Senator McCain Promises To Introduce Legislation To Backdoor Encryption, Make Everyone Less Safe

from the bad-ideas dept

Two months ago, the Obama administration came to the conclusion that mandating backdoors to encryption through legislation was a non-starter. They seemed to recognize that it was mostly a bad idea and (more importantly) that Congress would not approve such legislation. Almost immediately, we noted that intelligence officials (almost gleefully) noted that they really just needed to wait for the next terrorist attack to restart the campaign. Here was Robert Litt, the top lawyer in the intelligence community:

Although “the legislative environment is very hostile today,” the intelligence community’s top lawyer, Robert S. Litt, said to colleagues in an August e-mail, which was obtained by The Post, “it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.”

There is value, he said, in “keeping our options open for such a situation.”

Given all that, it was disappointing that the Obama administration then took the cowardly way out, and refused to take an official public stance against backdooring encryption.

Either way, with the attacks in Paris last week, it almost seems like the anti-encryption crowd was somewhat gleeful in their response. Why, here was the exact terrorist attack they needed to push their agenda.

And, of course, the idea of mandated backdoors is back on the table, with Senator John McCain announcing plans to introduce just such legislation:

“In the Senate Armed Services we're going to have hearings on it and we're going to have legislation,” Sen. John McCain (R-Ariz.), who chairs the committee, told reporters Tuesday, calling the status quo “unacceptable.”

Of course, that legislation was ready to go, sitting in a top drawer just waiting for this kind of situation. And now we have to waste all sorts of time responding to this idiocy even though just months ago we went through this whole debate all over again, during which it was pretty clear that backdooring encryption makes us all much less safe. It puts everyone at greater risk, not less.

So the question remains: why do officials and politicians like Senator McCain want to undermine our safety and security? And, even more bizarrely, how is this the same John McCain who was on the other side during the last crypto wars?

Filed Under: backdoors, encryption, going dark, john mccain

As Predicted: Encryption Haters Are Already Blaming Snowden (?!?) For The Paris Attacks

from the shut-up dept

It really was less than two months ago that we noted that, having lost the immediate battle for US legislation to backdoor encryption, those in the intelligence community knew they just needed to bide their time until the next big terrorist attack. Here was the quote from Robert Litt -- the top lawyer for the Office of the Director of National Intelligence from September:

Although “the legislative environment is very hostile today,” the intelligence community’s top lawyer, Robert S. Litt, said to colleagues in an August e-mail, which was obtained by The Post, “it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.”

Well, as you already know, on Friday there was a tragic and horrifying terrorist attack in France that killed over 100 people. And it took basically no time at all for defenders of the surveillance state to start... blaming Snowden and encryption? It started with the usual talking heads, such as former George W. Bush press secretary and current Fox News commentator, Dana Perino, who seriously seemed to blame Snowden for the attacks based on... who knows what.

Also, F Snowden. F him to you know where and back.

— Dana Perino (@DanaPerino) November 14, 2015

And then there was her Fox News colleague Greg Gutfeld, speculating that the attacks may have been planned in secret thanks to "whistleblowers."

if the attack was aided through "whistleblowers" leaking what the NSA cannot penetrate, will that be part of the movie?

— GregGutfeld (@greggutfeld) November 14, 2015

Robert Litt must have been smiling. And then, he was helped along even further by the stenographers at the NY Times, who reported over the weekend that the attackers "used encryption technology" based entirely on anonymous "European officials."

The attackers are believed to have communicated using encryption technology, according to European officials who had been briefed on the investigation but were not authorized to speak publicly. It was not clear whether the encryption was part of widely used communications tools, like WhatsApp, which the authorities have a hard time monitoring, or something more elaborate. Intelligence officials have been pressing for more leeway to counter the growing use of encryption.

