Supporters of the terrorist group Islamic State (Isis) are shunning sophisticated security and encryption software, including the Tails operating system and the Tor network, which could be used to cover their tracks when viewingterrorist propaganda online, communications between jihadi sympathisers have revealed.

The 10 most important things you need to know about GDPR, and a jargon-buster explanation for some of the key terminology.

By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

The disclosures come as the UK government prepares to introduce new restrictions on encryption following the terrorist attacks that killed more than 20 people, including children, at a concert in Manchester, and killed eight andinjured 47 at London Bridge.

Isis has claimed responsibility for the Manchester and London attacks and has also been linked to atrocities in Paris, Germany and Brussels.

Confidential messages show that Isis supporters had little interest in encryption techniques to hide their web browsing activities, or to createa secureversion of propaganda websites that would be difficult for law enforcement to censor or take down.

The messages between supporters recovered by police and the FBI investigating an internet terrorist reveal that Isis supporters preferred method of communication is mobile phone apps Telegram Threema, ChatSecure and Signal, which are designed for people with little or no technical knowledge.

Internet terrorist Samata Ullah communicated with Isis supporters on a Telegram discussion group known as the Khayr group. Police also retrieved a guide to ChatSecure, another mobile phone chat app, from Ullahs computer.

Ullah, who was jailed for eight years in May 2017 after posting encryption training videos on an Islamist blogsite, sent messages to an unidentified Isis supporter raising concerns that the terror groups supporters were not using more secure communications tools.

I dont know Akhi [brother], he wrote. It seems they have some bad info. They refuse to use Wikr [a mobile phone messaging system] and tails. They say threema is the best, then signal, and in extreme case chat secure [sic].

Ullahs Isis contact replied: And they say telegram with virtual sim or open vpn is enough protection.

Another message reads: Dawla [Isis] security groups seem to be very stubborn and not very flexible.

It was only when one of Ullahscontacts inKenya was arrested on 29 April 2016 that attempts were made to persuade fellow Isis supporters to adopt stronger forms of encryption.

The Kenyan said in a letter smuggled out of prison: Tell all KN [Khalifa News] and CCA [Cyber Caliphate Army] teams to be very careful online. It is very much advisable that phones be avoided & instead use PCs with TOR and TAILS.

Many Isis supporters, who often refer to themselves as fanboys, have little technical knowledge and it is difficult to convince them to use encryption software, one counter-terrorism organisation told Computer Weekly.

They have experimented a couple of times with ZeroNet and Onion [Tor] sites on occasions, but those sites are usually very short-lived, a spokesman said, speaking on condition of anonymity. While there are some tech savvy supporters, the majority of their fan base is not very tech savvy and trying to get a newbie to not only understand ZeroNet and Tor but to actually use them consistently is a challenge.

Isiss policy is to saturate the internet with ideas and jihadi content, through social media platforms such as Twitter, according to a report by counter-terrorism think-tank Quilliam.

The terror group distributes daily videos and photographs, which are circulated as widely as possible through self-appointed distributors, often with no official connection to the organisation.

Islamic State has revolutionised jihadist messaging by jettisoning operational security in the pursuit of dynamism, Quilliam reports in a study, The Virtual Caliphate: Understanding Islamic States Propaganda Strategy.

Ullah proposed using ZeroNet which uses BitTorrent peer-to-peer networking and integrates with the Tor secure internet network to create a secure version of a pro-Islamic blogsite, Ansar al Khilafah (Supporters of the Caliphate).

The WordPress propaganda blogsite had attracted interest from the UKs media arm of Isis, according to messages recovered by investigators.

The head of English Islamic State media wants to have the right to proofread all content before it is published on the wordpress in future, one Isis supporter told Ullah. If you would agree to it, they would promote the wordpress.

Ullah replied: Sure. thats good.

But in a series of exchanges, it becomes clear that Isis had no interest in using ZeroNet to create a version of the blog that would be difficult for law enforcement to censor or take down.

An Isis supporter told Ullah: First thing is, the brother almost completely dismissed the idea of zero net. So you will either have to give up the idea or try and convince them.

David Wells, a former GCHQ intelligence officer, told Computer Weekly that mobile phone apps offered a more practical alternative to ZeroNet, Tails and Tor for Isis supporters that may not have technical expertise.

More secure technologies are rarely easy to use, and pragmatically any terrorist group would rather their networks were using something pretty secure than not communicating [at all] when needed or doing something stupid like [sending an] SMS, he said.

A forensic report revealed that Ullahs ZeroNet version of the Answar al Khilafah blog did not work in practice.

ZeroNet would have been cumbersome to use for Isis supporters who were used to exchanging news on social media. It required each user to download the blogs contents, including the Isis magazine Dabiq, onto their own computer, putting them at risk of possession of terrorist materials.

Correspondence recovered from Ullahs computer equipment revealed that he had struggled to find a way to update the ZeroNet version of the site without writing code for each update, and to find ways of displaying videos and other feature-rich content.

Isis favours the mobile app Telegram as a platform for sharing propaganda and for group discussions because it has the ability to create public channels that unlimited numbers of people can view, according to the counter-terrorism specialist.

Isis members begin by creating a private distribution channel on Telegram which is restricted to a few people. These members are responsible forcopying messages from the private channels to publicly advertised open channels, where teams of people then share them through disposable Twitter and social media accounts.

The public channels usually have multiple backups to keep the data flowing if one of them gets suspended by Telegram administrators, said the specialist. Since the private channels have no links to join, they are considered private by Telegram and therefore wont be shut down.

Telegram is said to take down an average of 100 to 200 public Isis channels a day, but Isis creates multiple back-ups of each channel to keep data flowing.

However, the messaging service does not take down private discussion groups between Isis supporters because they are not publicly accessible, said the counter-terrorism specialist.

Encrypted communications is pretty much all they [Isis] do. Id say if theyre not using a walkie-talkie or a cell phone, theyre on one of the encrypted [mobile] apps.

If Isis had taken up ZeroNet, it may have drawn the intelligence services attention to its activities, Wells told Computer Weekly.

If a terrorist group chooses a bespoke or unusual communications provider or service, then this has huge challenges for the intelligence services but it also allows them to focus their efforts, he said.

Experimenting with unproven systems is likely be a low priority for Isis commanders in Syria, who have to deal with the day-to-day realities of civil war with the Assad regime and US drone strikes, said Ross Anderson, professor of computer security at Cambridge University.

If I was running Daeshs technology and some foot soldier says why dont we use ZeroNet, I would say get lost, I have far more interesting and important things to do, said Anderson. Why should I spend weeks investigating this stuff and seeing if it works?

Isis may be avoiding Tor and Tails for similar reasons. The US National Security Agency (NSA) and the UKs GCHQ could narrow down the search for Isis supporters if the terror group started using specialist applications such as Tails and Tor.

Anderson said: They could just harvest all the Tails users in the observable universe and de-dupe them against lists of known users, look for all the new ones and go searching for those.

Isis has used a variety of techniques to avoid detection. During the attack on the Bataclan theatre in Paris in November 2015, terrorist teams used multiple pre-paid burner phones, which they instantly discarded.

Investigators found a crates worth of disposable phones, an investigation by the New York Times has revealed. They used only new phones that they would then discard, including several activated minutes before the attacks, or phones seized from their victims, it said.

Although investigators concluded that the attackers were likely to have used encryption software, no evidence of it was found.

Read more:
Islamic State supporters shun Tails and Tor encryption for Telegram - ComputerWeekly.com

TechNet wants Congress to grill President Donald Trump's new FBI director nominee on issues like privacy and encryption.

President Trump signaled Wednesdaythat he plans to nominate Christopher Wray, a partner at international law firm King & Spalding, as new FBI director.

That announcement came only a day before his fired FBI director, James Comey, is scheduled to testify before the Senate Intelligence Committee, which some Democrats were seeing as an attempt to distract attention from the run-up to Comey's testimony.

Reacting to the news, TechNet, representing tech CEOs and top execs, signaled because of the increasing interaction of the FBI and their industry, Congress needed to get his input on those issues.

Comey and the tech industry crossed paths, and to some degree swords, over the issue of government access to encrypted information, notably in the case of an Apple phone the FBI wanted to access in its investigation of the San Bernardino shooting.

With the nomination of Christopher Wray as Director of the FBI, the responsibility now falls on the United States Senate to ensure the nominee will do everything in his power to protect the American people and uphold the rule of law, said TechNet president Linda Moore. Because of the FBI's increasing engagement with the technology industry, this confirmation process must explore Mr. Wrays views on digital privacy rights, encryption technologies, and needed reforms to the Electronic Communications Privacy Act that account for modern advances in cloud computing"

TechNet executive council members include Microsoft President Brad Smith and Apple general Counsel Bruce Sewell.

Here is the original post:
TechNet to Hill: Query FBI Nominee on Encryption - Broadcasting & Cable

In the early 1990s, the USs National Security Agency developed the so-dubbed Clipper Chip. This was intended as a backdoor bypassing encryption to allow the United States government to intercept messages.

The concept intended to use an outlet called key escrow, where specialist government encryption chips unique to each device could intercept data as and when the government requested it. Very quickly, however, the concept ran aground.

In a simple explanation, the project was defunct within a few years of the US government trumpeting its development and despite both the George H.W. Bush and Bill Clinton administrations touting its potential. Noted computer security researcher Matt Blaze discovered a serious flaw in the chips security features, while many US citizens raised concerns about privacy and the chips vulnerability eventually lead to the concept being shelved altogether.

Twenty-something years may have seen technologys advances become ever-more sophisticated and several political shifts occur in the interim, but a lot of the arguments in the debate over encryption remain the same. It has also played out in debates in the West on whether or not the more open Internet can be reconciled with security, and whether or not encryption can ever be breached just for one individuals communications.

Last year, the debate on encryption was a big story in the United States. Apple and the FBI were involved in a long-running argument in data on an iPhone 5C recovered from the site of a mass shooting in California at the end of 2015.

That case eventually went away after months of debate, with the Washington Post alleging that the FBI ultimately recruited some professional hackers to break into the phone on their behalf. But it lead to an interesting debate along the way on the ubiquity of encryption, and the impracticality of whether or not it simply can be breached for one phone.

In the last few decades, the incorporation of encryption in communication can be seen everywhere online. Internet communications all use it on some level, and strong encryption allows things we take for granted, like online shopping, banking, e-mail, accessing health records or credit scorers, and the majority of all messaging apps, with some of the big examples being WhatsApp, Telegram and Facebook Messenger.

Apples argument in the case last year, which is backed by the majority of technology companies and people in the computing industry, is that it is not technically possible to breach one device using its operating system without creating a vulnerability that affects every phone using a set Apple operating system. It is not inconceivable that if such a vulnerability was created, it may well end up in the hands of hackers, and furthermore, that after being asked to just use it once, there would be repeated requests for more use.

The encryption debate has had a curious recent demonstration when a coded hack of the older Windows XP by the NSA ended up in the hands of hackers, who duly ended up unleashing it worldwide on unprotected XP systems used by such diverse people as Britains NHS, the German rail network, Spanish phone giant Telefonica, FedEx, the Russian Interior Ministry, and several locations in Asia.

It may well be that the majority of computers turned out to be more secure than billed in the initial hack, and that Microsofts decision to stop supporting XP in 2014/15 did not help, but its highly unlikely even risking incidents like this happening with their newer technology would be a sell for technology companies to their users or shareholders.

Nevertheless, the encryption argument is still being made. Its presence has been heardahead of this weeks UK election, which is coming in the wake of repeated terrorist atrocities in Europe, including Saturdays awful events in London Bridge and adjacent Borough Market.

Arguments over encryption have long been bought up by the Conservative Party in arguing that strong encryption enables terrorists to hide their secrets, but the arguments have been more focused of late. In this year, they were bought up by Home Secretary Amber Rudd in March in the wake of the Westminster Bridge attacks, and calls to lower encryption surfaced again after Manchester & London Bridge.

The problem with the encryption debate as far as the Tory Party argues it is the question of motivation. Namely, how much of what is motivating them to make the argument over ending encryption is to keep British citizens safe from terror, and how much of their motivation is because they wanted to weaken encryption anyway.

In their manifesto, which was released before the two most recent attacks, the Conservatives pledged to toughen up internet regulation in such a way that technology journalists and experts compared their proposals to the so-dubbed Great Firewall of China in effect, the method where China seals its internet users in a self-contained corner of cyberspace.

The talk directed towards the likes of Facebook was either comply or be banned, which wouldnt be a great advert for the UKs attempts to position itself at the forefront of technical innovation, and given the ready availability of proxy or VPN networks, may not succeed anyway. In all truth, what would also happen for the counter-terror squad is that they would have to sift through thousands and thousands of messages to find the ones theyre looking for, and those looking to keep their messages encrypted will most likely find new apps to use anyway when the ones they were using have backdoors added.

In the governments defence, the argument on encryption is not a black and white issue, and technology companies can do more to help the fight against the spread of extremist ideology online. It is also true the likes of Facebook and Google do hold severe unchecked power over the world power that has grown massively in the last 10-20 years, and which seems to continue without stopping.

But the idea that encryption is to be the fall guy when everyday consumers rely on these tools to keep their personal data safe and to use the internet in confidence, and that the internet can be replaced by a state-regulated version, is not really a strategy thats ultimately going to work.

It is true the counter-terror plans need new options to reduce and eventually end the threat posed by groups like ISIS. But broadly speaking, weakening encryption is an easy idea to pitch, but too hard a one to really make work for the goals intended for it.

Read more from Charles Crook

Read this article:
OP-ED: Diluting encryption is more trouble than its worth - CitiBlog (blog)

TechCrunch

We want to limit use of e2e encryption, confirms UK minister TechCrunch The UK government has once again amped up its attacks on tech platforms' use of end-to-end encryption, and called for International co-operation to regulate the Internet so that it cannot be used as a safe space for extremists to communicate and ... Theresa May's repeated calls to ban encryption still won't workNew Scientist Government again takes aim at encryption after terrorists shake LondonSC Magazine UK Theresa May wants social media companies to create controversial 'backdoors' for policeThe Daily Dot Forbes -http://www.channelweb.co.uk -CNBC all 395 news articles »

See the rest here:
We want to limit use of e2e encryption, confirms UK minister - TechCrunch