Breaking encryption technology used by terrorists and criminals poses a frustrating dilemma for intelligence agencies and, most recently, congressional lawmakers.

Bipartisan legislation to create a commission to study U.S. encryption policies and practices is still weeks away from being introduced as discussions continue, congressional aides familiar with the plan told Computerworld.

The commission approach, backed by Sen. Mark Warner (D-Va.) and House Homeland Security Committee Chairman Michael McCaul, (R-Texas) is intended to bring experts together to dive into the differing points of view, where tech companies want to protect privacy with encryption, while the FBI and other law enforcement agencies want to prevent acts of terrorism and crime by monitoring encrypted communications.

Meanwhile, Senate Intelligence Committee Chairman Richard Burr (R-N.C.) and Sen. Dianne Feinstein (D-Calif.) are working on a separate bill that would guarantee law enforcement access to encrypted data, aides said Thursday. The terror attacks in Paris and San Bernardino, Calif., have ignited the debate in Congress over encryption.

The Burr-Feinstein approach is seen as taking a harder line on breaking encryption tech, although policymakers appear to have moved away from language calling for mandating a "back door" to break encrypted apps and communications.

The McCaul-Warner commission approach, meanwhile, is not intended to delay, deflect or bury the planned Burr-Feinstein bill, as some critics have claimed, aides working on the commission legislation contended. Whatever work the commission eventually recommends is expected to have an impact for decades to come, so a deliberate approach is needed, they added.

Both McCaul and Warner and their aides have repeatedly said there's "no silver bullet" legislative approach for solving the encryption dilemma. The lawmakers have pointed out that any U.S. law would only apply to U.S. companies, while many encryption apps and technologies are designed by companies outside the U.S. For example, some terrorists in the Paris attacks used Telegram, a messaging app with end-to-end encryption that was built by a Belgian-based company.

In addition, tech companies have argued that third-party access to decryption keys or other means of breaking encryption could only create a hole for criminals and terrorists to sneak through.

The debate over encryption policy in Washington was addressed by two other top officials speaking before think tanks in recent days.

On Thursday, Senate Homeland Security Chairman Ron Johnson (R-Wis.), said that legislating encryption standards might "do more harm than good" in the fight against terrorism, according to The Hill website.

"Is it really going to solve any problems if we force our companies to do something here in the U.S.?" he asked at a presentation at the American Enterprise Institute, a conservative think tank. "It's just going to move offshore."

Johnson also said that encryption helps protect personal information, a position strongly backed by Apple CEO Tim Cook and other tech companies. Apple has been among the most vocal in defending its privacy policies with end-to-end encryption.

On Jan. 21, National Security Agency Director Adm. Michael Rogers told an audience that "encryption is foundational to the future." In remarks at the Atlantic Council, an international affairs think tank, Rogers said that spending time arguing that encryption is bad and should be done away with is a "waste of time." Rogers' comments are recorded in video at The Intercept.

Professor Darren Hayes, director of cybersecurity at Pace University, said he supports the idea of a congressional commission to review encryption laws and policies.

"The whole idea of government access to communications is nothing new," Hayes said in an interview. "Every telecom company has to set up their infrastructure so that law enforcement can set up a wiretap" subject to a court order.

He also said that some type of legal step may be needed to gain greater access. "The vast majority of companies will never hand over data without any kind of warrant or subpoena. The idea that companies will help out law enforcement is not true at all."

Hayes has served as a forensics encryption specialist in more than two dozen criminal cases in the New York area since 2008 to help prosecutors bring cases against people accused of being pedophiles and other crimes who have resorted to hiding criminal activity with encrypted data.

Hayes is well aware that any U.S. law on encryption wouldn't apply to other countries, but said a broad-based discussion "is a good discussion to have The list is growing of potential prosecutions held up by [not having] a full disclosure of encrypted data." In any event, he added, "I'm a big proponent that you have to have a warrant to gain access."

Two representatives for tech companies based in Silicon Valley said recently in interviews that they were open to the idea of creating a congressional commission, but would want to review the final legislation before signing on.

Conversely, Kevin Bocek, vice president of cybersecurity for Venafi, called the idea of creating an encryption commission "very concerning." Venafi works with 250 large banks and retailers in setting up encryption and authorization software to protect their data.

In an interview, Bocek said he is worried that creating the commission could turn into an entity that is powerful and ominous. "I don't understand how an encryption commission is going to deal with encryption already being widely used," he said. "It's counterproductive and more productive to talk about how to live in a world with encryption and how to safeguard national security."

Bocek said there was a broad national discussion about cryptography policy that was fought in the 1990s. "The crypto wars of the 1990s won freedom and there's no sense in moving backwards," he said. "Encryption controls were very painful years ago and here we are again, facing the same problem which can harm American business. Encryption, keys and certificates must be free Blanket legislation will do nothing but cause more problems."

