TPM is a chip that provides control over what software can or cannot run on the computer. The argument is that this provides a high level of user security and industry digital rights management. If only good software is allowed, bad software (such as malware and illegally downloaded videos and software) cannot run. The current version of TPM is selectable – the user can choose to opt in or opt out of its use.
The problem with version 2.0 is that it is controlled by the operating system and always on. German publication Zeit Online has seen a number of government documents that indicate growing concern among German federal agencies. The problem focuses on three issues: firstly, TPM 2.0 is default on; secondly, the user cannot opt out; and thirdly, it is controlled by the operating system – that is, Windows 8 and Microsoft.
Zeit quotes from a document produced by the Ministry of Economics as long ago as early 2012, which concludes, "The use of 'trusted Computing' technique in this form...is unacceptable for the federal administration and the operators of critical infrastructure." The perceived danger is that Microsoft, a US company, could secretly be compelled either by existing or future US legislation, to hand the TPM keys over to the NSA. That would effectively be giving the NSA a permanent back door to all Windows 8 TPM 2.0 computers that could never be closed; nor even monitored to see by whom or when it was being used.
But Zeit suggests that the potential problems go even further. Quoting professor Rüdiger Weis from the Beuth University of Applied Sciences in Berlin, it suggests that the TPM keys could be intercepted in the country of chip manufacture – China. Theoretically, then, any user of Windows 8 with TPM 2.0 could be handing the computer’s entire contents to either or both the NSA and the Chinese authorities, without ever being aware of it.
Zeit also notes that the German authorities had tried to influence the development of TPM 2.0 as an interested stakeholder. The Germans, however, were “simply rebuffed. Others have got what they wanted. The NSA, for example. At one of the last meetings between the TCG and various stakeholders, someone dropped the line, ‘The NSA agrees.’”
The BSI (the German Federal Office for Information Security) yesterday published an ‘opinion’ on the issue. It notes that for some users who either cannot or do not wish to operate their own security, and who trust the manufacturer, TPM 2.0 “provides and maintains a safe solution.” But, it adds, “the use of Windows 8 in combination with a TPM 2.0 is accompanied by a loss of control over the operating system and the hardware used. This results, especially for the federal government and critical infrastructure, in new risks.”