The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle

More like private curriers with type written notes.

Personally, the biggest take away to this is the invasive targeting of completely innocent and ordinary people simply as a means to get access to things the NSA needed (sim Card keys). We have concrete evidence they nailed peoples personal email accounts and social networks merely as a means to an get crypto keys in mass. Sure, the potential mass surveillance is exceedingly problematic, but thats mainly problematic because of the potential for abuse. Abuse that we either assumed would happen or already had, but as far as I know there was little direct evidence of.

The absolute lowest bar for surveillance seems to be that a government doesn't use it to intentionally target innocent people/ those not in the game (hell, lets lower it even further to be only people the government themselves believe are innocent).[0]

That potentially allows dragnet collection of data if no one looks at it. It might allow hacking just a company's servers to get access to third party data. It probably allows you to spy on foreign heads of state (even if it's a boneheaded move). But it damn well doesn't allow you to go through the personal communications of people who you know have done nothing wrong and aren't even working for someone who has.

[0] This is precisely the woefully low bar Obama has been espousing : “The bottom line is that people around the world, regardless of their nationality, should know that the United States is not spying on ordinary people who don’t threaten our national security and that we take their privacy concerns into account in our policies and procedures,”

In 2007 I worked with Gemalto when they ported a Java/PKCS #11 Chip & PIN implementation to the .NET Micro Framework/CAPI for Microsoft, who were using it for challenge/response authN on a remote access project for the UK Ministry of Defence. There was a case study of the project on Microsoft.com, but it seems to no longer be there.

Anyway, this sucks because the Gemalto guys I did this with were to this day among the best vendors I've ever worked with. Really awesome guys, smart, and incredibly willing to share what they knew and did. And it's somewhat ironic that Gemalto are trusted by the UK MoD for sourcing their smart card components in Europe.

So much for keeping it local to avoid hacks.