Spies Still Butthurt They Can't Get At Encrypted Comms Data
Five Eyes to tech: We have ways of making you comply
The Five Eyes nations have told the tech industry to help spy agencies by creating lawful access solutions to encrypted services – and warned that governments can always legislate if they don't.
The UK, US, Canada, Australia and New Zealand - which have a long-standing intelligence agreement – met in Australia this week.
In an official communiqué on the confab, they claim that their inability to lawfully access encrypted content risks undermining democratic justice systems – and issue a veiled warning to industry.
The group is careful to avoid previous criticisms about their desire for backdoors and so-called magic thinking – saying that they have "no interest or intention to weaken encryption mechanisms" – and emphasise the importance of privacy laws.
But the thrust of a separate framework for their plans, the Statement of Principles on Access to Evidence and Encryption, will do little to persuade anyone that the agencies have changed their opinions.
"Privacy laws must prevent arbitrary or unlawful interference, but privacy is not absolute," the document stated.
Although governments "should recognize that the nature of encryption is such that that there will be situations where access to information is not possible", these situations "should be rare".
The problem the Five Eyes have is that the principles that allow government agencies to search homes or personal effects don't give them the ability to use the content of encrypted data.
The group described this situation as "a pressing international concern that requires urgent, sustained attention and informed discussion on the complexity of the issues and interests at stake".
Ever keen to amp up the threat this poses to society, it added: "Otherwise, court decisions about legitimate access to data are increasingly rendered meaningless, threatening to undermine the systems of justice established in our democratic nations."
The principles set out in the Five Eyes' statement seek to stress that law enforcement's inability to access the content of "lawfully obtained data" is the responsibility of everyone.
"Law enforcement agencies in our countries need technology providers to assist with the execution of lawful orders," the group said.
The agencies also pointed out that tech firms, carriers and service providers are also subject to the laws of the land – and if they don't cooperate willingly, well, they have ways of making them.
"The Governments of the Five Eyes encourage information and communications technology service providers to voluntarily establish lawful access solutions to their products and services that they create or operate in our countries," it said.
Should governments continue to encounter impediments to lawful access to information necessary to aid the protection of the citizens of our countries, we may pursue technological, enforcement, legislative or other measures to achieve lawful access solutions.
Providers can create customised solutions that are tailored to their individual system architectures, it added, but governments should not favour a particular technology.
The communiqué also makes the common complaint that the "anonymous, instantaneous, and networked nature of the online environment has magnified" the threats of terrorism, child abuse, extremism and disinformation.
Again, tech firms should "take more responsibility for content promulgated and communicated through their platforms and applications", with another separate statement setting out the action industry needs to take.
This includes development of capabilities to prevent uploading of illicit content, to carry out "urgent and immediate" takedowns, and more investment in human and automated detection capabilities.
Major firms should also set industry statements and help smaller firms deploy these capabilities on their own platforms.
Elsewhere, the communiqué re-committed the five nations to cooperate on terrorism, cyber security, and immigration through intelligence sharing and new sources of data importance.
- Senior Identity and Access Management Architect
- Up to €85,000 Base + Package
Senior Identity and Access Management Architect (IDAM) subject matter expert is needed to lead and drive technical and or business transformation projects in a client-facing position for a prestigious consultancy in Frankfurt, Germany. Broad technical knowledge across Identity and access management is essential. Technical hands-on experience with one or more of the following core areas; Privileged Access Management (PAM, CyberArk, Beyondtrust, Thycotic) Identity Governance Administration (IGA, Sailpoint, Omada, RSA) Customer Identity & Access Management (CIAM, Forgerock PSD2) Fluent German is a MUST (Written & Speaking) A successful individual will be client-facing and MUST have strong exposure in previous positions designing and implementing Identity and Access Management solutions, this will be a hands-on position, working directly with the functional consultant and support teams If you are passionate about your industry and specialise in the IDAM space and are looking for a new challenge to step up, apply today and speak with the Security team. Candidate must be Germany or EU based (must want to relocate to Germany) Ref: TC7153
- Functional Identity & Access Management Consultant
- Up to €100,000 Base + Package
My Client, a leading international consultancy firm are currently in the process of expanding their Identity & Access management practice across each of their 3 sectors. Working with Large FTSE 500 companies on interesting technical / Business Transformation projects. The Identity & Access Management Consultant will be the key head in deriving and understanding business cases, consulting with the client to truly understand the needs of the business and suggest a solution of best fit. A deep understanding of business protocols, risks, as well as a strong understanding of Identity & Access management is essential to be successful in this position. Working in one of the following three IAM practices, The Identity & Access Management Consultant will need to have strong knowledge in at least one of the following; Privileged Access Management (PAM, CyberArk, Beyondtrust, Thycotic) Identity Governance Administration (IGA, Sailpoint, Omada, RSA) Customer Identity & Access Management (CIAM, Forgerock PSD2) Fluent German (Speaking & Writing) Current experience within a client-facing role, working with Identity & Access Management solutions is essential, my client are one of the leading partners in the space, hence why I am looking to speak with the best of the best. If you are passionate about your industry and specialise in the IDAM space and are looking for a new challenge to step up, apply today and speak with the Security team. Candidate must be Germany or EU based (must want to relocate to Germany) Ref TC7542
- Senior Identity and Access Management Consultant (IDAM)
- €70,000 - €85,000
(Security Consultant, Technical Consultant, Consultant, IDAM, CyberArk, RSA, Cyber, Security, Germany) Location: Frankfurt *Candidates must be EU based (Germany preferred) as our client are unable to provide sponsorship* Senior Identity and Access Management consultant (IDAM) subject matter expert is needed to lead and drive technical and or business transformation projects in a client facing position for a prestigious consultancy in Frankfurt, Germany. A broad technical knowledge across Identity and access management is essential. Technical hands-on experience with one or more of the following Ping, Forgerock, Cyberark, RSA Aveksa is highly desirable. A successful individual will be client facing and MUST be able to effectively engage, consult and provide advice to complex client engagements. The position will give the Senior Identity and Access Management consultant the opportunity to work with top tier clients with the view of making a meaningful strategic difference. If you are passionate about your industry and specialise in the IDAM space and are looking for a new challenge to step up, apply today and speak with the Security team. Call DCL Search & Selection on 0208 663 4030 and find out about more of our cybersecurity jobs. Reference: TC7528 (Security Consultant, Technical Consultant, Consultant, IDAM, CyberArk, RSA, Cyber, Security, Germany)
- Business Development Manager (IoT Connectivity Solutions)
- Up to €120,000 plus bonus and benefits
Experienced Business Development Manager is required for an expanding Service Provider to sell/position their IOT connectivity solutions into the Manufacturing Sector within the German market. This is a great opportunity to join a key player within this space, who have a number of successful projects for you to reference, they have the skills and the network but now needs the key person to help take the message to market You need to have proven sales experience within the mobile cellular IOT connectivity space and ideally knowledge of the manufacturing sector, this is a true consultancy role, you will be comfortable working with other sales team within the business but also able to directly approach key customers yourself. Great opportunity to join an expanding business as they grow their German Presence Ref: RA7259 (IoT Sales Jobs, IoT Sales, IoT Sales Executive, IoT Business Development Manager)