Tag: agency

US military will finally start encrypting soldiers’ emails

You’d think the military’s email service mail.mil would be more secure than Gmail and other free alternatives, but that’s apparently not the case. A Motherboard investigation in 2015 revealed that while it does have systems in place to protect classified messages, it doesn’t even use STARTTLS — a 15-year-old encryption technology that prevents emails from being intercepted in transit. That exposes unclassified emails to surveillance and leaves them vulnerable as they make their way to recipients. Now, after getting a lot of flak over the lack of security, Pentagon says it will finally start encrypting soldiers’ emails… but not until July 2018. See, Gizmodo discovered that the military’s email service doesn’t use STARTTLS, because it would prevent the Defense Information Systems Agency (DISA) from screening each message for malware, phishing attempts and exploits. A letter from DISA, which oversees the military’s emails, says its detection methods developed using national level intelligence “would be rendered ineffective if STARTTLS were enabled.” To be able to implement the technology and make it a default feature, it would have to migrate to a “new email gateway infrastructure, ” and migration won’t be done until July next year. DISA has revealed its plans to migrate the military’s email service in a letter addressed to Senator Ron Wyden, who questioned the agency for not using a “basic, widely used, easily enabled cybersecurity technology.” Wyden said in a statement that the move is definitely a step in the right direction, but he’s also pretty unhappy that it’ll take DISA a year to migrate. “Protecting the communications of American servicemen and women should be a priority, ” he said, “so I hope the agency accelerates its timeline.” Source: Gizmodo , Motherboard

Continued here:
US military will finally start encrypting soldiers’ emails

NSA will stop illegally collecting American emails

The National Security Agency has enjoyed relatively broad authority to monitor communications among suspected terrorists and their associates, even when those people happen to be American citizens and even without a warrant . However, The New York Times reports the NSA is stopping one of its most controversial practices: the collection of Americans’ international emails and text messages that mention a foreigner under surveillance. The NSA is attempting to adhere to a 2011 ruling by the Foreign Intelligence Surveillance Court. The court found this “about the target” collection program violated the Fourth Amendment because some internet companies packaged and processed emails in bundles — meaning if one message contained a foreign target’s email address, the entire group was swept up. The NSA was intercepting domestic communications, resulting in illegal searches. FISC allowed the surveillance to continue, but with a new safeguard in place: The NSA proposed a program where it would keep these bundled emails in a separate repository where analysts would not be able to see them. In 2016, the NSA reported the revamped program was not going as planned and analysts were, in fact, still searching the sequestered documents, The New York Times says. FISC delayed renewing the agency’s warrantless surveillance program until it promised to cancel the entire “about the target” collection process. The NSA has argued its bulk-collection methods help officials track potential threats, as contact with someone under surveillance is grounds for suspicion. Privacy advocates like the American Civil Liberties Union argue otherwise. “This development underscores the need for Congress to significantly reform Section 702 of FISA, which will continue to allow warrantless surveillance of Americans, ” ACLU legislative counsel Neema Singh Guliani says in response to today’s news. “While the NSA’s policy change will curb some of the most egregious abuses under the statute, it is at best a partial fix. Congress should take steps to ensure such practices are never resurrected and end policies that permit broad, warrantless surveillance under Section 702, which is up for reauthorization at the end of the year.” I’m going to go out on a limb & add a big reason: bulk access going darker 1—email providers moved to TLS/https 2—targets moved to E2E apps https://t.co/zz5WCxOHmZ — Thomas Rid (@RidT) April 28, 2017 Of course, technology continues to rapidly advance, and online communication has changed a lot since 2011. Today, more people are using end-to-end encryption and email providers are offering more secure ways to communicate, potentially making it harder for the NSA to round up these messages in the first place. In 2014, Google announced it would use HTTPS connections in Gmail specifically because the NSA was poking around in users’ business. Source: The New York Times

Read More:
NSA will stop illegally collecting American emails