A secure communications platform would provide a simple to follow audit trail
People like using WhatsApp. There are reputedly 2.7 billion users globally, beating both Facebook and WeChat. However, it’s really not suitable, or indeed, secure enough for organisations whether in the government or private sector, especially when national security may be at stake. The latest twist in the Covid enquiry demonstrates this point, yet again.
The Guardian reported that Penny Mordaunt, leader of the commons, who served under Boris Johnson as paymaster general during the Covid pandemic, told the enquiry that WhatsApp messages with the then prime minister had mysteriously disappeared from her phone.
What actually happened to those messages we may never know. However, had all communications between minsters and people working in government, been properly safeguarded i.e. securely archived so that they were available for later audit, this current situation would simply not have arisen.
Preserving the evidence
In other industries, financial services for example, organisations are required by the Financial Conduct Authority (FCA) to preserve any material conversations, including those conducted over instant messaging, so that they can be reviewed at a later date should the need arise. Financial institutions have banned employees from using unsanctioned apps such as WhatsApp for any form of business conversation, and those that have been caught have suffered punitive fines as a result.
Emails of government employees and ministers are securely stored and have been for many years. So, with the ubiquity of instant messaging, why are these communications not treated in the same way? Many other countries’ governments have banned the use of consumer apps such as WhatsApp, Telegram and Signal, with France being the latest. When will the UK government follow suit?
BYOD devices can still be used
The Guardian article notes that Ms Mordaunt admitted using her own personal phone for some messages. Ministers using their own phones for government business, while understandable as no one wants to be bothered carrying two phones, adds extra complexity to the issue of maintaining a public record of official communications. However, if a secure communications messaging app (the sort already approved and recommended by the National Cyber Security Centre (NCSC)) is used, any communication via the platform is preserved, even when using a BYOD device and even if the original messages are lost or deleted from the device.
Ministers using these apps could even provide licenses to journalists and other third parties, so that all calls/conversations/communications are preserved.
NCSC’s Secure Communications Principles
The NCSC has published principles dealing with secure communications which are:
- Protect data in transit
- Protect network nodes with access to sensitive data
- Protect against unauthorised user access to the service
- Provision for secure audit of the service
- Allow administrators to securely manage users and systems
- Use metadata only for its necessary purpose
- Assess supply chain for trust and resilience
Furthermore, NCSC has published guidelines for dealing with Shadow IT which expressly covers the use of unsanctioned channels and applications.
NCSC approved alternative to consumer apps
While consumer apps are easy and convenient to use, the Armour NCSC-approved Secure Communications Platform is equally as engaging. It has been designed working closely with NCSC to ensure that there is the correct balance between usability and security that supports good information governance.
Had ministers been using such a platform for communications, there would be no question about what happened to messages, they would all be archived and available for review by suitably approved and authenticated auditors. It would have been much easier and faster for the enquiry to discover exactly what went on, saving time and public money. And dare we say it, democracy would have benefitted!
For more information about how to tackle Shadow IT read our eBook: https://armourcomms-25743375.hubspotpagebuilder.eu/shadow-it-ebook or download our Secure Communications Buyer’s Guide to discover what you should be looking for and the 10 questions you should be asking: https://armourcomms-25743375.hubspotpagebuilder.eu/buyers-guide-landing-page-2
