Indian Government To Ban Use of US Email Services For Official Communications 219
hypnosec writes "The Government of India is planning to ban the use of U.S.-based email services like Gmail for official communications. It will soon send out a formal notification to it half-million officials across the country, asking them to use official email addresses and services provided by India's National Informatics Center. The move is intended to increase the security of confidential government data and protect it from overseas surveillance."
Not seeing a problem with that. (Score:5, Insightful)
Re:Not seeing a problem with that. (Score:5, Insightful)
What's the point? It's not like you can control which packets will and won't be routed through the US.
What they ought to be requiring is encryption, but we all know that's not going to happen.
Re: (Score:3)
Packet Sniffing is more of a cheap parlor trick then a good way to collect information.
For the most part our infrastructure has moved from Hubs to Switches so there are a lot less free packets bouncing around the net. Routers have gotten smarter and better so chances are it won't bother sending your packet around the world just just to go to your neighbors.
Re: (Score:3)
Packet Sniffing is more of a cheap parlor trick then a good way to collect information.
For the most part our infrastructure has moved from Hubs to Switches so there are a lot less free packets bouncing around the net. Routers have gotten smarter and better so chances are it won't bother sending your packet around the world just just to go to your neighbors.
Route poisoning would like to have a word with you. He is waiting in Room 641A.
Re: (Score:2)
Route poisoning would like to have a word with you. He is waiting in Room 641A.
Are you sure?
Re: (Score:2)
Re: (Score:2)
It's most likely going to hit a backbone that the US has control over at some point.
Re: (Score:3)
and?
It's perfectly possible to send E-Mail using SSL between servers. Google even prefers to do this. Use an HTTPS site as an E-Mail portal, and it won't matter if the communication is going through the US.
Unless the NSA has a copy of the site's key or has broken SSL crypto, they can log all the trafic they want. With perfect forward secrecy they can get the key latter, and still not know what's being said.
Note: I'm simplifying how SSL works for the sake of convenience.
If the key signing authorities are compromised (Score:3)
Doesnt that pretty much defeat SSL? And what on earth would make you believe that they weren't compromised.
Re: (Score:3)
Doesnt that pretty much defeat SSL? And what on earth would make you believe that they weren't compromised.
I can create an uncompromised cert authority in the next 5 min on my laptop, and it would be effective for exchanging communication between us, if you choose to trust it.
And this should be enough as long as the emails are not stored in plain text on servers controlled by US companies. Which seems to me exactly what this ban is about, isn't it?
And does the client cache this key? (Score:2)
Great, they key is signed and you agree to trust it. Then somebody steps into the middle on the next connection attempt and hands you a new key. Signed by a trusted authority that has been compromised. Does your client check the manually accepted keys before the CA signed keys? Does it do a redundancy check? Or does it just merrily proceed and let you give the MITM your password.
I really dont think the client is checking to see if the key changes. And that would be a very bad thing.
Re: (Score:3)
The problem with this approach is that the other person has to stop accepting all other certificate authorities -- otherwise a man-in-the middle attack can be used if any of those certificate authorities can be abused by a government agency.
Ah, you said CA instead of self signed key (Score:2)
Sorry about my poor reading skills. I dont know enough about a new CA to be able to tell if this would work.
Re: (Score:3)
Um, no. If it's an American owned company (anywhere in the world), or a US based server .. the NSA can walk in and demand the key and the decrypted content.
The only way to (try to) keep data out of the hands of the NSA is to not have it in the hands of a US controlled company, and not on US soil.
Google, Microsoft, Yahoo, Facebook ... every single one of them is covered under the Patriot Act. And an
Re:Not seeing a problem with that. (Score:4, Informative)
I think the point is that if the source and destination endpoints are not under US control, and the communication channel between them is secure, then the NSA can watch the encrypted traffic flow through US-controlled nodes all they want without getting much information beyond mail server A transferred X bytes of data to mail server B.
Re: (Score:3)
Precisely. The other thing is "perfect forward secrecy." It's not perfect, but what it means is the key used to encrypt the traffic is randomly generated. Man in the middle attacks are still an issue, especially if people are dumb enough to use as US based cert authority, but the NSA can never decrypt the traffic after the fact. That still relies on the protocol being secure, and given the amount of money and talent the NSA is throwing at breaking it.... Well, there's a reason why even the US government
Re:Not seeing a problem with that. (Score:5, Informative)
NICNET (http://www.nic.in) has long been used in India for government mails and official data. You literally have dedicated VSAT connections etc. to it in offices, and it is a separate network in itself.
The Indian army too for obvious reasons, just like its counterparts everywhere, maintains its own nationwide network, and does not allows internet connections to it.
All they are asking is, that officials use these network, which are NOT public, instead of allowing the data to pass over any backbone that US has control over. And thus no classified data is expected to ever hit any backbone that is in US control.
Re: (Score:2)
BGP protocol takes care of this by design by finding the shortest routes for data to travel. Encryption is still a good idea for all the other reasons BGP doesn't address, but India is on the right track here in regards to what they're trying to accomplish.
Re:Not seeing a problem with that. (Score:5, Interesting)
Nobody should use email for official anything.
Benjamin Franklin was right. It's the Post Office. I mean, does any email provider say they will deliver through rain, sleet, snow or hail? Do you see that on anybody's TOS? Given the uncertainties of the climate these days, you'd be a fool to do it any other way.
Besides, it will slow the government down. That's always a plus.
Re:Not seeing a problem with that. (Score:5, Insightful)
Re: (Score:2)
Woops. Sorry. The sarcasm / humor tag failed again. Typical Slashdot crap code.
Re: (Score:2)
Can they really get any slower?
Re: (Score:2)
That's obviously what this is about. Snowden. The government wants the whole team to realize that if there's so
Re:Not seeing a problem with that. (Score:5, Informative)
Re:Not seeing a problem with that. (Score:5, Insightful)
And besides, if you're doing nefarious activities, you can avoid subpenas when you appear in front of Congress ... right Lois Learner?
Re:Not seeing a problem with that. (Score:5, Insightful)
Ironic, since the NSA considers GMail to be public property and not private communication as well.
Re: (Score:2)
Frankly, I dont think the US should use gMail etc for governmental communications either.
I whole-heartedly agree. Alas, I believe the US Gov't is being too lenient with their communications practices; unlike the 90's where only encrypted BlackBerrys were allowed, today everybody can use their Hotmail, Gmail, or Aol account to conduct official government business.
Instead, they should endorse Lavabit-type services and setup an outbound email transport for any public-private business... not go fully commercial without proper senses of security in place.
Re: (Score:2)
Frankly, I dont think the US should use gMail etc for governmental communications either.
The problem I see is that it wasn't discouraged and/or banned earlier. Of COURSE an entity in a different country, with no stated or even implied interest in privacy, is not a good place to conduct your nation's business. Duh! The revelations about Google (and others') cozyness with the NSA should not have been the tipping point.
Re: (Score:2)
Frankly, I dont think the US should use gMail etc for governmental communications either.
Correct. Google might outsource the Gmail service to India.
how many recipients are on gmail? (Score:2)
Re: (Score:2)
Re: (Score:2, Informative)
What contracts? The government of India already provides email addresses to their employees. They're saying "Hey, stupid employee, use this email, don't go off making a Gmail account for official business!"
Re: (Score:2)
Re: (Score:2)
Interesting Headline (Score:2)
Interesting headline given the level of corruption in the Indian Government. Given that, the headline makes sense. More secrets to keep.
Re: (Score:2)
Re:Interesting Headline (Score:5, Insightful)
So if you want to hide something you must be guilty?
If you are a government official in a democratic country, and you are trying to hide your official activities, then yes, it is a reasonable assumption that you are corrupt. With very few exceptions, government business should be conducted in public and transparently.
Re: (Score:2)
Re: (Score:2)
Also interesting is that India stopped telegram service only about 45 days ago.
Indian govt is just jealous (Score:3)
Re: (Score:2)
That was my first thought too. It's a double win for the Indian government. They reduce the opportunity of the US spying on their communications while at the same time increase their opportunity.
Re: (Score:2)
Re: (Score:2)
i think they are just the first one to voice their jealousy...
Re: (Score:2)
That they can't be the ones spying. Corrupt govt hating on another corrupt govt.
It's hardly hating. Given the circumstances, this will likely become the norm for all governments and quite likely businesses that don't feel like being spied on. I'd like to think this is a wake up call for all those people that want to throw their data into the cloud without giving it a second thought, but it looks like for the most part nobody cares. And apparently, anyone who does care and takes a pro-active approach will be labelled as a hater.
Re: (Score:2)
Re: (Score:2)
a good idea. (Score:2)
it seems like a prudent move on behalf of the indian government considering the NSA has all but said they were spying on other governments. though there is the question of what system the indian government will switch to and if it gets hacked by other governments. realistically, they should be using encryption on 100% of their emails.
