6 C
Tuesday, November 21, 2017
Home Tags GCHQ


Let's Encrypt, an organization set up to encourage broader use of encryption on the Web, has distributed 1 million free digital certificates in just three months. The digital certificates cover 2.5 million domains, most of which had never implemented SSL/TLS (Secure Sockets Layer/Transport Layer Security), which encrypts content exchanged between a system and a user.

An encrypted connection is signified in most browsers by "https" and a padlock appearing in the URL bar. "Much more work remains to be done before the Internet is free from insecure protocols, but this is substantial and rapid progress," according to a blog post by the Electronic Frontier Foundation, one of Let's Encrypt's supporters. The organization is run by the ISRG (Internet Security Research Group) and is backed by Mozilla, Cisco, Akamai, Facebook and others. There's been a push in recent years to encourage websites to implement SSL/TLS, driven in part by a rise in cybercrime, data breaches and government surveillance. Google, Yahoo, and Facebook have all taken steps to secure their services. SSL/TLS certificates are sold by major players such as Verisign and Comodo, with certain types of certificates costing hundreds of dollars and needing periodic renewal.

Critics contend the cost puts off some website operators, which is in part why Let's Encrypt launched a free project. "It is clear that the cost and bureaucracy of obtaining certificates was forcing many websites to continue with the insecure HTTP protocol, long after we've known that HTTPS needs to be the default," the EFF wrote.
Director tells MIT that all must cooperate in response to crims' use of ciphers Robert Hannigan, director of GCHQ, told an audience at the Massachusetts Institute of Technology that there was an ethical problem presented by encryption and it was necessary for industry's technical experts to help them work out a solution on its use by criminals. Published alongside the speech were two newly declassified papers by James Ellis, a cryptographer at GCHQ who, in the 1970s, secretly invented public-key cryptography. The papers, titled The Possibility of Secure Non-Secret Digital Encryption (PDF) and The Possibility of Secure Non-Secret Analogue Encryption (PDF), had remained classified for almost 50 years. Though Ellis had first invented the capability, public-key cryptography would actually be made public in 1976, in a famous paper titled New Directions in Cryptography (PDF) written by Whitfield Diffie and Martin Hellman – who won the Turing Award this February, 40 years after the paper's publication, for their contributions to the field. Hannigan said he was publishing the Ellis papers for three reasons, key among which was how advances in 1970s public-key cryptography reversed “centuries of assumptions about how communications could be protected.” This gave the director “some hope that our current difficulties can be overcome.” For nearly 100 years we have been intimately involved in strengthening encryption. From traditional protection of military communications, through personal privacy online – including identity verification for Government digital services – through the security of domestic “smart” power meters – where the design principle is that homeowners are in control of their data – to the security of the nuclear firing chain, we understand the importance of encryption for the economy and for the individual. That importance grows as more of our private lives move online and the economy becomes increasingly dependent on digital currency and block-chain systems. Hannigan added: “But what the history of our cryptology teaches me above all is that the enduring problems in the debate over privacy and security are essentially moral rather than technical.” The ethical issue presented by encryption “is the problem presented by any powerful, good invention, including the internet itself,” which could be used by miscreants, said Hannigan. “TOR is the most topical example: a brilliant invention that is still invaluable to those who need high degrees of anonymity, notably dissidents, human rights advocates and journalists; but an invention that is these days dominated in volume by criminality of one sort or another.” Hannigan claimed he was not in favour of banning encryption, nor asking for mandatory backdoors. He stated he was “puzzled by the caricatures in the current debate, where almost every attempt to tackle the misuse of encryption by criminals and terrorists is seen as a ‘backdoor’.” For those of us in intelligence and law enforcement, the key question is not which door to use, but whether entry into the house is lawful at all.
In our case that means applying the European Convention on Human Rights, as set out in UK domestic law: is what we are doing lawful (and appropriately sanctioned), is it necessary, and is it proportionate, notably in its infringement of privacy? Proportionality was important to consider.

Drawing a parallel with GCHQ's celebrated efforts at Bletchley Park, Hannigan said that it would not make sense to see the breaking of Enigma as a “backdoor”.
In the "easy example" of the breaking of the German Enigma code, it clearly enabled an Allied victory and an early end to the Holocaust, and, as such, could be considered proportionate. Hannigan stated that "what Turing and his colleagues recognised was that no system is perfect and anything that can be improved can almost inevitably be exploited, for good or ill.” “That is still true today.” said Hannigan. “It does not follow that Enigma was a poor system, or ‘weak’, or easily broken by anyone.
In fact we continued to build and use improved derivatives of Enigma – ‘Typex’ – for some years after the war.

For Turing, I do not think there was any such thing as an impregnable door, whether front, back or side: there were strong doors and degrees of security.” 'We want better security'. Oh yeah? Hannigan lauded Turing for his work on encryption and decrypting others' crypto, claiming that “strengthening and improving encryption has been the focus of our most brilliant mathematicians over the decades, and still is.” This is interesting.
In his book The Hut Six Story, Gordon Welchman, who founded Bletchley Park's Hut Six, cited an article by Professor Jean Stengers, of the University of Brussels, titled La Guerre de Messages Codes (1930-1945) approvingly: From pg. 17, The Hut Six Story, by Gordon Welchman [Stengers] knows the reason for British reluctance to reveal the methods they developed. He has discovered that, after the war, Britain sold a considerable number of Enigma machines to certain countries, no doubt claiming that they were unbreakable.

But, says Stengers, British codebreakers had no trouble. As I have made clear in this book, it is my firm conviction that what I have revealed should have been made available to our partners many years ago.

The over-prolonged secrecy has, in my view, already been prejudicial to our future national security.

The reason for the secrecy, made public at last, is hard to accept.* * I, personallly, have heard conflicting statements on this matter, but, on balance, I believe that Jean Stengers is correct. Following the publication of his book, Welchman was infamously described as “a disastrous example to others” by GCHQ. He subsequently lost his security clearance and ability to work in the USA on secure communications systems. There's security and there's security Expanding on the operational difficulties posed by encryption, Hannigan said: Turing also knew that human behaviour was rarely as consistent as technology: we are all to some extent too busy or careless in our use of it. Put more positively, we routinely make trade-offs not just between privacy and security, but privacy and usability. The level of security I want to protect the privacy of my communications with my family is high, but I don’t need or want the same level of security applied to protect a nuclear submarine’s communications, and I wouldn’t be prepared to make the necessary trade-offs. It is not inconsistent to want, on the one hand, to design out or mitigate poor user behaviour, but at the same time exploit that behaviour when lawful and necessary. The debate, for Hannigan, is not about back or front doors, but about “where you risk letting anyone else in if you accept that the lawful authorities can enter with a warrant.” All of this meant “some very practical cooperation with the industry. Whatever high level framework, whatever posture democratic nations decide upon will need to be implemented by commercial providers.

And this will get technical.

That is where we will need goodwill on both sides.” ® Sponsored: Five essentials for improving endpoint security
Apple filed court papers on Thursday urging a judge to overturn her order requiring it to unlock an iPhone used by one of the shooters in the San Bernardino attacks. Forcing Apple to help unlock the phone would set a dangerous precedent that undermines security for all its customers and opens the door to invasive government surveillance, the company argued. "If Apple can be forced to write code in this case to bypass security features and create new accessibility, what is to stop the government from demanding that Apple write code to turn on the microphone in aid of government surveillance, activate the video camera, surreptitiously record conversations, or turn on location services to track the phone’s user? Nothing," the company's lawyers wrote. Apple made several arguments to back up its position.

The All Writs Act, under which the government made its request, does not legally apply in this case, it said.

And the order violates Apple's rights under the First and Fifth Amendments of the Constitution, it added. Prosecutors have argued that the software they want Apple to create will be used only on the one iPhone in this case.

The company's lawyers said that's plainly false. "The government says: 'Just this once' and 'Just this phone,'" Apple's lawyers wrote. "But the government knows those statements are not true; indeed the government has filed multiple other applications for similar orders, some of which are pending in other courts." "Once the floodgates open, they cannot be closed, and the device security that Apple has worked so tirelessly to achieve will be unwound without so much as a congressional vote." The All Writs Act is a catch-all law that permits courts to issue an order, or writ, when there’s no existing law on the books to cover a particular need. Apple argued Thursday that there’s no law requiring it to unlock the iPhone because Congress has specifically chosen not to pass one.

The All Writs Act can’t be used to provide law enforcement powers that Congress has elected not to grant, the company said. Apple strongly supports the efforts of law enforcement, but the government's request is unsupported by the law and would "violate the Constitution," the company said. “Under well-settled law, computer code is treated as speech within the meaning of the First Amendment,” Apple said. Ordering the company to write code to access the phone would amount to “compelled speech and viewpoint discrimination” in violation of its rights. It would also breach the Fifth Amendment’s due process clause by “conscripting a private party” with almost no connection to the crime being investigated to “do the government’s bidding in a way that is statutorily unauthorized, highly burdensome, and contrary to the party’s core principles.” The FBI has said data on the iPhone could be essential to their ongoing terrorism investigation.

