TechNet to Hill: Query FBI Nominee on Encryption – Broadcasting & Cable

TechNet wants Congress to grill President Donald Trump's new FBI director nominee on issues like privacy and encryption.

President Trump signaled Wednesdaythat he plans to nominate Christopher Wray, a partner at international law firm King & Spalding, as new FBI director.

That announcement came only a day before his fired FBI director, James Comey, is scheduled to testify before the Senate Intelligence Committee, which some Democrats were seeing as an attempt to distract attention from the run-up to Comey's testimony.

Reacting to the news, TechNet, representing tech CEOs and top execs, signaled because of the increasing interaction of the FBI and their industry, Congress needed to get his input on those issues.

Comey and the tech industry crossed paths, and to some degree swords, over the issue of government access to encrypted information, notably in the case of an Apple phone the FBI wanted to access in its investigation of the San Bernardino shooting.

With the nomination of Christopher Wray as Director of the FBI, the responsibility now falls on the United States Senate to ensure the nominee will do everything in his power to protect the American people and uphold the rule of law, said TechNet president Linda Moore. Because of the FBI's increasing engagement with the technology industry, this confirmation process must explore Mr. Wrays views on digital privacy rights, encryption technologies, and needed reforms to the Electronic Communications Privacy Act that account for modern advances in cloud computing"

TechNet executive council members include Microsoft President Brad Smith and Apple general Counsel Bruce Sewell.

More here:
TechNet to Hill: Query FBI Nominee on Encryption - Broadcasting & Cable

Islamic State supporters shun Tails and Tor encryption for Telegram – ComputerWeekly.com

Supporters of the terrorist group Islamic State (Isis) are shunning sophisticated security and encryption software, including the Tails operating system and the Tor network, which could be used to cover their tracks when viewingterrorist propaganda online, communications between jihadi sympathisers have revealed.

Find out what are the most appropriate threat intelligence systems and services for your organisation

By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

The disclosures come as the UK government prepares to introduce new restrictions on encryption following the terrorist attacks that killed more than 20 people, including children, at a concert in Manchester, and killed eight andinjured 47 at London Bridge.

Isis has claimed responsibility for the Manchester and London attacks and has also been linked to atrocities in Paris, Germany and Brussels.

Confidential messages show that Isis supporters had little interest in encryption techniques to hide their web browsing activities, or to createa secureversion of propaganda websites that would be difficult for law enforcement to censor or take down.

The messages between supporters recovered by police and the FBI investigating an internet terrorist reveal that Isis supporters preferred method of communication is mobile phone apps Telegram Threema, ChatSecure and Signal, which are designed for people with little or no technical knowledge.

Internet terrorist Samata Ullah communicated with Isis supporters on a Telegram discussion group known as the Khayr group. Police also retrieved a guide to ChatSecure, another mobile phone chat app, from Ullahs computer.

Ullah, who was jailed for eight years in May 2017 after posting encryption training videos on an Islamist blogsite, sent messages to an unidentified Isis supporter raising concerns that the terror groups supporters were not using more secure communications tools.

I dont know Akhi [brother], he wrote. It seems they have some bad info. They refuse to use Wikr [a mobile phone messaging system] and tails. They say threema is the best, then signal, and in extreme case chat secure [sic].

Ullahs Isis contact replied: And they say telegram with virtual sim or open vpn is enough protection.

Another message reads: Dawla [Isis] security groups seem to be very stubborn and not very flexible.

It was only when one of Ullahscontacts inKenya was arrested on 29 April 2016 that attempts were made to persuade fellow Isis supporters to adopt stronger forms of encryption.

The Kenyan said in a letter smuggled out of prison: Tell all KN [Khalifa News] and CCA [Cyber Caliphate Army] teams to be very careful online. It is very much advisable that phones be avoided & instead use PCs with TOR and TAILS.

Many Isis supporters, who often refer to themselves as fanboys, have little technical knowledge and it is difficult to convince them to use encryption software, one counter-terrorism organisation told Computer Weekly.

They have experimented a couple of times with ZeroNet and Onion [Tor] sites on occasions, but those sites are usually very short-lived, a spokesman said, speaking on condition of anonymity. While there are some tech savvy supporters, the majority of their fan base is not very tech savvy and trying to get a newbie to not only understand ZeroNet and Tor but to actually use them consistently is a challenge.

Isiss policy is to saturate the internet with ideas and jihadi content, through social media platforms such as Twitter, according to a report by counter-terrorism think-tank Quilliam.

The terror group distributes daily videos and photographs, which are circulated as widely as possible through self-appointed distributors, often with no official connection to the organisation.

Islamic State has revolutionised jihadist messaging by jettisoning operational security in the pursuit of dynamism, Quilliam reports in a study, The Virtual Caliphate: Understanding Islamic States Propaganda Strategy.

Ullah proposed using ZeroNet which uses BitTorrent peer-to-peer networking and integrates with the Tor secure internet network to create a secure version of a pro-Islamic blogsite, Ansar al Khilafah (Supporters of the Caliphate).

The WordPress propaganda blogsite had attracted interest from the UKs media arm of Isis, according to messages recovered by investigators.

The head of English Islamic State media wants to have the right to proofread all content before it is published on the wordpress in future, one Isis supporter told Ullah. If you would agree to it, they would promote the wordpress.

Ullah replied: Sure. thats good.

But in a series of exchanges, it becomes clear that Isis had no interest in using ZeroNet to create a version of the blog that would be difficult for law enforcement to censor or take down.

