CSIS document flags less-effective encryption as issue for IoT

Canada’s security agency is aware of the push for stronger encryption by privacy groups and industry, but some technology, including the Internet of Things (IoT), might end up with less reliable forms of the security tool, a top secret government document found. “Encryption products are being adopted at a profound rate and influencing trends that deal with security, privacy and trust,” said the briefing paper, prepared before a November national security meeting involving the Canadian Security Intelligence Agency (CSIS) and obtained via an access to information request by the Canadian Press. The document looks at “mega trends” in the technology sphere, including those related to blockchain and cryptocurrency, artificial intelligence (AI) and the issues related to an abundance of encryption products, which it said is an issue made complex by a host of factors. Those complexities and complications are related to the available types of encryption technology. The document points to both open and proprietary encryption, the latter of which, it said, is likely to lead to “rapid prototyping,” the use of cheaper or limited hardware components and less robust implementation. That’s opposed to open source encryption standards that are publicly developed and tested and considered to be “verifiable and trustable,” it said. Furthermore, the human factor of convenience, user friendliness, the time to get encryption products to market and weak implementation plans are still “likely to undermine the effectiveness of strong encryption or other security features,” the paper said. The demand for more encryption is in line with the advent of more connected devices flooding the market, but limitations inherent in some IoT devices might mean IoT winds up with less effective encryption, the report said. “Going forward, the Internet of Things (IoT) promises to complicate the prospects for encryption and security,” the document said. “Hardware limitations from processors, memory, and communications protocols are currently hindering the use, efficiency or interoperability of encryption, and the possibility of implementation errors will persist.” The briefing comes as some Canadian experts have called for the federal government to be aware of potential encryption-undermining powers in proposed national security legislation as well as the need to implement security standards for IoT. A proposed bill by U.S. senators has called for IoT security standards, and security and privacy issues related to IoT have been brought up as a concern at various industry conferences. Indeed, the document raises the issue of industrial IoT. While it would benefit businesses, government services and municipalities through management of critical infrastructure and smart cities projects, it could also open that infrastructure to cyber attacks, including distributed denial of service attacks. The document put the encryption discussion against the backdrop of a seemingly brewing conflict between advocates of privacy and government collection agencies. Most recently, according to a Reuters report earlier this month, U.S. Federal Bureau of Investigation director Christopher Wray called unbreakable encryption an “urgent public safety issue” because of a number of cases relying on electronic evidence. This is despite the agency broadly supporting strong encryption, the report said. Previous calls for limiting encryption have been made in the name of aiding investigations, such as those in terrorism-related cases. For example, following a terror attack outside of the British parliament last year, the United Kingdom questioned the use of end-to-end encryption by Facebook Inc.’s WhatsApp messaging service. And before that, Apple Inc. refused a request from the United States government to create a backdoor into a phone linked to a December 2015 attack in California. The briefing described these confrontations as an “industry vs. government standoff.” Following a call to limit encryption to aid investigations by an alliance made up of five global security agencies including CSIS, called the Five Eyes, civil society organizations and individuals came out to reiterate their support for the privacy measure. For that, the briefing noted that the government would need to seek that balance. “We need to find ways in which technology can address the privacy concerns of the individual without pre-empting the ability of the state to enforce public safety interests, where and as appropriate.” — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

CSIS document flags less-effective encryption as issue for IoT

News | January 16, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

CSIS document flags less-effective encryption as issue for IoT

News | January 16, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Online harms and more in focus as Parliament returns

Telecoms and broadcasters hit by CrowdStrike IT outage

CRTC lacking in battle against cybercrime: Auditor General

Education key to combating foreign interference on social media, ETHI hears

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us