Slashdot Mirror
Why Governments Lie About Encryption Backdoors (vortex.com)
Lauren Weinstein says there are smart people in government, "who fully understand the technical realities of modern strong encryption systems and how backdoors would catastrophically weaken them," but asks So why do they continue to argue for these backdoor mechanisms, now more loudly than ever? The answer appears to be that they're lying to us. Or if lying seems like too strong a word, we could alternatively say they're being 'incredibly disingenuous' in their arguments. You don't need to be a computer scientist to follow the logic of how we reach this unfortunate and frankly disheartening determination regarding governments' invocation of terrorism as an excuse for demanding crypto backdoors for authorities' use.
I don't understand why people believe a single word from the (US) government. Every time, on nearly every topic but especially security / military, what they say turns out to be not true.
The government simply got used to being able to see everything at all times. Now that we can create blind spots, they are paranoid and lashing out.
Good-bye
We've read the "Government does this, the Government doesn't do what it should, and the Government is corrupted etc." so many times it becomes both tiring and old, especially since most of it is just us - the people - voicing our opinions about things we've "heard" about, and even if it was true - we do basically NOTHING about it...but talk.
That said...even if you elected someone else - the power of knowledge is too tempting for ANYONE to resist. Therefore the way is OPEN SOURCE all the way. The safest way is actually no secrets in any source or any software, keep everything open - and then no one will be able to put in back doors or abuse bugs that are unknown as everyone will be able to peek inside and help fixing it.
What we need to do is to stop this endless paranoid game of "who do you trust?" and start producing results and solutions. We can do this together...the "gorberment" can't do anything about it, if anything - they should keep to what they do best (whatever that is) and leave the technology to enthusiasts like us, WE - the people - will pretty much make sure your privacy is safe because we'll all end up using open source software.
The only thing "goberment" is achieving with this crazy "who do you trust?" game is making sure would-be terrorist keep digging a deeper hole to hide in and grow a HUGE database of every persons private lives - kept - for their interpretation, with the kind of knowledge and power NO man should hold.
What you do with your computer or in your home - isn't government business no matter what the cause is. If you don't have the freedom to think freely, voice your opinions at will - then you don't have any freedoms at all.
Now, if they ever outlaw open source, then we'll be in trouble (or rather - they will).
What this world is coming to - is for you and me to decide.
Serious question here......how would that work from a technical perspective?
Presumably they want to have a "master key" that would unencrypt any iPhone drive, but each user has to have their own unique key, as well. What kind of encryption algorithm lets either of two keys unencrypt something?
"First they came for the slanderers and i said nothing."
Because the smart people don't drive the commentary, they just stand there in the background face-palming them selves.
Honestly government isn't any different from enterprise:
The Techs & Scientists give management a clear answer on a subject, stipulating all the factors and issues with a stance that the boss is taking, providing alternate approaches & data that shows what they want is irrelevant anyway.
The PHB doesn't like what he's hearing so just goes out and says what he thinks, regardless of the facts. "Well that's what I've promised the client, so you'll have to deliver"
Do you think that politicians & leaders in the "security" services are any different ?
In the old days, you could attack one thing. You could defend one thing. But, that doesn't map well to the internet. Now, we all talk to each other. We all use the same methods of defense. When one actor attacks another, the attack is exposed, analyzed, and re-used. Now, when somebody attacks, they increase the cost of defense for everybody. When somebody comes up with improved defense, we all learn how to increase the cost of attack for everybody.
For over a decade, several branches of the US government have focused almost all their energy on attacking others across the internet. The result is an internet where compromise and breach are daily events. Somehow, our protectors don't see that they are crafting the tools of our demise and handing them to our enemies. If we are honest, we are more to blame for the great compromise at the OPM than our attackers. If we had spent the last decade on creating and encouraging defense, then breach would be difficult and rare.
Now, our governments are blindly following the tradition of attack. They wish to attack the protocols we use to determine identity and create security. They don't see or care that everybody else will do likewise. They don't see the great devastation that will follow.
Then only criminals will have guns and encryption.
The logic is absolutely inescapable with these scenarios: The US government is working with criminals and will thus help them to succeed.
Criminal gangs can get their hands on various encryption programs. Backdoors on hardware won't make a damn worth of difference.
The late Ben Bradlee of the Washington Post has recalled: ... [documented] hidden away in the Pentagon Papers..."
"I guess it started for me with Vietnam, when the establishment felt it had to lie to justify a policy that, as it turned out, was never going to work
https://www.washingtonpost.com...
It seems to me we (the electorate) keep sending the people who are best at it, because they keep telling us what we want to hear, back in.
Keep asking the encryption question and you'll find out how far away from a democracy we've drifted. And when our government gives up with the b.s. stories and lays down the law, they'll do it with armed troops.
Have gnu, will travel.
The simple truth is that while unbreakable encryption is out there in the form of books or papers with the math, most people -- bad guys included -- are lazy and just going to use what the simple, convenient stuff. (The back-doored stuff.)
