Slashdot Mirror
US Efforts To Regulate Encryption Have Been Flawed, Government Report Finds (theguardian.com)
An anonymous reader writes from a report via The Guardian: U.S. Republican congressional staff said in a report released Wednesday that previous efforts to regulate privacy technology were flawed and that lawmakers need to learn more about technology before trying to regulate it. The 25-page white paper is entitled Going Dark, Going Forward: A Primer on the Encryption Debate and it does not provide any solution to the encryption fight. However, it is notable for its criticism of other lawmakers who have tried to legislate their way out of the encryption debate. It also sets a new starting point for Congress as it mulls whether to legislate on encryption during the Clinton or Trump administration. "Lawmakers need to develop a far deeper understanding of this complex issue before they attempt a legislative fix," the committee staff wrote in their report. The committee calls for more dialogue on the topic and for more interviews with experts, even though they claim to have already held more than 100 such briefings, some of which are classified. The report says in the first line that public interest in encryption has surged once it was revealed that terrorists behind the Paris and San Bernardino attacks "used encrypted communications to evade detection." Congressman Ted Lieu is pushing the federal government to treat ransomware attacks on medical facilities as data breaches and require notifications of patients.
Stop insisting on unbreakable encryption. You're just helping terrorists and criminals while you hurt Americans. If you dorks didn't have anything illegal to hide, you wouldn't use unbreakable encryption. And no, I'm not worried about identity theft. I use Lifelock and, therefore, am immune from this.
If legislators ever bothered to try and understand anything before passing laws about it, government as we know it would cease to exist.
Please Slashdot editors, stop with the cross-story promotion. It makes sense if the two stories are directly related, not when the two stories hang in the same genre.
Apple CEO Tim Cook, along with executives from Google and Facebook, have argued that if Washington starts ordering them to build universal key features into their encryption software, it will create vulnerabilities that both the “good guys” (western governments, in this case) and “bad guys” (other governments and hackers) can exploit.
Sadly, the lines are a little more blurry than this.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
If "not knowing enough about something to make that kind of decision" is any indicator as to whether you should or should not make a decision, congress can't really make a lot of laws anymore.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Once the FBI started subverting TOR (developed by the Naval Research Lab to promote FREEDOM), hacking people's computers without warrents and demanding user data from ISPs without warrants, the US became a bad internet citizen and a de facto rogue state.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
"Going Dark, Going Forward: A Primer on the Encryption Debate and it does not provide any solution to the encryption fight" is a bit long for a title, isn't it?
Some perspective, people; we've had encryption in use for over 40 years, and the actual amount of people using it to escape prosecution is almost none. Furthermore, if we put in a backdoor, it's inevitably going to be discovered by the rest of the world, and we will wind up with a situation where anybody in the world can read traffic made by American citizens, but they can't read the rest of the worlds. How does it improve national security if the US's banking details are all in plaintext while the rest of the world's isn't? Not only doesn't it improve it, but it dramatically weakens it - if the US really winds up in a war against China or Russia or whatever, and they've figured out the secret, they can effectively spy on any data in the US, read any file. We all know there's no way people are going to upgrade after, so how exciting will it be when the entire infrastructure is easily hackable and no citizen's data will be secure?
Second off, I'd like to point out this isn't going to yield us much benefit. If criminals can't communicate securely with computers, then they'll... use encryption anyway. If they constantly switch WiFi hot spots, use different computers and phones, only send brief messages, and use it for dead drops when they're not around, they have absolutely no possible risk, and the data remains unreadable anyways. And if even that is somehow, magically and impossibly, fixed, then they'll simply do it the old fashioned way; rely on (physical) coded messages, talk person to person, or use stenography or other measures to evade detection. They'll still successfully escape oversight, and it'll be even easier because now they'll be needles in a 300 million pound haystack.
Finally, let's consider the kind of data they're after. They're probably going to want messages, personal videos, etc. from people - stuff that's actual communication. If the data is not stored on the phone, or the phone is destroyed, then... where is it? I know that I don't send the same email back and forth to a person for 30 days, and if neither of us have a copy, there'll be non-left anyways. Oh sure, maybe the server you say, but if we assume a criminal or spy willing to use advanced encryption, why exactly wouldn't they securely delete their messages after they've been read? We did it with burning papers, and once that message is gone, it's gone, encryption or not. Unless, of course, you propose to store every single message, video, and photograph that crosses US internet lines, and that is impossible with how much data there is. Also, how much crime is committed with just the internet? Law enforcement has access to criminal records, on seen evidence, bank records, security footage, witnesses, talking to family, and all manners of power; why would this hamper them? If the criminal is caught with his face bare on a security cam, we's convicted; if a spy blatantly and repeatedly does erratic things and snoops around, he's going to be caught also. Every country did it perfectly fine back in the 80's. Computers are (theoretically) a nice thing to have for this sort of purpose, but they don't contribute that much in the grand scheme. They simply make the inevitable a little quicker.
In short, we have absolutely nothing to gain really, unless you want to go after the 2 or 3 people who used it, and we have the world to lose; people will lose confidence in our IT market, businesses will move to a place where they can store encrypted data legally, the US will become completely unsafe for sensitive records, the government can easily turn into an Orwellian tolitarian state, all of our information becomes accessible to an enemy in the event of a war, and everybody who's smart will find loopholes around this provision anyway. We are going to suffer if we ban encryption or require it to have a backdoor, we are going to suffer a lot, and if you've seen the results of humanity's past, irrational fear and hatred tend to produce pretty poor choices.
"Set a man a fire, he'll be warm for the rest of the night. Set a man afire, he'll be warm for the rest of his life."
Why not a moratorium on laws? Require a current law to drop for every new law passed? I'm only half joking here. Seriously, how long can we go on passing new laws every day of every year until every human activity is either against the law, or mandated by law? Freedom loses all meaning. We're essentially approaching an era of legal "whitelist" tyranny; all actions implicitly denied except those mandated. Then, just in order to live our lives we'll always be in violation of some laws, and "the law" will have no meaning beyond a pretext for enforcing political control.
Well it isn't as bad as I thought but it is biased in that it does have the "Something must be done" theme in it. The document could have been worse but it could have been a lot better. As someone involved in security and encryption it felt very patronizing to me but then I'm not the target audience. There is a lot of space dedicated to explaining the productive uses of encryption but then there is about the same explaining why it makes life difficult for law enforcement. Then there is a big section showing what restrictions other countries have or what laws governing encryption other countries have tried to pass. They still push the idea that encryption caused them problems in the Paris attack yet ignoring the fact that the mastermind of it was featured as pig fucker of the month in Daesh's monthly magazine. They also bring up the San Bernardino cellphone but fail to mention that the government at all levels screw the pooch at every turn there. Yes I actually did read it.
Time to offend someone
I've never understood why the restrictions on exporting encryption outside the US. That seems to operate under the premise that non-Americans are unable to develop their own cryptography...which is certainly not the case. Can anyone explain why the US government tried to govern something that is inherently ungovernable?
You make it sound like those two choices are mutually exclusive.
But but but ... there ought to be a law!
We must do something, this is something, therefore we MUST DO IT!!!!
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
The Paris attackers did NOT use encryption!
They used burner phones.
The TLA's just tried to use encryption as the reason why their spy machines didn't detect squat, and to try force new encryption laws down peoples throats.
There are three kinds of falsehood: the first is a 'fib,' the second is a downright lie, and the third is statistics.
...lawmakers need to learn more about technology before trying to regulate it...
With congress members already struggling to understand basic science issues such as the age of the earth and AGW, something like cryptography lies largely and forever out of their grasp...
Good luck regulating math, morons.
The link supporting the assertion that terrorists behind the Paris and San Bernardino attacks "used encrypted communications to evade detection." is not supported by the linked article. In the first place, the article is only about San Bernardino, not Paris. Second, it only says that authorities were trying to get access to encrypted data. In the San Bernardino case, there was encrypted data because the iPhone encrypts by default but there was no evidence released that the encrypted data contained anything relevant to the case. No article is linked about Paris. My understanding there was that French officials basically said that the terrorists must have encrypted there communication because they didn't detect anything. They offered no proof that encryption had been used. The assertion was like the one in San Bernardino - the suspects had used some encryption in the course of their regular use of technology, as most people do, but there was no definite statement that the encrypted communication had actually been used to plot attacks. Ars Technica reports no evidence of encryption being used.
lawmakers need to learn more about technology before trying to regulate it.
Translation: We need to fire these idiots and elect lawmakers that know more about the things they intend to regulate
The Paris attackers didn't use encryption. They used unencrypted "burner" phones, which they changed frequently, and then during the attack, they took phones from their victims and used those.