Slashdot Mirror
Going Dark Crypto Debate Going Nowhere (threatpost.com)
msm1267 writes: FBI general counsel James Baker reiterated a theme his boss James Comey started months ago, that Silicon Valley needs to find a solution to the "Going Dark" encryption problem. Two crypto and security experts, however, pointed out during a security event in Boston that encryption remains the best defense against the government's surveillance overreach and espionage hacking targeting intellectual property. “If we were able to engineer a mechanism where we’re splitting a key and having a third party escrow it where the government could ask for it, the very next thing that would happen is that China et al will ask for the same solution. And we’re unlikely to give them the same solution,” Eric Wenger, director of cybersecurity and privacy, said. “Complexity kills, and the more complex you make a system, the more difficult it is to secure it. I don’t see how developing a key-bases solution secures things the way you want it to without creating a great deal of complexity and having other governments demand the same thing.”
Do what is best.
...the very next thing that would happen is that China et al will ask for the same solution...
No, that would be second. The first thing would be US agencies demanding keys without warrants and with gag orders.
Yes, Mr. Baker, it is about the relationship between the people and the government. What we wanted you to do was to treat the Fourth Amendment as a law, not as an obstacle to be circumvented. You have demonstrated yourselves incapable of obeying the laws you profess to uphold. So, what we want now is for you to go away. If that means a terrorist kills a few of us every now and then, so be it. Right now the terrorists are killing a lot fewer civilians than our policemen, so frankly, if I've gotta take the risk, I'd rather take my chances with the bad guys than the good guys.
Until then, remember this is professional, not personal. You Feebs actually pretty good at police work when you get off your asses and go do it. Maybe if we make it hard enough for you to spy on us illegally, you'll be forced to resort to good old-fashioned HUMINT-style police work for the rest of your cases. Try serving and protecting the public for a change. You might even start to enjoy it. And we might, after a few decades, start to trust you again.
There's no reason for normal email, IMs, video chats, web surfing, etc to be available at all to anybody who isn't among the intended recipients.
These protocols are in the clear for historical reasons: people didn't imagine that the government would be a bad actor. Since they now are, it's time to add strong encryption to all of those things.
The whole internet needs to "go dark" from the perspective of the Stasi fucks.
Why do they have to hide it in the US? There is nobody actually watching the system to make sure it is not abused. How much did Snowden download and nobody caught on. Hell, did they even 'catch' any of the people doing loveint or were they all self-reported?
They aren't even remotely interested in catching people abusing the system.
Sleep your way to a whiter smile...date a dentist!
All structures are, in the end, flammable. Literally or figuratively.
Even panopticons.
One Gang of Criminals Claims They're Way Better than the Other Gangs
Wants Privileged Data Access
This debate isn't about "terrorists"; any sophisticated organization with something substantial to hide isn't going to rely on Apple's or Google's encryption, they are going to be using their own, something that is easy enough to do.
The entire debate is about day-to-day police work: police want to be able to search your phone and your E-mail with the same ease with which they can open your car's trunk. The problem with that isn't that they may or may not use it against minor offenders, the problem is that if you put that capability in the hands of a million law enforcement officers and government investigators, they will invariably abuse it for personal and political gain, blackmail, and amusement.
Bullshit. If anything, the US state department will demand they implement the same flawed solution, or worse, a less secure implementation.
Leaving aside the honesty of this statement, a court order doesn't open safes, or reveal where the suspect's off-site storage is either. The real problem is encryption offers near-perfect secrecy for a low, low price, so everyone has it. Plus, the bad behaviour of most governments over the last decade motivates everyone to use it. An information device offers a detailed, easy-to-copy record of the suspect's activities stored in one location. The government wants full access to this strategic convenience and now demands that corporations provide it. (My country just forced all ISPs to save all meta-data.)
This is like demanding a copy of every safe key so that "law enforcement investigations on a local level, and surveillance efforts on national security and terrorism fronts" aren't hampered by the desire for privacy. In addition to enabling abuse by the government, every criminal will attempt to break into the key storage. Recent events reveal that governments aren't able to secure civilian data, making failure of the key storage, inevitable. Or just as bad, a universal back-door (again, recent events reveal corporations won't install quality security on back-doors), will mean the end of all privacy, once the universal key is found.
I think this is actually backwards compared to how it may actually play out. This month's *Harper's Magazine* has an interesting essay about American businesses operating in China. (*Harper's* is paywalled, but you get a few free views per month.) The essay can be found here:
"The New China Syndrome: American business meets its new master"
The gist of the essay is that China's authoritarian government strong-arms American businesses, using all of the tools at its command, including outright arrest of business executives, and that this is only going to get worse, to the point where China will be setting U.S. policy by proxy, via business lobbying. After reading that essay yesterday, my guess is that China may someday soon pressure businesses for a backdoor, be granted that backdoor, and that the U.S. government may then get its wish based on China's precedent.
quiquid id est, timeo puellas et oscula dantes.
