Possibly Cracked TrueCrypt Account At The Center Of Stolen Military Documents Case

(Mis)Uses of Technology

from the Federal-Backdoor-Installation dept

A little over a month ago, we covered a FOIA response (if you could call it that…) from the FBI concerning TrueCrypt, in which it withheld all 69 pages of responsive documents. In addition to the ridiculousness of much of the withheld information being easily-accessible online, there was the question about what this denial meant for TrueCrypt.

When the FBI withholds documents, it often does so because the subject of the FOIA involves an ongoing investigation. In this case, the FBI cited an FOIA exemption related to “trade secrets and commercial information,” which none of this was. So, why all the secrecy? Perhaps it was just the agency’s default mode taking over. Or maybe it had something to do with TrueCrypt’s sudden decision to halt development and declare the software “insecure.” Had the FBI managed to “break” TrueCrypt or was its lack of a reponse to this request a signal that it was talking to the people behind it?

What is certain is that the FBI has been able to gain access to a TrueCrypt user’s account.

Scott Glenn, a 35-year-old Harris Corp. employee working at a US military base in Honduras, apparently made off with documents considered to be “military secrets.”

In January, he admitted he hacked into the base commander’s classified email account and copied thousands of messages and more than 350 attached documents, much of which dealt with U.S. military plans and information regarding the Middle East.

The judge who sentenced Glenn to 10 years in prison asserted Glenn grabbed these documents out of a desire to “damage” the “security” of the United States. His lawyer had argued that Glenn was nothing more than a “technological hoarder” — someone who collects this sort of stuff just to be collecting it. He pointed to Glenn’s retention of a secretary’s hard drive that had no discernible value to anyone as evidence of Glenn’s “hoarding” habit. He also pointed out Glenn never tried to distribute the documents or attempted to use them for financial gain.

Glenn, however, has both a troubled legal past and a hazy legal future. He has previously been expelled from a military base for committing benefits fraud and hacking into US databases for Iraqi businesses. He’s also being investigated for “sexually exploiting” Honduran minors.

But the nexus point for this stash of military documents was TrueCrypt.

Glenn read up on the art of espionage and used an elaborate encryption system, TrueCrypt, with a decoy computer drive to distract investigators from another hidden drive that he protected with a complex 30-character password, army counterintelligence expert Gerald Parsons testified.

The FBI’s counterintelligence squad in South Florida was able to crack Glenn’s code, Parsons said.

Parsons said he didn’t know how the FBI agents did it but he estimated it would have taken “billions” of years to crack the code using traditional methods.

This should be a bit concerning for TrueCrypt users. Either Glenn’s password was cracked (rather than TrueCrypt’s encryption) or the questions raised about the predictability of the random-number generator behind the encryption method have some validity. Because “traditional methods” would still be underway — at least according to the expert presented by the prosecutors — something else had to give. The most likely explanation is that Glenn gave up his password or had it trapped by a keylogger or other government surveillance software. The FBI has tried to crack TrueCrypt’s encryption before and had no luck.

With many documents related to the case still sealed, it’s unclear what the government’s expert meant by “cracked.” It likely means TrueCrypt is as secure as it has been, but its appearance in a case centering on a decrypted hard drive doesn’t exactly encourage the throwing of caution to the wind.

Filed Under: encryption, fbi, investigation, scott glenn, truecrypt