BBC News

Message encryption a problem - Rudd BBC News The major technology companies must step up their fight against extremism or face new laws, the home secretary has told the BBC. Amber Rudd said technology companies were not doing enough to beat the enemy on the internet. Encryption tools used by ... 'Real People' Don't Need Encrypted Messaging Services, Claims UK Home SecretaryMac Rumors You're wrong, Amber Rudd encryption is for 'real people'New Scientist UK home secretary Amber Rudd says 'real people' don't need end-to-end encryptionBusiness Insider Telegraph.co.uk -Wired.co.uk -BBC -Telegraph.co.uk all 74 news articles »

Read the rest here:
Message encryption a problem - Rudd - BBC News

Awful terror attacks this year have confirmed again how terrorists use internet platforms to spread their vile ideology, and to inspire and to plan their acts of violence.

Nearly every plot we uncover has a digital element to it. Go online and you will find your own do-it-yourself jihad at the click of a mouse. The tentacles of Daesh (Isil) recruiters in Syria reach back to the laptops in the bedrooms of boys and increasingly girls in our towns and cities up and down the country. The purveyors of far-Right extremism pump out their brand of hate across the globe, without ever leaving home.

The scale of what is happening cannot be downplayed. Before he mowed down the innocents on Westminster Bridge and stabbed Pc Keith Palmer, Khalid Masood is thought to have watched extremist videos. Daesh claim to have created 11,000 new social media accounts in May alone. Our analysis shows that three-quarters...

Originally posted here:
We don't want to ban encryption, but our inability to see what terrorists are plotting undermines our security - Telegraph.co.uk

Updated August 01, 2017 07:34:44

The Federal Government's bid to force tech companies to reveal terrorists' secret conversations could be unachievable, according to the former deputy director of the US National Security Agency (NSA).

Chris Inglis had a 28-year career with the NSA and now advises private companies on how to detect Edward Snowden-style leakers within their ranks.

He told the ABC the Turnbull Government's bid to access encrypted messages sent by terrorists and other criminals is to be admired, but the technology may prove problematic.

"I don't know how feasible it is to achieve the kind of access the Government might want to have under the rule of law, the technology is tough to get exactly right," Mr Inglis told the ABC.

"But the Government is honour-bound to try to pursue both the defence of individual rights and collective security."

Encrypted messages affect close to 90 per cent of ASIO's priority cases and the laws would be modelled on Britain's Investigative Powers Act, which obliges companies to cooperate.

Technology experts, like adjust professor at the Centre for Internet Safety Professor Nigel Phair, have questioned how these laws would really work.

"From a technical perspective we are looking at very high-end computing power that makes it really, really difficult to decrypt a message on the fly, it's just not a simple process," he said.

Facebook has already indicated it will resist the Government's laws, saying weakening encryption for intelligence agencies would mean weakening it for everyone.

"Because of the way end-to-end encryption works, we can't read the contents of individual encrypted messages," a spokesman said.

But Mr Inglis said technology companies would not need to create a so-called backdoor to messages, but rather allow intelligence agencies to exploit vulnerabilities.

The NSA was criticised in May after it was revealed it knew about a vulnerability in Microsoft's system, but exploited it rather than reporting it to the company.

"Here's the dirty little secret: most of these devices already have what might be technically described as a backdoor their update mechanisms, their patch mechanisms," he said.

"My read on what you are trying to do is to put that issue on the table and say, 'we are not going to create backdoors, but we are going to try and use the capabilities that already exist'."

Mr Inglis said the Australian Government was pushing for legal powers the US Government had not called for.

"We have not had as rich a debate as what I sense is going on in Australia," he said.

"The Government by and large has not stepped in and directed that we are either going to seek a solution, we are still trying to find a voluntary way forward."

When Prime Minister Malcolm Turnbull announced the legislation, he noted strong libertarian tendencies of US-based technology companies.

Mr Inglis said Australia was "in the middle of the pack" when it came to cyber security planning.

"You are currently working through how to balance individual privacy the defence of liberty as well as we would say in the states and the pursuit of collective security," he said.

"No-one is exempt from the threats that are traversing across the cyber space at this moment in time."

