Wait, what? TrueCrypt 'decrypted' by FBI to nail doc-stealing sysadmin

Do the Feds know something we don't about crypto-tool? Or did bloke squeal his password?

Discontinued on-the-fly disk encryption utility TrueCrypt was unable to keep out the FBI in the case of a US government techie who stole copies of classified military documents. How the Feds broke into the IT bod's encrypted TrueCrypt partition isn't clear.

It raises questions about the somewhat sinister situation surrounding the software team's sudden decision to stop working on the popular project last May.

US Air Force sysadmin Christopher Glenn was sent down for 10 years after stealing military documents relating to the Middle East, in addition to copying emails controlled by the commander of a special unit that conducts military operations in Central and South America and the Caribbean, as we reported.

Glenn, 34, had secret-level clearance, and worked at the Soto Cano Air Base in Honduras installing and maintaining Windows 7 systems when he swiped copies of the classified files. He was arrested, charged, and appeared before a court in the southern district of Florida, where he admitted breaking the US Espionage Act and Computer Fraud and Abuse Act. He was sentenced on Friday.

According to the Sun Sentinel, the court heard a claim by Gerald Parsons, an army counterintelligence expert, that the FBI had managed to access a concealed and encrypted hard-drive partition within which Glenn had hidden the stolen files.

The hidden compartment was protected using "a complex 30-character password," Parsons said. It would take the Feds millions of years to crack it by brute force. A summary of Parsons' testimony is here [PDF].

The court heard that the partition was created using TrueCrypt, a popular source-is-available encryption tool, developed from 2004 up until last year when its anonymous developers mysteriously closed the project down.

The TrueCrypt team's decision to cease maintenance of the project made headlines in the tech world when its website was replaced with a warning against continued use of the software, with little to no explanation of why.

An audit of TrueCrypt, which began before the project imploded, was unable to offer additional information as to why it had been discontinued. Instead, the team of expert security researchers who had carried out the audit declared that they had found no evidence of any deliberate backdoors or serious design flaws in its code.

Seized hard drives and discs

According to the government's lawyers, "among the electronic equipment seized from [Glenn's] residence was a Synology-brand computer storage device (the Synology device), which stored a hidden and encrypted compartment labeled '2012 Middle East' into which [he] had again copied the same three [stolen] sub-folders and 18 files, including the JTF-B Commander's entire classified email account that [he] stole on June 17, 2012."

Seized ... the equipment found in Glenn's home in Honduras, according to court documents

The prosecution continued [PDF, page 4], with the following emphasis our own:

The encryption software that Glenn used to conceal the stolen classified materials in the Synology device is a program called TrueCrypt. In October 2011, Glenn had sent an email to an associate with an internet hyperlink to an article entitled 'FBI hackers fail to crack TrueCrypt.' In this case, the FBI did decrypt Glenn's hidden files containing the stolen classified materials.

It is, of course, entirely possible the FBI or some other agency was able to extract the password from Glenn while interrogating him – the man changed his plea to guilty halfway through the case, and may have sung like a canary. Or perhaps his computer systems were bugged, revealing his encryption key. You can read his plea bargaining here [PDF].

The prosecution's wording has bothered the rabble of infosec nerds and security researchers on Twitter, who have been sensitive to any mention of TrueCrypt since the project's shocking shutdown. The community is largely skeptical of Parsons' claims.

@PogoWasRight @mattblaze yeah either that or he had it stored or written down somewhere. or they have a capability against TrueCrypt ?!

— K.M. Gallagher (@ageis) August 3, 2015

@ageis @PogoWasRight Agreed.

— matt blaze (@mattblaze) August 3, 2015

Ross Anderson, a professor of security engineering at the University of Cambridge's Computer Laboratory, told The Register he had assumed the TrueCrypt shutdown was "a warrant canary of some kind, but that is by no means certain." Meaning, it may have been a signal that the project had been compromised and was forbidden from explicitly warning people to this fact.

Some do fear that an intelligence agency had, in some way, been responsible for the discontinuation of what was previously a premiere tool to protect privacy. TrueCrypt was used by all sorts of people, from petty criminals to whistleblowers and journalists to technologically sophisticated, if repressive, regimes.