CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant

http://www.itsecurityguru.org/node/4780

by atlantic • 13 years ago

163 75 13 years ago

billpg• 13 years ago

My eyes!

yoran• 13 years ago

Same here. I'm sure the content is really interesting but the design is awful! Plus the logo doesn't fit at all the topic of computer security.

lnanek2• 13 years ago

Wow, shows a lot of integrity closing the product instead of still keeping it up in a compromised state to comply with the warrant. We've seen some other providers here in the US even changed functionality to retain keys used in web clients of secure email at the behest of government orders.

This does mean that the UK is now on the list, along with the US, of places where no credible crypto startup is possible, though.

jabbernotty2• 13 years ago

The article also mentions this company's new product where additional security is possible because decryption requires data kept only by the customer. Perhaps that is the new way to go?

arethuza2• 13 years ago

I was wondering about that, it is described as:

"where rather than hold the data, it is split in two so CertiVox has one half and the user has the other, and law enforcement would need both to access the data."

By data here, do they mean encryption key? If so then I'm not sure what splitting it in two does as you presumably have to join them together somewhere and GCHQ would presumably just attack wherever the complete key is available.

[Edit: Product details here, it appears to be Open Source: http://www.certivox.com/m-pin/]

gambiting• 13 years ago

I think most people completely missed the part of Snowden leaks that directly said that GCHQ is not any better than NSA.

josephlord• 13 years ago

GCHQ are both better and worse than the NSA. I would argue that it seems they are if anything even less restrained than the NSA in over broad surveillance. However it is less clear whether GCHQ have actually broken the rules (and certainly not the constitution) which the NSA may have done.

My view is that everyone (in the world) should be pissed off at both the NSA and GCHQ and that Americans should be additionally angry that the NSA seems to have broken the limits placed on them in terms of domestic surveilance.

rayiner• 13 years ago

This does mean that the UK is now on the list, along with the US, of places where no credible crypto startup is possible, though.

I can think of very few developed countries that, when the rubber hits the road, will let you do what you want. Taking measures to aid official police or court investigations is simply an implied obligation in most countries with developed legal systems. Very few countries will tolerate service providers whose raison d'etre is "we won't cooperate with the authorities" except in limited situations like off-shore banking when the primary purpose is to hide assets or information from people in other countries.

This isn't specific to crypto or police investigations either. Say you want to start an accounting firm that guarantees it will never share your records if subpoenaed in a civil lawsuit. This would never fly in the U.S., not now or one hundred years ago, and while I'm not super familiar with European law, I can't imagine it would fly in any western European country either.

rdl• 13 years ago

I think it falls into three groups for communications providers:

1) Laws like CALEA, which (if applicable) require a provider to develop and expose backdoors to the government in advance of a request

2) Building systems where an operator doesn't have access, but where a court order can compel changes to the system, including ultimately shutting it down.

3) Being able to build a system where operator doesn't have access to data, and upon a request, if no data can be turned over, continues operating. Must turn over any data which you do have.

4) No requirement to cooperate, or something equiv to 4th/5th A protections for the end user being extended to service providers.

I used to think the US was #3. I don't believe #4 exists anywhere, at least outside specific kinds of data (medical, legal). The US is at least #2 now, and might actually be #1 in more and more domains.

79522• 13 years ago

There are some details of the legislation in question here[1]. It allows the UK to monitor "in the interests of the economic well-being of the United Kingdom" which seems a little broad!

It would be interesting to know if this warrant targeted all users or a specific subset?

I wonder how they decide whether to issue a warrant or just break into the site in question. A warrant could imply that they are unable to attack the provider, or that they want to have a chilling effect.

[1]http://wiki.openrightsgroup.org/wiki/Regulation_of_Investiga...

salient• 13 years ago

"In the name of the People, shut down this facility!"