In 1996, the National Academy of Sciences published a 688-page document entitled Crytography's Role in Securing the Information Society. In the executive summary, the authors wrote a preamble that seems to summarize the ongoing encryption debate in 2016: "U.S. policy should be changed to promote and encourage the widespread use of cryptography for the protection of the information interests of individuals, businesses, government agencies and the nation as a whole, while respecting legitimate national needs of law enforcement and intelligence for national security and foreign policy purposes to the extent consistent with good information protection."

Go here to see the original:
Encryption bills pose challenges for Congress | Computerworld

Encryption is the mathematical science of codes, ciphers, and secret messages. Throughout history, people have used encryption to send messages to each other that (hopefully) couldn't be read by anyone besides the intended recipient.

Today, we have computers that are capable of performing encryption for us. Digital encryption technology has expanded beyond simple secret messages; today, encryption can be used for more elaborate purposes, for example to verify the author of messages or to browse the Web anonymously with Tor.

Under some circumstances, encryption can be fairly automatic and simple. But there are ways encryption can go wrong, and the more you understand it, the safer you will be against such situations.

One of the most important concepts to understand in encryption is a key. Common types of encryption include a private key, which is kept secret on your computer and lets you read messages that are intended only for you. A private key also lets you place unforgeable digital signatures on messages you send to other people. A public key is a file that you can give to others or publish that allows people to communicate with you in secret, and check signatures from you. Private and public keys come in matched pairs, like the halves of a rock that has been split into two perfectly matching pieces, but they are not the same.

Another extremely valuable concept to understand is a security certificate. The Web browser on your computer can make encrypted connections to sites using HTTPS. When they do that, they examine certificates to check the public keys of domain names(like http://www.google.com, http://www.amazon.com, or ssd.eff.org). Certificates are one way of trying to determine if you know the right public key for a person or website, so that you can communicate securely with them.

From time to time, you will see certificate-related error messages on the Web. Most commonly, this is because a hotel or cafe network is trying to break your secret communications with the website. It is also common to see an error because of a bureaucratic mistake in the system of certificates. But occasionally, it is because a hacker, thief, police agency, or spy agency is breaking the encrypted connection.

Unfortunately, it is extremely difficult to tell the difference between these cases. This means you should never click past a certificate warning if it relates to a site where you have an account, or are reading any sensitive information.

The word "fingerprint" means lots of different things in the field of computer security. One use of the term is a "key fingerprint," a string of characters like "342e 2309 bd20 0912 ff10 6c63 2192 1928" that should allow you to uniquely and securely check that someone on the Internet is using the right private key. If you check that someone's key fingerprint is correct, that gives you a higher degree of certainty that it's really them. But it's not perfect, because if the keys are copied or stolen someone else would be able to use the same fingerprint.

Read more:
What Is Encryption? | Surveillance Self-Defense

Traditionally, ciphers have used information contained in secret decoding keys to code and decode messages. The process of coding plaintext to create ciphertext is called encryption and the process of decoding ciphertext to produce the plaintext is called decryption. Modern systems of electronic cryptography use digital keys (bit strings) and mathematical algorithms ( encryption algorithms ) to encrypt and decrypt information.

There are two types of encryption: symmetric key encryption and public (asymmetric) key encryption. Symmetric key and public key encryption are used, often in conjunction, to provide a variety of security functions for network and information security.

Encryption algorithms that use the same key for encrypting and for decrypting information are called symmetric-key algorithms. The symmetric key is also called a secret key because it is kept as a shared secret between the sender and receiver of information. Otherwise, the confidentiality of the encrypted information is compromised. Figure14.1 shows basic symmetric key encryption and decryption.

Figure14.1 Encryption and Decryption with a Symmetric Key

Symmetric key encryption is much faster than public key encryption, often by 100 to 1,000 times. Because public key encryption places a much heavier computational load on computer processors than symmetric key encryption, symmetric key technology is generally used to provide secrecy for the bulk encryption and decryption of information.

Symmetric keys are commonly used by security protocols as session keys for confidential online communications. For example, the Transport Layer Security (TLS) and Internet Protocol security (IPSec) protocols use symmetric session keys with standard encryption algorithms to encrypt and decrypt confidential communications between parties. Different session keys are used for each confidential communication session and session keys are sometimes renewed at specified intervals.

Symmetric keys also are commonly used by technologies that provide bulk encryption of persistent data, such as e-mail messages and document files. For example, Secure/Multipurpose Internet Mail Extensions (S/MIME) uses symmetric keys to encrypt messages for confidential mail, and Encrypting File System (EFS) uses symmetric keys to encrypt files for confidentiality.

Cryptography-based security technologies use a variety of symmetric key encryption algorithms to provide confidentiality. For more information about the specific encryption algorithms that are used by security technologies, see the applicable documentation for each technology. For more information about how the various symmetric key algorithms differ, see the cryptography literature that is referenced under "Additional Resources" at the end of this chapter.