Re: (Score:2)
Since NSA's job is to spy on other governments, I'm not sure why they needed to "all but say they were spying on other governments".
It should be a given - "Our job is to spy on other governments. We do our job."
Protect from international surveillance (Score:3)
Smoke screen (Score:4, Insightful)
Its not to 'protect the data' it's to get people to use services that they have direct access too.
Every government does this.
Missing the point (Score:5, Insightful)
Re: (Score:2)
thats the best way to make the point really. start hurting some wallets, and you'll see change a lot faster.
Re: (Score:3)
It is an unfortunate truth that our government is more responsive to the desires and needs of our corporations than it is to the rights of our citizens.
Re: (Score:3)
That's because corporations are now effectively 'citizens', and they contribute more to campaigns.
So their wishes matter more.
Re: (Score:2)
USA's authoritarian, Orwellian stance is hurting American companies' ability to compete in the global market, domestic and international. It hurts the American economy.
I'm not sure who the subject of 'missing the point' is here, so I can't address that, but yeah - I suspect India knows that by doing this, they may spur some competitive enterprises in India to fill the gap. I'm all for world trade and such, but for Pete^W Lakshmi's sake, India's own government should be patronizing its businesses, not forei
Re: (Score:2)
OK, so which couintry exactly would YOU trust to host your data and no spy on it.
FFS, all goverments should have official email only on goverment controled system. That is not 100% safe, but why make it easier than you have to?
Re:Missing the point (Score:4, Insightful)
If you are a government, YOU are the only ones you can trust to host your data.
If you are a company, YOU are the only ones you can trust to host your data.
Having another company or country host your data was NEVER a good idea, and some of us have been saying so for some time. But all of a sudden people are realizing just how bad of an idea that was, and they're pulling back from it.
Re: (Score:2)
That seems a bit extreme to assume all companies need to go that far. If I opened a small hardware shop on the corner of the street, and wanted to have an email address, do I hire a whole IT department to set up an email address for me?
Re: (Score:3)
You don't have to. But if you have someone else set it up for you and host it, you don't control it.
If you're willing to say "I don't care", then have at it and do it however you like.
If you decide that on principle, or because you have some specific need, that you aren't willing to have this ... then the only secure way is to host it your own
Re: (Score:2)
Re: (Score:2)
USA's authoritarian, Orwellian stance is hurting American companies' ability to compete in the global market, domestic and international. It hurts the American economy.
Yes, but... albeit hurt, doesn't the economy feel safe now?
Re: (Score:2)
Do you speak English? (Score:2)
If you're still speaking English, I can assure you that the intelligence and military complex are doing their job adequately.
And the backlash cometh (Score:3, Interesting)
Re: (Score:2)
I am looking for the same thing - but, in the meantime, I've already moved my personal mail off Gmail. While the ideal scenario is to have no one sniffing around in my email; since at the moment I can't do much about the government, I can at least keep Google out of it.
Traitorous NSA (Score:5, Insightful)
Here we see the beginnings of real, hard evidence of just how disastrous the NSA's recent actions are to the best interests of the country.
It used to be that American IT companies were the gold standard, to the point that there almost wasn't even any pretense of competition. Google, IBM, Microsoft, Apple, Facebook -- American companies ruled the Internet.
And the NSA has turned that all to shit. Now, you'd have to be an idiot to trust any American company not to hand your data over to the NSA. And the NSA has most emphatically been demonstrated that it cannot, under any circumstances, be trusted with that data; just look at not only the overt corporate espionage, but the pervy stalking culture of the degenerates working there. Even if not for official policy directives, you can bet that some low-level flunky at the NSA will be placing insider trades based on what he reads in your executive's emails.
In other words, the NSA has utterly devastated the greatest industry the United States has ever created, and the very backbone of our economy. It's worse than if they had bombed all our ball bearing plants; infrastructure can be rebuilt, but trust? How the fuck are we supposed to rebuild that? ...and the corporate heads and legal departments wonder why they shouldn't have refused to play with the NSA and gone public at the first hint of this malfeasance, writs of classification be damned. Had Google insisted it be taken down swinging rather than play lapdog to the NSA, their brand would have been unimpeachable; rather, it is untouchable.
Cheers,
b&
Re:Traitorous NSA (Score:4, Insightful)
Here we see the beginnings of real, hard evidence of just how disastrous the NSA's recent actions are to the best interests of the country.
It used to be that American IT companies were the gold standard, to the point that there almost wasn't even any pretense of competition. Google, IBM, Microsoft, Apple, Facebook -- American companies ruled the Internet.
