Encrypted Email Service Tuta Denies It's a 'Honeypot' for Five Eyes Intelligence

[Nomen Nescio]

GIZMODO

Privacy and Security

Encrypted Email Service Tuta Denies It's a 'Honeypot' for Five Eyes
Intelligence

For years, Tutanota (which recently rebranded to "Tuta") has been a trusted
email provider. A former Canadian cop has accused it of being a honeypot.

By Lucas Ropek - Published November 15, 2023

https://gizmodo.com/tuta-email-denies-connection-to-intelligence-services-1851022465

There are only a handful of trusted end-to-end encrypted email providers.
Of those, Tuta (which has long been known as “Tutanota” but recently
rebranded ) is one of the more well-known. This week, the company found
itself on the defensive after being labeled a “front” for law enforcement
and intelligence services. In an attempt to clear its name, the company
released a statement denying that it’s a honeypot operation, after a
former, highly placed Canadian intelligence official alleged in court that
was the case.

The cop in question, Cameron Ortis, formerly ran a “highly secret unit”
within the Royal Canadian Mountain Police, but is now on trial for
allegedly having attempted to sell government intelligence to criminals,
CBC reports.

Ortis has denied that he was actually attempting to sell state secrets. In
his testimony, which was made public this week, Ortis instead said that he
was involved in a special operation. As part of that operation, agents used
Tuta, which he described as a “storefront”—or a kind of honeypot—to lure in
prospective criminals for surveillance, he said. CBC describes the former
government official’s allegations like this:

...according to Ortis, [another agent] briefed him about a “storefront”
that was being created to attract criminal targets to an online
encryption service. A storefront, said Ortis, is a fake business or
entity, either online or bricks-and-mortar, set up by police or
intelligence agencies. The plan, he said, was to have criminals use the
storefront — an online end-to-end encryption service called Tutanota —
to allow authorities to collect intelligence about them.

“So if targets begin to use that service, the agency that’s collecting that
information would be able to feed it back, that information, into the Five
Eyes system, and then back into the RCMP,” Ortis claimed, in reference to
the Five Eyes intelligence-sharing alliance, of which Canada is a prominent
member. Ortis has claimed that some unnamed Five Eyes foreign agent
introduced him to the honeypot operation and that he didn’t notify his
superiors at the RCMP about it. Follow-up questions about the whole thing
have mostly led him to say things like “I don’t recall,” and “that’s
something I can’t talk about.”

Tuta has vehemently denied the allegations against it. In a blog post
published Monday, the company stressed that there was no “backdoor” in its
service and said that Ortis’ allegations were a “complete and utter lie”:

This weekend Tutanota was called a “storefront” and a “honeypot” -
without any evidence. Tutanota - or now Tuta - is the encrypted email
service with a focus on privacy, open source and transparency. It is
not linked to any secret service and there is no backdoor included. It
is not even necessary to trust our words, as our entire client code is
published so that anyone can verify that there is no backdoor.

In its statement, Tuta added that it would be watching Ortis’ “case with
great interest” and that it was “actively working with...[its] legal team
to fight” the “slanderous claims” that had been made against it.

It should be pointed out that Tuta does host its client-side code on
Github, though the company has never fully open-sourced its server-side
code. The company has stated that this shouldn’t matter since all of its
encryption occurs on the client side, and that’s what counts when it comes
to user privacy.

It’s not clear what evidence (if any) Ortis has that Tutanota is a
“storefront,” as he’s claimed. So far, he’s provided none. The story is
interesting, however, for its connection to a verified episode involving
law enforcement’s attempts to backdoor a well-known privacy service. One of
the people that Ortis is accused of spilling government secrets to is
Vincent Ramos, the former CEO of Phantom Secure—an encrypted phone company
that police say frequently sold its devices to drug cartels and other crime
syndicates. It was previously reported that the FBI once tried to force
Ramos to install a backdoor into his software so that the agency could spy
on Sinaloa Cartel members. Canadian law enforcement was notably involved in
the investigation into Phantom Secure and Ramos and assisted with his
arrest. In 2019, Ramos was sentenced to nine years in prison.

[Santayana]

On Fri, 16 Feb 2024 03:00:17 +0100 (CET), Nomen Nescio <nob...@dizum.com>
said:

[interesting article snipped]

Tutanota a honeypot? Wouldn't be the least bit surpring, especially
considering the Crypto AG scandal:

The CIA used a Swiss company to spy on over 100 countries

Politics

The CIA used a Swiss company to spy on over 100 countries
25.05.2020 -- Marc Lettau

https://www.swisscommunity.org/en/news-media/swiss-review/article/the-cia-used-a-swiss-company-to-spy-on-over-100-countries

A spy scandal has rocked Switzerland. For decades, US and German
intelligence surreptitiously harnessed Swiss technology to snoop on a
multitude of countries. Did the Swiss government turn a blind eye?

Ostensibly, Zug-based Crypto AG was a respectable Swiss company and
technology leader. It had a very niche specialisation in encryption
devices. These products were sold to countries whose armies and
intelligence services wanted to hide confidential communications from
prying eyes.

However, Crypto AG was anything but a normal Swiss company adhering to
normal Swiss values. Its business -- cryptic in the truest sense -- was
secretly owned by the CIA and its West German counterpart, the BND, from
1970 onwards. Both intelligence agencies were able to introduce back doors
in the company's supposedly uncrackable Swiss-made encryption systems.

Through their deliberate manipulations, the CIA and BND were able to
eavesdrop on 148 countries -- both friend and foe -- for decades. All these
countries invested millions in Crypto's rigged devices, believing that they
were getting trustworthy technology from neutral Switzerland when in fact
they were paying for the dubious pleasure of being spied on.

The revelations became public in mid-February of this year -- the result of
a joint investigation by Swiss television (SRF), German broadcaster ZDF,
and the "Washington Post", based firstly on leaked CIA documents and,
secondly, on interviews with former Crypto AG employees and their families.

The "intelligence coup of the century" -- as the CIA called it -- evidently
has far-reaching implications. It turns a spotlight on the tension-filled
Cold War era, with the extent of the CIA/BND collusion casting new light on
many historical events of the last 50 years. However, the extent to which
recent world history needs rewriting will only become clear once the Crypto
affair has been thoroughly digested. The question of whether Switzerland
needs to redraft its own history is generating discussion. After all, what
did the Swiss government know about what was going on? Was our country
hosting foreign intelligence activities but keeping them deliberately
secret?

"The programme exceeded our wildest expectations"

How successful were the CIA and BND in manipulating Crypto's Swiss systems
for their own intelligence purposes, and what impact did their actions
have? The effectiveness of spying always mirrors the amount of damage
caused to the party being spied on. It is all a question of perspective.
According to leaked sources, the CIA saw it as the "most productive and
longest-running intelligence project since the Second World War". It
allowed 80 to 90 per cent of Iran's confidential communications to be
intercepted. According to the CIA: "The programme exceeded our wildest
expectations."

Wiretapping enabled the USA in particular to influence the outcome of
almost every major conflict in its favour. For example, decryption records
now show that the CIA supported the 1973 military coup in Chile. The CIA
and BND also monitored communications within the military junta and knew
from the outset about the persecution and torture that cost 30,000
opponents of the regime their lives.

Some initial questions and answers

The Crypto AG revelations have caused quite a stir, although it is too
early to predict the full fallout. The following key questions outline the
implications for Switzerland:

Why did the CIA and BND use a Swisscompany?

Swedish cryptologist Boris Hagelin established Crypto AG in 1952. Hagelin
deliberately chose to base the business in Switzerland because, as the CIA
source notes: "When one was engaged in a sensitive business like
cryptography, better to seek the protection of a neutral country with fewer
moral scruples." Hagelin sold Crypto to a front company of the CIA and BND
in 1970.

The CIA and BND were the ones who were spying. Why is this being viewed in
Switzerland as a ‘Swiss' scandal?

The issue for Switzerland centres on what the federal government knew about
the motives, methods and extent of the spying, and whether it tolerated or
even facilitated what the two intelligence agencies were doing.

Suspecting at the time that foreign powers had tampered with their prized
technology, Crypto employees in Switzerland involved the authorities. What
happened next?

It is documented that an employee of Crypto AG told the authorities in the
mid-1970s that the products sold by his company had, according to a file
entry in the Swiss Federal Archives dated 24 July 1977, been fitted with
"manipulated key generators that allowed West Germany and the USA to decode
messages". Embarrassingly, part of this record has since disappeared.

Switzerland's federal police looked into the allegations at the time but
found no proof of wrongdoing. Witnesses of that era now lament the fact
that police inquiries were merely pro forma in nature.

Isn't the whole affair just a relic of the Cold War?

It was in the mid-1970s that doubts were first raised. Former Crypto
employee Hans Bühler openly accused the company of cooperating with foreign
intelligence services (Bühler, who spent nine months in an Iranian jail on
suspicion of spying, made the allegations in his 1994 book "Encrypted").
However, it is only now that we see the full implications after information
from CIA sources recently came to light. The snooping also continued far
beyond the Cold War until 2018, albeit without German involvement: the BND
left the programme in 1993 as a result of German reunification.

To what extent was the Federal Council complicit in the affair, if at all?

This is a key question. How much the Federal Council knew about the
conspiracy is still anyone's guess. CIA documents mention former Federal
Councillor Kaspar Villiger (FDP) as one of those who were aware of what was
going on. Villiger, now 79, has strenuously denied any knowledge.

Why does the issue of whether the Federal Council knew about the spying
carry so much weight?

If it turns out that the Federal Council -- or individual Federal
Councillors -- knew about the surveillance, then it begs some other serious
questions. Did the Federal Council turn a blind eye to CIA spying, or did
it try to cover it up? Did the Federal Council resign itself to foreign
entities taking advantage of Swiss neutrality? And if Switzerland was
indeed complicit, turned a blind eye or deliberately covered it up-- how
does spying against warring states square with Swiss neutrality?

How have the Federal Council and parliament reacted to the affair?

The President of the Swiss Confederation, Simonetta Sommaruga, has said
from the outset that her government will look at all the facts and would
welcome an investigation. Defence Minister Viola Amherd has also confirmed
that her department possesses documents suggesting complicity on the part
of predecessor Kaspar Villiger. The parliamentary control body will now
examine the allegations in order to find out what Switzerland knew about
the espionage -- and whether the Swiss intelligence service may even have
benefited.

To what extent does the ‘Crypto leaks' scandal jeopardise Switzerland's
current role?

Switzerland mediates in many conflicts, offering its ‘good offices' in some
of the world's most geopolitically tense regions. For example, it is
currently acting as an intermediary in the US-Iran crisis. Switzerland can
only play this diplomatic role if its credibility as a neutral state is
intact. This credibility is precisely what is at stake. It was the
Iranians, incidentally, who were particularly spied on via the rigged Swiss
devices sold to them by Crypto representative Hans Bühler.

The Americans and Germans spied. Why does this damage Switzerland's
reputation?

It remains to be seen how much of a hit Switzerland's image abroad has
taken, but how Switzerland sees itself has certainly been affected. The
neutrality that so many Swiss hold dear has been damaged. The scandal could
make a mockery of Swiss neutrality (see the opinion piece below).

Credibility, trust and self-image are all soft factors. Will the
revelations negatively affect any tangible economic interests?

Switzerland's technology sector is on the up. This, too, is reliant on the
country having a credible image. Furthermore, Switzerland wants to position
itself as a squeaky clean digital innovation hub and is pushing for an
international initiative to promote ethical standards. The Crypto affair
could not have come at a worse time.

Further information

Documentary on Swiss television (SRF) in German

Hans Bühler / Res Strehle: "Encrypted -- the case of Hans Bühler", Wird &
Weber-Verlag, new edition 2020; ISBN 978-3-03922-044-1

Patrick Feuz is a journalist, historian, and author of several non-fiction
books. He has been the chief editor of Berne-based daily newspaper "Der
Bund" since 2015.

▪ ▪ ▪

Opinion piece

A Zug-based company has been revealed as the hub of an audacious spying
operation. From the early 1970s, the CIA and the then West German
intelligence service, BND, used rigged Swiss encryption devices to snoop on
over 100 different countries. The Americans may have continued using this
technology to eavesdrop on governments and armies until very recently.

Germans and Americans wiretapped Argentina's generals during the Falklands
War, not to mention the Iranian revolutionary guards during the occupation
of the US embassy in Tehran. They claim that this surveillance, lasting
half a century, helped to avert suffering -- though their actions may also
have had the opposite effect.

Either way, these revelations hurt. They show that Swiss neutrality, held
up to this day as sacrosanct, is often a mere pretence. The US and German
intelligence services benefited directly from our neutrality and our status
as a technology leader. This was the main reason why so many encryption
devices were purchased in Switzerland of all places.

Swiss functionaries -- from intelligence to military, and from judiciary to
politics -- must have known or suspected that these machines had been
manipulated. After all, Switzerland was aligned to the West in de facto
terms during the Cold War. The Swiss intelligence service worked closely
with the Americans and still relies on US assistance to this day.
Switzerland therefore turned and continues to turn a blind eye

Put another way, neutrality was and is a myth to some extent. Strictly
speaking, participation in military alliances is the only thing that
neutrality has ever prohibited. Yet it has always been celebrated as a way
of life. We will treat everyone equally and keep quiet. Politicians and the
military peddle this lie, and we are only too happy to go along with the
charade. Especially if it's good for business.

But now that this affair has blown up in our faces, we may now be paying
the belated price for our amenability, both political and economic. If
people begin to doubt Swiss impartiality, demand could wane for the good
offices of our diplomats and the products of our technology companies.

▪ ▪ ▪