Password managers may not be as secure as many assume, with researchers uncovering multiple attack vectors across three popular systems serving 60 million users.

Security researchers from ETH Zurich studied the architecture of Bitwarden, LastPass, and Dashlane, which between them hold 23% of the password manager market.

The researchers demonstrated 12 attacks that would work on Bitwarden, seven on LastPass, and six on Dashlane, prompting calls for each to bolster defense capabilities.

“We were surprised by the severity of the security vulnerabilities,” said Kenneth Paterson, Professor of Computer Science at ETH Zurich, in a blog post from ETH Zurich.

The study focused on password manager claims that they use "zero-knowledge encryption," which means the companies don't know what users have stored.

"The promise is that even if someone is able to access the server, this does not pose a security risk to customers because the data is encrypted and therefore unreadable," said ETH Zurich researcher Matilda Backendal. "We have now shown that this is not the case."

Testing password managers

To test security capabilities, researchers set up their own servers that would act as though they were hacked password manager servers. They found they could alter passwords, access vaults, and more.

The study revealed "strange code architecture" that PhD student Matteo Scarlata attributed to the companies trying to improve ease-of-use for customers, such as offering password recovery or account sharing, as well as using out-of-date cryptography for accessibility.

"As a result, the code becomes more complex and confusing, and it expands the potential attack surface for hackers," Scarlata said.

Researchers urged password manager providers to use the most up-to-date cryptographic standards for all new customers, while existing customers could be offered the chance to migrate to updated systems or stick with older, compatible ones – providing they’re informed of the potential risks.

“We want our work to help bring about change in this industry,” Paterson said. “The providers of password managers should not make false promises to their customers about security but instead communicate more clearly and precisely what security guarantees their solutions actually offer.”

Industry response

ITPro contacted each of the companies for comment, but did not receive a response by time of publication.

However, all three have already published blog posts addressing the paper and issued fixes for the addressable flaws and used hardening measures for other concerns, thanking the researchers for their efforts.

Dashlane said the methodology was "useful", though Bitwarden also noted that the server-takeover scenario has never hit any password management product as far as it's aware.

Dashlane and LastPass stressed that there was no evidence that these flaws had been exploited as yet; Bitwarden added it has never suffered any security breach.

"Customers should continue using LastPass as normal," LastPass noted. "To continue to receive the best possible secure access experience, we always recommend that users check to ensure they are up-to-date and using the latest version of our browser extensions and apps."

Both companies noted they were selected by the researchers because their source code is publicly available. "We made that choice intentionally," Dashlane said in its blog post.

"Transparency makes it easier for third parties to inspect our design and hold us accountable. Security improves when systems are open to review."

Fixing the flaws

Dashlane explained that it fixed an issue that allowed the use of legacy cryptography to enable backwards compatibility and migration flexibility that could have allowed the injection of code into a secure vault, weakening the encryption that protects keys and user data.

"It’s important to note that the exploitation of this issue would require full compromise of a password manager’s servers, paired with a highly sophisticated threat actor able to execute cryptographic attacks, and an extremely significant window of time," Dashlane added.

Dashlane added that two other attack vectors detailed in the report relate to wider architectural issues that are well known in the encryption community, namely public key authenticity in sharing and transaction-based synchronization.

The password manager firm noted it – and indeed the wider industry – were well aware of both concerns, and had built in additional protections with that in mind.

"Public key authentication at scale is a known challenge that we as an industry must solve," the post added.

FOLLOW US ON SOCIAL MEDIA

The vast majority of companies aren't ready for the security threats posed by quantum computing, according to new research.

Analysis from Bain & Company, which surveyed technology leaders at 180 companies, found 90% didn't yet have systems in place to defend against quantum security threats – despite widely expecting them to arrive within the next five years.

When quantum computers do arrive, they're expected to be able to crack existing encryption techniques used to protect everything from email to financial transactions.

The US National Institute of Standards and Technology (NIST) has been working for a decade on new algorithms that can withstand such attacks – but now companies need to roll them out, with NIST advising enterprises need to be ready by 2035.

That message has been heard, according to Bain. Nearly three-quarters (71%) of those surveyed expect quantum-enabled attacks within five years, with a third predicting them within three years.

Similarly, two thirds believe quantum computing will exacerbate cybersecurity challenges.

Yet despite that just one-in-ten believe their existing safeguards will be enough. The same number of enterprises have a roadmap in place to address the risks, with most waiting to see what happens and hoping a third party solves the problem first.

No time to wait with quantum security

Companies shouldn't wait, Bain warned, pointing to rapid progress made by IBM, Google, and other industry leaders on this front.

"At a certain threshold, quantum computing will be able to easily and quickly break asymmetric cryptography protocols such as Rivest-Shamir-Adelman (RSA), Diffie-Hellman (DH), and elliptic-curve cryptography (ECC) and reduce the time required, weakening symmetric cryptography such as advanced encryption standard (AES) and hashing functions," the company noted in a blog post.

In a separate report, analysts from Juniper Research echoed concerns that too many businesses still underestimate the danger of quantum-enabled attacks and aren't doing enough to get ready.

This is a burgeoning market, the consultancy found, with analysts predicting the post-quantum cryptography market will grow from $1.2 billion this year to $13 billion by 2035.

That growth suggests progress in preparing for what the analyst firm has dubbed "Q-Day" – which they define as when quantum computers can compromise existing encryption.

Juniper Research noted that governments are clearly considering milestones, as are "forward-thinking organizations". However, awareness of the danger remains a serious hurdle.

“Many businesses still underestimate the risk of quantum-enabled attacks; making clearer, more accessible education critical to securing internal buy-in,” said Louis Atkin, Research Analyst at Juniper Research.

That echoes previous research by KeyFactor, which found as many as half of companies are not yet prepared to deal with cryptography made obsolete by the arrival of quantum computing.

The risks of quantum decryption

Bain said quantum computing will render today's cryptographic standards obsolete.

The highest impact will be on secure keys and tokens, digital certificates, authentication protocols, data encrypted at rest, and even network security and identity access management (IAM) tools. Essentially, anything currently relying on encryption.

Beyond that, quantum computing could supercharge malware and make it easier to identify and weaponize "zero day" flaws, Bain warned.

Another risk highlighted by security experts is "steal now, crack later" techniques, whereby threat actors harvest data now to decrypt later.

"Beyond these new types of attacks powered by quantum computers on current controls, terabytes of sensitive data already harvested by nation states and criminal groups over the last several years – spanning defense designs, chip architectures, energy technologies, and state secrets – will also become accessible and exploitable," Bain noted.

What can be done?

To prepare, companies should roll out post-quantum cryptography using algorithms that are strong enough to withstand quantum-powered attacks, Bain noted. Companies that fail to do so risk "exposing decades of encrypted data and compromising real-time systems”.

However, the consultancy noted that most existing algorithms designed for that post-quantum world have already been compromised – without quantum computers, but using traditional exploit flaws.

Notably, not all suppliers or vendors will be on top of the problem, so security teams will need to develop their own workarounds to keep the corporate stack safe.

"Organizations that are heavy with legacy infrastructure may be particularly vulnerable—and more attractive targets for attackers," Bain added.

Companies need a board-led – and funded – roadmap to consider post-quantum risks across their business decision making, ensuring quantum resilience across their own suppliers, existing technology, and even their products.

But so far, the Bain survey revealed only 12% of companies are considering quantum readiness as a key factor in procurement and risk assessments.

Juniper's Atkin noted that the rise of standards and regulations around post-quantum security has helped, notably from NIST, and investment in algorithms for encryption once Q-Day has passed is steadily increasing.

However, Juniper warned that for these technologies to be effectively adopted, organizations will need to collaborate to ensure interoperability across infrastructure – and borders.

"Many countries have accepted NIST’s standardized algorithms as the de facto quantum-safe option, even in nations with limited understanding of the quantum landscape," Atkin said. "It is vital this continues and that different sectors consider how their systems interoperate when implementing quantum-safe solutions."

FOLLOW US ON SOCIAL MEDIA

If you’ve ever wanted to see a real-world example of what happens when an unstoppable force meets an immovable object, you need only look at the stand-off between the tech industry and government over encryption.

In April 2024, European police have again warned that the rollout of end-to-end encryption (E2EE) is making it harder to investigate crime and keep people safe. Tech companies, for their part, have insisted that the rollout of the technology is essential to keeping consumers safe and are in no mood to back down.

How did we get here? It’s a long story.

It used to be relatively easy for police to access emails or other communications they deemed necessary to their investigations. That’s because, while emails might be encrypted as they travel across the internet, they were also usually stored by the tech company providing the service in a way that the authorities could access. 

The trouble is that – as was revealed a few years ago – many spy agencies around the world saw this rather trusting setup as an excellent opportunity to quietly scoop up as much data as they could, about everyone. And so, of course, they did just that. 

Not everyone was happy about that, for understandable reasons. 

This led to the introduction of E2EE by many tech companies. Once a message is protected in this way, it cannot be read by anyone until it arrives at the other end. There’s no database in the middle that tech companies can be made to hand over to the police, or that spy agencies and their hackers can target.

While this is good news for privacy, it’s bad news for law enforcement which continues to argue that poring over these messages is a necessary step to preventing crimes from being plotted or carried out.

We find ourselves in a tricky situation. User messages are largely safe from snooping due to E2EE and all the while police worry more about the fact that they can’t see everything they’d like to anymore. They argue for E2EE to be rolled back or somehow modified, so they can gain access through encryption 'backdoors' by design. 

That’s led to a row between governments and police on one side, and tech companies and privacy campaigners on the other. As one has pushed, the other has responded – for example, the E2EE messaging app Signal saw a surge in users during a parallel rise in protests across the US and Europe in 2020.

No right answer on encrypted safety 

What’s difficult about the encryption debate is that both sides see their actions as the ‘right thing’ to do. The government and the police are right: we cannot allow criminals to communicate in secret, with apps such as Telegram known to be  popular among cyber criminals.

And yet, the privacy campaigners are right too. We cannot undermine the security of online communications simply so that police can comb through every message we send and many criminal communities rely on the dark web rather than encrypted messaging apps.

That’s your immovable object and your irresistible force. None of this is to say the police and governments haven’t suggested a way forward (or rather, back). The trouble is, everything they suggest inevitably weakens security for everyone all over again.

For example, so-called client-side scanning would see tech companies adding features to effectively scan every image or every message for suspicious behavior before it was encrypted and sent. This neatly sidesteps the issue of breaking encryption, but introduces another problem by introducing a government-mandated scan of every message you send. 

It’s not exactly hard to see how various global regimes could tweak the scan requirements to create an excellent way to crack down on protest.

Some governments have already enacted laws to force tech companies to provide their customers’ messages, regardless of whether they are E2EE or not. The strange part is governments don’t seem willing or able to use it. 

In the UK, for example, the Online Safety Act effectively empowers the government to compel tech companies to hand over specific messages. But this can only be done without degrading the security of others, a feat the government itself has acknowledged is – at least for now – technically impossible.

Beyond the philosophical considerations, there is the harder reality. There are a small number of tech companies who are, in this situation at least, more powerful than governments. 

If any government ordered them to remove E2EE there would likely be three main consequences.

First, most companies would stop providing services in that country. The encrypted messaging firm Signal threatened to leave the US in 2020, as it added its voice to opposition of the US EARN IT Act, which is similar in scope to the Online Safety Bill. But who wants to be the politician explaining why voters suddenly can’t contact their friends or colleagues anymore? 

Second, that country would become one of the least secure places to do business online, with customers offered no legal avenue for completely secure messaging – hardly a claim that any government wants to make. Third, it would make it a lot easier for various regimes to make similar demands to crack down on dissent. 

As a result, we are left in a weird situation, with police and governments warning about encryption but not wanting to do anything about it.

The government has a power it likely doesn't want to enforce. Police are losing access to the intelligence that helps them do the job of keeping us all safe. Tech companies will continue to add strong encryption because it’s now a standard feature for many. 

The future for encrypted messages is uncertain

Perhaps chats with your distant relatives don’t really need state-of-the-art privacy tech. Others would argue we’ve already lost so much privacy in the information age that this small island of privacy is worth defending.

Either way, we’re unlikely to see the tech industry backing down on encryption, and in reality, there is little political will to force the matter. For now, it’s hard to know what would persuade tech users to give up on additional security, and even harder to know what would make tech companies change direction. Expect more broadsides against the tech industry, but little real action. 

But now we know, at least, what happens when an unstoppable force meets an immovable object: a messy stalemate that serves nobody well.

Quantum computing is an inevitable technology, with the private sector and nation-states racing to be the first to unlock its potential. While it can be used for all kinds of good, quantum computing could also be used to unravel critical systems.

One of the most common ways to protect data is to encrypt it using an RSA algorithm. In simple terms, it relies on the fact that while you can easily multiply one prime number by another, it’s very hard to work out prime factors from any given number. Quantum computing could make this much easier, allowing criminals to decrypt sensitive data.

The UK is among a number of nations investing in quantum computing, with the government having recently announced £900 million for exascale quantum computer. Stakes are high as we enter into what some have dubbed a ‘quantum arms race’, with the first to successfully crack encryption holding all the cards when it comes to its myriad use cases.

In this episode, Rory and Jane speak to Tim Callan, chief experience officer at cyber security firm Sectigo, about the current state of quantum computing research and how the industry can prepare for this seismic shift.

Highlights

“Think about those industrial secrets that, let's say, another nation-state might want to take away. Think about those military secrets, think about the plans for the stealth fighter. Those are the things that are very, very valuable. And those are the things that we need to worry about most immediately.”

“When I talk to people about this, I often say quantum computers are no longer a science project, they are now an engineering project. And what I mean by that is there's no question that it will work, and it will be commercially viable, and it will be practical. It's just about figuring out how to really get them all tuned in the way we want them.”

“What you should be doing now is you should be making yourself crypto-agile. Which means you have the ability to change your cryptography as needed at will. And there are a few steps for crypto agility. One of them is inventory or cryptography. Amazingly, most enterprises can't even tell you what cryptography they have implemented, where it is, how it's being used, whether or not it meets current standards.”

Footnotes

• What is quantum computing?
• What is the ‘steal now, crack later’ quantum computing threat?
• 2023 Spring Statement brings 'enhanced' tax incentives to tech SMBs
• Dell CTO: AI is nothing compared to the oncoming quantum storm
• Skills shortages could pose threat to UK’s quantum ambitions
• UK startup's Equinix deal marks step towards broad quantum computing access
• How quantum computing can fight climate change

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

A new update for the Google Authenticator app has drawn criticism from developers for allegedly opening users up to privacy and security violations.

Earlier this week, Google rolled out an update for Android and iOS allowing users to back up their one-time authentication codes to the cloud, but researchers have noted that the network traffic for this process is not end-to-end encrypted.

Security researcher and programmer duo, speaking from the single online handle of Mysk, alleged that without proper encryption, users’ two-factor authentication (2FA) secrets could be viewed by Google or potentially accessed by threat actors.

“Every 2FA QR code contains a secret, or a seed, that’s used to generate the one-time codes,” the researchers tweeted.

“If someone else knows the secret, they can generate the same one-time codes and defeat 2FA protections. So, if there’s ever a data breach or if someone obtains access to your Google Account, all of your 2FA secrets would be compromised.”

Mysk also stated that as 2FA QR codes contain data relating to the name of the service to which they relate, Google could access this data to serve users personalized ads.

Security analyst Graham Cluely echoed Mysk’s findings, saying “you shouldn't enable the feature as Google hasn't implemented it in a way that properly defends your security”.

The feature has been long requested, and Google said it has added it in acknowledgment of the frustration some users felt with one device being tied to crucial accounts.

“One major piece of feedback we’ve heard from users over the years was the complexity in dealing with lost or stolen devices that had Google Authenticator installed,” wrote Christiaan Brand, group product manager at Google in a blog post.

“Since one-time codes in Authenticator were only stored on a single device, a loss of that device meant that users lost their ability to sign in to any service on which they’d set up 2FA using Authenticator.”

With the new update, users will be able to access one-time codes again on a new phone once they have signed into the Authenticator app using their Google account.

Google Authenticator will automatically backup codes to the cloud, though users are able to use the app without a Google account.

Microsoft had already allowed cloud backups on Microsoft Authenticator, and its documentation page has outlined the extent to which keys sent to the cloud are encrypted with AES-256.

Some GitHub users will have to make changes to their terminal code after the platform replaced its RSA SSH host key after it was exposed.

The key was only "briefly exposed" in a public GitHub repository, it said, but took the measure to replace the key "out of an abundance of caution".

Mike Hanley, CSO and SVP of engineering at GitHub, assured users that GitHub’s systems haven’t been compromised, but that the key was exposed due to “an inadvertent publishing of private information”.

“We did this to protect our users from any chance of an adversary impersonating GitHub or eavesdropping on their Git operations over SSH,” Hanley said in a blog post.

“This key does not grant access to GitHub’s infrastructure or customer data. This change only impacts Git operations over SSH using RSA. Web traffic to GitHub.com and HTTPS Git operations are not affected.”

Secure Shell (SSH) keys are used in the SSH protocol as an access credential. It allows users to securely access network resources, including servers, and use them as if they were local machines.

Host keys are unique to each SSH client and if one was stolen and then abused, attackers could perform man in the middle (MITM) attacks to access user passwords or execute commands.

GitHub said that only the RSA SSH key was replaced, and users who rely on ECDSA or Ed25519 keys don’t need to make any changes.

However, GitHub users who see the message “WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!” when connecting to GitHub.com through SSH will have to make some changes.

Users need to remove the old SSH key by running the command '$ ssh-keygen -R github.com'.

Alternatively, they can also update their ~/.ssh/known_hosts file manually to get rid of the old key, and add the new one by inserting a new line that can be found in the company’s blog post.

Another method users can deploy is automatically updating the key in their ~/.ssh/known_hosts by running specific code in their terminal, which can also be found on GitHub’s blog post.

“This is maybe as bad as Heartbleed,” said Daniel Feldman, cloud security architect for HPE on Twitter.

"Everything was exposed, across many platforms and services, retroactively going back some period of time (we’re not sure how long yet).

“Like Heartbleed, it will be very difficult to prove whether or not someone actually used the exploit. They just might have.”

Heartbleed was a security bug introduced into the OpenSSL cryptography library in 2012 but only disclosed in 2014. The vulnerability allowed potential hackers to read the memory of websites affected with the bug, opening the possibility for cyber criminals to discover encryption keys.

In October 2021, GitHub revoked all SSH keys used in its GUI client GitKraken after it discovered that the software client was generating weak SSH keys.

GitKraken disclosed the flaw, detailing that weak keys could lead to a higher probability of key duplication. GitHub notified users whose keys had been revoked, and recommended developers to review SSH keys linked to GitHub accounts.

The capabilities of quantum computing have been rapidly developing over the last decade, and are expected to mature over the next. By 2030, in fact, the industry widely expects commercial quantum computing offerings to be available in the mainstream.

While the business use cases of quantum computing are being contemplated, so too has the advent of this technology piqued the interest of cyber criminals who now prefer to retain – rather than discard – heavily encrypted data where possible. These groups are embracing the idea of ‘steal now, crack later’, which involves harvesting and storing encrypted data until quantum computing gives them the tools to access the information.

Although the cyber security industry doesn’t expect cyber gangs to get access to powerful quantum computers next week, or even next month, businesses must begin preparing for the prospect of these machines one day cracking the encrypted data they hold dear today.

How long will your data remain secure?

A recent Gartner report noted the Rivest-Shamir-Adelman (RSA) algorithm has been used in almost every aspect of security over the last 30 years, but that key cracking is one of the small set of mathematically approachable problems quantum computing can solve.

“Quantum computers are advancing steadily, gaining the power and stability needed to pose a realistic threat to the widely-used public key encryption currently in place to protect sensitive data, applications and transactions,” says Greg Wetmore, VP software development at Entrust Cybersecurity Institute.

“There’s some uncertainty about when exactly there will be a quantum computer powerful enough to break the cryptographic algorithms currently in use, however many are operating under the assumption that this can happen within the next ten years.”

According to Gartner, conventional asymmetric cryptography is set to become unsafe to use as soon as 2029 – and will require the support of larger key sizes in just three years. Gartner's senior director analyst and co-author of the report, Mark Horvath, says, though, there's at least a decade before something like 2048-bit key can be broken.

Steal now, crack later attacks likely won’t be feasible

There’s no need for full-scale panic and just because this is possible, it doesn't mean cyber gangs will be routinely cracking encrypted files. In reality, most organisations won’t have access to the very large data centres needed to store this information long-term, and then access the quantum computing power necessary to decrypt this information once (eventually) available.

“For most cyber criminals the cost of accessing the quantum computing power is going to put it out of their reach, plus the need to resort to such sophisticated tools is not currently there,” says Will Richmond-Coggan, a litigator at law firm Freeths.

This is because the majority of cyber criminals focus on low-hanging fruit, where information can be accessed using traditional methods like social engineering or phishing. Experts agree those using quantum computing for nefarious means will mainly be nation state actors or state-sponsored groups looking to access highly sensitive information that could potentially affect national security.

“This kind of attack only makes sense for nation-states, who can reasonably expect to have powerful enough quantum capability in the near to medium term,” says Dr Chris Heunen, reader in quantum informatics and director of the Cisco Software Centre of Excellence at the University of Edinburgh.

“It’s also more likely to be high-value data with a long useful shelf life, such as intellectual property if its enterprise data, or defence and government-related data and intelligence,” adds Heidi Shey, a principal analyst at Forrester, highlighting that only certain organisations will appeal to these attackers.

Security risks extend beyond ‘steal now, crack later’

It’s worth noting, however, that security risks from quantum computing extend beyond the nature of harvesting encrypted data now with a view to decrypting it at an indeterminate future date. Shey points to the fact that breaking existing public key cryptography will also have an impact on the encryption used for secure communications and digital signatures.

“It impacts critical infrastructure if the hardware and software on devices used in these environments rely on public key cryptography,” she says. “Blockchains are also technically breakable by quantum computing,” adds Horvath, “and so the major blockchain companies like Bitcoin and Ethereum are (already) working on quantum-safe protocols for blockchains.”

How to prepare for quantum-powered attacks

These cryptocurrencies aren’t alone in preparing for the dawn of quantum computing and its potential effect on cyber security.

In the US, for example, the National Institute of Standards and Technology (NIST) has been working on its post-quantum competition for standardising protocols since 2017. At the end of last year, too, President Biden signed the Quantum Computing Cybersecurity Preparedness Act. Shey adds a White House memo recently asked US agencies to perform a cryptographic inventory, alongside proposed legislation on post-quantum cryptography.

What do businesses need to do?

I’ll be many years before the wider cyber criminal community has access to the quantum computing tools necessary to hack heavily encrypted data. Only a handful of businesses, too, are likely targets for those most likely nation-state attackers. This means the majority of organisations have little to fear from the arrival of quantum computing.

It’s also important to remember the benefits will far outweigh any cyber security risks. Even so, it’s important for organisations to establish risk level clearly, and what steps they might, therefore, need to take to protect encrypted data.

Both Horvath and Shey agree the responsibility for this preparation starts with the CISO or CIO within the organisations, and that the first steps should be to look at the sensitivity and long-term value of an organisation’s data. Sensitivity will help you establish risk level, while lifespan will point to the steps you may need to be taken.

“If its lifespan is going to be two or three years you don’t have to worry about it,” says Horvath. “If it’s more like four to seven years, then you can extend the key lengths that you use today. Something like 3072-bit will extend the lifetime of your data security well into the 2030s.

“If you have data, such as mortgages, bonds or financial instruments, that have a lifespan of more than ten years, then you need to start thinking about what your strategy is going to be regarding the introduction of quantum safe encryption.”

Getting ready for the post-quantum world

In the end, all organisations will need to ensure they’re ready for a post-quantum world. Every business needs to begin working on its strategy to ensure post-quantum readiness, which should include building maturity into how cryptographic assets such as certificates, keys, secrets and crypto libraries are managed.

Organisational changes can take time to implement, so it’s imperative to get a head start. But Wetmore points out that previous cryptographic transitions, such as the migration from SHA-1 to SHA-2, resulted in disruption and proved costly and time-consuming for organisations to implement.

The transition to post-quantum encryption will be much more complex, as quantum doesn’t act like the cryptography we have today.

This means it’s not as simple as a drop-in replacement, as the post-quantum algorithms currently identified have completely different key generation, exchange, encryption and decryption properties from the ones they’re replacing. Each business will have different steps it needs to take to make sure it’s ready for the incoming quantum era, but there will be something for every organisation to do.

Google has revealed that client-side encryption (CSE) will be now generally available for Gmail business customers as the company looks to bolster security features for users.

In a blog post, the company revealed that CSE will take “existing encryption capabilities to the next level” for Workspace customers, providing users with “sole control” over encryption keys and complete control over access to data.

The inclusion of CSE means that Google can’t see the contents of emails hosted on the platform as data is “encrypted before it reaches Google servers.”

Google said this will provide greater protection for business users required to store sensitive or regulated data.

“Google Workspace already uses the latest cryptographic standards to encrypt all data at rest and in transit between our facilities,” the company said. “Client-side encryption helps strengthen the confidentiality of your data while helping to address a broad range of data sovereignty and compliance needs.”

“Using client-side encryption in Gmail ensures sensitive data in the email body and attachments are indecipherable to Google servers. Customers retain control over encryption keys and the identity service to access those keys."

Gmail users will also be able to encrypt emails sent within their organisation, in addition to emails they send to users of other email providers.

Client-side encryption rollout

The launch of the feature follows a successful beta testing period for selected users announced in December last year.

CSE is already available for Google Drive, Docs, Sheets, Slides, and Google Meet. However, this move will expand CSE features and will be officially rolled out for customers using Google Workspace Enterprise Plus, Education Plus, and Education Standard.

The new feature will not be available for personal accounts or users of Google Workspace Essentials, Business Starter, Business Standard, Business Plus, Enterprise Essentials, or Legacy G Suite and Business customers.

Customers already enrolled in the beta will not be required to make changes following the launch, the company confirmed.

How to turn on client-side encryption in Gmail

In its blog post, Google said CSE will be switched off by default, meaning admins will be required to enable the feature at the domain, OU, and group levels.

Admins can do this by following: Admin console > Security > Access and data control > Client-side encryption.

“With Google Workspace Client-side encryption (CSE) for Gmail, you need to enable the Gmail API and give it access to your entire organisation,” the company notes in an explainer.

“Then, for each user, you need to use the API to upload an S/MIME (Secure/Multipurpose internet Mail Extensions) certificate and private key metadata encrypted by your key service.”

Once CSE has been enabled by a Workspace admin, individual end users will be able to add this feature to any message by clicking the ‘lock’ icon and selecting the additional encryption option.

If you work in the corporate world, you’ll be familiar with cybersecurity rules and regulations. Unfortunately, cyber-attacks are taking place at an astounding rate and have become a key challenge for companies across sectors, sizes and geographies.

According to Cybersecurity Ventures, more than 2,000 cyber-attacks occur around the globe each day – that’s an incident every 39 seconds. And these attacks have significant consequences. Estimates suggest that by 2025, global cybercrime will cost $10.5 trillion annually, not to mention the personal security risks and reputational damage that can occur as a result of a hack. With stakes this high, there’s no doubt that cybersecurity must be top of every organisation’s agenda.

Many different solutions and approaches exist, but no matter the tactics, encryption should be central to any cybersecurity strategy. Encryption technology converts sensitive data into code that only the intended recipient can decipher, thus facilitating the safe transfer and access of important information. Let’s take a look at some of the key encryption-based offerings that businesses can utilise to protect against malicious and costly attacks.

Website Security

SSL Certificates play a critical role in securing websites for businesses of all sizes. Installing SSL Server Certificates on a website lets companies enable the Transport Layer Security (TLS) protocol, a standard solution used to ensure online transaction security. TLS guarantees that a user’s session on a website remains fully encrypted and that all the data transferred between the user and the website is kept secure. This is evidenced by a padlock icon displayed in the browser bar. SSL Certificates also provide server authentication, which allows the user to verify the authenticity of a given site.

There are three categories of SSL Certificates: Extended Validation (EV), Organisation Validation (OV) and Domain Validation (DV), all of which offer the same level of encryption but with different approaches to vetting and verification. In addition to these categories, there are also several types of SSL Certificates available, including Single Domain, SAN and Wildcard. Which you use depends on how many domains and subdomains you’re looking to protect with the certificate.

When considering an SSL Certificate provider, it’s important to choose one with experience implementing all categories and types of certificates, as well as the knowledge to help you pick the best option for protecting your business. For increased flexibility, look for a security partner that enables clients to request and issue their own certificates with a Certificate Signing Request (CSR). This can help expedite processes and reduce reliance on external teams to implement new certificates. Some providers also offer services that deliver certificates automatically – another plus for increasing efficiency.

Email Security

Encryption also play an invaluable role in email communications. Business emails are a common entry point for cyber criminals and a source of costly attacks. In fact, according to the Federal Bureau of Investigation (FBI), as of December, 2021 global Business Email Compromise attacks had resulted in more than $43 Billion in losses.

Safeguarding the confidentiality and integrity of all business emails has never been more important and obtaining S/MIME certificates is a crucial step in keeping communications secure. S/MIME Certificates provide powerful protection against email hacks with end-to-end encryption and a digital signature. They ensure that email material is accessed only by the intended recipient and allow that recipient to easily confirm the sender’s identity.

When selecting an email security solution, consider vendors with Corporate S/MIME Certificate options that can configure the technical signature method to a company’s specific regulatory framework, as well as other particular needs. The ability to tailor the solution in this way can help ease adoption. If you want to test the effectiveness of S/MIME Certificates on your personal email, look for a vendor that offers free options for this use.

Software Security

Code Signing Certificates, which are essential in protecting against harmful malware attacks, are a third tool that all businesses should have in their cybersecurity arsenal. These certificates allow users to put a digital signature on a wide range of software or application components to confirm their origin, guarantee authorship and ensure code has not been altered. Code Signing Certificates connect the identity of an IT organisation to a private key used by the developer or distributor to sign the code, as well as a public key that allows the end-user to verify the identity of the signing party, thus ensuring the software is reliable.

These certificates can provide valuable protection against potentially crippling malware attacks, but there are a few best practices to consider to ensure their effective use. First, limit the number of personnel who are able to access the machines used for the code signing process – the fewer people with access to the private keys, the lower the chance of error or misuse that could compromise the protection. Keep close track of all code signing operations to prevent the signature of unapproved or malicious code, and store the keys with security-compliant tools to reduce the chance of attacks. It’s also recommended to scan for viruses before signing any code and add a timestamp to the signed code. Finally, don’t sign all software with the same certificate and be sure to change keys frequently.

There’s no doubt that cyber-attacks have become a constant threat for today’s businesses. Fortunately, encryption technology exists to help organisations protect themselves in today’s hostile cyber environment. By utilising encryption and implementing critical safety solutions and measures, businesses have the ability to thwart malicious attackers and protect against damaging hacks. Encryption may only be one piece of the puzzle, but its applications are far-reaching across the security space – making it central to any cybersecurity strategy.

To boost your organisation’s security with Actalis certificates, click here.

As companies struggle to get the most out of their data while adhering to strict regulations, privacy-enhancing technologies (PETs) have started to gain traction. Among the benefits, this set of technologies allows firms to extract data without compromising individuals’ privacy.

PETs are particularly useful for performing analytics on customer data – something that Facebook owner Meta has been doing to boost the success of its digital advertising business in an increasingly privacy-conscious consumer market.

Other big tech firms are also taking advantage, with Google and Apple among those creating, championing and using PETs. The pair used privacy-friendly technologies when rolling out contact tracing schemes during COVID-19.

PETs are gaining so much attention that the US and UK governments announced a joint initiative last year to boost adoption. Businesses will now rightfully consider how PETs can be integrated into their core processes.

What are privacy-enhancing technologies?

PETs are a set of technologies that offer the ability to analyse or manipulate data without compromising privacy. “PETs provide a way of analysing data in a privacy-friendly way to continue reaping the benefits, while at the same time minimising the risks associated with maintaining and safeguarding it,” says Michael Markevich, senior director of risk and security at browser company Opera.

One of the core pillars of PETs is homomorphic encryption, which allows complex computations to be performed without decrypting the data. Another type of PET is a trusted execution environment, which allows processing by a secure part of the computer isolated from the main operating system.

Secure multiparty computation, meanwhile, allows different parties to jointly process a dataset without sharing information with each other.

The power of PETs lies in their ability to protect data while it’s being used or processed. This allows searches, analytics and machine learning models to extract value securely and privately from multiple data sources, says Dr Ellison Anne Williams, founder and CEO at Enveil.

The use of PETs can therefore boost consumer trust, as well as offer a basis to adhere to regulations such as GDPR and the UK Data Protection Act (DPA) 2018.

'Soft' PETs vs 'hard' PETs

There are already multiple types of PETs, which all fall into ‘soft’ and ‘hard’ categories. A soft PET assumes you can trust a third party to process personal data. Luke Dixon, partner, IT and data specialist at law company Freeths cites the example of an organisation using controls to authorise certain parties to have access to data.

Transport Layer Security (TLS) used in email, instant messaging, and the HTTPS protocol are examples of soft PETs. “TLS relies on a number of third-party certificate authorities that are trusted to verify the authenticity of digital certificates,” Markevich explains.

In contrast, a hard PET works on the basis that third parties cannot be trusted in relation to the data. Examples include virtual private networks (VPNs).

What do PETs look like in a real-world setting?

PETs are only just starting to be used in real-world settings. The most common uses for businesses are encryption and pseudonymisation, adds Simon Walsh, partner at Oury Clark Solicitors. “Businesses tend to use these types of software as a way to collect data and assess the behaviours of individuals without the need to process large amounts of personal information.”

PETs can benefit multiple vertical industries, including financial services, where they can help with anti-fraud and money laundering initiatives. “Data silos and privacy boundaries continue to cripple financial organisations’ ability to fight criminal activity such as fraud and money laundering,” says Williams.

PETs allow banks to perform encrypted searches on data containing sensitive customer information. “This allows them to gain insights in near real-time while ensuring personal information is never exposed outside of its original jurisdiction,” she explains.

In healthcare, PETs are being used to analyse patient data and drive insights into drug interactions, clinical trials and research to improve health outcomes,” says Michael Hughes, chief business officer at Duality Technologies.

For example, genomic data, clinical data, patient disease registries and electronic health registries exist separately and are distributed across thousands of hospitals and research firms. “PETs are being used to allow healthcare researchers and firms to combine these disparate data sources together to fuel discovery, identify patterns and develop more effective interventions and treatments.”

How to integrate PETs into business processes

The advantages of PETs are clear, so how can businesses start to integrate PETs into their tools and services? Firstly, it's important not to rush into PETs and to determine relevant use cases for the technology. Businesses need to “think long and hard” about how best to implement PET systems into their workflows, says Markevich.

He says the primary challenges are technical. “For example, having a distributed trust system would be a prerequisite for most forms of PETs, and those are very difficult to implement at the moment.”

Taking this into account, firms should also ensure they have the right skills in place – or make sure they can access these through partners.

PETs are hailed as a tool to help firms comply with regulations, but official guidance around this is still at an early stage. In the UK, the Information Commissioner’s Office (ICO) issued draft guidance on the use of PETs in September 2022. As part of this, the organisation recommends businesses conduct data protection impact assessments (DPIAs) to assess their use of PETs.

“The ICO recognises that PETs can ‘unlock safe and lawful data sharing where people can enjoy better services and products without trading their privacy rights’,” says Lauren Wills-Dixon, a solicitor at Gordons. Yet, she warns organisations to exercise caution in their implementation. PETs should be utilised to augment existing frameworks “rather than as a panacea to satisfy all their data protection compliance needs”, says Wills-Dixon.

They are new technologies but in an era where both data and consumer trust are key to doing business, the future for PETs looks bright. “Data is arguably the biggest commodity in the world, and this creates a need for technology that protects the privacy of individuals and helps to demonstrate compliance with strict data protection laws,” Wills-Dixon continues. “PETs are very much here to stay and hopefully, we will see more regulatory guidance and codes of conduct to help organisations implement these technologies safely.”

WhatsApp has announced new support for proxy server connectivity, allowing its users to retain access to the messaging service in areas with state-controlled internet.

The firm stated that the update was driven by a concern for users that are being cut off from the outside world by government internet restrictions, and will shield users from communications blackouts.

The Iranian government has restricted access to Meta platforms such as WhatsApp and Instagram in recent months, and engaged in a shutdown of internet services as human rights protests have escalated across the country.

Proxy servers work by acting as an intermediary between a user and the internet-hosted service that's trying to be accessed. In cases where states limit or outright block access to WhatsApp, users will be able to connect to a proxy server that's separated from WhatsApp which then acts as a bridge to access the communications platform, bypassing state-imposed blocks.

“Our wish for 2023 is that these internet shutdowns never occur,” said WhatsApp.

“Disruptions like we’ve seen in Iran for months on end deny people’s human rights and cut people off from receiving urgent help. Though in case these shutdowns continue, we hope this solution helps people wherever there is a need for secure and reliable communication.”

In a blog post, WhatsApp confirmed that the change will not affect the end-to-end encryption (E2EE) of messages sent using the app, and reaffirmed that neither those running proxy servers, nor WhatsApp and Meta, will be able to intercept messages sent using the new method.

To activate the feature, users simply select ‘Use Proxy’ in WhatsApp’s settings, and enter a valid proxy address. These can be shared on social media, or prior to a blackout to ensure that users can continue WhatsApp communication even with heavy network restrictions in place.

Speaking to IT Pro, Mona Schroedel, a technology and privacy expert at law firm Freeths, welcomed the news but highlighted concerns around the management of volunteer servers and the potential powers afforded to criminals.

"From a data protection perspective, users are being assured that end-to-end-encryption remains in place. However, it should not be forgotten that the third party proxy server will receive the users’ IP addresses in the process," she said.

