In December 2015, Juniper Networks issued an emergency security advisory about unauthorized code in its ScreenOS firmware - software running on NetScreen VPN appliances used by government agencies, telecommunications companies, and major enterprises worldwide. The code had two separate components: one that could allow an unauthorized person to log into any NetScreen device with administrator access, and one that could decrypt VPN traffic passing through those devices. Both had been present in ScreenOS since at least 2012.

Investigation revealed that one of the backdoors appeared to be built on cryptographic infrastructure that the NSA had deliberately weakened years earlier - then apparently repurposed by a foreign intelligence agency. The Juniper backdoor case became the most consequential real-world illustration of a theoretical argument security researchers had been making since 2007: that NSA efforts to weaken public cryptographic standards created vulnerabilities that adversaries could exploit.

Dual EC DRBG and the NSA's Manipulation

Dual EC DRBG (Dual Elliptic Curve Deterministic Random Bit Generator) is a random number generation algorithm that was standardized by NIST in 2007. NIST's standards process had included the NSA as a participant. In 2007, cryptographers Dan Shumow and Niels Ferguson demonstrated at a conference that Dual EC DRBG had a structural property: if you knew a specific relationship between two constants in the algorithm (called P and Q), you could predict the output of the random number generator from a small sample of its output.

The NSA had proposed the specific P and Q constants used in the NIST standard. If the NSA knew the relationship between them - a discrete logarithm relationship that would be computationally infeasible to compute without knowing it was there by design - they could decrypt any TLS session that used Dual EC DRBG for key generation. In 2013, Snowden documents published by the New York Times confirmed that the NSA had paid RSA Security $10 million to make Dual EC DRBG the default in their BSAFE encryption library - and that this was part of a deliberate NSA program to insert vulnerabilities into cryptographic standards.

[TECHNICAL NOTE]
The mathematical structure of the Dual EC DRBG backdoor: the algorithm works by multiplying an input by a point P on an elliptic curve, then multiplying by another point Q. If someone knows k such that Q = k*P (the discrete log relationship), they can compute from the truncated output of the generator what the full internal state of the generator is, and predict all future output. The NSA chose P and Q. The discrete logarithm of Q with respect to P is computationally infeasible to find by anyone who didn't design it that way. But the NSA knew the relationship because they chose the constants. This is sometimes called a "kleptographic" backdoor - designed to be exploitable only by someone who knows the trap door.

How the Juniper Backdoor Worked

ScreenOS used Dual EC DRBG for its VPN key generation. This was already a red flag - by 2012 the cryptographic community had widely flagged Dual EC DRBG as suspect. But Juniper had not changed its implementation. More significantly, Juniper had used the standard NIST P and Q values - the ones that might contain the NSA's trap door.

What the unknown attackers did was change the Q constant to a different value. If the original Q was the NSA's backdoor point, replacing it with a new Q meant that whoever knew the discrete log of the new Q now had the decryption capability - and it wasn't the NSA. The attackers had essentially copied the NSA's backdoor mechanism and installed their own version, rekeyed to their own trap door.

The second backdoor - the administrative password - was different: a hardcoded password that allowed SSH login to any NetScreen device with administrator privileges. This backdoor was separate from the Dual EC issue and was likely a simpler insertion.

Attribution: China?

US intelligence officials told Reuters in 2016 that they believed China was responsible for the Juniper backdoor. Attribution was based on indicators that remained classified. China denied involvement. The technical analysis suggested a sophisticated nation-state actor with both the cryptographic expertise to modify Dual EC DRBG's constants and the persistent access to Juniper's development infrastructure needed to insert and maintain the modified firmware across multiple ScreenOS versions over three years.

Some researchers suggested a different scenario: the NSA had originally inserted the Dual EC DRBG implementation into Juniper's firmware (whether by coercing Juniper or through other means), and a second actor had subsequently discovered the implementation and modified the Q constant to redirect the backdoor to themselves. Under this scenario, the NSA had built a door that a different actor had later changed the locks on.

A 2021 New York Times investigation reported that NSA and GCHQ had intentionally inserted the Dual EC DRBG implementation into Juniper's ScreenOS as part of a program to access VPN traffic. The subsequent modification of the Q constant by a foreign adversary was the unintended consequence of having built exploitable cryptographic infrastructure into commercial products.

[WARNING]
The NOBUS ("nobody but us") argument: NSA proponents of deliberately weakened cryptographic standards have argued that vulnerabilities can be designed so that only the NSA's superior capabilities allow exploitation - that the backdoors are "nobody but us" accessible. The Juniper case was a direct refutation. A trap door mechanism designed to be exploitable by the NSA was repurposed by a foreign intelligence agency with sufficient sophistication to recognize what they were looking at. There is no such thing as a vulnerability that only one party can exploit. Once a weakness exists, it exists for anyone with the technical capability to find and use it.

Congressional Response and Industry Impact

The Juniper backdoor triggered congressional investigations but no legislation directly addressing government-mandated cryptographic weaknesses. The debate was reframed as the "going dark" problem: law enforcement arguing that end-to-end encryption prevented access to evidence, security researchers arguing that any mandated access mechanism creates exploitable vulnerabilities.

Juniper patched both backdoors in December 2015. NIST deprecated Dual EC DRBG in 2014 following the Snowden revelations. RSA Security removed it as a default. The broader ecosystem of VPN and security appliances that had incorporated Dual EC DRBG in the 2007-2013 period represented a substantial, partially unknown attack surface - devices that may have been compromised using the original NSA key or the modified Juniper key, with no way to detect past decryption.