Former Head Of GCHQ Says Don't Backdoor End-To-End Encryption, Attack The End Points

from the putting-an-end-to-the-end-to-end-debate dept

When he was head of GCHQ, Robert Hannigan said some pretty clueless things about the Internet and encryption. For example, in 2014, he accused tech companies of 'facilitating murder', and joined in the general demonization of strong crypto. Last year, he called for technical experts to work more closely with governments to come up with some unspecified way around encryption. Nobody really knew what he meant when he said:

"I am not in favor of banning encryption. Nor am I asking for mandatory back doors. … Not everything is a back door, still less a door which can be exploited outside a legal framework."

Now, speaking to the BBC, he has clarified those remarks, and revealed how he thinks governments should be dealing with the issue of end-to-end encryption. As he admits:

"You can't uninvent end-to-end encryption, which is the thing that has particularly annoyed people, and rightly, in recent months. You can't just do away it, you can't legislate it away. The best that you can do with end-to-end encryption is work with the companies in a cooperative way, to find ways around it frankly."

He emphasized that backdoors are not the answer:

"I absolutely don't advocate that. Building in backdoors is a threat to everybody, and it's not a good idea to weaken security for everybody in order to tackle a minority."

So what is the solution? This:

"It's cooperation to target the people who are using it. So obviously the way around encryption is to get to the end point -- a smartphone, or a laptop -- that somebody who is abusing encryption is using. That's the way to do it."

As Techdirt reported earlier this year, this is very much the approach advocated by top security experts Bruce Schneier and Orin Kerr. They published a paper describing ways to circumvent even the strongest encryption. It seems that Hannigan has got the message that methods other than crypto backdoors exist, some of which require cooperation from tech companies, which may or may not be forthcoming. It's a pity that he's no longer head of GCHQ -- he left for "personal reasons" at the beginning of this year. But maybe that has given him a new freedom to speak out against stupid approaches. We just need to hope the UK government still listens to him.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: encryption, gchq, going dark, hacking, robert hannigan, security

Spies In Denial: GCHQ Boss Says Snowden Didn't Kick Off Debate Over Surveillance

from the you-look-foolish dept

For all the idiotic things said about Ed Snowden, at least US bureaucrats appear to have come around to the idea that he helped kick off a necessary debate on surveillance powers and privacy. Just recently we had former Attorney General Eric Holder admit that Snowden "performed a public service by raising the debate." And regular surveillance apologist and former Defense Department lawyer Jack Goldsmith just said that "Snowden forced the intelligence community out of its suboptimal and unsustainable obsession with secrecy."

It appears that some of their counterparts in the UK are still in denial about all of this. GCHQ's boss Robert Hannigan, whose currently on a PR charm offensive (or should that be just offensive PR?) insists that Snowden has nothing to do with the ongoing debate, which he says was happening prior to Snowden leaking documents:

No, Edward Snowden had not sparked a global debate about privacy - that had been under way already - but terrorist targets GCHQ had been tracking had learned from his revelations with heavens knows what consequences, he said.

This is delusional, and calls into question whether or not the GCHQ has management that lives in reality or in a fantasy land. As someone who has followed this issue since well before the Snowden leaks, to argue that the debate was happening in any real way prior to them being splashed across the press is a flat out lie. You can disagree with what Snowden did -- as Hannigan clearly does. But to argue that the revelations did not spark the debate is clearly wrong.

As for the latter part of Hannigan's claim, that terrorists learned stuff from the Snowden documents that created "heaven knows what consequences," that's a load of bunk also. Actual studies showed basically no change in behavior by terrorists post-Snowden, as many already assumed that their basic communications were being tracked. And no one has yet to demonstrate any legitimate consequences from his revelations other than forcing people like Hannigan to have to answer questions about why the GCHQ and NSA seem to be spying on tons of people.

If this new PR campaign is about rebuilding trust in the GCHQ, Hannigan might want to recognize that spewing pure bullshit doesn't make people trust him more. It makes them trust him a lot less.

Filed Under: debate, ed snowden, gchq, robert hannigan, surveillance

GCHQ Boss Says Tech Companies, Government Should Work Together To Give The Government What It Wants

from the putting-the-'I'-back-in-'team' dept

The head of GCHQ has decided to make some belated overtures to the tech companies intelligence agencies have alienated over the past few years. With the UK's ever-evolving Investigatory Powers Act hanging around like an unwanted, hungover and extremely nosy houseguest, GCHQ Director Robert Hannigan says it's time for the government and tech companies to work together for the mutual betterment of both to give government agencies the access they're stopping just short of legislating into existence.

He starts by stating he doesn't want to ban encryption or demand backdoors…

“It should be possible for technical experts to sit down together and work out solutions,” he said. “I am not in favor of banning encryption. Nor am I asking for mandatory back doors. …

...before stating that backdoors would be a wonderful thing. They just might need to undergo rebranding.

"Not everything is a back door, still less a door which can be exploited outside a legal framework."

OH. You want those kinds of backdoors: the ones that can only be solely exploited within a legal framework. Sorry, we're fresh out. It's not that tech companies don't want to help, but even "technical experts" can't craft an exploitable "not a backdoor" that can only be exploited by whoever the government decides should be able to exploit it. ("Working together" or not, it will be the government that determines access, rather than the technical experts at tech companies who designed it.)

So, Hannigan doesn't want a backdoor. He wants another set of keys for the front door and is requesting that all parties work together to decide whether this set should be left in the mailbox or under the welcome mat. This skewed view likely comes from Hannigan's assumption that the many years of tech compnany cooperation intelligence and law enforcement agencies have enjoyed comes from a deep well of heartfelt goodwill, rather than numerous laws compelling them to do so.

Nonetheless, Hannigan—making just his second appearance in a public forum since taking the helm of GCHQ in 2014—said tech companies should work more closely with governments to try to come up with ways to give law enforcement what it wants. “The perception that there is nothing but conflict between governments and the tech industry is a caricature,” he said in his speech. “In reality, companies are routinely providing help within the law, and I want to acknowledge that today.”

It may have been less of a caricature pre-2013, but it was never simply about tech companies giving the government whatever it wanted whenever it asked for it. That's why the world's intelligence agencies are hoarding exploits, buying malware from shady merchants, and intercepting hardware shipments to add their own backdoors.

And so, yet another request goes out for cooperation in the ongoing search for an intelligence/law enforcement unicorn while War's "Why Can't We Be Friends?" plays in the background. Nothing's going to move forward until officials like Hannigan admit the thing they want (a safe backdoor) isn't something they can actually have -- at least not without a lot of collateral damage. If they can at least be honest enough to state they want it no matter how many problems it causes elsewhere, then maybe they'll be ready to move to the next level of discussion -- even if the "next level" means the discussion has reached its logical endpoint.

Filed Under: backdoors, encryption, gchq, robert hannigan, uk
Companies: apple

Demonizing Strong Encryption: Welcome To The Crypto Wars 2.0

from the paedophiles,-murderers-and-terrorists dept

Recently Techdirt wrote about the extraordinary tirade by the new GCHQ boss, Robert Hannigan, which boiled down to: "however much we spy and censor online today, it's still not enough." It was so full of wrong-headed and dangerous ideas that it was hard to capture it all in one post. Here's one thing we didn't have room for last time:

Isis also differs from its predecessors in the security of its communications. This presents an even greater challenge to agencies such as GCHQ. Terrorists have always found ways of hiding their operations. But today mobile technology and smartphones have increased the options available exponentially. Techniques for encrypting messages or making them anonymous which were once the preserve of the most sophisticated criminals or nation states now come as standard. These are supplemented by freely available programs and apps adding extra layers of security, many of them proudly advertising that they are "Snowden approved". There is no doubt that young foreign fighters have learnt and benefited from the leaks of the past two years.

Leaving aside the rather pathetic dig at Snowden at the end there, and the unsubstantiated statement that terrorists have benefited from his leaks, the key message here is that strong encryption is now used routinely by the wrong people, and that it presents an "even greater challenge" to the world's security services. If that lament sounds familiar, it's because suddenly, over the last few weeks, it has become the persistent refrain of law enforcement agencies in both the US and UK.

First we had the FBI Director James Comey talking about his agency's fears about things "going dark" because of encryption; then we heard from NYPD Commissioner Bill Bratton about how encryption "does a terrible disservice to the public"; a couple of weeks later, former NSA General Counsel Stewart Baker suggested the reason Blackberry had failed was because it used "too much encryption".

Now it seems that the baton has been passed to the UK. The day after Hannigan led the way with his piece in the Financial Times, the head of London's Metropolitan Police added his voice to the chorus of disapproval, as the London Evening Standard reports:

London's police chief today warns society against letting parts of the internet become a "dark and ungoverned" space populated by paedophiles, murderers and terrorists.

In a call for action, Met Commissioner Sir Bernard Hogan-Howe says encryption on computers and mobile phones is frustrating police investigations, meaning parts of the web are becoming "anarchic places".

What's particularly interesting is that as part of his visit to New York to make this speech, Hogan-Howe was also planning to meet all the senior US officials who had just voiced their concerns about encryption in precisely the same terms:

Sir Bernard has spent several days in talks with New York and Washington police chiefs about the threat of terrorism and what he calls "the challenges and opportunities" of technology. Today he was meeting FBI director James Comey.

He was also telling law enforcement experts behind closed doors at the New York police department that the internet is now a safe haven for criminality, adding: "Privacy is important but in my view the security of communications methods and devices is growing beyond what any genuine domestic user could reasonably require."

It's hard not to see this as part of a concerted and organized counter-attack against growing calls to rein in US and UK surveillance in the wake of Snowden's revelations. The common line on both sides of the Atlantic is that encryption has gone too far -- that "the security of communications methods and devices is growing beyond what any genuine domestic user could reasonably require". The clear implication is that only "paedophiles, murderers and terrorists" would want strong crypto, and that for law-abiding citizens with nothing to hide, crypto with backdoors is good enough.

But it isn't, of course. Law-abiding citizens with nothing to hide have a perfect right to real privacy online, just as they have a right to use doors, walls and curtains to screen off their private lives from the world's gaze. As Techdirt has noted before, placing backdoors in nominally secure systems simply makes them completely insecure, since there is no way to stop the bad people from using them too. Moreover, weakening crypto would not only make the Internet vastly less secure for billions of users, it would also undermine millions of online businesses and thus the economies with which they are now so deeply intertwined.

We can expect more of these blatant attempts to demonize strong cryptography, and to paint its mere use as a sure sign of terrorism and depravity. But we have been here before. During the 1990s the US government tried to introduce backdoors into secure communications using the Clipper chip. Civil society won those first Crypto Wars; now it needs to gird its loins to fight and win Crypto Wars 2.0.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bernard hogan-howe, crypto wars, demonized, encryption, james comey, mobile encryption, robert hannigan, stewart baker
Companies: apple, google

New GCHQ Boss Blames Tech Industry For 'Facilitating Murder' And Being Terrorists' 'Command-And-Control' Center

from the say-what-now? dept

So, we weren't too impressed with previous GCHQ (the UK equivalent of the NSA) boss, Sir Iain Lobban, who insisted that GCHQ didn't do "mass surveillance" so long as you defined "mass" and "surveillance" the way he does (and not the way the English language does). This statement was made just days before it was revealed that the GCHQ (contrary to its own claims) gets access to NSA data without a warrant.

New GCHQ boss Robert Hannigan has taken to the potentially pay-walled pages of the Financial Times to convince the world that he's a complete nutjob in charge of one of the most powerful spy agencies in the world. His message: basically "terrorists use technology, and because you hate terrorists, we should all be happy to have tech companies share all your private data with us to catch terrorists." Or something like that. Hannigan honestly seems to believe that the public is really on the government's side against the tech companies they use every day. That seems like rather large miscalculation of his audience.

Hannigan's pitch relies on (of course) spreading as much FUD as possible, starting with ISIS:

Terrorists have long made use of the internet. But Isis’s approach is different in two important areas. Where al-Qaeda and its affiliates saw the internet as a place to disseminate material anonymously or meet in “dark spaces”, Isis has embraced the web as a noisy channel in which to promote itself, intimidate people, and radicalise new recruits.

