Senate Bill Draft Would Prohibit Unbreakable Encryption (ap.org)

buck-yar quotes a report from the Associated Press: "A draft version of a Senate bill would effectively prohibit unbreakable encryption and require companies to help the government access data on a computer or mobile device with a warrant."
The two Senators finalizing the bill announced "No individual or company is above the law," saying their goal is to ensure compliance with court orders to help law enforcement or to provide decrypted information. The ACLU's legislative counsel argued the drafted legislation represents a "clear threat to everyone's privacy and security," and the bill is opposed by another member of the Senate committee, Ron Wyden, who says it would require "American companies to build a backdoor... They would be required by federal law per this statute to decide how to weaken their products to make Americans less safe."

Comments

OSS

[Anonymous Coward]

If this bill became law, it would be great for "black market" open-source encryption software.

Before everyone gets up in arms about this...

[FlyHelicopters]

Was this bill introduced with the intention of passing it, or was it done for election time?

Many bills get introduced that have zero chance of passing, rather they do it so the Congresscritters can go back to their home state and say "I'm fighting for you, to stop those evil terrorists from threatening your family, vote for me!"

Re:Before everyone gets up in arms about this...

[dgatwood]

That needs to be repeated: the majority of Americans WANT BREAKABLE ENCRYPTION. The majority of people think Apple was in the wrong - something like 60/40 according to polls. So not an absolute majority, but not an insignificant one. Especially when it comes to politicians measuring which way the wind is blowing.

What I don't think you understand here is that the opinion of the majority of Americans is completely irrelevant to what government actually does. Completely. Most politicians couldn't give two s**ts about what the public thinks. And although that is usually counterproductive, in situations like this, it is actually the right policy. The average American doesn't have any idea what encryption is or does; they just know that it magically keeps them safe. As such, their opinion on how crypto algorithms should be designed isn't important, because their opinion is not an informed opinion.

To use an analogy here, the majority of Americans want flying cars. The fact that they won't know how to drive flying cars doesn't matter to them. The fact that it isn't currently technologically feasible to build flying cars doesn't matter to them, either. If government listened to those demands, they would pass a law saying that 25% of cars next year must fly. Doing so won't give us flying cars; it will just cause all American automakers to shut down because of their inability to comply with that law. Politicians know this, because they have listened to people whose opinions actually are informed, and as a result, they won't pass such a law no matter how many Americans might jump up and whine, "But I want my flying car NOW!"

There are exactly two groups of people whose opinions matter in this case: law enforcement and the technology industry. Law enforcement's opinions matter because they're in the trenches, and they think they know what tools they need to get their jobs done. The opinions of people in the tech industry matter because they're the ones who can say whether or not what they are asking for A. is feasible, and B. can be done in a way that doesn't completely destroy the security of the system as a whole. Nobody else's opinion matters in this debate, because nobody else has sufficient knowledge of the ramifications of such a law (including, apparently, much of Congress).

It would be laughable to allow government positions to be decided by a bunch of uninformed people merely because they scream their ignorance at a louder volume than the rest of us. That's the surest way to governmental collapse, and is the reason that most politicians quickly erect an intern-powered bozo filter around their inbox....

Geeks are losing this battle. The simple problem is that people want encryption to be like a safe: a thing you use to keep The Bad Guys out, but which The Good Guys can still bust open if necessary. People flat-out don't want unbreakable encryption or perfectly secure phones. See that earlier story about the dad trying to get Apple to unlock his late son's iPhone. People side with the father. They want it to be possible to break into encrypted things.

No, people want to be in control of their lives. Some of them wrongly believe that banning encryption will give them more control. We merely must educate them about the fact that doing so will actually give them far less control.