They fall into the trap of thinking "there are so many people using Facebook chat, the authorities will never find MY stuff in all that noise". In many cases they end up using simple code-book substitution and trivial code names. Instead of Abdul al-Hazred, they'll use "Mr. White". Instead of the Twin Towers they'll use "Faculty of Commerce". They think they're being clever because THEY would never catch this stuff.
I've had this argument with gov't lawyers and it boiled down to me saying "but this is trivial to bypass -- smart bad guys would just use X", and them responding "yeah, but we'll catch the stupid ones and there are a TON of those".
Anyone who has studied the history of crypto knows it is damn near impossible to get it right every last time, much less develop it without bugs. Even WITH source code samples, algorithms and coding skills people who have been doing this for a lifetime screw it up. Thus, "the horse has escaped the barn" isn't really an honest argument. That horse is going to trip of its own volition fairly quickly.
The popular cryptographer and author Bruce Schneier in his blog recalled a conversation with fellow crypto expert Matt Blaze of the University of Pennsylvania, who said the publication of the Snowden documents would begin a âoenew dark age of cryptography, as people abandon good algorithms and software for snake oil of their own devising.â
Learning HOW to think is more important than learning WHAT to think.
Misdirection. Legerdemain. The "backdoors" are already there. The encryption is already broken. The network is already hacked.
(1) Aldrich Ames;
(2) Kim Philby;
(3) J. Edgar Hoover; and
(4) the State of Alabama (NAACP v. Button).
Sooner or later the Supreme Court is going to revisit the Fourth Amendment as it relates to wireless communications. Perhaps the feds are trying to shape the course of public opinion in this regard.
Because to work in government, the primary qualification you need is to be a complete psychopath.
As Friedman said:
I never felt that the reason they gave, which was to catch the most dangerous terrorists, was ever a realistic goal... Whenever someone advocates this, it is either because they are simply too ignorant to realize the actual implications of what they are saying, or else it is because they (possibly sincerely) feel that the number of people who are too incompetent to be able to get away with committing crimes if encryption is not as readily available, but would otherwise be able to get away with committing them if they had easy access to strong encryption technologies is somehow a sizable portion of the people who commit crimes.
File under 'M' for 'Manic ranting'
The Bill of Rights recognizes that the government needs to be kept at arm's length, to be limited in its power. In the last few decades, we've been slowly giving more and more power to the government, sometimes in the name of "national security," (Patriot Act) sometimes in the name of "fairness for all" (Affordable Care Act). We've been taught to let the friendly folks at Washington take care of us. Now we're starting to see the dark side again. The government is saying, "Trust us with your data!"--either when they take it secretly (NSA/Snowden) or when they demand it publicly (backdoors). Maybe it's time for a digital Bill of Rights. The problem is, the government isn't just going to sit down and let go of the power they already have.
There's another dimension to this story, which gets lost in the critically important discussion regarding privacy, but it's money.
If a government got their way and were able to impose the types of control that is now being argued for, it would require a vast amount of new infrastructure to be developed. For example, there would need to be a key escrow system; there would need to be the means of storing all data being transmitted between citizens, there would need to be vastly more money spent on all of this.
Populations across the Western World have - entirely rightly - reached the point of "No More! Not In My Name!" with respect to on-going armed conflict [another very effective way of shifting vast amounts of money from the public purse to the private pockets [of a few]. A shawdowy, unknown threat that is so pervasive that everything done to counter it must be kept secret is an absolutely perfect scenario for spending vast amounts of money on "something". This "spending" is one of the key elements in western [I guess capitalist] society - the government [at the top] takes money in taxes. It then spends that money buy buying things to stimulate the economy and generate more productivity that in turn raises more taxes...
Maybe - this is just a thought - what we're seeing here is a shift in strategy away from spending government trillions on the munitions side of the military-industrial complex and towards spending it on information technology.
Some will ask: "Well, if this is the purpose, why not invest in science, medicine, technology, space exploration?" Two thoughts: Kennedy tried that and the results were not as successful as some hoped; but also, investment made in a technology and apparatus that *strengthens* the control of government will always be most appealing to the decision-makers. As others have [correctly] pointed out, all of what is being discussed services to weaken the citizen and strengthen the state - not always a good thing. I'm also reminded [and sorry, can't find the reference] of a story reported from the Snowden files. IIRC, there was an email from 2 [Booze Allen] employees, discussing a proposal being put to the NSA. One was saying something to the effect, "Look, even if we can find a way to complete the technical build so that we harvest all this data, there is *no way* anyone is going to sift through it and find something of value!" to which the reply was something to the effect, "Look, it doesn't matter - let them make the decision. Our job is to give them a proposal and, if they take it, sell them whatever they ask for..." Now, if anything like that is even partially representative of what has happened [or is happening] then it may help to explain why governments are so keen to roll out so much more technology... Or is this entirely wrong?