Encryption app leaks sensitive info

An encrypted messaging app called Confide is being used in Washington DC by White House staffers to leak embarrassing or sensitive information.

Since US President Donald Trump's inauguration, a steady stream of leaks have been provided by the White House including reports of national security adviser Michael Flynn's unauthorised talks with Russia.

On Thursday, US President Donald Trump vowed to prosecute leakers. We are looking into this very seriously. It's a criminal act, Trump said. He has reportedly ordered an internal investigation to identify how sensitive information about his calls with foreign leaders and national security matters made their way to the press.

Messages sent via the Confide app are automatically deleted, leaving virtually no paper trail.

According to Jon Brod, cofounder and president of Confide, once messages are read, they vanish without a trace. The message is gone forever, it's deleted from our servers, you can't archive, print it, save it, cut and paste it. Again, just like the spoken word, it disappears, Brod said.

The message self-destructs so I can't go back in and try to piece together a number of screenshots into the actual message, and it notifies both the sender and the recipient that a screenshot was attempted, Brod continued.

White House staffers, and possibly other government officials and business executives, worried about being caught leaking information to the media have adopted this app.

They are likely violating the law if they are revealing that information through any means, whether it's through an email or through a disappearing chat app, said Carrie Cordero, a former national security lawyer at the Justice Department.

Confide's privacy features won't totally protect leakers since it still requires them to register their identities.

Sometimes these apps give users a false confidence that they will never be able to be traced, said Cordero. And although the communication in this particular app might disappear, that doesn't mean that the user is necessarily not able to be traced in any way.

Some security researchers are doubtful about Confide's cryptography since the app is not open-source and may use old protocols. Confide's encryption is closed source and proprietary, so no one outside the company knows what's going on within the app. The encryption protocol is based on the PGP standard and the app's network connection security relies on recommended best practices.

One key is always, do you make code publicly available that's been audited where features have been inspected by the security community so that it can arrive at some consensus, says Electronic Frontier Foundation legal fellow Aaron Mackey. My understanding with Confide, at least right now, is that it's not clear whether that's occurred.

Since its inception in 2013, Confide has seen a spike in usage after key security events took place such as the Celebgate scandal, the Sony Pictures hack in 2014, the Russian group leak of thousands of emails belonging to the DNC in 2016 and, of course, the 2016 US presidential election.

Using an encrypted messaging app such as Confide can pose legal concerns. It is the user's responsibility to make sure they abide by the law and use the app strictly for personal communications.

See the original post here:

Confide in me! Encryption app leaks sensitive info from Washington DC - SC Magazine UK

Slide: 1 / of 1. Caption: Confide

In the four tumultuous weeks since President Donald Trumps inauguration, the White House has provided a steady stream of leaks. Some are mostly innocuous, like how Trump spends his solitary hours. Others, including reports of national security adviser Michael Flynns unauthorized talks with Russia, have proven devastating. In response, Trump has launched an investigation, and expressed his displeasure in a tweet: Why are there so many illegal leaks coming out of Washington?

The answer may have to do with uncertainty and unrest inside the administration, as well as the presidents ongoing attacks against the intelligence community. But it doesnt hurt that every White House and Congressional staffer has tools to facilitate secure communication in their pocket or bag. Specifically, multiple reports indicate that Republican operatives and White House staffers are using the end-to-end encrypted messaging app Confide, which touts disappearing messages and anti-screenshot features, to chat privately without a trace.

The ability to communicate without fear of reprisal may have helped illuminate the Trump administrations darkest corners. But that same time, anonymity rings alarms for transparency advocates. The same technology that exposes secrets also enables them, a tension thats not easy to resolve.

Confide launched in 2013 as a secure app for executives looking to trade gossip and talk shop without creating a digital trail. The service uses a proprietary encryption protocol, what the company describes as military-grade end-to-end encryption. Its marquee feature, self-destructing messages, appears on similar services like Snapchat, but Confides appeal lies in its promise of more robust protections.

Its worth noting, though, that unlike other secure messaging apps, like standard-bearer Signal, Confides encryption is closed source and proprietary, meaning no one outside the company knows whats going on under the hood of the app. Company president Jon Brod says that Confide bases its encryption protocol on the widely used PGP standard, and that the apps network connection security relies on recommended best practices like Transport Socket Layer (TLS). Brod did not respond to questions, though, about whether Confide has ever opened its code base to be independently audited by a third party.

One key is always, do you make code publicly available thats been audited where features have been inspected by the security community so that it can arrive at some consensus, says Electronic Frontier Foundation legal fellow Aaron Mackey. My understanding with Confide, at least right now, is that its not clear whether thats occurred.

Confides also not the only option in play; EPA workers have reportedly turned to Signal to discuss how to cope with an antagonistic Trump administration, to the agitation of Republican representatives.

No matter what the method, though, encrypted chat appears to have become a staple among political operativeswhich happens to raise a whole host of legal questions.

