Spies Still Butthurt They Can't Get At Encrypted Comms Data
Five Eyes to tech: We have ways of making you comply
The Five Eyes nations have told the tech industry to help spy agencies by creating lawful access solutions to encrypted services – and warned that governments can always legislate if they don't.
The UK, US, Canada, Australia and New Zealand - which have a long-standing intelligence agreement – met in Australia this week.
In an official communiqué on the confab, they claim that their inability to lawfully access encrypted content risks undermining democratic justice systems – and issue a veiled warning to industry.
The group is careful to avoid previous criticisms about their desire for backdoors and so-called magic thinking – saying that they have "no interest or intention to weaken encryption mechanisms" – and emphasise the importance of privacy laws.
But the thrust of a separate framework for their plans, the Statement of Principles on Access to Evidence and Encryption, will do little to persuade anyone that the agencies have changed their opinions.
"Privacy laws must prevent arbitrary or unlawful interference, but privacy is not absolute," the document stated.
Although governments "should recognize that the nature of encryption is such that that there will be situations where access to information is not possible", these situations "should be rare".
The problem the Five Eyes have is that the principles that allow government agencies to search homes or personal effects don't give them the ability to use the content of encrypted data.
The group described this situation as "a pressing international concern that requires urgent, sustained attention and informed discussion on the complexity of the issues and interests at stake".
Ever keen to amp up the threat this poses to society, it added: "Otherwise, court decisions about legitimate access to data are increasingly rendered meaningless, threatening to undermine the systems of justice established in our democratic nations."
The principles set out in the Five Eyes' statement seek to stress that law enforcement's inability to access the content of "lawfully obtained data" is the responsibility of everyone.
"Law enforcement agencies in our countries need technology providers to assist with the execution of lawful orders," the group said.
The agencies also pointed out that tech firms, carriers and service providers are also subject to the laws of the land – and if they don't cooperate willingly, well, they have ways of making them.
"The Governments of the Five Eyes encourage information and communications technology service providers to voluntarily establish lawful access solutions to their products and services that they create or operate in our countries," it said.
Should governments continue to encounter impediments to lawful access to information necessary to aid the protection of the citizens of our countries, we may pursue technological, enforcement, legislative or other measures to achieve lawful access solutions.
Providers can create customised solutions that are tailored to their individual system architectures, it added, but governments should not favour a particular technology.
The communiqué also makes the common complaint that the "anonymous, instantaneous, and networked nature of the online environment has magnified" the threats of terrorism, child abuse, extremism and disinformation.
Again, tech firms should "take more responsibility for content promulgated and communicated through their platforms and applications", with another separate statement setting out the action industry needs to take.
This includes development of capabilities to prevent uploading of illicit content, to carry out "urgent and immediate" takedowns, and more investment in human and automated detection capabilities.
Major firms should also set industry statements and help smaller firms deploy these capabilities on their own platforms.
Elsewhere, the communiqué re-committed the five nations to cooperate on terrorism, cyber security, and immigration through intelligence sharing and new sources of data importance.
- Senior Cyber Security Analyst / Engineer. Exclusive role
- United Kingdom
Senior Cyber Security Analyst / Engineer. Exclusive role Hybrid role- Travel to London once a month. ROLE Day to day operations, management and scalability of existing cyber security systems. Advanced triaging and troubleshooting security alerts. Improve tooling, reducing false positives. Improve processes and documentation Reviewing, approving, escalating security change management requests. Implementing new cyber security systems. Managing of and maturing security tooling such as; SIEM Vulnerability management Firewalls Patch management CASB Ideal technical experience Vulnerability Management: Qualys Forcepoint: CASB, DLP, web security, email security Microsoft Defender for Endpoint SIEM (Splunk) Firewalls: Cisco, Palo Alto, Juniper, Sonicwall IDS: Alert Logic Microsoft Cloud App Security Microsoft Azure ManageEngine ADAudit Plus Darktrace, Cloudflare, Cisco Umbrella, Imperva WAF Appreciation of ISO27001, GDPR, PCI, etc
- Security Operations Senior Technical Analyst, Financial Services. Exclusive to DCL Search
- 75000 + benefits
Exclusive Security Operations - Senior Technical Analyst (x2) needed within a forward thinking financial services business head quartered in London. DCL Search have been engaged on an Identifier Project to attract the very best cyber talent to this business. Influence the cyber security capability and direction within the business. Learn new skills working within a collaborative team. Grow as a security professional. ROLE Triaging and troubleshooting security alerts. Improve tooling, reducing false positives. Improve processes and documentation Reviewing, approving, escalating security change management requests. Day to day operations, management and scalability of existing cyber security systems. Implementing new cyber security systems. Managing of and maturing security tooling such as; SIEM Vulnerability management Firewalls Patch management CASB Ideal technical experience Vulnerability Management: Qualys Forcepoint: CASB, DLP, web security, email security Microsoft Defender for Endpoint SIEM (Splunk) Firewalls: Cisco, Palo Alto, Juniper, Sonicwall IDS: Alert Logic Microsoft Cloud App Security Microsoft Azure ManageEngine ADAudit Plus Darktrace, Cloudflare, Cisco Umbrella, Imperva WAF Appreciation of ISO27001, GDPR, PCI, etc 2 days a fortnight in London- or more if you want.. Hybrid reworking.
- It's Pen Testing Chris, but not as we’ve know it.
- United Kingdom
5 reasons, as long as you are a skilled penetration tester (and a nice person) this may be different enough for you. Healthy package for the right talents- before you ask up to 95k+ (depending on skillset). Yes permanent only. Remotely based with the occasional time to meet up- unless you enjoy retiring from society. BUT UK based but not UK client focused. Research and training time- A dedicated trainer with budget for you to sharpen / develop skills. You can make your stamp. It’s a new role for someone technical to deliver, lead and shape a testing capability. No political shenanigans etc Exclusive to DCL Search and not one of the usual names. So you can dramatically increase your chances of securing it. Infrastructure pen testing and Web app / Manual penetration testing experience highly valued. Someone that can scope, deliver pen testing, report and not be useless in front of clients. Apply today to find out more. Or email Chris.Holt@dclsearch.com Or call 07884666351 This is a UK based role.
- Ping Contractor-
- Depends on skills and experience
Looking for experienced PIng Consultants, Looking for consultant with Implemenation or Architect experience in the Ping product set (Ping Identity, Ping Federate, Ping Access, Ping Directory, Ping Adapter development, SDK etc) This would be for implementation projects, working across UK. You will be responsible for providing implementation services to our clients from information gathering through to implementation. Evaluating client business, process, systems, and technology requirements and advise clients on best practices to help guide and solidify proposed designs. Manage Client expectations, Stakeholder Managment, ensuring design Matches business requirements