Feeds

MPs told PGP 'incompatible' with Parliament network

Cryptographic conundrum

Choosing a cloud hosting partner with confidence

MPs have been told that although they are free to install PGP on their parliamentary machines the technology is not compatible with Parliament’s remote access software, making its use impractical.

The curious response came from the House of Commons Commission via Lib Dem MP Nick Harvey in response to questions raised by Francis Maude, shadow cabinet office minister. Maude queried whether or not MPs are allowed to load Pretty Good Privacy encryption on their parliamentary computers. He was told that they could if they wanted to but advised that the software would frustrate support from the Parliamentary ICT (PICT (pdf)) department.

Worse still, the software is supposedly incompatible with key VPN (remote access) software, political blog Dizzy Thinks reports, adding an extract from the reply.

PICT has recently completed an evaluation of encryption software and Pretty Good Privacy (PGP) was found to be incompatible with Parliament’s current version of VPN (remote access) software. Therefore, this product is not recommended for users of that service. As part of the evaluation PICT has identified another product that can be deployed to members' loaned machines by PICT at no cost to Members. The software can also be acquired by Members at their own cost, if they wish to have it installed on machines that they have purchased through PICT.

We asked PGP for comment on the compatibility of its technology with VPN software in general and the parliamentary system in particular. The firm said there's nothing about PGP that ought to preclude its use with VPN software, a different class of security application. It's still looking into the specifics of the interaction between PGP and parliamentary systems.

"VPN Technology is a network transport technology, and PGP desktop is a piece of software that provides an encryption platform application," explained PGP marketing manager Jamie Cowper.

"The only interaction we have with a VPN, is to transport standard TCP/IP communications. As an application, we are not involved with any part of the VPN process (initiation, key exchange, management etc)."

Quite why Parliament's remote access software might be compatible with an alternative encryption package but not PGP - a widely-used package that's been available for over a decade - remains unclear. The more paranoid among you might say that the other (unknown) product might be easier to eavesdrop upon.

You may well think that. We couldn't possibly comment.

It's known that Colt Telecom supplies the connectivity and that MessageLabs handles the anti-spam and anti-virus filtering on the parliamentary internet connection.

The issue of whether MPs can exchange secure communications with each other and their constituents or not was thrown into focus by recent moves by the Metropolitan Police to get copies of email correspondence between Members of Parliament, without first getting a warrant. The request was made about requests between Damian Green MP and fellow Tory David Davis. Davis raised the issue in the House of Commons at the start of February, SpyBlog reports.

Green's constituency and House of Commons offices were searched in November, during which equipment including papers and computers was removed, when he was controversially arrested by police investigating alleged misconduct over leaked Home Office papers. The request for email correspondence seems to be a follow-up request in the same investigation.

Davis's questions in House can be read in Hansard here.

SpyBlog suggested that MPs sensitive about the privacy of the communications they exchange should publish a PGP key on their website. It's unclear how many have taken up this option. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
How to simplify SSL certificate management
Simple steps to take control of SSL certificates across the enterprise, and recommendations centralizing certificate management throughout their lifecycle.