The National Security Agency (NSA) director, Mike Rogers, on Monday sought to calm a chorus of doubts about the government's plans to maintain built-in access to data held by US technology companies, saying such "backdoors" would not be harmful to privacy, would not fatally compromise encryption and would not ruin international markets for US technology products.

 

Rogers mounted an elaborate defense of Barack Obama's evolving cybersecurity strategy in an appearance before an audience of cryptographers, tech company security officers and national security reporters at the New America Foundation in Washington.

 

In an hour-long question-and-answer session, Rogers said a cyber-attack against Sony pictures by North Korea last year showed the urgency and difficulty of defending against potential cyber threats.

"If you look at the topology of that attack from North Korea against Sony Pictures Entertainment, it literally bounced all over the world before it got to California," Rogers said.

 

"Infrastructure located on multiple continents, in multiple different geographic regions."

For most of the appearance, however, Rogers was on the defensive, at pains to explain how legal or technological protections could be put in place to ensure that government access to the data of US technology companies would not result in abuse by intelligence agencies.

 

The White House is trying to broker a deal with companies such as Apple, Yahoo and Google, to ensure holes in encryption for the government to access,

• mobile data

• cloud computing

• other data

 

"'Backdoor' is not the context I would use, because when I hear the phrase 'backdoor' I think: 'Well this is kind of shady, why wouldn't you want to go in the front door, be very public?'" Rogers said.

 

"We can create a legal framework for how we do this."

Rogers, who is also commander of US Cyber Command, said the government was playing catch-up not only in establishing defenses against cyber attacks but in laying out its own rules of cyber warfare, including when retaliation was appropriate.

"We're not mature and we're clearly not where we need to be," Rogers said.

 

"Take the nuclear example. If you go back in the first 10, 20 years, we were still debating about, 'Well, what are the fundamental concepts of deterrence?'

 

This whole idea of mutually assured destruction - that didn't develop in five years, for example. All of that has taken time. Cyber is no different."

Rogers admitted that concerns about US government infiltration of US companies' data represented a business risk for US companies, but he suggested that the greater threat was from cyber-attacks.

"I think it's a very valid concern to say 'Look, are we losing US market segment here?'" Rogers said.

 

"What's the economic impact of this? I just think, between a combination of technology, legality and policy, we can get to a better place than we are now."

US technology companies have bridled at government pressure to introduce weaknesses in encryption systems in order to ensure government access to data streams, and technical experts have warned that there is no way to create a "backdoor" in an encryption system without summarily compromising it.

 

An appearance by Obama at a cybersecurity conference at Stanford University last week to tout cooperation between the government and US tech companies was upstaged by an impassioned speech by Apple's chief executive, Tim Cook, who warned of the "dire consequences" of sacrificing the right to online privacy.

 

The basic discomfort of the new partnership the government would like to see with technology companies once again burst into full view on Monday when Alex Stamos, the chief information security officer at Yahoo, challenged Rogers on his recommendation for built-in,

"defects-slash-backdoors, or golden master keys" to serve government purposes.

Stamos asked Rogers how companies such as Yahoo, with 1.3 billion users worldwide, would be expected to reply to parallel requests for backdoors from foreign governments, and told Rogers such backdoors would be like "drilling a hole through a windshield".

"I've got a lot of world-class cryptographers at the National Security Agency," replied Rogers, skipping over the question of foreign government requests.

 

"I think that this is technically feasible. Now it needs to done within a framework."