In an op-ed published Tuesday by The Guardian, American whistleblower Edward Snowden expressed alarm over global governments' efforts to undermine encryption, highlighting a recent attempt by the United States, United Kingdom, and Australia to pressure Facebook to create a "backdoor" into its encrypted messaging applications.

"The true explanation for why the U.S., U.K., and Australian governments want to do away with end-to-end encryption is less about public safety than it is about power."Edward Snowden, whistleblower

"For more than half a decade, the vulnerability of our computers and computer networks has been ranked the number one risk in the U.S. Intelligence Community's Worldwide Threat Assessmentthat's higher than terrorism, higher than war," wrote Snowden.

"And yet, in the midst of the greatest computer security crisis in history, the U.S. government, along with the governments of the U.K. and Australia, is attempting to undermine the only method that currently exists for reliably protecting the world's information: encryption," he continued. "Should they succeed in their quest to undermine encryption, our public infrastructure and private lives will be rendered permanently unsafe."

As Snowden noted, "in the simplest terms, encryption is a method of protecting information, the primary way to keep digital communications safe." Messaging apps often use end-to-end encryption (E2EE)which, as the Electronic Frontier Foundation (EFF) explains, "ensures that a message is turned into a secret message by its original sender, and decoded only by its final recipient."

For six years straight, the vulnerability of our computer networks has been the top risk on the US Intelligence Communitys Worldwide Threat Assessment ranked higher than terrorism; higher than war.

This surveillance scheme will make it worse.https://t.co/MFZdRnCvTR

Edward Snowden (@Snowden) October 15, 2019

Facebook-owned WhatsApp already uses E2EE. The New York Times reported in January that Facebook CEO Mark Zuckerberg has ordered its implementation across all company messaging platforms, including Facebook Messenger and Instagram Direct. Acknowledging that encrypted apps could be used for "truly terrible things like child exploitation, terrorism, and extortion," Zuckerberg wrote in blog post on March 6 that "we've started working on these safety systems building on the work we've done in WhatsApp, and we'll discuss them with experts through 2019 and beyond before fully implementing end-to-end encryption."

SCROLL TO CONTINUE WITH CONTENT

On Oct. 4, four top officials from various countriesU.S. Attorney General William Barr, then-acting U.S. Homeland Security Secretary Kevin McAleenan, U.K. Home Secretary Priti Patel, and Australian Minister for Home Affairs Peter Duttonsent an open letter (pdf) to Zuckerberg requesting that "Facebook does not proceed with its plan to implement end-to-end encryption across its messaging services without ensuring that there is no reduction to user safety and without including a means for lawful access to the content of communications to protect our citizens."

Facebook responded by reiterating the company's commitment to its E2EE plans and opposition to backdoors. "We believe people have the right to have a private conversation online, wherever they are in the world," the company said in a statement. "End-to-end encryption already protects the messages of over a billion people every day... We strongly oppose government attempts to build backdoors because they would undermine the privacy and security of people everywhere."

Encryption is a human right in the digital society. Full stop. We should have it by design and default in the technology we use. I agree with @Snowden "Without encryption, we will lose all privacy. This is our new battleground" https://t.co/9YhAh0UsWn

Francesca Bria (@francesca_bria) October 15, 2019

Although Facebook has thus far resisted government pressure, Snowden warned Tuesday that "if Barr's campaign is successful, the communications of billions will remain frozen in a state of permanent insecurity: users will be vulnerable by design. And those communications will be vulnerable not only to investigators in the U.S., U.K., and Australia, but also to the intelligence agencies of China, Russia, and Saudi Arabianot to mention hackers around the world."

Snowden, who worked for CIA and NSA, is now president of the board of directors of the nonprofit Freedom of the Press Foundation. Last month, the whistleblower published a memoir entitled Permanent Record about his experience leaking classified U.S. government documents to the press in 2013, which sparked global discussions about privacy rights and mass surveillance, and led Snowden to seek asylum in Russia.

"When I came forward in 2013, the U.S. government wasn't just passively surveilling internet traffic as it crossed the network, but had also found ways to co-opt and, at times, infiltrate the internal networks of major American tech companies. At the time, only a small fraction of web traffic was encrypted: six years later, Facebook, Google, and Apple have made encryption-by-default a central part of their products, with the result that today close to 80 percent of web traffic is encrypted," Snowden wrote. "Barr, who authorized one of the earliest mass surveillance programs without reviewing whether it was legal, is now signalling an intention to haltor even roll backthe progress of the last six years."

While Barr and his co-signers "invoked the spectre of the web's darkest forces" to justify their opposition to E2EE, Snowden argued that "the true explanation for why the U.S., U.K., and Australian governments want to do away with end-to-end encryption is less about public safety than it is about power: E2EE gives control to individuals and the devices they use to send, receive, and encrypt communications, not to the companies and carriers that route them. This, then, would require government surveillance to become more targeted and methodical, rather than indiscriminate and universal."

