Obama wants to work with telecom companies. He should stop hacking them

http://www.theguardian.com/commentisfree/2015/feb/21/sim-card-hacking-gemalto-nsa

Version 0 of 1.

The US government has been harping on increased cooperation between tech and telecom companies to combat the supposed grave cybersecurity threat. President Obama even visited Stanford University last week to deliver that message personally to some of the internet’s most well-known tech companies. But why would any company – let alone the rest of us – trust a government that is so willing to hack them?

The Intercept published a blockbuster story on Thursday detailing how the British spy agency GCHQ, with help from the National Security Agency, hacked Gemalto, the biggest manufacturer of Sim cards in the world in 2010 and 2011, which allowed the agencies to steal millions of security keys that control the encryption on phone calls for providers like AT&T, T-Mobile, Verizon, Sprint and 450 companies around the world. These keys can let the US and UK spy agencies listen in on virtually any cell phone conversation without informing the user, the phone company, or the government of the country where the phone call is made.

Gemalto, a Dutch company, even has a contract with the US government for manufacturing the sensors in US passports, but apparently even that didn’t stop the spy agencies from hacking the company without their knowledge. It’s much like when the NSA secretly siphoned millions of persons’ data from Google and Yahoo from overseas cables behind the companies’ back. How, exactly, are these companies are supposed to believe when the government says Trust us?

As for how all of this is legal, good luck getting an answer. The NSA refused to comment on the Intercept story at all and the UK government just repeated their stock answer, which they give to literally every Snowden story: all GCHQ’s activities take place within “strict legal and policy framework.” Oh, really? If cyberstalking the personal emails and Facebook accounts of completely innocent employees at a telecom company that was never accused of a crime - in an attempt to steal massive amounts of data - is “within their legal framework”, is there anything that isn’t?

Maybe you trust the NSA and GCHQ not to abuse this incredible power - though I can’t imagine why, given their history. Either way, you can bet GCHQ and the NSA are not the only intelligence agencies stealing this type of information. Foreign governments all over the world, along with criminals and hackers, are probably engaged in the same types of heists. As cryptographer and Johns Hopkins University professor Matthew Green told the Intercept, “Put a device in front of the UN, record every bit you see going over the air. Steal some keys, you have all those conversations.” He added: “I can only imagine how much money you could make if you had access to the calls made around Wall Street.”

This is exactly why “end-to-end” encryption is so important, and why it’s so bizarre that many within the US and UK government are so intent on banning it, even as they continually hammer home the alleged risks of a coming cybersecurity armageddon.

Here’s the big difference between how regular cell phone calls work versus end-to-end encrypted calling apps like Signal and RedPhone: when you make a regular phone call, it’s usually protected by (weak) encryption as it travels through the air to the person you’re talking to. The call can be decrypted by your phone and the person’s phone you’re calling, but also by the phone companies. So that means if an intelligence agency - or anyone with the technical means - can break into a company and steal everyone’s keys at once, they suddenly have access to virtually every call being made at any give time. (That is, not coincidentally, one of the primary arguments against allowing the government to mandate a backdoor to all encrypted communications: the keys held by companies or the government can and will be stolen, just as they were at Gemalto.)

With end-to-end encryption, only the person you’re talking to - and not the phone company - can decrypt the call. Mass suspicionless surveillance suddenly becomes incredibly difficult once there is no longer a single central storage place for the keys to everyone’s communications.

Obama himself made positive comments about the importance of encryption in his first substantive interview on the issue with Recode last week, saying that he’s “a strong believer in strong encryption”. But then he couched his statements, as he always does, by remarking that he is also “sympathetic” to law enforcement officers, who say they want a key to everyone’s conversations.

Obama’s real mistake, however, was framing the encryption debate as one of privacy vs. safety. Encryption is a cybersecurity issue more than anything else; encryption is what keeps us safe. The New York Times reported recently that the White House will be making “a series of decisions on encryption in the next few weeks.” Let’s hope the administration understands that we need it to protect ourselves against criminals, foreign governments, and, as it becomes more clear every day, our own intelligence agencies.