"The difficulty with this, at least in theory, may well be that not much is known about the volunteer proxy server, its location and the technical and organisational safeguards the volunteer organisation may have in place to protect that information.

"Repressive regimes who may have an interest in identifying those individuals using such a service - potentially even through setting up a proxy server themselves - regardless of whether they can decode the messages sent. Democratic regimes may also be concerned about the ability that this might give to terrorists or criminals to set up and operate their own unsupervised encrypted communications networks."

The issue at hand

Protests intensified in Iran following the death of 22-year-old Mahsa Amini under suspicious circumstances in ‘morality police’ custody. The suspicious deaths of further protesters such as Nika Shakarami have since increased anti-government activity.

In September 2022 the hacktivist collective Anonymous hacked Iranian government websites, as well as pro-government media organisations, in support of the protestors. The group has encouraged protesters to utilise the deep web onion router TOR to use the internet without censorship, as the Iranian government has blocked access to traditional virtual private networks (VPN).

According to Statista, WhatsApp is the most popular messaging app in the world with over 2 billion users, and the app has strong business use cases. Approximately 400 million people in India use WhatsApp, and the app plays a major role as a go-between for companies and customers throughout the country. It is also used for in-house communications channels in many companies.

The Indian government has shut down internet access in Kashmir several times over the past decade, in response to anti-government protests in the region. While past bans have included a region-wide communications blackout, specific action has also been taken to block messaging platforms such as WhatsApp and Twitter.

The company has encouraged volunteers and organisations worldwide to set up proxy servers, in order to establish a network free from blackouts, and stated that the feature will work with servers on ports 80, 443, and 5222.

In recent years, Meta has championed the use of E2EE, against backlash from the UK government. It plans to extend E2EE to all its messaging services, including Facebook Messenger and Instagram throughout 2023, having delayed this rollout due to legislative pressure over harmful online content.

The government’s much-delayed Online Safety Bill seeks to compel social media firms to scan all messages sent on their platforms for harmful content, which would mean installing a backdoor that privacy rights campaigners such as Big Brother Watch have criticised as a threat to free speech.

For more information on establishing a proxy server, WhatsApp has outlined the process in more detail on a dedicated GitHub repository.

WhatsApp via proxy is available now in the latest version of the app.

Apple has announced it will begin allowing users to secure data backed up to their iCloud using end-to-end encryption.

The feature, dubbed Advanced Data Protection for iCloud, will debut for users participating in the company’s beta software programme. The tech giant revealed the feature will be available for US-based users by the end of 2022 and will roll out globally early next year.

At present, Apple offers end-to-end encryption for data already stored in its cloud platform, including passwords, credit card and payment details, and health-related data.

The advanced feature will extend this protection, allowing users to back up other sensitive information such as photos, notes and iCloud backups.

This change will not cover all data, however. The company has confirmed that contacts, calendar information and email info will not be encrypted.

Craig Federighi, Apple’s senior vice president of software engineering said the new privacy features are a signal of Apple’s “unwavering” commitment to providing users with the “best data security in the world”.

“We constantly identify and mitigate emerging threats to their personal data on device and in the cloud,” he said.

“Our security teams work tirelessly to keep users’ data safe, and with iMessage Contact Key Verification, Security Keys, and Advanced Data Protection for iCloud, users will have three powerful new tools to further protect their most sensitive data and communications.”

Initially, Apple users will be required to opt-in to the new feature and granted a specific encryption key which will be stored on their device.

Ivan Krstic, Apple’s head of security engineering and architecture, revealed that a key benefit of the Advanced Data Protection feature is that it will ensure iCloud data will be protected in the event of a cloud breach.

“Advanced Data Protection is Apple’s highest level of cloud data security, giving users the choice to protect the vast majority of their most sensitive iCloud data with end-to-end encryption so that it can only be decrypted on their trusted devices,” he said.

However, Jamie Akhtar, CEO & co-founder of CyberSmart, warned that the proposed opt-in requirement could leave users unprotected and place responsibility for data protection in their hands.

"With increased cybersecurity awareness among the general public, cultivating digital trust is imperative to business survival. Apple has long been the exemplar of this, having time and again invested in its user security,” he said.

“Unfortunately, the downside of Apple’s latest measures is the requirement for users to ‘opt-in’ which will likely leave many unprotected as the onus is on them to take action,” Akhtar added.

Similarly, Tony Sabaj, mobile security expert at Check Point Software noted that the added layers of security - including encryption keys - could inhibit users.

“This added layer of security is not without drawbacks as the end user is now responsible for storing, backing up and securing their own encryption keys,” he explained.

“From our experience in mobile security, even though Apple is taking steps to improve privacy, malicious apps, text/iMessage phishing and zero day threats will be unaffected by these measures.”

In a thread on Twitter, Matthew Green, professor of cryptography at Johns Hopkins University, said the encryption move “sets the standard on what secure consumer cloud backup looks like” and marks an important precedent for users globally.

“Even as an opt-in feature, this move will have repercussions all over the industry as competitors chase them,” he said.

Bolstering data security

The move by Apple forms part of a broader strategy focused on bolstering security, with the company adding that the releases come “as threats to user data become increasingly sophisticated and complex”.

Research conducted by Apple found that the number of data breaches has more than tripled between 2013 and 2021. In addition, the study found that 1.1 billion personal records were exposed globally during 2021 alone.

In 2023, the company plans to begin supporting the use of hardware keys to improve two-factor authentication. Similarly, toward the end of 2023, Apple also plans to launch a feature called ‘iMessage Contact Key Verification’.

This new feature will enable users to confirm they are interacting with an intended contact. The verification scheme will also issue users with a warning if they are communicating with a contact or individual with “compromised” iMessage infrastructure.

Melissa Bischoping, endpoint security research director at Tanium, welcomed the move as a positive step to ensure that users are safeguarded amidst escalating global security threats.

“Apple has introduced these important security features to keep pace with the threat landscape and threats to privacy,” she said.

“By leveraging these features, you can know that your data is encrypted; even if the company holding the data is breached, you have additional assurance that you will not be a secondary victim. I am hopeful that this trend continues, as these protections are essential for reducing the secondary victimisation of a services' users after a data breach.”

Two apps described as 'mandatory' for attending the Qatar World Cup have been the subject of privacy complaints by multiple European data regulators, amidst claims they collect sensitive data outside of their remit.

‘Ehteraz’ and ‘Hayya’ are both apps released by Qatar’s Ministry of Interior and its Supreme Committee for Delivery & Legacy, respectively. The former is listed on Google Play as a contact tracing app for the tournament, while the latter is listed as a portal through which to book tickets, manage accommodation, and enter stadiums, but experts have argued that the permissions required by both apps go far beyond these basic functions.

In a statement, Germany’s BfDI (The Federal Commissioner for Data Protection and Freedom of Information) urged football fans looking to download the app only to do so if “absolutely necessary”.

The regulator also suggested that users should put the apps on a spare phone that contains no other personal data or contact information, and wipe the phone's storage and operating after use.

It alleged that the permissions and data processing of both apps goes beyond that described on their app store listings, that one of the apps tracks the number of phone calls made, and that data used by the apps is “transmitted to a central server” in addition to remaining on the device.

Datatilsynet, Norway's data protection authority, likewise stated that it does not know “what these apps actually do,” but that Ehteraz is required for seeking any medical treatment whilst in Qatar.

It recommended not giving the Hayya app permission to use device location and urged all businesses planing to send employees to the Qatar World Cup to carry out proper risk assessments.

“We are alarmed by the extensive access the apps require. There is a real possibility that visitors to Qatar, and especially vulnerable groups, will be monitored by the Qatari authorities.”

Google Play notes that Hayya’s security practices do not include data encryption, and the developer has neglected to provide a way for users to delete their data. The official FIFA guidance on Hayya explains that a Hayya card is “required to access the stadium on match day”.

The UK government's travel advice for Qatar states that visitors will not be required to register with Ehteraz prior to arrival, but that Hayya is a mandatory ID required not only for entering stadiums during the event, but also for entering Qatar in general.

“We are aware of media reports on this matter and we will consider the potential impact on the privacy rights of UK citizens,” an ICO spokesperson told IT Pro.

“If anyone is concerned about how their data has been handled, they can make a complaint to the ICO. We’d also always advise travellers who may be heading to Qatar to refer to our Your Data Matters page to ensure they are aware of their data rights."

The ICO declined to comment on the suggestion of using spare phones for app use.

Apps released for the promotion of, or to interface directly with, sports events have a history of security concerns. At the start of 2022, a ‘devastating flaw’ was discovered in China’s Beijing Olympics app that allowed threat actors to circumvent encryption intended to protect users’ files and voice recordings.

The MY2022 app, the use of which was mandatory for both international and domestic visitors to the games, was also found to transmit some metadata without any SSL encryption and lacked transparency over the extent to which it shared user medical data with third-party organisations.

In response, the Federal Bureau of Investigation (FBI) urged athletes to use temporary phones throughout the Beijing Winter Olympics, and advised participants and spectators not to download apps required to attend the event for fear of personal data theft, tracking, or malware.

Researchers at cyber security firm WithSecure have issued an advisory, warning that the method used to generate encrypted messages in Microsoft Office 365 can be cracked relatively easily.

Microsoft Office 365 Message Encryption (OME), a feature offered within the Office 365 suite, allows enterprise users to send encrypted messages as an HTML attachment via email.

Microsoft says the function is useful for sending sensitive data such as medical records, but WithSecure contends the service uses an insecure method of operation for encryption, allowing threat actors to infer the structure of encrypted messages.

OME messages are generated using Electronic Codebook (ECB), in which the text of the message is broken down into cipher blocks that are individually encrypted using a key stored and managed by Microsoft, through Azure Rights Management (Azure RMS). Each character within the plaintext is directly substituted for a cipher text character, according to the key.

However, through this method identical blocks of plaintext will return identical blocks of encrypted text, allowing patterns within the content to be identified. This is particularly the case with emails, which have structures that are more easily predicted than other types of messages typically sent through end-to-end encrypted (E2EE) apps, such as Signal or WhatsApp.

Emails within organisations, which are likely to contain repeating headers or footers, might be especially vulnerable to this kind of malicious decryption, as patterns reveal the encrypted substitutions for plaintext. If a message from an organisation always signed off in the same way, an attacker with access to a database of such messages would be able to partially decrypt each one.

WithSecure has advised organisations to consider alternative channels of communication for sensitive company information.

Recipients are required to access messages through a one-time passcode, valid Microsoft account, or work account in order to decrypt messages, and end-users can revoke access to sent emails at any time.

However, OME imposes no usage limitations on the attachment itself. It's possible, therefore, that threat actors could intercept the attachments, print them, or be forwarded them by the original recipient with little remediation possible on the sender’s end.

WithSecure reported the issue, which it classifies as a vulnerability, to Microsoft on 11 January. However, after several repeated attempts to contact the tech giant, and a notice that it would go public with the disclosure, WithSecure claims it received the following message from Microsoft on 21 September:

"The report was not considered meeting the bar for security servicing, nor is it considered a breach. No code change was made and so no CVE was issued for this report."

Researchers cite Microsoft compliance documentation to posit that ECB is used to maintain backwards compatibility with legacy versions of Office, which only support Advanced Encryption Standard (AES) 128-bit ECB.

In addition to OME, enterprise users can use two other encryption services within Office 365. These are Information Rights Management (IRM), and S/MIME, which both offer greater control over the access rights of sent messages. Messages sent through these alternatives are also encrypted using different methods of operation, but come with their own accessibility benefits and drawbacks.

“The rights management feature is intended as a tool to prevent accidental misuse and is not a security boundary," a Microsoft spokesperson told IT Pro.

"To help prevent abuse we recommend customers follow best security practices, including keeping systems up to date, enabling multi-factor authentication, and using a real time anti-malware product.”

Microsoft also stated that its use of ECB encryption supports legacy applications, and that it is working on alternative encryption protocols for future product versions.

This article has been updated to include a statement from Microsoft.

Celebrating its 20th year in 2025, it's little surprise that TeamViewer is one of the first names to come to mind when looking for a remote access solution. Built for Windows, Windows Server, macOS, and common Linux distros, it lets you administer a whole fleet of remote machines from a single keyboard and mouse – or from an Android or iOS client.

It's primarily used by IT technicians who need to access clients' or employees' devices, and by employees who need to access office computers from home or while travelling. As well as facilitating remote control of a distant machine, much like VNC, some tiers allow for file transfer, video conferencing, and collaboration.

Pricing varies, based on features and use case, with single-user access to three managed devices starting at £15.90 a month, billed annually. A single business licence, at £35.90, adds Google Meet integration, mobile device support, the ability to record and play back sessions, and a 200-device limit. Team plans run from £67.90 for 15 users and 300 devices, and enterprise pricing is fully customised, so quoted on request.

Non-profit and education users get a 30% discount, and there's a free tier for personal use, although that drops support for file transfers, Wake on LAN, and remote printing.

However, TeamViewer isn't your only option. A wide range of alternatives offers a similar set of core tools plus a range of specific features tailored to particular use cases. Here, we'll take a look at six alternatives you may want to consider alongside TeamViewer.

The best TeamViewer alternatives available

Chrome Remote Desktop

Chrome Remote Desktop uses a proprietary protocol to connect computers over the web. It's entirely browser-based, as you might expect from Google, and guests don't need to install anything, so long as their browser supports WebRTC. Most modern browsers will satisfy these requirements.

Host machines will need to be running Firefox or Chrome, plus the necessary host utility, which you can download for free from remotedesktop.google.com. Once installed, set a six digit pin to protect your machine and grant the necessary access rights at the OS level – and you're done. The connection is saved to your Google Account, so all you need to do to use it is log in to the same account on a second machine, and click the name of the device you want to access.

Once connected, you can set up clipboard synchronisation so that anything copied on one machine can be pasted on the other, and you can transfer files between machines by opening the hidden sidebar (look for the tab on the right of the browser window).

If you won't need to return to the remote machine several times, you can instead set up an ad-hoc connection by generating a one-time code on the host and typing it in on the guest. This function is hived off in a separate Remote Support section, and although it's for short-term use, so isn't the option you'd use if you regularly want to work with your own machine remotely, it still allows keyboard and mouse control of the host.

Chrome Remote Desktop is a neat, free solution for accessing remote machines, on either a one-off or ongoing basis. For many smaller businesses, it offers everything they're likely to need, without the associated price tag.

Read more on Chrome Remote Desktop for more information.

IDrive RemotePC

RemotePC, from cloud-backup specialist IDrive, is another through-the-browser solution that doesn't require dedicated software on the guest machine. However, it does offer a connector for RDP should you need it, and there are apps for Android and iOS.

Setup is refreshingly simple. Install the host utility on the remote machine and log in to your RemotePC account on both devices. You'll see a list of all enrolled machines on your guest device, where a Connect button lets you initiate an in-browser or app-based connection. Once up and running, you can collaborate with remote users using chat or whiteboard (the latter allowing you to draw directly on their screen), blank their terminal while you work, and exchange files using the integrated file browser.

RemotePC's flexible pricing is both feature- and seat-based. Soho pricing starts at $79.50 for five computers (discounted in the first year) and offers file transfer, remote printing, session recording, remote chat, and support for Windows, macOS, and Linux. There's even a package for Raspberry Pi.

The Team tier (from $299.50 for 50 computers) rolls in Active Directory / SSO and on-demand remote support, and Enterprise plans, for which pricing is advertised up front (starting at $599.60 for 100 computers) allow you to organise computers into groups, and set roles and access permissions for users. As you'd expect, each tier includes every feature of the tiers below, and there are two consumer plans for home use.

We were impressed by both how easy this was to set up and use. The up-front Enterprise pricing, which is often hidden elsewhere, was likewise welcome. The fact that there's a free seven-day trial for all plans that don't require card details means there's nothing to be lost in giving it a go.

Read our full IDrive review for more information.

LogMeIn Pro

LogMeIn Pro is part of a varied portfolio of remote control and access platforms from GoTo, where it sits alongside training, webinar, and communications products. It's aimed primarily at small businesses and offers both browser- and app-based access. The browser-based screen viewer is still in beta at the time of writing.

We performed our tests using the LogMeIn client on a Mac, from which we connected to a Windows PC. This initially asked for our Windows password, as it doesn't support PIN-based login (which we use to access Windows). Entering our Microsoft account credentials did the trick, and it's possible to set up an access code as an alternative inside LogMeIn itself.

Once up and running, you can chat between machines, exchange files, draw on the remote display, and use an on-screen laser pointer. If you have a PC at both ends of the connection, you can drag and drop files between them, but if either is a Mac, you'll need to use the file browser instead

Upon clicking to end the remote connection, the client warned us that the host wasn't "completely protected from modern cyber threats" and prompted us to install LogMeIn's own antivirus software powered by Bitdefender. We opted not to do this as the host was already running Windows Security virus and threat protection.

The recommended Power Users plan starts at £69.99 a month (£839 a year), discounted to £699 if you opt for an annual payment. This lets an unlimited number of users access to five computers. The small business plan, at £108 per month when paid annually, ups the computer count to 10. These might not be impulse-purchase prices, but there's no need to commit right away: LogMeIn offers a generous 14 day free trial for which there's no need to enter any card details.

Read our full LogMeIn Pro review for more information.

RealVNC Connect 8

RealVNC claims that more than a billion devices run its software. Connect 8 offers both code-based temporary control of remote machines, as well as longer term device enrollment for ongoing management. It's app-based rather than browser-based, with a unified server/client utility that handles both ends of the connection.

New in this version is a redesigned toolbar that you can move around the screen, and a reworked file transfer tool with a side-by-side view of local and remote files. These include in-session chat, session recording, and support for multiple monitors. At the time of writing, session handover and annotations were listed as upcoming features.

VNC passwords are set per-machine and are distinct from both your Windows login and your RealVNC account password (unless you set them to match). Devices are organised in the client app, optionally with a thumbnail of the last-known state, which can help you identify several similar machines if you only check in periodically.

Team plans start with the Plus tier, at £12.50 per active connection per month, which allows an unlimited number of users to connect to 50 devices. The Premium plan, at £20.75 per active connection per month, raises the device limit to 150 and adds support for audit logs of key events, MFA for sessions, and on-demand connections over LAN that don't traverse the cloud. There's also an Essentials plan (single user and three device limit) for £7.25 a month, and enterprise pricing is available on demand. Although prices are quoted per-month, billing is annual. RealVNC offers a 14-day free trial with no need to provide your card details up front.

Connect 8 works with Windows, macOS, and Linux. Essentials tier users can also connect to Raspberry Pi OS, which is perhaps not surprising given that both Raspberry Pi and RealVNC are based in Cambridge, UK, and RealVNC was Raspberry Pi's default mode of remote access on launch.

Read our full RealVNC Connect review for more information.

Splashtop Remote Access

Splashtop supports remote Windows, macOS and Linux machines, accessed from Windows, Mac, iOS, Android, and Chromebook. You can also access virtual machines on a range of common cloud platforms, and it's even possible for two remote users to access the same host machine simultaneously. It requires a host app, known as a streamer, to be running on the remote computer, but clients can connect using either the accompanying business app or via the browser. We took this latter option and authenticated ourselves using our Microsoft Account credentials.