The information could help find collaborators of the San Bernardino shooters, they say. The two sides are due to appear in court March 22 for a hearing in the case. This fight between Apple and the FBI is shaping up to be a major test case in a year-and-a-half-old argument over whether law enforcement agencies can require device and OS makers to help them defeat encryption and other security measures. If the judge upholds her order, legal experts have said the case could go all the way to the Supreme Court.
The geeks are approaching the whole Apple vs.

FBI battle over encryption and privacy all wrong.

This is a golden opportunity to get John Q. Public on board regarding data privacy and online security.

But instead, we have a cacophony of conflicting information and noise, and the FBI is winning in the court of public opinion. It's high time Jane Q.

Citizen got to see a clear example of how the U.S. government is slowly but surely chipping away at personal privacy under the guise of national security.

And you couldn't have a better company standing up to the government: The one behind some of the most popular consumer electronics devices today.

There's none of the squickiness of Google and its constant slurping of data, or Facebook's desire to collect information about people you know and things you like.

Apple is not just a tech company -- hate it or love it, Apple is indubitably a lifestyle brand. But there is a stark difference in how Apple and the FBI and the Justice Department, along with their allies, are framing the conversation.

And as a result, Apple and the techies are losing John's and Jane's attention by railing about backdoors, encryption, and legal precedents. Those detailed explainers and FAQs do lay out what's at stake.

But it's the FBI that comes off looking reasonable.

The FBI is, it regular reminds us, trying find out why two people killed 22 people and injured 14 a few months ago as part of a mass shooting, which it regularly describes as terrorism.  So reasonable, in fact, that there's this headline: "San Bernardino terror attack victims' families ask Apple to cooperate with FBI." The side relying on emotions and fear is always going to win against the side carefully crafting logical arguments.
It may be in the nature of technical people to avoid emotions and favor logic, but that's one reason why the FBI is winning the hearts and minds of Americans here.  The thing is, even with all the secret documents that Snowden stole from the NSA, the average user isn't any more concerned about government surveillance today than he or she was three years ago. Sure, it's terrible, but when it comes to user privacy it's still a world of weak passwords, mobile devices with no passcode (or TouchID) enabled, and an overall lack of urgency. So skip the arguments about how if the FBI wins this round, law enforcement will keep coming back with more requests against more devices.  If there is something the Janes and Johns are scared of, it's the foreign other, the faceless enemies sitting in China, Russia, and Iran (why not throw North Korea in the mix, too?).
It's the criminals siphoning money from banks, the nation-state actors stealing personal information from government agencies, and adversaries trying to stop a movie release.  If the FBI gets its way on bypassing this iPhone 5c's protections, what would stop other governments from coming to Apple, Dell, and other companies and asking for help modifying the devices we use to further their own purposes? It won't be the first time a government tried to compel a company to modify technology in the name of national security. Remember BlackBerry?  "While the FBI's request seems to go beyond what other governments have sought from Apple so far, if Apple is forced to develop code to exploit its own phones, it will only be a matter of time before other countries seek to do the same," Jennifer Granick, the director of civil liberties at the Stanford Center for Internet and Society, wrote on the NYU School of Law's Just Security blog. She's right.

And that's a scary enough prospect to justify supporting Apple.

Techies may not like the emotionalism, and consider it to be FUD.

