There’s No Such Thing as ‘NSA-Proof’ Encryption

The world's largest Internet companies and thousands of average Internet users are trying to hide their private information from government snooping.

The goal is to set up technological barriers to the National Security Agency's sweeping surveillance programs. Rather than waiting for Congress to rein in the agency, many people want to take privacy into their own hands.

But the truth is, efforts to improve online encryption and security can't totally thwart the NSA.

Joseph Lorenzo Hall, the chief technologist for the Center for Democracy and Technology, said the idea of becoming "NSA-proof" is "just silly."

"If they want it, they can get it," he said of the NSA's expert spies. The agency can hack or bypass many security measures if it is determined enough, Hall said.

And it doesn't matter how heavily encrypted an email is in transit if the NSA just forces the email provider to turn the message over. While the NSA collects some of its data by surreptitiously tapping into communications, much of the surveillance is done through court orders to Internet and phone companies.

Christopher Soghoian, the principal technologist for the American Civil Liberties Union, said tech companies such as Google could hamstring the NSA if they just stopped collecting so much information about their users. If a company doesn't have information on a person, there's nothing to turn over to the government.

Of course, that's not likely to happen any time soon. Google and other companies depend on collecting detailed data about their users for targeted advertising.

"At the end of the day, you can only expect so much from an advertising company," Soghoian said. "Until we start paying for these services, they're only going to go so far."

While it's impossible to totally escape the NSA, making the agency's job harder could be enough to avoid the dragnet surveillance. Government analysts aren't likely to invest the time and resources to crack encrypted messages unless they really think there could be a connection to terrorism.

Hall recommended that people use a browser plug-in such as HTTPS Everywhere, which ensures that users have a secure online connection when possible. He added that it's particularly difficult for the NSA to track the online activity of people using Tor, a software that reroutes traffic to hide its source.

Major tech companies were shocked to learn last year that the NSA was tapping into the connections between their overseas data centers and siphoning off data. In the wake of the leaks, Google, Microsoft, Yahoo, and Facebook have all taken steps to encrypt their data-center connections.

Google has always tried to encrypt its emails in transit, but that's only effective if both the sender and the receiver support encryption. Recently, Google has started to publish statistics about which providers support encryption in a bid to pressure more companies to step up their security.

Emails that are encrypted in transit aren't as secure as ones that have total end-to-end encryption. Even Google can't read the contents of emails that are totally encrypted. But end-to-end encryption tools such as PGP are complicated and inconvenient to use. Google will soon launch its own end-to-end encryption extension to try to make the process simpler, but the option will still be realistic only for the most dedicated privacy advocates.

According to Soghoian, the No. 1 thing people can do to better protect their privacy is to refrain from using phones for any sensitive conversations.

"Telephone communications are just not secure," he said, adding that people are better off relying on Internet voice services such as Skype and FaceTime. He also warned that stored communications like email are risky because the NSA can go back and get messages even years after they're sent.

Hall recommended that people leave their phones at home or wrap them in aluminum foil when they're not using them. He acknowledged that before the Snowden leaks, recommending that people wrap their phones in foil would have sounded crazy.

"The NSA is giving the tinfoil-hat brigade a run for its money today," he said.

(Image by TACStock1 via Shutterstock)