As UK Prime Minister David Cameron forges ahead with a campaign pledge to ban encrypted messaging apps unless his government is given backdoors, that country's Guardian newspaper has aired a secret US report warning that government and private computers were at risk because cryptographic protections aren't being implemented fast enough.
The 2009 document, from the US National Intelligence Council, said encryption was the "best defense" for protecting private data, according to an article published Thursday by the newspaper. Airing of the five-year forecast came the same day Cameron embarked on a US trip to convince President Obama to place pressure on Apple, Google, and Facebook to curtail their rollout of stronger encryption technologies in e-mail and messaging communications. According to Thursday's report:
Part of the cache given to the Guardian by Snowden, the paper was published in 2009 and gives a five-year forecast on the “global cyber threat to the US information infrastructure”. It covers communications, commercial and financial networks, and government and critical infrastructure systems. It was shared with GCHQ and made available to the agency’s staff through its intranet.
One of the biggest issues in protecting businesses and citizens from espionage, sabotage and crime – hacking attacks are estimated to cost the global economy up to $400bn a year – was a clear imbalance between the development of offensive versus defensive capabilities, “due to the slower than expected adoption … of encryption and other technologies”, it said.
An unclassified table accompanying the report states that encryption is the “[b]est defense to protect data”, especially if made particularly strong through “multi-factor authentication” – similar to two-step verification used by Google and others for email – or biometrics. These measures remain all but impossible to crack, even for GCHQ and the NSA.
The report warned: “Almost all current and potential adversaries – nations, criminal groups, terrorists, and individual hackers – now have the capability to exploit, and in some cases attack, unclassified access-controlled US and allied information systems.”
Cameron's campaign against encryption comes as the rest of the world has stepped up cryptographic protections. Both Apple and Google have added default disk encryption by default to their iPhone and Android smartphone platforms, and a growing number of companies are ensuring that links connecting data centers use strong encryption to ensure traffic can't be read by the National Security Agency or its UK counterpart, the Government Communications Headquarters. Even before the Guardian report, it was hard to envision how it would be plausible to implement restrictions as draconian as the ones the UK prime minister is proposing. Now, there's evidence that UK's staunchest ally may have cold feet, too, signalling Cameron may have an even steeper uphill battle.
Read on Ars Technica | Comments