The battle over encryption, and the role tech companies should play in criminal investigations, has re-emerged after United Kingdom investigators discovered that Khalid Masood, the alleged perpetrator of last weeks terror attack in London, used WhatsApp before the attack.

Four people were killed and 50 others were injured before the attacker was shot and killed by police.

In a Sunday appearance on BBCs Andrew Marr show, U.K. Secretary of State Amber Rudd said the end-to-end encryption capabilities of messaging tools like WhatsApp are completely unacceptable. There should be no place for terrorists to hide, Rudd said, explaining how she believes national security supersedes concerns over privacy.

End-to-end encryption ensures that data is encrypted on one end and can only be deciphered by the recipient, with no third party, including Internet providers, able to intercept the messages. Apple found itself ensnarled in the debate previous year as authorities sought to unlock the phones of the San Bernardino shooters, who killed 14 people at a center for adults with disabilities in December 2015. Eventually, the Federal Bureau of Investigation accessed the devices without Apples assistance.

The tech industry will most likely resist Rudds request for a back door system to allow authorities to retrieve information, as it has in the face of previous law enforcement demands for access to data after major attacks.

And encrypted messaging is becoming a more popular feature, with other services opting to roll out new features. We need to make sure organisations like WhatsApp, and there are plenty of others like that, dont provide a secret place for terrorists to communicate with each other. [.] We need to make sure our intelligent services have the ability to get into situations like encrypted WhatsApp.Earlier today, MP Nadine Dorries also joined the chorus, tweeting that to keep our streets safe, we need to rise up against companies like Apple and WhatsApp who provide space and comfort to terrorists. They are not, she noted.

There is a fine line here, Maltese Interior Minister Carmelo Abela said Monday.

Police made another arrest in Birmingham, where Masood had lived. The 30-year-old is one of two men now being held over possible connection to the attack.

This report contains material from the Associated Press.

View original post here:
'WhatsApp encryption helps terrorists communicate safely' - pppFocus

Breaking encryption technology used by terrorists and criminals poses a frustrating dilemma for intelligence agencies and, most recently, congressional lawmakers.

Bipartisan legislation to create a commission to study U.S. encryption policies and practices is still weeks away from being introduced as discussions continue, congressional aides familiar with the plan told Computerworld.

The commission approach, backed by Sen. Mark Warner (D-Va.) and House Homeland Security Committee Chairman Michael McCaul, (R-Texas) is intended to bring experts together to dive into the differing points of view, where tech companies want to protect privacy with encryption, while the FBI and other law enforcement agencies want to prevent acts of terrorism and crime by monitoring encrypted communications.

Meanwhile, Senate Intelligence Committee Chairman Richard Burr (R-N.C.) and Sen. Dianne Feinstein (D-Calif.) are working on a separate bill that would guarantee law enforcement access to encrypted data, aides said Thursday. The terror attacks in Paris and San Bernardino, Calif., have ignited the debate in Congress over encryption.

The Burr-Feinstein approach is seen as taking a harder line on breaking encryption tech, although policymakers appear to have moved away from language calling for mandating a "back door" to break encrypted apps and communications.

The McCaul-Warner commission approach, meanwhile, is not intended to delay, deflect or bury the planned Burr-Feinstein bill, as some critics have claimed, aides working on the commission legislation contended. Whatever work the commission eventually recommends is expected to have an impact for decades to come, so a deliberate approach is needed, they added.

Both McCaul and Warner and their aides have repeatedly said there's "no silver bullet" legislative approach for solving the encryption dilemma. The lawmakers have pointed out that any U.S. law would only apply to U.S. companies, while many encryption apps and technologies are designed by companies outside the U.S. For example, some terrorists in the Paris attacks used Telegram, a messaging app with end-to-end encryption that was built by a Belgian-based company.

In addition, tech companies have argued that third-party access to decryption keys or other means of breaking encryption could only create a hole for criminals and terrorists to sneak through.

The debate over encryption policy in Washington was addressed by two other top officials speaking before think tanks in recent days.

On Thursday, Senate Homeland Security Chairman Ron Johnson (R-Wis.), said that legislating encryption standards might "do more harm than good" in the fight against terrorism, according to The Hill website.

"Is it really going to solve any problems if we force our companies to do something here in the U.S.?" he asked at a presentation at the American Enterprise Institute, a conservative think tank. "It's just going to move offshore."