Encryption algorithms that use different keys for encrypting and decrypting information are most often called public-key algorithms but are sometimes also called asymmetric key algorithms . Public key encryption requires the use of both a private key (a key that is known only to its owner) and a public key (a key that is available to and known to other entities on the network). A user's public key, for example, can be published in the directory so that it is accessible to other people in the organization. The two keys are different but complementary in function. Information that is encrypted with the public key can be decrypted only with the corresponding private key of the set. Figure14.2 shows basic encryption and decryption with asymmetric keys.

Figure14.2 Encryption and Decryption with Asymmetric Keys

The RSA digital signature process also uses private keys to encrypt information to form digital signatures. For RSA digital signatures, only the public key can decrypt information encrypted by the corresponding private key of the set.

Today, public key encryption plays an increasingly important role in providing strong, scalable security on intranets and the Internet. Public key encryption is commonly used to perform the following functions:

Encrypt symmetric secret keys to protect the symmetric keys during exchange over the network or while being used, stored, or cached by operating systems.

Create digital signatures to provide authentication and nonrepudiation for online entities.

Create digital signatures to provide data integrity for electronic files and documents.

See more here:
Encryption - technet.microsoft.com

Encrypt entire drives with DiskCryptor, which runs as a service and is configured via a dialog. This free, open-source encryption utility also works in Windows 8 desktop mode.

Freelance Writer, PCWorld

DiskCryptor (free) is a handy encryption programsimple, to the point, and lightweight.

My preference is to encrypt entire drives and partitions, which is the level at which I organize my data these days, and that's exactly what DiskCryptor doeseven with your system partition. The program takes that one further and will encrypt ISO files that you may then burn to CD. If you need encrypted container files, look to TrueCrypt or others.

After you install DiskCryptor, it runs as a service in the background with an icon in the system tray. You can set it up to load from your boot sector if you've encrypted your system drive. Click on the system tray icon and you're presented with a plain, down-to-business dialog from which you encrypt/decrypt (AES 256, Two-fish, Serpent) as well as mount and unmount encrypted drives. The program uses only a little over 1MB of disk space installed.

There are a few peculiarities with DiskCryptor that you should be aware of. When you unmount an encrypted drive, it's still visible to the system, as well as Windows Disk management, but isn't recognized as a validly formatted or partitioned drive. This could lead someone to think the drive is corrupt and repartition or reformat ita hide drive function would be nice. It would also be nice to have context menu support so you don't have to go through the dialog for everything. But that's a lot of complaining for a program that's free, easy, convenient, and works extremely well.

DiskCryptor encrypts at the sector, not file level, so converting a drive one way or the other can take a while. In my hands-on, the program worked perfectly and encrypted a 64GB USB 3.0 flash drive in about 20 minutes, or 50MBps on a fast Core i7 system. Decrypting was considerably slower at about 20MBps. Copying files to the flash drive proceeded at about 55MBpsencrypted or not.

DiskCryptor is lightweight, seems reliable, and doesn't noticeably impact system performance. It doesn't offer the same wealth of options as TrueCrypt, but if you need only drive and partition-level encryption, then DiskCryptor's a worthwhile alternative.

Note: The "Try it for free" button on the Product Information page will download the software to your system.

Jon is a Julliard-trained musician, self-taught programmer, and long-time (late 70s) computer enthusiast living the San Francisco Bay Area. More by Jon L. Jacobi

Your message has been sent.

There was an error emailing this page.

Go here to read the rest:
Review: DiskCryptor a worthwhile encryption program that's ...

1. What is an encryption registration? How long does it take to receive a response from BIS for my encryption registration?

2. Who is required to submit an Encryption Registration, classification request or self-classification report?

3. What are my responsibilities for exporting or re-exporting encryption products where I am not the producer?

4. What should I do if I cannot obtain the encryption registration Number (ERN) or the Export Control Classification Number (ECCN) for the item from the producer or manufacturer?

5. Can a third-party applicant submit an encryption registration and self-classification report on my behalf?

6. How do I report exports and reexports of items with encryption?

7. Can I export encryption technology under License Exception ENC?

8. What is non-standard cryptography?

9. How do I complete Supplement No. 5 if I am a law firm or consultant filing on behalf of a producer of encryption items?

10. What if you are not the producer of the item or filing directly on behalf of the producer (e.g., law firm/consultant)?

11. What do I need to submit with an encryption commodity classification request in SNAP-R?

12. Is Supplement No. 6 to Part 742 required for obtaining paragraph 740.17(b)(1) authorization?

13. How do I submit a Supplement No. 8 Self-Classification Report for Encryption Items?

14. When do I file Supplement No. 8 Self-Classification Report for Encryption Items?

15. What is Note 4?

16. I have an item that was reviewed and classified by BIS and made eligible for export under paragraph (b)(3) of License Exception ENC in 2009. The encryption functionality of the item has not changed. This item is now eligible for self-classification under paragraph (b)(1) of License Exception ENC. What are my responsibilities under the new rule?

