(FVEY) Five Eyes spying alliance will survive Edward Snowden

Britain needed US intelligence to help thwart a major terror attack. New Zealand relied on it to send troops to Afghanistan. And Australia used it to help convict a would-be bomber. All feats were the result of a spying alliance known as Five Eyes that groups together five English-speaking democracies, and they point to a vital lesson: American information is so valuable, experts say, that no amount of global outrage over secret US surveillance powers would cause Britain, Canada, Australia and New Zealand to ditch the Five Eyes relationship. The broader message is that the revelations from NSA leaker Edward Snowden are unlikely to stop or even slow the global growth of secret-hunting - an increasingly critical factor in the security and prosperity of nations. "Information is like gold," said Bruce Ferguson, the former head of New Zealand's foreign spy agency, the Government Communications Security Bureau. "If you don't have it, you don't survive."
The Five Eyes arrangement underscores the value of this information - as well as the limitations of the information sharing. The collaboration began during World War II when the allies were trying to crack German and Japanese naval codes and has endured for more than 70 years. The alliance helps avoid duplication in some instances and allows for greater penetration in others. The five nations have agreed not to spy on each other, and in many outposts around the world, Five Eyes agencies work side by side, allowing for information to be shared quickly. But Richard Aldrich, who spent a decade researching a book on British surveillance, said some Five Eyes nations have spied on each other, violating their own rules. The five countries "generally know what's in each other's underwear drawers so you don't need to spy, but occasionally there will be issues when they don't agree" - and when that happens they snoop, Aldrich said.
In Five Eyes, the US boasts the most advanced technical abilities and the biggest budget. Britain is a leader in traditional spying, thanks in part to its reach into countries that were once part of the British Empire. Australia has excelled in gathering regional signals and intelligence, providing a window into the growing might of Asia. Canadians, Australians and New Zealanders can sometimes prove useful spies because they don't come under the same scrutiny as their British and American counterparts. "The United States doesn't share information," said Bob Ayers, a former CIA officer, "without an expectation of getting something in return."
Britain is home to one of the world's largest eavesdropping centres, located about 300 kilometres north-west of London at Menwith Hill. It's run by the NSA but hundreds of British employees work there, including analysts from Britain's eavesdropping agency, the Government Communications Headquarters - or GCHQ.
Australia is home to Pine Gap, a sprawling satellite tracking station located in the remote centre of the country, where NSA officials work side-by-side with scores of locals. The US also posts three or four analysts at a time in New Zealand, home to the small Waihopai and Tangimoana spy stations.

Twitter Toughening Its Security to Thwart Government Snoops

A year ago, hardly anyone, save for cryptographers, had heard of Perfect Forward Secrecy. Now, some customers are demanding it, and technology companies are adding it, one by one, in large part to make government eavesdropping more difficult.
On Friday, Twitter will announce that it has added Perfect Forward Secrecy, after similar announcements by Google, Mozilla and Facebook. The technology adds an extra layer of security to Web encryption to thwart eavesdropping, or at least make the National Security Agency’s job much, much harder. (Update: Twitter has announced the security change on its blog.)
Until Edward J. Snowden began leaking classified documents last summer, billions of people relied on a more common type of security called Transport Layer Security or Secure Sockets Layer (S.S.L.) technology to protect the transmission of sensitive data like passwords, financial details, intellectual property and personal information. That technology is familiar to many Web users through the “https” and padlock symbol at the beginning of Web addresses that are encrypted.
But leaked N.S.A. documents make clear that the agency is recording high volumes of encrypted Internet traffic and retaining it for later cryptanalysis. And it’s hardly the only one: Iran, North Korea, and China all store vast amounts of Internet traffic. More recently, Saudi Arabia has been actively trying to intercept mobile data for Twitter and other communication tools.
The reason governments go to great lengths to store scrambled data is that if they later get the private S.S.L. keys to decrypt that data — via court order, hacking into a company’s servers where they are stored or through cryptanalysis — they can go back and decrypt past communications for millions of users.
Perfect Forward Secrecy ensures that even if an organization recording web traffic gets access to a company’s private keys, it cannot go back and unscramble past communications all at once. Perfect Forward Secrecy encrypts each web session with an ephemeral key that is discarded once the session is over. A determined adversary could still decrypt past communications, but with Perfect Forward Secrecy the keys for each individual session would have to be cracked to read the sessions’ contents.
Perfect Forward Secrecy was invented more than 20 years ago, and Paul Kocher, a leading cryptographer, put support for Perfect Forward Secrecy into the S.S.L .protocol. But companies have been reluctant to use it because it slows website and browser performance, uses resources and because — until Snowden — most consumers did not even know it existed. Unlike S.S.L. technology, there is no indication to a user that Perfect Forward Secrecy is enabled.
This tougher security is quickly becoming a must-have for Internet companies.
Earlier this week, Marissa Mayer, the chief executive of Yahoo, announced that Yahoo would introduce new security features in 2014. But, on Twitter, some consumers were quick to point out that Perfect Forward Secrecy was conspicuously absent from her blog post.
“With security, there are always the things you know you ought to do,” Mr. Kocher said in an interview. “But it’s not until you have a clear adversary that it’s much easier to justify the resources to go fix the problem.”
At Twitter, Jacob Hoffman-Andrews, a security engineer, had been pushing the company to adopt forward secrecy for some time, but did not get much support for the project until the Snowden leaks.
That showed “there really were organizations out there in the world that were scooping up encrypted data just so they could try to attack it at a large scale,” said Jeff Hodges, another Twitter software engineer. “We were like, oh, we need to actually spend some more time and really do this right.”
Actually installing and turning on the technology took only a few months, once Twitter decided to do it, both men said in an interview. That was in part because Google, an early pioneer in the technology, had worked out many of the kinks in Perfect Forward Secrecy and shared its knowledge with the security community.
Perfect Forward Secrecy does add a slight delay to a user’s initial connection to Twitter — about 150 milliseconds in the United States and up to a second in countries like Brazil that are farther away from Twitter’s servers. But the company said the extra protection was worth the delay.
Twitter said it turned on Perfect Forward Secrecy on Oct. 21, although it refrained from publicizing the change immediately to make sure there were no problems.
Twitter said it hoped that its example would prompt other companies to adopt the technology.
“A lot of services that don’t think they need it actually do,” Mr. Hodges said.