Hacker News Reader

Comment by jmull | Hacker News Reader

Not exactly. Don't get confused by false equivalencies.

This company is a problem because it's controlled by an American intelligence agency. The owners knew that was a problem, of course, and went to great lengths to hide that fact. Note that Crypto AG appeared to be a Swiss company, not an American one.

Typical American companies aren't controlled by the CIA or other government agencies.

Typical Chinese companies are substantially controlled by the Chinese government.

It's a rather important difference when trying to figure out the risks of how much you can trust who you work with. There's subterfuge, of course, so there aren't hard and simple rules. This is an exercise in risk management.

It's a rather large mistake to conclude Chinese Owned == American Owned.

View on HN

You can't say definitely that American companies are or are not controlled by government agencies.

No, you can't. His point is that you can say definitively that Chinese companies are controlled by government agencies, though.

What does "controlled by government agencies" mean?

Well, don't foget In-Q-Tel: the CIA's very own venture capital company. What better way to launder look-away money, or insert code.

Have a gander at the companies they have had their paws on: Palantir, Inktomi, Docker, ArcSight, etc.

[1] https://en.wikipedia.org/wiki/In-Q-Tel

"Typical American companies aren't controlled by the CIA or other government agencies."

True but that doesn't mean there aren't national interests in play when it comes to information security companies deploying crypto products. Think RSA e.g. who took bribes and implemented Dual EC DRBG -- a backdoored random number generator for a number of their cryptographic systems.

There are most likely others, thus transparency via open source (and verifiability via reproducible builds to split hairs) is necessary to avoid this ever happening again.

> Typical American companies aren't controlled by the CIA or other government agencies.

Unless the CIA has any interest in them, in which they get pwned pretty quickly.

No. That's my exact point. The CIA can't just get control of a company because they want to. Not that it's impossible, but there isn't a reliable mechanism for doing so.

They would need to somehow subvert key executives and subvert key employees to convince them to add back doors and keep quiet about it.

Their levers on such people (carrots and sticks, threats and bribes) aren't that easy to deploy either, especially en mass and in the US. There are a lot of legal hurdles. (The CIA has a lot more legal latitude outside the US than in -- that's very likely an important reason AG Crypto is a Swiss company and not an American one.) Not that the CIA always scrupulously follows the law -- they don't -- but they have to be careful about it.

I suppose you can just believe the CIA hits the "pwn" button anytime they like. But that doesn't have anything to do with the way things work.

Reply on news.ycombinator.com