OPM’s Hack Doesn’t Inspire Much Confidence in Creating Encryption Backdoors

By | LXBN | June 8, 2015

The past few weeks have seen tech companies trading barbs over who has the best security offers for their customers. But the real losers of the whole thing? The government.

Credit: Flickr user gervais_group

Credit: Flickr user gervais_group

As the technology companies compete to respond to the public’s growing awareness of privacy, the government is upping its efforts to fight encryption, and enable a backdoor for law enforcement. The problem is, so far they haven’t proved themselves capable of handling something like that.

Last week, Michael Steinbach, an FBI official, testified before the House Homeland Security Committee to explain how the FBI uses technology to track, intercept, and apprehend supporters of ISIS around the world. His comments were part of the FBI and other law enforcement agencies’ fight against technology companies that encrypt their data.

“When a company, a communications company or an ISP or social media company elects to build in its software encryption, end-to-end encryption, and leaves no ability for even the company to access that, we don’t have the means by which to see the content,” Steinbech reportedly told the committee. “When we intercept it, we intercept encrypted communications. So that’s the challenge: working with those companies to build technological solutions to prevent encryption above all else.”

This isn’t the first time law enforcement officials have made statements against encryption practices, but it also unfortunately comes the day before the U.S. Office of Personnel Management (OPM) got hacked.

The hack could affect up to 4 million past and current government employees, and is suspected to have come from Chinese hackers, though it’s really too early to make any definitive statement. For those of you who think this all sounds familiar, you’re not having deja vu. It’s because this exact same thing happened to OPM less than a year ago.

Understandably, some like TechCrunch haven’t taken too kindly to the idea that the government should have unilateral access to data:

However, before everyone starts handing over information to the federal government, shouldn’t we have some sort of evidence that the US government itself actually has some decent cybersecurity skills?

…this is the second time in less than a year that this happened, and last time it was determined to be Chinese hackers who broke in — and that’s who is suspected again this time. In which case, “free credit reporting” services are likely to be totally useless. It’s quite likely that whoever hacked in wasn’t doing it to do identity fraud and swipe credit card numbers, but to get useful information for additional, more sophisticated hacks to get access to various government employees’ computers and networks.

Now obviously it’s not quite as simple as the fact the government gaining access to millions of users data and then putting it in harm’s way. But given the government’s history with data security and breaches, it’s worth examining a little closer how they handle the data they do have. But as Motherboard reports, the outlook seems a bit grim:

“There is a general notion that government agencies unilaterally have their act together when it comes to protecting their information assets,” Jay Kaplan, the founder of security firm Synack, and a former NSA analyst, told Motherboard. “This is fundamentally false.”

Kaplan also said that data held by OPM is “extremely sensitive” and its loss “could put key government employees that wish to remain anonymous at risk.”

Events like this likely won’t change the mind of Steinbech, or other officials like him, but as our lives become increasingly digitized the people who are able to get their hands on data are increasingly powerful. It’s good to know that at least someone out there is succeeding in staying one step ahead of hackers.

Tweet Like LinkedIn LinkedIn Google Plus