Group items tagged

Verizon is the latest big company to enter the post-Snowden market for secure communication, and it's doing so with an encryption standard that comes with a way for law enforcement to access ostensibly secure phone conversations.Verizon Voice Cypher, the product introduced on Thursday with the encryption company Cellcrypt, offers business and government customers end-to-end encryption for voice calls on iOS, Android, or BlackBerry devices equipped with a special app. The encryption software provides secure communications for people speaking on devices with the app, regardless of their wireless carrier, and it can also connect to an organization's secure phone system. Cellcrypt and Verizon both say that law enforcement agencies will be able to access communications that take place over Voice Cypher, so long as they're able to prove that there's a legitimate law enforcement reason for doing so. Seth Polansky, Cellcrypt's vice president for North America, disputes the idea that building technology to allow wiretapping is a security risk. "It's only creating a weakness for government agencies," he says. "Just because a government access option exists, it doesn't mean other companies can access it." 

Phone carriers like Verizon are required by U.S. law to build networks that can be wiretapped. But the legislation known as the Communications Assistance for Law Enforcement Act requires phone carriers to decrypt communications for the government only if they have designed their technology to make it possible to do so. If Verizon and Cellcrypt had structured their encryption so that neither company had the information necessary to decrypt the calls, they would not have been breaking the law.

Other companies have designed their encryption in this way, including AT&T, which offers encrypted phone service for business customers. Apple and Android recently began protecting content stored on users's phones in a way that would keep the tech companies from being able to comply with requests from law enforcement. The move drew public criticism from FBI Director James Comey, and some security experts expect that a renewed effort to stir passage of legislation banning such encryption will accompany Silicon Valley's increased interest in developing these services. Verizon believes major demand for its new encryption service will come from governmental agencies conveying sensitive but unclassified information over the phone, says Tim Petsky, a senior product manager for Verizon Wireless. Corporate customers who are concerned about corporate espionage are also itching for answers. "You read about breaches in security almost every week in the press," says Petsky. "Enterprise customers have been asking about ways to secure their communications and up until this point, we didn't have a solution." 

Phil Zimmermann, the creator of the email encryption software PGP, has warned that anyone who uses consumer email services needs to be aware of the threats of exposing their metadata to eavesdroppers.

That risk also led Zimmermann to develop a new feature for his Silent Phone app, encrypting conversations earlier in the call process. Dubbed "tunnelling", the feature hides the knowledge of who is talking to who from any eavesdroppers. Zimmermann had the idea for the feature “quite a few months before the Edward Snowden revelations”, but its upcoming release will be timely. Where PGP flaws are becoming clearer with time, Zimmermann argues that the core technology holds up just as well. “The first thing I did [after the Guardian published Snowden’s leaks] was review my own designs. "I haven't seen anything in the Snowden revelations that suggests that PGP or the stuff we do now is weak in any way.”

The NSA and Britain's GCHQ hacked the world's biggest SIM card maker to harvest the encryption keys needed to silently and effortlessly eavesdrop on potentially millions of people. That's according to documents obtained by surveillance whistleblower Edward Snowden and leaked to the web on Thursday. "Wow. This is huge – it's one of the most significant findings of the Snowden files so far," computer security guru Bruce Schneier told The Register this afternoon. "We always knew that they would occasionally steal SIM keys. But all of them? The odds that they just attacked this one firm are extraordinarily low and we know the NSA does like to steal keys where it can." The damning slides, published by Snowden's chums at The Intercept, detail the activities of the as-yet unheard-of Mobile Handset Exploitation Team (MHET), run by the US and UK. The group targeted Gemalto, which churns out about two billion SIM cards each year for use around the world, and targeted it in an operation dubbed DAPINO GAMMA.

Gemalto's hacking may also bring into question some of its other security products as well. The company supplies chips for electronic passports issued by the US, Singapore, India, and many European states, and is also involved in the NFC and mobile banking sector. It's important to note that this is useful for tracking the phone activity of a target, but the mobile user can still use encryption on the handset itself to ensure that some communications remain private. "Ironically one of your best defenses against a hijacked SIM is to use software encryption," Jon Callas, CTO of encrypted chat biz Silent Circle told The Register. "In our case there's a TCP/IP cloud between Alice and Bob and that can deal with compromised routers along the path as well as SIM issues, and the same applies to similar mobile software."

On Wednesday the UK government admitted that its intelligence agencies had in fact broken the ECHR when spying on communications between lawyers and those suing the British state, so GCHQ might want to reconsider that statement.

ne new email service promising "end-to-end" encryption launched on Friday, and others are being developed while major services such as Google Gmail and Yahoo Mail have stepped up security measures.A major catalyst for email encryption were revelations about widespread online surveillance in documents leaked by Edward Snowden, the former National Security Agency contractor."A lot of people were upset with those revelations, and that coalesced into this effort," said Jason Stockman, a co-developer of ProtonMail, a new encrypted email service which launched Friday with collaboration of scientists from Harvard, the Massachusetts Institute of Technology and the European research lab CERN.Stockman said ProtonMail aims to be as user-friendly as the major commercial services, but with extra security, and with its servers located in Switzerland to make it more difficult for US law enforcement to access.