In some cases, governments go too far in trying to create the illusion of control, such as many of the things our government did after 9/11. However, the people grasping for power after 9/11 were mostly unopposed. The airline industry has always been on the verge of bankruptcy, and they weren't about to try to fight the government to keep them from forcing all of those changes, because they wouldn't have survived. In contrast, the government is now going up against the three largest companies on the planet Earth (Apple, Google, and Microsoft)—companies that make essentially 100% of the world's smart

Feinstein ain't no Einsten

[Space cowboy]

She's just a paranoid old woman who's so scared about "the terrorists" that she's willing to give up ... what's the line ? Oh yeah, "essential liberty" ... sounds familiar somehow.

I happen to work on De Anza Blvd, and I was looking out the window when the proverbial was hitting the fan with Apple and the FBI, there was suddenly a cavalcade of blacked-out sedans overriding the lights sequence, with police blowing their horn as someone (my assumption here is that it was the senator, no-one else really gets that level of police co-operation) halted the normal traffic lights sequence so this entire entourage could turn into Infinite Loop.

So, Diane was going to yell at Tim. I have some reasonable hope that Tim told her to stick it where the sun don't shine, but I think he's more polite (not to mention politically astute) than I, so I'm sure he came up with a gentlemanly way to say it.

The good news is that she won't be re-elected because she's not going to run any more. She's too old (thank $deity) so we have a chance of getting someone in who isn't a complete fucking moron when it comes to national security. There's no way this state will elect a republican, so we're stuck with her until then. She gets a lot of votes, and I really hope that's just people voting along party lines because if people actually *want* her policies, well... shit, time to leave.

Re:Write your senator

[FlyHelicopters]

This is a good time to drop them a letter AND an email AND a phone call AND a fax while at it. Go on, do what's expected of you but too few of you actually do.

I don't give them money, so they don't care.

https://youtu.be/Ylomy1Aw9Hk

Last Week Tonight with John Oliver: Congressional Fundraising (HBO)

Well worth 21 min of your time.

Cameron vs Panama Papers

[flyingfsck]

The Congressmen should speak to PM Cameron of the UK about the need for privacy and encryption. He seems to have gotten a change of heart following the Panama Papers leak. Anyhoo, all encryption is breakable. It may just take a while...

Second Amendment Issue?

[AF_Cheddar_Head]

Follow along with me:
Cryptograghy is subject to ITAR (International Traffic in Arms Regulations)
This means the Federal Government treats Cryptography as an Armament
What does the second amendment say: "the right of the people to keep and bear Arms, shall not be infringed"
Hey NRA time to step up and defend the Second Amendment against the heinous assault. Slippery slope and all. You don't want these guys coming after your guns do you.

Think a step further

[Elfich47]

Let's take this law to its logical conclusion. No one in power cares about individuals download pgp and encrypting their email. Everyone cares when money gets involved.

All "trusted" internet commerce where you plug in your credit card number is dependent upon encryption strong enough to prevent credit card and identity theft. If this law were to pass no internet commerce company would be able to use encryption strong enough to prevent people from stealing credit card numbers by skimming traffic. It may take a little bit (hours or days) but someone skimming Amazon or bank traffic will start being to pull out credit card and account numbers and the trust of internet banking will be destroyed for years.

This is what will prevent strong encryption from going away- the encryption has to be available to all users for it to be useful. People, credit card companies and insurance companies will not tolerate money being stolen whole sale that we have not seen yet. Yes I am aware that people get their card numbers stolen everyday. Removing encryption would guarantee that your card is stolen the first time you use your card on the internet.

No such thing

[fyngyrz]

Unbreakable encryption -- outside of direct coercion of the sender or receiver -- is trivial. Here's an encrypted message from me:

"The cockatrice is in the jacuzzi"

Let me know when you can decrypt it without directly coercing me. You're allowed to use any intellectual or computing resources available to anyone on the planet. Or all of them. Until you can, there's no way, literally no way to make unbreakable encryption inaccessible to anyone with a vocabulary larger than a parrot's (on second thought, that might be enough anyway.) Making such a thing illegal to do, or use, is completely impractical.

You can punish someone for using it, if you can catch them at it.