Topics: science-and-technology, defence-and-national-security, security-intelligence, information-and-communication, turnbull-malcolm, government-and-politics, australia, united-states

First posted August 01, 2017 04:44:23

Read more:
Ex-NSA boss questions encrypted message access laws proposed by Malcolm Turnbull - ABC Online

The emergence of multinational, mass-scale, internet-based social networks at the start of the 21st Century has changed the rules of communication like no other invention since the birth of broadcast radio 100 years previously.

Never before has it been possible for anyone to disseminate information, talk and share on such a mass scale, across the barriers of language and political borders. It's marvellous on so many levels.

But there's a dark side. Add easy-to-use, easy-to-access, high-strength encryption into the equation, as has indeed happened over the last few years, and we have a recipe for disaster. Terrorists and law-breakers are empowered like no previous era - and it may feel like there's no means to stop them without major incursions to civil liberties.

It's very clear that terrorist groups and other criminals are using encryption to organise their activities without fear of being detected, because strong encryption has become so easy.

Encryption proliferation, through popular messaging services - available for free, to anyone - makes it impossible for our security services to exercise their investigatory powers in the digital world in the same way they can in the physical domain.

In the physical domain, we expect privacy, of course. We expect to be able to come into our houses and close the door behind us, and no-one is allowed to come in and bother us. Quite right, too.

Unless we've broken the law and it demands we either be arrested or our property investigated.

Then, those privacy rights are clearly less important than the rule of law.

At that point, as members of a democratic society, we're bound to agree that - having obtained a judicial warrant through the laws we consent to as members of this society - security and law enforcement services ought to be able to bash through people's doors and conduct a thorough search.

But those actions are no longer available to our peacekeepers in the digital realm. The doors they have a legal warrant to breach won't break down. The wire-tap that was obtained through the courts yields only gibberish.

This cannot stand. We can't live safely in a society in which our security forces work blind and deaf.

This weakness for security and privacy are born out of design. The outer layers of the Internet, where social networks and messaging apps exist, have moved faster than its lowest levels.

The technological foundations of the Internet, invented in 1969 to enhance communications between a limited number of academic, corporate and defence systems, as DARPANET have barely moved on.

There was no thought around maintaining personal privacy on these systems back then, nor was there any thought given to the widespread use of sophisticated encryption systems.

Much the same thing is true of our legislature which, in the UK, relies on a complex system of precedents and legal acts, dating back centuries. Many current lawmakers continue to have a weak grasp of technology, and are prone to making over-generalisations that are neither practical, nor ultimately in their nation's best interest.

In short, we need to change the Internet, and our social networks.

We need to retrofit our wonderful, but dated, 1969 communications network with the powers it needs to continue to provide the amazing benefits it has done to date, but with safety and privacy embedded.

We need a blanket policy that will treat everyone the same, and give everyone their rightly deserved privacy.

A mechanism for privacy should be provided at the application layer of the Internet and this involves several steps, and some caveats.

To join future networks, identities ought to be verified. This is a complex area, and the verification credentials required of a 10-year-old girl might not be the same ones required of a 30-year-old man. But the broad proposition is that everyone should have a verifiable identity on the Internet that remains the same throughout one's life, much like your passport.

That, in itself, poses questions about privacy. If I were a young, closeted gay man, for example, then I may be looking for information and connections on the Internet that means a verified identity could threaten my privacy, and have further ramifications for my private life. That needs to be protected against.

Or what if I am now a 40-year-old businesswoman, who perhaps made some regrettable choices in my youth that are shown online? Again, people deserve that degree of privacy, just as they would normally find it in the physical world.

So, everything to be encrypted by law. Everything. Nobody, and no commercial organisation, will be allowed to read or identify your messages, browsing history or any other content you have produced on the Internet through any kind of scanning without your explicit consent.

The proviso is that when your actions and your content are encrypted, very securely, then the keys to that encryption action are retained by the service provider.

If the law enforcement or national security authorities require access to those keys, then the regulated service provider will yield them, for the specific actions for which they have a warrant. Only people with something to hide should have anything to fear - again, only warranted authorities would be allowed access.

This, I believe, is the only solution. We need privacy. We need security. We cannot continue as a free, democratic society without a balance between those two things. At Scentrics, we've put years of research into the problem, and we believe that legitimised key escrow, through agencies regulated by government, as telcos and ISPs already are, is the only solution.

