« First...102030...1,8091,8101,8111,8121,813...1,8201,8301,840...Last »

WikiLeaks Documentary Evolves With Its Subject, Year After Premiere – New York Times

Posted on by

New York Times
WikiLeaks Documentary Evolves With Its Subject, Year After Premiere
New York Times
Laura Poitras's film Risk is an up-close look at the WikiLeaks founder Julian Assange that has changed dramatically after disclosures in the U.S. presidential ...
Showtime to Release Wikileaks Documentary 'Risk' by Laura Poitras ...Variety
Showtime picks up Wikileaks documentary Risk, releases new trailerA.V. Club
Showtime Sets WikiLeaks DocumentaryMultichannel News
The Hill -gulfnews.com -YouTube
all 20 news articles »

Here is the original post:
WikiLeaks Documentary Evolves With Its Subject, Year After Premiere - New York Times

Found in the wild: Vault7 hacking tools WikiLeaks says come from CIA – Ars Technica

Posted on by

Malware that WikiLeaks purports belongs to the Central Intelligence Agency has been definitively tied to an advanced hacking operation that has been penetrating governments and private industries around the world for years, researchers from security firm Symantec say.

Malware used by Longhorn bears an uncanny resemblance to tools and methods described in the Vault7 documents. Near-identical matches are found in cryptographic protocols, source-code compiler changes, and techniques for concealing malicious traffic flowing out of infected networks. Symantec, which has been tracking Longhorn since 2014, didn't positively link the group to the CIA, but it has concluded that the malware Longhorn used over a span of years is included in the Vault7 cache of secret hacking manuals that WikiLeaks says belonged to the CIA. Virtually no one is disputing WikiLeaks' contention that the documents belong to the US agency.

"Longhorn has used advanced malware tools and zero-day vulnerabilities to infiltrate a string of targets worldwide," Symantec researchers wrote in a blog post published Monday. "Taken in combination, the tools, techniques, and procedures employed by Longhorn are distinctive and unique to this group, leaving little doubt about its link to Vault7."

Exhibit A in Symantec's case are Vault7 documents describing malware called Fluxwire. The changelog tracking differences from one version to the next match within one to a few days the changes Symantec found in a Longhorn trojan known as Corentry. Early versions of Corentry also show that its developers used the same program database file location specified in the Fluxwire documentation. A change in Fluxwire version 3.5.0 that removes the database file path also matches changes Symantec tracked in Corentry. Up until 2014, Corentry source code was compiled using the GNU Compiler Collection. Then on February 25, 2015, it started using the Microsoft Visual C++ compiler. The progression matches changes described in Vault7 documentation.

Yet more similarities are found in a Vault7 malware module loader called Archangel and a specification for installing those modules known as Fire and Forget. The specification and modules described match almost perfectly with a Longhorn backdoor that Symantec calls Plexor.

Another Vault7 document prescribes the use of inner cryptography within communications already encrypted using the secure sockets layer protocol, performing key exchanges once per connection, and the use of the Advanced Encryption Standard with a 32-bit key. Still other Vault7 documents outline the use of the real-time transport protocol to conceal data sent to command-and-control servers and a variety of similar "tradecraft practices" to keep infections covert. While malware from other groups uses similar techniques, few use exactly the same ones described in the Vault7 documents.

According to Symantec:

While active since at least 2011, with some evidence of activity dating back as far as 2007, Longhorn first came to Symantecs attention in 2014 with the use of a zero-day exploit (CVE-2014-4148) embedded in a Word document to infect a target with Plexor.

The malware had all the hallmarks of a sophisticated cyberespionage group. Aside from access to zero-day exploits, the group had preconfigured Plexor with a proxy address specific to the organization, indicating they had prior knowledge of the target environment.

To date, Symantec has found evidence of Longhorn activities against 40 targets spread across 16 different countries. Symantec has seen Longhorn use four different malware tools against its targets: Corentry, Plexor, Backdoor.Trojan.LH1, and Backdoor.Trojan.LH2.

