RSA Security Secretly Accepted $10 Million to Weaken Encryption Standard

When Edward Snowden's NSA leaks began surfacing in 2013, security researchers noticed something odd in the documents. A cryptographic algorithm called Dual_EC_DRBG, which had been quietly adopted as a default standard in RSA Security's software, appeared to contain a mathematical weakness that looked deliberately engineered. The suspicion was dark: had the NSA somehow influenced RSA to weaken encryption that millions of people depended on?

For years, RSA and federal officials denied any improper relationship. The company insisted its decisions were made independently based on technical merit. Security experts who questioned Dual_EC_DRBG were often dismissed as conspiracy-minded. The algorithm had been blessed by NIST, the National Institute of Standards and Technology, so surely the vetting process was sound. Dual_EC_DRBG became embedded in countless security products, protecting everything from financial transactions to classified communications. Most users never knew the debate existed.

Then, in December 2013, Reuters published an investigation that changed everything. The news organization obtained internal NSA documents, courtesy of Snowden, showing that the agency had indeed pressured RSA Security to make Dual_EC_DRBG the default in their toolkit. The kicker: Reuters also revealed that RSA had received $10 million from the NSA for doing so. This wasn't speculation or inference—it was a documented contract.

The documents showed the NSA knew something others didn't. Internal agency papers revealed that Dual_EC_DRBG contained a backdoor, a hidden weakness that theoretically allowed the NSA to decrypt communications protected by the algorithm. The agency had engineered the standard specifically so it would appear secure to outside observers while leaving a skeleton key in NSA's pocket. By paying RSA to make it the default, they had ensured massive adoption.