An Isis supporter told Ullah: First thing is, the brother almost completely dismissed the idea of zero net. So you will either have to give up the idea or try and convince them.

David Wells, a former GCHQ intelligence officer, told Computer Weekly that mobile phone apps offered a more practical alternative to ZeroNet, Tails and Tor for Isis supporters that may not have technical expertise.

More secure technologies are rarely easy to use, and pragmatically any terrorist group would rather their networks were using something pretty secure than not communicating [at all] when needed or doing something stupid like [sending an] SMS, he said.

A forensic report revealed that Ullahs ZeroNet version of the Answar al Khilafah blog did not work in practice.

ZeroNet would have been cumbersome to use for Isis supporters who were used to exchanging news on social media. It required each user to download the blogs contents, including the Isis magazine Dabiq, onto their own computer, putting them at risk of possession of terrorist materials.

Correspondence recovered from Ullahs computer equipment revealed that he had struggled to find a way to update the ZeroNet version of the site without writing code for each update, and to find ways of displaying videos and other feature-rich content.

Isis favours the mobile app Telegram as a platform for sharing propaganda and for group discussions because it has the ability to create public channels that unlimited numbers of people can view, according to the counter-terrorism specialist.

Isis members begin by creating a private distribution channel on Telegram which is restricted to a few people. These members are responsible forcopying messages from the private channels to publicly advertised open channels, where teams of people then share them through disposable Twitter and social media accounts.

The public channels usually have multiple backups to keep the data flowing if one of them gets suspended by Telegram administrators, said the specialist. Since the private channels have no links to join, they are considered private by Telegram and therefore wont be shut down.

Telegram is said to take down an average of 100 to 200 public Isis channels a day, but Isis creates multiple back-ups of each channel to keep data flowing.

However, the messaging service does not take down private discussion groups between Isis supporters because they are not publicly accessible, said the counter-terrorism specialist.

Encrypted communications is pretty much all they [Isis] do. Id say if theyre not using a walkie-talkie or a cell phone, theyre on one of the encrypted [mobile] apps.

If Isis had taken up ZeroNet, it may have drawn the intelligence services attention to its activities, Wells told Computer Weekly.

If a terrorist group chooses a bespoke or unusual communications provider or service, then this has huge challenges for the intelligence services but it also allows them to focus their efforts, he said.

Experimenting with unproven systems is likely be a low priority for Isis commanders in Syria, who have to deal with the day-to-day realities of civil war with the Assad regime and US drone strikes, said Ross Anderson, professor of computer security at Cambridge University.

If I was running Daeshs technology and some foot soldier says why dont we use ZeroNet, I would say get lost, I have far more interesting and important things to do, said Anderson. Why should I spend weeks investigating this stuff and seeing if it works?

Isis may be avoiding Tor and Tails for similar reasons. The US National Security Agency (NSA) and the UKs GCHQ could narrow down the search for Isis supporters if the terror group started using specialist applications such as Tails and Tor.

Anderson said: They could just harvest all the Tails users in the observable universe and de-dupe them against lists of known users, look for all the new ones and go searching for those.

Isis has used a variety of techniques to avoid detection. During the attack on the Bataclan theatre in Paris in November 2015, terrorist teams used multiple pre-paid burner phones, which they instantly discarded.

Investigators found a crates worth of disposable phones, an investigation by the New York Times has revealed. They used only new phones that they would then discard, including several activated minutes before the attacks, or phones seized from their victims, it said.

Although investigators concluded that the attackers were likely to have used encryption software, no evidence of it was found.

Follow this link:
Islamic State supporters shun Tails and Tor encryption for Telegram - ComputerWeekly.com

Encryption leaves authorities ‘not in a good place’: Former US intelligence chief – ZDNet

James Clapper at a Senate intelligence committee hearing in February. (Image: file photo)

James Clapper, Barack Obama's former director of National Intelligence, has said the issue of criminals and terrorists going dark by using end-to-end encrypted systems is causing issues in the United States.

"The so-called going dark phenomenon -- a situation that was dramatically accelerated by the Snowden revelations -- in our country, I don't think we're in a good place here," Clapper said at the National Press Club on Wednesday.

"I think there needs to be a very serious dialogue about giving criminals, terrorists, rapists, murderers, etcetera, a pass."

Clapper said he hopes technology giants will use the creativity and innovation that made the iPhone and turn it to a form of encryption that simultaneously protects privacy while allowing authorities to access its content, but he had no answers to offer himself.

"One of the approaches that might have promise, I don't know, would be circle back on a system of key escrow where not one party necessarily would have the keys to the kingdom from an encryption standpoint," he said.

"Where there might be three independent, separate, autonomous elements that would have to prove the provision of encryption in order to solve a crime or detect a terrorist attack, for example.

"We had some discussions about that in the waning days of the Obama Administration. I'm not a techie, but that appears to me to have some promise."

The former director of National Intelligence also said there is no single correct answer to the issues of whether intelligence agencies should disclose vulnerabilities in software to vendors, or use them to collect information.

In recent days, political leaders in the United Kingdom and Australia have called on social media companies and tech giants -- labelled by Australian opposition leader Bill Shorten as Big Internet -- to help provide access to encryption. It is an idea that Clapper is backing, particularly after a meeting with executives from Silicon Valley at the White House approximately 18 months ago.

"I was struck by the interest that the companies have in helping," he said. "I do think there is a role to play here in some screening and filtering of what appears in social media.