Read the original post:
'Without Encryption, We Will Lose All Privacy': Snowden ...

Government-mandated encryption backdoors make countries, and more specifically their election systems, vulnerable to cyber attack, 74% of information security professionals warn.

At the same time, 72% believe laws that allow governments to access encrypted personal data will not make citizens safer from terrorists, according to a poll by security firm Venafi of 384 attendees of the Black Hat USA 2019 security conference earlier in August in Las Vegas.

The findings echo a similar poll of attendees of RSA Conference 2019 in San Francisco in March, which showed 73% of respondents were opposed to government-mandated backdoors.

Governments and law enforcement officials around the world, particularly in the Five Eyesintelligence alliance, continue to push for encryption backdoors, which they claim are necessary in the interests of national safety and security as criminals and terrorists increasingly communicated via encrypted online services.

According to the Five Eyes governments, the increasing gap between the ability of law enforcement to lawfully access data and their ability to acquire and use the content of that data is a pressing international concern that requires urgent, sustained attention and informed discussion.

Last month, the US Senate Intelligence Committee reported that election systems in all 50 states were targeted by Russia during the 2016 election, said Kevin Bocek, vice-president of security strategy and threat intelligence at Venafi.

We know that encryption backdoors dramatically increase security risks for every kind of sensitive data, and that includes all types of data that affects our national security. The IT security community overwhelmingly agrees that encryption backdoors would have a disastrous impact on the integrity of our elections and on our digital economy as a whole.

Opponents of encryption backdoors have said repeatedly that government-mandated weaknesses in encryption systems put the privacy and security of everyone at risk the same backdoors can be exploited by hackers.

The survey also shows that 70% of the Black Hat USA respondents believe countries with government-mandated encryption backdoors are at an economic disadvantage in the global marketplace, while 84% would never knowingly use a device or program from a company that agreed to install a backdoor.

Bocek added: On a consumer level, people want technology that prioritises the security and privacy of their personal data. This kind of trust is priceless. Encryption backdoors would not only make us much less safe at a national level, they also clearly have the potential to inflict significant economic and political damage.

In July 2019, US attorney general William Barr said consumers should accept the risks that encryption backdoors pose to their personal security to ensure law enforcement can access encrypted communications. But more recently, Canadas public safety minister Ralph Goodale called for his government to work with internet companies to find a balance between internet privacy and the needs of law enforcement.

In December 2018,the parliament of another Five Eyes member, Australia, passed controversial legislation requiring tech businesses to create encryption backdoorswithin their products, prompting criticism from security and privacy advocacy groups, including theElectronic Frontier Foundation(EFF).

The Australian legislation is based on the UKs equally controversialInvestigatory Powers Act, but the Australian law goes a step further by including the power to compel individual network administrators, sysadmins, and open source developers to comply with secret demands, including potentially to force them to keep their cooperation secret from their managers, lawyers and executive leadership.

The US, Canada, Australia and the UK are all members of theFive Eyesintelligence alliance, which in September 2018called on tech firms to include backdoors in their encrypted productsto give access to law enforcement authorities or face various measures.

The group said it encouraged information and communications technology service providers to voluntarily establish lawful access solutions to their products and services, but warned in astatementthat should governments continue to encounter impediments to lawful access to information necessary to aid the protection of the citizens of our countries, we may pursue technological, enforcement, legislative or other measures to achieve lawful access solutions.

View post:
Security pros reiterate warning against encryption backdoors

Documents (or other items) attached to objects, such as Service Requests, in ServicePRO can be encrypted. Encrypting attachments ensures that only those authorized to review the information in the attachment, can do so. Encryption Settings for your Help Desk are managed here.

From the Configuration tab, click on the Encryption option.

The following window appears:

Encryption Settings

Trustees

A trustee is a privileged user who can decrypt any file in ServicePRO with the aid of another trustee.

Enforce Encryption

By checking the boxes beside objects here, users who attach items to these objects will be required to encrypt them.

Select the objects, if any, that your help desk requires encryption.

Passphrase Indicate the minimum number of characters required for encryption passphrases. Obviously, the longer the passphrase, the more secure your encrypted files will be. Users will be required to enter this passphrase for each encrypted file they are authorized to open.Setting an Encryption Passphrase Before you can encrypt a file or be selected as a trustee, a passphrase must be set. To increase security, the passphrase is in addition to the password required to log in to ServicePRO.

User Options - Setting an Encryption Passphrase

Encrypting Attached Files When encryption setup has been completed, file attachment encryption can take place.

Encrypting Attached Files

Decrypting Attached Files

Trustee Decryption On occasion, it might be necessary to decrypt a file when none of the selected users for whom the file was encrypted are available for example, when an employee leaves the company.

Decrypting files in this situation is called Trustee Decryption and requires a minimum of two trustees.