Here's the link to that article, but as I type this, it now shows the following: Perhaps the NY Times realized that publishing such rampant speculation without confirmation meant that they were getting played like fiddles by the intelligence community in their game to undermine encryption. Either way, the original article is available (for now) at the Internet Archive. Update: The NY Times is now redirecting the original link to a general link about the Paris attacks, not the specific story they originally had about the evils of the attackers using encryption. As far as I can tell, there's still been no explanation.

No matter what, the argument is pure bullshit. Of course they probably used encryption, because lots of people use encryption to communicate, and there's no way in hell that they suddenly decided to use encryption "because Snowden." As Glenn Greenwald has helpfully chronicled, the press has noted that terrorists have known to use encryption to avoid having their communications spied upon since before 9/11. Here's just one example in an article stuffed with many, many more: The idea that it was suddenly because of Snowden's revelations that the attackers decided to communicate via encryption defies all common sense, and anyone making that suggestion seems to be publicly displaying a near total ignorance on history -- most likely for political gain. Meanwhile, the speculation over how the attackers communicated has led some to claim (without any evidence to support it) that they may have been communicating via the PlayStation 4. I'm pretty damn sure that the PS4 does not include end-to-end encryption, so even if that does turn out to be true, it would seem to undermine the earlier claims of encryption being the problem. Update: And, as expected, the guy who made the original "they communicated via PS4" claims is now walking back that story....

The real point, though: if you want to communicate secretly, there is always some way to do it. To blame leaks from just a couple of years ago on the fact that people planning to commit mass murder try to communicate secretly is flat out ridiculous and is nothing more than fear mongering to score political points.

Filed Under: backdoors, dana perino, ed snowden, encryption, going dark, greg gutfeld, isis, paris attack

UK's Snooper's Charter Includes Mandatory Backdoors For Encryption

from the crypto-wars-move-overseas dept

Remember earlier this week when we mocked the silly reports claiming that the UK government had "backed down" on its demands for a Snooper's Charter. As we noted at the time, it did not appear they were backing down at all, but pulling out a bogus publicity campaign where they decided to "ditch" some absolutely crazy ideas that never really would have been included in the first place, but still leaving in plenty of terrible ideas.

And, now we know that includes mandatory backdoors into encryption -- a stupid and dangerous policy that will directly put UK citizens at risk. While, thankfully, those pushing for crypto backdoors in the US have realized that it's a politically untenable idea, the UK's new "Investigatory Powers Bill" has gone in the other direction, and will mandate encryption backdoors and ban any encryption offerings where there is no backdoor for law enforcement.

Companies such as Apple, Google and others will no longer be able to offer encryption so advanced that even they cannot decipher it when asked to, the Daily Telegraph can disclose.

Measures in the Investigatory Powers Bill will place in law a requirement on tech firms and service providers to be able to provide unencrypted communications to the police or spy agencies if requested through a warrant.

UK Prime Minister David Cameron and Home Secretary Theresa May will undoubtedly make a big show of this over the next few months, claiming that they need this to keep the public safe, but that's a load of hogwash. Backdooring encryption does the opposite. It puts everyone at serious risk. It's a technically dangerous solution by technically clueless people. If there are backdoors in encryption you are opening up a massive attack vector for those with malicious intent -- and that doesn't even get into the question of authorities abusing such powers. This has been explained over and over again, and it appears that Cameron's government simply decided to ignore all the technical experts and go with a "but they have to!" approach.

If you recognize the long history of governments using surveillance powers for nefarious reasons this should worry you. But even if you 100% trust the government, this should worry you, because what they're asking for, on a technological basis, is to make your information significantly less safe and much more open to hackers and online criminals.

A Home Office spokesman said: “The Government is clear we need to find a way to work with industry as technology develops to ensure that, with clear oversight and a robust legal framework, the police and intelligence agencies can access the content of communications of terrorists and criminals in order to resolve police investigations and prevent criminal acts. “That means ensuring that companies themselves can access the content of communications on their networks when presented with a warrant, as many of them already do for their own business purposes, for example to target advertising. These companies’ reputations rest on their ability to protect their users’ data.”