"I know this is a very sensitive, controversial issue, but in the same way that these companies very adroitly capitalise on the information that we make available to them and exploit it, it seems that that same ingenuity could be applied in a sensitive way to filtering out or at least identifying some of the more egregious material that appears on social media.

"I do think that as part of their social or municipal responsibility that they need to cooperate and if that means under some safeguarded way that they would have confidence in ... that law enforcement particularly, would be allowed access to encryption.

"I hear the argument about if you share once with one person and it's forever compromised -- I'm not sure I really buy into that."

Talking to ABC radio on Wednesday morning, Special Adviser to the Prime Minister on Cybersecurity Alastair MacGibbon stepped away from some of the rhetoric used by Australian politicians this week.

"The Australian government -- in fact, all governments with an interest in the safety of the public -- like encryption. End-to-end encryption helps reduce criminality against individuals, against governments and against business," MacGibbon said.

"But there's no absolutes. Clearly, encryption causes problems if you're investigating criminals or terrorists."

MacGibbon dismissed the issue of intelligence agencies using encryption backdoors to access communication content, and instead said investigations might be interested in a user's metadata and working with industry to solve crimes.

"No one is talking about back doors here," he said. "But as a police officer you'd execute search warrants. From time to time we do expect our privacy to be breached, but most of us don't ever have that privacy breached."

"And we need to take that same logic into the online space. That means, from time to time, you'd expect a law enforcement agency to break in to a private communication or to something that happens online."

MacGibbon said that regardless of whether it is a bus or an internet service, the public expects that service providers do not allow criminals or terrorists to abuse the service.

"There's nothing extreme about that. That's just what we expect offline and we should have that same philosophy online."

Read the original post:
Encryption leaves authorities 'not in a good place': Former US intelligence chief - ZDNet

TechNet To Hill: Query FBI Nominee on Encryption – Multichannel News

TechNet wants Congress to grill President Donald Trump's new FBI director nominee on issues like privacy and encryption.

Trump signaled Wednesday (June 7) that he plans to nominate Christopher Wray, a partner at international law firm King & Spalding, as the new FBI director.

That announcement came only a day before his fired FBI director, James Comey, is scheduled to testify before the Senate Intelligence Committee. Some Democrats were seeing the move as an attempt to distract attention from the run-up to Comey's testimony.

Reacting to the news, TechNet, representing technology company CEOs and other top execs, signaled that because of the increasing interaction of the FBI and thetechindustry, Congress needed to get his input on those issues.

Comey and the tech industry crossed paths, and to some degree swords, over the issue of government access to encrypted information, notably in the case of an Apple iphone the FBI wanted to access in its investigation of the San Bernardino, Calif., shooting.

With the nomination of Christopher Wray as director of the FBI, the responsibility now falls on the United States Senate to ensure the nominee will do everything in his power to protect the American people and uphold the rule of law, said TechNet president Linda Moore. Because of the FBI's increasing engagement with the technology industry, this confirmation process must explore Mr. Wrays views on digital privacy rights, encryption technologies, and needed reforms to the Electronic Communications Privacy Act that account for modern advances in cloud computing..."

TechNet executive council members include Microsoft president Brad Smith and Apple general counsel Bruce Sewell.

View post:
TechNet To Hill: Query FBI Nominee on Encryption - Multichannel News

Enterprise Encryption Solutions – Data at Rest and Data in …

To reduce therisk posed byhackers, insider threats, and other malicious attacks, your organization must utilize encryption to protect sensitive data wherever it is found across your on-premises, virtual, public cloud, and hybrid environments. This includes data at rest in application and web servers, file servers, databases, and network attached storage, as well as data in motion across your network.

As your corporate data assets grow, data-at-rest encryption is a critical last line of defense. Encryption applies security and access controls directly to your sensitive structured and unstructured data - wherever it resides.

In addition to protecting data at rest, enterprises must also address threats to sensitive data as it traverses networks. Data-in-motion encryption ensures your data, video, voice and even metadata is protected from eavesdropping, surveillance, and overt and covert interception. With Gemalto's comprehensive portfolio of SafeNet data-at-rest and data-in-motion encryption solutions, you can secure all types of sensitive data across today's distributed enterprise.

Gemalto's portfolio of data-at-rest encryption solutions delivers transparent, efficient, and unmatched data protection at all levels of the enterprise data stack, including the application, database (column or file), file system, full disk (virtual machine), and network attached storage levels. In addition to working across on-premises, virtual, and cloud environments, these solutions are deployed with the SafeNet KeySecure enterprise key manager for centralized key and policy management .

Learn More About Data-at-Rest Encryption

A powerful safeguard for data in motion, SafeNet High Speed Encryptors deliver proven and certified Layer 2 encryption capabilities that meet secure network performance demands for real time, low latency and near zero overhead to provide security without compromise .

Learn More About SafeNet High Speed Encryptors

Without a comprehensive data protection platform that includes strong encryption to secure and control access to your high-value information, and centralized enterprise key management to secure, manage, and prove ownership of your keys, your sensitive data is at risk. Gemalto's encryption solutions enable your organization to meet your immediate data protection and business needs now, while investing in a platform that provides robust security, a growing ecosystem, and the scalability you need to build a trusted framework for the future.

With Gemalto's encryption solutions, you can meet a wide variety of use cases, including:

Continue reading here:
Enterprise Encryption Solutions - Data at Rest and Data in ...

Enigma: Why the fight to break Nazi encryption still matters – CNET

This is the Enigma machine that enabled secret Nazi communications. Efforts to break that encoding system ultimately helped make D-Day possible.