17. When do I need a deemed export license for encryption technology and source code?

18. Does the EAR definition of "OAM" include using encryption in performing network security monitoring functions?

1. What is an Encryption Registration? How long does it take to receive a response from BIS for my Encryption Registration?

Encryption registration is a prescribed set of information about a manufacturer and/or exporter of certain encryption items that must be submitted to the Bureau of Industry and Security as a condition of the authorization to export such items under License Exception ENC or as mass market items.

Advance encryption registration is required for exports and reexports of items described in paragraphs 740.17(b)(1), (b)(2), and (b)(3) and paragraphs 742.15(b)(1), and (b)(3) of the Export Administration Regulations (EAR). Registration is made through SNAP-R by submitting the questionnaire set forth in Supplement No. 5 to part 742 of the EAR (point of contact/company overview/types of products/ etc.). Registration of a manufacturer authorizes the manufacturer as well as other parties to export and reexport the manufacturers encryption products that the manufacturer has either self-classified or has had the items classified by BIS, pursuant to the provisions referenced above. A condition of the authorization is that the manufacturer must submit an annual self-classification report for relevant encryption items.

How long does it take to receive a response from BIS for my encryption registration?

Once you have properly registered with BIS, the SNAP-R system will automatically issue an Encryption Registration Number (ERN), e.g., R123456, upon submission of a request. BIS estimates that the entire registration procedure should take no more than 30 minutes.

2. Who is required to submit an encryption registration, classification request or self-classification report?

Any party who exports certain U.S.-origin encryption products may be required to submit an encryption registration, classification request and/or self-classification report; however, if a manufacturer has registered and has self-classified relevant items and/or had items classified by BIS, and has made the classifications available to other parties such as resellers and other exporters/reexporters, such other parties are not required to register, to submit a classification request, or to submit an annual self-classification report.

3. What are my responsibilities for exporting or re-exporting encryption products where I am not the product manufacturer?

Exporters or reexporters that are not producers of the encryption item can rely on the Encryption Registration Number (ERN), self-classification report or CCATS that is published by the producer when exporting or reexporting the registered and/or classified encryption item. Separate encryption registration, commodity classification request or self-classification report to BIS is NOT required.

Please continue to the next question if the information is not available from the producer or manufacturer.

4. What should I do if I cannot obtain the Encryption Registration Number (ERN) or the Export Control Classification Number (ECCN) for the item from the producer or manufacturer?

If you are not the producer and are unable to obtain the producers information or if the producer has not submitted an encryption registration, self-classification report or commodity classification for his/her products to BIS, then you must register with BIS. The registration process will require you to submit a properly completed Supplement No. 5 to part 742 and subsequent Supplement No. 8 Self Classification Report for the products. You will receive an ERN for the registered products or CCATSs as appropriate. BIS recognizes that non-producers who need to submit for encryption registration may not have all of the information necessary to complete Supplement No. 5 to part 742. Therefore, special instructions have been included in Supplement No. 5 to account for this situation.

For items described in Part 740.17(b)(2) and (b)(3) or Part 742.15(b)(3) that require the classification by BIS, the non-producer is required to submit as much of the technical information required in Supplement No. 6 to part 742 - Technical Questionnaire for Encryption Items as possible.

5. Can a third-party applicant submit an encryption registration and self-classification report on my behalf?

Yes, special instructions for this purpose are provided in paragraph (r) of Supplement No. 2 to part 748 of the EAR for this purpose. The information in block 14 (applicant) of the encryption registration screen and the information in Supplement No. 5 to part 742 must pertain to the company that seeks authorization to export and reexport encryption items that are within the scope of this rule. An agent for the exporter, such as a law firm, should not list his/her name in block 14. The agent however may submit the encryption registration and list himself/herself in block 15 (other party authorized to receive license) of the encryption registration screen in SNAP-R.

6. How do I report exports and reexports of items with encryption?

All reports (i.e., the semi-annual sales report and the annual self-classification report) must be submitted to both BIS and the ENC Encryption Request Coordinator.

An annual self-classification report is required for producers of encryption items described by paragraphs 740.17(b)(1) and 742.15(b)(1) of the EAR. The information required and instruction for this report is provided in Supplement No. 8 to Part 742-Self-Classification Report for Encryption Items. Reports are submitted to BIS and the Encryption Request Coordinator in February of each year for items exported or reexported during the previous calendar year (i.e., January 1 through December 31) pursuant to the encryption registration and applicable sections740.17(b)(1) or 742.15(b)(1) of the EAR. Annual self-classification reports are to be submitted to This email address is being protected from spambots. You need JavaScript enabled to view it. and This email address is being protected from spambots. You need JavaScript enabled to view it..

