Talk: How Terrorists Encrypt
Encryption technology has always been regarded as a weapon, due to its uses in wars and espionage. Software used for encryption was banned for export to other countries in the US. The export regulations for strong cryptography were relaxed in 1996. Some countries still consider cryptographic software as a threat. Recently there have been discussions in the USA again about controlling access to encrypted communication channels. The United Arab Emirates, Indonesia, India, and Saudi-Arabia legally attacked the BlackBerry’s strong encryption of the BlackBerry Messenger Service. Encrypted messaging was discussed in UK after the riots in August. Pakistan has banned all encryption and requires users to apply for a permit. Usually the proponents of regulations claim that terrorists and cybercrime are heavy users of strong cryptography.
So how do terrorists really encrypt? Are there software packages available? What do real modern terrorists do with encryption tools? Do they use them? How do they use them? Do they know how to communicate securely? Do they master secure communication better than Western enterprises or government agencies?
When considering encryption in connection with communication first you have to decide where to look and what kind of messages will be transmitted. Tactical communication looks a lot different than strategic communication. The environment is crucial, too. Not all adversaries can sit in a coffee shop, sip their coffee and triple-encrypt their messages. Some are travelling, some are in an area without power supply, some are fleeing, some are being shot at. Key management requires a logistic overhead, especially if your messengers and bases are scattered throughout the world in places of varying technological level.
We are trying to explore answers to these questions with Duncan Campbell‘s talk. Duncan is an investigative journalist who now works as a computer forensic expert in major terrorism prosecutions. The spectre of international terrorism networks hiding behind “unbreakable” crypto communications was the war cry for security agencies lobbying for “key escrow” and inherently insecure encryption during the “Crypto Wars” of the 1990s. The agencies lost their campaign. Key escrow proposals hit the trash. The crypto wars have been rekindled, but the risks need to be discussed reasonably and with facts. New laws compelling targets to hand over crypto keys were introduced globally. Were they needed? Do the laws work? Can they work?
The reality of terrorists’ communications and crypto is mundane, repeating classic centuries old errors – such as the wannabe airline bomber who told Al Qaeda’s new chief to reject AES and use insecure homebrew methods instead (he was arrested within the week). Duncan will put the many theories of how terrorists employ encryption into perspective and deliver insight into the tools of the trade.