Hiding in plain sight
Encryption is not simply the domain of the big tech platforms
On 22 March, the actions of Khalid Masood on Westminster Bridge and the resulting loss of life served as yet another reminder of the vulnerability of our society to such disturbed and determined individuals. In the aftermath of this tragedy, it was discovered that a number of messages and photos had been sent from his Whatsapp account only minutes before his attack. Messages that, due to the encryption used on the platform, can never be decoded.
Again, this has sparked a debate in the media about the need for the government to monitor these platforms. During an interview on The Andrew
Marr Show, home secretary Amber Rudd was asked if it was acceptable that platforms such as Whatsapp remained beyond the oversight of intelligence services. Her response that the situation was indeed unacceptable and that companies had to take greater responsibility has triggered a backlash in the technology community, who labelled her statements “draconian” and “misguided”. They even mocked her and other cabinet members for personally using the very service she called “a secret place for terrorists to communicate”.
Putting hyperbole aside, the community is correct that this is not the appropriate path to security – but not for the standard reasons. It is not because of the inherent danger of back doors and the weakening of encryption it brings; nor is it because of the difficulty of shaming global corporations into abandoning their views towards privacy.
The true reason this path should not be followed is one of practicality. Encryption exists in the wild outside of platforms such as Whatsapp, Telegram and Facebook Messenger, and focusing efforts on monitoring these platforms is not only impossible but acts as a distraction that will reduce the overall effectiveness of our security services.
In a world that has turned digital, focusing on these platforms will only result in massive expenditures to monitor the constantly increasing number of communications channels. It is a waste of valuable resources attempting to sift signal from noise. With a total budget of just under £3bn (FY2015/16), our intelligence services are already under-equipped for such a brute-force approach – recently, Google disclosed it alone has invested more than $30bn on its cloud infrastructure.
Even if it was indeed possible to keep pace with this fire hose of data, breaking end-to-end encryption only removes a form of convenience. It in no way prevents determined individuals from hiding their communications from others. To illustrate this, I have used three forms of encryption in this article to deliver a secret message to the editor of Campaign, all known to the general public.
The first message uses public-key encryption and free software OPENPGP to encrypt text anywhere, even on the printed page. Invented in 1991, PGP brought encryption to insecure channels such as email by ensuring the contents of a message were unreadable before they were sent through a platform, and is still widely used today. While it looks like a string of gibberish text to you, someone with the right key (delivered securely to Campaign via USB drive) can decode its real meaning.
The second message uses an even simpler form of encryption called a book cipher. Dating back to the 15th century and popularised in TV shows such as Sherlock, individuals who possess a shared secret – such as the same copy of a book, purchased at a local bookstore this morning – can encode messages that again can be sent anywhere you can type but are nearly impossible to decrypt.
While the first two messages appear somewhat suspicious, the third is more subtle. Using a technique called steganography, a photograph from my recent holiday in Australia posted to my Twitter feed has had its pixels subtly altered to conceal a string of text (tinyurl.com/mzhgujl). And, by incorporating one of the previous types of encryption, it renders the message not only unreadable but invisible. If you look closely, I have exaggerated the effect, so you will see a series of noise or dots in the background.
Combining all three messages results in a time and location for a future meeting. This is where I hope to continue an open debate regarding the challenges we face and the unnecessary burden we place on our intelligence services expecting them to close stable doors after the encryption horse has bolted. Feel free to join me in the debate – it can be our little secret.
“Focusing efforts on monitoring platforms such as Whatsapp, Telegram and Facebook Messenger acts as a distraction that will reduce the overall effectiveness of our security services”