Before deploying malware to a target, Longhorn will preconfigure it with what appears to be target-specific code words and distinct C&C domains and IP addresses to communicate with. Longhorn uses capitalized code words, internally referenced as groupid and siteid, which may be used to identify campaigns and victims. Over 40 of these identifiers have been observed, and typically follow the theme of movies, characters, food, or music. One example was a nod to the band The Police, with the code words REDLIGHT and ROXANNE used.

Longhorns malware has an extensive list of commands for remote control of the infected computer. Most of the malware can also be customized with additional plugins and modules, some of which have been observed by Symantec.

Longhorns malware appears to be specifically built for espionage-type operations, with detailed system fingerprinting, discovery, and exfiltration capabilities. The malware uses a high degree of operational security, communicating externally at only select times, with upload limits on exfiltrated data, and randomization of communication intervalsall attempts to stay under the radar during intrusions.

For C&C servers, Longhorn typically configures a specific domain and IP address combination per target. The domains appear to be registered by the attackers; however they use privacy services to hide their real identity. The IP addresses are typically owned by legitimate companies offering virtual private server (VPS) or webhosting services. The malware communicates with C&C servers over HTTPS using a custom underlying cryptographic protocol to protect communications from identification.

Prior to WikiLeaks publishing its Vault7 materials, Symantec had regarded Longhorn as a well-resourced organization that engaged in intelligence-gathering operations. Researchers based that assessment on Longhorn's global range of targets and its ability to use well-developed malware and zero-day exploits. Symantec also noted that the group appeared to work a standard Monday-though-Friday work week, based on timestamps and domain name registration dates, behavior which is consistent with state-sponsored groups. Symantec also uncovered indicatorsamong them the code word "scoobysnack"and software compilation timesthat showed Longhorn members spoke English and likely lived in North America.

Since WikiLeaks published its first Vault7 installment in early March, there has been no outside source to either confirm or refute the authenticity of the documents. The Symantec research establishes without a doubt that the malware described in the trove is real and has been used in the wild for at least six years. It also makes a compelling case that the group that's responsible is the CIA.

Read more:
Found in the wild: Vault7 hacking tools WikiLeaks says come from CIA - Ars Technica

U.S. NSA hacked Pakistani mobile system: WikiLeaks – DunyaNews Pakistan

Posted on by

Last Updated On 10 April,201710:39 am

WikiLeaks released hundreds of NSA cyber weapons variants.

(Daily Dunya) - WikiLeaks has unearthed documents stating USs National Security Agency (NSA) has allegedly spied on Pakistani civilian and military leadership in the past.

NSA is responsible for global monitoring, collection, and processing of information and data for foreign intelligence and counterintelligence purposes in the USA.

Edward Snowden, a former NSA employee, has also suggested in the past that NSA used wiretapping and cyber weapons to spy on many international leaders.

On Saturday, WikiLeaks revealed hundreds of cyber weapons variants which include code pointing towards NSA hacking Pakistan mobile system.

The link shared in the tweet by WikiLeaks official account points to a Github repository containing the decrypted files pertaining to NSA cyber weapons. A complete analysis of these files by a cyber security expert is needed to further highlight the severity of the situation.

Initial impressions, however, seem to indicate that these leaks will certainly provide more substance to previous allegations against NSA.

See the article here:
U.S. NSA hacked Pakistani mobile system: WikiLeaks - DunyaNews Pakistan

Yes: Assange willfully set out to destroy the West, should face punishment – Arizona Daily Star

Posted on by

The United States may soon have the opportunity to request the extradition of WikiLeaks leader Julian Assange to its shores, which would allow criminal proceedings against him to finally begin.

Given his focused mission to cause momentous damage to the United States by disclosing secret and highly classified information, prosecution would be totally justified.

Lets put this in context.

I am a strong supporter of exposing government corruption and wrongdoing. I also believe whistleblowers are the appropriate mechanism of last resort for accomplishing that goal.

But theres a process whistleblowers must follow. It may not be perfect, but it allows abuses to be identified without compromising national security interests.

Whistleblowers in the intelligence community, including those working in the Defense Intelligence Agency, National Security Agency and the Central Intelligence Agency, have such paths outlined in a precise manner.

The process allows for the exposure of corruption while protecting classified information and ensuring that whistleblowers do not face retaliation. This is a balanced approach that protects all parties.

Those who operate outside of the process Chelsea Manning, Edward Snowden, the recent leakers at the CIA and those who leaked the information on former National Security Adviser Mike Flynn are criminals. They broke the law and blatantly ignored the avenues established for whistleblowers.

Manning was accordingly charged and convicted. Snowden, still hiding abroad, should be tried and convicted. The more-recent leakers must be, too.

These leakers all assumed roles well beyond their job descriptions. They perceived themselves as singularly possessing the authority and the judgment to determine right and wrong and, in turn, jeopardized the security of the country not to mention their colleagues.

Assange is no different. While he may not have actually physically stolen information, Assange has claimed possession of stolen materials and published them for the world to see. His public comments and actions clearly outline his motives and desire to fundamentally damage the West, the United States in particular.

There will be thousands of pages of legal debate written about Assange. The back-and-forth will focus on whether his actions constitute a new type of newsgathering and are thereby sheltered free speech.

Theyre clearly not, though, and he ought to be tried and found guilty.

Moving forward, Congress must strengthen whistleblower protections, direct our intelligence agencies to better secure sensitive and classified data, and put in place a modern legal framework to prosecute those who leak and make available classified information. These measures will ultimately protect the United States and its citizens from traitors and individuals seeking its demise.

A former chairman of the U.S. House intelligence committee, Pete Hoekstra is a senior fellow at the Investigative Project on Terrorism.

Go here to see the original:
Yes: Assange willfully set out to destroy the West, should face punishment - Arizona Daily Star

Private sector’s national cybersecurity strategy contributions lacking – TechTarget

Posted on by

The U.S. government has been very public about its concern for national cybersecurity. There have been grandiose speeches, presidential declarations and several attempts by the legislature to pass new cybersecurity laws. But the problem with America's national cybersecurity strategy is bigger than one-off hacks or data thefts. Crimes perpetrated by the likes of Edward Snowden, Chelsea Manning and the individual(s) who committed the alleged leak of the CIA's highly sensitive cyber warfare tools have resulted in mind-blowing losses.

Beyond those headline grabbers is a problem that gets less attention but poses a significant risk to critical national assets: the fact that private sector businesses operate -- but do not adequately protect -- a vast majority of the nation's critical infrastructure and data.

The federal government, and even the largest private sector enterprises, spend billions on cybersecurity investment but fail to extend those efforts into the SMBs that do much of the legwork. Laws are passed that promise to protect sensitive government information and "critical" systems, but the regulations are fine-tuned to work for the business community, effectively neutering enforcement mechanisms. Until there are real ramifications for cybersecurity failures in government and private sector entities that support the government, we will continue to see national security erode.

Private companies should be responsible for the public interest and implement precautions to minimize security failures that potentially undermine national defense.

Consider, for example, the fallout from a 2013 report that found designs for some of the most sensitive, advanced U.S. weapons systems were hacked by a foreign country. Although it is a serious issue that those weapons systems are now compromised and have likely been duplicated by at least one foreign military, there is no sign of any punishment for the private companies that allowed the theft in the first place. In fact, the companies and their subcontractors that made the stolen systems will ultimately benefit from the espionage: There are a limited number of prime contractors that can perform this work, so the companies from which the systems were stolen will most likely build any replacement systems, if they have not already done so. There is no evidence that the contractors have lost work or otherwise paid for their failure. Until the cost of failure is higher than implementing real security technology, we will continue to see poor choices that lead us to cybersecurity failure.

