Former Head Of GCHQ Says Don't Backdoor End-To-End Encryption, Attack The End Points

from the putting-an-end-to-the-end-to-end-debate dept

When he was head of GCHQ, Robert Hannigan said some pretty clueless things about the Internet and encryption. For example, in 2014, he accused tech companies of ‘facilitating murder’, and joined in the general demonization of strong crypto. Last year, he called for technical experts to work more closely with governments to come up with some unspecified way around encryption. Nobody really knew what he meant when he said:

“I am not in favor of banning encryption. Nor am I asking for mandatory back doors. ? Not everything is a back door, still less a door which can be exploited outside a legal framework.”

Now, speaking to the BBC, he has clarified those remarks, and revealed how he thinks governments should be dealing with the issue of end-to-end encryption. As he admits:

“You can’t uninvent end-to-end encryption, which is the thing that has particularly annoyed people, and rightly, in recent months. You can’t just do away it, you can’t legislate it away. The best that you can do with end-to-end encryption is work with the companies in a cooperative way, to find ways around it frankly.”

He emphasized that backdoors are not the answer:

“I absolutely don’t advocate that. Building in backdoors is a threat to everybody, and it’s not a good idea to weaken security for everybody in order to tackle a minority.”

So what is the solution? This:

“It’s cooperation to target the people who are using it. So obviously the way around encryption is to get to the end point — a smartphone, or a laptop — that somebody who is abusing encryption is using. That’s the way to do it.”

As Techdirt reported earlier this year, this is very much the approach advocated by top security experts Bruce Schneier and Orin Kerr. They published a paper describing ways to circumvent even the strongest encryption. It seems that Hannigan has got the message that methods other than crypto backdoors exist, some of which require cooperation from tech companies, which may or may not be forthcoming. It’s a pity that he’s no longer head of GCHQ — he left for “personal reasons” at the beginning of this year. But maybe that has given him a new freedom to speak out against stupid approaches. We just need to hope the UK government still listens to him.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: , , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Former Head Of GCHQ Says Don't Backdoor End-To-End Encryption, Attack The End Points”

Subscribe: RSS Leave a comment
16 Comments
Bergman (profile) says:

Or, phrased another way...

“It’s cooperation to target the people who are using it. So obviously the way around encryption is to get to the end point — a smartphone, or a laptop — that somebody who is abusing encryption is using. That’s the way to do it.”

Do exactly what law enforcement and espionage agents have done since the dawn of time. The ability to quickly crack encryption on a level much below a government spy agency is a relatively new development, after all.

Anonymous Anonymous Coward (profile) says:

Re: Re: Or, phrased another way...

And along the lines of ‘mine is bigger’ they continue to add to their ‘library’, but never read any of it, or so small a portion that they miss…everything.

One could almost think ‘no porn no read’, but that might be disingenuous to those that try but are told not to or led to ‘more important’ leads.

Anonymous Coward says:

What exactly is your point here? -- Yay, intelligence agency will try getting around end point encryption?

Probably a better bet. But the efforts aren’t exclusive.

And perhaps they just pretend focus changed. They alarmed the little bunnies only to get them used to being spied on, now time to calm and distract. At best, given the nature of “intelligence agencies”, they’re lying somehow. They’re ALWAYS lying, it’s definitional. But Techdirt just laps it up, doesn’t question the statements at all, just assumes are true, kind of crowing about a victory for common sense, and never mentions the daily actuality that we now live in surveillance states. — With the colorful front of helpful Google, which gives NSA “direct access”, Snowden said.

orbitalinsertion (profile) says:

Re: What exactly is your point here? -- Yay, intelligence agency will try getting around end point encryption?

Yeah lol no one questions these things. If nothing is noteworthy, why pay attention to anything?

What is the benefit of the imaginary world you live in?

Sure, some people are entirely for maximum government spying. Some people couldn’t care in the course of their everyday lives. But do go ahead and invent things to claim superiority over and insult people with here. As if we don’t know spooks don’t go beyond what is publicly known and legal on their already extremely long and loose leashes. And this time just because it is reported that one of the "security" talking heads changed his tune and undermined the idiotic "adult conversation" antics of his peers. (Whether he means it or not is largely irrelevant.)

So if you ever get anywhere near an actual point, go ahead and make it.

stderric (profile) says:

The best that you can do with end-to-end encryption is work with the companies in a cooperative way, to find ways around it frankly.

It’s cooperation to target the people who are using it. So obviously the way around encryption is to get to the end point — a smartphone, or a laptop — that somebody who is abusing encryption is using. That’s the way to do it.

My reading comprehension ain’t honed to a razor-sharp edge, so I’m uncertain about something here. I get the good old-fashioned idea of attacking the endpoints in general, but the ‘working with companies in a cooperative way’ still sounds a bit creepy. If he means that investigators should contact companies on a case-by-case basis for help finding goof-ups in a particular suspect’s security measures, OK… but his statement sounds like he’s talking about globally preemptive measures; these may not be backdoors, but they’re definitely ‘backdoor shaped objects.’

He’s not head of GCHQ anymore, so playing word-games would be silly. Still, I can’t help but want to read between the lines when anyone changes his tune and seems to say something sensible. Anyone else get this feeling, or should I bust out my Reynolds Wrap?

Shilling says:

I like the phrase ‘abusing encryption’. How does one know encryption is being abused when you do not know whats in the encrypted part of data. To me this sounds like everyone who uses encryption is a suspect which I assume is everyone.

If everyone is a suspect then all the endpoints need to be breached and in that circumstance end-to-end encryption becomes the next step in the security theater and makes it almost useless.

Anonymous Coward says:

Looks better.... at first glance

But you all know that they are never going to be satisfied with just the cooperation of companies in giving them access to a single device or on a case-by-case basis.
If they don’t just come out right at the beginning and demanding it, they are sure as heck going to bring it up later that they need full access, all the time. Like the data collection we see going on now, they are also going to escalate its use to lesser and lesser crimes.
Also let us not forget the current state of affairs with where they can just find a friendly judge and then get a free-for-all warrant that covers just about anything.
Like someone else wrote earlier, it will then be much worse because they would probably have access to everything and just just communications.

The problem hasn’t changed, because they are still not leashed or watched enough to consider giving them any access.
They need a lot of proof that they have improved in these areas before anyone should even consider anything of this sort.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...