Using an app like Confide for personal communications, like keeping in touch with family members or coordinating gym trips with coworkers, is within bounds. It also, according to a recent Washington Post report, has enabled vital leaks to the media.

At this point its still possible that politicos are legitimately using Confide for personal purposes. I know people who use [Confide], but I dont know anyone whos using it who shouldnt be using it, says Scott Tranter, a founder of the political data consultancy Optimus. The people who I know use it because its secure messaging.

Its sometimes not easy, though, to separate personal conversations from those that are work-related. Where those lines blur, legal concerns arise.

If these apps are being used by White House staff, it raises very disturbing questions about compliance with the Presidential Records Act specifically, and more broadly the Federal Records Act, says David Vladeck, a communications and technology law researcher at Georgetown Law School. The whole point of these statutes is to assure that our nations history is neither lost nor manufactured, and the kinds of apps that obliterate the messages are completely incompatible with that and at odds with the law.

Confide puts the onus on its users to walk a legal line. We expect people to use Confide in a way that complies with any regulation that may be relevant to their particular situation, says Brod.

Encryption itself isnt the issue. End-to-end encrypted communication can coexist with the goals of public disclosure laws, so long as someone retains the decryption key. Using strong security for sensitive government communications makes sense and is appropriate if the parties sending and receiving the communications can still archive them.

But disappearing messages are definitionally communications that are difficult, if not impossible, to record. Plus, its hard to assess how people are using a communication service like Confide if theres no record of anything they ever sent. Since Confide is explicitly designed to eliminate a paper trail, its use creates at least the appearance of misconduct, if not the reality, says Allison Stanger, a cybersecurity fellow at the New America Foundation. Those who wanted to lock up Hillary Clinton for the use of a private email server should be very concerned about this practice.

Its a tough act to balance. Encryption-enabled leaks help hold administrations accountable, a clear public good. The challenge is preserving that level of secrecy without creating black holes where public records should be.

Read more here:

Encryption Apps Help White House Staffers Leakand Maybe Break the Law - WIRED

The Signal app uses data encryption to send messages only readable by the designated receiver.

Some members of Congress are demanding an investigation into the Environmental Protection Agency's use of texting and encrypted chat apps like Signal.

Encryption scrambles data and only lets a person with the correct passcode have access. Tech firms and privacy advocates argue that encryption is essential to secure personal information and communications. The government and law enforcement officials counter that encryption hurts their ability to investigate criminal and terrorist activity.

Federal employees with concerns about the impact of President Donald Trump's administration have turned to encrypted messaging apps, new email addresses and other ways to coordinate their defense strategies, according to a report earlier this month from Politico.

That article and others prompted Rep. Darin LaHood, a Republican from Illinois, and Rep. Lamar Smith, a Republican from Texas, to send a letter to EPA Inspector General Arthur A. Elkins, Jr. asking him to "determine whether it's appropriate to launch a full-scale review" of EPA workers' use of encrypted apps. Smith serves as chairman of the Committee on Science, Space and Technology, while LaHood is vice chairman of the subcommittee on oversight on the Science, Space and Tech committee.

"Over the past few years, we have seen several examples of federal officials' circumventing Federal Records Act requirements and transparency generally," they wrote. "In this instance, the Committee is concerned that these encrypted and off-the-record communication practices, if true, run afoul of federal record-keeping requirements, leaving information that could be responsive to future Freedom of Information Act (FOIA) and congressional requests unattainable."

The letter requested a response from the Inspector General by February 28. The letter doesn't mean he is required to conduct a full investigation.

"The EPA OIG leadership is carefully reviewing yesterday's request from House Science Chairman Lamar Smith and Subcommittee Chairman Darin LaHood that the OIG review EPA employees' use of encrypted messaging applications to conduct official business," said the press office for the EPA Office of the Inspector General.

The EPA didn't immediately respond to CNET's request for comment.

Encryption gained a lot of scrutiny a year ago during Apple's public battle with the FBI over a request to help unlock an encrypted iPhone used in a terrorist attack. And after Democratic Party emails were hacked, Hillary Clinton and others working on her presidential campaign adopted Signal.

The letter on Wednesday cited a recent review from the EPA inspector general that found between July 1, 2014 and June 30, 2015, only 86 of the 3.1 million text messages sent or received on government-issued devices were preserved and archived as a federal record.

"Not only does this demonstrate the vast issues presented with using text messages to conduct official business, but raises additional concerns about using encrypted messaging applications to conduct official business, which make it virtually impossible for the EPA to preserve and retain the records created in this manner to abide by federal record-keeping requirements," the letter said.

Update at 3:20 p.m. PT: Adds comment from EPA Office of the Inspector General.

CNET Magazine: Check out a sample of the stories in CNET's newsstand edition.

Life, disrupted: In Europe, millions of refugees are still searching for a safe place to settle. Tech should be part of the solution. But is it?

Follow this link:

GOP demands inquiry into EPA use of encrypted messaging apps - CNET