To avoid NSA, Cisco gear gets delivered to strange addresses

One of the most successful U.S. National Security Agency spying programs involved intercepting IT equipment en route to customers and modifying it.

At secret workshops, backdoor surveillance tools were inserted into routers, servers and networking equipment before the equipment was repackaged and sent to customers outside the U.S.

The program, run by the NSAs Tailored Access Operations (TAO) group, was revealed by documents leaked by former NSA contractor Edward Snowden and reported by Der Spiegel and Glenn Greenwald.

It was one of many revelations about the NSA that caused widespread suspicion that U.S. technology products shouldnt be trusted, even if companies strenuously denied helping the agency.

And it appears some Cisco Systems customers have since taken steps to prevent NSA tampering.

The company has shipped equipment to addresses that are unrelated to a customer, said John Stewart, Ciscos chief security and trust officer, on Wednesday during a panel session at the Cisco Live conference in Melbourne.

In theory, that makes it harder for the NSA to target an individual company and scoop up their package. But supply chains are tough to secure, Stewart said, and once a piece of equipment is handed from Cisco to DHL or FedEx, its gone.

Still, the risk of such tampering is pretty low for most customers. Cisco has been working on better ways for customers to verify the integrity of the systems it ships, but there will always be certain amount of risk that cant be mitigated, Stewart said.

If a truly dedicated team is coming after you, and theyre coming after you for a very long period of time, then the probability of them succeeding at least once does go up, Stewart said. And its because theyve got patience, theyve got capacity and more often than not, theyve got capability.

One of the leaked Snowden documents, dated June 2010, has two photos of an NSA interdiction operation, with a box that said Cisco on the side.

See the article here:
To avoid NSA, Cisco gear gets delivered to strange addresses