Feeds

MPs told PGP 'incompatible' with Parliament network

Cryptographic conundrum

Internet Security Threat Report 2014

MPs have been told that although they are free to install PGP on their parliamentary machines the technology is not compatible with Parliament’s remote access software, making its use impractical.

The curious response came from the House of Commons Commission via Lib Dem MP Nick Harvey in response to questions raised by Francis Maude, shadow cabinet office minister. Maude queried whether or not MPs are allowed to load Pretty Good Privacy encryption on their parliamentary computers. He was told that they could if they wanted to but advised that the software would frustrate support from the Parliamentary ICT (PICT (pdf)) department.

Worse still, the software is supposedly incompatible with key VPN (remote access) software, political blog Dizzy Thinks reports, adding an extract from the reply.

PICT has recently completed an evaluation of encryption software and Pretty Good Privacy (PGP) was found to be incompatible with Parliament’s current version of VPN (remote access) software. Therefore, this product is not recommended for users of that service. As part of the evaluation PICT has identified another product that can be deployed to members' loaned machines by PICT at no cost to Members. The software can also be acquired by Members at their own cost, if they wish to have it installed on machines that they have purchased through PICT.

We asked PGP for comment on the compatibility of its technology with VPN software in general and the parliamentary system in particular. The firm said there's nothing about PGP that ought to preclude its use with VPN software, a different class of security application. It's still looking into the specifics of the interaction between PGP and parliamentary systems.

"VPN Technology is a network transport technology, and PGP desktop is a piece of software that provides an encryption platform application," explained PGP marketing manager Jamie Cowper.

"The only interaction we have with a VPN, is to transport standard TCP/IP communications. As an application, we are not involved with any part of the VPN process (initiation, key exchange, management etc)."

Quite why Parliament's remote access software might be compatible with an alternative encryption package but not PGP - a widely-used package that's been available for over a decade - remains unclear. The more paranoid among you might say that the other (unknown) product might be easier to eavesdrop upon.

You may well think that. We couldn't possibly comment.

It's known that Colt Telecom supplies the connectivity and that MessageLabs handles the anti-spam and anti-virus filtering on the parliamentary internet connection.

The issue of whether MPs can exchange secure communications with each other and their constituents or not was thrown into focus by recent moves by the Metropolitan Police to get copies of email correspondence between Members of Parliament, without first getting a warrant. The request was made about requests between Damian Green MP and fellow Tory David Davis. Davis raised the issue in the House of Commons at the start of February, SpyBlog reports.

Green's constituency and House of Commons offices were searched in November, during which equipment including papers and computers was removed, when he was controversially arrested by police investigating alleged misconduct over leaked Home Office papers. The request for email correspondence seems to be a follow-up request in the same investigation.

Davis's questions in House can be read in Hansard here.

SpyBlog suggested that MPs sensitive about the privacy of the communications they exchange should publish a PGP key on their website. It's unclear how many have taken up this option. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Choosing a cloud hosting partner with confidence
Download Choosing a Cloud Hosting Provider with Confidence to learn more about cloud computing - the new opportunities and new security challenges.