The Wall Street Journal is reporting that Chinese hackers (Salt Typhoon) penetrated the networks of US broadband providers, and might have accessed the backdoors that the federal government uses to execute court-authorized wiretap requests. Those backdoors have been mandated by law -- CALEA -- since 1994.
Zack Whittaker:
The wiretap systems, as mandated under a 30-year-old U.S. federal law, are some of the most sensitive in a telecom or internet provider's network, typically granting a select few employees nearly unfettered access to information about their customers, including their internet traffic and browsing histories.
But for the technologists who have for years sounded the alarm about the security risks of legally required backdoors, news of the compromises are the "told you so" moment they hoped would never come but knew one day would.
Jon Brodkin:
The Washington Post reported on the hacking campaign yesterday, describing it as "an audacious espionage operation likely aimed in part at discovering the Chinese targets of American surveillance." The Post report attributed the information to US government officials and said an investigation by the FBI, other intelligence agencies, and the Department of Homeland Security "is in its early stages."
The Post report said there are indications that China's Ministry of State Security is involved in the attacks.
John Gruber:
This incident should henceforth be the canonical example when arguing against "back doors for the good guys" in any networks or protocols. It's not fair to say that all back doors will, with certainty, eventually be compromised, but the more sensitive and valuable the communications, the more likely it is that they will. And this one was incredibly sensitive and valuable. There are downsides to the inability of law enforcement to easily intercept end-to-end encrypted communication, but the potential downsides of back doors are far worse.
Nick Heer: