My understanding is that https://en.wikipedia.org/wiki/FIPS_140-2 required Dual-EC DRBG to be implemented in any crypto system used by government, including such protocols as SSL/TLS, these algorithms are typically also adopted by industry, and NSA went further by paying RSA and perhaps others to make it the default in their security products.

This came after previous attempts such as https://en.wikipedia.org/wiki/Clipper_chip