Securing the Internet - Data Protection and Encryption

According to the Office for National Statistics, in the UK, over 75% of households now have Internet access and, increasingly, our lives are shifting online.  The financial sector say that over 20 million people bank online in the UK and a number of government services, including parts of the tax system are now paperless and operate exclusively over the web.  Also in the pipeline are systems for accessing medical records from anywhere in the country, and the benefits system is due to be put onto the Internet too.  Now this means that sensitive personal data has to be transmitted over the web.  So, how can it actually be kept safe?  Chris Smith spoke with Ross Anderson is a specialist in onlien security. He's from the computing security group at the University of Cambridge...

Ross - Data protection goes back to the 1960s and encryption goes back many, many centuries.  People have been enciphering their messages using all sorts of techniques for a long, long time.  But there has been a big change recently.  In the old days, 50 years ago or 100 years ago, the limiting factor in your ability to encrypt data or information security was the ability of the people at the end points to perform computations to substitute letters for numbers, shuffle letters around, and so on, and so forth.  This meant that it was difficult to make systems that were complex enough to resist mathematical analysis.  But over the past 20 years or so, now that we've all got PCs and mobile phones that can run software, that problem has gone away, and instead, the problem now is how secure at all the end points.

Chris -   You say it's gone away, is that because the computer basically doesn't have an attention span like a person.  It can just relentlessly plough on trying one thing after another, after another until it gets the code broken.

Ross -   No.  What's happened with the advance of the technology is that this has favoured the code makers over the code breakers because if you increase the length of key just a little bit, you can increase the difficulty of breaking decipher an awful lot.  And over the past 20 years, we've had the development of a number of encryption algorithms that are now really pretty good.  They're no longer the weak point in the chain.

Chris -   Could you just explain, when you say an encryption algorithm, what exactly does that mean?  What are people doing to data so that someone can't just come along and work out what is says?

Ross -   Well, I'm not going to into describing the internals of modern encryption algorithms because it's hard enough doing mathematics at a blackboard, let alone over the air.  But roughly speaking, what happens in modern encryption algorithms such as AES is  you've got a series of rounds where transpositions and substitutions follow one after another together with mixing of key material.  And this means that unless you know or can guess the key, it's in practice not possible to recover plaintext from ciphertext.

Chris -   So you have a key.  That's when you're on your router at home and you see PSK (Pre-shared Key), that's some combination of letters and numbers, or symbols.  And that's mixed-in in some way with the data, so that the data is changed using information in that key so that unless you know what that key is, you can't reverse the process.

Ross -   That's more or less right, but that isn't the interesting or relevant thing nowadays.  That's essentially a solved problem.  A much bigger problem is the fact that about 6% of PCs in Britain have malware in them.  So even if you think you share a key with your bank, that's not actually so.  6% or so, may actually be sharing that with some bad guys in Russia.

Chris -   In other words, when I log on to my bank account and I'm generating some kind of random series of, usually numbers with one of those little handheld devices, the bank knows what that number is, I know what that number is, so the data should be secure, but I am without realising it, also giving that number via software on my computer to somebody else so they can eavesdrop on the conversation I am having with the bank.

Ross -   That's fundamentally the problem.  If your computer is infected with malware or if the bank's computer is infected with malware, then the bad guys may be able to intercept the order that you give to pay 20 pounds to Sainsbury's and instead turn it into an order to pay 20,000 pounds to Mafia Real Estate Incorporated in Bermuda.  And as bank payments become ever faster and ever more voluminous, the risk and the exposure from all this goes relentlessly up.

Chris -   Why can't clever people like you spot when that kind of interception has occurred?  Because the whole point about Schrödinger's cat and sort of quantum things was that a photon knows if it's been observed during its course from one place to another.  Can we not do the sort of equivalent on the internet if a piece of data is probed or examined by someone other than the person it's intended for, you can tell?

Ross -   Well, the promise that was initially held out by quantum cryptography, 20, 25 years ago hasn't in fact come to pass for various technical reasons.  But in any case, it wouldn't be a viable technology for large scale use.  The problem is that the majority of banks have decided that rather than giving special software or special devices to their customers, they're going to use the commodity products, the web browser that came with your PC when you bought it.  And this means that the bad guys in Russia or Brazil, or Nigeria, or wherever just have to write an attack once and it can then run everywhere.

Chris -   So you can have this absolutely fantastic encryption and decryption system, but it's only as good as the thing that keeps the key safe.  And if that's leaky because you have dodgy software on your computer, you may as well have a much weaker system because it's effectively not watertight.

Ross -   Exactly.  So the mathematics of cryptography are no longer the weak point and where you have to start looking is in the game theory and the incentives that face the various banks, the incentives that face the malware writers.  Now, it's not particularly more difficult to write a virus for say, Mac OS or Linux than it is for PCs, but because there are so many more PCs, there are many more people writing malware for Windows operating systems.  And so, you're much more likely to be the victim of an attack involving malware if you're using a PC with Windows.  Now this isn't cryptography, this is game theory which is another kind of mathematics altogether.

Chris -   A tweet has just come in @nakedscientists.  Shib says, "What is the difference between malware and a computer virus?"  Are they effectively one and the same thing?  There isn't really a distinction, is there?

Ross -   Well viruses are a kind of malware.  So, for the current purposes, there isn't really a distinction.

Chris -   Effectively, what's the source of these things?  Do we not just tackle the root cause or origin of this malware?  Do we not just say, "Okay, we know this stuff exists. We'll just write better software that finds it and stops it installing itself on your computer?"

Ross -   The best thing to do would be for the world's police forces to put serious effort into catching the people who write malware and putting them in jail.  There are one or two police units, particularly the FBI, who put some effort into this, but I'm afraid that many police forces just consider it to be in the 'too hard' category.  After all, if these guys are in somewhere like St. Petersburg, you're talking mutual legal assistance, you're talking extradition, you're talking hundreds of thousands of pounds per case.

Chris -   Of course there you're talking about hiring them and turn them into employees because they might be quite useful against other countries.

Ross -   There is a problem, in that many governments find that they've got a conflicted mission.  On the one hand, if the government puts its priority to policing, it would try and drain the swamp.  It would clean up the botnet, stop people writing malware, and so on, and so forth.  But on the other hand, the people on the offensive side of things, GCHQ, the MOD and so on, rather like the idea that there's a big swamp out there because it means that they can hide their nefarious activities in it.  And so, you end up with a tension between policing missions and intelligence missions, between offensive and defensive missions.  And unfortunately, the offensive often wins out because GCHQ has got the ear of the prime minister, much more than the commissioner of the Met has.

Chris -   And the taxpayer, and bank customers are picking up the bill effectively... Thanks Ross.