ISIS encrypted communications with Paris attackers, French officials say | Ars Technica

A profile image from a Telegraph-encrypted social media channel called "Be a Lone Wolf" has the caption, "Lone Wolves: Soon [Will Be] My Turn."

The investigation into last Friday's coordinated terrorist attacks has quickly turned up evidence that members of the Islamic State (ISIS) communicated with the attackers from Syria using encrypted communications, according to French officials.

Former CIA Deputy Director Michael Morell said in an interview on CBS' Face the Nation on Sunday, "I think what we're going to learn is that these guys are communicating via these encrypted apps, this commercial encryption which is very difficult or nearly impossible for governments to break, and the producers of which don't produce the keys necessary for law enforcement to read the encrypted messages."

The use of encrypted communications by ISIS has prompted various former intelligence officials and media analysts to blame NSA whistleblower Edward Snowden for tipping off terrorist organizations to intelligence agencies' surveillance capabilities and for their "going dark" with their communications. Former CIA Director James Woolsey said in multiple interviews that former NSA contractor and whistleblower Edward Snowden "has blood on his hands," and the changes made by the Obama administration to surveillance as a result of the Snowden leaks and the changes that terrorists made in communicating with each other based on the leaks had led directly to the inability of the intelligence community in the US and in France to stop the Paris attacks from happening.

That blame seems a bit far-fetched, given that terrorist organizations have been using encryption of various sorts for more than 15 years at least. And additional details shared by officials since the attack suggest that metadata from the encrypted communications provided early warning that an attack in France was imminent. US intelligence officials warned the French government nearly two months ago that ISIS was planning an attack in France. The French Air Force struck targets in Raqqa, Syria—ISIS' proclaimed capital—on October 8, based on that intelligence, in an attempt to take out those planning and coordinating the attacks.

But while the use of encrypted "apps" to communicate may not have entirely screened the operation from the eyes of intelligence organizations, it may have had an impact on authorities' ability to act more decisively to prevent the attacks in Paris, which left 129 dead and hundreds more wounded. And that may spur another round of calls from US intelligence and law enforcement officials for restrictions on encryption without assured law enforcement access.

It's been known for some time that terror organizations use cryptography of various sorts. Since the late 1990s, Al Qaeda has used various forms of encryption to hide files on websites for dissemination, as well as using encrypted or obfuscated files carried on CDs or USB drives by couriers. The organization has heavily used steganography to conceal electronic documents—even files within pornographic videos on websites—rather than relying on e-mail, and has used the technique since before the September 11, 2001 attacks.

So the placing of blame on Snowden for terrorists using some of the most widely recognized pieces of operational security tradecraft seems a bit outlandish. But the propagation of free, end-to-end encrypted communications applications such as WhatsApp, Signal, RedPhone, Wickr, and Telegram have made it easier to encrypt communications and anonymize the recipient of the messages.

ISIS is known to use Telegram, an ephemeral messaging service created by Vkontakte creator Pavel Durov. Telegram allows for the creation of "channels" that can be used to broadcast messages and hold group conversations with up to 200 recipients. In October, the Middle East Media Research Institute (MEMRI) reported that both ISIS and Al Qaeda had created several channels on Telegram for secure communications to share files securely, including "tutorials on manufacturing weapons and launching cyberattacks, calls for targeted killing and lone-wolf attacks, and more," wrote MEMRI research fellow M. Khayat.

These chat applications aren't necessarily foolproof in maintaining operational security. In June, a group of alleged Chechen jihadists operating in Belgium were caught in part because WhatsApp had not yet fully implemented end-to-end encryption—the encryption libraries used at the time were not supported on Apple iOS devices. And even in situations where end-to-end encryption is available, intelligence agencies can use techniques like traffic analysis to attempt to identify the participants in an encrypted conversation over some messaging tools.

The Paris attacks will likely be used to revive calls by government officials, including FBI Director James Comey, for "golden key" backdoors into encrypted communications tools. That demand had been largely dropped by Comey after he cited "deep cynicism" about the government's need for access to encryption keys from the technology community. But even if the US government were to press forward a demand for companies such as Apple, Facebook, and Google to provide a way to tap into message traffic, that would do little to prevent the use of existing peer-to-peer encryption and other encrypted social media tools by terror organizations.