But it's not FUD.
It truly is scary -- and should be talked about that way.
US peppered Iran with thousands of cyberwar weapons The super worm known as Stuxnet was but a cog in an active US war program in which hundreds of thousands of network implants and backdoors in Iran networks were actively maintained to facilitate a devastating barrage of hacking attacks, a documentary claims. Zero Days, due to screen at the Berlin Film Festival today, claims that Stuxnet was just one part of an operation called "Olympic Games" that is itself part of a wider effort dubbed "Nitro Zeus" that involves hundreds of US defence personnel. Nitro Zeus may also involve Israel, the film alleges. Reports from those who've seen or been briefed on the film suggest it alleges that Stuxnet's authors attempted to keep the program covert by restricting the malware to infect only Iranian machines. Forte Mead hackers worked furiously to mop-up infected computers after a leak became apparent. Israeli counterparts reportedly screwed the pooch when they later unleashed a more aggressive and noisier version of Stuxnet that infected thousands of computers across more than 115 countries. The worm was soon discovered in 2010 and promptly analysed - and gaped at askance - by the security industry and media. The film asserts that Stuxnet contained four zero day vulnerabilities and was precision-designed for the Natanz facility using intelligence supplied by Britain's GCHQ. It is not stated in the documentary whether the GCHQ had knowledge of Nitro Zeus, a fact that could breach national laws regarding use of intelligence material in that country. US State Department and National Security Agency officials expressed concern over the likelihood that Nitro Zeus would devastate civilian infrastructure. One unnamed source said Nitro Zeus planners had "no f**king clue" regarding the potential impacts of the attacks. Former CIA and NSA director Michael Hayden says while he had no knowledge of Nitro Zeus the program has prematurely legitimised state-backed network centric warfare before rules of engagement could be agreed. ® Sponsored: Building secure multi-factor authentication
Blighty's spying nerve center GCHQ has a license to hack computers and devices at will, a UK intelligence oversight court has ruled. The judgment was handed down on Friday after Privacy International and seven ISPs launched a legal challenge against the agency's hacking operations – operations that were laid bare by documents leaked by NSA whistleblower Edward Snowden. During the case, GCHQ officially admitted infiltrating PCs and mobiles for the first time. "The use of computer network exploitation by GCHQ, now avowed, has obviously raised a number of serious questions, which we have done our best to resolve in this Judgment," reads the lengthy ruling [PDF] from the Investigatory Powers Tribunal (IPT). "Plainly it again emphasises the requirement for a balance to be drawn between the urgent need of the Intelligence Agencies to safeguard the public and the protection of an individual's privacy and/or freedom of expression." The tribunal is tasked with scrutinizing Blighty's agents; it says it "investigates and determines complaints of unlawful use of covert techniques by public authorities infringing our right to privacy." During the case, some of which was held in closed sessions for national security reasons, GCHQ said that about 20 per cent of the reports produced by the agency use material obtained by hacking. The agency said it had installed malware, used a phone's microphone and camera remotely, and tracked suspects via GPS. All this is done under a self-imposed code of conduct, and the IPT ruled that this gave it legal cover of its activities at home and abroad. These will be reinforced by the forthcoming Investigatory Powers Bill, aka the Snooper's Charter. "We are disappointed that the IPT has not upheld our complaint and we will be challenging its findings," said Scarlet Kim, legal officer at Privacy International. Kim said that Privacy International would be challenging the ruling on the grounds that it broke the European Convention on Human Rights when it comes to surveilling people in the trading block but outside of the UK. "The ability to exploit computer networks plays a crucial part in our ability to protect the British public," Foreign Secretary Philip Hammond told the BBC. "Once again, the law and practice around our Security and Intelligence Agencies' capabilities and procedures have been scrutinised by an independent body and been confirmed to be lawful and proportionate. It will provide our Security and Intelligence agencies with the powers they need to deal with the serious threats our country faces, subject to strict safeguards and world-leading oversight arrangements." ® Sponsored: Building secure multi-factor authentication
National security, and the role that government surveillance plays in it, has been one of the hot-button issues of this presidential campaign.The USA Freedom Act -- which was passed last June with overwhelming bipartisan support -- may have ended the NSA's mass collection of American's phone records, but telecom companies will continue to amass your phone data. The only difference is now the NSA must go to the Foreign Intelligence Surveillance (FISA) court for permission to gain access. (Documents leaked by Edward Snowden show that same secret court gave the NSA permission to indiscriminately collect Americans' phone records in the first place.)Other spying programs with even greater implications for privacy survive and thrive in the NSA's sprawling surveillance system. Regardless, many presidential candidates are falling over themselves to denounce the "weakening" of intelligence capabilities and promise they will repair the damage and keep the country safe. Here's how the candidates stack up.Donald TrumpTrump shoots from the hip, whether it's calling for the Internet to be shut down or for Muslims to be registered. But when it comes to government surveillance, his views