There's no doubt that a transition to such a state will be resisted by some, and from well-meaning intentions. People, by-and-large, don't want to change. There's a knee-jerk lobby ready to resist any change to the status quo perceived as any infringement to existing rights. And not least, be sure that such a change would require a considerable body of legislation, communication and reassurance. It will be a long, hard road.

But consider the alternative. Across most of the Internet, private networks are harvesting everything you do, say and post. And make no mistake that state authorities are not equally interested in probing your digital persona on a mass scale. You have no privacy whatsoever in the current environment. Encryption will change the rules for that engagement - in the favour of private citizens.

The encryption tools we have now are empowering terrorists, who currently face no checks to their organisation, recruitment, and operational efforts. That cannot be allowed. Whereas server-centric encryption against verified identities will make it very hard for them to continue.

What's it to be? The status quo we have at present is entirely untenable. And the terrorists will win if we drag our feet. As for the future we are proposing? It requires compromises, but making rational compromises which balance safety and civil liberties is the very foundation of rational society.

Paran Chandrasekaran, CEO, Scentrics Image Credit: Sergey Nivens / Shutterstock

Continued here:
Encryption and terror: how can government get the balance right? - ITProPortal

Ixia's Active SSL Sheds Light On Encrypted Traffic By employing a network packet broker, tool can handle decryption/encryption without negatively impacting performance.

By employing a network packet broker, tool can handle decryption/encryption without negatively impacting performance.

Instead of turning a blind eye (literally) to the traffic or overburdening critical tools, Ixia's Active SSL feature lets a network packet broker handle the decrypt/encrypt process without negatively impacting performance.

The job of a network manager is really hard and continues to get harder. Complexity has increased, new devices are connected at an alarming rate, and shadow IT has run amok in most companies. However, no trend has made the network manager's life more challenging than the rise of encrypted traffic.

Encryption is the ultimate Catch-22. At first it seems like a great idea in that SSL hides traffic from the bad guys. But then you quickly realize it enables those same hackers to hide threats from the monitoring and security tools that network managers rely on to manage and protect the network.

One solution is to have the tools decrypt, do whatever they're supposed to do, and then re-encrypt the traffic. But the SSL decryption/encryption process is processor-intensive and can bring the tools to their knees, so many network and security professionals let the encrypted traffic go by and hope and pray it isn't malicious. Last year, a ZK Research study found that almost 50% of organizations admit to turning security features off in favor of performance -- and encrypted traffic is a big contributor to that percentage.

Ixia offers up a better alternative to the encrypted traffic conundrum. Instead of turning a blind eye (literally) to the traffic or overburdening critical tools, Ixia's Active SSL feature lets a network packet broker handle the decrypt/encrypt process without negatively impacting performance.

The past several years has seen an explosion in the number of purpose-built network tools aimed at helping network managers understand what's happening on the network and how to secure it. The resulting tool sprawl has created a surge of interest in network packet brokers, which Ixia describes as a middleman for network monitoring traffic. These devices make adding new tools plug and play, performing the majority of the heavy lifting of traffic so the tools can do what they were meant to do and no more.

Ixia has added the Active SSL feature to its SecureStack software set that runs on its Vision One network packet brokers. Ixia's customers can use the platform to identify performance problems across physical and virtual networks as well as better secure the environment. Active SSL highlights include:

Active SSL also uses something called "ephemeral keys" to provide forward secrecy and protect past and future data exchanges. Ephemeral keys are cryptographic keys generated for each execution of the key establishment process. The use of the ephemeral keys means traffic is un-encrypted, inspected, and re-encrypted before being sent back to the network.

Some organizations have shied away from encrypting traffic because of the overhead involved in doing so, but the IETF's Transport Layer Security (TLS) 1.0 standard, which uses ephemeral keys, improves both security and performance. With TLS, the use of encrypted traffic will likely accelerate, making Active SSL and other solutions that can help bring light to a growing blind spot.

Follow Zeus Kerravala on Twitter and Google+! @zkerravala Zeus Kerravala on Google+

Read the rest here:
Ixia's Active SSL Sheds Light On Encrypted Traffic - No Jitter