And the NSA has turned that all to shit. Now, you'd have to be an idiot to trust any American company not to hand your data over to the NSA. And the NSA has most emphatically been demonstrated that it cannot, under any circumstances, be trusted with that data; just look at not only the overt corporate espionage, but the pervy stalking culture of the degenerates working there. Even if not for official policy directives, you can bet that some low-level flunky at the NSA will be placing insider trades based on what he reads in your executive's emails.
In other words, the NSA has utterly devastated the greatest industry the United States has ever created, and the very backbone of our economy. It's worse than if they had bombed all our ball bearing plants; infrastructure can be rebuilt, but trust? How the fuck are we supposed to rebuild that? ...and the corporate heads and legal departments wonder why they shouldn't have refused to play with the NSA and gone public at the first hint of this malfeasance, writs of classification be damned. Had Google insisted it be taken down swinging rather than play lapdog to the NSA, their brand would have been unimpeachable; rather, it is untouchable.
Cheers,
b&
Exactly! Its not a done deal yet, but they are gutting a very significant industry. This is a very costly fuck up. It would be one thing if we knew the world was a *better* or safer place as a result, but I can't see how to draw that conclusion. Au contraire, they just spend a boatload of money, muddy the waters, and gut a vital industry. You can't believe anything the NSA says since being really good liars is a valued trade asset, and there is no real oversight.
Re: (Score:2)
So where exactly are you guaranteed to have your data left alone? China? Russia? Israel? France?
If it's that important, encrypt before it leaves your control. No matter what the terms of service say.
Re:Traitorous NSA (Score:5, Insightful)
Whilst I certainly wouldn't disagree with you over the importance of encryption...well, put it this way: when was the last time you encrypted a letter you dropped in the mailbox?
The point is that it's about as much hassle for somebody at the post office to steam-open an envelope with nobody being none the wiser for it as it is for an ISP to snoop on people's mail.
People have historically been just fine with sending the most private of letters protected by nothing more than the seal of the envelope because the United States Postal Service has a well-deserved unimpeachable reputation for being the hardest of hard-cases about protecting the sanctity of the mail.
It's not surprising that people carried that same trust over to email; it's an almost instinctual conclusion to assume the one is every bit like the other save for the mechanisms of delivery.
And, had they done it right, Google could have earned the world's trust by self-policing with the same vigilance the USPS does.
But they blew it.
Royally, and spectacularly, they blew it.
But what remains most troubling about it is that it was an official government agency that twisted their arm, even if Google shouldn't have put up with the arm-twisting.
Cheers,
b&
Re: (Score:2)
What if you tape an encrypted microSD card to the folded paper in the envelope?
Re: (Score:2)
Re: (Score:3)
Whilst I certainly wouldn't disagree with you over the importance of encryption...well, put it this way: when was the last time you encrypted a letter you dropped in the mailbox?
The point is that it's about as much hassle for somebody at the post office to steam-open an envelope with nobody being none the wiser for it as it is for an ISP to snoop on people's mail.
It is just as much hassle to open a letter passing through the post office by steaming it open as it is for a lawyer somewhere to subpoena and get the contents of an email you sent through gmail.
However, it is much easier for the NSA to use their backdoor into gmail to make an automated request for all of a person's emails and all of the emails of everyone that emailed them and store that information. Even if they decide that they don't need that information, it will still get stored, and that stored info
Bad news (Score:2)
You know why the NSA has gone to wiretapping US communications? Because they're done tapping into all of the international communications.
Re: (Score:2)
Here we see the beginnings of real, hard evidence of just how disastrous the NSA's recent actions are to the best interests of the country.
Sorry, but this is all Snowden's fault. If it hadn't been for him everything would still be working as designed and no one would be (provably anyway) the wiser.
"A wrong is right if not known"? Like: the wife-cheater is not to blame for the divorce, the snitch is?
If that's what you say, you may continue to be sorry.
As if that makes a difference. (Score:3)
The NSA has a lot fewer legal problems intercepting foreign mail than
it does domestic.
Only now, it simply means they wont have good spam filters,
and money will now be flowing out of india to nigeria $26,000,000 at a time.
Re: (Score:2)
That's true. While the US is getting a ton of flac from every direction, those of us in the US are primarily worried about domestic spying. Anything outside the US is their jurisdiction by law. On the other hand, there are valid reasons for India to do what they are doing.
