No, Intel agencies have always been too powerful and Truman saw it when disbanding the OSS (Office of strategic services) after WWII. Then, he begrudgingly created the CIA to compete in the cold war.

They've always undermined American security so they could have more information and power.

> It used to be the US government worked to secure American communications.

When was this? As far as I remember (but I'm not that old to be honest), it seems to mostly been about the US government making sure the government has secure communications, while the rest get to fend for themselves.

Both statements are simultaneously true.

The goal is to protect the physical and institutional USA (and equivalent for other countries' intel agencies); this requires making sure there's no successful conspiracies, from within or without, to destroy it; this requires all the things we here all agree are bad for digital security, including the security necessary to running e.g. electronic banking ledgers or votes.

I don't have any actual solutions here, that's just a description of the problem space as I understand it to be.

There's a bunch of US agencies sponsoring Tor, presumably to undermine hostile governments, even though there's also US agencies trying to subvert it.

You misunderstood "American security" to mean "security of Americans" instead of the intended meaning "security of the American regime"

^ this guy is about to learn about the crypto wars.

On top of what you mentioned, they would have access to significant metadata, unencrypted traffic, and it is worth assuming that government agencies have the resources to acquire certificates and MITM high value information.

Meta data of how many packets are going between two parties, when its going, and who else is getting the data at the same time. It is like the pizza traffic story at 10 pm.

The CCP doesn't need the backdoor. The US intelligence agencies have to do the whole masquerade of freedom and liberty.

>However, I suspect if someone did a hack that juicy, carrier SOCs would've noticed immediately.

We're talking real deal nation-state actors targeting an industry where for the last few decades the only downside of being breached is having to say "oh oops, sorry" and maybe providing a year of credit monitoring. Security is something taken just seriously enough to avoid a ruling of negligence, but no more.

It is very optimistic to assume that carriers would immediately notice a breach by threat actors this sophisticated.

> This type of infrastructure isn't exactly hooked up to a public IP address somewhere.

Without going into details, consider that sometimes they are, even with very large providers that you think should know better. Law enforcement’s got to get to them somehow.

And much of the documentation for these systems is publicly available. Search for your favorite enterprise company and for “lawful intercept”.

> This type of infrastructure isn't exactly hooked up to a public IP address somewhere.

It's getting from point A to point B, and probably not via sneakernet. The details will make it more or less secure, but I'd be shocked if it's going through anything other than public internet pathways.

They probably dont have a public ip but just spearfish a network engineer at these ISPs and you'll have access to the devices performing the legal intercept.

I would just assume there's a cloud provider that handles all of the wiretapping services for both or all carriers. There's a single-point-of-failure for everything else nowadays anyway. Look at what happened with Crowdstrike, or Solarwinds, or any number of other big single-source providers. Nobody wants to maintain it in house, with predictable results.

> This type of infrastructure isn't exactly hooked up to a public IP address somewhere.

Snort.

<< few details are available to the public, it's hard to estimate the impact.

Would it not be a good indicator that it may not be a great idea to begin with?

<< carrier SOCs would've noticed immediately.

I want to believe that. I do. But the longer I live in corporate, the more I think that we are experiencing a serious competency problem across the board.