Semi-annual sales reporting is required for exports to all destinations other than Canada, and for reexports from Canada for items described under paragraphs (b)(2) and (b)(3)(iii) of section 740.17. Paragraph 740.17(e)(1(iii) contains certain exclusions from this reporting requirement. Paragraphs 740.17(e)(1)(i) and (e)(1)(ii) contains the information required and instructions for submitted the semi-annual sales reports. The first report is due no later than August 1 for sales occurring between January 1 and June 30 of the year, and the second report is due no later than February of the following year for sales occurring between July 1 and December 31 of the year. Semi-annual sales reports continue to be submitted to: This email address is being protected from spambots. You need JavaScript enabled to view it. and This email address is being protected from spambots. You need JavaScript enabled to view it..

7. Can I export encryption technology under License Exception ENC?

Yes, License Exception ENC is available for transfer of encryption technology. Specifically, paragraph 740.17(b)(2)(iv) has been amended to permit exports and reexports of encryption technology as follows:

(A) Technology for "non-standard cryptography". Encryption technology classified under ECCN 5E002 for "non-standard cryptography", to any end-user located or headquartered in a country listed in Supplement No. 3 to this part;

(B) Other technology. Encryption technology classified under ECCN 5E002 except technology for "cryptanalytic items", "non-standard cryptography" or any "open cryptographic interface," to any non-"government end-user" located in a country not listed in Country Group D:1 or E:1 of Supplement No. 1 to part 740 of the EAR.

8. What is non-standard cryptography?

Non-standard cryptography, defined in Part 772 Definition of Terms, means any implementation of cryptography involving the incorporation or use of proprietary or unpublished cryptographic functionality, including encryption algorithms or protocols that have not been adopted or approved by a duly recognized international standards body (e.g., IEEE, IETF, ISO, ITU, ETSI, 3GPP, TIA, and GSMA) and have not otherwise been published.

9. How do I complete Supplement No. 5 if I am a law firm or consultant filing on behalf of a producer or exporter of encryption items?

The information in Supplement No. 5 to Part 742must pertain to the registered company, not to the submitter. Specifically, the point of contact information must be for the registered company, not a law firm or consultant filing on behalf of the registered company.

10. What if you are not the producer of the item or filing directly on behalf of the producer (e.g., law firm/consultant)?

You may answer questions 4 and 7 in Supplement No. 5 to part 742as not applicable if your company is not the producer of the encryption item. An answer must be give for all other questions. An explanation is required when you are unsure.

11. What do I need to submit with an encryption commodity classification request in SNAP-R?

Encryption commodity classification determinations should be submitted through SNAP-R. Before entering SNAP-R, you should prepare the following supporting documents:

After accessing SNAP-R, fill-in a commodity classification determination request and upload the supporting documents into SNAP-R.

12. Is Supplement No. 6 to part 742 required for paragraph 740.17(b)(1) authorization?

If you are requesting a classification of an item is described in paragraph 740.17(b)(1) (in other words, the item is not described in either Section 740.17(b)(2) or (b)(3)), a Supplement No. 6questionnaire is not required as a supporting document. Provide sufficient information about the item (e.g., technical data sheet and/or other explanation in a separate letter of explanation) for BIS to determine that the item is described in paragraph 740.17(b)(1). If you are not sure that your product is authorized as 740.17(b)(1) and you want BIS to confirm that it is authorized under 740.17(b)(1), providing answers to the questions set forth in Supplement No. 6 to part 742 with your request should provide BIS with sufficient information to make this determination.

13. How do I submit a Supplement No. 8 Self Classification Report for Encryption Items?

The annual self-classification report must be submitted as an attachment to an e-mail to BIS and the ENC Encryption Request Coordinator. Reports to BIS must be submitted to a newly created e-mail address for these reports (This email address is being protected from spambots. You need JavaScript enabled to view it.). Reports to the ENC Encryption Request Coordinator must be submitted to its existing e-mail address (This email address is being protected from spambots. You need JavaScript enabled to view it.). The information in the report must be provided in tabular or spreadsheet form, as an electronic file in comma separated values format (CSV), only. In lieu of email, submissions of disks and CDs may be mailed to BIS and the ENC Encryption Request Coordinator.

14. When do I file Supplement No. 8 Self-Classification Report for Encryption Items?

An annual self-classification report for applicable encryption commodities, software and components exported or reexported during a calendar year (January 1 through December 31) must be received by BIS and the ENC Encryption Request Coordinator no later than February 1 the following year. If no information has changed since the previous report, an email must be sent stating that nothing has changed since the previous report or a copy of the previously submitted report must be submitted.

15. What is Note 4?

Note 4 to Category 5, Part 2 in the Commerce Control List (Supplement No. 1 to part 774) excludes an item that incorporates or uses cryptography from Category 5, Part 2 controls if the items primary function or set of functions is not information security, computing, communications, storing information, or networking, andif the cryptographic functionality is limited to supporting such primary function or set of functions. The primary function is the obvious, or main, purpose of the item. It is the function which is not there to support other functions. The communications and information storage primary function does not include items that support entertainment, mass commercial broadcasts, digital rights management or medical records management.

