WHEN the about-to-be-former spy Edward Snowden leaked a huge cache of top-secret documents to the press in May 2013, it confirmed what computer-security researchers had long nervously joked about: that Western intelligence services, and especially America’s National Security Agency, are in the business of subtly nobbling the cryptographic software that secures computers all over the world.
Mr Snowden’s documents named many big hardware and software firms as working with the spies, including the likes of Microsoft, Apple and Intel. Fortunately for those with something to hide there are alternatives to big American firms. A popular one is TrueCrypt, a piece of software which lets its users scramble the contents of their computers in a way that means anyone who does not know the password will see only a stream of gibberish.
Or that is what it used to do. On May 29th TrueCrypt’s website was updated with a brief, cryptic message. It warned that “Using TrueCrypt is not secure as it may contain unfixed security issues”. A new version was released that was incapable of encrypting anything. It exists only to help users recover encrypted files.
The announcement caused plenty of raised eyebrows. TrueCrypt had been in development (by a group of anonymous programmers) for ten years and was popular with everyone from security-conscious lawyers to journalists with sources to protect and dissidents in countries where too much complaining can land you in prison or worse. It is open-source, meaning its code is freely available for anyone to look at. Mr Snowden’s revelations had boosted its popularity still further.
Curiouser and curiouser
TrueCrypt offered a short explanation: the end of Microsoft’s support for its ancient Windows XP operating system. Newer versions of Windows come with their own disk-encryption program, BitLocker, and the message recommends using that instead. But, as security researchers were quick to point out, this is a strange piece of advice. After Mr Snowden’s revelations, those with a serious need for TrueCrypt would be reluctant to trust BitLocker.
One theory is that TrueCrypt’s developers have simply been hacked, and that the message is a piece of mischief-making. But SourceForge, a repository for open-source software which hosts TrueCrypt, reported that it had noticed nothing unusual: “We see no indicator of account compromise; current usage is consistent with past usage.” Had they been hacked, the development team might have been expected to say so in public. But they have not.
Another, more paranoid interpretation is that the developers have been tapped on the shoulder by the Men in Black. That is what happened to LavaBit, an e-mail provider which promised to encrypt its users’ messages. Like TrueCrypt, it was used by Mr Snowden. It shut itself down in August after the American government came calling, demanding the site’s encryption key, which could be used to unscramble the e-mail of all its roughly 400,000 users. A gag order required that the firm’s founder, Ladar Levison, not tell anyone this was happening, something that Mr Levison resisted. If TrueCrypt has been similarly clobbered, the sudden shutdown might be designed to warn its users off.
Since TrueCrypt’s developers shun the limelight, no one can be sure. But Matthew Green, a cryptographer at Johns Hopkins University who is helping to co-ordinate a formal security audit of TrueCrypt, thinks the real explanation is more prosaic. He blames a mix of burnout and events, pointing out that, over the ten years of its development, what might have been a fun side project for a group of footloose 20-something programmers could well have turned into an unwelcome burden on their free time. “Then all of a sudden you have Glenn Greenwald [one of the journalists to whom Mr Snowden leaked his documents] using it to secure stuff with real national-security implications,” he says. “Not to mention people like me deciding to audit it—that’s when it’s no longer fun anymore.” Dr Green is in contact with someone claiming to be one of TrueCrypt’s developers, who confirms that story.
Yet even this explanation is not entirely satisfying. Why quit so abruptly, with so little warning? When developers of open-source software get bored, the reins are often taken up by others, but TrueCrypt has made no effort to organise something similar. (Dr Green hopes other programmers may nonetheless step in, though there may be legal complications.) And why give the questionable advice to move to BitLocker? Whatever the answer—and whether or not it eventually becomes public—the mystery is a neat illustration of the fallout from Mr Snowden’s revelations for the computer-security industry, which must now recalibrate its professional paranoia. Everyone agrees that a little more is sensible. Yet too much would be crippling.