It was night when three British sailors and a 16-year-old canteen assistant boarded a sinking U-boat off the coast of Egypt. A spotlight shone on them from the HMS Petard, the Royal Navy destroyer that had hunted down the German submarine and now slowly circled the vessel. The U-boat's commander lay dead below the hatch as water poured in from a crack in the hull.

The four men began searching the ship, but not for survivors. They were looking for codebooks.

These red-covered guides were vital to breaking a diabolical code that made Nazi radio messages unintelligible. The Germans had been using a typewriter-like machine to encrypt their communications. They called it Enigma and were sure the code was unbreakable.

The British were determined to prove them wrong.

Wading past bodies through slowly rising water, First Lieutenant Anthony Fasson, Able Seamen Colin Grazier and Kenneth Lacroix, and young Tommy Brown found the captain's quarters and began searching drawers and breaking into cabinets. They found two codebooks written in red, water-soluble ink: the Short Weather Cipher, used to condense weather reports into a seven-letter message, and the Short Signal Book, used to report convoy sightings, along with other documents.

While Grazier and Fasson continued to search below, Brown carried the books up the ladder of the sub's conning tower to a waiting boat. They were racing against time as seawater poured into the submarine.

On his third trip up the ladder, Brown called for his shipmates to come up, too -- but it was too late. U-559 sank before Fasson and Grazier could escape that night in October 1942. As Hugh Sebag-Montefiore recounts in "Enigma: The Battle for the Code," their bravery helped changed the course of World War II.

The U-boat codes created by Enigma were especially hard to break, and the Allies found themselves locked out for weeks or months at a time. But several months after they recovered the codebooks from U-559 -- on March 19, 1943 -- cryptographers stationed in Britain's Bletchley Park broke through into U-boats' Enigma-coded messages and were never fully locked out again.

From then on, their efforts only improved. By September of that year, the Allies were reading encrypted U-boat messages within 24 hours of intercepting them. The breakthrough allowed the Allies to decrypt detailed field messages on German defenses in Normandy, the site of the impending D-Day invasion. And the machines themselves advanced the world's technology -- pushing forward ideas about computer programming and memory.

"I'd call it the key to computing," says Ralph Simpson, a retired computer expert and amateur Enigma historian.

The years since have given us a cat-and-mouse game between codebreakers and cryptographers, with each side trying to outwit the other. Those battles are still raging. But they're no longer confined to blackboards and spinning rotors on crude computers. They move at the speed of electrons flowing through your computer's processor.

Today's computer-enabled encryption -- technology that scrambles what unauthorized viewers see -- is so complex that computers can't break it unless it's been used incorrectly. It's so powerful that the US government and others have tried to legally require tech companies to unlock their own encryption, as was the case with Apple and the government last year over a terrorist's locked iPhone.

And today's encryption is so useful that dissidents, spies and terrorists rely on it to protect their conversations.

The innovation won't stop. Future advances in quantum computing might be able to crack even perfectly implemented encryption. That's led mathematicians to pre-emptively try to make encryption even stronger.

It's a cycle without end in sight.

Before the internet wove its way into our lives, encryption was pretty much something businesses and governments used to protect sensitive data, like financial documents and Social Security records.

"Mostly it was banks, diplomatic services and the military who used cryptography throughout history," says Bill Burr, a retired cryptographer from the US National Institute of Standards and Technology.

The internet increased the use of encryption, as business and governments sent information over networks that hackers and spies could easily intercept. But few regular people went out of their way to use encryption as part of daily life. Maybe your paranoid friend would encrypt his email, forcing you to use extra software to read it.

That changed after disclosures by former NSA contractor Edward Snowden, who in the summer of 2013 revealed the existence of government mass surveillance programs designed to collect reams of information from everything -- our emails, calls and texts. Though we were told the programs weren't designed to target Americans, the disclosures forced us to ask how much information we want to put on the internet -- and potentially expose.

The tech industry has tried to address the problem by offering us another option: encrypting as much of our lives as we can.

What's made this possible was the Engima, and the men, women, mathematicians, computer scientists and linguists who ultimately beat it.

This is their story.

The Enigma has a surprisingly understated design for being such a deadly tool. It could easily be mistaken for a typewriter with a few extra parts, housed in a plain wooden box.

Lifting the lid of an Enigma, a German operator saw what might on first glance seem like two typewriters squished together. One set of keys, closest to the operator, was the actual keyboard to be typed on.

Above it was a second set of keys, laid out just like the keyboard. But when you type on the real keyboard, these letters light up. Type an "a" on the normal keyboard, for example, and "x" lights up above.

So if you start typing a word, each letter lights up in code.

This was Enigma's genius. The German operators didn't need to understand the complex math or electronics that scrambled what they typed on the keyboard. All they knew was that typing "H-E-L-L-O" would light up as "X-T-Y-A-E," for example. And that's the message they sent around.

This jumbling of letters changed each day at midnight, when Nazi commanders would send new settings that Enigma operators would use to turn dials and change the plugs on a board below the keys, all designed to match the day's code. Without the code, the message couldn't be unscrambled.

Enigma was so sophisticated it amounted to what's now called a 76-bit encryption key. One example of how complex it was: typing the same letters together, like "H-H" (for Heil Hitler") could result in two different letters, like "L-N."

That type of complexity made the machines impossible to break by hand, Simpson says.

How impossible? If you gave 100,000 operators each their own Enigma machine, and they spent 24 hours a day, 7 days a week testing a new setting every second, "it would take twice the age of the universe to break the code," Simpson says.

Obviously, codebreaking by hand wasn't going to cut it.