I first wrote about the potential for a digital D-Day in 2005, then again in 2012. In the years since, we have sadly not come very far in advancing cyber protection of our most important systems. We are still allowing the private sector to decide what assets are critical and how they should protect them. This is true even where their product, service or infrastructure has a direct role in our national cybersecurity strategy and the U.S. government's operational continuity.

Private companies should be responsible for the public interest and implement precautions to minimize security failures that potentially undermine national defense. Cybersecurity professionals who falsely attest to security should be held accountable in the same way business executives are held accountable when their companies violate financial regulations.

But the reality is that the lack of resources within private companies, combined with no serious government enforcement, lead to little constructive action. As long as the U.S. continues to accept the lowest bids and/or sole-source providers in government contracting without serious consideration for their cyber hygiene, we will not see change.

In defense of the contractors, I do believe companies should be able to include burdensome security expenses when submitting bids. Security should be rewarded as a competitive advantage and in the interest of national security.

But if a bidder is found to have not initiated the protections they attested to, they should be penalized. How is a failure to protect U.S. national secrets by not meeting minimum cybersecurity requirements, and, in some cases, committing blatant willful neglect, not considered criminal negligence?

Under International Traffic in Arms Regulations (ITAR) one can get a decade in prison for unlawfully exporting defense technology. Punishments for export violations range from criminal penalties of "up to $1 million per violation and up to 10 years in prison" and for civil violations "seizure and forfeiture of articles, revocation of exporting privileges" with fines of up to $500,000 per violation. One Tennessee professor received 14 months in prison for "exporting military technology" when he taught foreign students about information that the professor didn't even know was protected. In his case, the prosecuting Assistant U.S. Attorney said, "Prison time is appropriate to avoid the appearance of a mere slap on the wrist for so serious of an offense involving national security." A mere accident on the part of this professor is a severe crime in the eyes of the government, but a cyber breach that results in dozens of our most important weapons system being stolen results in no action? We should treat willful neglect of cybersecurity hygiene that results in national security breaches by foreign countries as export violations as well.

As a cybersecurity professional, I know there is no such thing as foolproof cybersecurity: Perfection is not achievable, and even a great defensive posture may not be enough against a determined actor. Organizations are all challenged with the cost and distraction of cybersecurity requirements, but may not be doing enough because, frankly, they just do not feel compelled to make a real effort when it comes to cybersecurity.

For example, some organizations are under such tight pricing constraints that realistic security measures are just not possible. In order to survive, these organizations must gamble on this lack of security and hope they are never a target for hacking, or even audited. Other organizations are simply woefully uneducated on their security obligations, and still others sincerely try to understand these obligations but still do not succeed.

By design, U.S. cybersecurity laws and regulations are ambiguous and flexible. This flexibility, while intended to make it easier for organizations to comply, really makes it that much harder by not spelling out, in clear terms, what private sector organizations actually must do. We must insist that private sector companies work toward becoming secure, and then assist them when taking the necessary steps to help further the national cybersecurity strategy.

While I do not propose rushing into actions haphazardly, we must not just keep planning. We should start by:

With each administration there is a renewed commitment and refreshed cybersecurity directives that result in nothing of consequence. There has been a renewed cybersecurity focus as foreign actors show their cards, so it is time that we do something impactful. The bottom line is we are running out of time before cybersecurity threats to our critical infrastructure result in an actual catastrophic attack. The time for action is now.

More on national cybersecurity strategy:

Ask the Expert: How has the FITARA law influenced U.S. cybersecurity?

After government breaches, Pentagon cybersecurity under fire

Secret Service audit reveals cybersecurity flaws

Read more:
Private sector's national cybersecurity strategy contributions lacking - TechTarget

Assange deserves stiff punishment for putting US in peril – Canada Free Press

Posted on by

Congress must strengthen whistleblower protections, direct our intelligence agencies to better secure sensitive and classified data and put in place a modern legal framework to prosecute those that leak and make available classified information

WASHINGTON, D.C. The United States may soon have the opportunity to request the extradition of Julian Assange to the United States.

The U.S. can then finally begin criminal proceedings against him for the crimes he has committed.

It is clear that Assange has a single-focused mission to cause momentous damage and harm to the United States by disclosing secret and highly classified information. Now he can finally be held accountable.

Lets put this in context. I am a strong supporter of exposing government corruption and wrongdoing.

I also believe the appropriate mechanism of last resort is through whistleblowers. When all other means have been exhausted whistleblowers have the responsibility to approach the proper authorities to expose illegal or unethical conduct.

Whistleblowers are an avenue for exposing government wrongdoing. While there needs to be increased protection for government whistleblowers, an imperfect process does exist that allows for the identification of abuses while protecting national security interests.

Whistleblowers in the intelligence community, including those working in the Defense Intelligence Agency, National Security Agency and the Central Intelligence Agency, have paths outlined in a precise manner.

That allows for the exposure of corruption, protects classified information, and insures that whistleblowers do not face retaliation. This is a balanced approach and protects all parties.

Those that operate outside of the process like Bradley Manning, Edward Snowden, the recent leakers at the CIA and those who leaked the information on Mike Flynn are criminals. They had broken the law and ignored avenues established for whistleblowers.

Accordingly, Manning was charged and convicted. Edward Snowden should be tried and convicted and the recent leakers on Mike Flynn and those at the CIA must be too.

These leakers have all assumed much larger roles than their jobs allowed. They perceived themselves to be the only morally correct people with the authority and the judgment to determine right and wrong, what information needed to be in the public domain or kept secret, and whether its exposure was warranted even though it was classified as secret.

No one gave the leakers these authorities or this 20/20 judgment. They assumed it for themselves. It in turn jeopardized the security of the country. They may also have risked the security of their colleagues by disclosing such sensitive information.

Julian Assange is no different. While he may not have actually stolen the information, Assange claimed possession of those stolen materials and published them for the world to see. His public comments and actions clearly outline his motives.

Julian Assange has an inherent desire to fundamentally damage and destroy the West with a focus and emphasis on the United States.

Assanges attacks, while considerably international, have focused primarily on the West, but more specifically, on the U.S. His actions have never included measures against Russia, China or other countries significantly less free and open than those in the West.

There will be thousands of pages of legal debate that will be written about Assange. The debate will discuss whether or not he should be protected from prosecution because his actions represent a new media and therefore is sheltered by free speech.

Im hopeful that the future for Assange is that he is criminally charged and convicted for his illicit behavior towards the United States. The courts and a jury will, in the end, determine his fate. It is crucial that the trial take place.

Julian Assange has done significant damage to our national security. That has been his expressed intent.

Todays legal framework should recognize this and find him guilty. And if a trial results in Julian Assange finding a safe haven to protect him from conviction, then we will need to recognize that our laws are inadequate and must be updated.

Edward Snowden demonstrated that Bradley Manning was not an anomaly. Manning was just the first. He represented a new wave of traitors that have caused significant damage through the availability of data in cyberspace.

As a result, we will inevitably come to realize that Julian Assange will only be the first of many to take mass quantities of data to the public.

Moving forward in this new era, Congress must strengthen whistleblower protections, direct our intelligence agencies to better secure sensitive and classified data and put in place a modern legal framework to prosecute those that leak and make available classified information. These measures will ultimately protect the United States and its citizens from traitors and individuals seeking its demise.

A former Chairman of the U.S. House Intelligence Committee, Pete Hoekstra is a senior fellow at the Investigative Project on Terrorism and a graduate of the University of Michigans School of Business. Readers may write him at IPT, 5614 Connecticut Ave. NW, Suite 34, Washington, D.C. 20015

See the article here:
Assange deserves stiff punishment for putting US in peril - Canada Free Press

Snowden wasn’t a Russian agent, but a traitor just the same – The Hill (blog)

Posted on by

I have to admit that I was surprised when a friend contacted me to tell me that Edward Snowden used a clip of an interview that I did with Chris Inglis, former deputy director of the NSA, in an interview of him at South by Southwest.

