MMXVIII - Our New Year's Resolutions

He who gave us our calendar.

From the frigid tundra of Siberia to the scorching heat of Alice Springs, the start of a new year is a symbolic reboot point and a time to reflect upon the events in our lives that we can and cannot control. Many of us vow to eat healthier, exercise more, drink less, worship better, call home more often, or a myriad of other corrections to the flaws that make us human.  We have probably been doing that since the adoption of the first calendar.

Archaeologists have reconstructed methods of timekeeping that go back to the Stone Age, and the first calendars date to the Bronze Age when we discovered metal and writing. They were lunisolar in nature and needed intercalary months - leap months, basically - in order to keep summer as summer and winter as winter. Julius Caesar had enough of that nonsense and introduced a solar calendar to eliminate leap months, following an algorithm that added a leap day every four years. The Persian mathematician Omar Khayyam (yes, he of poetry fame) measured the length of a year to astounding accuracy in the eleventh century, showing that the Julian calendar had too many leap years. Pope Gregory XIII introduced calendar reforms based on the knowledge of the actual length of a year to set the date for Easter in 1582. There are at least thirty-three other calendars in use across the world today, most based on religious beliefs, but generally everyone uses the Gregorian calendar in civil life.

We have reached the year 2018 in the common era, a time of unprecedented technological progress. But with progress come problems, as complicated and complex as the technology itself. Human beings, for whatever reason, make life extremely (and needlessly) complicated, and we may spend as much time trying to solve the problems of our own making as we do sleeping. Consider the internet, arguably the most transformative invention in history. Here we literally have the world at our fingertips. You may be reading this blog post from Johannesburg, Tehran, Delhi, or Paris. You may be using a SumRando server in Sweden, USA, Turkey, Amman, Singapore, Hong Kong, Brazil, or Spain or another server from any corner of the world. You may buy SumRando VPN with Rand, Rial, Rupees, or Euros with just a number on a plastic card and a click of a button. It's pretty mind-blowing to think about.

Yet we have these people who want to limit our use of such an invention, who censor it or spy on us or steal from us or slow it down so they can make money off us. It's all stealing, really. So for this new year, let us make some resolutions to save the internet from these people who would destroy it, these corporations, governments, hackers, and lobbyists who just can't stand human freedom and dignity, who seek profit and power at the expense of humanity, who would still use a lunar calendar if there were money or power to come from it. Here are our resolutions:

1. Stand up for net neutrality. The regime in the United States has decided to give the corporations who fund it complete control over what Americans can see on the internet. What will stop other regimes across the world from slowing access to certain websites if the country that invented the internet is unwilling to protect it from those motivated only by power and profit? Even if we won't admit it, developing countries look to the United States for leadership or fear condemnation and consequences for bad behavior. Discarding net neutrality rules indicates to rogue regimes that it is ok to manipulate internet traffic. Unless the United States takes measures to reestablish net neutrality for itself, net neutrality in the world may be in jeopardy. As we've seen in Portugal, loopholes in EU net neutrality laws make it difficult for any EU country to be a global enforcer. There are just too many questions right now. We all need to push our governments to actively pursue net neutrality regulations so that we may enjoy a free and fair internet like we are wont to do.

2. Stand up for internet freedom and freedom of expression. Net freedom is a human right. It is that simple. Article 19 of the Universal Declaration of Human Rights protects freedom of expression, and as an extension, the United Nations passed a resolution stating that "the same rights people have offline must also be protected online." So not only is internet freedom in our hearts and minds, it is international law. Of course, the usual suspects opposed the resolution, given their addiction to censorship, fear, and surveillance. So we fight on.

3. Stand up for privacy. At a time when CCTV can recognize our faces and leviathan social media companies are tracking our every move online (and sometimes offline, too), privacy is threatened more than ever. Privacy starts with encryption. Encryption is kind of our thing. It's what we do. Get our free encryption tools here and take back control of your life.

4. Stand up for encryption. Yes, encryption itself is under threat, as prying governments want to know what you do, where you do it, and whom you do it with. Some lawmakers see boogeymen everywhere. Others just don't understand what encryption is. We are not psychiatrists, so we cannot help the former deal with their paranoia. We are, however, encryption experts. We literally make it. We will continue to help people understand what encryption is, how it is a vital part of our lives, and why you should not be online without it.

5. Stand up for internet access. In order to do the above, you have to have internet. As of June 2017, only half of the world had access to the internet, with only 41% of the developing world having access, most of that being mobile. Yet access is difficult for many in the developed world as well. Even though a federal court in the United States defined the internet as a basic utility, 35% of rural Americans have no access to broadband. U.S. telecoms corporations have fought pushes to expand access at every turn. We are familiar with that kind of corruption in the developing world and will continue to push for access and expose those who stand as obstacles to it. Rural America has started to take matters into its own hands; we should look to this story as an example for the world.

Janus

So that's our list, and we hope you make it yours, too. January 1 was established as the date for the new year by Julius Caesar to honor the god Janus, the god of gateways and beginnings. Janus, who had two faces, presided over the beginning and end of conflict, of war and peace. The internet took one heck of a beating in 2017. Here's to a much better, freer 2018, and the end of the conflict over internet freedom. Cheers.

SumTips: 7 Findings from Secure the News' Leaderboard

At this point, the average internet user knows to check for HTTPS encryption (the little padlock at the top of a browser) before entering sensitive information online. And while many of the websites that require sensitive information—typically banks and online vendors—have made necessary security upgrades, the websites that often go forgotten are those of media outlets.

In response, the Freedom of the Press Foundation recently launched a new tool: Secure the News, a platform that provides information on the security of more than 100 media websites. The results are a little unsettling. May we suggest a VPN the next time you need to catch up on your current events?

• 29% of news sites surveyed provide HTTPS encryption; only 14% default automatically to HTTPS.

• The United States’ Intercept was the only site to receive an A+ security rating. Runners up include the UK’s Guardian and the United States’ Buzzfeed, ProPublica, TechCrunch and WIRED, who also provide and default to valid HTTPS. These sites have HSTS capabilities, but are not preloaded (HSTS protects against HTTPS downgrade attacks).

• 9 news sites worldwide received a security rating of B for providing and defaulting to HTTPS, but lack HSTS altogether. These include Germany’s Die Welt; the Moscow Times; the Toronto Star and the Washington Post.

• 15 news sites worldwide received a security rating of C. These sites offer valid HTTPS and are available over HTTPS, but do not default to it and lack HSTS altogether; they include France’s Le Monde; India’s Anandabazar; Italy’s La Stampa; Wirtualna Polska; Saudi Arabia’s Al Arabiya; and the UK’s Independent and BBC.

• 25 news sites worldwide received a security rating of D. These sites only offer valid HTTPS and include Germany’s FAZ.NET; Spiegel Online and Süddeutschede; the India Times and Indian Express; Poland’s Onet; Russia’s TACC; and the United States’ New York Times and Ars Technica.

• The remaining 50 news sites received a security rating of F, for their complete lack of HTTPS and HSTS. These global sites include Australia’s Age; China’s Global Times, People’s Daily, Shanghai Daily and Xinhua News Agency; India’s Andhrajyothi, DNA India, Hindu, Hindustan Times and Mathrubhumi; Italy’s Corriere della Sera; Qatar’s Al Jazeera; Russia’s Pravda Report; Spain’s ABC.es, el Mundo, el Pais, el Periodico and la Vanguardia; the United States’ Univision; the Associated Press; and Reuters.

• Currently, 0 sites have committed to making a change, but the Freedom of the Press Foundation expects Secure the News’ report will begin to prompt such action.

Use HTTPS, surf secure and stay Rando!

---

Image credit of Shutterstock.com.

Want more SumTips? Read on!

• SumTips: 5 Highlights of Snowden's Twitter Interview
• SumTips: 6 Reasons the Internet Is Unkind to Indian Women
• SumTips: What to Say When the Internet Goes Off

Want SumTips sent to your inbox? Sign up for our weekly newsletter ("Security Tips and News" at bottom of page). 

SumRando Cybersecurity is a Mauritius-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

SumTips: 10 Facts on Encryption and Human Rights from Amnesty International

Amnesty International recently released a report ranking 11 technology companies on encryption and human rights.

The results reinforce what we already know:

• Encryption helps protect people’s human rights online.

• Encryption stops cybercriminals from stealing our personal information, and helps prevent unlawful government surveillance of our communications.

• There is virtual consensus among expert technologists and cryptographers that it is impossible to put in place a system of special access that could only be used by the intended state authorities. If a backdoor exists, others–criminals, malicious hackers, or other governments–will also be able to access it.

…and remind us that there is still work to be done:

• Only three of the companies assessed–Apple, LINE, Viber Media–apply end-to-end encryption as a default to all of their IM services. Of these, none are fully transparent about the system of encryption they are using.

• In five cases Amnesty International found a gap between policy and practice: for example, Microsoft has a clear stated commitment to human rights, but is not applying any form of end-to-end encryption on its Skype service. 

• All of the companies, with the exception of Tencent, have stated publicly that they will not grant government requests to backdoor the encryption on their messaging services.

• Apple is a powerful advocate for privacy and security and is applying a strong form of encryption to its services. However, Amnesty International found that the company could do more to tackle these issues from a human rights perspective and inform its users about the threats to their human rights and the way that the company is responding.

• Facebook deploys end-to-end decryption by default on WhatsApp, but not on Facebook Messenger.

• Telegram Messenger, Kakao Talk and Google Allo do not warn users when using weaker encryption.

• Snapchat and BlackBerry Messenger offer no commitment to freedom of expression and make no policy recognition of online threats to human rights.

Know what your chat app can do for you, surf secure and stay Rando!

---

Image credit of Shutterstock.com.

Want more SumTips? Read on!

• SumTips: 8 Must-Have Tips From EFF's Surveillance Self-Defense Guide
• SumTips: How Donald Trump Proves that Freedom of Speech Works
• SumTips: 9 Cyber Security Awareness Month Events Not to Miss

Want SumTips sent to your inbox? Sign up for our weekly newsletter ("Security Tips and News" at bottom of page). 

SumRando Cybersecurity is a Mauritius-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

World Press Freedom Day 2016 Highlights What Journalism Needs

[Source: Mstyslav Chernov]

We need good journalists.

Those four words, shared by Finland Prime Minister Juha Sipila, summarize two days of keynote addresses and plenary sessions at this year’s World Press Freedom Day celebration in Helsinki.

Each year the event serves as an opportunity to promote a free and open press; to acknowledge the ways in which it is not; and to recognize those journalists whose lives have been lost. This year, a host of speakers and panelists from around the world offered insight regarding the current state of press freedom that does not always make it into mainstream media:

Policies and laws that prohibit encryption and weaken digital security tools will only threaten the safety of journalists. Good journalism relies on the ability to keep sources, research and whistleblowers confidential. Encryption is a necessity, not an option.

Western technologies and laws currently have the power to negatively impact the safety and security of journalists elsewhere. According to European Parliament member Marietje Schaake, surveillance technologies developed in Europe under the assumption of certain rules and regulations are frequently exported to countries where a lack of rule of law only enables the targeting and surveillance of journalists.  

There is a need to pass and better implement protective legislation. Only 108 countries today have right to information laws. The last 25 years have seen an increase in legislation in countries beyond the Western world, yet implementation of such legislation remains problematic everywhere. Edetaen Ojo, executive director of Nigeria’s Media Rights Agenda, noted that laws in Africa are frequently adopted as a condition of receiving aid and therefore often exist in theory rather than in practice.

