The Office of the Director of National Intelligence (ODNI) flat-out denied reports that the National Security Agency had been quietly exploiting a widespread flaw in Internet security called the Heartbleed bug for years, as reported by Bloomberg news on Friday — accusations that sent shock waves of concern and frustration through Internet users.
“The Federal government was not aware of the recently identified vulnerability in OpenSSL until it was made public in a private sector cybersecurity report,” reads an official statement posted Friday to a blog maintained by the government agency. “If the Federal government, including the intelligence community, had discovered this vulnerability prior to last week, it would have been disclosed to the community responsible for OpenSSL.”
The alarming Bloomberg report claimed that the country’s top spy agency had discovered the security vulnerability shortly after it emerged, and has routinely used it to collect data and spy (likely on Americans, intentionally or otherwise). Data sucked up by the NSA using the Heartbleed bug could have included email addresses, passwords and other data that would have let the agency carry on its cyber-espionage operations.
MORE: Here’s a list of websites allegedly affected by the Heartbleed bug
The longer a flaw like Heartbleed existed on the Internet, the more opportunity there was for criminals and enemy states to exploit it to steal information, spy on others and cause incalculable harm to individuals, businesses and government agencies, explained noted security analyst Graham Cluley.
“If it’s true … then they’ve let down everyone who uses the Internet.”
One of the NSA’s main missions is national security. That includes seeking out software flaws and vulnerabilities that could be exploited by hackers and other governments. The agency’s actions with respect to how it used the Heartbleed bug, and its refusal to inform the public of its existence, would have run contrary to those missions, some say.
“It flies in the face of the agency’s comments that defense comes first,” said Jason Healey, director of the Atlantic Council’s cyber statecraft initiative, and a former Air Force cyber officer. “They are going to be completely shredded by the computer security community for this.”
The NSA first addressed the Bloomberg report in a statement issued via Twitter:
Statement: NSA was not aware of the recently identified Heartbleed vulnerability until it was made public.
— NSA/CSS (@NSA_PAO) April 11, 2014
The ODNI statement stressed the same point, noting that “it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose.” Yet many still questioned the agency. The Electronic Freedom Foundation (EFF), a non-profit dedicated to protecting Americans’ civil liberties, wrote the following tweet in response:
So @NSA_PAO if it isn’t you guys, who runs this botnet that was launching Heartbleed attacks last year? http://t.co/4wEWK6WXIx
— EFF (@EFF) April 11, 2014
A handful of programmers runs the OpenSSL security protocol in which the Heartbleed bug lies; the NSA tasks thousands with discovering such vulnerabilities. Once the flaw was uncovered, the Bloomberg report claimed, the NSA essentially put it in its back pocket, instead of warning those who could have patched the problem and kept the nation’s data safe — a part of the agency’s stated mission.
MORE: How to check if your favorite websites are vulnerable to the Heartbleed bug
“The Information Assurance mission confronts the formidable challenge of preventing foreign adversaries from gaining access to sensitive or classified national security information,” the agency’s mission statement reads.
James Lewis, a senior fellow at the Center for Strategic and International Studies specializing in cybersecurity, says that the NSA considers multiple options when it discovers vulnerabilities like Heartbleed. They include temporary exploitation combined with collaboration with software developers to plug the flaw.
MORE: What is the Heartbleed bug?
“They actually have a process when they find this stuff that goes all the way up to the director” of the NSA, Lewis said. “They look at how likely it is that other guys have found it and might be using it, and they look at what’s the risk to the country.”
The Heartbleed bug is a serious vulnerability in the OpenSSL Internet encryption protocol known that has potentially left the information of most Internet users vulnerable to hackers. The Heartbleed bug reportedly affects as much as 66 percent of the world’s active websites, and has existed for roughly two years. That’s according to a team of Codenomicon researchers, as well as Google Security researcher Neel Mehta.
“We’ve never seen any quite like this,” Michael Sutton, vice president of security research at Zscaler, a security firm, says. “Not only is a huge portion of the Internet impacted, but the damage that can be done, and with relative ease, is immense.”
MORE: The Heartbleed bug affects “almost everyone”
The NSA has been embroiled in controversy and scandal since it was revealed that the agency actively collects data and spies on a vast array of Internet users, including unaware Americans.