"Because we now have machine encryption for the first time, it took a machine to break it," Simpson says.

Equally fascinating is that Nazi military leaders knew, in theory, that someone could develop a machine-assisted way to speed up their code cracking. But they didn't believe their enemies would put in the time and resources needed.

They were wrong.

14

See Alan Turing's lost notes, found in the walls of Bletchley Park 70 years later

Of course, the UK was very motivated to break the Enigma. German U-boats were sinking hundreds of British ships, costing thousands of lives and choking the country off from vital supplies being shipped from the United States and Canada. What's more, the country was desperate for any advantage in the early days of the war, filled with German bombing campaigns and fears of a land invasion.

So resources, manpower and the lives of sailors like Fasson and Glazier were poured into cracking the Enigma codes. The first result of these efforts was the Bombe.

Custom-designed by British mathematicians like Alan Turing, Bombes were about the size of three vending machines stacked side by side, with a series of spinning rotators connected in the back by a 26-way cable. They were based on the Polish "Bomba" codebreaking machine, which the Poles were forced to abandon in 1939, after their country was invaded by Germany.

Housed at a secretive intelligence program on the grounds of manor house Bletchley Park, less than 50 miles outside of London, and other nearby installations, the Bombes were run by teams of Navy women.

Each of the Bombe's rotators had letters on it and, as they spun, the machine tested possible solutions to a given Enigma code much faster than a human could.

Researchers like Turing and his team were able to make the Bombes more efficient by using "pinched" codebooks from U-boats and other clues, eliminating thousands of possible solutions.

"If we understand the book, we then know what the submarines are likely to say," says David Kenyon, a research historian at the Bletchley Park Trust.

Breaking into the U-boat's "Shark" code in 1943 set in motion a series of dominoes that ultimately led to the Nazi defeat. Intercepted U-boat messages made the Allies better at sinking the vessels, which contributed to the German Navy's decision to pull its U-boats out of the Atlantic later that year, Kenyon says. That respite allowed the Allies to prepare for D-Day in 1944 and to end the war in 1945.

While codebreaking alone didn't win World War II, it was one of the most powerful weapons invented for that purpose.

"There was no point in the Second World War where the outcome was a foregone conclusion," Kenyon says. There's no telling what might have happened "if you took away any of the factors that were working in the Allies' favor."

35

Photo Tour of Bletchley Park

The work done on the Bombes and other codebreaking machines didn't just aid in the fight against the Nazis. They proved theories about computer programming and data storage, the lifeblood of today's modern computers.

One of these breakthroughs came when the Joseph Desch of the US Navy found a way to speed up the Bombe. The machines could only run so fast, because operators read the results of the codebreaking analysis right off of the wheels themselves. Go any faster and the wheels would spin right past the correct answer.

Desch's solution was a primitive form of digital memory. When the Bombe came upon the correct answer, electrical relays would detect and record it. That let the US Bombes spin more than 17 times faster than the British Bombes.

Then there was Colossus. This machine -- designed not to break Enigma, but rather the more sophisticated Lorenz codes used by the German High Command -- advanced vacuum tube tech that later came to power the world's first true computers, like the ENIAC and Mark-1, and then the first generation of IBM mainframes.

To create a codebreaking machine powerful enough to crack Lorenz, British engineer Tommy Flowers found a way to run more than 2,000 vacuum tubes at once. While it had been theorized this approach could power a programmable computer, Flowers was the first to make it happen.

Flowers himself didn't get a chance to push this technology to its next logical conclusion. But Turing and other Bletchley alums worked at the University of Manchester after the war, creating the Ferranti Mark 1 -- a programmable computer run with vacuum tubes.

That the work at Bletchley showed up later in the first general-purpose computers doesn't surprise Burr. The codebreakers were able to fully understand the workings of Enigma and the Lorenz code create machines to break them at a time when the principles of computing only existed in theory.

"It's hard for me to imagine people smart enough to do that," says Burr, who's an expert in cryptography.

In terms of global politics, encryption was pretty straightforward during World War II. One nation tapped its linguists and mathematicians -- and relied on the heroism of men who boarded sinking U-boats -- to crack the encryption tech of an enemy force.

The world's gotten a lot more complicated since then.

Just as in World War II, law enforcement and spy agencies today try to read the communications of criminals, terrorists and spies. But now that almost everyone uses encryption, a government's ability to break it doesn't just worry our country's enemies -- it concerns us, too.

And despite the advances in computing and encryption since Bletchley Park, we haven't come close to agreeing on when it's okay to break encryption.

Case in point: the 2016 conflict between Apple and the US Federal Bureau of Investigation. The FBI wanted Apple's help breaking into the iPhone of a suspected terrorist, but Apple argued that this could put everyone who uses an iPhone at risk.

Burr, who saw the inside of public controversies over the government breaking encryption during his time at the National Institute of Standards and Technology, says there's no clear path forward.

"There's just a big dilemma there," he says. Creating ways to break encryption "will weaken the actual strength of your security against bad guys of ability. And you have to count among those the state actors and pretty sophisticated and organized criminals."

In their laser-focused effort to crack Nazi encryption, codebreakers like Turing and soldiers like Fasson and Grazier were unlikely to have imagined a world like this. But here it is: the catch-22 of computerized encryption. And it's not going away anytime soon.

Special Reports: CNET's in-depth features in one place.

Tech Enabled: CNET chronicles tech's role in providing new kinds of accessibility.