Journalism everywhere would benefit from more in-country trainings. The success and livelihood of journalists depend upon understanding one’s rights. Given that laws and policies can vary widely from country to country, state to state and region to region and also that many governments take it upon themselves to block the very information that would be most useful, in-person trainings provide a much-needed space for journalists to receive and share information and methods, argued Neela Banerjee, a journalist with Inside Climate News. Speakers at Wednesday’s “Promoting Freedom of Expression in the Arab Region” seminar expressed a further need for training in countries such as Syria, Libya, Yemen, Lebanon and South Sudan, where a lack of education combined with access to social media has contributed to the use of hate speech and the incitement of violence.

Public perception of the persecution of journalists must change. Christiane Amanpour, UNESCO Goodwill Ambassador for Freedom of Expression and Journalist Safety, pointed out that in the majority of countries where journalists are imprisoned, the average citizen believes such punishment is just and deserved. A change in repressive government treatment of journalists will only come when non-journalist citizens believe that participating in a free and open media is not a crime.

For individuals accustomed to dictatorship, learning to freely express oneself takes time. Change is possible, but it cannot be expected to happen immediately, noted Albana Shala, chair of UNESCO’s International Programme for the Development of Communication. In sharing her own experience of transitioning from living under dictatorship in Albania to democracy in the Netherlands, she said: “I’ve learned to use my right for freedom of expression and to seek information. For people who have been living in a dictatorship, it takes time for them to learn to how to breathe freely, how to speak freely, how to think freely. That is also reflected sometimes in the way we do things in life. For example, instead of seeking information through the front door, going through the back door, or instead of talking directly, talking indirectly because of the fear of being persecuted. These are things that stay with us, and these are rights that we are born with, but we are not aware of. And that is the state of the world.”

The world needs good journalists. As World Press Freedom Day 2016 concludes, let’s remember that freedom of expression and journalism trainings—not censorship—will produce the journalists that the world so desperately needs.

---

Want the latest freedom of speech and cybersecurity news from around the world? Read on!

• It's a Vulnerable World: Panama Papers Edition
• This Tiradentes Day, Take a Stance Against Censorship in Brazil 
• Ghana Looks to Pass a Spy Bill by Another Name

SumRando Cybersecurity is a Mauritius-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

Sean Penn’s “Secret Visit” With El Chapo Has Become Everyone’s Business

Penn defends his interview on 60 Minutes. [Source: CBS News/60 Minutes via AP]

 On January 9, 2016, Rolling Stone magazine published an interview by American actor Sean Penn titled “El Chapo Speaks: A secret visit with the most wanted man in the world.” A short two weeks later, little about the visit has remained secret.

Joaquin “El Chapo” Guzman, known less casually as the powerful Mexican drug lord behind the infamous Sinaloa Cartel, made headlines last July when he successfully escaped from prison for a second time. His status as a wanted fugitive made Penn’s October interview all the more significant and also meant that numerous security precautions were required to arrange the meeting. In his article, Penn spoke at length of El Chapo’s “unusual trust,” as well as Blackphones, encryption, TracPhones, BBM messages and escorts by car and plane.

According to the Mexican authorities, the trust and security provided was not enough to shield El Chapo’s location from the powers that be. On January 8, Mexican marines apprehended El Chapo; shortly thereafter, Mexico’s attorney general described Penn’s October visit as “essential” to the capture. Penn himself has since denied a connection between his visit and El Chapo’s arrest, but his article’s words seem to imply otherwise: “Since our late-night visit in the Mexican mountains, raids on ranches there have been relentless. A war zone. Navy helicopters waging air assaults and inserting troops. Helos shot down by Sinaloa cartel gunmen. Marines killed. Cartel fighters killed. Campasinos killed or displaced…On Friday, January 8th, 2016, it happened. El Chapo was captured and arrested – alive.”

In jail El Chapo remains, but the fallout from this “secret” visit is far from over. Kate del Castillo, the Mexican actress who has been in communication with El Chapo since 2012 and arranged the meeting via BBM, has argued that the Mexican government is now trying to “destroy” her. Under investigation is del Castillo’s relationship with El Chapo, as well as whether illicit funds from him were used by del Castillo to launch her Honor del Castillo tequila business. The evidence comes in part from secret communications themselves: on January 13, Mexican news source Milenio published a series of encrypted BlackBerry messages between del Castillo and El Chapo leading up to the October visit, proving that what was thought to be secure was anything but.

Of the three, only Sean Penn does not currently find himself in legal trouble, but his 10,000-word account of the visit has left many wanting more. Journalists everywhere, including 60 Minutes’ Charlie Rose, are questioning Penn’s journalistic integrity and ability given his final product was a piece that failed to ask or answer tough questions and received its final approval from its subject. Mexican actor Gael Garcia Bernal was offended Penn would choose to profile El Chapo when there are “others more deserving of the attention.” The UK’s Daily Mail went so far as to publish the headline, “Sean Penn spotted for the first time since speaking about drug lord El Chapo during Charlie Rose interview as he spends time with son Hopper” with a series of invasive pictures. In attempting to share a secret with the world, Penn seems to have lost his rights to a personal opinion or to privacy.

This is one saga that appears to be far from over, but several lessons have already been learned. Most importantly, if you, like Penn, call yourself “the single most technologically illiterate man left standing,” educate yourself. El Chapo may have shown an “unusual trust,” but Penn displayed a blind trust in his “experiential journalism” process and now must face the aftermath, for himself and for others. Ultimately, the user must know how and when and when not to use the technology at his fingertips.

---

Want more of the latest cybersecurity news from around the world? Read on!

• Free Speech in Kuwait Was Bad Before, And Now There's a Cybercrime Law
• This MLK Day, Think Before You Tweet
• A Democratic Malaysia Requires "Creative Activism"

SumRando Cybersecurity is a South Africa-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

SHA-1 Sunset Highlights Internet Instability for Poor, Repressed and War-Torn Countries

For 37 million users across the globe, portions of the Internet will no longer exist on Friday.

January 1, 2016 marks the day that Secure Hash Algorithm 1 (SHA-1) will cease to provide users with an encrypted connection. For 98.31% of the population online, browsers will default to SHA-2 and life will continue as usual. For everyone else, the encrypted Internet is about to look like this:

As CloudFlare pointed out, 1.69% of the Internet population may not sound like a lot, but these nearly 40 million users are clustered in areas of the world already operating at a disadvantage: “Unfortunately, this list largely overlaps with lists of the poorest, most repressive, and most war-torn countries in the world. In other words, after Dec. 31, most of the encrypted Web will be cut off from the most vulnerable populations of Internet users who need encryption the most. And, unfortunately, if we’re going to bring the next 2 billion Internet users online, a lot of them are going to be doing so on secondhand Android phones, so this problem isn’t going away anytime soon.”

The unlucky 37 million are largely found in Africa, Asia, Latin America and the Middle East and typically aren’t carrying the latest technology in their back pockets. (Beware, users of Windows XP before Service Pack 3, Android before Gingerbread and pretty much any phone more than five years old.) A CloudFlare report listed the 25 countries most affected by the change: approximately 1 of every 20 browsers will be unable to support SHA-2 in Cameroon, Yemen, Sudan, Egypt, Libya, Ivory Coast and Nepal; other countries significantly affected include China, Ghana, Nigeria, Ethiopia, Iran, Tanzania, Syria, Paraguay, Angola, Kenya, Algeria, Bahrain, Nicaragua, Myanmar, Senegal, Bangladesh, Venezuela and Pakistan.

It’s undeniable that the shift away from SHA-1 will negatively affect the very users who have long been the Internet’s second class citizens, but the alternative leaves little to be desired. The decision to migrate away from 20-year-old SHA-1 is rooted in insecurity, as the algorithm is widely understood to be increasingly easy to break.

Such is the Internet for the poor, repressed and war-torn—at best, insecure and at worst, nonexistent. As efforts continue to bring the next 2 billion online, users must keep in mind that their security ultimately remains in their own hands, and also that the planet is far from a being a net neutral place. When SHA-1 appeared in 1995, it was widely supported across all browsers; twenty years later, SHA-2 does not come with the same universality. In an era in which the desire to advance technology has outpaced the desire to meet the needs of all users, no one should take whatever Internet connection or security they have for granted.

