Bug to differ: Secure encryptions run into ‘backdoor’ hurdles

Encryption is a double-edged sword. It means converting information into a format that's unreadable by humans or computer that only authorized users can decode using a secret decryption key. So even though encrypting data can help minimize spying on private communications, it is not encouraged by governments. "Governments aren't happy about encryption because it would mean they can't monitor their own citizens' communications either," said Christopher Soghoian of ACLU. "They want to make sure that their citizens' communications are not encrypted, but then they have to deal with the security risks associated with unencrypted communications," he says.

Such security risks have emerged in many software tools and hardware components alleged to have 'backdoors' — a way of bypassing a system's security deliberately built into them for spy agencies to exploit. These hardware and software with malicious backdoors are supplied to companies or even exported. Multiple such allegations have cropped up, especially against American and Chinese firms. Chinese telecom equipment has in particular faced numerous accusations. India is among several nations wary of using them. The US has so far stayed away from Chinese equipment too.

"Why there's a worry over potential backdoors and intentional bugs in routers sold by the Chinese companies Huawei and ZTE is because many of the communications transmitted over the Internet are not encrypted. If communications of the public, businesses and state agencies were encrypted, then interception risks through secret bugs and backdoors would be significantly reduced," said Soghoian.

Weak or no encryption also does away with the need for an interception law, giving spy agencies a free hand. If encryption used by companies is strong, government needs to ask them for records under a legal framework. Otherwise it can simply hack its way to these records.

At a security conference 'nullcon' in 2012 in Goa, a company, Matrix Shell, claimed that most telecom service providers in India use A5/0 algorithm for encryption, which actually is no encryption. Of the many GSM encryption systems: A5/0, A5/1, A5/2 and A5/3), the standard should be A5/1. The company hacked into Indian GSM mobile networks to show they could impersonate a user and make calls on his/her behalf. No encryption implies that anyone with off-theair interception systems can listen to calls without any permission.