The deputy director of the United States' National Security Agency (NSA) during the Edward Snowden leaks has backed the Australian government's push to force tech giants to assist in revealing the content of some encrypted messages, saying the likes of Facebook and Apple could do more to help track terrorists and criminals.

Speaking to The Australian Financial Review ahead of a trip to Australia this week, Chris Inglis, who was the NSA's highest-ranking civilian from 2006 to 2014 says the government's plan to enact law enforcement powers to crack open encryption by the end of the year is an appropriate attempt to strike a balance between protecting privacy and protecting citizens from terrorism.

He says the government's plan will not require the providers of apps such as WhatsApp, Wickr, Telegram Messenger and iMessage to create new so-called back doors into devices and apps, but will simply involve them doing more to open up their systems on request.

"When citizens look to their government they expect them to protect their privacy and also to keep them safe, this is not an either/or proposition. When I hear your Prime Minister and your Attorney-General speaking about this, I don't see them favouring one of these over the other," Inglis says.

"There has been scaremonger comments on these topics, but I haven't heard your government asking for new back doors, they are merely saying that, if there is a capability already there, they would like to use it under the rule of law, which has always been a legitimate government pursuit."

Tech giants such as Facebook and Apple have already asserted they provide as much assistance as they can to law enforcement agencies, both in Australia and globally, and say they are powerless to break the encryption on individual messages.

Prime Minister Malcolm Turnbull raised eyebrows around the world with a comment suggesting the laws of Australia trump the laws of mathematics, which led to Edward Snowden tweeting that such remarks create a "civilizational risk".

Apple chief executive Tim Cook previously wrote an open letter to customers last year after the company refused to build a system to help the FBI unlock the iPhone of a San Bernardino terrorism culprit who jointly killed 14 people.

He said the US government's request to break encryption would require its engineers to weaken the devices for everyone else around the world.

"The same engineers who built strong encryption into the iPhone to protect our users would, ironically, be ordered to weaken those protections and make our users less safe," Cook wrote.

In July, special adviser to the Prime Minister on cyber security Alastair MacGibbon said he couldn't understand why these companies "viscerally rail against helping protect their customers", and Inglis says he believes that the likes of Apple are balancing their commercial concerns in markets in all corners of the globe against the option of being as open as possible with different governments.

"Many of these systems already have what I would describe as an appropriate, well-known back door, whether it's a patching mechanism, or it's a software update mechanism those are back doors," he says.

"Most users have every confidence in the world that those work very appropriately and that only the vendor who services their software is able to replace the software, update the software and change the function of that phone in every way, shape, or form."

Other experts, such as Firstwave Cloud Technology's Simon Ryan have also suggested that it is entirely possible, at least for Facebook, to reveal the contents of private messages.

Inglis is heading to Australia in his role as chair of the strategic advisory board of US-based behaviour analytics cyber security firm Securonix, which is poised to officially open its operations Down Under this week.

His time in office at the NSA ended a year after its former IT contractor Edward Snowden plunged it into crisis by leaking thousands of documents that laid bare the methods and extent of the agency's surveillance programs.

Securonix provides technology, which it says detects malicious behaviour within an organisation or network in real-time, and would theoretically stop the kind of exfiltration of private data accomplished by Snowden.

While saying that he still sits more closely to the black-and-white view that Snowden committed an act of betrayal, Inglis says he now has some empathy with Snowden's purported intention to expose what he believed to be egregious behaviour by the government.

However, he says Snowden's credentials as a principled whistleblower are called into doubt by the fact that he did nothing to raise concerns in less harmful ways prior to leaking information.

"I would feel more sympathetic about him in 2013 if he had exercised one iota of having raised a hand, lodged a concern, kind of thrown a brick through somebody's window with an anonymous note to us, but he did none of those things," Inglis says.

"With allegations like these, you an obligation to actually be factually correct in what you allege is going on, and he was not I think that if you believe in your cause, you should be willing to stand and speak about that in the presence of your peers, and here he is in Moscow, so none of that speaks well of either of his motivation and certainly not of his means."

Inglis was portrayed in the 2016 Oliver Stone movie Snowden, which followed events leading up to the leak, and which he says provided an "egregious misappropriation of the facts" regarding the attitudes at the NSA and of Snowden's importance within it.

In the movie a character in Inglis' role is seen sending Snowden off to head a mission in Hawaii to solve a problem related to China, yet Inglis says the two never met in person, and Snowden was too far removed from the action to be remotely considered for such work.

"I have to imagine that the reason it was portrayed that way was not to make it more interesting, but rather to impress upon the audience that Edward Snowden was somebody that travelled in circles where he would have direct knowledge of the strategies, the means and the conspiracies that are practised by an NSA, and of course he was nowhere near in those places," he says.

"He was an important enough worker that he was hired to do what he did, but he was working at the edge, and many of the things that he saw, he didn't fully understand the context of, and he therefore misdescribed."

Inglis says the sense of shock that permeated the NSA following the leaks had passed by the time he left the agency. He says that he and others within the NSA were comfortable that they were doing the right thing, with noble intentions, and believed they made the scandal worse by mismanaging their external communications before Snowden leaked.

He says the agency should have explained why it had surveillance plans in place and proactively addressed concerns about a lack of controls and restraint.

"If I could go back in time I would address the fact that the government and NSA were not transparent enough the noble purpose and controls were not as well understood as what Snowden was talking about, which was capability, and a capability that you might enjoy never tells the whole story," Inglis says.

"Most of his allegations were taken as revelations and they were not. His allegations were just that. They were facetious and vilified us."

Moving into the present, Inglis says he understands people outside the US viewing its present administration with a sense of worry. However, he believes that the checks and balances in place would not allow an unpredictable president to become a national security risk.

The Trump presidency has been dogged by suggestions that his team has been too close to Moscow since the election campaign, but Inglis says there are enough protections in place that would prevent the President from exceeding his remit.

"If I was still at the NSA, I would have to appreciate the President has a role, and that role within the United States system is that he is not the sole and ultimate authority on how the nation proceeds," he says.

"You have to actually let this play out, because it's still true that the conflict of ideas is one of our best ideas. I'm confident at the end of the day that our system is going to work its way through what looks like some pretty chaotic controversies at a distance, and frankly, most days, close in, feels that way as well.

"There is a genuine battle of ideas taking place as to what is the proper role of government, and the views are extreme. It looks a bit worrisome, both close in and at a distance, but the system has lived through periods where it was equally chaotic before and we worked our way through it. If you believe in the foundations of this particular form of government, as I do, you have to believe that we'll figure it out, that we'll work our way through."

See the original post:
Ex-NSA chief Chris Inglis backs government's encryption push against Apple, Facebook - The Australian Financial Review

NEW DELHI: Indian IT firms value scaling of data encryption but lag in adoption of the technology compared to the global average, says a study commissioned by French security technology firm Thales.

"95 per cent of organisations in India valued scalability for encryption solutions, which was much higher than any other country, global average of 29 per cent," the Global Encryption Trend study said.

However, it found that 82 per cent of organisations in India covered in the study embrace some type of encryption strategy while global average is of 86 per cent

The survey is based on responses from more than 5,000 IT security decision makers across multiple industry sectors in the United States, United Kingdom, Germany, France, Australia, Japan, Brazil, the Russian Federation, Mexico, Saudi Arabia and the United Arab Emirates and includes responses from 548 individuals in India.

"This study is part of a global initiative by Thales to educate leaders from the private and public sectors on the privacy and data protection practices companies can follow today," Thales, Country director India, Emmanuel de Roquefeuil said.

The company operates in strategic electronics and IT space with focus on high-end security. It is setting up manufacturing unit in India in partnership with Reliance Defence for making radar and electronic warfare display system for supply to Rafale Jet.

The study found that Indian firms led globally in adoption of cloud technology with 75 per cent of organisations transferring sensitive or confidential information to the cloud - whether encrypted or not - compared to global average of 53 per cent.

The top drivers for encryption in India are to protect against specific, identified threats and customer information.

"This is in contrast to the global data where compliance is, and historically always has been, the top driver for encryption. In India, compliance ranked third on the list at 55 per cent," the study said.

As per the study, 62 per cent of the respondents in India feel hardware security modules (HSMs) will be important in the next 12 months for encryption or key management strategy which is almost in line with global average of 61 per cent.

"This study is a call to action for organisations in India to strengthen their security position with strong data security and encryption plans in order to secure sensitive data and adhere to risk and compliance best practices and regulations," Thales e-Security, director for sales in South Asia, James Cook said.

Most of the Indian IT firms are of the view that top threat to sensitive data is from mistake of employees followed by hackers and temporary contract workers, the study said.

"Top threat to sensitive data continues to be employee mistakes (55 per cent of respondents), followed by hackers (36 per cent) and temporary or contract workers (31 per cent)," the study said.

Continued here:
Indian IT firms value scaling encryption, lag in adoption: Study - Economic Times

Nominee for director of the FBI Christopher Wray. Photo: Jim Watson/AFP/Getty Images

News reports from likely future FBI director Chris Wrays Senate hearing today focused on the question of the agencys independence from the White House. This is understandable the bureaus relationship to the White House is at the top of everyones mind and Wray performed well: My commitment is to the rule of law, to the Constitution, he told members of the Senate Judiciary Committee. But when it came to the less attention-getting, but no less important, question of encryption, unfortunately, Wray performed somewhat less inspiringly: Theres a balance, obviously, that has to be struck between the importance of encryption which we can all respect when there are so many threats to our systems and the importance of giving law enforcement the tools that they lawfully need to keep us all safe, he said.

The problem is that there isnt really a legal balance to be struck when it comes to encryption. American tech companies already comply with lawful orders for user information that isnt fully encrypted, and shy of building backdoors into their products, there isnt a lot more they can do.

Unfortunately, Im still not sure how this is an issue that can be solved by working together with industry, said Matthew Green, a renowned cryptography professor at Johns Hopkins University, after seeing Wrays comments. Either the U.S. government will pursue a strategy that includes mandated encryption backdoors or it wont. I believe other forms of cooperation, such as metadata sharing, are already available.

Wray is entering a decades-long debate, one where a principal argument hasnt really changed: Should you be allowed to make a device or a method of communication thats so secure, even you have no way of knowing what your users are doing or saying? The FBI, famously, was so stumped when it couldnt access San Bernardino shooter Syed Farooks iPhone last year that it invoked the All Writs Act of 1789, a broadly written law used when the government needs an authorization that Congress hasnt yet legislated or thought of, and demanded Apple write a personalized, fake software update to get past the phones login screen. At the 11th hour, the FBI said it had found and paid for a rare vulnerability in the code for the 5c, the model Farook had, and stood down.

Technologists and cryptographers have long been unanimous that forcing a tech company to build a secret vulnerability into their products, only to be used for emergency situations a backdoor is a terrible idea. If cops can use it, hackers and foreign governments can probably find it and exploit users, for one thing. And if American companies would be forced by law to build backdoors, as floated in an ill-fated draft bill last year by senators sympathetic to the FBIs concerns about terrorists going dark, privacy-minded consumers would simply start using secure messaging apps made in countries that didnt have that law.

At the same time, its hard to tell the law-and-order crowd that if a terrorist cell in the U.S. is using Signal, the FBI has to simply throw up its hands and use whatever other investigative tools are at its disposal. Thats why a number of political figures, among them former Democratic presidential nominee Hillary Clinton and former FBI Director James Comey, have rejected the idea of outright backdoors, but like Wray today, still declared a wistful support for some kind of compromise solution, achievable by the tech industry and federal government really putting their heads together.

But politicians and law-enforcement figures pushing for a compromise ignore the realities of mathematics and the dire need to increase internet security in favor of pushing technologists to nerd harder and come up with some magical way to create strong security tools that only the FBI could break, said Amie Stepanovich, U.S. policy manager at Access Now, a group that advocates for digital civil liberties.

In Wrays defense, maybe he only hoped for an impossible compromise because he hasnt had time to give the issue much thought: He readily admitted he was an outsider who didnt have enough information about encryption in front of him to present a formal plan, a repeated theme in his hearing. For the future, Wray might consider stressing that pushing for mandatory backdoors should be off the table, or that strong encryption should be a fundamental consumer protection in a world where Russian intelligence agencies target American civilians, like the heads of U.S. presidential campaigns. Wray could have said that agents stymied by locked phones would have to rely more on old-school investigative techniques. He could have admitted that while the gray market of buying exploits in emergencies is far from perfect, its worked so far, and there simply isnt a better solution out there.

Unfortunately, no senator probed Wray much further on the issue. What does he think the FBI should do if the agency encounters another Farook iPhone case, but this time cant find a vendor hawking exploits? Apparently, hope that math changes.

Read this article:
The Encryption 'Balance' Trump's FBI Candidate Wants Is Mathematically Impossible - New York Magazine

Walter Haydock works for PreVeil (@EndToEndEncrypt), a Boston-based cybersecurity company.

If the Internal Revenue Service's Data Retrieval Tool had used end-to-end encryption from the start, the federal government may have been able to avoid a privacy breach that ultimately occurred over the past year.

This tool allowed prospective students to transfer their tax return data to the Education Departmentfor use in loan applications. Earlier this spring, the agency disabled it because identity thieves had used the tool to receive the personal financial data of potentially thousands of taxpayers in an effort to file fraudulent returns.

Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

One of the key lessons from this breach is that deploying default end-to-end encryption should be a priority for all enterprises handling sensitive information, especially the government. Following the presidents recent cybersecurity executive order, which urges federal agencies to move to the cloud, properly securing data there is more critical than ever.

Because ofa statutory quirk, the IRS could not transmit taxpayer information directly to the Education Department. Instead, the agency relied on loan seekers to obtain their tax return information themselves through the Data Retrieval Tool, and then include it in their applications.

Unfortunately, the IRS tool had flaws that allowed identity thieves to masquerade as loan applicants. These cyber criminals could use already stolen personal information to download their victims tax data and subsequently file fraudulent returns.

Although hackers took advantage of the lack of proper authentication procedures necessary to access the Data Retrieval Tool, end-to-end encryption still could have saved the day. This technology cryptographically makes data unreadable at the start of its journey and only ever renders that data legible at the devices of authorized recipientsnever at any intermediate point.

Those seeking student loans do not need to see the tax data they forward with their applications; they only need to transmit it from the IRS to the Education Department. As a result, the two organizations should have designed the Data Retrieval Tool to forward taxpayer data in end-to-end encrypted form, in which case the stolen information would have appeared as complete gibberish to the identity thieves who obtained it.

Unfortunately, government officials seem to have only considered this course of action after the major cybersecurity incident that resulted from their initial oversight, at which point they took down the Data Retrieval Tool for several months to add a comparable feature.

Bringing federal technology into the 21st century while keeping it secure will by no means be a simple task. Even though its systems were not to blame for the aforementioned incident, the Education Departmentis an example of the challenges the government faces in this regard.

Despite a chorus of warnings, especially from Congress, the department used more than 180 different data management systems as of 2016, many of which are outdated and insecure. Maintaining nearly 140 million unique Social Security numbers of ordinary Americans, the department has nonetheless ignored many security recommendations from its own inspector general.

Moving federal systems to the cloud, as the presidents recent guidance encourages, will assist in consolidating and protecting such arrays of overlapping systems, but doing so is not without risks. Although convenient, data stored in the public cloud can be an easy target for hackers, if not properly protected.

Fortunately, a new generation of secure, easy-to-use and competitively priced end-to-end encrypted file-sharing applications is now coming to market. These cheap and effective tools can help government organizations secure the data of their citizens more effectively, while still providing easy access to appropriate stakeholders through innovative security features.

As the Data Retrieval Tool incident demonstrates, limiting access to sensitive data through well-designed security measures is critical. Using end-to-end encryption by default is one readily available way to do so, which will more effectively protect American citizens in the cyber domain.

Link:
End-to-End Encryption is Key to Securing Government Databases - Nextgov

According to a 2017 report, 2.5 million terabytes of data are generated every dayand the ways that employees share and store data continues to multiply. As the amount of data continues to explode, and as the number of non-corporate-controlled places to store data expand, companies are faced with a daunting challenge: How do we find and protect sensitive information?

"Today, data can exist simultaneously in multiple locations across an enterprise," said Matt Little, chief product officer at PKWARE. "Because data is crossing traditional boundaries, both on premise and in the cloud, many organizations do not have visibility into where sensitive information is stored, leaving data unprotected and vulnerable to internal and external threats. Smartcrypt Data Discovery allows customers to not only find their sensitive data, but protect that information wherever it's used, shared or stored."

Smartcrypt Data Discovery findssensitive information credit card numbers, Social Security numbers, personal account numbers and customer-specified data and can also encrypt it using Smartcrypt's persistent data-centric encryption. It is the simplest, most integrated way for organizations to identify their sensitive information and strongly protect it against theft or misuse.

"Organizations of all sizes are recognizing that many traditional security tools are no longer enough to protect sensitive data from breaches," said Garrett Bekker, Principal Analyst, Information Security Practice, 451 Research."Encryption is a powerful tool to protect sensitive data, but organizations generally face big challenges both finding sensitive data and also determining what data to encrypt and what not to encrypt. Combining encryption with data discovery is a logical way to help organizations protect their data without the costs and overhead associated with using encryption indiscriminately."

Smartcrypt Data Discovery uses the existing Smartcrypt agent which continuously monitors desktops, laptops, file servers and other storage locations for sensitive information. Each time a file is added or modified, Smartcrypt initiates a scan based on the organization's policies. If the data fits one of the defined patterns, the system can apply remediation via encryption, reporting or other custom actions. The discovery and encryption process is transparent to end users and the organization maintains complete control.

PKWARE's Smartcrypt Data Discovery is now available. For more information, click here.

About PKWAREPKWARE is a trusted leader in global business data protection. For 30 years PKWARE has focused not just on networks and devices, but on the data itself. Building on our compression expertise with the latest encryption technology, PKWARE protects data for over 30,000 enterprise customers and 200 government agencies. Our software-defined solutions provide cost-effective and easy-to-implement protection that is transparent to end users and simple for IT to administer and control.

Media ContactJosh Swarz +1 (646) 428-0650 pkware@allisonpr.com

View original content with multimedia:http://www.prnewswire.com/news-releases/pkware-integrates-intelligent-data-discovery-with-enterprise-encryption-platform-300486220.html

SOURCE PKWARE

http://www.pkzip.com

Read the original post:
PKWARE Integrates Intelligent Data Discovery With Enterprise Encryption Platform - PR Newswire (press release)