The cheapest business plan – Pro – is keenly priced at £7 per user, per month. Aimed at individuals and small teams that need to work remotely, it supports multiple monitors, and chat, and session recording. The Performance plan, at £10 per user per month, builds on this with 240FPS compatibility, high-fidelity audio, USB pass-through, and both remote stylus and Wacom Bridge, with support for pressure, orientation, tilt, and size of stylus during the session. This will likely make Splashtop Remote Access an appealing proposition for hybrid design teams.

Enterprise pricing is available as a quote, and at the opposite end of the scale, there's a Solo tier for individual users at £5 a month. This allows unattended remote access, file transfer, and remote printing. Although prices are quoted per-month, billing is annual.

Read our full Splashtop review for more information.

Zoho Assist

Zoho has separate plans for remote support and unattended access, each starting at £10 a month (reduced to an equivalent £8 per month if you pay for a year up front). They require a host application on the remote machine for access through the browser at the local end. This enables clipboard sharing, instant chat, video and voice chat, file transfer, and multi-monitor navigation. There's also a free plan, but this drops support for file transfers and remote screen blanking, as well as limiting the number of enrolled technicians to one (this is unlimited on all other plans).

Windows, macOS, and Linux are supported at all levels, but you'll need to upgrade to at least the Professional tier (£14 / £12 per month for monthly or annual access respectively) if you need to support ChromeOS, iOS, Android, or IoT devices.

As well as being interactive with the remote display, you can perform a lot of powerful admin tasks through the browser, without affecting the remote user's screen. For example, the browser-based Task Manager displays all running services and applications, which you can shut down from a distance. You can access the Device Manager, add and remove users, edit the Registry, and more. You can also enable Wake on LAN, where supported, so that you can activate and log into machines that have gone to sleep.

Assist is a flexible platform that's easy to get up and running – and, like the others featured here, you can try it yourself, for 15 days, without providing card details.

Read our full Zoho Assist review for more information.

Further reading on remote desktops

If you'd like to learn more about remote desktop technology and platforms, we've got a wide range of content available for your reference. 

Learn more about protocols such as RDP, XRDP or VNC and what TeamViewer offers; find out how to use Microsoft Remote Desktop and how to use remote desktop on Windows 10.

If you need walkthroughs for setting up remote access via Microsoft or Apple OS', see how to use remote desktop on Mac, how to set up Chrome Remote Desktop; and how to remote desktop from Mac to Windows.

The GSMA has teamed up with IBM and Vodafone to form the GSMA Post-Quantum Telco Network Taskforce, which the trio say will support the roadmap for post-quantum cryptology.

Their aim is to help define policy, regulation, and operator business processes for the enhanced protection of telecommunications as quantum computing takes on a more prominent role.

Instead of relying on bits for calculation like today’s computers, quantum machines leverage the exponential power of quantum bits, called qubits. That involves a simultaneous mix of 0s and 1s and opens up the possibility of solving complex of problems that today’s supercomputers struggle with.

The Taskforce has been set up to help navigate these new waters. The team will help define requirements, identify dependencies, as well as create the roadmap to implement quantum-safe networking, to help mitigate potential risks.

“The GSMA Taskforce’s goal is to bring together leading global communication services providers with experts from IBM, Vodafone, and other operators and ecosystem partners to understand and implement quantum-safe technology,” said Alex Sinclair, Chief Technology Officer at the GSMA.

These future quantum-safe controls will aim to protect sensitive business information and consumer data from attackers that harvest present-day data for later decryption.

That will be no small feat, either. In its announcement, the GSMA noted the World Economic Forum’s recent estimation that more than 20 billion devices will need to be upgraded or replaced in the next 10-20 years in order to use the new forms of quantum-safe encrypted communication.

“By working together to establish consistent policies, we can define quantum-safe approaches that protect critical infrastructure and customer data, complementing our ongoing security efforts to increase resiliency in future networks,” Sinclair added.

Back in July 2022, the U.S. National Institute of Standards and Technology (NIST) announced it had chosen the first four post-quantum cryptography algorithms to be standardised for cyber security in the quantum computing era.

These were designed to rely on the computational difficulty of problems from the mathematical areas such as lattices, isogenies, hash functions, and multivariate equations, and protect current systems from future quantum machines.

Taskforce member IBM, which boasts the world’s largest fleet of cloud-accessible quantum computers, contributed to the development of three of these four chosen algorithms.

“Given the accelerated advancements of quantum computing, data and systems secured with today’s encryption could become insecure in a matter of years,” warned Scott Crowder, Vice President of IBM Quantum Adoption and Business Development.

“IBM is pleased to work with the GSMA Post-Quantum Telco Network Taskforce members to prioritize the telco industry’s move to adopt quantum-safe technology.”

A consortium of 20 European companies led by the federal government’s Senior Executive Service (SES) is set to build Europe’s first sovereign Quantum Key Distribution (QKD) system.

The move is anticipated to facilitate secure cryptographic key transmission to bolster cyber security among European nations.

Per reports, the EAGLE-1 satellite-based QKD system will be developed in partnership with the European Space Agency (ESA) and European Commission. An operations centre is also underway in Luxembourg, in addition to a dedicated low earth orbit satellite.

On a related note, it is anticipated that the EAGLE-1 satellite will launch in 2024 and will be in orbit for three years with support from the European Commission.

A QKD demonstration and validation from low earth orbit to the ground will be completed by ESA and EU Member States through EAGLE-1, which will aid next-generation quantum communication infrastructures (QCIs) using valuable space mission data.

Most importantly, the breakthrough in in-orbit technologies will pave the way for sovereign and autonomous cross-border quantum communications networks. Furthermore, the consortium will work towards developing a QKD payload, terrestrial optical station, scalable quantum operational networks, and key management system to facilitate EAGLE-1’s ultra-secure cryptographic key exchange system.

Josef Aschbacher, ESA director general, said: “European space innovation has gained strong momentum both from a technology perspective and in terms of commercialisation. It allows us to develop and implement next-generation, future-proof projects in space across critical domains like secure communication, next-generation networks and cybersecurity.”

“Led by ESA, partially financed by the European Commission and implemented by SES, EAGLE-1 is a major step towards making the secure and scalable European Quantum Communications Infrastructure a reality,” added Aschbacher.

Signal has appointed Meredith Whittaker, co-founder of the AI Now Institute and founder of Google’s Open Research Group, as its first-ever president.

As president, effective September 12, Whittaker will be responsible for company strategy. Speaking to The Washington Post, she outlined her priority as sustaining the firm’s funding, noting that it “costs tens of millions of dollars per year to develop and maintain an app like Signal.”

The encrypted messaging service Signal is primarily known for its app, which provides users with end-to-end encryption (E2EE) on all messages by default and has been widely used by protesters seeking to avoid surveillance.

A former Google manager, Whittaker was one of the main organisers of the 2018 walkout that saw 20,000 employees leave their desks to protest the company’s handling of sexual harassment cases and forced arbitration. After drawn out action, the movement secured Google employees' class action rights and an end to the forced arbitration practice.

Further protests in which Whittaker was involved centred around Google’s involvement in the Pentagon’s ‘Project Maven’, which would have seen AI used to enhance the capabilities of military drones. Employee pressure eventually forced Google to withdraw from the project altogether, and publish an AI ethics code.

Since leaving the company, Whittaker has been a prominent critic of artificial intelligence (AI) and facial recognition technology, testifying before congress that both carry the risk of entrenching existing biases against minorities. She has also advised the Federal Trade Commission on AI in the role of senior advisor.

“Signal is not made for pristine academic speculation, it is made to be used by real people, all over the world,” stated Whittaker, in a blog post announcing her appointment to the role.

“And many millions do use it, turning to Signal for a safe and pleasant space where intimate, experimental, and private communication can happen outside of the surveillant gaze of dominant tech companies and states who can and do subpoena their data.

“I believe that Signal is core infrastructure whose growth and stability is imperative for a livable future. And as Signal’s President I will do everything I can to build on Signal’s firm foundation and vision, and to create a rich soil where Signal can continue to grow and thrive.

“I’m honored to be taking this role, and I’m grateful to the team whose careful work makes Signal possible, and to the community beyond who contribute labor and intelligence that helps us maintain our rigorous standards. Onward!”

Whittaker assumes her position amidst growing government hostility towards the use of E2EE in messaging apps. The currently stalled Online Safety Bill received an amendment in July that would compel companies operating messaging apps to scan for child sexual exploitation and abuse (CSEA) content and remove it from their platform or be fined up to 10% of their worldwide revenue. Firms would be required to use “best endeavours to develop or source” technology to do the same, effectively mandating backdoors into messaging apps that security services could use.

Last year, Meta continued with its roll out of encryption as default across the direct messaging of its apps Messenger and Instagram, facing harsh criticism from the UK government. Despite this, experts have argued that E2EE is a necessary technology and that restricting the technology would have a detrimental effect on the tech landscape.

Quantum computing still sounds like the realm of science fiction. The promise is that quantum computing can perform calculations over a hundred million times quicker than the fastest current supercomputer. This will have hugely positive implications for solving the big problems in science.

But it has a darker side effect: encryption that would have taken thousands of years to crack with conventional computers could be dispatched in a matter of minutes – or even seconds. The implication today is that adversaries are currently able to hoover up and store data, which they can attack with a quantum computer in years to come. Some commercial and personal data will remain sensitive far into the future. So, it's worth future-proofing data to withstand quantum computing attacks.

How quantum computing works

The increased performance of quantum computing compared to existing 'Von Neumann' machines is such a massive leap that one could easily be forgiven for not believing it's real. But the speed is a by-product of how quantum computing works, which is markedly different. Traditional computer chips are still based around the computing concept devised by John Von Neumann and published in 1945. In this system, each operation is performed sequentially, by being read from the input device, worked on logically, and then output again back to storage.

Even massively parallel supercomputers function in this way. If they are performing thousands of operations at the same time, each one is still executed sequentially by the CPU core. GPUs are simpler than CPUs, but they contain sequential units too, albeit with much greater parallelisation of lots more units. Traditional computing also works with bits, which have two states - usually represented as 0 and 1. The input will be one state, and after operation the output will be the same or the other state. As problems get more complex, with more possibilities to calculate, breaking these into individual sequential calculations can mean they go well beyond the capabilities of current architectures.

This is not how quantum computers work. Rather than containing lots of individual computing cores to run sequential operations on single bits in parallel, a quantum computer works on the probability of an object’s state before it is measured. Known as a qubit, these states are undefined properties of an object prior to detection, such as the polarisation of a photon or spin of an electron. Because these quantum states don’t have a clear position before measurement, they mix many different possible positions at once, rather than just two.

However, despite being undefined until measured, these mixed states can be 'entangled' with those of other objects in a mathematically related way. By applying the mathematics of this entanglement to an algorithm, complex problems can be solved in essentially one operation. On the one hand, this can be used for very difficult science such as predicting multiple particle interactions in a chemical reaction or creating security codes that are much more difficult to break than current ones. But conversely, they can also be used to crack existing codes that would have been impossible to breach with current computer technology, because they can run through lots of possible solutions at once.

Putting this in perspective, a conventional computer would take around 300 trillion years – 22,000 times the age of the universe – to crack the ubiquitous 2,048-bit RSA encryption. But a quantum computer with 4,099 qubits would require just 10 seconds, using Shor’s Algorithm, which is designed to find the prime factors of an integer used in encryption keys. It’s clear that there is a danger looming for many forms of cryptography. For example, the ubiquitous SSL and TLS used for encrypting web connections employ 2,048-bit RSA keys and would therefore be vulnerable to being breached by a quantum computer.

How fast are current quantum computers?

The good news is that we were not at this stage just yet. While 4,099 qubits don’t sound like a lot when we now have 64-core processors executing more than 3 billion operations per second per core, it’s still more than the most potent current quantum computer. IBM’s Eagle, unveiled at the end of 2021, only has 127 qubits. Google’s Sycamore only has 53 qubits, the University of Science and Technology of China’s Jiuzhang has 76 cubits, and most quantum processors (QPUs) have fewer than 50 qubits. There are ‘quantum annealing’ processors from D-Wave with up to 5,760 qubits, but these require a limited set of possible outcomes, and can’t run the Shor’s Algorithm required to break encryption.

Development is moving forward, however. Xanadu plans to launch a 216-qubit QPU called Borealis in 2022, and IBM aims to hit 433 qubits in 2022 with Osprey, followed by 1,121 qubits with Condor in 2023. So while traditional encryption remains safe for now, it will not be the case for much longer. IBM’s roadmap, for example, is aiming for 4,158 qubits by 2025, making it likely that cracking 2,048-bit RSA virtually in real time will be possible before 2030, which is the final year when NIST originally reckoned it would still be secure. You may not be able to go out and buy a quantum computing desktop computer by 2030 – D-Wave’s first commercially available quantum computer cost $15 million when it shipped in 2017. Prices will fall, but it is only likely to be large companies and countries that have QPUs for years to come. However, not all those countries will have our best interests at heart, so the danger is looming.

Hardening cyber security against quantum computing

Fortunately, there is time to get ready for the threat; for example, by using security products based on post-quantum cryptography. These products can protect your sensitive data today and future-proof it against attacks from quantum computers.

Current encryption algorithms use either integer factorisation, discrete logarithms, or elliptic-curve discrete logarithms, all of which Shor’s Algorithm can defeat using a quantum computer. Post-quantum cryptography switches to alternative approaches that are not vulnerable to quantum computing. Research is still in its infancy based around six primary methods, but there are already products appearing that employ the technology. One example is QST-VPN, based on the OpenVPN library but with post-quantum secure algorithms protecting user data. The server software is provided via the AWS cloud, with clients for Windows, MacOS and a wide range of Linux distributions, and offers an opportunity for businesses to begin bolstering their security now, rather than after the quantum horse has bolted.

Quantum computing has massive potential to revolutionise how fast we can perform calculations. Like every new technological development, this has both good and bad implications. But now that we know what’s in store for cyber security – in the not-too-distant future – we can at least prepare, so that the beneficial potential of quantum computing prevails over the more nefarious possibilities.

Learn more about how QST-VPN can help protect your business

Rumbling in the wings of the government’s policy programme for the last few years has been the widely anticipated Online Safety Bill.

This major piece of legislation will be among the first laws directly regulating tech companies and the way they operate, with 25,000 businesses falling under the scope of this complex framework. The overarching ambition is to make the internet a safer place to be – given it’s reportedly rife with terrorism, hate speech and exploitative content – although critics say it infringes on free speech.

Nevertheless, it still represents a marked change in the way business is conducted online, with those affected expected to adapt, or face huge financial penalties, when it eventually comes into force.

What is the Online Safety Bill?

First proposed formally in March 2021, the Online Safety Bill effectively regulates the content that any “user-to-user service” makes available online. It seeks to make big tech companies more responsible for the material they host on their platforms in order to protect their users.

The Bill applies to search engines, internet services that host user generated content and those that publish or display pornographic content. It’s been designed to make the UK “the safest place in the world to be online” while defending free expression. It also aims to improve law enforcement’s capacity to tackle harmful content online, improve users’ ability to keep themselves safe, and improve society’s understanding of the harms landscape.

The legislation proposes a shift away from self regulation, which has arguably failed, to one that promotes accountability and a safety-first mindset. Under this model, tech companies will need to be able to demonstrate they have evaluated key risks. This includes misinformation, predatory behaviour, and cyber bullying. They need to have proven there are suitable protections and safeguarding mechanisms in place on their platforms, with those falling short of these expectations facing massive fines. These will either be up to 10% of annual turnover, or £18 million, which are similar levels to fines under the General Data Protection Regulation (GDPR).

How has the Online Safety Bill evolved?

In the many months since this legislation was introduced, the government has amended its terms to reflect more regulatory requirements. Initially, Ofcom was granted a statutory duty of care to enforce the terms of the Online Harms white paper, which was produced as a result of a two-year consultation.

In February this year, for example, the government introduced an amendment compelling websites containing pornographic content to use secure age verification technology on their platforms. The following month, the scope of the legislation expanded from the purest sense of ‘online harms’ to also include fraudulent and misleading adverts, which social media sites and search engines would have to do more to protect UK users from.

The government then changed a key provision in the Online Safety Bill in July, with an amendment forcing companies to identify child sexual exploitation and abuse (CSEA) content and take it down. Previous iterations of the law only required companies to use “accredited technology” to detect CSEA and terrorism content, but the amendment goes further in stating companeis should further seek to use “best endeavours to develop or source technology” to automatically detect and take such material offline.

Then, less than a week later, the government inadvertently put the Online Safety Bill on ice after failing to include its third reading in the parliamentary schedule before the summer recess. This means the legislation will be delayed, and possibly subject to change when a new prime minister is appointed by the Conservative Party in September.

Why do some feel the Online Safety Bill doesn’t go far enough?

Charlotte Aynsley, safeguarding advisor at Impero Software, says the Bill needs clearer directives around reporting and referrals.

“There is currently no centralised system to make referrals, nor is there clear guidance or clarification on who these referrals go to and how they will be progressed,” she tells IT Pro. “If they do go to the police, how will this then be managed? It is vital that victims feel reassured by knowing their incident will be addressed – if people don’t think any action will be taken, or there isn’t a timely response, there is a risk that harmful incidents will continue to go unreported,” she says.

Dr Bill Mitchell, director of policy at BCS, the Chartered Institute for IT, says the Bill leaves a lot of abstract definitions, and much of the concrete expectations for what platforms will be asked to do will be set out in secondary legislation and codes of practice. He adds that this means “it’s currently very difficult to assess what exactly platforms will be asked to do to reduce harms and protect rights, and whether it will be sufficient”.

“For instance, platforms will need to take into account the importance of ‘democratically important content’ – the definition of which is extremely unclear,” he explains.

For Robin Wilton, meanwhile, a director at the Internet Society, one omission in the legislation is highly significant – encryption. “The Bill only mentions encryption twice, and not in a meaningful way: it says that if a service provider gets a law enforcement request for access to data and, in providing that data, encrypts it so that it is unusable by law enforcement, it’s committing an offence. Fine. I wonder how many times that has ever happened in the past. I suspect it’s none.”

How will the Online Safety Bill affect big tech?

Hand in hand with the raft of new obligations are new costs that companies falling in syncope will have to absorb, according to Luke Jackson, a director at Yorkshire-based law firm Walker Morris LLP.

“As well as the mooted Ofcom regulator fee, many will need to commission specialist support to ensure compliance – be that with subscriptions for policing and age-gating software or legal fees to interpret the act and understand risk exposure,” he says.

Worryingly, there’s also scope in the legislation to compel companies to develop flawed security in their products, critics allege. Wilton says that, until now, the Bill stopped short of allowing the government to compel the tech industry to design their products in such a way that might not be feasible. However, the latest amendments removed any doubt. The July update, instructing tech companies to implement technology automatically scanning messages, is an example.