Examples of items that are excluded from Category 5, Part 2 by Note 4 include, but are not limited to, the following:

16. I have an item that was reviewed and classified by BIS and made eligible for export under paragraph (b)(3) of License Exception ENC in 2009. The encryption functionality of the item has not changed. This item is now eligible for self-classification under paragraph (b)(1) of License Exception ENC. What are my responsibilities under the new rule?

Your item meets the grandfathering provisions set forth in section 740.17(f)(1) of the EAR. You do not need to submit an encryption registration (Supplement No. 5), an annual self-classification report (Supplement No. 8), or semi-annual sales reports for the item.

17. When do I need a deemed export license for encryption technology and source code?

A license may be required in certain circumstances for both deemed exports and deemed reexports. For encryption items, the deemed export rules apply only to deemed exports of technology and to deemed reexports of technology and source code. There are no deemed export rules for transfers of encryption source code to foreign nationals in the United States. This is because of the way that section 734.2 defines exports and reexports for encryption items.

For transfers of encryption technology within the United States, section 740.17(a)(2) of license exception ENC authorizes the export and reexport of encryption technology by a U.S. company and its subsidiaries to foreign nationals who are employees, contractors, or interns of a U.S. company . . . There is no definition of U.S. company in the EAR, however, BIS has interpreted this to apply to any company operating in the United States. This means that deemed export licenses are generally not required for the transfer of encryption technology by a company in the U.S. to its foreign national employees. A deemed export license may be required if, for example, a company operating in the U.S. were to transfer encryption technology to a foreign national who is not an employee, contractor, or intern of a company in the United States. License exception ENC does not authorize deemed exports or reexports to any national of a country listed in Country Group E:1.

For deemed reexports, the end-user would have to be an employee, contractor, or intern of a U.S. Subsidiary for 740.17(a)(2) to apply, or a private sector end-user headquartered in a Supplement 3 country for 740.17(a)(1) to apply. The term contractor in this context means a contract employee (i.e., a human person). License exception ENC does not authorize deemed exports or reexports to any national of a country listed in Country Group E:1.

Also note that as of June 25, 2010, encryption technology (except technology for cryptanalytic items, Open Cryptographic Interface items, and non-standard cryptography) that has been reviewed is eligible for license exception ENC to any non-government end user located outside of Country Group D:1. Also, encryption source code that has been reviewed by BIS and made eligible for license exception ENC under 740.17(b)(2) is eligible for export and reexport to any non-government end-user. Thus encryption technology and source code that have been reviewed are eligible for export and reexport to a broader range of end-users than 740.17(a) allows. Again, section 740.17 does not authorize deemed exports or reexports to any national of a country listed in Country Group E:1.

18. Does the EAR definition of "OAM" include using encryption in performing network security monitoring functions?

No. The definition of "OAM" includes "monitoring or managing the operating condition or performance of an item." BIS does not consider network security monitoring or network forensics functions to be part of monitoring or managing operating condition or performance.

The phrase "monitoring or managing the operating condition or performance of an item" is meant to include all the activities associated with keeping a computer or network-capable device in proper operating condition, including: configuring the item; checking or updating its software; monitoring device error or fault indicators; testing, diagnosing or troubleshooting the item; measuring bandwidth, speed, available storage (e.g. free disk space) and processor / memory / power utilization; logging uptime / downtime; and capturing or measuring quality of service (QoS) indicators and Service Level Agreement-related data.

However, the "OAM" definition does not apply to cryptographic functions performed on the forwarding or data plane, such as: decrypting network traffic to reveal or analyze content (e.g., packet inspection and IP proxy services); encrypting cybersecurity-relevant data (e.g., activity signatures, indicators or event data extracted from monitored network traffic) over the forwarding plane; or securing the re-transmission of captured network activity.

Thus, products that use encryption for such network security monitoring or forensics operations, or to provision these cryptographic services, would not be released by the OAM decontrol notes (l) or (m), or the Note to 5D002.c.

Similarly, the "OAM" decontrol does not apply to security operations directed against data traversing the network, such as capturing, profiling, tracking or mapping potentially malicious network activity, or "hacking back" against such activity.

Back to top

Original post:
Encryption FAQs

Effortless Key Creation

Unlike other solutions, Trend Micro Email Encryption features dynamic key generation, built with Trend Micro Private Post technology, eliminating the pre-enrollment and certificate management hassles of PKI encryption. All you need is a recipients email address to create encryption keys.

Hosted key management helps ensure the availability of encryption keys 24x7, providing password and key recovery without the need for IT involvement.

Our web-based Zero Download Reader enables your intended recipients to decrypt emails without requiring them to install client software and supports popular mobile devices running iOS, Android, and Blackberry. Plus, our solutions help you comply with the regulations and requirements of partners and customers by allowing you to secure both incoming and outgoing emails and attachments.

Our email encryption solutions minimize IT administration and lower overall costs thanks to all of the above: effortless key creation, hosted key management, plus ease of use for both senders and recipients.