Go here to read the rest:
Enigma: Why the fight to break Nazi encryption still matters - CNET

Hungary’s CryptTalk boosted by encryption controversy – Financial Times

In his modest office in one of Budapests innovation parks, Szabolcs Kun reels off an eclectic list of clients: law firms, commodity traders, television celebrities and dealers in gemstones and precious metals.

Oh, and we recently got an inquiry from a top European football club, he adds.

All want the same thing: completely secure telephone calls.

Football club managers are like commodity traders: both deal in very expensive goods and have to negotiate [by phone], says Mr Kun, a 34-year-old IT entrepreneur, whose start-up CryptTalk is one of the products making a name for itself in Hungarys growing technology sector.

It was energy traders in Hungary who, in 2010, first alerted Mr Kun to the increasing threat of phone tapping. They found prices would mysteriously move against them after agreeing a deal on the phone, he says.

Mr Kun and Attila Megyeri, his business partner, were experienced telecommunications engineers. As more clients found evidence of eavesdropping, they turned their attention to security when communicating by telephone.

They wanted to provide a software solution, so that customers would not need to buy a second phone or additional gadget to increase security.

Even more importantly they wanted to make sure the software did not have a so-called back door that would allow governments or hackers to circumvent security measures. Traditional telecom providers typically offer secure telephony and call encryption through a central server, which generates and stores encryption keys.

This is legally mandated so the secret services can monitor calls [when justified], says Mr Kun. But it is also a back door into your system. Even if [it exists] for good control purposes, that door can be opened by the bad guys, for industrial espionage.

To circumvent this risk, the pair used so-called peer-to-peer encryption, whereby calls and messages are scrambled from handset to handset using software based on a complex algorithm. This generates an encryption code shared only between caller and receiver.

The Achilles heel of such systems is the delay in calls typically of two seconds duration that is caused by the encryption-decryption process and can frustrate users. With their specialist knowledge of telephony and many hours of hard work, Mr Kun and his partner eliminated this lag.

The two founders have won backing from a clutch of private investors to finance their vehicle, Arenim Technologies. Angel investors are still the most common way for Hungarian start-ups to raise funding, with 37 per cent of start-ups using this route for finance, according to the European Startup Monitor, a study conducted by start-up associations around Europe.

Arenim was registered in Stockholm while the development team remained in Budapest.

After a long review, we chose Sweden. It has the best privacy laws...Its where the rights to free speech and such stuff are important, Mr Kun says.

Sweden also has more liberal export regulations than Hungary, where licences are needed to sell security software outside the EU.

Designed to work with Apples iPhone, they quietly launched their CryptTalk app in 2014.

This is a solution with no back door, without any special hardware and, very importantly, even we, the vendors, cannot decrypt calls made using CryptTalk, Mr Kun says. If my engineer goes crazy, or gets a big offer from a bad guy heres $1m, but help me [eavesdrop] even in that situation, CryptTalk cannot be hacked.

Two audits undertaken by NCC Group, a UK-based cyber security and risk mitigation company, in 2015 and 2017, support this claim.

CryptTalk was found to be secured to a very good standard and no practically exploitable vulnerabilities were found, NCC wrote.

Commercial progress, though, has been modest: CryptTalk has attracted 15,000 users, half from within Hungary, with revenues last year totalling 0.4m. Prices start from 19.99 per month for a subscription.

Gyuri Karady, Arenims business development director, says that a slow start is typical for a new product like this. He argues that businesses, while spending huge sums on computer security, typically fail to show the same concern over their phone calls.

Most corporates dont seem to have caught on that they are at risk, he says.

Arenim Technologies 25 staff are now focused on launching an Android-based version of CryptTalk later this year, followed by a drive for international sales.

CryptTalk was at the centre of controversy in March last year when, as part of Hungarys war on terror, a government official threatened to ban secure communications providers, including CryptTalk, for thwarting eavesdropping operations.

In an ironic twist, the very same week the Hungarian Innovation Association a state-supported body championed by the government awarded the annual prize for start-up innovation to Arenim Technologies in recognition of CryptTalk.

The hubbub died down after the government decided not to enact the ban.

Mr Kun says he is willing to co-operate on legitimate security concerns with any state including, if necessary, closing a users account. But, he says: So far, [we have had] zero official request from authorities or governments of any kind to co-operate with them or provide them data.

Publicity surrounding the governments threat to CryptTalk last year had a positive effect on sales. Extensive media coverage in the region and globally, led to a surge in users, which jumped 20 per cent from 8,000 to 9,600 in one month.

It shows the Hungarian government does support start-ups, says Mr Kun. We couldnt have paid for this [kind of] marketing.

Read the original:
Hungary's CryptTalk boosted by encryption controversy - Financial Times

We want to limit use of e2e encryption, confirms UK minister – TechCrunch

The UK government has once again amped up its attacks on tech platforms use of end-to-end encryption, and called for International co-operation to regulate the Internet so that it cannot be used as a safe space for extremists to communicate and spread propaganda online.

The comments by UK Prime Minister, Theresa May, and Home Secretary, Amber Rudd, come in the wake of another domestic terrorist attack, the third since March, after a group of terrorists used a van to plow down pedestrians in London Bridge on Saturday evening, before going on a knife rampage attacking people in streets and bars.

Speaking outside Downing Street yesterday, May swung the finger of blame at big Internet companies criticizing platform giants for providing safe spaces for extremists to spread messages of hate online.

Early reports have suggested the attackers may have used YouTube to access extremist videos.