are in line with that of many GOP rivals, although his assertions are perhaps more colorful."I assume when I pick up my telephone people are listening to my conversations anyway, if you want to know the truth," he told conservative radio host Hugh Hewitt.Apparently that fact doesn't bother him, because Trump says he would be "fine" with restoring provisions of the Patriot Act to allow the NSA to once again collect American phone metadata in bulk.This might seem surprising in a candidate who has been riding a wave of mistrust of government, but Trump says "when you have the world looking at us and would like to destroy us as quickly as possible, I err on the side of security."Jeb BushOn the topic of surveillance, The Donald is trumped by Bush, who is something of an NSA junkie. Bush not only advocates tirelessly for the NSA on the campaign trail and defends its mass surveillance program, he would like to hand the agency even more power. "I think the balance [between civil liberties and security] has actually gone the wrong way," he said. Documents leaked by Edward Snowden in 2013 showed the NSA has "broken privacy rules or overstepped its legal authority thousands of times each year since Congress granted the agency broad new powers in 2008." But Bush maintains: "There's not a shred of evidence that anybody's civil liberties have been violated by it -- not a shred."Ted CruzBush has repeatedly slammed Cruz for his opposition to the bulk collection of phone metadata. The Texas senator was a co-sponsor of the USA Freedom Act and remains its lone defender among GOP candidates since Rand Paul suspended his campaign.Cruz has denounced "hoarding tens of billions of records of ordinary Americans," noting that it didn't prevent terrorist attacks in San Bernardino, Boston, and elsewhere. When the focus of law enforcement and national security is on ordinary citizens rather than targeting the bad guy, we miss the bad guys while violating the constitutional rights of American citizens. Instead, the bulk data program was emblematic of the bureaucratic tendency to gather more not better information, which gives government tremendous opportunity for abuse. However, constant sparring with Marco Rubio has led Cruz to take a harder line on Snowden, who provoked the move for restraints on domestic surveillance in the first place. While Cruz lauded Snowden in 2013 for doing "a considerable public service by bringing it to light," he has since pivoted and issued a statement, saying, "​It is now clear that Snowden is a traitor, and he should be tried for treason."Jesselyn Radack, the attorney who represents Snowden, found it "sad that Cruz chose to score political points by bashing a whistleblower ... while at the same time Cruz regularly and vigorously defends his 'yea' vote for USA Freedom Act, a reform that only happened because Snowden had the courage to come forward."Marco RubioRubio, who sits on the Senate Select Committee on Intelligence and voted against the USA Freedom Act, has positioned himself as the national security candidate. Government surveillance has a prominent place in his attacks on Cruz; Rubio repeatedly accuses Cruz of weakening the intelligence community and laments the loss of the metadata program as "a valuable tool that we no longer have at our disposal.""If ISIS had lobbyists in Washington, they would have spent millions to support the anti-intelligence law [the USA Freedom Act] that was passed with the help of some Republicans now running for president," Rubio said in a national security speech.In turn, Cruz accuses Rubio of mischaracterizing the USA Freedom Act for political gain and says the bill actually gives the government broader authority to target and monitor terrorists, their cellphones, and their emails.What Rubio fails to mention when demonizing the USA Freedom Act is that many of his biggest advocates in Congress were also outspoken supporters of that very bill. Of Republican lawmakers in Congress who have endorsed Rubio, only one of the 21 representatives who was present for the vote opposed the Act, and only two of the 24 senators who back Rubio opposed the bill.John KasichWhile the feud between Rubio and Cruz blazes hot, Ohio Governor Kasich -- like Goldilocks -- is looking for a "just right" policy position. "I think the porridge [needs to be] the right temperature, not too hot and not too cold," he told New Hampshire voters about the balance between civil liberties and national security.But the details of that balance are a bit fuzzy. When asked about the USA Freedom Act, by radio host Hewitt, Kasich said: Well, I don't know what you mean about this Freedom Act. Look, you know, conservatives are in general very distrustful for government, as they should be.... But I think there's a balance between good intelligence and the need to protect Americans from what can become an aggressive government somewhere down the road. …I'm not giving carte blanche to anybody in the federal government. There has to be rules, restrictions and regulations that restrain them. However, at a Republican debate in December, where government surveillance was discussed, Kasich not only sided with Rubio, he went even further and called out encryption as a major problem, saying, "Congress has got to deal with [encryption] and so does the president to keep us safe." Hillary ClintonClinton is another presidential candidate trying to find that "just right" balance between civil liberties and security --  to the point of keeping people guessing about her stand on NSA surveillance. When interviewed last year by Re/code's Kara Swisher, Clinton said of government surveillance: Well, I think the NSA needs to be more transparent about what it is doing, sharing with the American people, which it wasn't…So when you say, 'Would you throttle it back?' Well, the NSA has to act lawfully. And we as a country have to decide what the rules are. And then we have to make it absolutely clear that we're going to hold them accountable. When pressed on whether she thought