RSA's Coviello: NSA Can't Violate Security Community's Tradition of Trust -- Update

    By Danny Yadron 

    SAN FRANCISCO--The head of computer-security company RSA said American tech firms shouldn't work with intelligence agencies if the companies can't trust whether they're being used to protect computer networks or help government spies break into them.

    RSA Executive Chairman Art Coviello Tuesday made his first public comments since his firm was accused last year of selling weakened encryption products that may allow the National Security Agency to better spy on RSA customers. He spoke at a conference sponsored by RSA, a unit of EMC Corp., and an interview with The Wall Street Journal.

    If the NSA "exploits a tradition of trust within the security community, that's a problem," Mr. Coviello said in his speech. In the interview, he said, "If that is an issue, we can't work with the NSA."

    Mr. Coviello acknowledged that RSA has classified contracts with the government, but suggested the firm didn't know it may have aided government surveillance efforts.

    In the interview, he declined to comment on any specific contracts, responding to most questions on the matter with a grin. He said the company doesn't currently have any encryption-related deals with the NSA, adding that whether RSA has future contracts "will be dependent on assurances" from the government.

    Mr. Coviello's remarks are notable for an executive whose company has significant government ties, and point to a broader question for U.S. tech companies in the Edward Snowden era: Is the revenue from classified contracts worth the risk to their reputations?

    Documents leaked by Mr. Snowden, the former NSA contractor, last year showed the agency helped popularize a weak encryption formula, in the hope that it would help the agency spy on terrorists. In December, Reuters reported that RSA accepted $10 million to make the setting a default in one of its products, Bsafe.

    The Wall Street Journal recently confirmed that such a contract existed, based on conversations with people briefed on the matter. These people said there is no evidence RSA knew the encryption formula was weak.

    In a report, President Barack Obama's surveillance review panel said last year that the government shouldn't weaken encryption standards. Mr. Coviello said in the interview that he agrees with that recommendation, but said he isn't optimistic it will be accepted.

    Richard Clarke, a former White House cybersecurity official who sat on the commission, said Monday at the same conference that "trust in encryption was greatly eroded" by the RSA allegations.

    Wendy Nather, a research director at 451 Research LLC, said Mr. Coviello did a "pretty good" job of addressing trust issues Tuesday. She added, though, "He obviously didn't mention everything."

    RSA told customers last fall to stop using the encryption formula as soon as documents from Mr. Snowden suggested NSA holds a secret key to solve it.

    Encryption accounts for a small portion of RSA's business. Most encryption used on computers these days is based on a series of publicly available formulas--not algorithms owned by security companies.

    Mr. Coviello said the product in question, called Bsafe, mainly is bought by governments and that the Reuters article had no impact on business. Customers, he said, have been "maybe curious" about the matter.

    Nevertheless, the issue has roiled this year's RSA Conference, the equivalent of the Detroit auto show for the security community. Several security researchers canceled their presentations. Some of them are participating in a rival conference, called TrustyCon, nearby later this week.

    Security researchers question why RSA continued to use the formula in question even after mathematicians discovered holes more than seven years ago.

    Mr. Coviello said "there is maybe a little 20/20 hindsight here" and that relatively few researchers found problems with the formula before the Snowden leaks.

    Tuesday, he sought to broaden the debate about Internet security, proposing that governments stop using cyberweapons, cooperate on cybercrime and protect online privacy.

    "If the NSA had been more transparent maybe they wouldn't have the PR difficulty that they're having now," Mr. Coviello said. "That's really what I'm calling for: more of that transparency."

    Write to Danny Yadron at