Europol Chief Warns About Computer Encryption

An anonymous reader writes The law enforcement lobbying campaign against encryption continues. Today it's Europol director Rob Wainwright, who is trying to make a case against encryption. "It's become perhaps the biggest problem for the police and the security service authorities in dealing with the threats from terrorism," he explained. "It's changed the very nature of counter-terrorist work from one that has been traditionally reliant on having good monitoring capability of communications to one that essentially doesn't provide that anymore." This is the same man who told the European Parliament that Europol is not going to investigate the alleged NSA hacking of the SWIFT (international bank transfer) system. The excuse he gave was not that Europol didn't know about it, because it did. Very much so. It was that there had been no formal complaint from any member state.

Comments

Oh For Crying Out Loud

[Anonymous Coward]

Encryption isn't new so why are they crying about it now? It makes no sense unless they are trying to sneak another fast one by the rubes in the general public. Tell your elected officials to stop whining about encryption and embrace it. Also, tell them we're tired of all these invasions to our rights to privacy because of an existential threat.

No, encryption is NOT going away and you're not getting a back door. Eff off and get to work on something useful and stop playing games!

Re:Oh For Crying Out Loud

[Hadlock]

PGP isn't exactly known for being user friendly. Gmail does not support it out of the box. The average person just can't be expected to understand that kind of cryptography.
 
That said, if you encrypt the device, encrypt the transport method, and the receiving device, that's pretty damn secure in about 98% of situations. WhatsApp just rolled out end to end encryption for their service as well, and they only charge a dollar a year (I think). That's encryption the average person can use. When an 18 year old mother of two in Sao Paulo can review her grocery list with her mother via secure encryption and neither of them know they're even doing it, that's a whole new level of secure. Compare that to the plain text emails I get from my boss about what I might consider vastly more important things at the office.
 
The golden era of unencrypted plaintext email is just about dead, I think, is the problem for intelligence agencies. At least for those people outside of gleaming glass corporate offices.

Re:Oh For Crying Out Loud

[SuricouRaven]

Encryption isn't new, but tansparent on-by-default encryption is. Remember just how tech-dumb the average person is - you'd be lucky if you could get them to realise a web browser and the internet are not the same thing. Most governments weren't too worried (US aside) when encryption was something available only to the moderately skilled, especially in communications where the lowest standard has to rule*. After the NSA scandal though, companies are starting to design encryption into their products at a lower level, such that the user benefits without even having to know what encryption is.

*Would you like to explain to your mother how to use gnupg to encrypt emails?

Re:Oh For Crying Out Loud

[Anonymous Coward]

When an 18 year old mother of two in Sao Paulo can review her grocery list with her mother via secure encryption and neither of them know they're even doing it, that's a whole new level of secure.

Sounds like the kind of secure you wouldn't notice if it was disabled.

Re:Oh For Crying Out Loud

[aaaaaaargh!]

They are crying now because some companies no longer want to cooperate with them by developing deliberately weak standards (e.g. cell phone encryption) and by providing illegal backdoors for wiretapping without warrant. So they want to be able to force them by law, which means that they need to convince politicians first.

In my pessimistic opinion, the most probable outcome of this debate is that companies will bow (again) to the authorities like they did before and provide the backdoors voluntarily, presumably in the form of vulnerabilities that are not published.

Re:Oh For Crying Out Loud

[jonwil]

There are JavaScript (and other client-side-but-in-the-browser) implementations of all kinds of encryption algorithms out there. The mega.co.nz site does client-side encryption before uploading to the server (so they never get the plaintext)

I see no real reason why you couldn't have a client side/browser extention/JavaScript/whatever implementation of something like PGP/GPG where the private keys never get seen by the web mail provider (it would mean each device you want to send email from has to have its own copy of the private key stored somewhere though)

Google and Yahoo already have in-browser addons in development that are designed to do client-side end-to-end encryption in the browser for their email platforms.

Re: Oh For Crying Out Loud

[Anonymous Coward]

Here's a hint for the under-informed: If you don't know you're using encryption, someone else is managing your keys. If someone else is managing your keys, they can let cops, intelligence agencies, and other kinds of bad actors in without you knowing it.

Better than nothing? Sure. However, a little understanding of what it is and is not good for can go a long way, and that's exactly what must people don't have.

