This Is How They Tell Me the World Ends: The Cyberweapons Arms Race

by Nicole Perlroth

When the interviews wrapped up that evening, I marched across the street to the nearest bodega, bought the cheapest twist-cap wine I could find, and chugged it straight from the bag.

You get me

And I’d embedded with the Times’ own IT security team as the Chinese hacker we came to refer to as “the summer intern” popped up on our networks each morning at 10:00 A.M. Beijing time and rolled out by 5:00 P.M. in search of our sources.

They got jokes

In some cases, the NSA was back-channeling with the international agencies that set the cryptographic standards adopted by security companies and their clients. In at least one case, the NSA successfully convinced Canadian bureaucrats to advocate for a flawed formula for generating the random numbers in encryption schemes that NSA computers could easily crack. The agency was even paying major American security companies, like RSA, to make its flawed formula for generating random numbers the default encryption method for widely used security products.

Wow i hate us

named Melissa by its author after a stripper in Florida,

Wow thanks

Even bombs that would live in infamy didn’t quite work as intended. Little Boy—the very first nuclear weapon America dropped in war—killed eighty thousand people on Hiroshima. But the destruction could have been much worse—only 1.38 percent of its nuclear core fissioned. Three days later, when Americans dropped their second bomb—codename “Fat Man”—on Nagasaki, it accidentally detonated one mile off target, though it still managed to kill forty thousand. A 1954 test of a hydrogen bomb in the Bikini atoll produced a yield of fifteen megatons—triple the amount America’s nuclear scientists anticipated—blanketing hundreds of square miles in the Pacific—and, as a result, America’s own weapons observers—with lethal radioactive fallout.

“Think about it,” he told me one day. “Nothing is American-made anymore. Do you really know what’s in your phone, or in your laptop?” I looked down at my iPhone with a renewed sense of intrigue, the kind of look you might give a beautiful stranger. “I do not.”

had been told, in the vaguest of terms, that they each possessed a unique set of skills that could help their country.

ok liam neeson

(The Pentagon later sealed its USB ports with superglue.)

Analog solution

With the arrival of Facebook in 2004, it was often hard to see where the NSA’s efforts ended and Facebook’s platform began.

Using an automated NSA program called Snacks—short for Social Network Analysis Collaboration Knowledge Services

That's a fucking stretch, kids. Also that's my new job title. Dibs. Called it.

An automated NSA program called Where’s My Node?

Guys you have way too much free time

There was an arrogance to the NSA’s work, Neumann told me. By inserting backdoors into any piece of technology it could get its hands on, the NSA assumed—to the country’s detriment—that all the flaws it was uncovering in global computer systems would not be discovered by someone else.

“The most likely way for the world to be destroyed, most experts agree, is by accident. That’s where we came in; we’re computer professionals. We cause accidents.”

subterfuge.

Centrifuge subterfuge

“We might not have agreed with everything our government was doing, but if you’re going to sell exploits, at least the U.S. government is one of the more ethically responsible ones.

I mean, that's debatable

You can’t stop the gears of capitalism. But you can always be a pain in the ass. —JARETT KOBEK, I HATE THE INTERNET

a year’s supply of beer,

But what are we talking about here? Like one beer a day? Where do i keep it? Is it even good beer?

They started paying hackers minimum bounties of $500 and maximum payouts of $1,337. That seemingly random payout was a clever wink at their target audience—the number 1337 spells out leet in hacker code, an abbreviated form of elite.

You fucking nerds

And it upped its maximum reward from $1,337 to $31,337—eleet in hacker code—and started matching offers for bounties that hackers donated to charity.

You're still fucking nerds but that's better

“We wouldn’t share this with Google for even $1 million,” Bekrar told a reporter. “We want to keep this for our customers.”

Ew

Sometimes this required cake; the Dutch love cake. If executives gave them a half hour, they promised to find a gaping hole in their website. If they failed, the teenagers would give them a cake.

Oh man I'm in

With her jet-black hair that she sometimes dyed bright pink, she was easy to mistake for a twentysomething hacker, even though she was now well into her forties. “I’m really old but really well preserved because I never go outside,” she told me.

Mood

She started buying hackers beer. A lot of beer. She also began inviting them to late-night karaoke sessions at the big hacking cons.

Again, I'm in

“Fuck these guys,” a Google security engineer named Brandon Downey wrote in a post to his personal Google Plus page.

I just had a recovered memory of Google Plus

only to find out they’d been had by their own government. In a window to how Valley’s engineers think, Downey made the obligatory Lord of the Rings reference: “It’s just a little like coming home from War with Sauron, destroying the One Ring, only to discover the NSA is on the front porch of the Shire chopping down the Party Tree and outsourcing all the hobbit farmers with half-orcs and whips.”

I understood that reference dot gif

Chris Evans, a British security engineer with serious eyes and a square jaw,

You dont say

Cook was famously private himself. He had grown up gay in conservative Alabama, a fact he kept private until 2014, the year after the Snowden revelations dropped. In Alabama, his lingering childhood memory was watching Klansmen burn a cross on the lawn of a black family in his neighborhood while chanting racial slurs. He’d screamed at the men to stop, and when one of the men lifted his white hood, Cook recognized him as the deacon of a local church.

One year later, September 2014, Cook took the stage in Cupertino to debut the new iPhone 6,

I am so old

Up to that point, if a government needed Apple’s help unlocking an iPhone, they had to physically fly to Cupertino and bring the phone into a secure sensitive compartmented information facility (SCIF), where a trusted Apple engineer unlocked it. The trips could be comical. In one case, a foreign government sent an iPhone, along with a government minder, by chartered jet to Cupertino, only to get into the SCIF and learn from Apple’s engineer that the owner had never even bothered to set up a passcode.

Oh my god i hate it

The FBI went ballistic.

Good, you creepy creepos

“No one in this country is beyond the law,” Comey told reporters at FBI headquarters a week after Apple’s announcement. “The notion that someone would market a closet that could never be opened—even if it involves a case involving a child kidnapper and a court order—to me does not make sense.”

Because you're a dumbass, Jim

The breach at the Office of Personnel Management was still fresh in Cook’s memory. The breach had exposed the very data you would think the government had the most personal incentive to protect: Social Security numbers, fingerprints, medical records, financial histories, home addresses, and sensitive details for every American given a background check for the last fifteen years—which included Comey, and the most senior officials at the Department of Justice and the White House. If they could not even manage to keep their own data safe, how could they ever be expected to safeguard Apple’s backdoor?

And perhaps most miraculously of all, Comey admitted that his agency had paid these cryptic hackers more than his salary for the seven-plus years left in his term.

Piece of shit you are

He showed me how to hack a chip with a “side channel attack,” sending malware via radio emissions to the copper in the chip itself.

What the shirt

“So will they only sell their exploits to good Western governments?” He repeated my words back to me. “Good Western governments?”

Lolololololol

The last time I checked, the country that bombed another country into oblivion wasn’t China or Iran.”

I wondered who was going home with their code. You may ask yourself, “Am I right, am I wrong?” You may say to yourself, “My God! What have I done?”