NSA Revises Guidance on Teleworking Services for Government Users

The National Security Agency updated guidance to help federal agencies choose secure collaboration services, changing its determination of whether a number of products offered end-to-end encryption and other security features. 

Changes to the NSA’s guidance, along with comments from some of the vendors, highlight the big-picture political fight over end-to-end encryption and an enduring disconnect among various government officials, industry representatives and privacy advocates on what the term means.

NSA examined the policies of 15 companies in the June 4 version of its guidance, including Zoom, Microsoft Teams, Google G Suite, Slack, Skype for Business and Wickr, all of which NSA changed its designations for regarding factors such as whether the service offered certain kinds of encryption, or allowed users to control invitations to virtual meetings.

Microsoft Teams, for example, is noted as generally offering end-to-end encryption in the new guidance when the April 24 version of the document concluded the collaboration service generally doesn’t do this.     

Neal Ziring, technical director for NSA’s cybersecurity directorate, said the change to Microsoft Teams’ designation was “based on further review of public vendor documentation.”

“NSA cybersecurity publications include a feedback email address, we welcome input from industry and government readers,” he said in a statement provided to Nextgov

As the coronavirus pandemic forced government employees to choose conferencing services to enable remote work, the NSA listed nine decision-making criteria against five functions—text chat, voice conferencing, video conferencing, file sharing, and screen sharing—for prioritizing security.

Here are the criteria NSA recommended considering:

  1. Does the service implement end-to-end encryption?
  2.  Are strong, well-known, testable encryption standards used? 
  3. Is multi-factor authentication used to validate users’ identities? 
  4. Can users see and control who connects to collaboration sessions? 
  5. Does the service privacy policy allow the vendor to share data with third parties or affiliates? 
  6. Do users have the ability to securely delete data from the service and its repositories as needed? 
  7. Has the collaboration service’s source code been shared publicly (e.g. open source)?
  8. Has the service and/or app been reviewed or certified for use by a security-focused nationally recognized or government body? 
  9. Is the service developed and/or hosted under the jurisdiction of a government with laws that could jeopardize U.S. government official use?

The NSA labeled each service with a “Y” for yes or “N” for no regarding their delivery of the criteria. Some of the services given a Y for end-to-end encryption, including Zoom, had a footnote attached, indicating this was “partial.” 

Ziring said “partial end-to-end encryption means one or more of the five listed functionality types does not fall within the service’s end-to-end encryption.” 

Voice conferencing was considered as a functionality for Microsoft in the updated guidance but not in the old version of the document.

Zooming Past Definitions 

Consideration of how these services stack up in terms of security is a lot more complicated in the NSA guidance document than it is in the public discourse. 

At the Defense One Tech summit Thursday, Anne Neuberger, head of NSA’s cybersecurity directorate highlighted the agency’s guidance on telework services in discussing how COVID-19 has changed the cyber landscape. 

“Ideally, security, when it works, is invisible to the user. I’m connected to Zoom who is end-to-end encrypted, that makes a difference,” she said, citing the NSA’s top criteria for choosing a secure service. 

While the NSA guidance ranks Zoom and Microsoft Teams as generally offering end-to-end encryption, privacy and civil liberty advocates and other technology organizations, including the Mozilla Foundation, lambasted Zoom CEO Eric Yuan for his intention to only make end-to-end encryption available for paying customers.

Following the backlash, Zoom announced on Wednesday that it would work to make end-to-end encryption available to all users.

“End-to-end encryption means that content (text, voice, video, data, etc.) is encrypted all the way from sender to recipient(s) without being intelligible to servers or other services along the way. Only the originator of the message and the intended recipients should be able to see the unencrypted content,” according to the NSA document.

For staunch advocates of end-to-end encryption, including major tech companies like Apple and Facebook, this means even the service providers themselves should not have access to keys that could decrypt the data in their servers. 

This is at the heart of disputes between the tech companies and law enforcement officials who want to be granted access to devices and communications to aid criminal investigations. 

Yuan had said maintaining the ability to cooperate with law enforcement is the reason Zoom was disinclined to make end-to-end encryption freely available.

Privacy advocates who fear the surveillance of marginalized groups say communications are either end-to-end encrypted or they’re not. But the NSA guidance tries to walk a fine line by saying “strong end-to-end encryption is dependent on [decryption] keys being distributed carefully.”

In a blog post about the privacy and security of Microsoft Teams, Jared Spataro, corporate vice president for Microsoft 365, avoids the term end-to-end encryption.

He notes data is encrypted in transit between users’ devices and Microsoft data centers, and also while at rest in those data centers, but “in a way that allows organizations to decrypt content if needed, to meet their security and compliance obligations, such as eDiscovery.”

There was only one change in the text, outside of a table of designations, of the NSA’s guidance document. 

Where the old version said “some services such as large-scale group video chat are not designed with end-to-end encryption for performance reasons,” the new version says “some use cases may not be able to use end-to-end encryption for performance reasons, capability limitations, or compliance requirements.”

Source link

Recent articles

Coronavirus Live Updates: Trump Pushes for Schools to Reopen

As U.S. infections hit 3 million, the Trump administration presses local officials to reopen classrooms in the fall.As the total number of coronavirus...

How New Zealand’s media endangered public health | Coronavirus pandemic

New Zealand's health minister, David Clark, has been forced to resign and the nation's hyperactive media have claimed their latest scalp. In the...

How Do You Tell Your Child He Is Undocumented?

When Excel comes back nine months later, he surprises Maxima at home: She jumps up with “a switchblade aimed right at him,” mistaking...

PlayStation Store Update Worldwide – July 7, 2020

Each week Sony brings PlayStation 4, PlayStation 3, PlayStation Vita and PlayStation Portable owners new content, add-ons, games and more. PlayStation LifeStyle catalogs...

SAA pilots isolated as other unions gradually back severance scheme | News

South African Airways unions have largely indicated acceptance of voluntary severance packages as part of the airline’s rescue, after the government warned that...

2014 FIFA World Cup™ – News – Behind the World Cup record: Miroslav Klose

​Miroslav Klose broke Ronaldo's record on this day in 2014 He did it in front of the Brazilian's eyes Klose set...

Leave a reply

Please enter your comment!
Please enter your name here