Cloud Hosting

Government agencies want their own backdoor into communications.

More details of how the UK's new surveillance law will operate have been revealed, in details about the use of encryption.

Under draft regulations to support the new Investigatory Powers Act, the government will be able to issue 'technical capability notices' to companies with more than 10,000 UK users to make it easier for police, spy agencies and other government bodies to access their customers' communications.

In particular, the regulations require companies to provide and maintain "the capability to disclose, where practicable, the content of communications or secondary data in an intelligible form and to remove electronic protection applied by or on behalf of the telecommunications operator to the communications or data, or to permit the person to whom the warrant is addressed to remove such electronic protection."

Those powers means it will be extremely difficult for tech companies and ISPs in the UK to offer their own end-to-end encryption services to their customers. That's because end-to-end encryption only allows the sender and the recipient of the communications to read the message: it is hidden from the company that sends it, as well as from other prying eyes.

The leaked paper was revealed by the Open Rights Group, and the group's executive director Jim Killock said the powers could be used to force companies to limit encryption, and that when these powers are used, it would be done in secret.

"There needs to be transparency about how such measures are judged to be reasonable, the risks that are imposed on users and companies, and how companies can challenge government demands that are unreasonable", he said.

"Businesses and the public need to know they aren't being put at risk. Sometimes, surveillance capabilities may be justified and safe: but at other times, they might put many more people - who are not suspected of any crime - at risk."

Police and intelligence agencies have long worried about losing the ability to intercept the communications of criminals and terrorists, who are able to plot in secret using encrypted messaging apps. It's a legitimate concern, but not one that is likely to be addressed by this legislation.

Criminals are simply going to switch to services based in other countries, or find even more obscure ways to communicate. And it may also make us less secure. The events of the last year have shown that criminals and state-sponsored hackers are always looking for ways to access and steal communications. Forcing the UK to use weaker forms of secure messaging will make the job of foreign spies and crooks much easier.

And those ISPs and tech companies that are obliged to hold our unencrypted messages? Effectively they will have a big red target painted on them forever more. If hackers and intelligence agencies know that these companies have the means to decode any messages on their network, then cracking their security becomes a priority.

Still, it's also important to consider the international perspective here: most secure messaging apps are not based in the UK, but in the US and the rest of the world, where the UK's law will have little impact. For these companies the UK is just one market among many, and they won't change their tech strategy just for one goverment, especially if their own goverment imposes no such demands.

So it's highly unlikely that the messaging apps we use, in our millions, every day, will be stripped of their end-to-end encryption anytime soon. UK phone companies and ISPs offering such services will simply shrug, and point out they did not add the encryption in the first place and therefore have no way of removing it. That's a big hole in the legislation.

However, there is another international dimension to consider. It could be that some countries will take the UK's law as a blueprint for their own surveillance laws (and the row over encryption is just one element of the legislation which also includes a legal framework for police and intelligence agencies to hack smartphones, PCs, tablets or computer infrastructure and requires ISPs to retain details of the internet browsing history of the entire country for 12 months.)

If enough countries decide they want similar legislation in place (the UK laws go further than similar laws in other democratic countries) and do not want companies in their jurisdiction offering end-to-end encryption then it may become harder for many people to use encryption as they do today.

That may make it easier to police and intelligence agencies to track criminals but at a cost to the security of the majority (and it would still be all but impossible to stop the use of end-to-end encryption completely).

But already, the idea of some kind of encryption legislation seems to be gaining traction in the US again; could we be heading back towards the sort of 'crypto wars' fought in the 1990s?

The UK's lone stand against encryption is unlikely to succeed, but it may point to bigger battles ahead.

See original here:
Are we heading for a new encryption war? - ZDNet

May 4, 2017 by Ryan Hagemann

A little over three months into 2017 and encryption is once again coming into focus.

Yesterday, in testimony before the Senate Judiciary Committee, FBI director James Comey was asked about the ongoing Going Dark problem. He noted that thus far, in just the first three months of this year, almost half of all pending cases at the FBI involved devices or systems that cannot be opened with any technique available to the federal law enforcement agency. He went on to note a collision between privacy and security, but stopped short of supporting a legislative mandate, arguing that while the encryption issue may require a legislative solution, it was premature for him to say anything definite. Sen. Dianne Feinstein (D-CA), however, was certain of her position, and noted her intention to reintroduce last years Compliance with Court Orders Act, co-sponsored with Sen. Richard Burr (R-CA) (around the 3:06:00 mark). For a more detailed analysis on the ins-and-outs of that bills many flaws, see here, here, and here.