The extremists of Isis use messaging and social media services such as Twitter, Facebook and WhatsApp, and a language their peers understand. The videos they post of themselves attacking towns, firing weapons or detonating explosives have a self-conscious online gaming quality. Their use of the World Cup and Ebola hashtags to insert the Isis message into a wider news feed, and their ability to send 40,000 tweets a day during the advance on Mosul without triggering spam controls, illustrates their ease with new media. There is no need for today’s would-be jihadis to seek out restricted websites with secret passwords: they can follow other young people posting their adventures in Syria as they would anywhere else.

Got it? Terrorists use the same services you and I do, and they're really, really mean. So, why is the public so upset that GCHQ wants to snoop on what everyone's doing on those services? For bonus points, he also tosses in some child porn fears as well.

GCHQ and its sister agencies, MI5 and the Secret Intelligence Service, cannot tackle these challenges at scale without greater support from the private sector, including the largest US technology companies which dominate the web. I understand why they have an uneasy relationship with governments. They aspire to be neutral conduits of data and to sit outside or above politics. But increasingly their services not only host the material of violent extremism or child exploitation, but are the routes for the facilitation of crime and terrorism. However much they may dislike it, they have become the command-and-control networks of choice for terrorists and criminals, who find their services as transformational as the rest of us. If they are to meet this challenge, it means coming up with better arrangements for facilitating lawful investigation by security and law enforcement agencies than we have now.

Then, finally, he blames the tech companies for not recognizing that by spying on everyone, GCHQ is just trying to protect the free and open society we all love, and assumes that the public is really on his side:

To those of us who have to tackle the depressing end of human behaviour on the internet, it can seem that some technology companies are in denial about its misuse. I suspect most ordinary users of the internet are ahead of them: they have strong views on the ethics of companies, whether on taxation, child protection or privacy; they do not want the media platforms they use with their friends and families to facilitate murder or child abuse. They know the internet grew out of the values of western democracy, not vice versa. I think those customers would be comfortable with a better, more sustainable relationship between the agencies and the technology companies.

There are lots of things that facilitate murder and child abuse that plenty of people are still fine using. I drive a car. Cars kill lots of people. I use a camera. Cameras are often key to child porn. Phones are frequently used in crimes. Yet, I'm not so ridiculous as to blame any of these tools for the scummy people who use them for bad purposes. And it bothers me that the head of the UK's technology spying effort doesn't seem to understand that distinction. Actually, it doesn't just bother me, it frightens me.

As we celebrate the 25th anniversary of the spectacular creation that is the world wide web, we need a new deal between democratic governments and the technology companies in the area of protecting our citizens. It should be a deal rooted in the democratic values we share. That means addressing some uncomfortable truths. Better to do it now than in the aftermath of greater violence.

Note what Hannigan left out: what's wrong with the existing deal? What's wrong with making a specific case for why you need specific information to a court and then getting a warrant? Why do we need a "new deal" that involves giving a government increasingly broad access to all that data -- especially when the very same intelligence community that has that data has a rather long history of abusing it, violating human rights, stifling free speech and criticism and harassing those who oppose it?

In a companion article, the Financial Times notes that, with US tech companies hardening their networks against the intelligence community, the UK has been locked out from the easy access it used to have, which explains some of Hannigan's exasperation. I'm sure it must suck when you used to be able to sift broadly through a variety of private information without everyone realizing it. And having that treasure trove of private data ripped away must not be much fun. But privacy is, in fact, a democratic ideal, contrary to Hannigan's belief that the public is willing to give it up just to stave off some bad guys thousands of miles away. Besides, as the article notes, when the UK government demands access, where should US companies draw the line:

One senior executive at a US tech group said any agreement to circumvent the current process, which requires law-enforcement groups to seek a court order before a company hands over data, would be “eliminating due process and that could be a dangerous situation”.

“What should we do if the Saudi or Russian government also demanded information be handed over on the spot?” he said.

It seems that the intelligence community and the surveillance state has gotten somewhat fat and lazy in the last few years, with so much access to so much data. Back in the old days, they had other ways to get what they needed without violating everyone else's privacy. It's time they learned how to get back to that sort of system that fits much better with our basic ideals of democracy and freedom than this desire to have access to absolutely everything does.

Filed Under: gchq, iain lobban, privacy, robert hannigan, surveillance, tech companies