This belief that law enforcement needs this information to do its job is hogwash. For all of history prior to this, people have had methods of communicating entirely in secret, and since the dawn of civilization it was still possible to track down criminals and conspirators through traditional detective work. This belief that the content of these communications is absolutely necessary would seem to suggest that UK law enforcement is currently terrible at doing its job. I'd like to believe that's not true.

The big tech companies may now face a pretty big fight in the UK. Over the last few years, they've increasingly ramped up their efforts to provide more real privacy solutions that can actually protect your information. The UK wants to send things back to the stone age, and that's dangerous. Hopefully, companies like Apple -- which has made a big show of pushing non-backdoored-encryption -- take a stand here and refuse to give in. And, other tech companies that haven't been quite as vocal, including Google, Facebook, Microsoft and Twitter need to speak out against this, potentially to the point of threatening to pull out of the UK if the government doesn't adjust its policy. Without such a strong threat, it seems unlikely the UK government will recognize just how much danger they're putting the public in with this proposal.

Filed Under: backdoors, david cameron, encryption, going dark, snooper's charter, theresa may, uk
Companies: apple, facebook, google

If The NSA's Not Complaining About Encryption, It's Likely Because It Has Already Found A Way In

from the we-left-ourselves-a-key-to-the-back-door-under-the-mat dept

The NSA hasn't said much (well... compared to the FBI) over the past several months about the default phone encryption offered by Google and Apple. This lack of public outcry has to do with the NSA's capabilities, rather than a sudden interest in ensuring people around the world have access to secure communications. If it truly felt the world would be a better place with safer computing, it wouldn't have invested so much in hardware implants, software exploits and -- its biggest black budget line -- defeating encryption.

Where there's no smoke, there's a great deal of fire which can neither be confirmed nor denied. The NSA has very likely punched holes in encryption in existing encryption. But how does it do it? A brute force attack on encryption would be largely futile, even with the computing power the agency possesses. Alex Halderman and Nadia Heninger at Freedom to Tinker have a theory, and it involves a "flaw" in a highly-recommended encryption algorithm.

The key is, somewhat ironically, Diffie-Hellman key exchange, an algorithm that we and many others have advocated as a defense against mass surveillance. Diffie-Hellman is a cornerstone of modern cryptography used for VPNs, HTTPS websites, email, and many other protocols. Our paper shows that, through a confluence of number theory and bad implementation choices, many real-world users of Diffie-Hellman are likely vulnerable to state-level attackers.

For the nerds in the audience, here’s what’s wrong: If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number with a particular form. There seemed to be no reason why everyone couldn’t just use the same prime, and, in fact, many applications tend to use standardized or hard-coded primes. But there was a very important detail that got lost in translation between the mathematicians and the practitioners: an adversary can perform a single enormous computation to “crack” a particular prime, then easily break any individual connection that uses that prime.

The belief that these common primes (or at least some of them) wouldn't be cracked relied on the assumption that no one entity would have the money to assemble the computing force needed to break the code. The problem is that the NSA likely has the time, money and power to tackle this enormous project. Here's why it first seemed unlikely:

For the most common strength of Diffie-Hellman (1024 bits), it would cost a few hundred million dollars to build a machine, based on special purpose hardware, that would be able to crack one Diffie-Hellman prime every year.

And here's the reality of the situation, as exposed by documents leaked by Snowden.

The 2013 “black budget” request, leaked as part of the Snowden cache, states that NSA has prioritized “investing in groundbreaking cryptanalytic capabilities to defeat adversarial cryptography and exploit internet traffic.” It shows that the agency’s budget is on the order of $10 billion a year, with over $1 billion dedicated to computer network exploitation, and several subprograms in the hundreds of millions a year.