For some reason, Snowden does not want people to think that he was a Russian agent, and Inglis's comments support that belief. That being said, it is important to realize why this is incredibly irrelevant.

Snowden using valuable time during an interview to contend he was never a Russian agent is an example of him trying to confuse his actions. It in no way changes the damages caused or the crimes committed. It might matter in how he is prosecuted, but it has no bearing on any significant aspect of his crimes.

The agent might or might not be aware that he or she is providing information to a foreign spy depending upon how the operative approaches the agent. An operative is much more of a puppet master than a James Bond.

Many operatives are under diplomatic cover, but some operatives are also under what is referred to as non-official cover (NOCs). Valerie Plame, whose cover was blown by the George W. Bush administration for political retribution, is an example of a NOC. She worked for a variety of front operations around the world, but had primary responsibility to gather information.

Regarding Snowden, Inglis stated during the interview that Snowden's actions were too haphazard to be planned, implying that Snowden was not an official Russian agent. However, the fact that Snowden was not an agent in no way changes the fact that he intentionally committed espionage and treason, and can therefore be considered a traitor. The fact he asked for asylum in Russia makes him a defector.

And for the record, he is not stuck in Russia as he can just walk to the U.S. embassy and turn himself in. (Also, Russian President Vladimir Putin issued a passport to American actor Steven Segal. I'm sure he will give Snowden a passport as well, if he asks.)

Remember, Snowden has specifically stated that he applied for a job at Booz Allen so he would have better access to steal information. That is a clear statement of planning and intent to target and steal information. While it doesn't matter whom his intended customer was, the fact he chose to go to China to turn over information to a third party when he had the opportunity to meet journalists Glenn Greenwald and Laura Poitras anywhere else in the world speaks to his intent.

Snowden's haphazard actions might demonstrate he wasn't an official Russian agent, but the impact was the same. The distinction doesn't matter. Now, anyone with minimal knowledge would have plotted a cleaner defection. But just because he was not good at it does not mean he is not a traitor and defector.

I will, however, add that the fact that Snowden was not a Russian agent before leaving the U.S. doesn't help him, but it is stupid of him to highlight this. In the world of espionage, even members of Russian intelligence agencies would not have much respect for him. While they welcome abusing his status and information, Snowden is a traitor and defector to the espionage world as a whole. He would be perceived as being willing to betray them even quicker than he betrayed the United States.

There is a generally accepted unofficial rule that intelligence agencies do not extradite foreign agents who defect to them. Even despite the lack of respect, they don't want to discourage future agents from working with them. Snowden has excluded himself from such protection, though, so anytime Putin wants to hand Trump a big win, he can hand over Snowden without violating protocol.

So no, Edward Snowden might not have been a Russian agent. But he is a Russian stooge, and a traitor and defector by default.

Ira Winkler is president of Secure Mentem, a security awareness company. He is one of the foremost experts in the human elements of cybersecurity and the author of several books, most recently "Advanced Persistent Security." He has previously worked for the National Security Agency and served as president of the Internet Security Advisors Group, chief security strategist at HP Consulting and director of Technology of the National Computer Security Association. He has also served on the graduate and undergraduate faculties of Johns Hopkins University and the University of Maryland. He and his work have been featured in a variety of media outlets including CNN, The Wall Street Journal, USA Today, the San Francisco Chronicle and Forbes, among others.

The views of contributors are their own and not the views of The Hill.