Re:Oh For Crying Out Loud

[Gr8Apes]

This is easily possible, but realize who you're talking about - this is Google (G), and G makes its money by scanning your plaintext email and building profiles about you to sell ads and marketing metrics. If gmail goes PGP, then G loses the ability to scan that plaintext email, unless it's doing so via a client side process to send the information its interested in prior to encryption, also possible, but kind of defeats the purpose of encryption in the first place. I wouldn't be surprised if GTalk goes away soon, because more people are starting to use OTR supported clients. G only sees encrypted messages, pretty useless for gathering data.

Europol is not investigative

[Anonymous Coward]

Europol not investigating is not strange. That is not their job. Cross border investigations are handled by the police in the memberstates, but with coordination from europol.

Whatever people believe, europol is not an european fbi. Although, it would probably improve things if they did become one...

Citizens are not to be trusted.

[pspahn]

As Tom Waits wondered, what's he building in there?

Your Fault

[Bob9113]

"It's changed the very nature of counter-terrorist work from one that has been traditionally reliant on having good monitoring capability of communications to one that essentially doesn't provide that anymore."

You backed us into a corner by monitoring non-suspects.

It's your fault.

Dickhead.

Re:Your Fault

[Bob9113]

I'm gonna pretend you're actually interested in the answer, but let's face it, we're really talking past each other, to our fellow Slashdotters. Thank you for smoking.

The reason for the mass move to encryption -- like Wikipedia and Google moving to default HTTPS, and people like me working on making encryption more approachable by the masses -- was the revelation that non-suspects were being monitored. That is why there is now a haystack within which to hide the needles, and that is why the encryption is now too strong for the intelligence agencies to break when we really want them to be able to.

Moreover, while I'm here, and since I want terrorists to get caught, let me add this: The solution is not increasing the level of distrust between citizens and government. The solution is restoring the reasonable, moderated, level of trust that we used to have in the executive branch. That starts with the ones who created the rift, and that is not the people who were sending all their traffic in the clear; it is the assholes who recorded it all and denied they were doing it.

Because obviously..

[Altrag]

Of course, terrorists are well known as the most law abiding citizens on the planet.

Or maybe this guy thinks the universe will just make prime numbers and whatnot stop working because he doesn't like what they can do.

Both are equally likely to produce useful counter-terrorism results.

Re:Because obviously..

[davester666]

Hey, these guys didn't go into policework because they were experts at math...

Re:Because obviously..

[bill_mcgonigle]

Both are equally likely to produce useful counter-terrorism results.

The most effective thing to do for counter-terrorism is to keep blowing up families in the Middle East and occupying "holy lands". Keep bombing villages until democracy emerges.

To do so, we need ever-stronger Nation States, and giving them the ability to monitor all of their subjects' domestic communications is a good rung up on that ladder.

Also, Facebook is the real danger to world peace - so be very upset about their ad network and don't bother encrypting your traffic.

When every citizen is a potential terrorist...

[MindPrison]

...then we have a problem with government.

Re:When every citizen is a potential terrorist...

[Zocalo]

I suspect that's actually the underlying problem for the security & intelligence services. It's not so much the fact that regular citizens are starting to use encryption that they have a problem with so much as through the use of encryption by default they're losing the ability to find the more interesting chatter by simply looking for people that are even using encryption in the first place. When your entire haystack is made out of needles, finding the few you are actually interested in becomes that many orders of magnitude harder.

Well, screw that. What they are basically saying is "make our jobs easier for us", but what they are failing to point out is that by doing so they are also leaving people exposed to everyone else that might want to eavesdrop on random communications, and in particular all those people/organizations/countries that they are meant to be securing each other against. If *you* have access to it, then so do your opponents - so the real question, and the one that really needs to be addressed, is which is the lesser of the two evils - having your nation secure from outsiders, or making the job of securing your nation against internal threats slightly easier? Given the complete failure of the security & intelligence services to demonstrate they can achieve the latter even before encryption become a big issue I'd say that's a complete no brainer.

Re:When every citizen is a potential terrorist...

[UnknownSoldier]

/Oblg. "Government: Terrorists who extorts its citizens to prevent another group of terrorists from taking over its job."

Re:When every citizen is a potential terrorist...

[Jason Levine]

What they are basically saying is "make our jobs easier for us"

We've been seeing a lot of this recently. From the RIAA/MPAA who would like the ability to get the personal information on multiple people on the flimsiest of evidence of copyright infringement (because actually gathering evidence on each one and suing each person in the appropriate district is too hard) to the government law enforcement agencies who feel that asking a court for a warrant - even when said court never turns them down - is too much effort.

It's one thing to be power-hungry. It's quite another to be power-hungry AND lazy!

Re: When every citizen is a potential terrorist...