“This is “scope creep” of the worst kind, and in all probability, it won’t work,” he adds. “Consider this: today, Apple announced a $10m research fund to “harden” devices against spyware probes like Pegasus. By contrast, the UK Government’s “Safety Tech Challenge Fund”, to develop “safe” tools for backdoor access has distributed £85,000 each to a handful of start-ups. The Online Safety Bill will not prevent secure communication technology from reaching the mass consumer market, but it could prevent UK users from being lawfully allowed to use it. That represents significant harm for no visible benefit.”

How will the Online Safety Bill change the wider industry?

The Bill sets out to take on the big tech companies, but it has the potential to impact any business that is operating in the digital space. Jackson says that the legislation could well require a mindset shift for all enterprises with an online presence, requiring them to prevent online harm as a driving principle in the way their web presences are delivered.

Jackson adds that, for consumers, the idea of an Online Safety Bill should, in theory, be a good thing. “A reduction in the spread of misinformation, online abuse and inappropriate content for children would undoubtedly make the Internet a better place,” he says. “However, as some have pointed out, there is a very delicate balance to be struck between shielding users from harmful content whilst protecting freedom of speech.”

When, or if, enacted, the Online Safety Bill is likely to cause much controversy in the form of projected weakened security in products and services. Wilton says that the bill not only enables scope creep, but in the context of technology, it also allows societal scope creep, as this is also built into the Bill. Wilton explains that it allows the secretary of state for Digital, Culture, Media and Sport (DCMS) to add new categories to the list of banned content through secondary legislation.

“That means no parliamentary scrutiny, and it’s a licence for the minister to ban whatever he or she chooses,” he explains. “That could be ‘communicating about an anti-Government protest; it could be ‘saying rude things about the minister’; it could be ‘demanding information about secret donations to political parties’; it could be ‘publishing information about access to abortion’,” he says. “We live in an information society, with a data-driven economy, and a population of digital natives. We cannot allow the government to weaponise digital technology against its citizens."

UK safety tech sector revenues hit £381 million last year, the government has announced, an increase of 21% across the ‘world-leading’ industry.

This was matched by the creation of jobs within the sector, with a total number of 2,850 now available marking a 30% increase from the previous year.

Additionally, 57% of safety tech firms were based outside of London and the South East, a sizeable increase from the 48% based outside of these regions just two years prior. In total, 117 firms have been identified as currently offering safety tech solutions.

In a blog post, the government specifically championed safety tech such as tools used to detect and remove child sexual exploitation and abuse (CSEA) content. These systems have been put in the spotlight by the government’s Online Safety Bill, which seeks to compel companies to use or develop such tools to even work on messages currently protected by end-to-end encryption (E2EE).

The bill has drawn criticism from rights organisations such as The Open Rights Group, which has described the measures as “an Orwellian censorship machine.” A recent survey of industry experts also revealed that 66% thought ending E2EE would have a negative impact on protecting society, while Meta plans rollout of E2EE across Messenger and Instagram in 2023.

Last year, the government set up the Safety Tech Challenge Fund, a £555,000 competition to find novel solutions for combatting CSEA content without impacting people’s rights to privacy. These include artificial intelligence (AI) and facial recognition solutions for detecting child abuse images before upload.

At the time, it was announced that the Information Commissioner’s Office (ICO) would offer advice to the winners, to protect privacy throughout the development process.

However, doubts have been raised over the feasibility of regulation of direct messaging that also retains privacy measures. Last year several rights organisations signed an open letter to MPs, stating that the tech being sought by the government would be bad for business as well as individual privacy.

“End-to-end encryption means that your constituents’ family photographs, messages to friends and family, financial information, and the commercially sensitive data of businesses up and down the country, can all be kept safe from harm’s way,” the letter stated.

“It also keeps us safer in a world where connected devices have physical effect: end-to-end encryption secures connected homes, cars and children’s toys. The government should not be making those more vulnerable to attack.”

At the time of writing, the Online Safety Bill has been put ‘on ice’ amidst Conservative Party restructuring, leaving the timeline for when these changes can be expected to be passed into law unclear.

When the house returns in September the bill could be redrafted, or scrapped entirely under the leadership of either Liz Truss or Rishi Sunak.

For now, safety tech sees no signs of slowing, as 67% of firms within the sector predict a customer base increase of 50% or more within the next 12 months.

“Making the online world safer is not only the right thing to do, it’s good for business,” said digital minister Damien Collins

“UK tech firms are at the cutting-edge developing practical solutions to the risks posed by the internet so that it continues to be a benefit not a detriment to people’s lives.

“They have blazed a trail of growth, innovation and job creation to become world leaders in their field and we are committed to maintaining their upward trajectory.”

Zoom is expanding its privacy and security capabilities by adding end-to-end encryption (E2EE) settings to more of its services.

In the coming months, end to end encryption will be available on its cloud-based Zoom Phone and in meeting Breakout Rooms.

Breakout Rooms lets an admin divide the participants in a meeting into smaller groups that come together in their own mini-meeting within the larger one.

For Zoom Phone calls, users can add E2EE during a call by selecting "more" and hitting the option for the higher level of encryption. When enabled, the call will be encrypted using cryptographic keys known only to the devices that belong to the caller and the receiver. This can also be verified with special E2EE status in the form of a security code the participants can share with one another.

However, to enable E2EE users will have to have a few things in place first. Their account will need to have E2EE turned on in the web portal and both callers will need to be on the same Zoom account. Both callers will also have to use the Zoom Phone desktop or mobile client and neither caller can record the call - automatic call recording will also have to be turned off. What's more, E2EE is only available for one-to-one calls.

Although other Zoom services previously had end to end encryption options, these protections did not extend to Breakout Rooms. Before today's change, creating a meeting and attempting to set it to E2EE would automatically disable the Breakout Rooms feature.

To extend the encryption to Breakout Rooms, each breakout will have its own unique encryption key. The feature is not live yet, though Zoom says it is coming "soon".

E2EE on Zoom was something of a PR disaster in the early days of the pandemic when the video conferencing platform quickly grew in popularity. It only began rolling out E2EE for meetings in October 2020, after months of various security problems, such as Zoomboming.

Meta has doubled down on its inclusion of tracking parameters in URLs posted to Facebook, by encrypting URLs to include parameters within required portions of the address itself.

When a user clicks a link shared through Facebook, all kinds of parameters are added to the URL. Some of these, such as utm_source and utm_medium are used by analytics sites such as Google Analytics to measure where traffic is coming from, and how much of it there is.

Facebook has historically used the parameter fbclid to measure what sites its users visit and which links they click, whether or not those sites support Facebook’s tracking script Meta Pixel. These are then used to tailor users’ ad profiles, to target them more effectively.

URLs under the new system lack clearly defined parameter names, appearing instead as a long string of letters and numbers in which all the address and tracking information is included in an encrypted format.

It is normally possible to strip certain parameters from URLs, removing the tracking element and increasing link privacy. Some browsers even offer URL stripping as a built-in choice, for privacy-minded users.

These include Firefox, which last month introduced a feature called ‘Query Parameter Stripping’ that automatically removes tracking parameters from URLs to improve the privacy profile of its users. This can be activated in the browser's configuration settings. The browser Brave also supports a URL stripping feature. With its move to encrypt the URL parameters, Meta has greatly impacted the ability of such tools to effectively strip the tracking elements.

In binding tracking elements with the URLs in such a way that it is impossible to tell where the web address ends and the parameters begin, Meta has found a way to track data for advertising almost unavoidably. This is a boost for its analytics operation, as well as for the tech giant's advertising partners whose interests include targeted data on as many users as possible.

With 153 million users, Firefox represents a not insignificant pool of users to Meta, which enjoyed just under $115 billion in revenue last year largely through advertising.

It Pro has reached out to Meta for comment.

The contentious Online Safety Bill has been delayed by the government as a result of the inner turmoil in the Conservative party.

Its third reading in the House of Commons was due to take place next Wednesday, but this crucial stage has been pushed back to at least the autumn. The leader of the House of Commons Mark Spencer published next week’s schedule ahead of parliament's summer recess without a mention of the bill. Instead of debating the Online Safety Bill, the government has tabled a motion of no confidence in itself, alongside a debate around the Northern Ireland protocol bill.

This could potentially kill off the legislation, as its passage through parliament will be overseen by a new prime minister and perhaps a new secretary of state for digital, culture, media and sport (DCMS), both of whom may not support the bill in its current form.

The legislation is highly contentious not only because it raises the prospect of banning legal, albeit harmful, content, but also because it compels prominent players in the tech industry to implement sweeping changes across their platforms. The most recent amendment, for example, compels tech companies and messaging services to either develop or acquire technology that automatically scans messages for content that's deemed harmful.

Potential Tory leader candidate Kemi Badenoch commented on the matter on Twitter, calling it the right move and underlining that the bill is in no fit state to become law.

“If I’m elected Prime Minister I will ensure the bill doesn’t overreach. We should not be legislating for hurt feelings,” she said.

In response, Nadine Dorries, the current DCMS secretary replied: “Which part of the bill legislates for hurt feelings, Kemi?” on Twitter.

“The Online Safety Bill is fundamentally misconceived. It holds out the threat that our social media posts will be removed and censored, and goes to the heart of our basic right to express our opinions online, and to hear the opinions of others,” said Monica Horten, free expression policy manager of the Open Rights Group.

Horten added the campaign website belonging to Penny Mordaunt, another Tory leader candidate, is being listed as unsafe for children and blocked by customers of some broadband providers, using their filters, which shows what can and will go wrong.

“As it stands, the bill would mean everyone’s social media posts are monitored in case they are ‘harmful’ or illegal, and even private messages could be scanned,” explained Horten. “What is ‘harmful’ will be decided by government ministers behind closed doors. While the motivations may be good, the result is bad for free speech. MPs now have a chance for a rethink, which is long overdue, if we want to protect our free society from arbitrary censorship and mass surveillance.”

In January, a DCMS committee report outlined that the Online Safety Bill fails to tackle child abuse and violence against women and girls. The committee called on MPs to address the issues in the bill, and described the draft legislation in its form as a “missed opportunity”.

Passwords, in recent months, have been the source of much contention in cyber security, with the viability of conventional authentication methods under fire. Although a string of companies are bidding to remove passwords from the information security scene altogether, the reality is they’re still widely prevalent and likely to remain so. Most people lean on passwords to log into anything from personal email accounts to business-critical apps and services, so keeping them secure remains a paramount concern.

The threat of hackers cracking weak passwords, meanwhile, has only escalated in recent years. Not only has the spotlight been shone onto poor cyber security hygiene practices like password reuse, but a string of historic data breaches mean many credentials are in circulation around the web. Although it’s difficult to avoid a cyber security horror story in today’s age, the unfortunate truth is the majority of people are prone to reverting to easy solutions when devising passwords. Astoundingly, for example, the most common password of 2021 was ‘123456’, which was used by more than 100 million individuals.

Insecure passwords have long been an issue, with cyber security expert Troy Hunt expressing alarm in 2011 that passwords generally tend to follow a similar trend. They’re relatively short (between six and ten characters), simple (less than 1% had a non-alphanumeric character) and predictable (more than a third were in a common password dictionary). In the 11 years since, how much has actually changed? Not an awful lot, it seems, and businesses can’t risk their employees using short, simple and common passwords to access critical business systems. That’s where a password management tool, like Synology C2 Password, comes in to help us safeguard data with stronger access protections and password generation.

Guess my password

The state of password hygiene across society is poor – thanks, in a large part, to the way our brains work and the limitations of our memory. Beyond ‘123456’, the most common passwords in the top five are ‘password’, ‘1234578’, ‘qwerty’ and ‘123456789’, according to WPengine. Examining the top 50 most-used passwords suggests number sequences are incredibly common. Whole words such as ‘dragon’, ‘football’, ‘monkey’ and ‘master’ are also leant on heavily.

It confirms what many of us may have assumed; that people often instinctively choose passwords that might be easier to recall off the top of their head, rather than methodically choosing strong and complex passwords. There’s also the issue of password reuse. With so many passwords to remember, many people tend to just use the same one, or handful, across several user accounts. As a result, hackers wouldn’t need to employ sophisticated brute-force cracking tools often warned about to break into user accounts; they can simply reach for a handful of short and simple go-to words or number sequences.

Another trick many people lean on to complexify a weak password is to tack a number onto the end of it. Of the ten million passwords WPengine analysed, 8.4% ended with a number between 0 and 99; with people perhaps thinking it was easier to remember than using a more complicated letter and number combination. Of those, more than 20% of people used ‘1’ suggesting convenience is the key priority.

When choosing whole words as passwords, many people rather predictably tend to pick words from categories such as colours, animals, or fruits, in addition to first names, superheroes or even days of the week. This, of course, makes the job that much simpler for cyber criminals hoping to break into user accounts that aren’t protected with a password management tool. Poor password hygiene, indeed, does most of the heavy lifting.

A modern remedy to age-old problems

How do we, collectively, move past the limits of our password-creating psychology? There are various methods to overcome poor password hygiene, including the National Cyber Security Centre (NCSC) recommendation to use three random words. Although the ‘three random word’ strategy is suited for use at both home and work, it might not be so simple for users to remember a few dozen different three-word combinations for the various apps, services and user accounts they’ll log in and out of on a daily basis.

Password reuse is, by far, the greatest risk with this strategy. Whild sensible on paper, most people will likely default to a handful of combinations and rotate as they see fit. Meanwhile, although two-factor authentication (2FA) might provide another barrier for cyber criminals, this isn’t entirely infallible and not all organisations offer such protective measures on every internal system.

Password managers are, by far, the most effective and simplest protective measure anyone can take when safeguarding their account credentials. The Synology C2 Password platform, in particular, is a shining example of a robust and free password management tool fitted with a litany of capabilities that collectively serve as a modern remedy to age-old problems associated with passwords.

Synology C2 Password allows users to store their passwords in a bank alongside other sensitive material like banking information, addresses and passport details, while keeping everything organised using categories, favourites and tags. The platform is also accessible across a multitude of devices, so you can add an item on your primary work machine and access it from your tablet, for example. Saved credentials, too, are also automatically filled in at login screens.

The most important feature, however, is the password generation tool. Synology C2 Password automatically generates and securely stores passwords for your essential apps and services, so you don’t have to generate and remember a complex and uncrackable password for each one you access. The use of AES-256 encryption to safeguard all data also ensures the password data cannot be remotely accessed or intercepted; items are encrypted before they leave your device to be stored on C2 servers. The decryption key, moreover, is stored on your devices and never shared with Synology C2 servers.

Poor password hygiene is a growing spectre in the security world, with the most common habits people lean on when devising passwords a huge factor. However, using a free password management tool like Synology C2 Password could be the most effective way to counter the shortcomings of human psychology, and completely wipe out the prevalence of bad habits like using number sequences or common words when setting passwords, or reusing passwords across multiple accounts.

Learn more about Synology C2 Password

The US Department of Commerce’s National Institute of Standards and Technology (NIST) has revealed the first four encryption tools that are designed to withstand future cyber attacks powered by quantum computing.

The four selected encryption algorithms will become part of NIST’s post-quantum cryptographic standard, which is expected to be finalised in two years. They’ll be used to withstand potential future assaults by hackers using quantum computers, which may have the ability to crack the security used to protect privacy in digital systems, including in online banking and email software.

The announcement is part of a six-year effort pushed by NIST when, in 2016, it called on the world’s cryptographers to devise and vet encryption methods that could resist an attack from a future quantum computer that would be more powerful than today's most advanced hardware. NIST said the selection of these encryption tools marks the beginning of the finale of the agency’s post-quantum cryptography standardisation project.

Four additional algorithms are under consideration for inclusion in the standard, and NIST plans to announce the finalists from that round in the near future. It said it’s announcing its choices in two stages because of the need for a robust variety of defence tools. The agency also said there are different systems and tasks that use encryption, and a useful standard would offer solutions designed for different situations, use varied approaches for encryption, and offer more than one algorithm for each use case in the event one proves vulnerable.

“NIST constantly looks to the future to anticipate the needs of US industry and society as a whole, and when they are built, quantum computers powerful enough to break present-day encryption will pose a serious threat to our information systems,” said under secretary of commerce for standards and technology, and NIST director, Laurie E Locascio. “Our post-quantum cryptography programme has leveraged the top minds in cryptography — worldwide — to produce this first group of quantum-resistant algorithms that will lead to a standard and significantly increase the security of our digital information.”

Which encryption tools can withstand a quantum computer attack?

The four quantum-resistant algorithms rely on maths problems that both conventional and quantum computers should have difficulty solving, thereby defending privacy both now and down the road, added the agency.

The algorithms are designed for two main tasks for which encryption is typically used, general encryption, used to protect information exchanged across a public network, and digital signatures, used for identity authentication. All four of the algorithms were created by experts collaborating from multiple countries and institutions.

For general encryption, used when users access secure websites, NIST has selected the CRYSTALS-Kyber algorithm. Its advantages include comparatively small encryption keys that two parties can exchange easily, as well as its speed of operation.

For digital signatures, often used when users need to verify identities during a digital transaction or to sign a document remotely, NIST has selected the three algorithms CRYSTALS-Dilithium, FALCON and SPHINCS+. Reviewers noted the high efficiency of the first two, and NIST recommends CRYSTALS-Dilithium as the primary algorithm, with FALCON for applications that need smaller signatures than Dilithium can provide. The third, SPHINCS+, is larger and slower than the other two, but is valuable as a backup for one key reason: It’s based on a different maths approach than all three of NIST’s other selections.

Three of the selected algorithms are based on a family of maths problems called structured lattices, while SPHINCS+ uses hash functions. The additional four algorithms still under consideration are designed for general encryption and do not use structured lattices or hash functions in their approaches.

While the standard is in development, NIST has encouraged cyber security experts to explore the new algorithms and consider how their applications will use them, but not to deploy them into their systems yet, as the algorithms could change slightly before the standard is finalised.

To prepare, NIST said that users can inventory their systems for applications that use public-key cryptography, which will need to be replaced before cryptographically relevant quantum computers appear. They can also alert their IT departments and vendors about the upcoming change.

A new amendment tabled for the upcoming Online Safety Bill would compel companies to identify child sexual exploitation and abuse (CSEA) content and take it down.

Previous versions of the bill have only compelled companies to use “accredited technology” to detect CSEA and terrorism content, but the July 6 amendment goes further in stating that companies should further seek to use “best endeavours to develop or source technology” to detect and remove CSEA content.

It is unclear whether the government has undertaken research into what form this technology could take, or whether the expectation is companies will fall back on “accredited technology” such as encryption backdoors.

The clarification within the bill that the requirement applies to messages “communicated publicly or privately” seeks to extend oversight to messages currently protected by end-to-end encryption messaging, in which messages are encrypted before being transmitted and thus are accessible only by the sender and recipient.

Under powers already established in earlier drafts of the bill, Ofcom would have the power to fine non-compliant companies up to £18 million or 10% of their worldwide revenue in the most recent complete accounting period.

The government argues that giving security and law enforcement services unfettered access to encrypted messages will improve safety at home and abroad, but critics have argued that once ways around message encryption are established, no messages can properly be considered private.

