My understanding is that https://en.wikipedia.org/wiki/FIPS_140-2 required Dual-EC DRBG to be implemented in any crypto system used by government, including such protocols as SSL/TLS, these algorithms are typically also adopted by industry, and NSA went further by paying RSA and perhaps others to make it the default in their security products.