New Snowden leaks show NSA attacked anti-virus software

By Barry Eitel

SAN FRANCISCO

 The National Security Agency successfully hacked into popular anti-virus software to track users and gain access to computer networks, according to documents leaked Monday by whistle-blower Edward Snowden.

The NSA, along with its British counterpart Government Communications Headquarters (GCHQ), spent years reverse-engineering popular computer security software in order to spy on email and other electronic communications, according to the classified documents published by the online news site The Intercept.

The spy agencies worked especially hard to crack into the software produced by Moscow-based company Kaspersky Lab which also has a holding registered in the United Kingdom. The company’s name was repeatedly mentioned in the documents. Kaspersky notes that more than 270,000 corporate clients use its services and its software protects more than 400 million people worldwide.

The leaked documents include a warrant renewal request filed by the GCHQ in 2008 that claimed Kaspersky’s products interfered with its spying operations.

“Personal security products such as the Russian anti-virus software Kaspersky continue to pose a challenge to GCHQ’s CNE [Computer Network Exploitation] capability and SRE [software reverse-engineering] is essential in order to be able to exploit such software and to prevent detection of our activities,” the warrant renewal request reads. “Examination of Kaspersky and other such products continues.”

In the request, GCHQ admits the reverse engineering is of questionable legality, noting that in other cases it would amount to copyright infringement.

The leak also claims the NSA would monitor email accounts attached to companies producing security software. Through spying on these conversations, the agency hoped to learn about new vulnerabilities in the programming.

Since the manufacturers of computer operating systems highly trust security software, it is often given clearances and controls that are denied to most other consumer software. The government spy agencies desired hacking into this anti-virus programming because of its expanded access.