SE Labs

Posts tagged 'government'

The Government Encryption Enigma

big-brother-nsa-snooping-8039934
Is Amber Rudd right about encryption? Jon Thompson isn’t so sure.

UK Home Secretary Amber Rudd recently claimed in an article that “real people” prefer ease of use to unbreakable security when online. She was met immediately by outrage from industry pundits, but does she have a point?

Though paywalled, as reported elsewhere, Rudd asks in her article, “Who uses WhatsApp because it is end-to-end encrypted, rather than because it is an incredibly user-friendly and cheap way of staying in touch with friends and family?”

Rudd name-checked Khalid Masood, who used WhatsApp minutes before he drove a van into pedestrians on Westminster Bridge killing three, and then fatally stabbed a police officer outside Parliament before being shot dead. However, Masood was not part of any MI5 investigation. In fact, a week after the attack, police had to appeal for information about him. His final WhatsApp message seems to have been the first sign that he was about to strike. The recipient was entirely innocent, and knew nothing of his murderous intentions.

There are plenty of other atrocities that were planned in part via social media apps. The attacks on Paris in December 2015, and the Stockholm lorry attack to name but two. In the UK the new UK Investigatory Powers Act 2016 (IPA), which caused so much fuss last year, can compel vendors to decrypt. So, why not just use that? The answer is somewhat complicated.

The IPA makes provision for Communications Service Providers to be served with a notice that they must remove encryption from messages to assist in the execution of an interception warrant. Apart from Providers needing access to private decryption keys, reports suggest that any move to enforce this measure would meet stiff opposition, and may not even be enforceable.

Many of the most popular secure messaging apps use the Signal Protocol, developed by Open Whisper Systems. This is a non-profit organisation and lies outside the UK’s jurisdiction, so its compliance would be difficult to obtain, even if the companies using the protocol agreed to re-engineer their platforms to include backdoors, or to lower encryption standards. There are also plenty of other issues to be resolved if Rudd is to get her way.

If the government mandates weaker encryption for messaging apps in the UK, then companies will face difficult business choices and technological challenges. It boils down to a choice: they could weaken their encryption globally, or they could just weaken encryption in the UK. But what happens
if you send a secure message from outside the UK to someone inside the country? Can the UK authorities read it? Can the recipient, using a lower encryption standard, decrypt it? How would international business communications work if the UK office doesn’t use the same encryption standard as a foreign parent company?

This isn’t the first time the UK government has attempted to find an answer to the problem of encryption. Back in January 2015, the then-Prime Minister David Cameron gave a speech in which he said there should be no means of communication “which we cannot read”. He was roundly criticised as “technologically illiterate” by opposition parties, and later clarified his views, saying he didn’t want to ban encryption, just have the ability to read anyone’s encrypted communications.

amber2brudd-2638730Authoritative voices have since waded into the argument. Lord Evans, the former head of MI5, has recently spoken out about the problems posed by strong encryption: “It’s very important that we should be seen and be a country in which people can operate securely – that’s important for our commercial interests as well as our security interests, so encryption in that context is very positive.”

Besides, if the government can decrypt all messages in the UK, won’t genuine terrorists simply set up their own “dark” services? Ten seconds on Google Search shows plenty of open source, secure chat packages they could use. If such groups are as technologically advanced as we’re led to believe, then it should be simple for them, and terrifying for the rest of us. Wouldn’t it be better to keep such groups using mainstream apps and quietly develop better tools for tracking them via their metadata?

Rudd’s argument that “real people” want ease of use over strong encryption implies that secure apps are in some way difficult to set up and require effort to maintain. The opposite is plainly true, as anyone who’s ever ‘butt dialled’ with their mobile phone can tell you.

Rudd’s argument also plays into the idea that if you have nothing to hide you have nothing to fear. While writing this piece, I accessed several dozen online information sources, from mainstream news reports of terrorist outrages to super paranoid guides for setting up secure chat services. I accessed many of these sources multiple times. I didn’t access any extremist material, but my browsing history shows a clear and persistent interest in recent atrocities perpetrated on UK soil, secure chat methods, MI5 and GCHQ surveillance methods, encryption algorithms, and so on. Joining the dots to arrive at the wrong conclusion would be a grave mistake, and yet without the wider context of this blog piece to explain myself, how would authorities know I’m not planning to be the next Khalid Masood or Darren Osborne? The answer lies in developing better tools that gather more context than just what apps you use.

Brexit and Cybersecurity

Is the UK headed for a cybersecurity disaster?

istock-big-ben-parliament-standard-5154835

With Brexit looming and cybercrime booming, the UK can’t afford major IT disasters, but history says they’re inevitable.

The recent WannaCry ransomware tsunami was big news in the UK. However, it was incorrectly reported that the government had scrapped a deal with Microsoft to provide extended support for Windows XP that would have protected ageing NHS computers. The truth is far more mundane.

In 2014, the government signed a one-year deal with Microsoft to provide security updates to NHS Windows XP machines. This was supposed to force users to move to the latest version of Windows within 12 months, but with a “complete aversion to central command and control” within the NHS, and no spare cash for such an upgrade, the move was never completed.

