Vanbever of SWIFT told a European Parliament committee this week that the system was necessary to avoid any disruptions to the worldwide system, and he pointed out that the company had no choice but to turn over data to the Americans. "After September 11th," he said, "we received a compulsory order to provide information on data stored in the US... We verified the situation with external legal counsel, which confirmed the US had the authority to issue the order. If we did not comply, we would face civil and criminal penalties, including fines or imprisonment."
Even without processing domestic transactions, SWIFT is already a giant in the banking world, and it's easy to see why concerns would be raised about any disclosure of the company's database. On March 1, 2007, SWIFT set a record for the volume of financial transactions handled in a single day as 14 .7 million messages passed through its network. Privacy advocates like Schaar worry about the potential for economic espionage and other kinds of abuse if US authorities keep using their subpoena power to gain access to such a transaction database, which would contain far more messages than the current version.
Combine these worries with earlier fears about a worldwide ECHELON surveillance system run by the US, the UK, and Australia (worries great enough that the European Parliament issued a lengthy report outlining everything it could discover about ECHELON [PDF]), and you have an explosive cocktail of paranoia.
http://www.fas.org/irp/program/process/ ... lon_en.pdf
Also, Nicky Hager's book about Echelon now for free as pdf:
http://www.nickyhager.info/ebook-of-secret-power/
Of course, NSA also co-operates with the likes of Microsoft and Apple regarding their popular operating systems. If there are backdoors somewhere in popular OS platforms, they were put there by NSA with the agreement of those corporations.
http://www.schneier.com/blog/archives/2 ... e_sto.html
But one of those generators -- the one based on elliptic curves -- is not like the others. Called Dual_EC_DRBG, not only is it a mouthful to say, it's also three orders of magnitude slower than its peers. It's in the standard only because it's been championed by the NSA, which first proposed it years ago in a related standardization project at the American National Standards Institute.
The NSA has always been intimately involved in U.S. cryptography standards -- it is, after all, expert in making and breaking secret codes. So the agency's participation in the NIST (the U.S. Commerce Department's National Institute of Standards and Technology) standard is not sinister in itself. It's only when you look under the hood at the NSA's contribution that questions arise.
This is how it works: There are a bunch of constants -- fixed numbers -- in the standard used to define the algorithm's elliptic curve. These constants are listed in Appendix A of the NIST publication, but nowhere is it explained where they came from.
What Shumow and Ferguson showed is that these numbers have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can predict the output of the random-number generator after collecting just 32 bytes of its output. To put that in real terms, you only need to monitor one TLS internet encryption connection in order to crack the security of that protocol. If you know the secret numbers, you can completely break any instantiation of Dual_EC_DRBG.
And the most logical place for subverting a computer system -
the CPU, the chip itself inside the machine. That has worried US authorities vs. China as well:
http://homelandsecuritynewswire.com/single.php?id=6007
A technological sleeper cell: The Chinese have manufactured counterfeit Cisco routers and switches and offered them at exceedingly low prices; U.S. vendors upgrading or replacing U.S. government IT systems used these counterfeit devices -- and the FBI and other government agencies are now worried that the gear offers the Chinese undetectable back-doors into highly secure government and military computer system; the FBI investigates
http://www.networkingpipeline.com/blog/ ... a_wir.html
Feds Want A Wiretap Backdoor In All Net Hardware and Software
http://www.indymedia.ie/article/77862
The (Irish) Government did not know about the monitoring scheme, but several EU central banks were informed about the programme, which was introduced after the terrorist attacks on September 11th 2001. Under the scheme the CIA can sift through millions of international banking transactions to try to identify potential terrorist financing. […]
It has emerged that several central banks across Europe knew that the Society for Worldwide Interbank Financial Telecommunications (Swift) has been providing infomation to the US Authorities. Some did not inform their own governments. […]
I definitely consider the whole PROMIS hoopla to be misdirection from these (SEAS, NSA surveillance and simulaton, deep packet analysis of all traffic, ECHELON, SWIFT access and the international finance network) very real issues.
Let me reiterate - software that runs undetected on any operating system, any hardware system, can access any database, and provide a backdoor as well, is bloody (near) impossible to make. Even more so if it can never be spotted. Never say never, but I am stating my scepticism.
If there was such a thing, it would be on the chips. And that presents another problem - there are more than one CPU maker, and in several countries.
http://www.hermann-uwe.de/blog/how-to-d ... d-wiretaps
How do we know whether our software or hardware is backdoored/wiretapped? We all know that using a certain OS from Redmond opens a lot of security holes in itself. Add to that all the now-public attempts of agencies and companies ranging from the FBI, NSA, Sony to antivirus-software vendors who install backdoors on your PC, and you've got some very good reasons to never trust any closed-source software again.
This is not a problem for most of us using Free Software and free operating systems (Linux, *BSD, etc.). Theoretically, we can read the source code of almost every single instruction being executed on our hardware, and verify that the software doesn't do any funny things like phoning home, logging keystrokes, opening backdoors and so on.
(
My note: It can be too, if there are undisclosed vulnerabilities that say, NSA does know about, in free software! Like the one that afflicts all linux kernel versions since forever, and was only spotted just now - http://linux.slashdot.org/story/09/08/1 ... art_pos=16 )
However, how can we know whether or not our hardware has been backdoored/wiretapped/trojaned (or whatever you want to call it)?
We can not, at least not easily.
Sorry about the lengthy post, but since PROMIS was discussed here, I consider all this relevant.