The FBI and NSA are right that good default crypto will make it harder to catch criminals and the extremely rare terrorists. It will also make it harder to catch people doing quite a number of other bad things.
However, they also brought this on themselves. Overall this is like the response to ads online. Ads got so extremely bad that people just installed adblockers that block everything. Now many sites are finding it hard to even survive due to ads being blocked. If you unblock the ads on the site though you find out the ads are extreme with sound, video, taking over clicks, and with dozens of ads on a page and so you go back to blocking.
If the Ad industry had stayed to banner ads and maybe one or two small ads on the sidebars of a page and with no music or video then it is likely that people would not have gone to the effort to block them. They created this mess all on their own.
If the NSA had not started watching everyone in a fairly blatant violation of the law and the courts made it so you can't even try to stop them since they rule you have not standing since you can't prove you where watched then this reaction would not be happening. What the NSA did damaged Apple, Microsoft, Google, Facebook and many others along with pissing off average people a lot. When the average person thought the NSA was just going after evil people outside the country they where okay with it. Finding out they go after citizens in the country also is unacceptable.
I have no idea how to deal with the actual legitimate concerns of the NSA and FBI and also deal with their abuse. We all know that they will keep abusing their powers if they can. If you compromise encryption in any way then others will find the backdoors also and use them.
This is not a good situation and in the end I don't know how it will play out. It should be possible for the NSA and FBI to get access to data upon probably cause and with a court order I just don't see any realistic way to do that anymore given what they have done.
Computer modeling for biotech drug manufacturing is HARD!
Dear Mr. Baker,
I have an interest in this discussion as an engineer on a product that uses encryption. Here's a small sample of my companies customer list:
- Federal Bureau of Investigation
- US Department of Defense
- US Department of State
- US Department of Homeland Security
- US Air Force
- US Army
- Naval Air Warfare Center Weapons Division
- Northrop Grumman
- Lockheed Martin
- Raytheon
I am sure these organizations would love to hear why you need access to their data. I am sure the governments of China and Russia would never dream of hacking into your key repository, honest.
Disclaimer: opinions expressed here are mine and do not represent my employer.
Crypto does away with the NEED for many aspects of government. 1. Governments have traditionally done a wonderful job printing money when they are broke Obviously this hurts people who save a currency, but since there are less of them these days who cares! Bitcoin and gold offer a way to decouple the value of a currency from the government lack of discipline. Even though it is a legal tender in the constitution, raids on gold currency have been enough to hurt it's image. It is hard to store gold securely. As for blockchain crypto this is something truly new which could take power from the big monopoly (it is also hard to store individual bitcoins securely, but the blockchain would be almost impossible to corrupt). 2. Registering property, marriage licenses, contracts, etc could also be handled by blockchain. We no longer need to send billions a year to our local, state, and central governments to do such minor accounting for us. 3. The forth and fifth amendment. Crypto gives this some actual teeth-- i.e. requiring a real warrant, and not incriminating oneself. Is it any wonder that Proton Mail, Wuala, etc, and other strong crypto services are being attacked by state entities?? 4. While they RUN over our basic Constitutional rights, the government is still regulating us to death. This really does hurt small business. It is possible the people could vote more directly over the internet would reduce the need for representatives and regulatory agencies. Bypassing the lobbyists on both sides of the issues. As long as the individual rights are not up for a vote. And as long as one group is not allowed to subjugate another economically -- which via well-meaning programmed have sucked the economic marrow from the average family imo. In short, this is an historic moment to stand up (individually, and through groups like the EFF and maybe the ACLU). Laws like the anti crypto ones will be a huge win for centralized power over the individual/family. Centralized power is it's only real true goal. Do you trust 100 data-awareness power with auto facial identity etc, to be wielded intelligently 1, 5,10, 20 years out? I for one do not.
...to not abuse the powers we granted it in good faith for the common defense and the public good we can have this discussion about how to deal with legally granted search warrants in pursuit of a legitimate and well targeted crime. Until then I feel for these people in criminal justice trying to do what I am sure is a hard job, but its a non starter. This situation is a direct result of abuse and corruption. You broke it, you bought it.
Peace, or Not?
“This is about rule of law and the fundamental rights we have from the Constitution, creating laws that enable government to obtain the results of surveillance in ways that are consistent with constitutional rights,” Baker said. “Today, that’s not happening. We are not able to use what’s available today with a 4th Amendment warrant. We do what the law requires, show up with a court order, and can’t get the fruits of surveillance because of encryption.”
Without encryption, what happens when they show up with their warrant and I say "Sorry, I don't have any secrets here, they are hidden in a land far far away and you'll never find them".
How is that any different than if I say "Sorry, my secrets are encrypted, and you'll never decrypt them".
Besides, if commercially available encrypted products are required to have a back door, the smart criminals are just going to use real (i.e. "illegal") encryption to store up their secrets.