Possible ECC backdoor and its impact on Internet traffic In a recent article, Bruce Schneier suggested that he prefers classic discrete log crypto over ECC because "I no longer trust the constants. I believe the NSA has manipulated them through their relationships with industry."

Can someone elaborate on a case study what the above phrase would mean in the real world? Could a backdoored ECC allow the passive sniffing of HTTPS traffic that uses ECC for the ephemeral key?
Can someone explain the logic behind this fear?
If the NSA has chosen the elliptic curve parameters (the "constants") in a way that makes the elliptic curve cryptographically weak, then cryptography using that curve might be, well, insecure and breakable by the NSA.  For instance, it is known that there exist various classes of elliptic curves where the discrete log problem is easy (or not very hard).  If the NSA knows of an additional class of weak curves, and if they were able to influence the choice of parameters, it is plausible they could have chosen the parameters to make the curve weak.  Given that the NSA apparently spends $250 million per year on research, it is not implausible that they might know of classes of weak curves that are not known to the public community.

No one currently knows of a concrete, fully-worked-out way they could have done that with the NIST curves (for instance), but at the same time, no one knows of any proof or argument why this would be impossible.

In this scenario, if the curve is sufficiently weak, then it would let them mount passive attacks: by eavesdropping on traffic that is protected with ECC using those curves, they could break the ECC crypto and decrypt the traffic.  Hypothetically.  Yes, in this scenario, it could let them passively sniff HTTPS traffic that is using an ECC-based ciphersuite.  This is all terribly speculative, but you asked how it could happen, at least in principle.