"Our vision is to make encryption and privacy mainstream by making it easy to use," Stockman told AFP. "There's no installation. Everything happens behind the scenes automatically."Even though email encryption using special codes or keys, a system known as PGP, has been around for two decades, "it was so complicated," and did not gain widespread adoption, Stockman said.After testing over the past few months, ProtonMail went public Friday using a "freemium" model a basic account will be free with some added features for a paid account.

By locating in Switzerland, ProtonMail hopes to avoid the legal woes of services like Lavabit widely believed to be used by Snowden which shut down rather than hand over data to the US government, and which now faces a contempt of court order.Even if a Swiss court ordered data to be turned over, Stockman said, "we would hand over piles of encrypted data. We don't have a key. We never see the password."

Software created by the controversial UK-based Gamma Group International was used to spy on computers that appear to be located in the United States, the UK, Germany, Russia, Iran, and Bahrain, according to a leaked trove of documents analyzed by ProPublica. It's not clear whether the surveillance was conducted by governments or private entities. Customer e-mail addresses in the collection appeared to belong to a German surveillance company, an independent consultant in Dubai, the Bosnian and Hungarian Intelligence services, a Dutch law enforcement officer, and the Qatari government.

The leaked files—which were posted online by hackers—are the latest in a series of revelations about how state actors including repressive regimes have used Gamma's software to spy on dissidents, journalists, and activist groups. The documents, leaked last Saturday, could not be readily verified, but experts told ProPublica they believed them to be genuine. "I think it's highly unlikely that it's a fake," said Morgan Marquis-Bore, a security researcher who while at The Citizen Lab at the University of Toronto had analyzed Gamma Group's software and who authored an article about the leak on Thursday. The documents confirm many details that have already been reported about Gamma, such as that its tools were used to spy on Bahraini activists. Some documents in the trove contain metadata tied to e-mail addresses of several Gamma employees. Bill Marczak, another Gamma Group expert at the Citizen Lab, said that several dates in the documents correspond to publicly known events—such as the day that a particular Bahraini activist was hacked.

The leaked files contain more than 40 gigabytes of confidential technical material, including software code, internal memos, strategy reports, and user guides on how to use Gamma Group software suite called FinFisher. FinFisher enables customers to monitor secure Web traffic, Skype calls, webcams, and personal files. It is installed as malware on targets' computers and cell phones. A price list included in the trove lists a license of the software at almost $4 million. The documents reveal that Gamma uses technology from a French company called Vupen Security that sells so-called computer "exploits." Exploits include techniques called "zero days" for "popular software like Microsoft Office, Internet Explorer, Adobe Acrobat Reader, and many more." Zero days are exploits that have not yet been detected by the software maker and therefore are not blocked.

Another burst of sunlight permeated the National Security Agency's black box of domestic surveillance last week.According to the New York Times, the NSA is searching the content of virtually every email that comes into or goes out of the United States without a warrant. To accomplish this astonishing invasion of Americans' privacy, the NSA reportedly is making a copy of nearly every international email. It then searches that cloned data, keeping all of the emails containing certain keywords and deleting the rest – all in a matter of seconds.

The NSA appears to believe this general monitoring of our electronic communications is justified because the entire process takes, in one official's words, "a small number of seconds". Translation: the NSA thinks it can intercept and then read Americans' emails so long as the intrusion is swift, efficient and silent.That is not how the fourth amendment works.Whether the NSA inspects and retains these messages for years, or only searches through them once before moving on, the invasion of Americans' privacy is real and immediate. There is no "five-second rule" for fourth amendment violations: the US constitution does not excuse these bulk searches simply because they happen in the blink of an eye.The government claims that this program is authorized by a surveillance statute passed in 2008 that allows the government to target foreigners for surveillance. Although the government has frequently defended that law as a necessary tool in gathering foreign intelligence, the government has repeatedly misled the public about the extent to which the statute implicates Americans' communications.