View original post here:
Snowden wasn't a Russian agent, but a traitor just the same - The Hill (blog)

US National Security Agency hacked into Pak mobile networking system, claims Wikileaks – The Indian Express

Posted on by

The Nation
US National Security Agency hacked into Pak mobile networking system, claims Wikileaks
The Indian Express
This is not the first time that reports of NSA spying on other countries has surfaced. It was reported that the NSA authorised to spy on foreign-based political organizations including the Bharatiya Janata Party (BJP) from India and the Pakistan ...
American NSA hacking into Pakistan's mobile system: WikiLeaksThe Nation
Top US spy agency hacked Pakistan's most popular mobile network, claims WikiLeaksDaily Pakistan

all 5 news articles »

See more here:
US National Security Agency hacked into Pak mobile networking system, claims Wikileaks - The Indian Express

View: India is worried that the West will always have free access to … – Economic Times

Posted on by

By Kamlesh Bajaj

Encryption and lawful government-access debate raging for over two decades has become more important in present scenario of ever increasing cyber crimes and terrorism. EastWest Institute's seventh Global Cybersecurity Summit, held at University of California, Berkeley , from March 14-16, included this as an important part of the summit agenda. It looked at policy development in the United States, India and Europe. Both the threat landscape and technology landscape have changed during this period. Encryption was not easy to deploy in the 1990s though it was available since it required high skills to use it. Hence, the intercepted communications were largely in plain text. Clipper and key escrow, though presented as solutions for lawful government access, were not accepted by technologists.

It was concluded that the society would be exposed to more risk if either of these were to be compromised.

The technology developments during the last few years have made it easier for encryption to be used.End-to-end encryption (E2EE) is provided by apps such as WhatsApp and Telegram which are overthe-top (OTT) applications. Encryption keys, which are ephemeral, are with the end-user. Since app providers don't have keys, they can't enable access to law-enforcement agencies, even if they have a court warrant. This is a unique situation where even with a warrant, the law-enforcement can't access data in a device of a suspect or shared via an E2EE app.

There is universal agreement that strong encryption is essential for secure e-transactions, both by the government and industry . But then, is the cyberspace `going dark' to use the famous phrase of the FBI Director? Is the law-enforcement unable to track terrorists and investigate crimes involving criminals using encryption?

There is increasing use of encrypted smartphones such as the Apple. E2EE messaging traffic is also on the rise, with terrorists using E2EE apps to communicate. This traffic is already touching 275 billion messages per day .Is the Internet truly going dark?

In the `going dark' debate, cryptographers and others have come up with a number of policy options which centre around the following: weak encryption not a solution, hence law-enforcement needs to work around strong encryption by learning to use metadata which continues to grow in the form of location data and call data records; cooperate with tech companies; above all use lawful hacking of devices under court warrant. Compelled disclosure too is an option that law-enforcement often resorts to.

Lawful hacking is possible only for known vulnerabilities, which is often a small subset of the vulnerabilities in a target device. It is the vulnerabilities in underlying software platforms operating system, browser or apps that are exploited before encryption takes place in a device, which enables access to plaintext. So, law-enforcement would like to discover or pay to find as many vulnerabilities and exploits, as possible. They are thus not worried about having to decrypt strong encryption.

Governments have the responsibility to enhance cybersecurity and promote trust in cyberspace. The agencies that discover vulnerabilities should let the vendors know, so that these are plugged through software patches.

Cyber surveillance and weapon development is old story. What is new is that it is lawful hacking under court orders that is trying to keep the underlying IT platforms vulnerable. Do we need an encryption policy at all? It is this that reinforces suspicion among policy makers in countries like India, that notwithstanding any encryption policy instrument, the US and the UK will have access to all encrypted data, while India will be advised to work with tech companies and use metadata! No wonder, the Indian government has been unable to come up with a revised encryption policy after it withdrew the draft policy in September 2015.

(Kamlesh Bajaj is ex-CEO, Data Security Council of India)

See the original post here:
View: India is worried that the West will always have free access to ... - Economic Times


« First...102030...1,8091,8101,8111,8121,813...1,8201,8301,840...Last »