Well, that sounds familiar. It seems the more governments change over the decades, the more they stay the same.

arethuza2• 13 years ago

In a case of "Just because you're paranoid Don't mean they're not after you" Harold Wilson, who was paranoid about lots of things but particularly being bugged by MI5, was in No 10 at a time when there were bugs in cabinet room and PM's study - whether the bugs were actually used or not isn't known:

http://en.wikipedia.org/wiki/Harold_Wilson_conspiracy_theori...

Edit: If anyone is interested in this stuff, I can strongly recommend Dominic Sandbrook's histories of the UK in the 60s and 70s:

http://www.amazon.co.uk/Dominic-Sandbrook/e/B001HCWSSW/ref=n...

dingaling• 13 years ago

RIPA was strongly opposed by the IT and communications community during its 'consultation' period, but was passed largely intact. It was so intrusive a proposal that even people like me who often say 'I'll write and complain' actually did write a letter.

Predictions of its misuse have been borne out, particularly as the authorized users of communication data were never enumerated or restricted. So we have the situation today where local Councils use RIPA to obtain communication data regarding individual citizens' activities.

jackgavigan10• 13 years ago

..local Councils use RIPA to obtain communication data...

It's worth noting that legislation introduced during 2012 limited the circumstances under which councils could use RIPA powers [1] and required judicial approval for the exercise of those powers [2].

[1] http://www.legislation.gov.uk/uksi/2012/1500/article/2/made

[2] http://www.legislation.gov.uk/ukpga/2012/9/part/2/chapter/2/...

csmuk5• 13 years ago

Spot on. I wrote to my MP about RIPA. Not a sausage back.

throwaway_yy2Di• 13 years ago

A warrant could imply that they are unable to attack the provider

This is the institution which allowed U-boats to sink British ships so not to even hint that the ENIGMA cipher was cracked. I'm sure they're utterly incompetent at keeping secrets, and anyone on the internet can deduce their most critical SIGINT capabilities simply by observing how they deal with civil warrants in minor cases.

79522• 13 years ago

Well the Snowden revelations suggest that yes this kind of capability will become public. We exist in a space that is bounded by technological opportunities and limitations which agencies are just as subject to as everyone else.

CamperBob2• 13 years ago

This is the institution which allowed U-boats to sink British ships so not to even hint that the ENIGMA cipher was cracked. I'm sure they're utterly incompetent at keeping secrets

Easy call to make 70 years after the fact, I guess.

elemeno2• 13 years ago

From https://wiki.openrightsgroup.org/wiki/In_the_interests_of_th... -

"The House will notice that the Bill restricts the activities of the SIS and GCHQ for safeguarding the economic well-being of the country to the acts or intentions of persons outside the United Kingdom. The agencies may not and do not get involved in domestic economic, commercial or financial affairs."

So it's not quite as broad reaching as it reads on first glance. It is generally a problem though that laws need to be written so they're broad enough to cover circumstances which might not have been considered at the time of the laws' writing so that new laws don't need to be written all the time yet they can't be so overly broad as to be unworkable - which is why the judiciary has it's role in deciding how to interpret the laws and decide whether or not they ought to apply in a given circumstance.

jackgavigan10• 13 years ago

Also, one can argue that it's a good thing in general that our intelligence and security services' activities are regulated by laws like this (instead of operating in grey areas beyond the law).

And, by the way, activities carried out by the UK's intelligence and security services OUTSIDE the UK are also subject to RIPA.

DanBC2• 13 years ago

A warrant might just mean that they're asking for the information legally, so that they can use it, rather than relying on their illegally gathered hacked information.

A warrant might mean that they do not ever illegally hack sites, and that they only ever obey the law.

RIPA is problematic law, and it's nice to see discussion of RIPA cases involving GCHQ.

Not avoiding the problems of RIPA and GCHQ (I certainly think it needs better oversight and I'd prefer better law) RIPA has been abused quite a lot by many other organisations for stuff that US readers may find really awful.

Local education authorities spy on parents to ensure they're actually in the catchment area of a school that they want to send children to, for example. Or councils spy on people applying for parking permits to make sure those people live in that area, and aren't just selling the permits on. Having that activity regulated is important, but RIPA is less regulation and more encouragment.

jackgavigan10• 13 years ago

A warrant might just mean that they're asking for the information legally, so that they can use it, rather than relying on their illegally gathered hacked information.