NOTE:If you have specified that a minimum of 3 trustees are required to decrypt the file, then your form will feature with three frames, requiring 3 trustees to enter their information.

Forgotten Passphrases If you forget your passphrase, you can create a new one with the assistance of two trustees.

Changing Trustees To change a trustee, you must have the assistance of another trustee.

Tips and Best Practices Ensure that you have at least three trustees who will not lose or forget their passwords. If an attachment is encrypted, the file will not be recoverable if you do not have the appropriate number of trustees to decrypt the file.

Follow this link:
Encryption - servicepro.wiki

In simple terms, encryption is a secret pass phrase that is applied to the contents of your files to ensure that they are completely unreadable without the means to do so along with that encryption key. Mozy encrypts your files on your computer before they are sent over the Internet to the Mozy cloud. Your files remain encrypted when stored in the Mozy cloud and can only be read if you have both the encryption key and the means to read the encrypted file.

When you install Mozy software, you might be able to select the type of encryption key you want to use for your backups. Whether you can choose and exactly which types of encryption keys are available depends on the type of account you have. MozyHome accounts can choose either the Mozy default encryption key or a personal encryption key. If you use MozyPro or MozyEnterprise, your administrator can determine the encryption key types that you can choose from or whether you can choose at all. That encryption is permanently associated with all files sent to the Mozy cloud from that computer.

You can change the encryption key type after you install the Mozy software. Doing this requires deleting the computer from the account and re-activating the software. If users are permitted to activate the software, a user can re-launch the setup wizard through the software and reactivate. Otherwise, you must uninstall the software, then reinstall and reactivate. The Mozy software then uploads all the files again to ensure that the stored files match the current encryption key.

The type of encryption key that is used determines whether some tasks are seamless and simple or whether extra steps are required. The Mozy default encryption key yields the least complicated experiences. A personal or corporate encryption key requires an extra set of steps for certain tasks. For example, if a personal encryption key is used, that key must be supplied to access files from the Mozy cloud when you use the Mozy mobile app. If a personal or corporate key is used, when you download files from the Mozy cloud using a web browser that you must then also use the Mozy decryption utility to supply that key. If a KMS key is used, you must use the backup software or Restore Manager to download and decrypt files.

With a few exceptions, most features of Mozy are available regardless of which type of encryption key is used.

If you use MozyPro or MozyEnterprise, some features might have been disabled by your administrator. For example, some organizations choose not to permit their users to access their files online.

Mozy separately stores the key. This option lets Mozy automatically decrypt your files when you download or restore them. This is the least complicated, most seamless experience for users, imposing no restrictions on any Mozy features.

To ensure you can download and restore your files, you must either remember your key indefinitely, or you can save it and store it separately. If you choose to save it, a plain text file is saved to the location you choose. The file contains only the characters you entered when creating your key. To ensure you can always provide your key, it is best not to save it only on your computer, which could fail, or only anywhere else which you could easily lose or damage, such as a USB stick.

When you download and restore files, you must supply this key to decrypt those files. Mozy does not have access to your personal encryption key and cannot decrypt files for you. This means that if you lose your key, Mozy cannot help you decrypt your files. Even under force of law, Mozy cannot decrypt your files if you choose to use a personal encryption key. When you reinstall the Mozy software or install it on a replacement computer, you must supply this same key to ensure continued access to files you have previously backed up.

If you choose to use a personal encryption key and you also use the Mozy mobile app, you must provide your personal key to view and download files from the Mozy mobile app. For more information, see Provide Personal Encryption Key in the Mozy Mobile App.

If you choose to use a personal encryption key with Mozy Sync, each instance of the sync software you install must use exactly that same key.

If you use a personal encryption key, several Mozy features are affected.

If you use a corporate encryption key, several Mozy features are affected.

If you use KMS encryption keys, several Mozy features are affected.

If you have a MozyHome account, you can use the same type of encryption key, or the exact same personal encryption key, when you install each instance of the backup software. Or, you can choose to install each instance of the backup software with a different type of encryption key, or a different personal encryption key. You can install Mozy Sync with the same encryption key as the backup software or a different one; however, all your instances of Mozy Sync must use the exact same encryption key. In making these choices during installation, you can choose to create the simplest experience possible when downloading or restoring files. Or, you can choose to be responsible for managing the most secure experience, which can also be the most complex.

If you have a MozyPro or MozyEnterprise account, you might not be able to choose which type of encryption to use. Or, your administrator specifies which types you can choose from. If you can choose, the same considerations that are described for a MozyHome account apply to you as well. As always, if you use Mozy Sync, each installed instance must use not only the same type of encryption, but the exact same key.

With this scheme, you never need to remember or supply an encryption key to use any Mozy features.

With this scheme, you must always be able to provide each key as necessary to use certain Mozy features, particularly when restoring or downloading files, or when installing any Mozy software when you replace any computer.

More:
Mozy Encryption