Read analyst TCO white paper

Trend Micro Email Encryption saves time vs. PKI encryption Read analyst TCO white paper

Our client-based encryption plugs into Microsoft Outlook, making it easier for end users to select which emails should be encrypted. Secure, encrypted email is as simple as sending regular emailno special training is needed.

Free trial View datasheet

Compatible Operating Systems

CPU and Memory

Required Disk Space

Compatible Web Browsers

Compatible Email Clients

Compatible Smart Phone Operating Systems for Zero Download Reader

In my opinion, Trend Micro Endpoint Encryption should be considered an industry standard for data encryption in healthcare. As an IT leader, when you find a tool that works so wellyou keep [it] in your tool-box indefinitely. Rob Jones, Chief Technology Officer, Truman Medical Centers Read more (PDF)

This option for InterScan Messaging Security, automatically encrypts email at the gateway based on content policiesfor a critical layer of data protection that doesnt rely on end user discretion. A recipients email address is all thats needed to create encryption keys, lifting the burden from IT staff.

Free trialView datasheet

Its faster to deploy and easier to manage

Its become a necessity See analyst white paper

Policy-based encryption from Trend Micro automatically enforces compliance requirements and protects confidential informationall while minimizing administration and lowering TCO. This service integrates seamlessly with Trend Micro Hosted Email Securityfor comprehensive messaging security in a fully hosted solution.

Free trial View datasheet

As a hosted service, Trend Micro Hosted Email Security does not require additional hardware or software located on your premises since all scanning hardware and software is operated and maintained offsite at Trend Micros secure datacenters.

To access your local Hosted Email Security administration account, a personal computer with Internet access and either Microsoft Internet Explorer 6.0 or 7.0 , or Mozilla Firefox 2.0, and JavaScript and Sun Java Runtime Environment (JRE) 1.4 or higher is required.

To start using Hosted Email Security, environments must also have an existing Internet gateway or workgroup SMTP connection and access to the DNS mail exchange record required to redirect the MX mail host record. If you have hosted email, then contact your service provider for more information or configuration help in redirecting your MX record.

Quality Life Services simplifies compliance with Hosted Email Encryption Read case study

Continued here:
Email Encryption Solutions - Secure Email - Trend Micro USA

Are You Responsible for Sensitive Data?

Do you store sensitive information on your workstation, laptop, flash drive or mobile device? Do you email sensitive data to persons outside the ECU network? If so, you should encrypt these files and emails to protect them from unauthorized access or theft. Read on to learn categories of sensitive data and a few simple tools you can use to add a significant layer of protection to your information.

Sensitive data includes the following:

Encryption scrambles data to make it unreadable. Only persons with the password key can unscramble, or decrypt, the information. This not only prevents identity theft but also protects you and the university from unnecessary liability if your device or email is stolen, hacked or otherwise breached.

From the Start button, type BitLocker into the search. Choose BitLocker Drive Encryption.

All faculty and staff have encryption enabled and are required to encrypt messages containing sensitive information when addressed to recipients outside the ECU network. For example, do you send HIPAA information to users at Vidant? Then encrypt these messages before sending. Messages sent within the ECU network do not need to be encrypted.

Its easy to encrypt email. Follow the instructions found at http://www.ecu.edu/cs-itcs/email/encryption.cfm. There are also printable instructions for decryption that can be sent to recipients.

Read more:
Data Encryption | IT Security - East Carolina University

Tim Cook has said following through with the court order would endanger its customers. Letting the FBI in would also give hackers an easier way in too, he argued.

Police everywhere are having a hard time keeping track of terrorists, because modern phones, including the iPhone, make it easier than ever to communicate privately.

1. Technology companies are increasingly using encryption to protect your data.

By translating your messages and private information into a string of seemingly random letters and numbers, encryption keeps your data out of the watchful eyes of hackers and government data collectors.

2. Terrorists are using encryption to "go dark."

When ISIS spots a possible recruit, they move conversations to direct person-to-person chatting apps that encrypt messages. Police can't monitor those messages.

3. Phones themselves are locked with encryption.

Apple and Google (GOOGL, Tech30) are encrypting data stored on iPhones and Android phones. When police obtain a suspect's or victim's device, police have a difficult time breaking in if the phone is locked with a passcode.

4. That makes evidence seizure difficult for law enforcement.

Traditionally, police obtain a court-ordered search warrant to seize evidence. Then they approach a tech company and demand to see a customer's information. But those court orders are increasingly worthless because many tech companies no longer hold the encryption keys -- they couldn't unlock their customers' data, even if they wanted to.

5. You control your own encryption keys.

Instead, customers have the keys, in the form of a smartphone passcode. Only you can unlock your iPhone -- Apple doesn't know or store your password.

6. Law enforcement still demands access.

FBI Director James Comey wants tech companies to figure out a way to let in police anyway. Comey suggests Apple (AAPL, Tech30), Microsoft (MSFT, Tech30) and others design "doors" into products with a second set of keys for law enforcement.