Companies such as Meta have committed to not only keeping WhatsApp direct messages encrypted but to eventually roll out end-to-end encryption to Messenger and Instagram, a move which has increasingly put them at odds with government ideology.

The last few cabinets have been particularly vocal in their opposition to encryption. Last year, Home Secretary Priti Patel responded to Meta’s commitment to providing end-to-end encryption across its messaging platforms in harsh terms, stating:

"The offending will continue, the images of children being abused will proliferate - but the company intends to blind itself to this problem through end-to-end encryption which prevents all access to messaging content.”

The bill was first published as a draft in May 2021, and since then has been subject to much criticism for providing the government with what is seen as overreaching powers over privacy. The digital rights and freedoms organisation The Open Rights Group has been a particularly vociferous critic of the bill, which is described on its website as “an Orwellian censorship machine.”

“Dropping powers to ban encryption would be a major step forward if confirmed in the Bill. Ukrainians and Russian dissidents today are relying on encryption to protect themselves from real-world harm.

“We have repeatedly warned the Government that attacks on encryption would only help blackmailers, scammers and other criminals,” stated the Executive Director of the Open Rights Group, Jim Killock, in a blog post.

WhatsApp was first released in 2009, but it wasn’t until two years after Facebook’s (now Meta) 2014 acquisition of the company that end-to-end encryption was fully implemented across the app. The WhatsApp product page on security currently promises “only you and the person you're communicating with can read or listen to what is sent, and nobody in between, not even WhatsApp.”

IT Pro has approached Meta for comment on the bill.

Post-quantum cryptography (PQC) expert QuSecure has unveiled its end-to-end quantum resilient orchestration platform, considered an industry-first.

Dubbed QuProtect, the new platform pairs PQC algorithms with a quantum secure channel to offer steadfast security for encrypted communications and data.

The cyber solution, designed to work round-the-clock on any device, is targeted at enterprises and government agencies.

The platform, sold as a service under the 'quantum security as a service (QSaaS)' moniker, can protect against present-day cyber attacks and future quantum computing threats, according to QuSecure.

“QuSecure’s mission is to provide enterprises and government organizations with a comprehensive cryptographic orchestration platform that addresses today’s classical and future quantum threats,” said Dave Krauthamer, QuSecure CEO.

“Our QuProtect solution secures networks from current vulnerabilities using zero trust, next-generation standardized encryption, active monitoring, and attack remediation – all cloud-delivered in software to existing devices, over existing infrastructure.”

“We are creating an exceptionally secure future using a unique and comprehensive approach to cybersecurity that gives organizations a practical encryption solution for resilience to cyberattacks. Early customers tell us that a SaaS end-to-end PQC approach is optimal to address their critical needs for a practical post-quantum cybersecurity solution. QuProtect is the ‘easy button’ for this critical PQC upgrade,” added Krauthamer.

To support its work, QuSecure has created an advisory team compromised of leading experts in quantum cryptography. The team includes ARM CEO Rene Haas, Paul Touw, former Chief Strategist for the US Department of State and founder of Ariba Networks, Dr. Sarah McCarthy, postdoctoral researcher at the University of Waterloo and specialist in post-quantum cryptography, and Louie Gasparini, former CTO & VP of Product Management at RSA.

BT and Toshiba have officially launched the trial of their quantum-secured metro network which will protect the transmission of valuable data between multiple physical locations around London using quantum key distribution (QKD).

Although QKD offers “unhackable” encryption that is powerful enough to protect organisations from the rising threat of quantum cyber attacks, it’s still susceptible to man-in-the-middle (MITM) attacks, in which an exchange between two computer systems is breached by a third party.

However, Andrew Shields, head of the Quantum Technology Division at Toshiba told IT Pro that BT and Toshiba’s network is protected from man-in-the-middle attacks through quantum-safe conventional cryptography authentication:

“When the other side receives a communication, they have to know where it's coming from and that hasn't been changed in transit and we use conventional cryptography to do that authentication,” said Shields.

The cryptography is quantum-safe, meaning that it “can’t be broken by a quantum computer”, he added.

BT's managing director for applied research Tim Whitley told IT Pro that BT had been in touch with the National Cyber Security Centre (NCSC), which previously raised the concerns of potential man-in-the-middle attacks.

“They're fully aware of what we're doing in this trial and I think they’re actually very supportive of the research,” he said. The NCSC wasn’t immediately available to comment.

First announced in October 2021 and scheduled to last for three years, the trail follows a smaller-scale experiment successfully conducted last year at BT’s research and engineering campus in Adastral Park, Ipswich, where researchers used a six-metre-long hollow, air-filled cable.

This time around, the fibre ring connecting the three BT core nodes has a total length of approximately 76 km, stretching from Slough to London’s West End and City, with a trial catchment area of 20km in radial distance.

Commenting on the official launch, Minister for Science, Research and Innovation George Freeman said that the trial “represents significant progress towards achieving our ambition to make the UK a quantum-enabled economy”.

“This is the kind of innovation that helps cement the UK as a global innovation economy in the vanguard of discovering, developing and commercially adopting transformational technology with real societal benefits," he added.

An Australian committee report has outlined that public servants should retain records about government decisions, including messages sent via encrypted messaging or social media apps.

The report was published by the Parliamentary Joint Committee on Public Accounts and Audit this month. Although there are calls to strengthen existing legislation, the report didn’t support any changes or recommendations to the way the government keeps records of its communications.

David Fricker, the National Archives of Australia (NAA) director-general, explained in the inquiry that the Archive Act defines a “Commonwealth record” as being “a record that is the property of the Commonwealth.” He noted, however, that WhatsApp and Facebook are not the property of the Commonwealth. Fricker underlined that the increasing use of third party non-government, non-Australian platforms for the conduct of official business is a pressing issue for the NAA.

“I would like to see our legislation modernised, first and foremost, to embrace a more 21st-century definition of a Commonwealth record, one that incorporates a message sent on WhatsApp, for example,” he said at the inquiry in April last year.

NAA guidance explains that public servants should keep a record of what they’ve done. If encrypted messages are sent through WhatsApp, Signal, or Telegram, then the responsibility is on the user to make sure a copy is saved without encryption and put into the Commonwealth record-keeping system.

However, Fricker underlined that no transfers of social media records from Commonwealth government agencies or ministerial offices have been received by the NAA yet. He added that initial planning discussions are underway with some agencies over this topic.

The director general was asked if there were any penalties in place for entities, public servants, or ministers who failed to supply encrypted messages and keep a record as required. Fricker said that under the Archives Act, the only breach is to engage in conduct that leads to the deterioration, loss, or alteration of a Commonwealth record. If the record is never made in the first place then there isn’t any penalty available through the Archives Act.

Fricker confirmed that advice has been sought on the definition of the Commonwealth record, as in the act the powers in his office are limited to records that are the property of the Commonwealth. NAA has provided advice to the Attorney-General’s department on this matter and is in active discussion to bring the law into the 21st century, he added.

The committee has failed to acknowledge in its findings the evidence received that the Archives has received few or no records of social media or encrypted messages from public servants or ministers, said Julian Hill, Labour minister and deputy chair of the committee.

“Dancing around this evidence and failing to make a finding doesn’t change the fact this is a Government addicted to secrecy, and that the definition of Commonwealth record requires updating to ensure government records made or transmitted via modern forms of communication are captured,” added Hill.

Hill said the committee could have gone further by providing recommendations to the government like providing a more modern definition of “Commonwealth Record” and addressing gaps in rules and policy guidance to make sure encrypted messages and social media that relate to government decision making are retained.

How does this compare to the UK?

Overall, the UK government has supported the use of encryption but has attempted to implement measures that would allow it to bypass barriers to accessing secured data if it needed to. The government has said that end-to-end encryption inhibits law enforcement’s ability to gather data that could lead to the protection of vulnerable individuals.

In April 2021, Priti Patel said that Facebook’s plan to implement end-to-end encryption is likely to jeopardise the progress in fighting online child abuse. The same fears were raised, that the technology could hinder law enforcement efforts to track down and arrest child abusers.

Despite the Australian parliament calling for more transparency when it comes to ministers’ communications, the country also passed a controversial surveillance bill last year. It granted the authorities extensive new powers, more than any of its allies like the UK or US has, which is said to take surveillance of citizens to the next level. Citizens are said to have their communications listened to, data on their computers altered, copied, added, or deleted, and their social media accounts closed and their identities impersonated.

IT experts have warned against limiting end-to-end encryption, underlining it wouldn’t make the world safer and is likely to do more harm than good.

78% of industry professionals don’t believe restricting the use of encryption in messaging would protect users, according to a survey of 1,062 respondents carried out by BCS.

66% of specialists also said restricting end-to-end encryption would have a negative impact on protecting society at large.

The poll was carried out following the UK government-backed No Place to Hide campaign, warning against the further rollout of end-to-end encryption.

“We are not opposed to end-to-encryption in principle and fully support the importance of strong user privacy,” the campaign said. “Instead, our campaign is calling for social media companies to work with us to find a solution that protects privacy, without putting children at even greater risk.”

BCS said that encrypted messaging has since become increasingly important to the people of Ukraine, with a large rise in usage being reported, including by journalists.

70% of IT professionals were not confident it is possible to have secure encryption as well as the ability to check encrypted messages for criminal material.

Many industry experts said they were worried about the possibility of increased surveillance from government, police, and technology companies, added the BCS. Other concerns revolved around the protection of, for example, financial data from hackers if encryption was undermined.

There were also concerns that wider sharing of ‘secret keys’ or centralised management of encryption processes would also significantly increase the risk of compromising the confidentiality they are meant to preserve.

“Now is not the time to weaken technology that is so fundamentally important to our security,” said Bill Mitchellm director of policy at BCS. “There should be more exploration of the alternatives before we go down the road of rolling back E2EE, especially in this time of war, when secure messaging is a vital tool for truth telling across the world.”

“It’s odd that so much focus has been on a magical backdoor when other investigative tools aren’t being talked about,” he added. “Alternatives should be looked at before limiting the basic security that underpins everyone’s privacy and global free speech.”

This isn’t the first time the government has faced criticism over its encryption campaign, as in January the Information Commissioner’s Office argued that the technology strengthens online safety. It said that end-to-end encryption helped keep children safe online by not allowing criminals or abusers to send them harmful content or access their pictures or location.

Avast has announced it intends to acquire digital identity and authentication provider SecureKey Technologies for an undisclosed sum.

SecureKey's privacy-enhancing products are designed to streamline access to online services while also ensuring users’ data is only ever shared with prior explicit consent.

A case in point is Verified.Me, SecureKey’s distributed digital identity verification network that employs banking-grade security measures to prevent identity theft and fraud. User banking information is not accessible through Verified.Me, nor are credentials used for online banking.

Additionally, Government Sign-In by Verified.Me, tailored for government applications, allows for simplified access to e-government services and applications. So-called 'Triple Blind' capabilities are built into the tool, ensuring nobody, including financial institutions, government agencies, or network operators, can discern the origin of registrations.

Both Verified.Me and Government Sign-In by Verified.Me are provided by interbank network expert Interac under an exclusive Canadian licensing agreement.

"We envisage a global and reusable digital identity framework which will underpin a new trust layer for the internet. It's clear that digital identity is the critical enabler for many digital services and SecureKey's success reflects the growing demand for this from consumers, " said Ondrej Vlcek, Avast CEO.

“SecureKey is highly complementary to Avast's prior work in Identity and together we will take our offer to the next level, accelerating innovation and working to establish a user-focused, global approach that aligns user, business, and government propositions. We are committed to developing offerings that will be fully inclusive for everyone, regardless of their own circumstances."

The Avast-SecureKey deal is anticipated to close by April and the general availability of SecureKey-based products is scheduled for Q2 2022.

"The maturity of the SecureKey hybrid federation, bank ID, and decentralized technology suite, and history of strong operational delivery in Canada for discerning financial services and government customers & partners, positions Avast for geographic expansion," said Charles Walton, general manager and SVP of identity at Avast.

"As the European community is investing in public-private sector digital identity infrastructure in 2022 and beyond, we see Avast well positioned as a collaborative provider of digital trust services for people, digital businesses and government."

"Success for us is where digital identity becomes simple, user-centric and portable, and can enable a more trustworthy digital experience and deeper online engagement benefiting both people and business," added Walton.

IBM has launched a service to help manage digital security keys across multicloud environments.

The Unified Key Orchestrator supports what IBM calls 'bring your own key' functionality by enabling customers to manage their own data encryption keys across cloud environments including IBM Cloud, Amazon Web Services, and Microsoft's Azure.

It also lets them manage keys on their own premises, the company revealed this week.

The Orchestrator product allows administrators to manage their keys through a single user interface. Customers can also use an API to integrate digital keys into their DevOps process, making it easier to deploy workloads in the cloud, it added.

The service stores digital keys in its own hardware security module, protected by the customer's master key. It transfers those keys to key stores in different cloud services and manages them via an API.

Administrators can also redistribute keys that are lost or corrupted in the field, effectively making the Unified Key Orchestrator a backup service for digital keys, according to the company.

IBM has made the key orchestration system part of its existing IBM Cloud Hyper Crypto Services offering, which is a key management and HSM service. It will offer the new service under a tiered pricing model, it said.

The announcement comes at a time when around 79% of respondents are incorporating multiple public clouds, while 60% said that they're using more than one private cloud, according to a report from Flexera this month.

A third of all organizations said that they were using security tools designed for multiple clouds, making it the front runner for the first time, ahead of multi-cloud cost management and governance tools.

The global encryption software market is projected to exceed $22.1 billion by 2026, according to a new report by MarketsandMarkets.

A compound annual growth rate (CAGR) of 15.2% is anticipated for the market between 2021 and 2026, with the IT and telecommunications industries driving the demand for encryption software.

Regulations for data protection, growing concerns over loss of critical data, and an exponential increase in the adoption of cloud and virtualization technologies will also propel the market.

Major players in the global encryption software market include IBM, Microsoft, and Broadcom.

Within the market forecast period, the on-premises segment is forecast to account for the greatest market share of all software deployment models.

“The on-premises deployment mode is majorly used by critical information industries due to the high security associated with managing sensitive data in-house. Organizations that manage large volumes of sensitive data, especially government agencies, financial companies, and healthcare, still rely on-premises solutions - due to concerns around data security and privacy,” according to MarketsandMarkets’ report.

Furthermore, telecom and IT markets are expected to grow at the highest CAGR over the forecast period. The use of encryption software will help the industries comply with regulations, such as AES, PCI DSS, and GDPR.

By region, APAC is slated to grow at the highest CAGR during the forecast period. The increasing threat of spear phishing, malware, ransomware, and business email compromise can be attributed to the growth in the region.

A study by threat intelligence provider FireEye revealed that Asia Pacific countries are more susceptible to cyberattacks than their western counterparts.

Researchers have found “severe” security flaws in a long line of flagship smartphones made by Samsung whereby attackers can lift cryptographic keys.

Potentially affecting around 100 million Samsung devices including the Galaxy S21, Galaxy S20, and others dating back to the Galaxy S8, attackers can remotely lift cryptographic keys to bypass security authentication standards such as FIDO2.

Real-world applications of the vulnerabilities could see attackers extracting keys used for secure payments such as those made through Google Pay, and bypassing FIDO2 authentication which is often used in place of account passwords.

The researchers from Tel-Aviv University demonstrated how two feasible real-world attacks can be performed on even the latest Samsung devices. Said attacks allowed the researchers to extract cryptographic keys from hardware-protected elements of the device, and downgrade devices so that they’re vulnerable to these attacks, known as IV reuse attacks.

They explained how ARM devices use TrustZone technology which essentially splits a device into two parts: the ‘Normal World’ where normal applications on an operating system (OS) like Android can run; and the ‘Secure World’ which is essentially an isolated environment in which only trusted applications, like those critical to device security, are supposedly able to run.

The Android Keystore provides hardware-backed cryptographic key management via the Keymaster Hardware Abstraction Layer (HAL) and this is implemented in the Secure World of the TrustZone, where processes are not supposed to be accessed from the outside.

Cryptographic keys are protected here using the AES-GCM encryption standard, but Samsung’s implementation of Keystore, which allows keys to be retrieved and stored (while wrapped by an encrypted layer) from the Secure World by apps operating in the Normal World, is flawed.

This allows an attacker to predictably obtain the cryptographic keys if they know the contents of one plaintext sample encrypted using AES-GCM. The encryption standard protects items using the same key and relies on unique initialization vectors (IVs) never being reused.

The researchers were able to show how Samsung devices were vulnerable to the IV reuse attack, allowing attackers to assign IVs as part of the key parameters.

In approaching the research, the academics assumed an attacker could fully compromise the Normal World through mechanisms such as malware granting root privileges. The attacker would not need to be able to run code in the Android kernel, just be able to execute code in the Android user mode.

The researchers disclosed their findings to Samsung in August 2021 and the manufacturer addressed the issues by publishing the flaws to the Common Vulnerabilities and Exposures (CVE) register.

The initial IV reuse attack is tracked as CVE-2021-25444 with a ‘high’ severity rating, and patched in August 2021.

The downgrade attack which allowed newer devices, such as the Samsung Galaxy S20 and S21, to become vulnerable to the IV reuse attack, was patched in October 2021 after its CVE (CVE-2021-25490) addressed the issue for all devices running Android 9 or later.

Although Samsung's latest Galaxy S22 devices are also based on ARM architecture, they will not ship with OS versions before Android 9 as standard and as such will theoretically not be vulnerable to the researcher's attack.

"Samsung takes the security of Galaxy devices seriously. We are constantly looking for ways to enhance the security of our products and welcome any input from research communities," the company told IT Pro.

"The reported issue was acknowledged and has been addressed through security updates since August 2021. We recommend our users to keep their devices updated with the latest software to enjoy safe and convenient Galaxy mobile experiences."

The FBI has urged all athletes to keep their personal smartphones at home and instead use a temporary phone while at the Olympic Games.

The organisation published a notice in which it warns entities associated with the February 2022 Beijing Winter Olympics and March 2022 Paralympics that cyber actors could use a broad range of cyber activities, including DDoS or ransomware attacks, to disrupt the events.

Additionally, the FBI warned Olympic participants and travellers of potential threats associated with mobile applications developed by untrusted vendors.

“The download and use of applications, including those required to participate or stay in the country, could increase the opportunity for cyber actors to steal personal information or install tracking tools, malicious code, or malware,” said the FBI.

The organisation recommends all athletes to use a temporary phone, highlighting that the National Olympic Committees in some Western countries are also advising athletes to leave personal devices at home due to cyber security concerns at the Games.

However, it added that it isn’t aware of any specific cyber threat against the Olympics, but encourages partners to remain vigilant and maintain best practices in their network and digital environments.

It pointed to the 2020 Tokyo Olympics and Paralympics, where there were over 450 million attempted cyber-related incidents during the event, although none were successful due to the cyber security measures in place, according to the NTT Corporation which was in charge of IT security. The most popular attack methods used were malware, email spoofing, phishing, and the use of fake websites and streaming services designed to look like official Olympic service providers.