Note that the "warrant", in this case, required that CertiVox hand over the key(s) to the encrypted data. It's possible that the authorities (not necessarily GCHQ itself, as NTAC provides assistance to other law enforcement and intelligence agencies) had already intercepted or seized the data but were unable to read it because it was encrypted.

anoncowherd• 13 years ago

> It allows the UK to monitor "in the interests of the economic well-being of the United Kingdom" which seems a little broad!

You're right, that is a bit broad. "In the interests of the UK's ruling class" would be more accurate.

jackgavigan10• 13 years ago

The headline attached to this submission is sensationalist and misleading. GCHQ did not force CertiVox to shut down PrivateSky. CertiVox decided to close PrivateSky after they were served with a notice issued under section 49 of the Regulation of Investigatory Powers Act (RIPA) which required that they hand over the key(s) required to decrypt one (or more) of their customer's data.

The underlying legislation can be found here: http://www.legislation.gov.uk/ukpga/2000/23/contents

The relevant section is 49 but sections 53 (Failure to comply with a notice) and 54 (Tipping off) are also of particular interest.

kintamanimatt5• 13 years ago

I disagree. The headline is reasonable because you can be put in a position in which you're not forced to do something, but it's extremely unreasonable not to do that thing. They weren't forced to close down per se, but their other options were extremely infeasible or reprehensible.

Bahamut• 13 years ago

Arguably it is a problem they created by the architecture they chose, in which this is a fatal flaw of design that was almost certainly something that could be anticipated.

jackgavigan10• 13 years ago

They weren't forced to close down per se...

That's the crux of the issue. They weren't forced to close down, they chose to.

End of discussion.

EDIT: Actually, why don't we see what the CEO of CertiVox has to say on the matter?

"The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash."

Source: https://news.ycombinator.com/item?id=6894316

Zigurd• 13 years ago

That doesn't appear to be the whole story. The claim to have needed to re-engineer their system to have access to keys, effectively making it a different service than it had been. And that means that a demand for keys can effectively make services where users' key are not accessible impermissible.

jzzskijj• 13 years ago

"or spend £500,000 building a backdoor into the system"

A nice round number... They had good motive to protect their customers and close the service. Why start talking about this kind of ridiculous development costs, that sound like it got pulled out of the air?

At least I'd be more sympathetic, if they sticked to the facts. I could even support their cause by posting and tweeting that this is terrible. Now I just feel, that cut the BS already, even they apparently were treated wrong and intimidated to shut down their business.

</rant>

elemeno2• 13 years ago

Since a comment claiming to come from the CEO of PivateSky is dead, it seems worth re-posting so that more people can read it :-

" This is Brian, the CEO. Yea, it was a nice round number out of the air. But it probably wasn't far off the mark.

For all the other comments, below is a blog post on the matter which is going to go live shortly:

With the story about our PrivateSky takedown now public, I want to take the opportunity to clarify a few points in various articles that have appeared since yesterday covering the story.

The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash. In fact, the headline contradicts the article, which becomes clear as you read it.

Secondly, a very important point wasn’t printed. GCHQ couldn’t, by law, request a blanket back door on the system. There are a very rigid set of controls that mean only specific individuals can come under surveillance. The legal request for such surveillance has a due process that must be stridently followed. At no time did I or anyone at CertiVox talk about CertiVox in relation to any RIPA warrant, only the generic process by which these warrants are served.

By saying “our friends at GCHQ”, there is no facetiousness intended. The team at CertiVox have the upmost respect for the folks we interacted with at GCHQ. They took the due process I outlined in the previous point very seriously. We found that as an organisation, and every individual involved there, were as worried about a breach of public trust as much as we are.

Finally, I believe very strongly the following should be a larger part of the public discourse of these subjects. What everyone needs to understand is that every developed democracy in the world, even where privacy rights are enshrined to the maximum efficacy by statute, has laws on the books that mandate that Internet Service Providers have facilities to work with law enforcement for the purposes of legal intercept, to enforce public safety and security.

Being L.I. capable is a very important set features and functions that must be in place for any credible, commercial service on the Internet. In endeavouring to make PrivateSky as secure as possible, we overlooked this critical requirement when we built PrivateSky.

When CertiVox positioned PrivateSky as the easiest to use and most secure encrypted messaging service, we really had two significant points of differentiation. First, even though we held the root encryption keys to the system, it was architected in such as way that it would have been all but impossible for our internal staff to snoop on our customer’s communications, or for the service to leak any of our customer’s data. Secondly, our possession of the root keys, and our use of identity based encryption, made the system incredibly easy to use. For the user, there were no private or public keys to manage, every workflow was handled for the user in an easy to grasp pure HTML5 interface, no hardware or software required, just an HTML5 browser.

We boxed ourselves into a feature set and market position that when called upon to comply with legal statues, we simply had no alternative but to shut the service down. We built it, but we couldn’t host it.

Why? Because as you can probably surmise, there is an inherent impedance mismatch between being able to host a commercial communications service that gives the upmost in privacy to its users, against any breach, whilst at the same time being able to operate safely within the confines of the law as it is on the books in most countries on the planet.

Is this wrong? Actually, I don’t think it is. This may be an unpopular viewpoint, but I cannot argue against having a well regulated legal intercept function as being necessary to have in place for a society that prizes law and order and the safety of its citizens. This is speaking as someone who lived in NYC during 9/11.

In summary, it’s the abuse of the communications interception in the Snowden revelations that has everyone up in arms, as so it should. But that’s not what happened with PrivateSky.

What is our next move?

Watch this space.

-----"

pistle• 13 years ago

Drop shadows in all the directions!

I like the idea obfuscating the location of the containers of the data as well as the content.

Shred, encrypt, disperse. You send a token to the recipient and they are able to use that to build location requests for the containers. Once they have the parts, they can assemble and decrypt.

So, in which country can this be developed?

spindritf2• 13 years ago

we had the choice to make - either architect the world's most secure encryption system on the planet, so secure that CertiVox cannot see your data, or spend £500,000 building a backdoor into the system

So, just like Lavabit as 'moxie keeps pointing out[1][2], it wasn't actually secure. Still, I like the principled stand they took.

[1] https://news.ycombinator.com/item?id=6672442

[2] http://www.thoughtcrime.org/blog/lavabit-critique/

_mhp_• 13 years ago

There is no actually secure - that's the problem. The best you can do is secure against specific threat models. Up until recently, most people didn't necessarily view government intrusion as a particularly credible threat, so didn't spend the extra time/effort/money mitigating against it.

One of the best things to come out of all these revelations, in my opinion, is a revised view of what threats we should consider which were previously dismissed as paranoid ramblings.

spindritf2• 13 years ago

Sure, but they don't seem any more (technically) secure than any other decent webmail provider.

maffydub3• 13 years ago

You're right that we may have been naive about trusting our governments.

What I don't understand is why anyone trusted businesses (such as CertiVox and Lavabit) to keep their emails secure?

If the businesses themselves couldn't decrypt these emails, there's nothing the government could usefully ask them for.

SoftwareMaven• 13 years ago

If they had to spend money building in the back door, that would imply it didn't exist already.

wavefunction• 13 years ago

So now our legal economic activities depend on the say-so of a shadowy, unelected cabal. I guess we're "destroying the village to save it."

at-fates-hands• 13 years ago

Just confirmation of another vendor who said no to the government intrusions on their customer data.

I"ll say it again since it bears repeating. How many more companies are complying and giving their keys to the government so they can track people that we won't hear about??

Makes me sketchy on using any "encrypted" email service right now.

create28• 13 years ago

CertiVox have released a blog on their site explaining more about PrivateSky shut down: http://www.certivox.com/blog/bid/359788/The-real-story-on-th...

CertiVox confirms it withdrew PrivateSky after GCHQ issued warrant

Related Stories