Johnson also said that encryption helps protect personal information, a position strongly backed by Apple CEO Tim Cook and other tech companies. Apple has been among the most vocal in defending its privacy policies with end-to-end encryption.

On Jan. 21, National Security Agency Director Adm. Michael Rogers told an audience that "encryption is foundational to the future." In remarks at the Atlantic Council, an international affairs think tank, Rogers said that spending time arguing that encryption is bad and should be done away with is a "waste of time." Rogers' comments are recorded in video at The Intercept.

Professor Darren Hayes, director of cybersecurity at Pace University, said he supports the idea of a congressional commission to review encryption laws and policies.

"The whole idea of government access to communications is nothing new," Hayes said in an interview. "Every telecom company has to set up their infrastructure so that law enforcement can set up a wiretap" subject to a court order.

He also said that some type of legal step may be needed to gain greater access. "The vast majority of companies will never hand over data without any kind of warrant or subpoena. The idea that companies will help out law enforcement is not true at all."

Hayes has served as a forensics encryption specialist in more than two dozen criminal cases in the New York area since 2008 to help prosecutors bring cases against people accused of being pedophiles and other crimes who have resorted to hiding criminal activity with encrypted data.

Hayes is well aware that any U.S. law on encryption wouldn't apply to other countries, but said a broad-based discussion "is a good discussion to have The list is growing of potential prosecutions held up by [not having] a full disclosure of encrypted data." In any event, he added, "I'm a big proponent that you have to have a warrant to gain access."

Two representatives for tech companies based in Silicon Valley said recently in interviews that they were open to the idea of creating a congressional commission, but would want to review the final legislation before signing on.

Conversely, Kevin Bocek, vice president of cybersecurity for Venafi, called the idea of creating an encryption commission "very concerning." Venafi works with 250 large banks and retailers in setting up encryption and authorization software to protect their data.

In an interview, Bocek said he is worried that creating the commission could turn into an entity that is powerful and ominous. "I don't understand how an encryption commission is going to deal with encryption already being widely used," he said. "It's counterproductive and more productive to talk about how to live in a world with encryption and how to safeguard national security."

Bocek said there was a broad national discussion about cryptography policy that was fought in the 1990s. "The crypto wars of the 1990s won freedom and there's no sense in moving backwards," he said. "Encryption controls were very painful years ago and here we are again, facing the same problem which can harm American business. Encryption, keys and certificates must be free Blanket legislation will do nothing but cause more problems."

In 1996, the National Academy of Sciences published a 688-page document entitled Crytography's Role in Securing the Information Society. In the executive summary, the authors wrote a preamble that seems to summarize the ongoing encryption debate in 2016: "U.S. policy should be changed to promote and encourage the widespread use of cryptography for the protection of the information interests of individuals, businesses, government agencies and the nation as a whole, while respecting legitimate national needs of law enforcement and intelligence for national security and foreign policy purposes to the extent consistent with good information protection."

Go here to see the original:
Encryption bills pose challenges for Congress | Computerworld

Encryption is the mathematical science of codes, ciphers, and secret messages. Throughout history, people have used encryption to send messages to each other that (hopefully) couldn't be read by anyone besides the intended recipient.

Today, we have computers that are capable of performing encryption for us. Digital encryption technology has expanded beyond simple secret messages; today, encryption can be used for more elaborate purposes, for example to verify the author of messages or to browse the Web anonymously with Tor.

Under some circumstances, encryption can be fairly automatic and simple. But there are ways encryption can go wrong, and the more you understand it, the safer you will be against such situations.

One of the most important concepts to understand in encryption is a key. Common types of encryption include a private key, which is kept secret on your computer and lets you read messages that are intended only for you. A private key also lets you place unforgeable digital signatures on messages you send to other people. A public key is a file that you can give to others or publish that allows people to communicate with you in secret, and check signatures from you. Private and public keys come in matched pairs, like the halves of a rock that has been split into two perfectly matching pieces, but they are not the same.

Another extremely valuable concept to understand is a security certificate. The Web browser on your computer can make encrypted connections to sites using HTTPS. When they do that, they examine certificates to check the public keys of domain names(like http://www.google.com, http://www.amazon.com, or ssd.eff.org). Certificates are one way of trying to determine if you know the right public key for a person or website, so that you can communicate securely with them.