[dcollins117]

Our own government doesn't obey the law, why should we? This is standard Pisoner's Dilemna. Once the other side defects, you must too. Continue to cooperate and you lose. Badly.

He thinks it is bad now?

[Karmashock]

Given the arrogance of the NSA and other national security agencies, they can expect encryption to increase radically. This is a natural consequence of their refusal to abide by due process as well as generally doing whatever the hell they want because they "can".

That attitude is a double edged sword. And they are just now feeling the bite of the other edge as the global community responds to their behavior.

Not only will the sophistication of encryption spread by it will go from being an option to being a default status quo. In the not too distant future, if they want access to data, they will need to get the cooperation of the owner of that data... or get nothing at all.

Re:He thinks it is bad now?

[Anonymous Coward]

For most of its history, the Fourth Amendment has never been about protecting privacy, but rather protecting against using the state's power to disrupt innocent people's lives.

The SCOTUS decision of Katz v. United States counters that assertion, particularly in the realm of wiretapping.

Besides, how do you know that an ongoing unreasonable warrantless dragnet over the entire country isn't a disruption? It's insidious, even more so when the public wasn't aware of it.

To use the mandatory Slashdot car analogy, if a police officer asked you first, how often would you grant permission for him to pull you over, regardless of your speed?

To lawfully pull you over, the police officer must have probable cause to do so - to do otherwise is proscribed by the Fourth Amendment. It may be as trivial as a broken taillight, but probable cause nonetheless.

By conducting indiscriminate monitoring of the speed of vehicles, he's probing your vehicle's status, and that's invading your privacy.

With some exceptions (see United States v. Jones), you generally do not have a reasonable expectation of privacy on public roads.

Re:He thinks it is bad now?

[N1AK]

Rather, what actually happened is that the spy agencies watched everybody, and by and large didn't care about people who weren't throwing up red flags. If it weren't for Snowden and the Internet-fueled rage he spurred, you'd never know that you'd been investigated at all.

And if you never found the camera your neighbour installed in your bathroom you'd never know he'd been watching you and your family naked, but that probably wouldn't stop you being pretty pissed about it when you found out.

When your government begins using mass surveillance on the entire population, and does so in secret and against the protections your government tells you that you have, it should be a pretty obvious sign that you can't trust them.

How many people called it here?

[Thanshin]

Someone should make a query that extracts the Slashdot commentaries that have predicted this exact situation for a decade.

The prediction goes like this : "If you keep doing stupid shit like that, people will start encrypting their computers and communications to protect themselves from your unimportant shit and this will help the very few people who encrypt their computers and communications to hide serious crimes."

The more you turn everyone into a criminal, the harder it will be to find the actual criminals.

It's time to decriminalize the population, so people become once again able to distinguish between the guilty and the innocent.

Re:How many people called it here?

[Pi1grim]

But the point is not to catch real criminals, the point is to dig up dirt on anyone and everyone, so when the time is right - you could use it to your advantage.

"Don't you see it's for your own protection, and for your children, protecting all of your from pedophiles, terrorists and the scary monster in your closet. And if you don't buy this argument, then obviously you are an enemy of the state, because if you don't have anything to hide - you have nothing to fear. Oh, and don't forget - arbeit macht frei."

Snooping agencies will fight tooth and nail to keep their snooping powers because they don't give a rat's behind about the read bad muthus out there - because that's entirely different playing field, you can't go after them directly, they are well protected and shifting balance includes a lot of political play, but the smaller fishes can be caught with a wider net, and to get leverage all you need is a right to snoop on anyone at any point in time. It's too convenient to give up.

Re:How many people called it here?

[Thanshin]

Snooping agencies will fight tooth and nail to keep their snooping powers

The problem with fighting tooth and nail is that it's strategically stupid to fight directly against a larger and stronger army.

The privacy arms race benefits the people, only a false feeling of safety and anonymity stops the people from making it practically impossible (or impossibly impractical) to spy on the general population.

A front attack, however strong it may be, will fail.

Some of us are accusing the agencies of being intrusive, but this is a different problem. This is about having been intrusive in a strategically unintelligent way.

Ignorance

[Futurepower(R)]

Most government leaders are profoundly ignorant about technology.

For those of us who work with technology, it is difficult to understand how ignorant the leaders are, and what we could do to fix the problems ignorant leaders cause.

It's only going to get worse.