We cannot allow this ideology the safe space it needs to breed. Yet that is precisely what the internet and the big companies that provide internet-based services provide, May said. We need to work with allied, democratic governments to reach international agreements that regulate cyberspace to prevent the spread of extremism and terrorist planning. And we need to do everything we can at home to reduce the risks of extremism online.

We need to deprive the extremists of their safe spaces online, she added.

Speaking in an interview on ITVs Peston on Sunday program yesterday, UK Home Secretary Amber Rudd further fleshed out the prime ministers comments. She said the government wants to do more to stop the way young men are being groomed into radicalization online including getting tech companies to do moreto take down extremist material, and also to limit access to end-to-end encryption.

Rudd also attacked tech firms use of encryption in the wake of the Westminster terror attack in March, although the first round of meetings she held with Internet companies including Facebook, Google and Twitter in the wake of that earlier attack apparently focused on pushing for them to develop tech tools to automatically identify extremist content and block it before it is widely disseminated.

The prime minister also made a push for international co-operation on online extremism during the G7 summit last month coming away with a joint statement to put pressure on tech firms to do more. We want companies to develop tools to identify and remove harmful materials automatically, May said then.

Though it is far from clear whether this geopolitical push will translate into anything more than a few headlines given tech firms are already using and developing tools for automating takedowns. And the G7 nations apparently did not ink any specific policy proposals such as on co-ordinated fines for social media takedown failures.

On the extremist content front, pressure has certainly been growing across Europe for tech platforms to do more including proposals such as a draft law in Germany which does suggestfines of up to50 million for social media firms that fail to promptly takedown illegal hate speech, for example. While last month a UK parliamentary committee urged the government to consider a similar approach and UK ministers are apparently open to the idea.

But the notion of the UK being able to secure international agreement on harmonizing content regulation online across borders seems entirely fanciful given different legal regimes vis-a-vis free speech, with the US having constitutional protections for hate speech vs hate speech being illegal in certain European countries, for example.

Again, these comments in the immediate aftermath of an attack seem mostly aimed at diverting attention from tougher political questions including over domestic police resourcing; over UK ally Saudi Arabias financial support for extremism; and why known hate preachers were apparently allowed to continue broadcasting their message in the UK

Blaming social media platforms is politically convenient but intellectually lazy, tweeted professor Peter Neumann, director of theInternational Centre for the Study of Radicalisation and Political Violence. Most jihadists are now using end-to-end encrypted messenger platforms e.g. Telegram. This has not solved problem, just made it different.

Responding to the governments comments in a statement, Facebooks Simon Milner, UK director of policy, said: We want to provide a service where people feel safe. That means we do not allow groups or people that engage in terrorist activity, or posts that express support for terrorism. We want Facebook to be a hostile environment for terrorists. Using a combination of technology and human review, we work aggressively to remove terrorist content from our platform as soon as we become aware of it and if we become aware of an emergency involving imminent harm to someones safety, we notify law enforcement. Online extremism can only be tackled with strong partnerships. We have long collaborated with policymakers, civil society, and others in the tech industry, and we are committed to continuing this important work together.

Facebook has faced wider criticism of its approach to content moderation in recent months and last month announced it would be adding an additional 3,000 staff to its team of reviewers, bringing the global total to 7,500.

In another reaction statement Twitters UK head of public policy, Nick Pickles, added: Terrorist content has no place on Twitter. We continue to expand the use of technology as part of a systematic approach to removing this type of content. We will never stop working to stay one step ahead and will continue to engage with our partners across industry, government, civil society and academia.

Twitter details how many terrorism-related accounts it suspends in its Transparency Report the vast majority of which it says it identifies using its own tools, rather than relying on user reports.

On the controversial topic of limiting end-to-end encryption, a report in The Sun newspaper last month suggested a re-elected Conservative government would prioritize a decryption law to force social media platforms which are using e2e encryption to effectively backdoor these systems so that they could hand over decrypted data when served a warrant.

The core legislation for this decrypt law already exists, aka the Investigatory Powers Act which was passed at the end of last year. Following the General Election on June 8, a new UK Parliament will just need to agree the supplementary technical capability regulation which places a legal obligation on ISPs and communication service providers to maintain the necessary capability to be able to provide decrypted data on request (albeit, without providing technical detail on how any of this will happen in practice).

Given Rudds comments now on limiting e2e encryption it seems clear the preferred route for an incoming Conservative UK government will be to pressure tech firms not to use strong encryption to safeguard user data in backed up by the legal muscle of the country having what has been widely interpreted as a decrypt law.

However such moves will clearly undermine online security at a time when the risks of doing so are becoming increasingly clear. As crypto expert Bruce Schneier told usrecently, the only way for the UK government to get the access it wants is to destroy everyones security.

Moreover, a domestic decrypt law is unlikely to have any impact on e2e encrypted services such as Telegram which are not based in the UK, and would therefore surely not consider themselves bound by UK legal jurisdiction.

And even if the UK government forced ISPs and app stores to block access to all services that do not comply with its decryption requirements, there would still be workarounds for terrorists to continue accessing strongly encrypted services. Even as law-abiding users of mainstream tech platforms risk having their security undermined by political pressure on strong encryption.

Commenting on the governments planned Internet crackdown, the Open Rights Group had this to say: It is disappointing that in the aftermath of this attack, the governments response appears to focus on the regulation of the Internet and encryption. This could be a very risky approach. If successful, Theresa May could push these vile networks into even darker corners of the web, where they will be even harder to observe.