the NSA had too much spying power, Clinton again evaded staking out a position. "Well yeah, but how much is too much? And how much is not enough? That's the hard part.... I resist saying it has to be this or that. I want us to come to a better balance."When asked in the first Democratic debate whether she regretted voting for the Patriot Act in 2001 and its renewal in 2006, the former senator insisted the bill was necessary to ensure security in the aftermath of 9/11 and did not answer directly when asked if she would end NSA spying.Bernie SandersBy contrast, the senator from Vermont voted against the Patriot Act, and in the first debate said he would "absolutely" end the NSA's sweeping surveillance powers. "Yes, we have to defend ourselves against terrorism, but there are ways to do that without impinging on our constitutional rights and our privacy rights," he said, without providing details.In an opinion piece penned for Time last spring, when the USA Freedom Act was being debated, Sanders wrote: Do we really want to live in a country where the NSA gathers data on virtually every single phone call in the United States -- including as many as 5 billion cellphone records per day? I don't. Do we really want our government to collect our emails, see our text messages, know everyone's Internet browsing history, monitor bank and credit card transactions, keep tabs on people's social networks? I don't. Unfortunately, this sort of Orwellian surveillance, conducted under provisions of the Patriot Act, invades the privacy of millions of law-abiding Americans. Sanders voted against the USA Freedom Act, on the grounds that it did not go far enough, while Clinton endorsed the bill.
The outgoing Obama administration has proposed increasing federal cyber-security spending by $5bn, or around a third, in the hope of reaching $19bn in 2017. Reuters reports that the Democrat president's proposals, due to be unveiled later on Tuesday, will earmark $3.1bn for technology modernisation at various federal agencies. The proposed spending increases may face a rough passage through the Republican-controlled House of Representatives, which controls the US federal government’s purse strings. The proposed cyber-security spending increases follow a high profile (and hugely damaging) hack against the Office of Personnel Management last year, as well as a generally more turbulent threat environment, with Chinese and Russian state sponsored hackers at the fore of attempts to break into and perhaps even disrupt US government systems. Other nation states – most notably Iran and North Korea – as well as terrorist groups affiliated to Islamic State, and cybercriminals – also pose a hacking or malware infection risk to federal systems as well as businesses. Similar pressures prompted UK Chancellor George Osborne to announce plans to double cybersecurity spending and establish a single National Cyber Centre back in November. Cybersecurity spending will rise to £1.9bn ($2.87bn) at a time of ongoing austerity measures elsewhere. Part of the spending increase will go towards previously announced plans to hire 1,900 more staff at GCHQ. Meanwhile the NSA is going through a major reorganisation, combining its attack and defence sides into a single organisation, the Washington Post reported last weekend in a authoritative story citing current and former government officials. The White House is due to announce the creation of a presidential commission on cyber security later on Tuesday, according to (unnamed) senior administration officials. The commission will make recommendations on how to strengthen US cyber-defences. The current US government cyber defence system, known as Einstein, was judged inadequate in a report by a government watchdog last month. Related plans also due to be unveiled today will see the creation of a Federal Privacy Council, with a mandate to develop comprehensive guidelines on the use of personal data, Reuters adds. ® Sponsored: Building secure multi-factor authentication
GCHQ has defended its controversial MIKEY-SAKKE phone encryption protocol against criticism that it leaves a backdoor into systems that support the technology. The CESG assurance arm of the UK government’s signal intelligence agency has taken the unusual step of publishing a background document and FAQ in defence of the technology, summarised in a statement by a government spokesman. The MIKEY-SAKKE protocol is designed to enable organisations to provide secure communications with end-to-end encryption. Each organisation that uses a MIKEY-SAKKE based product has its own Key Management Server, which allows users to access the system. As our specification makes clear, the Key Management Server does not need to be online for the system to be secure, which makes it much less vulnerable to attack. All the products approved by HMG operate in this way. Organisations using MIKEY-SAKKE do not share a common Key Management Server, so it is totally wrong to suggest there is a secret master key or 'backdoor' that would allow GCHQ or any other third party to access real time or historic conversations. Only the owners of individual systems can access and decrypt conversations, if they want to. At least some independent security experts are sympathetic to the argument that the design of the technology fulfils an explicit requirement for a built-in interception capability. However Dr. Steven Murdoch, research fellow at University College London, whose detailed examination of MIKEY-SAKKE sparked the original controversy remains critical. Dr Arnold Yau, a self-described privacy advocate, who studied for a doctorate in information security at Royal Holloway before becoming a mobile security and cryptography specialist, argues that early reports that MIKEY-SAKKE was back-doored were unfair. “The protocols are meant for government and enterprise deployment, with an explicitly stated requirement for lawful interception,” Yau told El Reg. “It's much like companies' ability to read their employee's emails sent