Feeds

MPs told PGP 'incompatible' with Parliament network

Cryptographic conundrum

The Essential Guide to IT Transformation

MPs have been told that although they are free to install PGP on their parliamentary machines the technology is not compatible with Parliament’s remote access software, making its use impractical.

The curious response came from the House of Commons Commission via Lib Dem MP Nick Harvey in response to questions raised by Francis Maude, shadow cabinet office minister. Maude queried whether or not MPs are allowed to load Pretty Good Privacy encryption on their parliamentary computers. He was told that they could if they wanted to but advised that the software would frustrate support from the Parliamentary ICT (PICT (pdf)) department.

Worse still, the software is supposedly incompatible with key VPN (remote access) software, political blog Dizzy Thinks reports, adding an extract from the reply.

PICT has recently completed an evaluation of encryption software and Pretty Good Privacy (PGP) was found to be incompatible with Parliament’s current version of VPN (remote access) software. Therefore, this product is not recommended for users of that service. As part of the evaluation PICT has identified another product that can be deployed to members' loaned machines by PICT at no cost to Members. The software can also be acquired by Members at their own cost, if they wish to have it installed on machines that they have purchased through PICT.

We asked PGP for comment on the compatibility of its technology with VPN software in general and the parliamentary system in particular. The firm said there's nothing about PGP that ought to preclude its use with VPN software, a different class of security application. It's still looking into the specifics of the interaction between PGP and parliamentary systems.

"VPN Technology is a network transport technology, and PGP desktop is a piece of software that provides an encryption platform application," explained PGP marketing manager Jamie Cowper.

"The only interaction we have with a VPN, is to transport standard TCP/IP communications. As an application, we are not involved with any part of the VPN process (initiation, key exchange, management etc)."

Quite why Parliament's remote access software might be compatible with an alternative encryption package but not PGP - a widely-used package that's been available for over a decade - remains unclear. The more paranoid among you might say that the other (unknown) product might be easier to eavesdrop upon.

You may well think that. We couldn't possibly comment.

It's known that Colt Telecom supplies the connectivity and that MessageLabs handles the anti-spam and anti-virus filtering on the parliamentary internet connection.

The issue of whether MPs can exchange secure communications with each other and their constituents or not was thrown into focus by recent moves by the Metropolitan Police to get copies of email correspondence between Members of Parliament, without first getting a warrant. The request was made about requests between Damian Green MP and fellow Tory David Davis. Davis raised the issue in the House of Commons at the start of February, SpyBlog reports.

Green's constituency and House of Commons offices were searched in November, during which equipment including papers and computers was removed, when he was controversially arrested by police investigating alleged misconduct over leaked Home Office papers. The request for email correspondence seems to be a follow-up request in the same investigation.

Davis's questions in House can be read in Hansard here.

SpyBlog suggested that MPs sensitive about the privacy of the communications they exchange should publish a PGP key on their website. It's unclear how many have taken up this option. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Fiendishly complex password app extension ships for iOS 8
Just slip it in, won't hurt a bit, 1Password makers urge devs
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.