But we should not be distracted: the Internet and companies like Facebook are not a cause of this hatred and violence, but tools that can be abused. While governments and companies should take sensible measures to stop abuse, attempts to control the Internet is not the simple solution that Theresa May is claiming.

Meanwhile, asked about his support for encryption back in September 2015given the risks of his messaging platform being used by terrorists Telegram founder Pavel Durov said: I think that privacy, ultimately, and our right for privacy is more important than our fear of bad things happening, like terrorism Ultimately the ISIS will always find a way to communicate within themselves. And if any means of communication turns out to be not secure for them, then they switch to another one. So I dont think were actually taking part in this activities. I dont think we should feel guilty about this. I still think were doing the right thing protecting our users privacy.

Original post:
We want to limit use of e2e encryption, confirms UK minister - TechCrunch

Krypt.co scores a $1.2M seed round to simplify developer encryption … – TechCrunch

Krypt.co, a new security startup foundedby two former MIT students and one of their professors, is launching today with a free product called Kryptonite, designed to help developers protect their private encryption keys, using an app on their smartphones.

Itsa big day for the fledgling company as it also announced a $1.2 million seed round led by Rough Draft Ventures/General Catalyst with participation from Slow Ventures, SV Angel and Akamai Labs. Thats a solid rosterof backers for their first swing at funding.

The company came out of research by two former MIT students, Alex Grinman and Kevin King, who shared a common passion for encryption. The two friendsbelieved that they had found a better way to protect encryption keys and they approached their professor David Gifford, who thought it was a good idea and helped them launch the company.

Kryptonite takes advantage oftypical public/private key encryption using the Secure Socket Shell (SSH) protocol used by developers to log onto networks remotely. Typically, they store their private keys on a laptop, but the founders saw this as inherently insecure because apps arent sandboxed and separated from one another as they are on a smartphone.

They believed that by moving the process to the phone, it would make it more convenient and safer. You simply download the free Kryptonite app, pair it with your computer and use SSH in the normal fashion. As you try to log onto remote services like Github to commit your code, youll see a notification on your phone. If it wasnt you who made that request, your keys might be compromised and you can reject access and revoke the keys.If it is you, you can sign in and continue.

Photo: Krypt.co

While they acknowledge that people could lose their phones, they say that you could cut off access to services using your privatekey, and render the key essentially useless to the person who found (or stole) your phone.

While the initial product is free, the company sees this offering as a way to build relationships in the developer community, and eventually add services on top of that free product they can charge for.

The founders are still working on the administrative architecture, but they are envisioning a team administrator, who will have access to a central dashboard to set device policies and view the public keys for all of the developers on the team.

Down the road, they could apply this technology to code signing to avoid fraudulent commits, oreven possibly at some point, simplify the use ofencrypted emails for all users, not just developers.

For now, they have the money from this seed round to add some more employees and begin to build beyond the free product and see where this takes them.

Originally posted here:
Krypt.co scores a $1.2M seed round to simplify developer encryption ... - TechCrunch

Theresa May’s repeated calls to ban encryption still won’t work – New Scientist

Theresa May making a statement following Saturdays attack in London

Chris Ratcliffe/Bloomberg via Getty Images

By Timothy Revell

In the wake of Saturdays terrorist attack in London, the Prime Minister Theresa May has again called for new laws to regulate the internet, demanding that internet companies do more to stamp out spaces where terrorists can communicate freely.

We cannot allow this ideology the safe space it needs to breed, she said. Yet that is precisely what the internet and the big companies that provide internet-based services provide.

Her comments echo those made in March by the home secretary, Amber Rudd. Speaking after the previous terrorist attack in London, Rudd said thatend-to-end encryption in apps like WhatsApp is completely unacceptableand that there should be no hiding place for terrorists.

Yet most experts agree that these repeated calls to be tougher on technology are poorly thought through. Undermining cryptography simply could not work.

The arguments against banning encryption are well rehearsed, but worth repeating. Encryption is not just a tool used by terrorists. Anyone who uses the internet uses encryption. Messaging apps, online banking, e-commerce, government websites, or your local hospital all use encryption.

A ban on encryption would make it impossible to do anything online that relies on keeping things private, like sending your credit card details or messaging your doctor.

Even if governments were willing to sacrifice their citizens online privacy, any sort of ban would be futile anyway. Anyone with a little technical know-how could write their own code to encrypt and decrypt data. In fact, the code to do so is so smallit easily fits on a t-shirt.

Another way to get rid of Mays safe spaces that has been mooted is to give security services special access to encrypted messages, so-called back doors. Again this is impractical.

If a master key was created that allowed security services to bypass encryption it would immediately become a target for hackers. Anyone feeling hostile could focus their efforts on cracking the master key, and in doing so would not just get access to one persons data, but everyones.

Whats more, despite members of the government once again insisting on the need to ban or bypass encryption, we still have no details on how they plan to achieve it.

Theresa Mays response is predictable but disappointing, saysPaul Bernalat the University of East Anglia, UK. If you stop safe places for terrorists, you stop safe places for everyone, and we rely on those safe places for a great deal of our lives.

Last month New Scientist called fora greater understanding of technology among politicians. Until that happens, having a reasonable conversation about how best to tackle extremism online will remain out of reach.

The internet is a convenient scapegoat and a distraction from the awkward questions that might otherwise be asked about things like foreign policy and arms sales, says Bernal.

Read more:

Why breaking encryption is a bad idea that could never work

How 2016s war on encryption will change your way of life

WhatsApp enables encryption and ramps up for government fight

More on these topics:

More here:
Theresa May's repeated calls to ban encryption still won't work - New Scientist