The two things India is trying to do are send a message and secure their communications. The message part is pretty obvious, but the security part is still there. They know that the NSA has access to Gmail. Anything home grown might
Re: (Score:2)
Indian Central Monitoring System (Score:5, Informative)
Of course India is setting up the Central Monitoring System (CMS) [medianama.com] essentially India's version of PRISM:
Re: (Score:2)
Re: (Score:2)
Nobody should be surprised ... (Score:2)
The reality is, I expect to see more governments doing this.
With the Patriot Act and all of the revelations about the NSA spying, American companies are not things you can trust. All of the cloud services ran by US companies are covered by the same thing.
I've said it before, but when you turn your corporations into arms of your security apparatus, those corporations cease to be trustworthy.
So in a few months when US companies start feeling the pinch as people do stuff like this, when they start whining abo
Re: (Score:2)
The problem becomes when you have a nation like China that is spying on everybody but working fervishly to block all others.
Re: (Score:2)
Sure they do, but if a government sets themselves up using a US owned/based service, they're inviting them in the front door.
Knowing the other countries are doing it doesn't mean you bring in someone who you know is under the sway of the people spying on you.
What, you mean like the US is?
It wasn't all that long ago the US was trying to ch
it all depends on who's spying department (Score:2)
most tin-star sheriffs don't want anybody else doing their snooping. lot of that going on in the InterClouds these days.
Actually, pretty stupid (Score:2)
Instead of worrying about the routing, they should be pushing for all clients to encrypt the contents (not web-based either). Worse, they should be getting off windows and Macs, and moving to Open Source such as Linux and BSD. In addition, the hardware should be produced in their own nations with Logic chips from their nation or the west, instead of China. The bios should be openbios on flash ram that was produced local.
But focusing on the server shows how p
Email sucks ass (Score:3)
Of all the inherently useless and broken protocols in use today SMTP email takes the cake.
Anyone can impersonate anyone else with impunity. Phishing and PC zombification via Email is boundless.
Anyone can send you whatever useless garbage they want without your consent.
No useful security of any kind.
Inability to transmit large content and no way to facilitate realtime communication.
Message delivery is a crapshoot thanks to hapazard proliferation of automated filters with minds of their owns.
The failure of SMTP on all levels and massive operational costs it has incurred for administrators and users is mind boggling.
Re: (Score:2)
Figure it out, this goes way beyond Obama.
Re: (Score:2)
Yeah, this is true. However, if this exposure happened under GWB, he would be crucified. Quit given Obama a pass. Treat him exactly as you would have treated GWB.
Re: (Score:3)
Actually no, GWB would only have been attacked by the Left for the most part, the Right mostly would have defended GWB for doing what was needed to protect our country. The response from the pro defense politicians is decidedly mute, they are simply choosing not to defend he President, at least not very much.
These intrusions by the NSA are a lot like things that have been going on all along (note I did not say it was good). Basically the opportunity for progress on this issue is precisely because Obama is
Re: (Score:2)
Actually no, GWB would only have been attacked by the Left for the most part
Like, you know, almost the entire mass media.
he Left is naturally suspicious of police and spying
Tell that to the Stasi.
The left are only suspicious of police and spies they don't control. They love police and spies who can be used against their opponents.
Re: (Score:2)
Re: (Score:2)
Re:Makes sense to me.... FTFY (Score:4, Insightful)
This seems total sensible, after all if you let a foreign entity. on the cloud, run your email you don't really own the data and any data that you don't own is at risk. The real surprise is that it took the business world this long to realize.
Re: (Score:2)
I disagree, in the US Copyright is automatic and thus you do own the data, any unauthorized use by the ISP's should open them up for civil damages based on unlicensed use of copyrighted material.
Re: (Score:2)
great Indian gov't is worried falsely US ISP's would never share data with anyone and all the hops going through other countries are just as safe as in US... o wait.
Re: (Score:2)
Since we have to live with what was once a great nation now fallen in corruption, at least we should have some fun with it.
The old meme "in soviet union" is becoming obsolete. I suggest we start a new meme: "in nazi america".
And remember now, "war is peace".
Re: (Score:2)
"NSA America" or "fascist [wikipedia.org] America" would be better. Some people get justifiably offended when one throws around causal references to the Nazis. It desensitizes people to the Holocaust and their mass murders of Roma, Slavs, homosexuals, etc.
The Nazis were a special breed, much worse than anything that exists in our privileged world today, except perhaps in Syria and a few other places [wikipedia.org]. To compare modern states to theirs is disingenuous.
Re: (Score:2)
However, there is no doubt that America IS controlled by businesses and wealthy, which really is as close to fascism as it comes.
Re: (Score:2)
Re: (Score:2)