through their system, with the difference that emails aren't routinely encrypted.” El Reg understands that MIKEY-SAKKE was primarily designed to support a government requirement for secure communications. Initially designed to fulfil the requirements of the UK emergency services the technology is positioned as also suitable for businesses who need to meet legal, regulatory and other governance requirements. We put it to Murdoch that if MIKEY-SAKKE is indeed designed for government and enterprise deployments with an explicit requirement for interception then perhaps different standards ought to be applied. Murdoch responded that, even on its own terms, MIKEY-SAKKE has practical shortcomings, particularly against potentially skilled nation state adversaries. Murdoch confessed he was “not expecting such a detailed response” from GCHQ to his research. “The GCHQ response only discusses the security of MIKEY-SAKKE when the system is well designed, properly operated and functioning correctly,” Murdoch explained. “My article instead also dealt with the (likely) scenario that things can go wrong due to accident or malicious behaviour. In these cases an unauthorised third party could gain access to communications and bypass the safety measures GCHQ assured would be present (only to provide time-bounded, single-user keys subject to legal authorisation).” Scorecard Backers of MIKEY-SAKKE argue that comparison using the EFF scorecard is “misleading” since the marker is designed when running a rule over consumer services such as Skype, whereas MIKEY-SAKKE is for businesses, where different criteria apply. Murdoch applied EFF developed criteria for assessing the security of encryption protocols, an approach he argues is valid even for systems designed for enterprises and governments rather than the general population. “I still think the EFF criteria, which require that security be preserved even if the network provider is compromised, are appropriate. Even if the network provider has a legitimate reason to eavesdrop on communications, someone who has compromised the network provider does not.” “The GCHQ response correctly states that other protocols have centralised aspects, but MIKEY-SAKKE is notable for making the centralised aspects difficult to protect and there being severe consequences from any compromise,” he added. Lawful interception (eavesdropping) could have being applied in a more robust manner to that offered by MIKEY-SAKKE, he further argues. Damningly, he describes the robustness of MIKEY-SAKKE as worse than that offered by the infamous Clipper Chip, an abortive US-government backed (and backdoored) crypto scheme of the 1990s. “MIKEY-SAKKE design is a fragile way to achieve the goal of permitting the eavesdropping of communications. The same master key is used for both communication security and for key-escrow purposes. This makes the master key more vulnerable because it must be used for many purposes, including adding of new users and the monthly update of user-keys. “There are circumstances where eavesdropping on calls is appropriate (e.g. some enterprise and government communications) but there are other options available which separate the escrowing from normal encryption. Examples include the current financial industry approach of just recording calls before encryption or after decryption, and the Clipper chip which has a separate escrow key which can be more carefully protected and be subject to legal restrictions,” he added. Murdoch concludes that the “need for permitting eavesdropping on calls in certain circumstances is sufficient justification for the design” of MIKEY-SAKKE, which he maintains is essentially not fit for purpose whether or not it’s eventually used by consumers, something Murdoch reckons remains an open question. Half-IBAKEd Murdoch further argues that GCHQ is pushing MIKEY-SAKKE over a rival approach, called MIKEY-IBAKE on the grounds that the latter was less “snoop friendly”. "There are some hints in the GCHQ submission to the 3GPP committee discussing MIKEY-IBAKE, where they were focussing on MIKEY-SAKKE allowing law enforcement access rather than an enterprise or government getting access to their own staff’s communications," Murdoch explained. "Also of note is the GCHQ were asking the committee to prevent the use of MIKEY-IBAKE, not to permit the use of MIKEY-SAKKE. If GCHQ were content to let companies have free choice over which security protocol they use, why prevent them from using MIKEY-IBAKE if they want?” Yau conceded Murdoch had made some fair and reasonable points. He said the discussion about the protocol would be better focused on the possibility it creates “unsafe deployment”, rather than existence of hidden "backdoors”. “With 3GPP, I wonder why GCHQ how much it would actually help them have MIKEY-SAKKE adopted,” Yau concluded. “My (academic) understanding is that mobile communications (GSM/3G/LTE) are never secured end-to-end to start with with encryption only applied to the air interface (between cell towers and device). This means they can (and probably are) already eavesdrop on conversations (or data traffic) at the mobile network operator whether legally or illegally.” “If law enforcement agencies wish to decrypt over-the-air traffic, there are already equipment such as Stingray, IMSI ((International Mobile Subscriber Identity) catcher, femtocells that are available for that purpose,” he added. If MIKEY-SAKKE was intended as a backdoor then it was a hopelessly cack handed, according to Yau. “More generally if they want to insert backdoors into public communication protocol/equipment, they'd probably do it with far more subtlety as demonstrated by the Dual-EC DRBG and the Juniper backdoor,” Yau added in what’s best described as a backhanded compliment. ® Sponsored: Building secure multi-factor authentication