What was once considered to be beyond the capabilities of even the biggest intelligence agency is obviously well within its reach. As the authors point out, this would explain the other information seen in leaked documents, like the NSA's ability to decrypt some secured connections "on command" or eavesdrop on VPN traffic.

This is still just a theory, but it does seem to explain much of what's been uncovered in leaked documents. It also shows the NSA is still doing what the NSA does best: leaving lots of stuff poorly-secured, despite directives otherwise.

Our findings illuminate the tension between NSA’s two missions, gathering intelligence and defending U.S. computer security. If our hypothesis is correct, the agency has been vigorously exploiting weak Diffie-Hellman, while taking only small steps to help fix the problem.

As the authors point out, the NSA has recommended better encryption methods, but no one's in any hurry to adopt them because no one trusts the NSA to recommend a method it hasn't already weakened, if not completely compromised. If there's any truth to what's covered here, the NSA has sat quietly by and allowed researchers to recommend yet another encryption method that it's already made large strides towards defeating. And, once again, we can see that when the word "security" is combined with the word "national," it means something completely different than when it stands on its own.

Filed Under: alex halderman, backdoors, diffie hellman, diffie hellman key exchange, encryption, hacking, https, nadia heninger, nsa, surveillance, vpns

Sen. Grassley Asks DOJ To Get Back To Pushing James Comey's Mandatory Encryption Backdoors Plan

from the damn-this-administration's-showy-shrugs-over-encryption! dept

It's hard to figure out just where Sen. Charles Grassley stands in terms of his assessment of the FBI's trustworthiness. Grassley demanded the FBI answer questions on its presumably warrantless use of Stingray devices. He also called it out for refusing to update Congress on the status of its investigation into Hillary Clinton's emails.

But now that the debate over encryption and "going dark" seems to have come to a halt, Grassley is now encouraging the DOJ to take up FBI Director James Comey's lead and find a legislative "solution" to the supposed encryption problem.

FBI Director James Comey appears to have conceded defeat when it comes to legislation to require communications companies to make encrypted communications available to law enforcement on the basis of a search warrant. But Iowa Republican Sen. Charles Grassley is not having it.

"I believe that the administration should use every lawful tool at its disposal and vigorously investigate each and every potential solution to this serious problem," wrote Grassley, chairman of the Senate Judiciary Committee, in an Oct. 8 letter to Deputy Attorney General Sally Yates.

The letter points to some recent press coverage that suggests the administration has walked away from seeking mandatory backdoors to the encryption provided by Apple and Google. Apparently, a few "technically feasible solutions" have been put together by a "working group" but have not been discussed or otherwise made public. Grassley wants to know what these are and why the DOJ isn't pursuing these options.

I believe that the Administration should use every lawful tool at its disposal and vigorously investigate each and every potential solution to this serious problem, as your testimony before the Committee implied it would.

Grassley then goes on to cite efforts being made by the UK and France, as if the broad wording and overreach of their anti-terrorism proposals were something to be admired and emulated.

Moreover, countries like Great Britain and France are much further along in their national dialogues on how best to balance privacy and public safety with regard to and are currently contemplating specific legislative proposals to address the threat posed by widespread inviolable encryption.

Yes, but the "national dialogue" these countries are engaging in only includes pro-surveillance administrations and the intelligence agencies that stand to benefit from expanded powers and the increased budgets that come with them. The other stakeholders -- the citizens of these countries -- have been cut out of the discussion. Even in Comey's own words, the "threat" posed seems manageable ("dozens") and other evidence out there suggests encryption is rarely a problem for law enforcement or intelligence agencies, who have other ways of obtaining data and communications that do not require attacking encryption head-on.

Grassley appears to believe a legislative solution is the best approach. While this administration has demurred, another administration is on its way in little more than a year -- one that could take advantage of Congressional majorities to push through mandated encryption backdoors.

Filed Under: backdoors, chuck grassley, doj, encryption, fbi, going dark, james comey

Administration Won't Seek Holes In Encryption... But That's Just THIS Administration

from the encryption-as-platform dept

I don't normally recommend Lawfare, seeing as it's generally filled with NSA apologia and has been known to host the complaints of FBI directors who apparently just don't have enough outlets for crypto-related spleen-venting. But Hoover Institute cyber-policy/security scholar Herb Lin makes a few good points about the administration's decision to brush that backdoor dirt off its shoulders.

As pleasantly surprised as we may be by this decision to not screw with encryption to appease FBI director James Comey and other law enforcement officials, this unofficial (and mildly disingenuous) policy may be very short-lived .

In the absence of legislation, executive branch policy can stand only until the next administration. Thus, even if the present admin had said that it would *never* seek a legislative or technical back door to encrypted products or services (according to the NY Times, a statement sought by Tim Cook), it would not necessarily have had a binding effect past January 2017.

In other words, vote like your privacy and security depends on it. Given the current selection of possible candidates, this may prove to be difficult. The only candidates who seem likely to continue this hands-off approach would be Rand Paul and (possibly) Bernie Sanders. And from there, you have to consider who's actually a viable candidate and neither of those fit that description, at least not to the extent that anyone would feel comfortable calling them a frontrunner at this point.

A new president also means new faces in the legislature and a possible majority shift. Time and distance from the Snowden leaks heyday could result in "privacy fatigue," both by current officeholders as well as their constituents. Those who vote the most are also those who tend to view national security and law enforcement agencies as above reproach.

But the upcoming election isn't the only wild card. There's another option which won't result in much visible backdoor activity (legislation, etc.) but could still have the same end result.

The NY Times reported that the intelligence agencies were less vocal in their concerns about encryption, which it posited reflected their greater capabilities to gather information. If so, it suggests the desirability of increasing the technical capabilities of federal, state, and local law enforcement agencies to deal with encrypted data and communications when encountered.

New capabilities could be put to use without the public's awareness, shrouded in the same secrecy that won't even allow the NSA's budget to be published in unredacted form. Intelligence officials have stopped complaining about encryption and, as Lin points out, it could possibly mean they've found other ways to attack the "problem" -- something that doesn't (directly) involve tech companies or the far more public process of pushing for legislation.

Even without new capabilities, leaked documents have shown the NSA and others have plenty of options when it comes to accessing data and communications, even if they've been encrypted. Targeted software exploits and compromised hardware are only part of the equation. Third parties who hold the ability to decrypt communications they process can be leaned on to acquire more data and communications. And, of course, the NSA's focus continues to be defeating encryption.

The last wild card is the unforeseen. No one actively wishes for one of these events, but when they do happen, all previous lessons learned tend to be forgotten and hasty, overbroad legislation swiftly deployed to patch up perceived national security holes. The abuses uncovered by the Church Committee in the mid-70's were but a footnote to history by the morning of September 12, 2001. Whatever has been learned from the excesses of the Patriot Act will fade quickly should another terrorist attack occur. Whether or not it involves encrypted communications, encryption will be the first thing sacrificed to make Americans "safer..." just in case.

Filed Under: backdoors, encryption, fbi, going dark, james comey, politics

Former NSA Directors Coming Out Strongly *Against* Backdooring Encryption

from the didn't-see-that-coming dept

Earlier this summer, we were taken a bit by surprise when both former NSA/CIA boss Michael Hayden, along with former DHS boss Michael Chertoff, came out fairly strongly against backdooring encryption at a time when their counterparts still in the government seemed to be leaning in the other direction and have been pushing proposals to mandate backdoors. And it appears they're not backing down. Hayden has now doubled down with further statements against backdooring encryption, according to Lorenzo Franceschi-Bicchierai at Vice's Motherboard.

Michael Hayden, the former head of the US top spy agencies, the CIA, and the NSA, thinks the US government should stop railing against encryption and should support strong crypto rather than asking for backdoors.

The US is “better served by stronger encryption, rather than baking in weaker encryption,” he said during a panel on Tuesday.

Later, he told Lorenzo that part of his thinking is that the intelligence community doesn't need such backdoors since it has other ways of getting that info:

“In retrospect, we mastered the problem we created by the lack of the Clipper Chip,” he said. “We were able to do a whole bunch of other things. Some of the other things were metadata, and bulk collection and so on.”

Hayden is being a bit snarky there. He knows that privacy advocates will take his words about backdooring encryption and celebrate them, so he's using it at the same time to argue in favor of the other problematic programs -- programs that Hayden is most closely associated with involving mass surveillance. He's also being disingenuous. The metadata and mass surveillance efforts generally give you access to a different kind of information. What Hayden leaves out, of course, is the real reason why backdoors usually aren't that important: because there are almost always ways to hack into encrypted data, though that also raises serious questions.

Meanwhile, another former NSA director, Mike McConnell, has joined with the other two Michaels in arguing against backdoors. This according to Kaveh Waddell at the National Journal:

“Don’t get in the way of pro­gress,” Mc­Con­nell said Thursday at a pan­el dur­ing an en­cryp­tion sum­mit hos­ted by The Wash­ing­ton Post. “Don’t get in the way of in­nov­a­tion and cre­ativ­ity, be­cause this is go­ing to hap­pen. Some­body’s go­ing to provide this en­cryp­tion.”

Mc­Con­nell’s po­s­i­tion is a com­plete de­par­ture from the per­spect­ive he rep­res­en­ted in gov­ern­ment, a shift he has pub­licly ac­know­ledged. When he ran the Na­tion­al Se­cur­ity Agency in the 1990s, Mc­Con­nell was a vo­cal sup­port­er of the Clip­per Chip, a device de­veloped by the NSA that al­lowed the gov­ern­ment to de­crypt elec­tron­ic com­mu­nic­a­tions.

Of course, what's mostly left out of this discussion is that both McConnell and Hayden are now in the private sector -- Hayden at the Chertoff Group with Michael Chertoff, and McConnell at defense contracting giant (and former Ed Snowden employer) Booz Allen Hamilton -- where both have economic reasons for supporting actual stronger security, rather than undermining such security. Either way, in this debate, it seems that those pushing for backdooring encryption are increasingly being marginalized entirely. Even their normally faithful supporters have moved on into the world of reality, where backdooring encryption only leads to trouble.

Filed Under: backdoors, encryption, michael chertoff, michael hayden, michael mcconnell, nsa, surveillance

As US Turns Away From Idea Of Backdooring Crypto, David Cameron Has A Problem

from the saber-rattling dept

Last week, Mike wrote about what seems an important shift in US government policy on encryption, as the White House finally recognizes that adding backdoors isn't a sensible option. That leaves a big question mark over what the UK will do, since David Cameron and intelligence officials have been hinting repeatedly that they wanted to undermine encryption in some unspecified way. Just last week, the new head of MI5, the UK's domestic intelligence service, gave the first-ever live media interview by a senior British intelligence official. Asked about the alleged danger of parts of the Internet "going dark", he said:

"It requires the cooperation of the companies who run and provide services over the internet that we all use. It is in no one's interest that terrorists would be able to plot and communicate out of the reach of any authorities with the proper legal power."

That's from The Guardian, and another article there points out that the UK government's strategy of trying to get the big US online services to co-operate now looks in trouble:

If the White House does drop the battle [over backdoors] it will leave Britain with little option but to accept the widespread use of encryption. The UK's ability to directly lobby the big American technology firms is limited, and in a report leaked in June the former British diplomat Sir Nigel Sheinwald said that a new international treaty was the only way to get the co-operation of the companies. Without the support of the White House such a treaty seems unlikely.