The FBI added that the use of new digital infrastructure and mobile applications, like digital wallets or applications that track COVID testing or vaccination status, could also increase the opportunity for cyber actors to inflict damage. This could allow them to steal personal information or install tracking tools, malicious code, or malware. The FBI underlined that athletes will be required to use the MY2022 smartphone app to track their health and travel data.

The MY2022 app was analysed by Citizen Lab researchers who said they had found it contained a “devastating” encryption flaw, which it said allowed users’ audio and file transfer encryption to be sidestepped. The researchers also said it fails to validate SSL certificates and can be deceived into connecting to a malicious host.

There also appears to have been some misinformation surrounding the privacy of the Chinese app, with one researcher, Jonathan Scott, claiming that athletes’ audio is being collected, analysed, and saved on servers belonging to a Chinese AI firm with human rights concerns called iFlytek. This claim has been shared by US senators and a prominent podcaster on Twitter.

However, members of the infosec community have said the researcher’s claim is unsubstantiated by any of the evidence provided, even though it has already been shared widely.

The White House issued a memorandum on Wednesday detailing new cyber security requirements and timelines to protect national security systems.

The Memorandum on Improving the Cybersecurity of National Security, Department of Defense, and Intelligence Community Systems, builds on an Executive Order issued last May to bolster cyber security across the federal government. It identifies more requirements for national security systems that go beyond those in the original document.

The memorandum requires agencies to inventory all systems affecting national security within 90 days. It also calls for an incident reporting and response program with clear reporting deadlines.

It also addresses systems that span different security domains, such as those designed for sharing information between different agencies.

The head of the National Security Agency will act as a national manager and advise on their security, the memorandum says. The national manager is responsible for advising on and enforcing most of the requirements in the memorandum.

The Executive Order last May requested the implementation of zero-trust architectures, but today's memorandum puts a timeline on it. It calls on the head of each agency to create an implementation plan within 60 days, incorporating the National Institute of Standards and Technology's (NIST) zero-trust guidance documents.

Agencies must also implement multi-factor authentication within 180 days, along with encryption for data at rest and in transit, the memorandum said.

The memorandum also accounts for quantum-proof encryption, which researchers are designing to ensure that encrypted data is protected against quantum computers. Quantum systems will eventually be able to unlock data encrypted by conventional asymmetric encryption algorithms when they become powerful enough, fear experts.

The memorandum calls for agencies to identify any encryption that isn't compliant with an NSA-approved list of quantum-proof encryption algorithms within 180 days. They must also provide a timeline to swap out these algorithms, it adds.

Other mandatory measures include a program for collaboration between defense and intelligence agency participants on cyber security incident response and cloud security.

The International Olympic Committee (IOC) has defender China’s MY2022 app for the Olympic Games in Beijing after researchers found it contained a "devastating" encryption flaw.

Due to the pandemic, China has decided to implement a “closed-loop” management system and daily testing. All international and domestic attendees are mandated to download MY2022 14 days prior to their departure for China and to start monitoring and submitting their health status to the app on a daily basis.

However, the flaw allows encryption protecting users’ voice audio and file transfer to be trivially sidestepped, according to new research from Citizen Lab. The app fails to validate SSL certificates, allowing an attacker to spoof trusted servers by interfering with the communication between the app and servers. This means it can be deceived into connecting to a malicious host, allowing information it transmits to be intercepted and enabling the app to display spoofed content that appears to originate from trusted servers.

The researchers also found that some sensitive data is transmitted without any SSL encryption or any security at all. It transmits non-encrypted data to “tmail.beijing2022.cn” on port 8099 which contain sensitive metadata relating to messages, such as the names of messages’ senders and receivers, and their user account identifiers. This data can be read by any passive eavesdropper, such as someone operating an unsecured WiFi access point or an Internet Service Provider.

The report said the app collects a range of highly sensitive medical information and it is unclear with whom or which organisations it shares this information. It also contains features that allow users to report politically sensitive content, and contains a censorship keyword list which is presently inactive. The keywords target political topics such as Xinjiang and Tibet as well as reference to Chinese government agencies.

Citizen Lab stated that the app’s security deficits may not only violate Google’s Unwanted Software Policy and Apple’s App Store guidelines but also China’s own laws and national standards pertaining to privacy protection, providing potential avenues for future redress.

The IOC told IT Pro that the user is in control over what the app can access on their device, as the settings can be changed to configure access to specific features like Files and Media, Camera, Contacts, Microphone, and more.

“The app has received approval of the Google Play store (Android/HarmonyOS) and the App Store (iOS) too and is available for download,” said the spokesperson. “It is not compulsory to install 'My 2022' on cell phones, as accredited personnel can log on to the health monitoring system on the web page instead.”

The IOC added that it has conducted independent third-party assessments on the application from two cyber security testing organisations, with the reports confirming that there are no critical vulnerabilities. It said that many of the app’s features are used for local Beijing 2022 workforce for time-keeping, task management, and instant messaging, as the app is not only for international users.

The IOC has requested the report from Citizen Lab to understand its concerns better. IT Pro has contacted Google and Apple for comment.

The UK has waged a war on end-to-end encryption for years, with the government boomeranging between scaremongering tactics to manipulate public opinion on the divisive technology. Its latest attempt to convince the public that surrendering its basic human right to privacy is, actually, a good idea, however, fails to address the core issue it’s ignoring; that criminalisation almost never works.

Revelations published by Rolling Stone shows the government isn’t backing down on encryption, despite a litany of more pressing fires it needs to put out. The Home Office has commissioned M&C Saatchi, a high-end advertising agency, to run an anti-encryption campaign centred on the role of encryption in child exploitation, including an insidious “visual PR stunt” involving a child and an adult. This aims to mobilise public opinion against Meta's decision to add encryption to Messenger, for instance, among other uses of the technology.

The events of recent weeks have shown the contempt the government holds towards its citizens, and the lengths it will go to hide self-servitude. It now believes using child exploitation as the main argument against encryption should be enough to turn the tide.

It should be under no illusion, however, that banning the technology will do little to curb the online abuse of children, although according to the former head of the NCSC Ciaran Martin, the government may not actually know what it’s talking about.

Banning encrypted messaging will remove the benefits and freedoms it affords the public, while ramping up the levels of already-hyperactive state-wide surveillance. The 1920s prohibition era serves as a historical example, as well as today’s so-called war on drugs; it’s very much a losing battle.

Has the lack of easy-access cannabis, like we can find in some states in the US, led to a drop in use? Well, cannabis is still the most misused illicit drug in the UK, ONS figures show, with usage rising since 2013. Cocaine use, too, was up 37% against 2013, and more people also misused ketamine now than a decade ago. The Children’s Society, meanwhile, says 90% of police forces in England have observed county lines activity, with violence escalating.

It suggests what we know to be true; that outlawing things of value will only push them into the hands of outlaws. In the case of encryption, only those intent on harm will gain access to encrypted messaging services through technologies like Pretty Good Privacy (PGP), deep underground with little chance of government tracking.

Take Messenger, WhatsApp, and Signal away from Joe Public and what are you left with? The vast majority of the population will be exposed to the government of the day, whether it’s Boris Johnson, or an untimely successor. Criminals, meanwhile, will have already burrowed themselves deeper into the dark web, using PGP-signed messages over which the government has no oversight. Nobody can ban cryptography.

It’s here from which whiffs of incompetence emanate. Revoking end-to-end encryption will allow dark web communities to flourish, making life even more difficult for law enforcement. We’ve seen how dark web marketplaces have thrived despite attempts to stop the illegal trade of guns, drugs, and other illicit goods. After all, it takes months to infiltrate a marketplace and shut it down, and minutes for an alternative to begin accepting patrons.

This campaign is yet another thinly-veiled attempt to achieve the government’s ambition of scaling up the apparatus of the surveillance state, first through the Investigatory Powers Act, recently in its Online Safety Bill, alongside years of public gesticulations.

To complicate matters, though, the government’s argument is somewhat valid, and one that even I, an avid proponent of end-to-end encryption, often struggle to internally justify. When you consider the lives lost through terrorist plots organised over encrypted messaging platforms, or the countless lives ruined through exploitation, it’s a difficult stance to hold.

When you see through the flagrant technical illiteracy and untruths running through this prospective campaign, however, you have to call into question the motives. This is especially true when you factor in attempts to undermine our rights and access to privacy, alongside the lengths to which government ministers go to hide their own activities from the public by using, you guessed it, WhatsApp.

In the early days of computer networking, cyber security was predominantly focused on the perimeter because it was thought you needed to keep the bad guys out. Within the perimeters was thought to be safe and trusted, while outside the enterprise firewalls danger lurked.

However, this assumes that hackers haven’t already got into the network and started doing damage. Cyber criminals can get a grip within a businesses' infrastructure by exploiting a vulnerable system, stolen credentials, or by exploiting poorly configured wireless connections. To counteract this scenario, many modern enterprises are adopting a zero trust model.

What is a zero trust model?

Zero trust is a relatively new and evolving approach to network design. It means “never trust, always verify”. By default, devices on a network are not trusted, even when connected to a corporate network and even if previously verified.

This model protects the environment by using methods and processes such as network segmentation, strong authentication, preventing lateral network movement, and simplifying “least access” policies.

So how does an organisation go about building, running, and using a zero trust model in the infrastructure?

Network segmentation

The foundation of a zero trust architecture is network segmentation. Systems and devices must be segregated according to the types of data they process and the access they permit. This can then limit the reach of a hacker once they get into the network.

To segment a network, organisations should create a comprehensive roadmap based on business and security aims. They should then map application dependencies so that organisations know how apps communicate to endpoints within the infrastructure. Finally, a network should not be over-segmented as this can lead to over complexity and may prevent employees from doing their jobs properly if they can’t access the systems they need to.

Identity and access management improvement

A strong identity and access management infrastructure is another precondition of a zero-trust model. Multi-factor authentication offers additional reassurance of identity and defends against credential stealing. Implementing role-based access control permits applications to limit access in a way that implements the principle of least privilege.

Deploying least privilege at the firewall

Least privilege not only applies to users, but it also applies to networks. After network segmentation, access between networks should be locked down to only allow traffic between them according to business needs.

Using a next-generation firewall (NGFW) can help organisations to implement what Gartner defines as a “deep-packet inspection firewall that moves beyond port/protocol inspection and blocking to add application-level inspection, intrusion prevention, and bringing intelligence from outside the firewall.”

Monitoring using AI and machine learning

Machine learning can be used by organisations to speed up the work of detecting and mitigating threats. Usually, security analysts would use security information and event management (SIEM) solutions to gain a comprehensive understanding of security events collected from systems, devices, and applications across an organisation’s network and clouds. Machine learning and artificial intelligence (AI) can help to surface threat indicators that would otherwise be lost in reams of data.

This gives security teams a better way of recognising what activity is taking place and if it is normal activity that machine learning has been trained to identify. If this activity falls outside normal usage patterns, AI can flag this up as suspicious and help enterprises improve their defences from both internal and external threats and deploy a more full-bodied zero trust security model.

Ongoing management and issues

A zero trust model should be thought of as part of an organisation’s overall digital transformation strategy. It should be by design and not simply retrofitted. This means implementing technology to achieve zero trust as more systems move to the cloud and legacy systems are replaced.

Moving to zero trust should involve an ongoing conversation between security and the rest of the organisation to prioritise what moves to a zero-trust model and what can wait.

When up and running, managing zero trust should involve security teams developing and maintaining zero trust models, while network teams manage networks. The security team should also carry out regular audits to ensure that the network adheres to the policies and protocols of zero trust. Critical workloads will need more analysis of users and devices compared to other, less important, workloads.

The US Department of Commerce has added a dozen Chinese tech companies to its trade blacklist to prevent the Chinese army from gaining access to critical US technologies.

Among the newly-banned Chinese companies, eight specialise in quantum computing technologies and had sparked concerns that the country could leverage them in breaking US encryption or developing unbreakable encryption for the Chinese army.

Hangzhou Zhongke Microelectronics, Hunan Goke Microelectronics, New H3C Semiconductor Technologies, Xi'an Aerospace Huaxun Technology, and Yunchip Microelectronics have been added to the blacklist due to their "support of the military modernisation of the People's Liberation Army [PRC]”.

Meanwhile, Hefei National Laboratory for Physical Sciences at Microscale, QuantumCTek, and Shanghai QuantumCTeck had been banned for "acquiring and attempting to acquire US-origin items in support of military applications”.

Commenting on the decision, US Secretary of Commerce Gina Raimondo said that “global trade and commerce should support peace, prosperity, and good-paying jobs, not national security risks”.

“The Department of Commerce is committed to effectively using export controls to protect our national security,” she added.

Apart from the dozen Chinese companies, the governmental body also blacklisted 15 tech businesses from Japan, Pakistan, and Singapore, as well as determined that Russia’s Moscow Institute of Physics and Technology produces military products for the Russian army.

“Today’s actions will help prevent the diversion of US technologies to the PRC’s and Russia’s military advancement and activities of non-proliferation concern like Pakistan’s unsafeguarded nuclear activities or ballistic missile programme,” said Raimondo.

Hours after the announcement, the Chinese Embassy in Washington released a statement saying that the US "uses the catch-all concept of national security and abuses state power to suppress and restrict Chinese enterprises in all possible means”.

"China is firmly opposed to that," the embassy’s spokesperson, Liu Pengyu, told Reuters.

The news comes weeks after the Federal Communications Commission (FCC) expelled China Telecom from the US, ordering the US subsidiary of a Chinese state-owned enterprise to stop providing domestic interstate and international communication services within its borders. This is due to the company reportedly being subject to exploitation, influence, and control by the Chinese government. China Telecom has until 27 December to comply with the FCC’s orders.

Meta has announced plans to delay the global rollout of end-to-end encryption (E2EE) across its messaging applications to 2023.

The company previously said it would have E2EE across all its products by 2022 at the earliest.

Meta said it would be taking additional time to ensure the implementation across Facebook Messenger and Instagram is done correctly, protecting privacy while also mitigating the risk of online harms.

WhatsApp is currently the only app in Meta's product portfolio that enables E2EE by default, although it has previously been criticised for allowing moderators to access the contents of any messages flagged by users as potentially abusive.

“We’re taking our time to get this right and we don’t plan to finish the global rollout of end-to-end encryption by default across all our messaging services until sometime in 2023,” said Antigone Davis, head of safety at Meta, the Sunday Telegraph.

“As a company that connects billions of people around the world and has built industry-leading technology, we’re determined to protect people’s private communications and keep people safe online,” she added.

E2EE has created an ongoing debate around the divide between privacy and personal safety. Meta said it's taking time to implement E2EE in a way that upholds both, but how that happens is unclear.

If E2EE is deployed in its proper form, with unique on-device encryption, it should be impossible to facilitate any third-party oversight of what is communicated through the technology without breaking its fundamental principles.

"Encryption is an absolute. You either have it or you don’t. There is no 'getting it right'," said Andy Yen, founder and CEO at Proton. "The best way to protect privacy and user data is to not have the data in the first place.

"Of course we need to ensure tech is not misused, but there are many ways to combat criminal behaviour," he added. "Back doors and similar methods of undermining privacy are an ineffective way of preventing crime. If Meta cared as much about user privacy as it claims, it would have implemented end to end encryption a long time ago."

From a cyber security perspective, Jim Killock, executive director at Open Rights Group, said there is a clear argument that E2EE offers protections for the everyday consumer and calls for its removal would be welcomed by cyber criminals all over.

"There are many ways of tackling crime. Storing all communications in the clear is just one; the focus on E2EE is narrow and misleading," he told IT Pro. "What is certain is that E2EE provides security from cybercriminals and hacking.

"Government campaigning against security technologies is a gift to cybercriminals," he added.

However, repeated calls for a proposed 'backdoor' in E2EE-enabled messaging services have been made by governments across the world.

The main opposing arguments are those related to the protection of children online and safeguarding national security from terror events, for example.

Home Secretary Priti Patel labelled Facebook's encryption plans "simply not acceptable" earlier this year at an event run by the National Society for the Prevention of Cruelty to Children (NSPCC). Patel said tech companies have a duty to protect children from online harms.

"Facebook is right not to proceed with end-to-end encryption until it has a proper plan to prevent child abuse going undetected on its platforms," said Andy Burrows, head of child safety online policy at the NSPCC, to the Guardian.

"But they should only go ahead with these measures when they can demonstrate they have the technology in place that will ensure children will be at no greater risk of abuse," he added.

Coinciding with Meta's new 2023 encryption deadline is the enactment of the UK's Online Safety Bill, which will force online platforms to implement protections for users, including children, from harm and address abusive content.

The domestic legislation may stifle Meta's ability to enable E2EE across its products, but to what extent the Online Safety Bill will impede consumer privacy through encrypted messaging remains to be seen.

The shift to remote working, the increase in ransomware attacks (and ransom costs), and the looming threat of cyber warfare have all unquestionably contributed to elevating the urgency of cyber security. By offering newfound levels of “unhackable” encryption, quantum key distribution (QKD) is turning heads in the cyber security and telecommunications industries alike.

QKD advocates claim this technology is an ultra-secure communication method that serves as the antidote to the rise of powerful quantum machines. It allows the parties involved in sharing confidential information to generate a shared random key, known only to them, in order to encrypt and decrypt messages distributed between them. Its purported necessity is driven by the fear that quantum computers may one day be powerful enough to bypass most cyber security defences by being able to rapidly identify the prime factors of numbers used in RSA encryption. Indeed, theoretically, anybody with access to a powerful enough quantum computer would be able to crack much of today’s encryption, which safeguards messages as well as sensitive medical information and military secrets.

It’s been a formative year for QKD research; from breaking records in long-distance quantum-secured information transfer, to the world’s first trial of QKD over hollow-core fibre cable, the technology is maturing at pace. Earlier this month, meanwhile, we learned London will receive the world’s first commercially available quantum-secured metro network connecting the Docklands with the City and M4 Corridor.

BT is among a number of companies that have, for years, advocated for the potential of QKD, with the firm behind the majority of recent developments. The National Cyber Security Centre (NCSC), however, hasn’t subscribed to this view, believing the technology is still a considerable distance from maturity.

QKD: Hackable or not?

In a whitepaper published in March 2020, the NCSC stated it doesn’t endorse the use of QKD, and cautioned against relying on the technology to protect networks. Although the technology has evolved considerably since the start of the pandemic, the NCSC’s position hasn’t. “While the NCSC welcomes continuing research into QKD,” a spokesperson tells IT Pro, “it does not endorse its use in government or military systems and cautions against its sole reliance on networks used by critical infrastructure.

“Developments in quantum computing present challenges to cyber security in the long term that must be managed, and the UK is preparing new technologies to mitigate the threat and protect our digital lives. The NCSC considers quantum-safe cryptography to be the most effective mitigation to adopt, and advice to help organisations prepare for the transition has been published on our website.”

Although QKD promises a secure way of communication that’s “unhackable” by quantum computers, it’s still susceptible to man-in-the-middle (MITM) attacks, in which an exchange between two computer systems is breached by a third party. This is because QKD doesn’t have adequate authentication protocols in place, meaning that a threat actor could pose as person B to person A, and as person A to person B, leading them to believe that they are communicating with each other. Apart from that, the technology is also limited by specific hardware requirements, as well as the assumption the code used won’t contain any exploitable bugs which could sabotage the efforts of ultra-secure communication.

Today's problem for tomorrow’s security

Duncan Jones, head of cyber security of the quantum computing company Cambridge Quantum, tells IT Pro he wholeheartedly agrees with the NCSC’s position, adding that QKD won’t be suitable for production use for “a while” – potentially five years. In this respect, QKD is similar to 6G; at the moment, the technology is far from maturity, let alone there being any smartphones capable of supporting it. That shouldn’t, however, stop networking firms from exploring 6G, in the same way companies like BT shouldn’t refrain from continuing to research QKD.

“[QKD] is going to have a big impact on communications and telecommunications. And so, they are completely right to be investing in this now,” Jones says. The “average enterprise”, on the other hand, might want to sit it out for another few years. So what makes telecom companies exceptional? The answer lies in fibre optic cables, says Jones, and the telecommunication industry’s “responsibility for moving things around securely”.

“So, definitely, they should be exploring it, and a lot of this builds towards this idea in the future of a quantum internet, so the ability to share quantum data between distributed quantum computers – and that's something else that I know BT and others are thinking about and building towards,” he says.

Although innovation might seem to be moving at an overwhelmingly fast pace, to some it’s not fast enough. According to BT’s director of Government Relations, Simon Godfrey, the government doesn’t see QKD as a matter of urgency. “Quantum for me is something that I've woken up to only recently, but it is critically important to embrace it and understand it,” he tells IT Pro. “My fear is that our political classes are looking for it to be tomorrow's problem rather than today's problem, and it really is today's problem.”

Full steam ahead

Despite the private and public sector being at loggerheads over the readiness of QKD, Jones believes the technology’s “in a good place” thanks to the multiple grants, funds, and innovation projects that encourage research in the technology. One such initiative is a £10 million partnership between the UK and Singapore to build and fly a satellite QKD test bed. After three years of work, the satellite is set to become operational by the end of 2021.

Research and development of QKD can be described in one way: full steam ahead. Although this might seem at odds with the NCSC’s position, it’s thanks to its guidance that researchers can pinpoint the areas of development that need to be addressed. QKD might not come into play for most businesses at least for the next five years. With the encryption-breaking prospect of quantum computing coming leaps and bounds, however, UK enterprises might want to keep the technology on their radar as they aspire to future-proof their cyber security defences.

When WhatsApp, Instagram and Facebook – along with its Messenger – all went down in October, it became apparent just how ingrained messaging apps have become in people’s everyday lives.

Many immediately took to Twitter (where else?) to express their frustrations at not being able to contact friends and family as normal. Others cited how critical such channels were to those in countries where free speech is undermined, or where communication infrastructure is lacking.

Late last year, on an earnings call, Facebook founder Mark Zuckerberg revealed how WhatsApp now delivers more than 100 billion messages a day across the globe, clearly demonstrating how free messaging platforms have left SMS and the simple phone call trailing in their wake.

This most recent outage, however, was also used by others to highlight the belief that some messaging routes might be more private and secure than others. Privacy advocate Edward Snowden, for example, suggested on Twitter that it was a “reminder that you and your friends should probably be using a more private, non-profit alternative”.

Snowdon cited Signal as one example. Describing the eponymous app on its website, Signal says: “We can’t read your messages or listen to your calls, and no one else can either. Privacy isn’t an optional mode — it’s just the way that Signal works.” Competitor Telegram is growing in popularity for similar reasons.

Andrew Whaley, senior technical director at Norwegian app security company Promon suggests the growth over time in the use of encrypted messaging apps has been determined by the richer functionality and privacy they offer to consumers and company teams.

“Apps like WhatsApp, Signal and Telegram all offer end-to-end encryption, which, for the many people wanting privacy, is a big bonus,” he says. “In some cases, this could be privacy from advertisers, while, for others, this might be privacy from the state. Either way, simple SMS or email is typically the less secure option.”

From regulation to whistleblowing

The shift to using end-to-end encrypted messaging apps has thrown up a broad range of controversies, as well as highlighted a range of benefits.

In some quarters, they are seen as having a negative impact on society with governments around the world regularly raising the idea of regulation. Most often states say there’s a dangerous lack of oversight on the private conversations being had; security services have long expressed concerns about those who may push hate speech or plan terror attacks via these channels.

Such apps have also recently been in the news amid claims they were used to spread anti-COVID-19 vaccine content or, in the case of the German elections, conspiracy theories.

On the opposite side of the argument, the strict privacy of these apps has been heralded as a way for whistle-blowers and journalists to communicate safely, ensuring important stories and scandals are uncovered. In countries where democracy is curtailed, they also offer a route for private and unmonitored discussions.

Others believe the encryption is also a much-needed tool to stop companies mining data from unencrypted message platforms, which is often then used, or sold, to influence advertising.

Robin Wilton, director of internet trust at the global non-profit Internet Society, says: “One of the main reasons these apps have grown in popularity comes down to the fact consumers have become savvier towards how their data is managed, and are therefore more aware of end-to-end encryption and its benefits.

“In addition, these apps are often free of charge and are as simple as SMS to use, while delivering enhanced privacy. Therefore, not only do users feel safer, but they also do not have to deal with the inconvenience of having to configure encryption into their applications.”

Building the future of encrypted messaging

Not everyone feels so positive towards these sorts of services, though. For Andersen Cheng, CEO at Post-Quantum, a firm of UK cryptographers, the risks related to such heavily encrypted apps actually led to him closing down a previous creation in 2014, described as “the world’s first and only ‘quantum-safe’ instant messaging system”.

He explains: “In the age of privacy, it was a much-needed win in a period where the misuse and monetisation of user data was widely agreed to be out of control. However, the reality proved vastly more complex when our application subsequently appeared on an Islamic State recommended technical tools list.

“We were getting healthy daily downloads as well, but the eventual decision to switch it off was relatively easy — we would not put profit before human lives.”

Cheng adds: “I firmly believe these privacy-preserving apps have a future but a middle ground must be reached between the two sides of the debate. On the one hand, we have privacy advocates arguing for full and unquestionable privacy for users. However, this makes it extremely difficult for the police and tech firms to monitor communications, detect child grooming and intercept child abuse imagery. It also makes it easier for terrorist organisations to operate undetected.”

On the other hand, Cheng argues government-sanctioned ‘backdoors’ in encryption aren’t the answer either, warning: “A backdoor for one is a backdoor for all, and anyone can walk through it, whether the intended government agency, a hacker, or a malicious nation.”

His suggestion is to have a pre-agreed ‘side door’, adding: “That allows you to split control and responsibility, and one you can only access if multiple parties like governments, private companies, privacy groups and preferably courts each provide their section of the key.”

Amandine Le Pape, co-founder of secure messaging app Element, which claims to be trusted by French, US and UK governments, is also against backdoors. Her aim was to create an open standard for communication that brought benefits to both sides, leading to Matrix – an open standard for decentralised, end-to-end encrypted communication. Element is a Matrix-based app, one of hundreds that now exist, with 38 million users in the network.

Le Pape states end-to-end encryption is “absolutely vital” to secure the modern digital world. “We need end-to-end encryption to protect the 99.9% of the population that are perfectly law-abiding people from the bad actors,” she adds.

However, from the technology providers’ side, she believes there is a need for responsible management and explains that by building a “first-class infrastructure … users (and room/community moderators and server admins) make up their own mind about who to trust, and what content to allow”.

She believes the future is “incredibly bright” but warns: “Backdoors are an absolute disaster. Don’t forget, ‘bad people’ have free and easy access to create their own end-to-end encrypted systems. They will not be using an encrypted system with a wide open backdoor. It only impacts the ‘good people’.”

Multi-factor authentication (MFA) has been increasingly adopted in recent years, in line with the threats to password security.

Web and mobile products primarily use this, but approaches can differ.

Download this guide to learn why MFA is an essential tool in online security as well as the best practices for deployment.

Provided by

The UK government must act now to regulate Facebook, whistleblower Frances Haugen told MPs on Monday.

The data engineer and scientist, who worked for Facebook for two years prior to sounding the alarm about the tech giant’s practices, testified before the Online Safety Bill committee on Monday about the dangers created by the social media platform.

Haugen warned MPs that “Facebook is closing the door on us being able to act”.

“We have a slight window of time to regain people[‘s] control over AI,” she told members of the committee, who are working on new legislation that could see social media companies fined up to 10% of their annual turnover, or £18 million, for failing to quash online abuse.

Haugen said that work on the Online Safety Bill ​​has been largely ignored by Facebook CEO Mark Zuckerberg, yet the legislation could have the potential to set a precedent for other countries.

"The UK has a tradition of leading policy in ways that are followed around the world,” she told Parliament, adding that she was "incredibly proud of the UK for taking such a world-leading stance".

Haugen told MPs that, due to shortages of moderators, Facebook had been unable to police harmful content in multiple languages around the world, leading to civil unrest in Ethiopia and Myanmar. However, the issue also impacts the UK, she added, due to Facebook’s AI’s inability to detect online abuse in British English.

"UK English is sufficiently different that I would be unsurprised if the safety systems that they developed primarily for American English were actually under-enforcing in the UK,” she told the committee.

The hearing comes days after Facebook claimed that its AI managed to reduce the prevalence of hate speech by 50%.

Haugen also hit back at claims made by the Telegraph on her stance on end-to-end encryption (e2ee), saying that she had been ‘misrepresented’ by the publication.

She said that, contrary to the Telegraph’s report published on Sunday, she fully supports “e2e open source encryption software”, using it herself on a daily basis.

“I want to be very, very clear. I was mischaracterised in the Telegraph yesterday on my opinions around end-to-end encryption,” Haugen told MPs, adding that she is “a strong supporter of access to open source end-to-end encryption software”.

“Part of why I am such an advocate for open source software, in this case, is that if you’re an activist, if you’re someone who has a sensitive need, a journalist, a whistleblower — my primary form of social software is an open source, end-to-end encryption chat platform,” she said.

However, Haugen said she was sceptical about the legitimacy of Facebook’s e2ee.

In August, Facebook added the option of e2ee for voice and video calls on its Messenger communications platform, defying warnings from the UK government about the technology’s risk to children’s safety. Weeks later, it also extended e2ee to WhatsApp backups.

Despite the negative attention and increased scrutiny from US and UK officials, Facebook managed to generate a profit of $9.2 billion (£6.67 billion) during the third quarter, according to financial earnings results published on Monday.

The Australian Federal Police (AFP) has suggested it may introduce a "more aggressive" cyber division, after legislation was passed in September granting extensive new surveillance powers to law enforcement agencies in the country.

During a Senate estimates hearing held on Monday, in which senators typically scrutinise how the government is spending taxpayer money, AFP commissioner Reece Kershaw said that the introduction of Surveillance Legislation Amendment (Identify and Disrupt) Act 2021 means it can now proactively target suspected criminals with disruptive operations.

Kershaw highlighted that the three new powers in the Act will significantly enhance how the AFP investigates serious cyber-enabled crime. The new powers allow police to disrupt data by modifying, copying, adding, or deleting it and allow the AFP and Australian Criminal Intelligence Commission (ACIC) to collect intelligence from devices and networks. Lastly, the powers allow the agencies to take control of an online account to gather information for an investigation.

The commissioner said that the police’s investigators are already planning how they might use the new powers in active investigations to identify, target, and disrupt offenders, including those relating to terrorism, drug importations, and distribution of child abuse material.

"At the moment, we're actually going through an internal review of how we can be more aggressive in cyber, and it may mean a mini restructure internally for us to really have what we would call a cyber offensive operation of the AFP, which would actually conduct disruption operations on these individuals," said Kershaw, according to ZDNet.

The commissioner said this includes talking with the Five Eyes alliance about the growth of cyber threats, with Kershaw currently being the chair of the organisation’s law enforcement group.

Encrypted communications platforms are a significant barrier for the AFP, said Kershaw, outlining that transnational serious organised crime offenders rely on encrypted platforms to carry out their criminality.

“This is the next frontier of crime, and the AFP and our partners will work with governments and global law enforcement networks to ensure the long arm of the AFP reaches criminals no matter where they are in the world,” he added.

The AFP's plan for a new cyber offensive arm will have a dangerous effect on people's rights and freedoms in Australia and de-stabilise the open, secure internet we all rely on, said Namrata Maheshwari, Asia Pacific policy counsel, and lead on encryption policy at Access Now.

"This is extremely damaging for privacy and free expression, and undermines digital security for all. The new arm is being built on a flawed foundation: the Identify and Disrupt Bill, which violates human rights; and discussions with the Five Eyes surveillance alliance, which has often called for backdoors to encryption, a measure that would render private and secure communication impossible," she said. "We need rights-respecting frameworks to strengthen cybersecurity, and enhanced surveillance and new 'disruption' tools by law enforcement, as is being contemplated, will have the opposite effect."

Kershaw explained that Operation Ironside was enabled by unique, global law enforcement partnerships, particularly with the FBI, as the AFP provided the agency with the technical ability to decrypt and read encrypted communications in real time.

The operation saw the AFP work for almost three years, leading to the arrest of hundreds of suspected criminals that were tricked into using an encrypted messaging app. The app, codenamed “Anom”, was installed on mobile phones stripped of other capabilities that were bought on the black market. They were only able to send messages to another device that had the app installed, and criminals had to know other criminals to acquire a device.

Facebook has announced plans to roll out end-to-end encryption for WhatsApp chat history on both Android and iOS versions of the app.

The feature, which is to be slowly rolled out to those using the latest version of the chat app, will allow users to secure backups before they are saved in iCloud or Google Drive storage, where neither WhatsApp or the cloud service provider will be able to access the files.

Users will be able to use a password to encrypt the backup or use a 64-digit encryption key, the has company confirmed.

WhatsApp has offered secure messaging since 2016 and the company started testing encrypted backups earlier this year. With Wednesday's announcement, Facebook said it had taken the final step towards providing a full end-to-end encrypted messaging experience on WhatsApp.

In essence, end-to-end encryption lets only the sender and receiver see the contents of a message, and conceals it from the company providing the service. While this is an assurance to users of WhatsApp, it's a concern for governments and security professionals that feel there needs to be a way to access communications under certain circumstances.

WhatsApp has long been considered at the forefront of the industry when it comes to end-to-end encryption, and has repeatedly drawn the ire of those seeking to ban its use in telecommunications.

The UK's government has repeatedly called for a mechanism that can bypass the safeguards of a service. This would require service providers to be active participants in the interception and acquisition of user data as part of an investigation.

Charities, such as the NSPCC, and law enforcement agencies like Interpol and GCHQ, have also argued against end-to-end encryption on the grounds that it protects individuals and impedes investigations.

Even the European Union, which was once in favour of end-to-end encryption, has reportedly proposed regulations to ban it. A leaked document, dated 6 November, appeared to show that the Council of the European Union had a near-complete resolution to ban the use of end-to-end encryption on off-the-shelf apps, like WhatsApp or Signal. However, there has been no official announcement from the EU regarding the memo.

However, many cyber security professionals and industry lobbyists maintain that a so-called backdoor in end-to-end encryption would only make users more vulnerable to cyber crime.

Facebook is launching end-to-end encryption protection for WhatsApp users who want to back up their chat histories to the cloud.

The firm has devised an entirely new system for encryption key storage that means end-to-end encrypted backups will be protected with a randomly generated 64-character encryption key.

The firm's two billion users will be able to benefit from this optional feature on their primary devices when it launches in the coming days.

“For years, in order to safeguard the privacy of people’s messages, WhatsApp has provided end-to-end encryption by default ​​so messages can be seen only by the sender and recipient, and no one in between,” said WhatsApp software engineer managers, Slavik Krassovsky and Gabriel Cadden.

“Now, we’re planning to give people the option to protect their WhatsApp backups using end-to-end encryption as well.

“People can already back up their WhatsApp message history via cloud-based services like Google Drive and iCloud. WhatsApp does not have access to these backups, and they are secured by the individual cloud-based storage services. But now, if people choose to enable end-to-end encrypted (E2EE) backups once available, neither WhatsApp nor the backup service provider will be able to access their backup or their backup encryption key.”

All users can activate this method of backup to secure their accounts either with the key directly, or with a user password. If users choose a password, the key is stored in a Backup Key Vault that’s built on a component called a hardware security module (HSM).

When the owner needs to access their backup, they can access it with the encryption key, or use their password to retrieve their key from the HSM-based vault.

The vault enforces password verification and permanently disables the key after a number of failed attempts, however, meaning the backup will be lost forever. WhatsApp itself will only know that a key is being stored in the vault, and not what the key is.

WhatsApp isn’t the first company to enforce end-to-end encrypted backups, with Apple enforcing encryption on iCloud backups.

However, the fact Facebook’s messaging service has expanded the level of encryption it uses on its service will likely anger law enforcement agencies across the world which have railed against the technology.

The Five Eyes nations of English-speaking countries, for example, have time after time asked for tech companies to water down or undermine the application of end-to-end encryption in their services.

The group, for example, handed tech giants an ‘ultimatum’ in September 2018 to voluntarily insert a backdoor for law enforcement into their platforms. They have followed this up with repeated calls for a backdoor, and in October 2020, again, urged companies to implement a backdoor by-design into their services.

ProtonMail has been criticised for providing authorities with the IP address of a French climate activist.

The company, which is one of the world’s largest secure email services, offers end-to-end encrypted emails which can only be decrypted by the recipient. However, it can log users’ IP addresses in the case of serious crimes.

French authorities, who were denied the request for the activist’s IP address, managed to obtain the information through Swiss law enforcement. ProtonMail, based in Switzerland, prides itself on benefiting from the country’s strict privacy laws, yet was “obligated" to comply with the “legally binding order from Swiss authorities”, according to founder and CEO Andy Yen.

The case has been extensively criticised, with many disagreeing about the severity of the crime. The activist had been involved in taking over apartments and commercial locations in the Paris neighbourhood of Sainte Marthe, in order to protest the rising gentrification in the area. Amnesty International technologist Etienne Maynier stated on Twitter that he has “a hard time seeing how young people squatting buildings in Paris is an extreme criminal case”.

“In any case, I have an issue with this lack of transparency from ProtonMail, if any police service can ask them to log IP addresses, that is not anonymous,” he added.

In a company statement published on Tuesday, Yen said that “there was no possibility to appeal this particular request [from the Swiss authorities]”.

However, it has sparked concerns that ProtonMail could be able to give out IP addresses to law enforcement of any country, as long as they file their request through the Swiss authorities.

Security expert Filippo Valsorda said that “the problem with ProtonMail is not that they don't deliver an impossible product (secure email), but that they advertise it”.

“It's a choice, they know it, they benefit from it, their users believe it, and they are responsible for it,” he added.

Yen stated that the company “will be making updates to [its] website to better clarify ProtonMail’s obligations in cases of criminal prosecution”.

“We apologise if this was not clear. As a Swiss company, we must follow Swiss laws,” he said, adding ProtonMail’s privacy policy will also be updated “to make clearer our legal obligations under Swiss law”.