From time to time, you will see certificate-related error messages on the Web. Most commonly, this is because a hotel or cafe network is trying to break your secret communications with the website. It is also common to see an error because of a bureaucratic mistake in the system of certificates. But occasionally, it is because a hacker, thief, police agency, or spy agency is breaking the encrypted connection.

Unfortunately, it is extremely difficult to tell the difference between these cases. This means you should never click past a certificate warning if it relates to a site where you have an account, or are reading any sensitive information.

The word "fingerprint" means lots of different things in the field of computer security. One use of the term is a "key fingerprint," a string of characters like "342e 2309 bd20 0912 ff10 6c63 2192 1928" that should allow you to uniquely and securely check that someone on the Internet is using the right private key. If you check that someone's key fingerprint is correct, that gives you a higher degree of certainty that it's really them. But it's not perfect, because if the keys are copied or stolen someone else would be able to use the same fingerprint.

Read more:
What Is Encryption? | Surveillance Self-Defense

Traditionally, ciphers have used information contained in secret decoding keys to code and decode messages. The process of coding plaintext to create ciphertext is called encryption and the process of decoding ciphertext to produce the plaintext is called decryption. Modern systems of electronic cryptography use digital keys (bit strings) and mathematical algorithms ( encryption algorithms ) to encrypt and decrypt information.

There are two types of encryption: symmetric key encryption and public (asymmetric) key encryption. Symmetric key and public key encryption are used, often in conjunction, to provide a variety of security functions for network and information security.

Encryption algorithms that use the same key for encrypting and for decrypting information are called symmetric-key algorithms. The symmetric key is also called a secret key because it is kept as a shared secret between the sender and receiver of information. Otherwise, the confidentiality of the encrypted information is compromised. Figure14.1 shows basic symmetric key encryption and decryption.

Figure14.1 Encryption and Decryption with a Symmetric Key

Symmetric key encryption is much faster than public key encryption, often by 100 to 1,000 times. Because public key encryption places a much heavier computational load on computer processors than symmetric key encryption, symmetric key technology is generally used to provide secrecy for the bulk encryption and decryption of information.

Symmetric keys are commonly used by security protocols as session keys for confidential online communications. For example, the Transport Layer Security (TLS) and Internet Protocol security (IPSec) protocols use symmetric session keys with standard encryption algorithms to encrypt and decrypt confidential communications between parties. Different session keys are used for each confidential communication session and session keys are sometimes renewed at specified intervals.

Symmetric keys also are commonly used by technologies that provide bulk encryption of persistent data, such as e-mail messages and document files. For example, Secure/Multipurpose Internet Mail Extensions (S/MIME) uses symmetric keys to encrypt messages for confidential mail, and Encrypting File System (EFS) uses symmetric keys to encrypt files for confidentiality.

Cryptography-based security technologies use a variety of symmetric key encryption algorithms to provide confidentiality. For more information about the specific encryption algorithms that are used by security technologies, see the applicable documentation for each technology. For more information about how the various symmetric key algorithms differ, see the cryptography literature that is referenced under "Additional Resources" at the end of this chapter.

Encryption algorithms that use different keys for encrypting and decrypting information are most often called public-key algorithms but are sometimes also called asymmetric key algorithms . Public key encryption requires the use of both a private key (a key that is known only to its owner) and a public key (a key that is available to and known to other entities on the network). A user's public key, for example, can be published in the directory so that it is accessible to other people in the organization. The two keys are different but complementary in function. Information that is encrypted with the public key can be decrypted only with the corresponding private key of the set. Figure14.2 shows basic encryption and decryption with asymmetric keys.

Figure14.2 Encryption and Decryption with Asymmetric Keys

The RSA digital signature process also uses private keys to encrypt information to form digital signatures. For RSA digital signatures, only the public key can decrypt information encrypted by the corresponding private key of the set.

Today, public key encryption plays an increasingly important role in providing strong, scalable security on intranets and the Internet. Public key encryption is commonly used to perform the following functions:

Encrypt symmetric secret keys to protect the symmetric keys during exchange over the network or while being used, stored, or cached by operating systems.

Create digital signatures to provide authentication and nonrepudiation for online entities.

Create digital signatures to provide data integrity for electronic files and documents.

See more here:
Encryption - technet.microsoft.com