NSA Connection Creates Credibility Problems For NIST Encryption Standards
The Department of Commerce is a big place. It's home to the National Weather Service, the US Patent Office, and the Census Bureau. But following last summer's revelations about National Security Agency surveillance of American citizens, one bureau has gotten more than its usual share of the media's attention: the National Institute of Standards and Technology, which develops the encryption standards used by all public organizations and many private companies to protect their digital infrastructure.
Because of a legal requirement, NIST had help from NSA in creating these encryption recommendations, and in September, the bureau "strongly" advised that organizations stop using one part of their standard because of security concerns. While the head of NIST, Patrick Gallagher, testified that the organization is not "not deliberately, knowingly, working to undermine or weaken encryption,” outrage about NSA surveillance has put the bureau in an awkward situation: People aren't sure whether they can trust the digital security standards that NIST puts out. That's why Penny Pritzker, the Hyatt hotel chain heiress and recently confirmed Secretary of Commerce, has been getting questions about national security, including at The Atlantic's forum on small business. "There's a national security approach, as well as an economic approach, to the 'How do we restore trust?' question," Pritzker said. "I put the national security issue in what I call protecting the digital flexibility" of companies.