Shady root certification company might have connections with the United States intelligence: Report | Digit

A company that is supposed to vouch for the legitimacy of online websites has connections with United States intelligence agencies and the law enforcement body, as reported by The Washington Post. The company’s name is TrustCor Systems, and it is trusted by several web browsers, such as Google Chrome, Apple Safari, Firefox and others, as a root certificate authority. For those catching up, a root certificate authority is an organisation that guarantees that websites are not fake and provides a certificate of authenticity. 

TrustCor could be linked with spyware makers

While that might not concern users, TrustCor Systems’ Panamanian registration records reveal that “it has the identical slate of officers, agents and partners” as a spyware maker associated with Arizona-based Packet Forensics, who might have sold “communication interception services to the U.S. government agencies.” 

The report also highlights that one of the TrustCor partners has the same name as the company managed by someone quoted as a spokesman for Packet Forensics in 2010, Raymond Saulino. The same person surfaced last year as a contact for a company that might have activated and operated over 100 million dormant IP addresses previously assigned to the Pentagon. 

Although the Pentagon recovered the IP addresses, it remains unclear why they were transferred in the first place. According to researchers, the activation of those addresses might have given the military access to massive internet traffic. Upon the report’s publication, a TrustCor executive said that the company “had not cooperated with any government information requests or assisted with a third party’s monitoring of its customers on behalf of others.”

TrustCor co-founders are not working anymore

So far, TrustCor has issued over 10,000 certificates for websites, many of which are hosted with a dynamic domain name provider called Np-IP, which allows websites to be hosted with changing IP addresses. While there have been no reports that the company has misused its power to issue inappropriate certificates, researchers speculate that the system “is only used against high-value targets within short windows of time.” 

What is shadier is that the company’s website mentions two men as the co-founders, one of which died months ago, and the other left the company as the chief technology officer in 2019. Altogether, TrustCor seems to be a mysterious company that might be operating under the radar. 

For more technology news, product reviews, sci-tech features and updates, keep reading Digit.in.