---

Want to know more about the current state of an encrypted, net neutral Internet? Read on!

• Shortened WhatsApp Ban Signifies a New Norm in Favor of User Choice
• Let's Encrypt: Free, Automated and Open
• Freedom on the Net Amounts to "Privatizing Censorship, Eroding Privacy"

SumRando Cybersecurity is a South Africa-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

Let’s Encrypt: Free, Automated and Open

[Source: Let's Encrypt]

It’s a Christmas miracle: Let’s Encrypt has entered public beta, making free HTTPS certificates readily available to all.

‘HTTPS’, usually accompanied by a padlock, are the five letters preceding a website URL that tell you all data sent between your browser and the website will be encrypted, making it safe for you to enter your password, credit card information or anonymous comment. Without Hyper Text Transfer Protocol Secure, your information could easily be compromised by anyone interested in taking it.

As Jacob Hoffman-Andrews of the Electronic Frontier Foundation recently reminded readers, “A huge percentage of the world’s daily Internet usage currently takes place over unencrypted HTTP, exposing people to illegal surveillance and injection of unwanted ads, malware, and tracking headers into the websites they visit.”

When reached for comment, Internet Security Research Group (ISRG) Executive Director Josh Aas reported, “I’m not 100% sure what the future holds, but demand for Let’s Encrypt’s services seems to be strong. Ultimately what we care about most is seeing two numbers go up: 1) the percentage of sites using HTTPS and 2) the percentage of encrypted traffic on the Web. We want those numbers as close to 100% as possible. That’s the next big step for the Web to take in terms of privacy and security.”

Let’s Encrypt, a joint project stemming from ISRG, was born in 2012 when Aas and then-Mozilla coworker Eric Rescorla concluded that the best way to increase transport layer security (TLS) usage on the Internet would be to provide a free and fully automated certificate authority. Three years later, Let’s Encrypt has issued more than 26,000 invite-only HTTPS certificates, a number that will only grow exponentially now that the service is accessible to all.

Anyone who owns a domain name is welcome to obtain a Let’s Encrypt certificate; for information regarding installation or renewal, go to https://letsencrypt.org/howitworks/. In keeping with an open internet, Let’s Encrypt is a transparent, cooperative effort that makes publicly available all issued and revoked certificates, publishes open standard protocols for adoption and is overseen by independent experts and those from supporting organizations alike. Although still in beta, Let’s Encrypt is committed to closely monitoring user feedback and quickly making improvements.

Here’s to an encrypted 2016!

---

Want to know more about the encryption debate? Read on! 

• To Encrypt or Not to Encrypt? That Is Not the Question
• Take a Stance on Encryption at SaveCrypto.org
• India's National Encryption Policy: Another Step in the Wrong Direction

SumRando Cybersecurity is a South Africa-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

To Encrypt or Not to Encrypt? That Is Not the Question

[Source: EFF Photos]

If there were need for further proof that 2015 has become Orwell’s 1984, look no further than the renewed debate over encryption prompted by the recent Paris bombing. For every claim that this is the reason why encrypted communications must be stopped exists a counterclaim pointing out that the Islamic State did not necessarily even rely on encrypted communications to carry out their attacks.

The release of an ISIS security manual—providing a host of suggestions for safely accessing email, publishing pictures and using the Internet—has intensified the scrutiny several leading technology providers find themselves under. Rather than let their services be written off as facilitating acts of terrorism, SumRando Cybersecurity applauds the companies that have taken advantage of this opportunity to reframe the encryption conversation.

In a statement released last week, ProtonMail co-founder and CEO Andy Yen clarified that the company is standing by its tagline of “secure email with absolutely no compromise”:

“But even if the communications were encrypted, it is illusory to believe that you can block terrorists from communicating by banning encryption. With or without ProtonMail, terrorists will continue to have encrypted email capabilities, in the same way that they will continue to have access to weapons regardless of a ban on assault rifles. What we do know for sure is that banning encryption would certainly lead to an increase in cyberattacks, data breaches, and an end to online banking and online shopping. This is not to mention the numerous dissidents, journalists, and activists whose lives will be put at risk…We must remember that ISIS doesn’t just use ProtonMail, they also use Twitter, mobile phones, rental cars. We couldn’t possibly ban everything that terrorists use without disrupting democracy and our way of life, and in effect achieving the goal of terrorism.”

Similarly, President and CEO Dean Garfield of the Information Technology Industry Council (ITI), the “global voice of the tech sector”, responded:

“Encryption is a security tool we rely on everyday to stop criminals from draining our bank accounts, to shield our cars and airplanes from being taken over by malicious hacks, and to otherwise preserve our security and safety. We deeply appreciate law enforcement's and the national security community’s work to protect us, but weakening encryption or creating backdoors to encrypted devices and data for use by the good guys would actually create vulnerabilities to be exploited by the bad guys, which would almost certainly cause serious physical and financial harm across our society and our economy. Weakening security with the aim of advancing security simply does not make sense.”

Bill Conner, President and CEO of Silent Circle, actively dissociated his company from terrorism while also acknowledging the need for ubiquitous encryption in everyday life:

“Of course, encryption plays an important part of maintaining digital security in everyday life—from online banking and corporate intellectual property to the communications of our governments and intelligence services. But when tragic and abhorrent events happen, the focus inevitably turns to whether encryption is being used for hostile purposes instead…So, we will continue to be transparent in how we protect your communications and how we vet our members, but we will also continue to advocate the responsible use of end-to-end encryption to protect the legitimate concerns of businesses, governments and individuals.”

The Paris attacks and the released ISIS security manual are currently being leveraged to fuel a side on the encryption debate that lacks perspective. In truth, encryption is an important and fixed feature of the landscape we all live in. Think about it: What would your day be like without encryption? (Hint: You might think twice about using the ATM, checking your PayPal account or booking a flight.)

---

Want to know more about the encryption debate? Read on!

•  Take a Stance on Encryption at SaveCrypto.org
•  India's National Encryption Policy: Another Step in the Wrong Direction
•  Rejoice, World: U.S. Government-Mandated Backdoors Are Unlikely

SumRando Cybersecurity is a South Africa-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

Take a Stance on Encryption at SaveCrypto.org

In the United States, October is National Cyber Security Awareness Month, an event that acknowledges the range of cyber threats in existence and promotes ways to reduce them. The solution, according to the U.S. government, is for all stakeholders to share in the responsibility of making the internet more cybersecure.

The Electronic Frontier Foundation and Access, along with privacy advocates such as the Committee to Protect Journalists, are celebrating October by providing an outlet for citizens and government alike to take responsibility for their security: an online petition asking the Obama administration to stand up for strong security and not allow secret backdoors in technology. 

Since launching on September 29, the petition has garnered more than 60,000 signatures; the White House will provide an official response if the petition reaches 100,000 signatures in 30 days. Its demands include publicly supporting encryption; rejecting laws, policies and mandates that undermine security; and no longer pressuring companies to store data, make data available or implement vulnerabilities.

Early October has already brought news from the White House that Obama won’t push for legislation that would allow access to encrypted communication, but many insist a non-stance is no substitute for a strong stance. 

Cybersecurity expert and Chief Technology Officer of Resilient Systems Inc., Bruce Schneier, had little optimism regarding government intrusions into privacy: “It’s been an issue since the mid-1990s, and it’s not going away because some president somewhere got momentarily sensible. I don’t believe for a minute that the pressure, overt or covert, is going to lessen.”

Techdirt’s Tim Cushing similarly pointed out that a momentarily sensible president is no long term solution: Obama will leave office in January 2017 and—if the current presidential candidates’ platforms are any indication—with him could go what sensibility the government currently has regarding encryption.

Access’s US Policy Manager, Amie Stepanovich, concurred that conversation in Washington regarding encryption amounts to little more than ‘posturing’: for her, last week’s declaration to not take a strong stance simply means that conversation can continue behind closed doors without public input and law enforcement can continue to petition for whatever access it can get, as seen in a recent attempt to force Apple to unlock a phone. 

It’s undeniable that encryption is slowly gaining greater acceptance in the United States, but it would be unwise to believe there isn’t more to do. This October, consider taking responsibility for your cybersecurity by asking President Obama to do his part as well. It is time the United States took a strong stance in support of encryption, for its own security and the security of the world.

SumRando Cybersecurity is a South Africa-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

India’s National Encryption Policy: Another Step in the Wrong Direction

India’s recent draft National Encryption Policy was so undesirable it was thrown out, but current politics in India imply the replacement won't be much of an improvement.

The policy was widely criticized for clauses that would have:

• Required citizens to “store the plaintexts of the corresponding encrypted information for 90 days from the date of transaction and provide the verifiable Plain Text to Law and Enforcement Agencies as and when required as per the provision of the laws of the country.”

• Required citizens to only use products registered in India and, in turn, required vendors of encryption products (like SumRando) to register with the Indian government by submitting working copies of any hardware or software. (A later addendum clarified the exclusion of mass use products such as Facebook, Twitter and Whatsapp from this clause.) 

• Prescribed the use of certain algorithms, including the known-to-be-vulnerable RC4 encryption.

Flawed as it was, many of the draft’s extreme measures were not without explanation. As Siddharthya Swapan Roy pointed out, “The entire post-Snowden civil liberties furore in the American media is about how their government must go through their courts only when the target of the surveillance is their countryman—an American. India may be their biggest market, but when it comes to digital civil rights, India is just another clump of lesser mortals called the third world and like all non-West nations, her citizens, common and VIP, are all fair game. This imbalance of power is what has lent credence to the efforts of BRICS members like Russia and China to block out and/or seek homegrown alternatives to Google and Twitter.”

No one would cite Russia and China as exemplars in protecting citizens’ privacy rights, but Roy does have a point. Rather than sit back and watch foreign companies profit off of their citizens’ data, these nations have taken action. India’s draft Encryption Policy fits with a history of similarly pushing back on foreign-owned companies with greater access to citizen data than itself, such as its standoff with Blackberry that led the Canadian company to install accessible servers in India. The outrage the initial draft Encryption Policy has been met with is not unfounded, but should perhaps ask itself why the fight against government all-access passes to data has not been extended to corporations as well. 

In the meantime, Indian Prime Minister Narendra Modi has been actively promoting the Digital India initiative, an purported effort to provide all citizens the digital connections and information necessary to be competitive in today’s world via measures such as linking local governments to each other and providing public Wi-Fi hubs in schools and cities. It may sound good, but recent developments imply that Digital India won’t really be for all Indians and won’t be completed without at least one major corporation: in recent weeks, Modi initiated yet another temporary internet ban in Gujarat province in order to avoid protests against his government and held a meeting with Facebook’s Mark Zuckerberg, a melding of minds that appears to have led to the rebranding of Internet.org—previously seen as incompatible with India’s commitment to net neutrality—as the more marketable Free Basics.

A second draft National Encryption Policy will eventually emerge and, given the current climate in India, there is little reason to believe it will be much kinder than the first. An anonymous senior government official recently told Newslaundry, “Rest assured, the government will not give up its right to intercept all forms of communication. If this is not included in the proposed encryption policy, then it will be included in a new set of rules and regulations that govern over-the-top [OTT] applications.”

Both government and business currently find themselves with a vested interest in India’s expanding internet and, unfortunately, neither has shown signs of making the average internet user’s right to privacy a priority. Unless drastic change materializes in the coming months and years, India’s users should expect to rely on independent action to preserve what online safety they may.  

SumRando Cybersecurity is a South Africa-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!