13 Comments
User's avatar
J. Gan.'s avatar

Always remember, the USA has a history of backdoors as well. Example: 1980s PROMIS software used by district attorney offices across the country. We then sold it abroad, after installing a backdoor, so we could spy on who and how it was being used and to keep tabs on the criminal info stored in it,.

Expand full comment
BT's avatar

Go back further...Postmasters General and the Patent Offices.

Check out behaviors across nations.

Probably pretty old espionage protocols.

Once one country does it, it tends to spread.

Expand full comment
Perry Simms's avatar

Ah! The bizarre history o PROMIS, one of my first rabbit holes. I fondly remember the snug cozy walls, the deep passages...

PROMIS was designed by Bill Hamilton (Inslaw) to track criminal cases piling up in DOJ offices across the country. In an interview for this story, he stated, “It was always a tracking program. It tracked cases in local U.S. Attorneys’ offices, which means street crimes, keep track of the scheduled events in court, what actually takes place, who’s there, witnesses, police officers, conclusions, convictions, acquittals, whatever.”

Inslaw claimed the DOJ had stolen their software.

During the 12-year long legal proceedings, Inslaw accused the Department of Justice of using the stolen software for covert intelligence operations against foreign governments, and involvement in a murder. These accusations were eventually rejected by the special counsel and the Court of Federal Claims.

Hamilton explained, "We developed it originally just for prosecutors. But some of our users wanted to have it shared with the courts and the police."

The software was engineered to make it adaptable. In making it highly adaptable, a byproduct was to make it useable for non-prosecutor tracking and that made it adaptable totally outside the criminal justice system.”

PROMIS was just a framework for fuzzy-matching data, digging through archives, finding that this record and that record actually talk about the same person, for example.

There's a lot of imagination active around such programs, including among government employees. The reality is mundane.

Expand full comment
J. Gan.'s avatar

Interesting material! Hamilton had to prove it was being used outside US borders, and when they were contacted by the RMP of Canada (looking for instructions in French) they had their evidence. Hamilton was former NSA, so my question: was he a white hat or deep state tool?

Expand full comment
Perry Simms's avatar

Looks to me like he put his experience to good use to make a tool that helped tie-together otherwise unlinked data. That is a core problem in all kinds of IT domains - government and business, and nothing I've seen points to anything nefarious in the product as released by Hamilton.

To me this looks like some spooks saw Hamilton's program -- a useful tool wanted by governments (like angry birds was wanted by phone users) -- and decided to backdoor it. That play has been repeated many times with many different targets.

Expand full comment
mary-lou's avatar

yikes

Expand full comment
BRK7_2's avatar

Java was designed by James Gosling at Sun Microsystems. Oracle, which bought Sun in 2010, offers its own HotSpot Java Virtual Machine. However, the official reference implementation is the OpenJDK JVM, which is open-source software used by most developers and is the default JVM for almost all Linux distributions.

Expand full comment
The Underdog's avatar

Whilst the concept was designed by James Gosling, Java has seen continual development post-purchase by Oracle.

The problem with OpenJDK (not mentioned in the listings), is if it copies Java too closely, it'll also mirror any backdoors unawares (the nature of backdoors are they're hidden: if everyone knew about it, then it'd be a front door!). The trade-off between accurate emulation and security, between "backwards compatibility" and updating the code.

Prime example of Open Source having backdoors: HeartBleed for OpenSSL. Oops!

Expand full comment
BRK7_2's avatar

Yes, thank you.

Expand full comment
supercellex4d's avatar

Crediting Oracle with inventing... anything... is a bit of a misnomer. They're a bit like if Microsoft kept on reselling licenses from other vendors like Seattle computers' CP/M clone QDOS and never even bothered to hire engineers that can ship new things. All their products are either plagerized from other tech companies, University projects, or open source software. This is true for Java and I'm pretty sure it's true for SQL because they're just a support vendor for the MIC and a patent troll. Not even Google likes them for fucks sake.

Expand full comment
supercellex4d's avatar

Yeah. In-fact their first product Oracle DB is just a shitty clone of IBM mainframe systems that he flipped to the literal fucking CIA. They're like Microsoft but even worse. At least Microsoft figured out how to poach creative engineering teams instead of just their resulting products.

Expand full comment
supercellex4d's avatar

Part of the reason bugs in OpenJDK went unchecked is Oracle pissed off literally evert single engineer that went on to just leave the resulting code behind because their open source maintainers are being dicks too. It killed virtualbox, and Android actually uses a different implementation called Dalvik that orajew went lalalalalalalala and sued Google and OHA/AOSP for. Not saying they aren't Israeli mossad backdoors but crediting them for creating these projects is literally more than they ever deserve. It's like crediting the GitHub account that tried to backdoor `xz` for creating xz-utils

Expand full comment
Jewell Highers's avatar

Par

Expand full comment