Slashdot Mirror
US Efforts To Regulate Encryption Have Been Flawed, Government Report Finds (theguardian.com)
An anonymous reader writes from a report via The Guardian: U.S. Republican congressional staff said in a report released Wednesday that previous efforts to regulate privacy technology were flawed and that lawmakers need to learn more about technology before trying to regulate it. The 25-page white paper is entitled Going Dark, Going Forward: A Primer on the Encryption Debate and it does not provide any solution to the encryption fight. However, it is notable for its criticism of other lawmakers who have tried to legislate their way out of the encryption debate. It also sets a new starting point for Congress as it mulls whether to legislate on encryption during the Clinton or Trump administration. "Lawmakers need to develop a far deeper understanding of this complex issue before they attempt a legislative fix," the committee staff wrote in their report. The committee calls for more dialogue on the topic and for more interviews with experts, even though they claim to have already held more than 100 such briefings, some of which are classified. The report says in the first line that public interest in encryption has surged once it was revealed that terrorists behind the Paris and San Bernardino attacks "used encrypted communications to evade detection." Congressman Ted Lieu is pushing the federal government to treat ransomware attacks on medical facilities as data breaches and require notifications of patients.
If legislators ever bothered to try and understand anything before passing laws about it, government as we know it would cease to exist.
Please Slashdot editors, stop with the cross-story promotion. It makes sense if the two stories are directly related, not when the two stories hang in the same genre.
Apple CEO Tim Cook, along with executives from Google and Facebook, have argued that if Washington starts ordering them to build universal key features into their encryption software, it will create vulnerabilities that both the “good guys” (western governments, in this case) and “bad guys” (other governments and hackers) can exploit.
Sadly, the lines are a little more blurry than this.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
U.S. Republican congressional staff said in a report released Wednesday that previous efforts to regulate privacy technology were flawed and that lawmakers need to learn more about technology before trying to regulate it.
*Republicans* are creating and authorizing the publication of reports critical of government-mandated encryption 'backdoors'?
We keep being lectured by those on the Left that the Democrats are the ones that protect the "regular Joe" and the Republicans are the ones that want to crush the rights/privacy of the "regular Joe".
This is unpossible!
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
Some perspective, people; we've had encryption in use for over 40 years, and the actual amount of people using it to escape prosecution is almost none. Furthermore, if we put in a backdoor, it's inevitably going to be discovered by the rest of the world, and we will wind up with a situation where anybody in the world can read traffic made by American citizens, but they can't read the rest of the worlds. How does it improve national security if the US's banking details are all in plaintext while the rest of the world's isn't? Not only doesn't it improve it, but it dramatically weakens it - if the US really winds up in a war against China or Russia or whatever, and they've figured out the secret, they can effectively spy on any data in the US, read any file. We all know there's no way people are going to upgrade after, so how exciting will it be when the entire infrastructure is easily hackable and no citizen's data will be secure?
Second off, I'd like to point out this isn't going to yield us much benefit. If criminals can't communicate securely with computers, then they'll... use encryption anyway. If they constantly switch WiFi hot spots, use different computers and phones, only send brief messages, and use it for dead drops when they're not around, they have absolutely no possible risk, and the data remains unreadable anyways. And if even that is somehow, magically and impossibly, fixed, then they'll simply do it the old fashioned way; rely on (physical) coded messages, talk person to person, or use stenography or other measures to evade detection. They'll still successfully escape oversight, and it'll be even easier because now they'll be needles in a 300 million pound haystack.
Finally, let's consider the kind of data they're after. They're probably going to want messages, personal videos, etc. from people - stuff that's actual communication. If the data is not stored on the phone, or the phone is destroyed, then... where is it? I know that I don't send the same email back and forth to a person for 30 days, and if neither of us have a copy, there'll be non-left anyways. Oh sure, maybe the server you say, but if we assume a criminal or spy willing to use advanced encryption, why exactly wouldn't they securely delete their messages after they've been read? We did it with burning papers, and once that message is gone, it's gone, encryption or not. Unless, of course, you propose to store every single message, video, and photograph that crosses US internet lines, and that is impossible with how much data there is. Also, how much crime is committed with just the internet? Law enforcement has access to criminal records, on seen evidence, bank records, security footage, witnesses, talking to family, and all manners of power; why would this hamper them? If the criminal is caught with his face bare on a security cam, we's convicted; if a spy blatantly and repeatedly does erratic things and snoops around, he's going to be caught also. Every country did it perfectly fine back in the 80's. Computers are (theoretically) a nice thing to have for this sort of purpose, but they don't contribute that much in the grand scheme. They simply make the inevitable a little quicker.
In short, we have absolutely nothing to gain really, unless you want to go after the 2 or 3 people who used it, and we have the world to lose; people will lose confidence in our IT market, businesses will move to a place where they can store encrypted data legally, the US will become completely unsafe for sensitive records, the government can easily turn into an Orwellian tolitarian state, all of our information becomes accessible to an enemy in the event of a war, and everybody who's smart will find loopholes around this provision anyway. We are going to suffer if we ban encryption or require it to have a backdoor, we are going to suffer a lot, and if you've seen the results of humanity's past, irrational fear and hatred tend to produce pretty poor choices.
"Set a man a fire, he'll be warm for the rest of the night. Set a man afire, he'll be warm for the rest of his life."
Why not a moratorium on laws? Require a current law to drop for every new law passed? I'm only half joking here. Seriously, how long can we go on passing new laws every day of every year until every human activity is either against the law, or mandated by law? Freedom loses all meaning. We're essentially approaching an era of legal "whitelist" tyranny; all actions implicitly denied except those mandated. Then, just in order to live our lives we'll always be in violation of some laws, and "the law" will have no meaning beyond a pretext for enforcing political control.
I've never understood why the restrictions on exporting encryption outside the US. That seems to operate under the premise that non-Americans are unable to develop their own cryptography...which is certainly not the case. Can anyone explain why the US government tried to govern something that is inherently ungovernable?
No one wants unbreakable encryption. We just want encryption to work like copyright - it's completely breakable on a completely impractical timescale (heat death of the universe + 2 billion years should be ok).
...lawmakers need to learn more about technology before trying to regulate it...
I was going to say that but you beat me to it. The Paris attackers used burner phones and SMS. Unencrypted SMS. If worldwide police agencies can't detect the digital equivalent of postcards being sent through the mail, what makes them think that a) terrorists will care enough to go through the trouble to encrypt their communications and b) they could even find the supposedly encrypted messages when they're just tossing more hay on the pile while searching for the same needle.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
With congress members already struggling to understand basic science issues such as the age of the earth and AGW, something like cryptography lies largely and forever out of their grasp...
Yes! And, the link provided in the summary to support the statement is not about the Paris attacks. This is like me saying "Scientists have reported that neutrinos do not change flavor." (The link is to an article confirming that they do change flavor.)
lawmakers need to learn more about technology before trying to regulate it.
Translation: We need to fire these idiots and elect lawmakers that know more about the things they intend to regulate