After the reversing revelations published at RWC about the 2008 introduction of Dual EC to their code, it&#x27;s been more or less established that Dual EC was deliberately introduced to their code by their development team as a backdoor.<p>When they reverted the &quot;unauthorized&quot; changes from 2012 (the backdoor in the news from a few weeks back), they were merely reverting to an older backdoor configuration.<p>The Reuters story isn&#x27;t especially precise.<p>Dual EC, the construction, was designed by NSA (that&#x27;s the &quot;designed by NSA&quot; referred to by the article.<p>NSA didn&#x27;t write the code that appeared in ScreenOS in 2008 (or at least there&#x27;s no evidence that they did).<p>Virtually nobody believes the 2012 Dual EC backdoor was implanted by NSA (Edward Snowden stated on Twitter that he believed NSA notified Juniper of that backdoor).<p>The big question now is how to attribute the 2008 backdoor (the original introduction of Dual EC to the platform). I lean towards believing it was sanctioned by NSA, because the changeset that introduced it included subtle tweaks to the rest of the system to make it easier to exploit, and those tweaks were --- I personally think --- not common knowledge among practitioners in 2008.<p>But there are arguments that it wasn&#x27;t NSA; in particular, while the tweaks were subtle, the code introducing them is extremely hamfisted, easily reversed, and something of a dead giveaway about the nature of Dual EC, which, while known to be problematic in 2008, wasn&#x27;t 100% believed to be the key escrow system it turns out to be.<p>If it&#x27;s not NSA that introduced the original 2008 Dual EC backdoor, that&#x27;s a devastating argument against policy officials who think we should design crypto backdoors: here&#x27;s a backdoor <i>concept</i> designed in secret at NSA, turned against the US shortly after its introduction and undiscovered by the &quot;good guys&quot; for almost 10 years.