<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:14pt"><div><a href="http://finance.yahoo.com/news/white-house-spy-agencies-deny-nsa-exploited-heartbleed-215906148.html">White House, spy agencies deny NSA exploited 'Heartbleed' bug</a><span style="font-size: 14pt;"> </span></div><div class="cover-wrap " style="text-align: center; width: 734.125px; box-sizing: border-box; margin-bottom: 30px; padding: 0px 10px; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 13px; line-height: 16.25px;"><div class=""><div class="img-wrap" style="position: relative;"><figure class=" cover
get-lbdata-from-dom
go-to-slideshow-lightbox
" data-id="1a5c26b2-9131-3f3d-b44b-b82daae2fd33" style="margin: 0px; padding: 0px; position: relative; cursor: pointer;"><div class="cta-overlay" style="height: 401px; left: 0px; position: absolute; top: 0px; -webkit-transition: background-color 0.24s linear; transition: background-color 0.24s linear; width: 714.125px;"><div class="cta-text large" style="margin-top: 35px; color: white; opacity: 0; position: relative; -webkit-transition: opacity 0.24s linear; transition: opacity 0.24s linear; font-size: 16px; top: 200.5px;">photo<span style="color: gray; font-size: 12px; white-space: nowrap;">Security experts warn there is little Internet users can do to protect themselve\</span><span style="font-size: 15px; line-height: 24.000001907348633px; color: rgb(0, 0, 0);">WASHINGTON (Reuters) - The White House and U.S. intelligence agencies said on Friday neither the National Security Agency nor any other part of the government were aware
before this month of the "Heartbleed" bug, denying a report that the spy agency exploited the glitch in widely used Web encryption technology to gather intelligence.</span></div></div></figure></div></div></div><div class="body yom-art-content clearfix" itemscope="" itemtype="http://schema.org/Article" style="zoom: 1; max-width: 100%; overflow-x: scroll; font-family: 'Helvetica Neue', HelveticaNeue, helvetica, arial, sans-serif; font-size: 15px; line-height: 24.000001907348633px; margin-bottom: 20px; padding: 0px 10px;"><div style="margin-bottom: 1.1em;">The White House, the NSA and the Office of the Director of National Intelligence issued statements after Bloomberg reported that the NSA was aware of the bug for at least two years and exploited it in order to obtain passwords and other basic information used in hacking operations. The Bloomberg report cited two unnamed sources it said were familiar with the matter.</div><div style="margin-bottom:
1.1em;">The Heartbleed bug is considered one of the most serious Internet security flaws to be uncovered in recent years.</div><div style="margin-bottom: 1.1em;">"Reports that NSA or any other part of the government were aware of the so-called Heartbleed vulnerability before April 2014 are wrong," White House National Security Council spokeswoman Caitlin Hayden said in a statement.</div><div style="margin-bottom: 1.1em;">"This administration takes seriously its responsibility to help maintain an open, interoperable, secure and reliable Internet," Hayden added.</div><div style="margin-bottom: 1.1em;">Bloomberg was not immediately available to comment.</div><div style="margin-bottom: 1.1em;">The discovery of Heartbleed by researchers with Google Inc and a small security firm, Codenomicon, prompted the U.S. Homeland Security Department to advise businesses on Tuesday to review their servers to see if they were using vulnerable versions of widely used
software known as OpenSSL.</div><div style="margin-bottom: 1.1em;">OpenSSL is used to encrypt email and other communications and to protect the websites of big Internet companies, including Facebook Inc, Google Inc and Yahoo Inc. The bug, disclosed Monday, allows hackers to steal data without a trace.</div><div style="margin-bottom: 1.1em;">NSA spokeswoman Vanee Vines said in a separate statement: "NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private-sector cybersecurity report."</div><div style="margin-bottom: 1.1em;">Hayden said the federal government relies on OpenSSL to protect the privacy of users of government websites and other online services. "If the federal government, including the intelligence community, had discovered this vulnerability prior to last week, it would have been disclosed to the community responsible for OpenSSL," Hayden
added.</div><div style="margin-bottom: 1.1em;">Hayden said that when U.S. agencies discover a new vulnerability in commercial and open-source software, "it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose." Such vulnerabilities are known as "zero-day" flaws because the software developers have had zero days to fix them.</div><div style="margin-bottom: 1.1em;">In December, a five-member advisory panel convened to review electronic surveillance policy urged the White House to sharply curtail the use of undisclosed flaws and stop undercutting encryption standards. The panel included former White House cybersecurity advisor Richard Clarke.</div><div style="margin-bottom: 1.1em;">In late February, a senior White House official said the Obama administration was intensively studying both issues.</div><div style="margin-bottom: 1.1em;">The administration statements issued
on Friday confirmed that the review had already "reinvigorated an interagency process for deciding when to share vulnerabilities" on a case-by-case basis.</div><div style="margin-bottom: 1.1em;">The activities of the NSA have come under sharp scrutiny since former agency contractor Edward Snowden leaked numerous documents exposing expansive U.S. surveillance efforts.</div><div style="margin-bottom: 1.1em;">Even before Snowden's emergence, former officials, including Clarke, told Reuters that offensive and spying considerations had dominated inside the NSA, causing it to withhold information instead of warning the public about new flaws.</div><div style="margin-bottom: 1.1em;">Clarke told Reuters Friday that the NSA had not known of Heartbleed.</div><div style="margin-bottom: 1.1em;">The U.S. government warned banks and other businesses on Friday to be on alert for hackers seeking to steal data exposed by the bug, as a German programmer who volunteered
with OpenSSL took responsibility for inadvertently launching the security crisis.</div><div style="margin-bottom: 1.1em;">(Additional reporting by Joseph Menn; Editing by Jonathan Oatis)</div></div></div></body></html>