Feeds

MPs told PGP 'incompatible' with Parliament network

Cryptographic conundrum

Next gen security for virtualised datacentres

MPs have been told that although they are free to install PGP on their parliamentary machines the technology is not compatible with Parliament’s remote access software, making its use impractical.

The curious response came from the House of Commons Commission via Lib Dem MP Nick Harvey in response to questions raised by Francis Maude, shadow cabinet office minister. Maude queried whether or not MPs are allowed to load Pretty Good Privacy encryption on their parliamentary computers. He was told that they could if they wanted to but advised that the software would frustrate support from the Parliamentary ICT (PICT (pdf)) department.

Worse still, the software is supposedly incompatible with key VPN (remote access) software, political blog Dizzy Thinks reports, adding an extract from the reply.

PICT has recently completed an evaluation of encryption software and Pretty Good Privacy (PGP) was found to be incompatible with Parliament’s current version of VPN (remote access) software. Therefore, this product is not recommended for users of that service. As part of the evaluation PICT has identified another product that can be deployed to members' loaned machines by PICT at no cost to Members. The software can also be acquired by Members at their own cost, if they wish to have it installed on machines that they have purchased through PICT.

We asked PGP for comment on the compatibility of its technology with VPN software in general and the parliamentary system in particular. The firm said there's nothing about PGP that ought to preclude its use with VPN software, a different class of security application. It's still looking into the specifics of the interaction between PGP and parliamentary systems.

"VPN Technology is a network transport technology, and PGP desktop is a piece of software that provides an encryption platform application," explained PGP marketing manager Jamie Cowper.

"The only interaction we have with a VPN, is to transport standard TCP/IP communications. As an application, we are not involved with any part of the VPN process (initiation, key exchange, management etc)."

Quite why Parliament's remote access software might be compatible with an alternative encryption package but not PGP - a widely-used package that's been available for over a decade - remains unclear. The more paranoid among you might say that the other (unknown) product might be easier to eavesdrop upon.

You may well think that. We couldn't possibly comment.

It's known that Colt Telecom supplies the connectivity and that MessageLabs handles the anti-spam and anti-virus filtering on the parliamentary internet connection.

The issue of whether MPs can exchange secure communications with each other and their constituents or not was thrown into focus by recent moves by the Metropolitan Police to get copies of email correspondence between Members of Parliament, without first getting a warrant. The request was made about requests between Damian Green MP and fellow Tory David Davis. Davis raised the issue in the House of Commons at the start of February, SpyBlog reports.

Green's constituency and House of Commons offices were searched in November, during which equipment including papers and computers was removed, when he was controversially arrested by police investigating alleged misconduct over leaked Home Office papers. The request for email correspondence seems to be a follow-up request in the same investigation.

Davis's questions in House can be read in Hansard here.

SpyBlog suggested that MPs sensitive about the privacy of the communications they exchange should publish a PGP key on their website. It's unclear how many have taken up this option. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Best practices for enterprise data
Discussing how technology providers have innovated in order to solve new challenges, creating a new framework for enterprise data.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?