There should no longer be any doubt: the US government has for years relied upon its authority to collect foreigners' communications as a useful cover for its sweeping surveillance of Americans' communications. The surveillance program revealed last week confirms that the interception of American communications under this law is neither "targeted" at foreigners (in any ordinary sense of that word) nor "inadvertent", as officials have repeatedly claimed.Last week's revelations are a disturbing harbinger of future surveillance. Two months ago, this newspaper reported that the US government has been forcing American telecommunications companies to turn over the call records of every one of their customers "on an ongoing daily basis", to allow the NSA to later search those records when it has a reason to do so. The government has since defended the program, in part on the theory that Americans' right to privacy is not implicated by the initial acquisition of their phone records, only by their later searching.That legal theory is extraordinarily dangerous because it would allow the NSA to acquire virtually all digital information today simply because it might possibly become relevant tomorrow. The surveillance program revealed by the New York Times report goes one step further still. No longer is the government simply collecting information now so that the data is available to search, should a reasonable suspicion arise at some point in the future; the NSA is searching everything now – in real time and without suspicion – merely on the chance that it finds something of interest.

Siri can understand what you say. Google can take dictation. Even your new smart TV is taking verbal orders. So is there any doubt the National Security Agency has the ability to translate spoken words into text? But precisely when the NSA does it, with which calls, and how often, is a well-guarded secret. It’s not surprising that the NSA isn’t talking about it. But oddly enough, neither is anyone else: Over the years, there’s been almost no public discussion of the NSA’s use of automated speech recognition.

Siri can understand what you say. Google can take dictation. Even your new smart TV is taking verbal orders. So is there any doubt the National Security Agency has the ability to translate spoken words into text? But precisely when the NSA does it, with which calls, and how often, is a well-guarded secret. It’s not surprising that the NSA isn’t talking about it. But oddly enough, neither is anyone else: Over the years, there’s been almost no public discussion of the NSA’s use of automated speech recognition. One minor exception was in 1999, when a young Australian cryptographer named Julian Assange stumbled across an NSA patent that mentioned “machine transcribed speech.”

One minor exception was in 1999, when a young Australian cryptographer named Julian Assange stumbled across an NSA patent that mentioned “machine transcribed speech.” Assange, who went on to found WikiLeaks, said at the time: “This patent should worry people. Everyone’s overseas phone calls are or may soon be tapped, transcribed and archived in the bowels of an unaccountable foreign spy agency.” The most comprehensive post-Snowden descriptions of NSA’s surveillance programs are strangely silent when it comes to speech recognition. The report from the President’s Review Group on Intelligence and Communications Technologies doesn’t mention it, and neither does the October 2011 FISA Court ruling, or the detailed reports from the Privacy and Civil Liberties Oversight Board.

On Wednesday, France woke up to find that the National Security Agency had been snooping on the phones of its last three presidents. Top-secret documents provided by WikiLeaks to two media outlets, Mediapart and Libération, showed that the NSA had access to confidential conversations of France’s highest ranking officials, including the country’s current president, François Hollande; the prime minister in 2012, Jean-Marc Ayrault; and former presidents Nicolas Sarkozy and Jacques Chirac. Yet also today, the lower house of France’s legislature, the National Assembly, passed a sweeping surveillance law. The law provides a new framework for the country’s intelligence agencies to expand their surveillance activities. Opponents of the law were quick to mock the government for vigorously protesting being surveilled by one of the country’s closest allies while passing a law that gives its own intelligence services vast powers with what its opponents regard as little oversight. But for those who support the new law, the new revelations of NSA spying showed the urgent need to update the tools available to France’s spies.

The response from the French government today was firm but predictable. Senior intelligence officials will travel to the U.S. to meet their counterparts in Washington, while the U.S. ambassador in Paris was summoned to the Elysee Palace. A similar scenario played out in 2013, when Le Monde published Snowden documents that revealed some of the extent of American surveillance in France. Prime Minister Manuel Valls said today that he wants a “code of conduct” to guide the relationship between France and the U.S. on intelligence activities — but the government demanded the exact same thing almost two years ago. When The Intercept published NSA documents in March indicating the Five Eyes — the NSA’s core allies — were intercepting large swaths of internet traffic in France’s Pacific islands, an official protest from France was nowhere to be heard. Even when it appeared that France’s closest ally, Germany, was using its surveillance capabilities to spy, on behalf of the NSA, on France’s foreign affairs ministry and some of the country’s most strategic companies, French authorities remained silent.

Until the law was passed, France’s intelligence services operated almost without any laws to regulate them. Although the new law delivers a much-needed framework, its safeguards are regarded by many critics as insufficient. The powers of the oversight body in charge of the intelligence agencies have been slightly strengthened and it will be possible, if a citizen suspects she is being surveilled, to take her case before the Conseil d’Etat, France’s highest court. But other parts of the law have drawn controversy, including the way it defines the purposes the government can invoke to surveil French residents. The categories extend well beyond terrorism. Many opponents of the law think these guidelines are so broad that they could enable political surveillance. But the key point of disagreement is what the government calls “black boxes.” The law allows the use of government equipment inside Internet Service Providers and large web companies to analyze streams of metadata and find “terrorist” patterns and behaviors.