Former Head Of GCHQ Says Don't Backdoor End-To-End Encryption, Attack The End Points
from the putting-an-end-to-the-end-to-end-debate dept
When he was head of GCHQ, Robert Hannigan said some pretty clueless things about the Internet and encryption. For example, in 2014, he accused tech companies of 'facilitating murder', and joined in the general demonization of strong crypto. Last year, he called for technical experts to work more closely with governments to come up with some unspecified way around encryption. Nobody really knew what he meant when he said:
"I am not in favor of banning encryption. Nor am I asking for mandatory back doors. … Not everything is a back door, still less a door which can be exploited outside a legal framework."
Now, speaking to the BBC, he has clarified those remarks, and revealed how he thinks governments should be dealing with the issue of end-to-end encryption. As he admits:
"You can't uninvent end-to-end encryption, which is the thing that has particularly annoyed people, and rightly, in recent months. You can't just do away it, you can't legislate it away. The best that you can do with end-to-end encryption is work with the companies in a cooperative way, to find ways around it frankly."
He emphasized that backdoors are not the answer:
"I absolutely don't advocate that. Building in backdoors is a threat to everybody, and it's not a good idea to weaken security for everybody in order to tackle a minority."
So what is the solution? This:
"It's cooperation to target the people who are using it. So obviously the way around encryption is to get to the end point -- a smartphone, or a laptop -- that somebody who is abusing encryption is using. That's the way to do it."
As Techdirt reported earlier this year, this is very much the approach advocated by top security experts Bruce Schneier and Orin Kerr. They published a paper describing ways to circumvent even the strongest encryption. It seems that Hannigan has got the message that methods other than crypto backdoors exist, some of which require cooperation from tech companies, which may or may not be forthcoming. It's a pity that he's no longer head of GCHQ -- he left for "personal reasons" at the beginning of this year. But maybe that has given him a new freedom to speak out against stupid approaches. We just need to hope the UK government still listens to him.
Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: encryption, gchq, going dark, hacking, robert hannigan, security
Reader Comments
Subscribe: RSS
View by: Time | Thread
Or, phrased another way...
Do exactly what law enforcement and espionage agents have done since the dawn of time. The ability to quickly crack encryption on a level much below a government spy agency is a relatively new development, after all.
[ link to this | view in chronology ]
Re: Or, phrased another way...
Or, conversely, attack all the endpoints, all of the time, so we may maintain our indiscriminate hoovering practices and work around encryption.
[ link to this | view in chronology ]
Re: Re: Or, phrased another way...
One could almost think 'no porn no read', but that might be disingenuous to those that try but are told not to or led to 'more important' leads.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
microsoft windows ten has the gchq covered
what could go wrong there you idiot
last time they tried it the sony root kit got leaked to the idiots at sony after us hackers had it for 3 years already
[ link to this | view in chronology ]
What exactly is your point here? -- Yay, intelligence agency will try getting around end point encryption?
And perhaps they just pretend focus changed. They alarmed the little bunnies only to get them used to being spied on, now time to calm and distract. At best, given the nature of "intelligence agencies", they're lying somehow. They're ALWAYS lying, it's definitional. But Techdirt just laps it up, doesn't question the statements at all, just assumes are true, kind of crowing about a victory for common sense, and never mentions the daily actuality that we now live in surveillance states. -- With the colorful front of helpful Google, which gives NSA "direct access", Snowden said.
[ link to this | view in chronology ]
Re: What exactly is your point here? -- Yay, intelligence agency will try getting around end point encryption?
[ link to this | view in chronology ]
Re: What exactly is your point here? -- Yay, intelligence agency will try getting around end point encryption?
Yeah lol no one questions these things. If nothing is noteworthy, why pay attention to anything?
What is the benefit of the imaginary world you live in?
Sure, some people are entirely for maximum government spying. Some people couldn't care in the course of their everyday lives. But do go ahead and invent things to claim superiority over and insult people with here. As if we don't know spooks don't go beyond what is publicly known and legal on their already extremely long and loose leashes. And this time just because it is reported that one of the "security" talking heads changed his tune and undermined the idiotic "adult conversation" antics of his peers. (Whether he means it or not is largely irrelevant.)
So if you ever get anywhere near an actual point, go ahead and make it.
[ link to this | view in chronology ]
The best that you can do with end-to-end encryption is work with the companies in a cooperative way, to find ways around it frankly.
It's cooperation to target the people who are using it. So obviously the way around encryption is to get to the end point -- a smartphone, or a laptop -- that somebody who is abusing encryption is using. That's the way to do it.
My reading comprehension ain't honed to a razor-sharp edge, so I'm uncertain about something here. I get the good old-fashioned idea of attacking the endpoints in general, but the 'working with companies in a cooperative way' still sounds a bit creepy. If he means that investigators should contact companies on a case-by-case basis for help finding goof-ups in a particular suspect's security measures, OK... but his statement sounds like he's talking about globally preemptive measures; these may not be backdoors, but they're definitely 'backdoor shaped objects.'
He's not head of GCHQ anymore, so playing word-games would be silly. Still, I can't help but want to read between the lines when anyone changes his tune and seems to say something sensible. Anyone else get this feeling, or should I bust out my Reynolds Wrap?
[ link to this | view in chronology ]
Root them all.
I'm feeling safer already.
/s
[ link to this | view in chronology ]
If everyone is a suspect then all the endpoints need to be breached and in that circumstance end-to-end encryption becomes the next step in the security theater and makes it almost useless.
[ link to this | view in chronology ]
Re:
Is 'abusing encryption' kind of like 'abusing window blinds'?
[ link to this | view in chronology ]
Looks better.... at first glance
If they don't just come out right at the beginning and demanding it, they are sure as heck going to bring it up later that they need full access, all the time. Like the data collection we see going on now, they are also going to escalate its use to lesser and lesser crimes.
Also let us not forget the current state of affairs with where they can just find a friendly judge and then get a free-for-all warrant that covers just about anything.
Like someone else wrote earlier, it will then be much worse because they would probably have access to everything and just just communications.
The problem hasn't changed, because they are still not leashed or watched enough to consider giving them any access.
They need a lot of proof that they have improved in these areas before anyone should even consider anything of this sort.
[ link to this | view in chronology ]
In other words: he is no longer pwned.
[ link to this | view in chronology ]
Words can be very deceiving.
[ link to this | view in chronology ]