Maybe I missed it but I didn't see the German government dismissing the experts warning that TPM may enable NSA surveillance. The enablement process identified was via capture of the keys at the point of manufacture using legal authority the US government already claims for itself.
The concern was raised amongst others by Rüdiger Weis, a professor at the Beuth University of Applied Sciences in Berlin. He claims to have worked with TCG for a number of years, so one should take his views as likely to be well founded.
Companies like Dell import those keys. Within Dell is an office of the NSA. Seems likely that office would want access to the keys.
Here's the key positive paragraph in the German government document:
"For certain types of users, employing Windows 8 in combination with a TPM may well mean an increase in safety. This includes users who for various reasons can not take care of their own security or want but trust the manufacturer of the system that [Win8 + TPM] provides and maintains a safe solution. This is a valid use case, however, the manufacturer should provide sufficient transparency about the potential limitations of the [Win 8 + TPM] architecture and possible consequences of its use."
So it is helpful for folks who are unable to run security and who trust the manufacturer. That is weak tea if I've ever seen it.
The document then diverts to a separate concern about device control, before adding a curious statement.
"In addition, the newly-established mechanisms can also be used for sabotage by third parties. These risks must be addressed."
That is a serious allegation for a government to make. The system may be used for sabotage. By third parties.
Good grief. That doesn't sound safe to me.
So I am not sure where the headline for the zdnet article comes from. The German government did not refute the back door claim made by experts. It said Win8 plus TPM is better than nothing for some users, addressed a new category of concern and added a dark sabotage shadow over Win8 + TPM.
Indeed, after making the empty claim in the headline, the author of the ZDNet article makes his own prejudice very clear at the end of the article: "The only people left who really believe that Windows has a backdoor to the NSA are the same kinds of people who believe Facebook, Google, Apple, Yahoo, and the rest of the named seven major companies, gave "direct access" to their systems to the NSA — which they didn't, as they continue to fight in the courts to reveal documents that they know exonerates them from any allegations made by former NSA contractor Edward Snowden."
Because the companies are fighting in the courts doesn't mean the NSA hasn't got access to their information.
The zdnet author thinks refutation via the phrase "direct access" has some kind of value. Whereas in fact we have discovered the access is almost complete but likely achieved by other means than direct access. Such as access to encryption methods.
"The files provided by Edward Snowden illustrate the scale of co-operation between Silicon Valley and the intelligence agencies over the last three years. They also shed new light on the workings of the top-secret Prism program, which was disclosed by the Guardian and the Washington Post last month.
The documents show that:
• Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal;
• The agency already had pre-encryption stage access to email on Outlook.com, including Hotmail;
• The company worked with the FBI this year to allow the NSA easier access via Prism to its cloud storage service SkyDrive, which now has more than 250 million users worldwide;
• Microsoft also worked with the FBI's Data Intercept Unit to "understand" potential issues with a feature in Outlook.com that allows users to create email aliases;
• In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism;
• Material collected through Prism is routinely shared with the FBI and CIA, with one NSA document describing the program as a "team sport"."
So I'm afraid the issue remains live until someone actually refutes it.
What is really going on here seems to be this. The German government is demanding changes and saying it won't buy devices with TPMs in them until those changes are made.
The major question is this. How many governments will adopt a similar stance?
| 