How did they get caught? Someone built one of the service packs without stripping the symbols from the code, and right there where everyone could see it was "_NSAKEY."Wirecutter follows up with a link to techdirt saying the NSA and GCHQ Admit The Public is the Enemy. Internal documents, referenced by the Guardian (UK) show the NSA refers to the public as "adversaries".
Now Microsoft denied that this was in fact what the key was, but what they didn't do was release the source code in question to prove it. No, they simply "asserted" that one should trust them because, well, they're Microsoft.
Among other things, the program is designed to "insert vulnerabilities into commercial encryption systems". These would be known to the NSA, but to no one else, including ordinary customers, who are tellingly referred to in the document as "adversaries".That's your government referring to you. Apparently not without some sense of humor, among the code names the NSA used internally for these programs were Manassas and Bull Run, a major battle in the (first?) civil war. The UK GCHQ used the name Edgehill, the first major engagement of the English civil war, more than 200 years earlier.
It seems there's only one answer, tear down the agency. I'm partial to the argument that we need an agency that performs the NSA's original mission - to monitor and, yes, spy beyond the water's edge. Foreign only. So we need a massive cancer-like surgery to remove the domestic side of the house while leaving the international side there. Ain't gonna happen without serious disruption, if ever.