[John Allsup]

People haven't figured out the half of it. The Theoretical Computer Scientists are still trying to figure out if P equals NP, when there is both an easy solution (I've tried to submit one version of it, and have written another), and that when conditions of physical plausibility are introduced, it turns out to be the wrong problem anyway. Hard problems arise as soon as you need one more peek at a pile of data than you have. Then you have to guess, and you are at the mercy of the guess. If it is a genuine binary guess and nobody is in a position to force your random number source (and this is totally unrealistic) then you only have a 50% chance of being totally wrong. Things go downhill pretty fast from there.  Trust me, my sanity has survived by playing these games in my head for the last decade or so, and there is only one sensible strategy, and it is built fundamentally on sensibly chooing friends you trust. Things then either turn into a lovely blissful world of total cooperation (and I'm still dreaming here), or else devolve into a downward spiral of ever decreasing trust, ever increasing suspicion, and total failure to justify that distrust given that when one determined person want to screw things up, he or she happens to be the 1/1000 that you didn't decide to label a 'madman' and lock up. The law enforcement systems they are demanding don't work even in dreams. They face too many decision processes, can't improve matters by adding more decision processes (and this is the mess that using computers to aid they really gets them), and they are demanding that their task is made artificially simple. Doesn't bloody work that way in our universe. Sorry. We live according to the laws of mathematics and physics, and if you find yourself on the wrong side of them, complaining to lawmakers won't make the problems go away, but can screw up a large number of lives in the attempt.

Re:Spies vs Comm Monitoring

[John Allsup]

He will win who knows when to fight or not to fight. These law enforcement idiots are fighting a battle for control that they shouldn't and our friend Sun Tzu tells us they will lose the war. Pity those fellows.

boo hoo

[Anonymous Coward]

You are more likely to die by crossing the street, falling down the stairs, heart attack, or cancer than by terrorism.

He's right

[hcs_$reboot]

[encryption] has become perhaps the biggest problem for the police (...)

He is right. Eavesdropping everyone everywhere in all possible ways without any ethical limit made everyone aware of
- the privacy intrusion risks posed by non encrypted communication
- the privacy intrusion risks posed by weakly encrypted communication
- the privacy intrusion risks depending on the communication media being utilized.

Shut uuuuup

[wonkey_monkey]

Maybe if law enforcement types didn't keep banging on about how useful encryption is for terrorists, fewer terrorists would actually hear about it in the first place.

Crying about encryption just another symptom

[einar.petersen]

Watching the police state encroach deeper and deeper and the sheeple doing nothing but watching their reality shows and empty journalists blabbering the agenda on the evening news attempting to marginalize anyone with half a brain discussing the deeper implications regarding the slide towards totalitarian rule is a sad sad reality for someone who has seen the Berlin wall fall and who remembers the horror stories about STASI an organization that pales in comparison to the evils of intelligence services operating in todays so called free democracies. When will the people rise and object against the tyrannical powers laying their claws upon every soul walking this earth...

There's an old saying....

[BravoZuluM]

When encryption is outlawed, only outlaws will have encryption. And the government, but then I'm being redundant.

Re:No encryption == full employment for police

[Jason Levine]

That was my first reaction also. The government likes to speak about terrorism, but ID theft, credit card fraud, and other types of financial crimes are a whole lot more prevalent. Now imagine if encryption were to disappear tomorrow. All those personal details whizzing about the Internet unencrypted? Financial crimes would skyrocket. Either that, or nobody would do business online and a huge sector of the economy would collapse overnight. Even *IF* banning encryption meant all terrorism was stopped the financial cost alone would make it a non-viable option.

They abused the privilege, now they pay

[msobkow]

They abused the privilege, now they pay the price. I've no sympathy for any of the intel agencies out there who've claimed they're only interested in identifying endpoints and sessions, yet now are crying about the traffic content being encrypted. Encryption simply limits CSEC, GCHQ, NSA, et. al. to the endpoint identification they said they want.

It's too late to change your mind. I use RSA2048 exchange of AES256 keys, hard coded into all my applications. If you don't have the Java export-strength encryption enabled, I don't want to bother supporting your code. You're just begging to be intercepted without export-strength encryption.

I'm tired of being snooped on. I'll take my right to privacy seriously, thanks. I don't even trust pre-generated keys for the RSA2048 server encryption -- I generate them on the fly at server startup so that even the person running the server doesn't know what the keys are.

The problem goes beyond encryption

[TsuruchiBrian]

We need to ban, not only digital computers, but also math. One can multiply big prime numbers and keep them secret using pen and paper.

Lie. If caught, lie more.

[gweihir]

As far as we know, not a single terrorist attack would have ever been averted if encryption had been breakable. This person is either terminally stupid or exceptionally dishonest. In either case he is a serious threat to society and should be removed from his position immediately.