7. The tech industry and experts say those doors are a bad idea

The world's top cryptographers issued a joint statement last July, calling the FBI's attempts "mandating insecurity." They describe this in binary terms: either data is secured against everyone -- or it's not. 48 companies and 37 civil society groups took a similar stand, worrying that hackers could exploit those doors.

8. Government can't regulate encryption anyway.

Encryption is software that's easy to replicate and share. Much of it is free. Even if law enforcement got the extra access it seeks, terrorists and criminals could just use software or devices made outside the United States. Terrorists acquire illegal assault rifles. They'll get encryption too.

CNNMoney (New York) First published February 18, 2016: 10:58 AM ET

View original post here:
The Apple encryption debate... in 2 minutes - Feb. 18, 2016

Welcome to Day Sixteen. Were continuing on with our series on Windows Server 2008 in preparation for the launch. Today, were going to look at Terminal Server security in Windows Server 2008 specifically Network Level Authentication and Encryption.

Terminal Server security may be enhanced by providing user authentication earlier in the connection process when a client connects to a Terminal Server. This early user authentication method is referred to as Network Level Authentication. This is a new authentication method that completes user authentication before you establish a Remote Desktop connection and the logon screen appears. This is a more secure authentication method that can help protect the remote computer from malicious users and malicious software. The advantages to Network Level Authentication are:

There are specific requirements to use Network Level Authentication:

The Terminal Server can be configured to only support connections from clients running Network Level Authentication. This setting can be configured in a couple of different ways:

To determine if a system is running a version of Remote Desktop Connection software that supports Network Level Authentication, start the Remote Desktop Connection client application, click the icon in the upper-left corner of the Remote Desktop Connection dialog box and click About. Look for the phrase, "Network Level Authentication" in the About window as shown below.

By default, Terminal Services sessions use native Remote Desktop Protocol (RDP) encryption. However, RDP does not provide authentication to verify the identity of a Terminal Server. You can enhance the security of Terminal Services sessions by using Transport Layer Security (TLS) 1.0 for server authentication and to encrypt Terminal Server communications. The Terminal Server and client system must be configured correctly for TLS to provide enhanced security. There are three available security layers outlined in the table below:

When SSL (TLS 1.0) is used to secure communications between a client and Terminal Server, a certificate is needed. You can select a certificate that you have already installed on the Terminal Server or you can use the default self-signed certificate.

For Terminal Services connections, data encryption protects data by encrypting it on the communications link. By default, Terminal Services connections are encrypted at the highest available level of security 128-bit. However, some older versions of the Terminal Services client application do not support this high level of encryption. The encryption level of the connection may be configured to send and receive data using different encryption levels to support legacy clients. There are four configuration options as outlined below:

These encryption levels are stored in the MinEncryptionLevel value in the following registry key: HKLMSYSTEMCurrentControlSetControlTerminalServerWinStationsRDP-Tcp. There are four possible values for MinEncryptionLevel that correspond to the settings in the table above:

And with that we come to the end of this post. In tomorrows post, well take a look at Terminal Server printing. Until next time

CC Hameed

More:
WS2008: Network Level Authentication and Encryption | Ask ...

Contemporary Examples

The secret behind the Coin is that it is powered by a 128-bit encryption for all storage and communication.

Get to know E2E (end to end) encryption, says Dan Auerbach, a staff technologist at the Electronic Frontier Foundation.

Forget about encryptionyour ISP could require the key as condition of using its network.

Websites should probably revoke and re-issue their encryption keys as well.

Bloomberg even reported that the NSA did know and had been exploiting the mistake in encryption.

Snowden contacted Poitras in mid-January 2013 after failing to connect with Greenwald due to his lack of encryption.

With the Assange movie, there are sequences like the [Vincente] Minnelli-like visual explorations of an encryption system.

In November 2013, well before U.S. bombs started falling, ISIS did launch a Web-based encryption tool, Ahlberg said.

And then Glenn finally got on encryption, came on a plane to New York, and off we went.

How many congressmen could even describe how encryption works?

British Dictionary definitions for encryption Expand

to put (a message) into code

to put (computer data) into a coded form

to distort (a television or other signal) so that it cannot be understood without the appropriate decryption equipment

Derived Forms

encrypted, adjectiveencryption, noun

Word Origin

C20: from en-1 + crypt, as in crypto-

Word Origin and History for encryption Expand

1975 in computer sense, from en- (1) + crypt (see crypto-). Related: Encrypted; encrypting; encryption.

encryption in Science Expand

encryption in Culture Expand

The process of encoding a message so that it can be read only by the sender and the intended recipient. Encryption systems often use two keys, a public key, available to anyone, and a private key that allows only the recipient to decode the message. (See also cryptography.)

encryption in Technology Expand

Read more here:
Encryption | Define Encryption at Dictionary.com