In a call with news outlets this week, the FBI revealed that a state sponsored cyber attack on telecom companies like AT&T and Verizon is still ongoing: The bad guys are still in these networks, with access to millions of customers’ private phone data, and officials say it’s “impossible to predict a time frame on when we’ll have full eviction.”
The FBI and CISA indicated that the attack, dubbed “Salt Typhoon,” is worse and more pervasive than we all thought, and they urged Americans not to trust their sensitive information to telecom companies like AT&T and Verizon’s networks, and to use encryption to prevent their communications from being intercepted by China.
End-to-End Encryption Keeps Your Information Private
“Our suggestion is not new: Encryption is your friend,” said Jeff Greene, executive assistant director for cybersecurity at the Cybersecurity and Infrastructure Security Agency. Whether it’s a phone call, text message, or email, using encrypted communication ensures that even if an adversary intercepts the data, it remains unreadable because encryption converts the information into ciphertext, rendering it inaccessible without the proper decryption key.
Note: There’s an important distinction to make between end-to-end encryption and TLS (transport-layer security) encryption. Unlike TLS encryption, which protects data only in transit, end-to-end encryption covers the full lifecycle of the data, across the various system handoffs it encounters on its journey. If you're evaluating these two encryption methods, end-to-end encryption is stronger.
CALEA Demonstrates the Danger of Backdoors
End-to-end encryption is especially vital considering that major telecom companies are beholden to CALEA, the Communications Assistance for Law Enforcement Act, which mandates backdoors in critical infrastructure so that law enforcement can gain access to phone records and metadata when authorized as part of criminal investigations. The problem with backdoors is that they inherently create vulnerabilities that can be exploited — and the FBI has confirmed that the system that facilitates CALEA was part of this attack, along with customers’ phone data as well as live phone calls by certain targets.
“Proponents of backdoors often frame the debate as a choice between security and privacy,” Virtru CEO John Ackerly wrote. “But as this telecom hack demonstrates, it's a false dichotomy. A system vulnerable to lawful interception is also vulnerable to unlawful intrusion.”
In a letter to the U.S. Attorney General and FCC Chair after the Salt Typhoon hack was first revealed, Oregon Senator Ron Wyden highlighted the lack of accountability when it comes to protecting CALEA data, referring to “non-existent secure backdoors” that can put citizens’ private information in jeopardy. “The recently reported hack of U.S. telecommunications companies’ wiretapping systems should serve as a major wake-up call to the government,” he said, citing longstanding concerns with the backdoors mandated by CALEA — and the lack of “mandatory security standards for these highly sensitive systems, which has reportedly resulted in serious harm to national security.”
Use Virtru to Encrypt the Information You Share
Whether it’s an email or a file, a video or a voice memo — Virtru provides end-to-end encryption, paired with granular access controls that follow your data everywhere it moves. Virtru puts the data owner in control at all times, including the ability to revoke or change access permissions whenever you choose to do so.
Our portfolio of data security products offers integrations with the tools you already use every day — including Gmail, Google Drive, and Microsoft Outlook — to protect the sensitive information you need to share with others — making sure it’s protected and under your control across its full lifecycle, in transit and at rest.
Ready to follow the FBI and CISA’s recommendation to encrypt the sensitive information you share? Contact our team today for a demo. We’d love to discuss how Virtru can help you maintain control over your data.
