NSA Denies It Knew About Heartbleed Bug Before It Was Made Public

Enlarge this image toggle caption iStockphoto iStockphoto

The National Security Agency says it did not know about a critical security bug until it became public earlier this month.

The NSA was responding to a report from Bloomberg that the agency had known about the vulnerability known as "Heartbleed" for two years and instead of alerting the tech community, it exploited the bug to "gather critical intelligence."

Just to catch you up: The Heartbleed bug has led tech experts to call on Internet users worldwide to change the passwords they use on popular and sensitive sites, like that of their bank or email provider. As NPR's Jeremy Bowers explained, the bug allowed an attacker to receive the encryption keys used to transmit information like your username and password. In other words, the bug allowed access to the "crown jewels."

In a statement, the NSA said Bloomberg's report was simply "wrong." The U.S., the NSA said, would reveal this kind of vulnerability to developers if it ever came upon it. The statement goes on: