Russian Court Says Telegram Must Hand Over Encryption Keys To State Intelligence Service

from the maybe-don't-hold-onto-all-of-the-keys-in-the-first-place dept

Here's an idea for the FBI, gift-wrapped and signed "From Russia, With Love."

Telegram, the encrypted messaging app that’s prized by those seeking privacy, lost a bid before Russia’s Supreme Court to block security services from getting access to users’ data, giving President Vladimir Putin a victory in his effort to keep tabs on electronic communications.

Supreme Court Judge Alla Nazarova on Tuesday rejected Telegram’s appeal against the Federal Security Service, the successor to the KGB spy agency which last year asked the company to share its encryption keys. Telegram declined to comply and was hit with a fine of $14,000. Communications regulator Roskomnadzor said Telegram now has 15 days to provide the encryption keys.

Who needs backdoors when messaging services are willing to keep their customers' front doors keys on hand for you? Sure, Telegram doesn't want to turn these over to the FSB, but its decision to hold onto encryption keys means they're available to be had. Telegram is appealing this decision, so customers' keys are safe for now, but there's zero chance the FSB is going to back down.

The FSB has also provided a ridiculous argument for the FBI to use when demanding companies retain keys for easy law enforcement access. According to the FSB's interpretation of the Russian constitution, no privacy violations occur when the government obtains citizens' encryption keys.

The security agency, known as the FSB, argued in court that obtaining the encryption keys doesn’t violate users’ privacy because the keys by themselves aren’t considered information of restricted access.

Clever. The keys are not restricted info. Everything accessible with the keys is. This isn't completely unlike judicial assertions that passwords are not evidence, even if relinquishing them then gives the government access to plenty of evidence. In this case, the FSB is collecting the keys to everyone's houses and promising not to open them up and take a look around whenever it feels the urge. The best way to protect users' privacy is to not hold the keys. The second best way is to take your business elsewhere (but in reverse, I guess) when local governments claim the only way you can do business locally is by placing users' communications directly in the government's hands.

If Telegram is forced to hand the keys over, it will be the last communications company in Russia to do so. All others have "registered" with the state communications agency, putting their users' communications directly in the Russian government's hands. If Telegram decides to pull out of the market, it will leave behind nearly 10 million users. Many of those will probably end up utilizing services the FSB has already tapped. Others may go overseas for uncompromised messaging services. But in the end, the FSB will get what it wants.

As for Telegram, it's facing a tough choice. With an initial coin offering in the works, it may not be willing to shed 10 million users and risk lowering its value. On the other hand, it may find standing up for 10 million users isn't something that matters to investors. Unfortunately, pushing back against the FSB on behalf of its users still may result in the loss of several million users once the Russian high court reaches its expected decision several months down the road. It still has the option of moving its operations out of the reach of the Russian government while still offering its services to Russian citizens. This may be the choice it has to make if it wants its millions of Russian users to avoid being stuck with compromised accounts.

Filed Under: encryption, fsb, privacy, russia, surveillance
Companies: telegram

Putin Says All Encryption Must Be Backdoored In Two Weeks

from the make-it-snappy dept

A few weeks ago, we wrote about the push by the Russian Duma to pass a massive new surveillance bill that would mandate backdoors to encryption as well as massive data retention requirements for service providers, including saying that they need to store recordings of phone calls. As you may have heard, earlier this week, Russian President Vladimir Putin signed the bill into law. And apparently to prove that he's serious about all of this, Putin has also signed an executive order telling the FSB (the modern version of the KGB) to make sure it gets encryption keys to unlock everything within the next two weeks.

After signing controversial anti-terrorist legislation earlier today, President Putin ordered the Federal Security Service (the FSB, the post-Soviet successor to the KGB) to produce encryption keys to decrypt all data on the Internet. According to the executive order, the FSB has two weeks to do it. Responsibility for carrying out Putin's instructions falls on Alexander Bortnikov, the head of the FSB.

As the article notes, there's a lot of uncertainty here, because in many cases, when things are encrypted locally or where there are private keys, there isn't any way for service providers to turn over any keys.

What happens next is a little unclear. But it seems likely that the Russian government will use this to attack certain encrypted communications services, and potentially block and/or fine them for failing to comply with the new law. There has been a lot of talk about how Ed Snowden has been speaking out against this law, as he should. Considering that he uses a number of different encryption systems to communicate with the world, this law puts him very directly in danger. But it also puts lots of other people at risk as well. As we've been pointing out for a while, encryption does much more to protect everyday citizens than it does to hide the communications of "terrorists." Undermining that puts a lot more people at risk of people hacking into their stuff than being a victim of a terrorist attack.

Filed Under: backdoors, data retention, ed snowden, encryption, fsb, mass surveillance, russia, surveillance, vladimir putin

Move Over Ed Snowden, Al Jazeera Has A Huge New Stack Of Spy Documents

from the and-the-revelations-just-keep-on-coming dept

There have been questions of when (not if) the next "Ed Snowden" situation would show up. There certainly have been a few recent leaks that appear to have been from folks other than Snowden, but they've mostly been one-off leaks. However, this morning, Al Jazeera is claiming that it got its hands on a huge trough of spy documents, in the form of cables from South Africa's spy agency, the State Security Agency (SSA), and it will begin reporting on what's in those documents, in collaboration with reporters at The Guardian:

Spanning a period from 2006 until December 2014, they include detailed briefings and internal analyses written by operatives of South Africa's State Security Agency (SSA). They also reveal the South Africans' secret correspondence with the US intelligence agency, the CIA, Britain's MI6, Israel's Mossad, Russia's FSB and Iran's operatives, as well as dozens of other services from Asia to the Middle East and Africa.

The files unveil details of how, as the post-apartheid South African state grappled with the challenges of forging new security services, the country became vulnerable to foreign espionage and inundated with warnings related to the US "War on Terror".

As Al Jazeera points out, this is not "signals intelligence" (SIGINT) material, but rather "human intelligence" (HUMINT) of the kind normally done by the CIA, rather than the NSA. It's about spies on the ground -- and also, according to Al Jazeera, their humdrum daily office existence. Honestly, it almost sounds like the plot of a bad sitcom: come work at a premier national intelligence agency... and bitch about the lack of parking:

At times, the workplace resembles any other, with spies involved in form-filling, complaints about missing documents and personal squabbles.... One set of cables from the Algerian Embassy in South Africa relates to a more practical concern. It demands that "no parking" signs are placed in the street outside. The cable notes that the British and US embassies enjoy this privilege, and argues that it should be extended to Algeria as well.

Whether or not this latest leak turns up anything more interesting than parking disputes, it is worth noting that another trove of intelligence documents have leaked...

Filed Under: cia, fsb, leaks, mi6, mossad, south africa, ssa, surveillance, whistleblower
Companies: al jazeera, guardian

Putin's 'Clapper' Moment: What He Said Vs. What Russian Intelligence Actually Does

from the did-anyone-expect-Putin-to-actually-confirm-this? dept

Snowden's puzzling single-question Q&A with Russian president Vladimir Putin on the topic of domestic surveillance prompted many to believe this was an indication that he was, at the very least, under control of Russian intelligence, if not actually acting in concert with it. Putin took the apparent softball and lined it right down the middle, responding with a series of statements and denials that made Russia appear to be the antithesis of the US government: tightly controlled intelligence built on respect for its citizens' privacy.

As Snowden later clarified, he was pulling a Wyden -- crafting a question about the mass collection and storage of communications that would either result in transparency or an easily-disproven denial. Putin delivered the latter.

"Mr Snowden you are a former agent, a spy, I used to work for a intelligence service, we are going to talk the same language."

He said Russia did not have a comparable programme, stating: "Our agents are controlled by law. You have to get court permission to put an individual under surveillance. We don't have mass permission, and our law makes it impossible for that kind of mass permission to exist."

Putin's response was laughable. After all, his nation's intelligence services originally put the "surveillance" in Surveillance State. In the USSR, along with the Eastern Bloc, citizens were very closely watched and routinely punished for not toeing the Party line.

Not much has changed, even if Russia is nominally a "free" country. The Russian Federal Service for Telecoms Supervision (Roskomnazdor) is continually expanding its internet censorship efforts and Russian intelligence services have made public announcements about their surveillance plans, like the collection of all foreign communications during the Sochi Olympics.

While Roskomnazdor mans the front door, Russian intelligence lets itself in the back, according to information gathered by Privacy International.

When the Soviet Union collapsed, many of the KGB’s regional branches became the security services of the newly independent states. But they didn’t stray far from the Kremlin’s lead. They modeled their governing laws after Moscow’s, and used similar technology, too. Namely, SORM — Russia’s nationwide system of automated and remote legal interception on all kinds of communications.

SORM’s tactical and technical foundations were developed by a KGB research institute in the mid-1980s. Initially SORM was installed on analogue telephone lines. As new technologies developed, SORM did, as well.

Today SORM-1 intercepts telephone traffic, including mobile networks, while SORM-2 is responsible for intercepting internet traffic, including VoIP. SORM-3 gathers information from all communication media, and offers long-term storage (three years), providing access to all data on subscribers. In addition, SORM enables the use of mobile control points, a laptop that can be plugged directly into communication hubs and immediately intercept and record the operator’s traffic.

SORM also proved essential to spy on social networks based in Russia. “We can use SORM to take stuff off their servers behind their backs,” an FSB official told us. According to figures published by Russia’s Supreme Court, over the last five years the number of legal telephone intercepts alone has almost doubled, from 265,937 intercepts and recordings of phone calls and e-mails to 466,152 in 2011.

Going back to Putin's statement, he claims that "court permission" is needed to put someone under surveillance. From the above paragraph, that statement would appear to be true. But further digging into SORM reveals that court orders and warrants are little more than surveillance blank checks.

In Russia, an FSB operative is also required to get an eavesdropping warrant, but he is not obliged to show it to anyone. Telecom providers have no right to demand that the FSB show them the warrant. The providers are required to pay for the SORM equipment and its installation, but they are denied access to the surveillance boxes.

Thus, the FSB does not need to contact the ISP’s staff; instead the security service calls on the special controller at the FSB HQ that is connected by a protected cable directly to the SORM device installed on the ISP network. This system is copied all over the country: In every Russian town there are protected underground cables, which connect the HQ of the local FSB department with all ISPs and telecom providers in the region.

If the FSB needs to add targets to its existing "tap," it doesn't need to notify the court. The agent in place simply updates the SORM control device. So, one controller and one court order can easily trap the communications of an unlimited number of citizens, all without anyone but SORM knowing who's being surveilled. This technology has made its way to the former Eastern Bloc (which hasn't made those countries happy) and has been deployed to intercept communications from political opponents. The more things change, the more Russian intelligence appears to be happy to return to its KGB heyday.

Beyond the fact that Putin's answer was simply (and knowingly) false, there's also the fact that his denials echo those delivered by NSA and GCHQ officials. Whenever a new leak surfaces, the routine denial is dispensed. Here's GCHQ's canned response:

[A]ll of GCHQ’s work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight…

Putin basically says the same thing while denying information that's already been made public. According to him, it's all legal and subject to oversight, something that clearly isn't the case. Certainly Snowden expected a canned answer, and he got one -- one in which Putin lied about his intelligence agency's capabilities and tactics. At one point, we in the US (and the UK) could have mocked such a clearly false denial, but after the events of the past nine months, we no longer have that luxury.

The problem isn't that we don't expect Russia's government to have made a sea change in its relationship with its citizens. The problem is that we didn't expect ours had. Putting this on Snowden's head because a softball question was handled with a PR-savvy answer doesn't make him complicit with the FSB's surveillance activities. But our politicians and government agencies have made us unwillingly complicit with our own. "Legality" and "oversight" are mere buzzwords in the hands of surveillance state defenders. The words don't mean what they used to… if they ever meant anything at all.

Filed Under: ed snowden, fsb, russia, surveillance, vladimir putin

Recently Departed Founder Of Russia's Facebook Says Gov't Demanded Data On Ukrainian Protestors

from the surveillance-made-simple dept

While we're still puzzled by Ed Snowden's question to Vladimir Putin concerning Russian surveillance, it's pretty well accepted that the Russians have significant surveillance powers, and they're not afraid to use them. Now the outspoken ousted founder of "Russia's Facebook," VKontakte, Pavel Durov, has said that Russian intelligence service FSB had demanded info on Ukrainian protestors -- and that VKontakte had refused to provide it. As Mashable explains:

"On December 13, 2013 the FSB demanded from us to turn over the personal data of organizers of the Euromaidan protesters," Pavel Durov wrote in a post (English translation) on his VKontakte page on Wednesday.

"Our response has been and remains a categorical refusal — Russian jurisdiction does not extend to Ukrainian users VKontakte," he wrote. "Giving personal details Ukrainians Russian authorities would not only be against the law, but also a betrayal of all those millions of people in Ukraine who have trusted us."

This actually provides some more background details on what happened with VKontakte and Durov in the past few months. In January, Durov "sold" his stake in the site to the CEO of a Russian mobile operator. Many people noted at the time that this was unlikely to have been a wholly voluntary transaction. Having known some folks working for startups/tech companies in Russia, stories of being "forced" to sell are not exactly uncommon.

Durov himself had been outspoken for a while about the importance of secure communications, and had criticized both the NSA and the FSB for mass surveillance. He's also been working for a while on a secure messaging app (separate from VKontakte).

Then, just a few weeks ago, despite promises that when he sold his shares, nothing would change about his management role, he abruptly resigned. It was noted at the time that he had been under pressure to shut down pages related to Alexei Navalny, an opposition candidate to the current government, whose web presence was broadly censored by the Russian government last month. However, it was also hinted at that Durov had been asked to give up info on Ukrainian protestors. His latest comments appear to confirm those rumors.

