Laws that undermine security

Posted in Real life, Security.

The Draft Investigatory Powers Bill combines some previous laws and makes more explicit what the (UK) Government security services can do. That’s a good thing.

However, there are two areas where I think the bill will make life worse for us (UK citizens):

  1. Undermining our security, for the general everyday person and UK businesses. It is not entirely clear from (trying) to read the bill what exactly is required, but expert witnesses think that it would require companies to create back-doors for the Government.
  2. Mass surveillance, the government want to keep a record of every website you’ve visited. Mass surveillance has a chilling effect on us all, and especially vulnerable groups. I’m not going to cover that here, but there are good reasons why normal people would not want their browsing data retained.

I wanted an understandable roundup of the security issues my friends and family would understand, so I’ve tried to write one.

Undermining our security

Encryption is binary, on or off. A system is either secure (to the best of anyone’s knowledge) or broken and the security has to be fixed. Getting security right is hard (see any of the major hacks in the last few years), it is an ongoing process of closing holes in your armour, and any hole can have devastating consequences for people and businesses.

The plain truth is that online security relies on cryptography, and “cryptography depends on a set of mathematical relationships that cannot be subverted selectively“.

If you put in a backdoor for one person, it is there for anyone.

Some of the top experts in the security world wrote a paper called “mandating insecurity by requiring government access to all data and communications“. The NSA tried to create a general back-door 20 years ago. It failed then and it would be monumentally harder to do now.

A former director of the NSA and others have said “We believe that the greater public good is a secure communications infrastructure protected by ubiquitous encryption at the device, server and enterprise level without building in means for government monitoring.” I agree.

This isn’t just theoretical, at work we recently had to upgrade our main firewall because a ‘State level’ hack put a backdoor in (the Juniper hack). Whoever put it in, the US and UK security services knew of it (or another like it) and did nothing except take advantage of it. That’s three years our firewall wasn’t doing its job properly. Once the back-door was known it took researchers just 6 hours to backwards engineer it and get the password. Criminals would be able to do the same thing.

The pernicious aspect of the current and proposed laws is that: It is in the security services interest to use the vulnerabilities, even at the cost of businesses and other parts of the Government being hacked.

There are hackers using malicious software to disrupt power supplies and other real-world impacts, possibly getting access via Office software. We need to improve the general level of security for everyone, as any ‘back door’ (intentional or accidental) is a method for access.

It is also worth noting that the bill makes investigating security issues much harder, as if you find a vulnerability in some software, you might go to jail for responsibly disclosing it if it turns out to be have been created by the Government. This is madness, security researchers have a hard enough time as it is, we need to be helping them not threatening them with prison.

If the law undermines security, it is doing us a disservice.

“But we need to catch terrorists” is generally the reply, but that is so flawed as to be laughable for anyone with a clue about how this stuff works.

Ineffective

Assume the bill passes (like a French one did many months before the Paris attacks) and the Government have the ability to require technology companies (in the UK) to provide access by back door access or by other means.

If you are plotting something bad you would:

  • Stop using UK based services. It is the internet, you have your choice of providers from all over the world.
  • Use an app that provides end-to-end encryption (not from the big names like Facebook/Google/Apple), where you share encryption keys directly with your fellow plotters.
  • Build your own app, for example “Al Qaeda has used its own encryption programs since 2007.”
  • If you are UK based use a VPN (widely used by business to allow employees to access corporate networks) so that your ISP can’t tell what sites you visit.
  • Hide in plain sight, such as when “al-Qaeda hid secret documents in a porn video“.

Encryption cannot be the problem.

The Government’s reply to a recent petition on encryption indicated they will not seek to ban encryption, but will ask main-steam services to enable access to their customers communications. That effectively bans main-stream providers from using full end-to-end encryption, and therefore means “privacy for the criminals, but not for ordinary, law abiding citizens.” as criminals can just avoid certain providers.

Terrorists have known about encryption since the ‘90s, and the Paris attacks didn’t even use encryption, and still weren’t detected. In general Jihadists are making their plans public, so encryption really can’t be the problem.

All of the recent terrorist attacks have been perpetrated by people known to the intelligence agencies, but there wasn’t the man power to keep tabs on these targets.

The former technical director of the NSA’s Analytic Services Office, William Binney said “Bulk data over-collection from internet and telephony networks undermines security and has consistently resulted in loss of life in my country and elsewhere, from the 9/11 attacks to date… because it inundates analysts with too much data. It is 99 per cent useless. Who wants to know everyone who has ever looked at Google or the BBC? We have known for decades that that swamps analysts.”

The evidence given by the Home Secretary fleshes out some of the scenarios that bulk collection have helped with, but when you also read the full evidence from Binney, they are orthogonal. It appears (but it’s hard to tell from the top-line nature of the evidence) that targeted collection would also fulfil the scenarios outlined, without overwhelming the investigation(s).

Another concern is that the mass surveillance data is used to identify terrorists algorithmically. You might not think that’s a problem, but it would inevitably suffer from the False Positive Paradox. When you have a very small proportion of actual targets (e.g. 2000 terrorists in a population of 66 million, 0.003%), you are more likely to identify non-targets than real-targets.

Thousands of people have been killed by drone strikes in Pakistan since 2004, and the top target identified by the NSA’s algorithm was a reporter who travelled to the region to interview people (see The NSA’s SKYNET program may be killing thousands of innocent people).

This bill will cause millions (or perhaps billions) of pounds to be spent to add more hay to the stack, rather than magnets for the needles.

What to do

To be clear I am all for targeted surveillance and hacking of specific people’s devices / software etc. It just shouldn’t harm everyone else in the process.

Target surveillance: The recommendation from William Binney (former NSA) is to target surveillance as it is captured: “use social networks as defined by metadata relationships and some additional rules to smartly select data from the tens of terabytes flowing by… This focused data collected around known targets plus potential developmental targets and represented a much smaller set of content for analysts to look through. This makes the content problem more manageable and optimizes the probability of analysts succeeding.”

Change the general dynamic from secretive-offense to open-defense.

Rather than undermining our security, the Government should do everything possible to make our citizens, businesses, infrastructure and the Government itself as secure as possible.

Security research should be encouraged, business should be educated (this is a good start), and the best security possible should be built into all our products and services. The Web Standards organisation the W3C supports the pervasive use of strong end-to-end encryption for web communications. Perhaps bad-guys will be able to communicate in secret (as they do now with and without encryption), but at least criminals from around the world won’t be able to snoop on and steal from us.

One approach to encourage security research would be to create a specific exception for it (like this request triggered by copyright issues impinging on research.)

Enable better international sharing for national security services (and not just the US/UK/CA/Aus/NZ). The internet is borderless, terrorist/criminals can move around, why should the intelligence about terrorists be marooned in particular countries? That means “making it easier for foreign governments to get data when that access is justified and harder when it is not.”

Above all, don’t let terrorists win by creating a culture of fear.

Scrutinizing the draft Investigatory Powers Bill goes into a lot of detail on the issues raised by the committees that examined the evidence put forward, it is a good next step for a deep dive.

Other Governments

I’m going to compile any references I see to other governments discussing this issue here: