Thousands of the world’s security professionals, most of them middle-aged white males, gathered in San Francisco last week for the annual RSA Conference.

Traditionally, it’s the time of year vendors hawk their gear in halls containing a perturbing whiff of ammonia, research announcements provide relief from the festival of commerce, and government mandarins hobnob with corporate types - all with the implied intent to work together to protect people’s data.

Yet 2014’s event was always going to be a bit different. RSA, the security company hosting the event, had to defend itself against criticism over an alleged $10m deal with the National Security Agency (NSA) to include flawed encryption in its products.

The company’s chief, Art Coviello, outright denied any wrongdoing, saying RSA was only following advice given by the US government’s National Institute of Standards and Technology (NIST).

RSA’s excuses have convinced some onlookers, others remain sceptical. But the organisation that took far more flak this week was the NSA itself, which had its own booth on the trade floor, albeit a considerably plainer one than the surrounding neon-clad stalls of commercial firms.

There was one criticism, amid the understandable ire around the damage done to global privacy, which stood out: that the NSA’s mass spying had perversely made life easier for digital criminals.

Data sharing in danger

Cross-border data-sharing mechanisms - a critical part in both online and non-internet crime investigations - have come under threat since the Edward Snowden leaks. Even though information-sharing deals covering banking and airline passenger data just about survived calls to suspend them, the Snowden files have caused problems for collaboration between public and private bodies.

The heightened tensions lie not between law enforcement agencies, but between police and other organisations that potentially hold valuable information for investigations. “The impact is more [with] third parties giving more consideration to sharing their data with agencies or other departments,” said Charlie McMurdie, formerly the head of the defunct Metropolitan Police Central e-Crime Unit and now senior crime adviser at PricewaterhouseCoopers.

“This can have a negative impact on law enforcement ability to respond to or progress investigations, but on the positive side [this] has also made third parties think more about where their data exists, security and sharing protocols, which isn’t a bad thing.”

A recent European Commission report on trust between the US and the EU following the leaks last year said: “Information sharing is … an essential component of EU-US security cooperation, critically important to the common goal of preventing and combating serious crime and terrorism. However, recent revelations about US intelligence collection programmes have negatively affected the trust on which this cooperation is based. In particular, it has affected trust in the way personal data is processed.”

Discussions are ongoing about an umbrella agreement covering law enforcement data sharing, with much talk of the need to ensure safeguards are in place, with “strict conditions”.

The US government has already seen the impact. In response to a Guardian question on the effect of Snowden’s revelations on data sharing, Phyllis Schneck, the chief cybersecurity official at the US Department of Homeland Security, said the government body’s partners were “feeling it”.

She said the data sharing environment had to be improved if the nation was to protect against people who wanted “to change and hurt our way of life”. “It’s so important to be able to combine what we know… We all have to make sure we get this right and we will, with full privacy and full civil rights,” Schneck said during a panel at the conference.


Steven Chabinsky, former deputy assistant director for the FBI’s Cyber Division and now general counsel for offensive security firm Crowdstrike, said the information sharing problems that had emerged “have to be resolved”.

Criminals learning from NSA

Intelligence agency hacking techniques will also be adopted by criminals, according to security luminaries speaking with The Guardian. This has been seen in other nations in recent history.

“The spear-phishing tricks we saw the Chinese secret police using against the Dalai Lama in 2008 were being used by Russian crooks to steal money from US companies by 2010. We predicted as much in … 2009,” said Ross Anderson, professor of security engineering at the University of Cambridge. “A lot more people have become aware of what can be done.”

Cryptography expert and author Bruce Schneier said some of the techniques the NSA used to hack routers are starting to be seen in criminal cases, amongst other attack types. Indeed, from compromises of much used but vulnerable mobile applications, to spying on people through their web cams, dark web dealers were already using the same methods as the NSA. “Today’s secret NSA programs are tomorrow’s PHD theses and the next day’s hacker tools,” he added.

“The US has done an enormous amount of damage here. There is a basic level of trust that has been lost… There is a lot of international mistrust right now because the US was supposed to be a trusted keeper of everything, but it turned out they were subverting it with every chance they got. And the NSA keeps saying it’s not as bad as you think, but who the hell believes that?”

The zero-day race

Purposeful backdoors in security products - another revelation from leaked security agency documents - benefit all hackers. If firms have allowed for weaknesses in their product sets, they don’t just open up holes for agents to exploit, but criminals too. Organised crime groups are pumping money into hunting for such vulnerabilities, placing the everyday user at ever greater risk.

Those crooks and the NSA are racing to uncover and use zero-day flaws - previously-unknown, unpatched weaknesses in software and hardware. After governments buy, discover or use these vulnerabilities, they often filter down into the wider criminal community, says Jason Steer, director of technology strategy at FireEye.

“We know that governments purchase undisclosed zero-day vulnerabilities, and the providers of such zero-days such as Vupen openly acknowledge that government are big buyers of their research in text on their website,” Steer said. “All exploits have an inevitable lifecycle - from highly targeted usage to APT [advanced persistent threat] usage, then to broader cyber criminals and finally hacktivists.

“Once an exploit is used in the wild, its effectiveness will drop as researchers in both the blackhat and whitehat communities discover it and learn about it. Once its effectiveness is weakened, any zero-day is picked up by the broader attacker community as this gives them an opportunity to monetise their window for a time, until the targeted software or hardware fixes the vulnerability - it’s quite simply a race.”

Government malware = criminal malware


But the NSA isn’t the only official body that is spurring on digital crime, whether willingly or unwittingly. In using offensive digital tools against one another, governments have brought about a degradation of co-operation on dealing with cybercrime, according to RSA chief Art Coviello.

“The only ones deriving advantage from governments trying to gain advantage over one another on the internet are the criminals. Our lack of immediate, consistent and sustained cooperation, globally, gives them the equivalent of safe havens,” Coviello said during his keynote.

And the introduction of government-owned malware on global networks only gives criminals yet more tools to play with. “The genie is out the bottle on the use of cyber weaponry and unlike nuclear weapons, cyber weapons are easily propagated and can be turned on the developer,” Coviello added.

Anderson has concerns around organised criminals taking advantage. “If governments keep on giving millions of people access to this stuff, it’s only a matter of time before serious organised crime gets in there.”

It’s long been believed governments across the world are paying cyber criminals to help them attack foreign entities too. While this has never been detailed, Coviello and numerous others in the security industry have claimed knowledge of it happening.

This has all combined to create a chaotic, dangerous environment, where attack numbers continue to rise and aggressive, sophisticated techniques have been given a sense of legitimacy, whether the targets are governmental data or individuals’ money.

“Paraphrasing a famous quote, those who seek military advantage riding the back of the tiger will end up inside,” Coviello said during his keynote. Many are now calling for the NSA and other government bodies contributing to the rise in digital crime to get off that tiger.