Encryption expert says Sony Pictures hack shows why companies should value privacy as well as security, too, and is unimpressed by David Cameron’s encryption stance

The recent hack against Sony Pictures is likely to have made companies of all sizes consider upping their cybersecurity measures. Perhaps, though, it’s also a different kind of wake-up call: a reason to think less about security, and more about privacy.

That’s the belief of Phil Zimmermann – the creator of email encryption software Pretty Good Privacy (PGP), and now president and co-founder of secure communications company Silent Circle – initially expressed in a blog post, and expanded on in an interview with the Guardian.

“Sony had all kinds of things: intrusion detection, firewalls, antivirus … But they got hacked anyway. The security measures that enterprises do frequently get breached. People break in anyway: they overcome them,” says Zimmermann.

“A lot of this stuff could have been encrypted. If those emails had been encrypted with PGP or GnuPG, the hackers wouldn’t have gotten very far. Those movie scripts that they stole? They could have been encrypted too.”



Tech pioneer Phil Zimmerman calls Cameron's anti-encryption plans 'absurd' Read more

Zimmermann hopes that companies will look at what happened to Sony, and use it as a spur to explore encryption as a way to protect their employees’ privacy, rather than ramping up their spending on security measures to protect their data.

“People don’t think of privacy much when they think about enterprises, but enterprise privacy is a real thing: it’s the collective privacy of everybody in the company, and the privacy of the company assets as well,” he says.

“In Sony’s case, there were emails about Hollywood actresses that got breached. That’s connected with personal privacy. I think companies retain too much information.”

If more businesses shift their thinking from security to privacy, it’ll be good news for Silent Circle, which offers technology for encrypted voice calls, video chat and messaging, as well as being a key part of the privacy-focused Blackphone smartphone.

According to Zimmermann, this kind of technology still often makes its way into a business through individual employees and spreads through word of mouth, rather than being a strategic decision by the company to deploy it.

“Lately, we’ve been trying to do things that are lightweight, and don’t involve such a heavy commitment from the IT department. It’s not an infrastructure thing, it’s an agile personal initiative,” he says.



Facebook Twitter Pinterest The Blackphone often makes its way into companies through individual employees. Photograph: Manuel Blondeau/Manuel Blondeau/Corbis

Zimmermann adds that press coverage of the mass-surveillance revelations prompted by NSA whistleblower Edward Snowden has had an impact on the number of companies exploring strong encryption technology.

“Everybody’s heard of this. Your newspaper’s published a lot of stuff on this. It contributes to a herd immunity,” he says. “The press is kind of like a vaccination program: it helps build herd immunity with its coverage of these things.”

He may have created PGP, which is still the best-known software for email encryption, but Zimmermann says the favourite technology that he has worked on is secure Voice-over-IP (VoIP) for encrypted voice calls.

“It’s more fun than secure emails. It’s more human, more organic. You talk to someone! It’s what we evolved to do, for thousands of years: we talk with our voices, and we can get the nuance of people’s meaning,” he says.

“To be able to protect that and have end-to-end, secure communication is something I’ve been working on for a decade now.”

Zimmermann is a firm defender of strong encryption technology, suggesting that it’s one of the relatively few bona-fide success stories in the online security world.

“If you look at all the things that have been developed – firewalls, intrusion detection systems, all these things put in place to protect computers? They haven’t really hit a home run: they keep getting breached,” he says.



“But if you look at the Snowden material, the one thing that does seem to do well is strong encryption. Of all the things you see getting broken into, it’s conspicuously absent from that list.”

(As the Guardian interviewed Zimmermann, news emerged of a vulnerability in the Silent Text messaging app bundled with the Blackphone. Silent Circle patched it and expressed its “respect and gratitude” to the researcher that uncovered it.)

Not everyone is joyful about the growth in use of strong encryption, though: from GCHQ boss Robert Hannigan suggesting that freely available encryption technology has been a boon for modern terrorist groups like Islamic State, to comments by prime minister David Cameron mooting legislation to not “allow” such technology to be used in the UK.

The latter has sparked a heated debate about the wisdom of such legislation, not to mention whether it is even possible to ban the use of end-to-end encryption in messages. Unsurprisingly, Zimmermann is unimpressed with the notion too.

“It’s absurd. We fought the crypto wars in the 1990s, and that matter has been settled. End-to-end encryption is everywhere now: in browsers, online banking. If you have strong encryption between your web browser and your bank, you can’t have a man in the middle from the government wiretapping that,” he says.



Facebook Twitter Pinterest Recent comments by David Cameron were interpreted as a desire to ban end-to-end encryption’s use for messaging. Photograph: Christopher Thomond for The Guardian./Christopher Thomond

“In the 90s, if you were using strong encryption, you’d have to defend yourself and justify what you were doing: ‘What, are you a terrorist or a drug dealer?’ Now, if you aren’t using strong encryption, you have to justify it.

“You’re a doctor? Whaddya mean you’re not encrypting your patient records? Or you left your company laptop in a taxi with 2,000 customer names on it? You better hope that data is encrypted, or you’re in trouble.”

Zimmermann claims that in the UK, the laws around disclosing security breaches are more stringent than in the US, meaning that if a company loses data as the result of an intrusion, not only does it face “the public humiliation of telling everyone”, but there are civil and criminal liabilities too.

“Encryption is your way of avoiding that: the legislative environment requires it. David Cameron can’t reverse that. And it’s also too entrenched in the world economy,” he says.

Zimmermann also gives short shrift to the arguments put forward by surveillance agencies that strong encryption technology is making their terrorism-fighting jobs much more difficult.

“The intelligence agencies are living in a golden age of surveillance. They’ve never had it so good! Their life is so cushy now compared to a couple of decades ago. They now have total information,” he says.

“They can see everything: they’ve got face recognition algorithms looking through cameras on the streets, optical recognition cameras at bridges, tunnels and traffic lights. They can track movements, transactions, who’s having lunch with who, who’s sleeping with who. They can see everything!

“To complain that end-to-end encryption is crippling them? It’s like having a couple of missing pixels in a large display. They have the rest of the display! They’ve never had it so good. They didn’t have this stuff 20 years ago.”

Zimmermann suggests that if the underlying problem that governments and national security agencies are trying to solve is religious extremism, “there are other ways to get what they want” – hinting that tough talk on encryption is distracting attention from the real issues.

He remembers hearing politicians worrying about encryption before, about 10 years ago, when he travelled to Bogota in Colombia to speak at a conference, and to address MPs about proposed legislation to allow banks to use strong encryption online for the first time.

“They weren’t allowed to use strong encryption. Not even banks! And the banks were getting robbed by hackers – bank accounts were getting cleaned out – because people like David Cameron who don’t like encryption said nobody could use it,” he says. “The bank robbers loved this!”

What happened next? “I don’t know. I assume they must have come to their senses,” says Zimmermann. He’s hoping for a similar shift in attitudes on digital privacy from other governments and companies alike in 2015.

• Secret US cybersecurity report: encryption vital to protect private data



• Lavabit founder condemns Cameron’s ‘insane’ plan to ban encryption