Also, given that he's no longer there, and this appears to be part of the reason, it seems reasonable to believe that the FSB now does likely have access to such information via VKontakte. For whatever Putin thought he was proving with his answer to Snowden's question, it's pretty clear that Russian surveillance reaches far and wide. And, of course, the NSA's activities allow him to play it off as less intrusive than the NSA (even if that's not true). Either way, all of this seems to highlight why we all need much more secure communications systems.

Filed Under: fsb, pavel durov, privacy, surveillance, ukraine, vladimir putin
Companies: vk, vkontakte

Snowden Asks Putin Live On TV If Russia Carries Out Mass Surveillance; But Why?

from the what-on-earth-was-he-thinking? dept

Edward Snowden has generally been staying out of the limelight so that the NSA story is about the surveillance not the whistleblower. He's given occasional interviews and delivered a few short speeches via videolink, but usually of a fairly low-key nature. That makes his unexpected appearance today on a marathon televised question-and-answer session with Vladimir Putin -- again by videolink -- extremely odd. Here's his question, as reported by The Guardian:

Snowden asked: "Does Russia intercept or store or analyse the communication of millions of individuals?" He went on to ask whether increasing the effectiveness of internal security systems could ever justify such actions.

To which Putin replied:

"Mr Snowden you are a former agent, a spy, I used to work for a intelligence service, we are going to talk the same language."

He said Russia did not have a comparable programme, stating: "Our agents are controlled by law. You have to get court permission to put an individual under surveillance. We don't have mass permission, and our law makes it impossible for that kind of mass permission to exist."

He said he was aware that "criminals and terrorists" relied on this kind of [technology], and that their actions demanded a response from the security services. "We have to use technical means to respond to their crimes, including those of a terrorist nature, we do have some efforts like that. We don't have a mass control. I hope we [w]on't do that," he said.

It's really hard to know why Snowden asked this question. Perhaps he wanted to emphasize the disproportionate nature of NSA spying by contrasting it with Russia's approach; perhaps he thought his appearance would jolt a jaded public and focus renewed attention on the key issues. But surely he must have guessed that Putin would answer as he did -- whether or not it is true -- that Russia uses surveillance strictly according to the law, that there is no massive, disproportionate spying of the kind practiced by the NSA, etc. etc. He must have known that Putin would easily turn Snowden's question into a wonderful opportunity to score points against the US.

Inevitably, then, this appearance will be leapt on by those who have maintained that Snowden is some kind of Russian spy, and that he has been working for Putin all along. As Techdirt has noted, that story doesn't stand up, but this unexpected intervention by Snowden certainly doesn't do anything to dispel it. For someone who until now has judged when and how to make public statements so skilfully and effectively, this seems like an incredible misstep. It really makes you wonder what might lie behind it.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: ed snowden, fsb, mass surveillance, nsa, russia, surveillance, vladimir putin

Has Russia's VKontakte Social Network Betrayed Its Users? Or Is It Under Attack For Defending Them?

from the what's-going-on? dept

We last wrote about the Russian social network site VKontakte, often called "The Facebook of Russia," a year ago. Since then, lots of bad stuff has been happening in Russia as a part of clampdown on online activity there, and now VKontakte is back in the news, with a pair of rather contradictory stories.

On the one hand, East-West Digital News is reporting that VKontakte has been cooperating with the Russian secret service FSB (successor to the KGB):

Directly implicated is Vkontakte co-founder and CEO Pavel Durov. In what [the Russian newspaper Novaya Gazeta] alleged was a message from Durov to Vladislav Surkov, a notorious hardliner who was, at that time, the deputy head of then President Medvedev's administration, Durov mentioned that his site "[has] been cooperating with the FSB and Department K [a section of the Interior Ministry responsible for preventing cybercrime] for several years, promptly disclosing information about thousands of our users in the form of IP addresses, phone numbers, and other data required to pin them down."

That sounds like a pretty bad betrayal of trust. But in the light of a story published recently in the Guardian, you have to wonder whether false documents are being circulated to blacken VKontakte's name:

The Russian version of Facebook has had its offices searched and its ownership structure shaken amid fears the Kremlin is looking to tighten its grip on the internet.

...

A source inside VKontakte said that pressure against the site began after Durov refused to co-operate with the Federal Security Service (FSB) when Moscow erupted in protest.

"A year ago, when the protests started, Durov showed he wasn't ready to close protest pages," the source said. "That's when his problems started." VKontakte said at the time it had denied an FSB request to shut several pages devoted to opposition groups.

That hardly sounds like a company that is secretly cooperating with the authorities to spy on its users, but does sound more like one that is paying the price for defending them. So until more details emerge, it's really hard to know what to think here. Probably the most that can be said is that the online world in Russia remains in turmoil, as Vladimir Putin seeks to assert control over any possible channels of dissent.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: fsb, russia
Companies: vkontakte