The European Union and the US have reached an eleventh-hour deal on data transfer and privacy rules to replace the Safe Harbour agreement ruled illegal by the European Court of Justice in October last year. The sudden and unexpected judgment had thrown organisations large and small into a quandary about how they might deal with the consequences, should the EU and US fail to come to a new agreement. The draft EU-US Privacy Shield framework was announced late yesterday, with EU justice commissioner Věra Jourová promising that a full draft agreement will be released in the next few weeks - possibly before the end of February. That will contain the finer points of the deal. One of the concessions from the US was the creation of a "special ombudsman" with the authority to investigate privacy complaints from EU citizens. The EU would also hold an annual joint review with the US Federal Trade Commission that would examine national security exemptions. This comes on top of assurances from the US government. "The US has clarified that they do not carry out indiscriminate mass surveillance of European citizens," said European Commission vice president Andrus Ansip. Bojana Bellamy, president of law firm Hunton & Williams's Centre for Information Policy Leadership, said that the deal meant, effectively, that it was pretty much business-as-usual for Facebook, Google, Yahoo and other internet businesses, although they may need to adapt some of their practices."The EU-US Privacy Shield agreement will no doubt mean more work for businesses, as they examine the new deal and what they have to do to implement the new rules in practice. Certainly, there will be more practical obligations for businesses to use data of Europeans responsibly and respect privacy rights of Europeans," said Bellamy. She continued: "Europeans will also have more rights in the US... But, more importantly, Europeans will also have rights against surveillance practices by US government agencies in the context of national security. This was a major step for the US to agree and good for them for doing so! It should put to bed the post-Snowden concerns that Europeans did not have any rights in the US against government surveillance." However, Snowden himself was less impressed with the deal. "EU capitulates totally on #SafeHarbor. Interesting, given that they held all the cards," he initially tweeted, before following up: "It's not a 'Privacy Shield', it's an accountability shield. Never seen a policy agreement so universally criticised." SEE ALSO:Analysis: "The Safe Harbour stand-off: views down the barrel of a gun", by John Leonard
GCHQ’s Christmas puzzle has stumped the nation. The multi-stage cryptographic challenge was released in the GCHQ Christmas card and later published on the agency’s website. The first stage of the challenge involved completing a grid-shading puzzle to unveil a QR (Quick Response) code. This only led onto more and more difficult challenges. Only one in 20 people who began the exercise reached the final stage. And none of these 30,000 players completed the final (fifth) stage by Sunday. GCHQ plans to publish the solution in early February. As well as offering a cryptographically themed brainteaser, the challenge is partly designed to spur donation to the children’s charity the NSPCC as well as publicising the work of the signals intelligence agency. ® Sponsored: Building secure multi-factor authentication
CyberInvest, a £6.5m scheme to fund research into cyber security, has been launched by the government, with spy agency GCHQ playing a lead role. "CyberInvest is about bringing together academia, industry and government to address the critical shortage of high-end cyber research in a more focused way," said GCHQ director Robert Hannigan during the annual IA15 conference in London. GCHQ will work in collaboration with the Department for Culture, Media and Sport and the Engineering and Physical Sciences Research Council, while 18 companies have signed-up to the scheme, including BT, HP and IBM. The £6.5m will be invested over the next five years. "It's important to recognise that CyberInvest is a new programme and it provides additional targeted investment," said Ed Vaizey, the UK's digital economy minister. He continued: "The UK is one of the leaders in cyber security and one of the reasons that we have a leadership role is because of excellent research that our universities produce. The UK is doing well but we want to keep moving forward. Technology in this area changes hugely all the time and other nations are working hard as well so we want to have an even more coordinated and a more focused approach to cyber research." Vaizey said the CyberInvest scheme will help to give the companies that work alongside the government and intelligence agencies "public recognition". Cabinet Office minister Matt Hancock, who also spoke at the event, said that the changes the government has made in procuring IT will enable it to better address emerging cyber security risks. "We're treating security as a core responsibility, rather than outsourcing it to our suppliers," Hancock said. "Many successful attacks exploit out-of-date systems and GovTech used to date very quickly indeed. Some of our legacy systems were designed before the invention of the web. "Security had to be bolted on top, rather than designed in from the outset. So we're now phasing out the large inflexible contracts that locked us into ageing IT. And we're building iterative, adaptive systems, which allow us to rapidly react to new threats. "We can change the code that runs GOV.UK within an hour for example," he claimed, concluding: "We now need to embed this approach across Whitehall." In a statement, GCHQ explained the initiative in more depth: "CyberInvest will build a community of industry, government and academia who are committed to sustained investment in cyber security research." It continued: "While many companies invest in research, some find it difficult to target the right opportunities, and where investment is made, it is not always visible or focused. CyberInvest will provide a forum for the latest in cyber security research, drawing upon the expertise of GCHQ, leading academics and industry."