NSA Revises Guidance on Teleworking Services for Government Users

The National Security Agency updated guidance to help federal agencies choose secure collaboration services, changing its determination of whether a number of products offered end-to-end encryption and other security features. 

Changes to the NSA’s guidance, along with comments from some of the vendors, highlight the big-picture political fight over end-to-end encryption and an enduring disconnect among various government officials, industry representatives and privacy advocates on what the term means.

NSA examined the policies of 15 companies in the June 4 version of its guidance, including Zoom, Microsoft Teams, Google G Suite, Slack, Skype for Business and Wickr, all of which NSA changed its designations for regarding factors such as whether the service offered certain kinds of encryption, or allowed users to control invitations to virtual meetings.

Microsoft Teams, for example, is noted as generally offering end-to-end encryption in the new guidance when the April 24 version of the document concluded the collaboration service generally doesn’t do this.     

Neal Ziring, technical director for NSA’s cybersecurity directorate, said the change to Microsoft Teams’ designation was “based on further review of public vendor documentation.”

“NSA cybersecurity publications include a feedback email address, we welcome input from industry and government readers,” he said in a statement provided to Nextgov. 

As the coronavirus pandemic forced government employees to choose conferencing services to enable remote work, the NSA listed nine decision-making criteria against five functions—text chat, voice conferencing, video conferencing, file sharing, and screen sharing—for prioritizing security.

Here are the criteria NSA recommended considering:

1. Does the service implement end-to-end encryption?
2.  Are strong, well-known, testable encryption standards used? 
3. Is multi-factor authentication used to validate users’ identities? 
4. Can users see and control who connects to collaboration sessions? 
5. Does the service privacy policy allow the vendor to share data with third parties or affiliates? 
6. Do users have the ability to securely delete data from the service and its repositories as needed? 
7. Has the collaboration service’s source code been shared publicly (e.g. open source)?
8. Has the service and/or app been reviewed or certified for use by a security-focused nationally recognized or government body? 
9. Is the service developed and/or hosted under the jurisdiction of a government with laws that could jeopardize U.S. government official use?

The NSA labeled each service with a “Y” for yes or “N” for no regarding their delivery of the criteria. Some of the services given a Y for end-to-end encryption, including Zoom, had a footnote attached, indicating this was “partial.” 

Ziring said “partial end-to-end encryption means one or more of the five listed functionality types does not fall within the service’s end-to-end encryption.” 

Voice conferencing was considered as a functionality for Microsoft in the updated guidance but not in the old version of the document.

Zooming Past Definitions 

Consideration of how these services stack up in terms of security is a lot more complicated in the NSA guidance document than it is in the public discourse. 

At the Defense One Tech summit Thursday, Anne Neuberger, head of NSA’s cybersecurity directorate highlighted the agency’s guidance on telework services in discussing how COVID-19 has changed the cyber landscape. 

“Ideally, security, when it works, is invisible to the user. I'm connected to Zoom who is end-to-end encrypted, that makes a difference,” she said, citing the NSA’s top criteria for choosing a secure service. 

While the NSA guidance ranks Zoom and Microsoft Teams as generally offering end-to-end encryption, privacy and civil liberty advocates and other technology organizations, including the Mozilla Foundation, lambasted Zoom CEO Eric Yuan for his intention to only make end-to-end encryption available for paying customers.

Following the backlash, Zoom announced on Wednesday that it would work to make end-to-end encryption available to all users.

“End-to-end encryption means that content (text, voice, video, data, etc.) is encrypted all the way from sender to recipient(s) without being intelligible to servers or other services along the way. Only the originator of the message and the intended recipients should be able to see the unencrypted content,” according to the NSA document.

For staunch advocates of end-to-end encryption, including major tech companies like Apple and Facebook, this means even the service providers themselves should not have access to keys that could decrypt the data in their servers. 

This is at the heart of disputes between the tech companies and law enforcement officials who want to be granted access to devices and communications to aid criminal investigations. 

Yuan had said maintaining the ability to cooperate with law enforcement is the reason Zoom was disinclined to make end-to-end encryption freely available.

Privacy advocates who fear the surveillance of marginalized groups say communications are either end-to-end encrypted or they’re not. But the NSA guidance tries to walk a fine line by saying “strong end-to-end encryption is dependent on [decryption] keys being distributed carefully.”

In a blog post about the privacy and security of Microsoft Teams, Jared Spataro, corporate vice president for Microsoft 365, avoids the term end-to-end encryption.

He notes data is encrypted in transit between users’ devices and Microsoft data centers, and also while at rest in those data centers, but “in a way that allows organizations to decrypt content if needed, to meet their security and compliance obligations, such as eDiscovery.”

There was only one change in the text, outside of a table of designations, of the NSA’s guidance document. 

Where the old version said “some services such as large-scale group video chat are not designed with end-to-end encryption for performance reasons,” the new version says “some use cases may not be able to use end-to-end encryption for performance reasons, capability limitations, or compliance requirements.”