The Burr-Feinstein legislation will undoubtedly set the tone for one extreme of the forthcoming encryption debate. Id wager that on the other end of the spectrum well hear a lot of the same talking points we heard during the height of the Apple vs FBI fight from this time last year. The same folks armed with the same messages are going to be entrenching themselves on the same battle-wearied policy hills, lobbing the same talking points at one another. Once more, the perfect is set to be the enemy of the good.

Maybe this time, however, we can aim to lift the voices of the moderate middle on this issuethose stakeholders that have all-too-unfortunately been drowned out by the more sensationalized messages from the polar extremes that often dominate the headlines. Instead of business-as-usual in the encryption debate, moderates on both sides of the debate need to signal support for the only other legislative proposal that has the political viability and compromise-oriented policy prescription necessary to defuse the Burr-Feinstein bill: the McCaul-Warner Digital Security Commission.

Ive written about the Commission a lot over the past year and a half, but it remains as clear today as it did then that this approach is the only viable path forward towards achieving compromise on the encryption debate. Talks between the FBI and the technology industry, according to Comey, have been good, but he remains uncertain as to whereif anywhere those conversations will lead. Those types of behind-the-scene stalemates are likely the reason a lot of tech companies, including Facebook and Apple, have signaled support for McCaul-Warner. If Burr-Feinstein is poised to move, its more imperative than ever that both encryption supporters and centrist politicians start putting their weight behind the only bill that respects the complexity of the issues involved in this debate.

The ebb and flow of policy priorities can sometimes feel cyclical, but few issues are as perennial as encryption (though net neutrality may give it a run for its money). As we prepare for yet another ride on this perpetual motion policy merry-go-round, its worth remembering that in between the polar extremes lies a significant moderate majority. In the event a political opportunity or necessity arises, the McCaul-Warner Commission is likely going to appeal more to those policymakers than either the do nothing approach or Burr-Feinstein. Despite all the loud voices in the encryption debate, it may be that silent moderate majority that ends up as the real heroes in this debate.

Go here to see the original:
Encryption is Back in the Saddle Again - Niskanen Center (press release) (blog)

Today in Indonesia, media leaders gathered at UNESCO's World Press Freedom Day event issued the "Jakarta Declaration" calling on governments of the world to recognize the importance of a free and independent media in creating "peaceful, just and inclusive societies". The declaration calls on governments to take steps to support the freedom of the press, and, in the midst of the many actions was this statement:

34. Recognise the legitimacy of the use of encryption and anonymisation technologies;

As a long-time advocate for the widespread usage of encryption to protect our personal communication, I was extremely pleased to see this statement included in the declaration.

My colleague Constance Bommelaer wrote in detail yesterday about WHY encryption is so critical for journalists:

The future of the free press is at risk: encryption is part of the solution

She ends the piece with this call to action:

Governments have a role too. We invite them to adopt the SecureTheInternet principles and to support strong encryption, not only to ensure the safety of journalists, but also as a technology that already allows us to do our banking, conduct local and global business, run our power grids, operate communications networks, and do almost everything else.

As we celebrate World Press Freedom Day, we must remember that journalists and their sources are taking enormous risks right now in making sure crucial stories get told.

In today's environment, where trust in online information is at an all-time low, we need free, safe and independent journalists more than ever. We all have a role to play, and encryption is one step to take us there.

We all DO have a role. And encryption is part of how we get there.

I encourage you all to share this news about the Jakarta Declaration; to share the Jakarta Declaration document itself; to learn more about encryption; and to help people understand why encryption is critical for securing our digital economy!

By Dan York, Author and Speaker on Internet technologies - and on staff of Internet Society. Dan is employed as a Senior Content Strategist with the Internet Society but opinions posted on CircleID are entirely his own. Visit the blog maintained by Dan York here.

Related topics: Policy & Regulation, Privacy, Security

Read more:
Jakarta Declaration Calls on Governments to Recognize Legitimacy of Encryption - CircleID