This isn’t the first IT Whitehall IT disaster by a very long way.

During the 1990s, for example, it was realised that the IT systems underpinning the UK’s Magistrates’ Courts were inadequate. It was proposed that a new, unified system should replace them. In 1998, the Labour government signed a deal with ICL to develop Project Libra. Costing £146m, this would manage the courts and link to other official systems, such as the DVLA and prisons systems.

Described in 2003 as “One of the worst IT projects ever seen“, Project Libra’s costs nearly tripled to £390m, with ICL’s parent company, Fujitsu, twice threatening to pull out of the project.

This wasn’t Labour’s only IT project failure. In total, it’s reckoned that by the time the government fell in 2010, it had consumed around £26b of taxpayer’s money on failed, late and cancelled IT projects.

The coalition government that followed fared no better. £150m paid to Raytheon in compensation for cancelling the e-Borders project, £100m spent on a failed archiving system at the BBC, £56m spent on a Ministry of Justice system that was cancelled after someone realised there was already a system doing the same thing: these are just a few of the failed IT projects since Labour left office seven years ago.

The Gartner group has analysed why government IT projects fail, and discovered several main factors. Prominent amongst these is that politicians like to stamp their authority on the nation with grandiose schemes. Gartner says such large projects fail because of their scope. It also says failure lies in trying to re-implement complex, existing processes rather than seeking to simplify and improve on them by design. The problem is, with Brexit looming, large, complex systems designed to quickly replace existing systems are exactly what’s required.

ukba_and_police-7387838

A good example is the ageing HM Customs & Excise CHIEF system. Because goods currently enjoy freedom of movement within the EU, there are only around 60 million packages that need checking in through CHIEF each year. The current system is about 25 years old and just about copes. Leaving the EU will mean processing an estimated 390 million packages per year. However, the replacement system is already rated as “Amber/Red” by the government’s own Infrastructure and Projects Authority, meaning it is already at risk of failure before it’s even delivered.

Another key system for the UK is the EU’s Schengen Information System (SIS-II). This provides real time information about individuals of interest, such as those with European Arrest Warrants against them, terrorist suspects, returning foreign fighters, missing persons, drug traffickers, etc.

Access to SIS-II is limited to countries that abide by EU European Court of Justice rulings. Described by ex-Liberal Democrat leader Nick Clegg as a “fantastically useful weapon” against terrorism, after Brexit, access to SIS-II may be withdrawn.

Late last year, a Commons Select Committee published a report identifying the risks to policing if the UK loses access to SIS-II and related EU systems. The report claimed that then-Home Secretary Theresa May had said that such systems were vital to, “stop foreign criminals from coming to Britain, deal with European fighters coming back from Syria, stop British criminals evading justice abroad, prevent foreign criminals evading justice by hiding here, and get foreign criminals out of our prisons.

The UK will either somehow have to re-negotiate access to these systems, or somehow quickly and securely duplicate them and their content on UK soil. To do so, we will have to navigate the EU’s labyrinthine data protection laws and sharing agreements to access relevant data.

If the UK government can find a way to prevent these and other IT projects running into problems during development, there’s still the problem of cybercrime and cyberwarfare. Luckily, there’s a strategy covering this.

In November 2016, the government launched its National Cyber Security Strategy. Tucked in amongst areas covering online business and national defence, section 5.3 covers protecting government systems. This acknowledges that government networks are complex, and contain systems that are badly in need of modernisation. It asserts that in future there will be, “no unmanaged risks from legacy systems and unsupported software”.

The recent NHS WannaCry crisis was probably caused by someone unknowingly detonating an infected email attachment. The Strategy recognises that most attacks have a human element. It says the government will “ensure that everyone who works in government has a sound awareness of cyber risk”. Specifically, the Strategy says that health and care systems pose unique threats to national security due to the sector employing 1.6 million people in 40,000 organisations.

The problem is, the current Prime Minister called a snap General Election in May, potentially throwing the future of the Strategy into doubt. If the Conservatives maintain power, there’s likely to be a cabinet reshuffle, with an attendant shift in priorities and funding.

european-union-flag-std_1-9767927

If Labour gains power, things are even less clear. Its manifesto makes little mention of cyber security, but says it will order a complete strategic defence and security review “including cyber warfare”, which will take time to formulate and agree with stakeholders. It also says Labour will introduce a cyber charter for companies working with the Ministry of Defence.

Regardless of who takes power in the UK this month, time is running out. The pressure to deliver large and complex systems to cover the shortfall left by Brexit will be immense. Such systems need to be delivered on time, within budget and above all they must be secure – both from internal and external threats.

About

SE Labs Ltd is a private, independently-owned and run testing company that assesses security products and services. The main laboratory is located in Wimbledon, South London. It has excellent local and international travel connections. The lab is open for prearranged client visits.

Contact

SE Labs Ltd
Hill Place House
55A High Street
Wimbledon
SW19 5BA

020 3875 5000

info@selabs.uk

Press