Without the co-operation of the tech firms what the UK government can do when facing widespread encryption is limited. In June the Home Office confirmed that, for extreme cases, it was considering inserting "black box" probes into the transatlantic cables, to collect data leaving and entering the UK. But if the communications were encrypted on their way to the US, such collection would have little value.

Of course, a lot depends on the detailed policy adopted by the US government, and whether the US intelligence community manages to exploit any future terrorist attacks to get backdoors on the agenda again. But for the moment, it seems that David Cameron's anti-encryption saber-rattling will remain just that.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: backdoors, david cameron, encryption, going dark, mandates, uk

India's Government Looking At Mandating Backdoors In Encryption

from the selling-out-the-people-for-the-good-of-the-people dept

Here in the US, the FBI really really really wants to be able to let itself in your backdoor if it feels the urge to paw through your personal communications. (Perhaps the FBI's lack of respect for encryption is due to its own unwillingness to encrypt its communications...) Congress isn't pushing this forward and the administration has indicated it won't back an encryption backdoor mandate. Over in Europe, a mixed bag of terrorism-related legislation is going the other way, pushing for "good guys only" holes in encryption, with any negative use by criminals and foreign governments apparently being the price that must be paid to secure whatever liberty still remains once the "securing" is completed.

India's government -- never one to shy away from overreach, censorship or other bad ideas -- similarly sees encryption backdoors as A Good Thing. A draft proposal from India Department of Electronics and Technology, posted by essential government doc stash Public Intelligence, indicates that the government may be looking to mandate a variety of encryption backdoors in the near future.

It starts out with some positive thinking…

The recognition of the need to protect privacy and increase the security of the Internet and associated information systems have resulted in the development of policies that favour the spread of encryption worldwide. The Information Technology Act 2000 provides for prescribing modes or methods for encryption (Section 84A) and for decryption (Section 69). Taking into account the need to protect information assets, international trends and concerns of national security, the cryptographic policy for domestic use supports the broad use of cryptography in ways that facilitates individual / businesses privacy, international economic competitiveness in all sectors including Government.

...before cutting the floor away entirely.

This policy is not applicable to sensitive departments / agencies of the government designated for performing sensitive and strategic roles. This policy is applicable to all Central and State Government Departments (including sensitive Departments / Agencies while performing non-strategic & non-operational role), all statutory organizations, executive bodies, business and commercial establishments, including public sector undertakings and academic institutions and all citizens (including Personnel of Government / Business performing non-official / personal functions).

The "policy" is mandated backdoors -- not for "sensitive" and "strategic" government agencies, but for everyone else, from other government agencies to "all citizens."

The suggested policy splits up the country's population in three groups, with businesses and citizens designated as "B" and "C." The government says, yes, use encryption for better privacy and security... but don't lock us out.

B / C groups (i.e. B2C, C2B Sectors) may use Encryption for storage and communication. Encryption algorithms and key sizes will be prescribed by the Government through Notification from time to time. On demand, the user shall reproduce the same Plain text and encrypted text pairs using the software / hardware used to produce the encrypted text from the given plain text. All information shall be stored by the concerned B / C entity for 90 days from the date of transaction and made available to Law Enforcement Agencies as and when demanded in line with the provisions of the laws of the country. In case of communication with foreign entity, the primary responsibility of providing readable plain-text along with the corresponding Encrypted information shall rest on entity (B or C) located in India.

And any ISP looking to provide service in India -- including those not actually located in India -- is expected to give the government access to encrypted transmissions.

Service Providers located within and outside India, using Encryption technology for providing any type of services in India must enter into an agreement with the Government for providing such services in India. Government will designate an appropriate agency for entering into such an agreement with the Service provider located within and outside India. The users of any group G,B or C taking such services from Service Providers . are also responsible to provide plain text when demanded.

On top of that, creators of encryption products would be required to register with the government and submit to a "security evaluation." Presumably, the evaluation will include discussion of where to best place backdoors and/or involve a handover of Golden Keys.

