Here is a recent article discussing the DEA doing this: https://www.washingtonpost.com/news/powerpost/wp/2016/09/30/...

$600k to a particular airline employee, $1 million for a single parcel worker (this was over a few years).

Also there is the various NSA efforts to insert people into the encryption standards process, as well as use cooperative sources within companies to insert vulnerabilities in the commercial encryption systems:

http://www.nytimes.com/interactive/2013/09/05/us/documents-r...

Also the FBI/Yahoo email program was apparently done by just the CEO, a lawyer, and a few members of the email team. The security team wasn't informed, nor the board.

https://www.theguardian.com/technology/2016/oct/04/yahoo-sec...

The DEA program is pretty shocking and a great example, thanks for sharing!

The second one sounds more like an interdiction program, where vulnerabilities are inserted into the devices (this is a thing that was in the Snowden documents). The document gives no details. The highlights on the side are from an NYT journalist, not source material.

I disagree that the last example is an example of that. It's still unclear what the scanning was doing.

The Yahoo thing is a huge deal. Email providers do interception all of the time and have strong procedural controls.

The idea that people could bypass those processes and controls is a tremendous liability that no board would ever approve.

First of all, Skype is Microsoft. Second, they're well known to collaborate already. If NSA wanted a Skype feed, they could have it server or client side.

https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-...

Originally, and perhaps at the time this "backdoor" was created, Skype wasn't Microsoft.

Skype was around for along time before Microsoft bought it and changed its architecture and design.

This. It could well have been a backdoor that predates the "superpeer" change MS introduced right after acquisition. Skype was already under pressure from European authorities at the time, to provide intercept capabilities; European criminal networks (mafia etc) were early adopters and everybody knew it.

That collaboration looks like the same mechanism used to adhere to warrants, subpoenas, and NSLs. Do you think that any internet service in the world doesn't have similar mechanisms to comply with law enforcement requests in their home country?

I think you are misleadingly using the word "collaboration".

I also think you have failed to understand the article correctly; there is no reference to client side collection. Take another look.

Agreed. I'm just suggesting if someone were to ask for a client backdoor they could have one, just like they could ask for a server feed.

NKW gave a nice summary of some recent actions. For more historical examples, I highly suggest any of James Bamford's excellent books on the NSA. _The Puzzle Palace_ is a massive tomb, but a very good read. I haven't had a chance to read _Shadow Factory_ yet, but it is in my pile.

How do you think that Juniper VPN compromise got inserted into the code?