The proposal also suggests the government take a more active role in the development of "indigenous" encryption products. While not specifically detailed in the draft, one assumes any government-produced, pre-compromised encryption products will make their debut accompanied by mandates requiring use going forward, if not retroactively as well.

For what it's worth, the Indian government is accepting comments on the proposed policy until October 16th. Presumably, the draft will move forward despite any negative feedback, given the country's track record on internet freedom and human rights. Factor in the threat of terrorism, and there's very little chance the government won't find some way to push this through mostly unaltered.

Filed Under: backdoors, encryption, going dark, india, mandates

Why Backdoors Always Suck: The TSA Travel Locks Were Hacked And The TSA Doesn't Care

from the locks-with-scare-quotes dept

The TSA, it appears, is just simply bad at everything. The nation's most useless government agency has already made it clear that it is bad at knowing if it groped you, bad at even have a modicum of sense when it comes to keeping the traveling luggage of citizens private, and the TSA is especially super-mega-bad at TSA-ing, failing to catch more than a fraction of illicit material as it passes by agents upturned noses. And now, it appears, the TSA has demonstrated that it is also bad at pretending to give a shit.

In case you missed the recent news, the TSA's specially designed master key to open all of the specially designed TSA-recognized luggage locks were especially super-hacked by someone with access to such privileged information and equipment as a newspaper subscription and a 3D printer. By using a picture in the Washington Post of a TSA agent's master key and some documents from Travel Sentry, a group that generates and enforces TSA protocols, one security researcher was able to create 3D printer files to create his own master key.

Steven Knuchel, a hacker/security researcher who goes by Xylitol or Xyl2k, used the detailed images obtained from the Travel Sentry website to create the kind of files that 3D printers use to produce models. Since the files were first published, several people have demonstrated that they work, using inexpensive 3D printing plastic called PLA.

So, hey, that's probably bad, right? I mean, here we have the TSA recommending passengers lock their luggage with locks designed with a TSA-backdoor in the form of a master key, and now anyone can make the master key. That would seem to leave thousands (millions?) of passengers' luggage vulnerable to break-in. Not a great look for an agency designed with no other goal beyond security. The TSA response?

“The reported ability to create keys for TSA-approved suitcase locks from a digital image does not create a threat to aviation security,” wrote TSA spokesperson Mike England in an email to The Intercept. “These consumer products are ‘peace of mind’ devices, not part of TSA’s aviation security regime,” England wrote.

Yes, that's correct. Upon being informed of the TSA lock master key hack, the TSA essentially went with the "we don't give a shit" approach. I will say, at the very least, that it's somewhat refreshing to hear a government representative admit that at least some part of aiport and passenger security boils down to the feel-goods, but I'm of the opinion that a security agency unconcerned about security probably shouldn't be allowed to exist any longer. Especially when that same agency has been touting those same useless locks for years to passengers.

The larger point, of course, is that this is inevitable when you build security with backdoor access.

Nicholas Weaver, a computer security researcher at Berkeley, wrote on the Lawfare blog about the TSA locks and how they are “similar in spirit to what [FBI] Director [James] Comey desires for encrypted phones.”

Xylitol, the GitHub user who published the blueprint of the keys, said that was his point. “This is actually the perfect example for why we shouldn’t trust a government with secret backdoor keys (or any kind of other backdoors),” he wrote in an email to The Intercept. “Security with backdoor[s] is not security and inevitably exposes everyone.”

That's an axiom that other government agencies might want to pay attention to. The breaking of TSA locks wasn't even particularly difficult. If the government truly wants security on the networks of the American people, be the computer, phone, or otherwise, building in government backdoors provides the perfect entry point for bad-actors. If they actually want security, leave the backdoors out, or they risk looking every bit as dumb as the TSA.

Filed Under: backdoors, privacy, security, tsa, tsa key