Slashdot Mirror
Five Eyes Intelligence Alliance Argues 'Privacy is Not Absolute' in Push For Encryption Backdoors (itnews.com.au)
The Five Eyes, the intelligence alliance between the U.S., U.K., Canada, Australia, and New Zealand, issued a statement warning they believe "privacy is not absolute" and tech companies must give law enforcement access to encrypted data or face "technological, enforcement, legislative or other measures to achieve lawful access solutions." Slashdot reader Bismillah shares a report: The governments of Australia, United States, United Kingdom, Canada and New Zealand have made the strongest statement yet that they intend to force technology providers to provide lawful access to users' encrypted communications. At the Five Country Ministerial meeting on the Gold Coast last week, security and immigration ministers put forward a range of proposals to combat terrorism and crime, with a particular emphasis on the internet. As part of that, the countries that share intelligence with each other under the Five-Eyes umbrella agreement, intend to "encourage information and communications technology service providers to voluntarily establish lawful access solutions to their products and services." Such solutions will apply to products and services operated in the Five-Eyes countries which could legislate to compel their implementation. "Should governments continue to encounter impediments to lawful access to information necessary to aid the protection of the citizens of our countries, we may pursue technological, enforcement, legislative or other measures to achieve lawful access solutions," the Five-Eyes joint statement on encryption said.
... is not absolute.
Sure thing guys, you first.
A big part of why end to end encryption is becoming more popular and desired by the public is because people everywhere were horrified to find out how big a dragnet the 5 eyes nations were using, and they'd probably never have found out if it wasn't for Edward Snowden.
We need more encryption not less.
I'd rather every single criminal go free than have the government able to snoop on innocent people.
This is not some sort of challenge to government. It's a fact of the universe. All the efforts by each government to outwit the other by creating "unbreakable encryption" has resulted in it getting into the hands of the civilians. No amount of government restricts will undo the laws of mathematics they so carefully tried to exploit to ensure the security of their own messages. Now it can be used by anyone and no amount of collusion by technological companies, legislation, or other measures will adequately provide the backdoors they so desperately desire.
The cat is out of the bag. Instead of embracing this fact and working around the limitations this means, like finding loose links or offering immunity to some for access when it comes to criminal organizations/groups or simply other detective/intelligence work in a world that will never return all the answers, this parade of begging and threats only lures in a few useful idiots who tend to not be useful enough.
Either that or it's all a charade and the encryption has already been broken. But given their behavior, I tend to doubt it. That, by far, is actually the most crippling thing: admitting how powerless they are when encryption is used correctly. It's little wonder "Five Eyes" acts such like a petulant child. It's also incredibly pathetic.
With multiple systems being breached every month, lets create backdoors to make this happen. Anyone suggesting this has no idea how tech works.
Look, I get it: when you're trying to stop the worst criminals in the world it seems stupid to let trivial stuff like privacy of people you don't care about get in the way. Because if you don't, people will die.
But there are three problems: (1) you haven't earned the public trust. Episode after episode (lying to congress, for-profit prisons, coercion of innocent people to plead guilty through a bad plea bargain system, backdoor unconstitutional evidence, even standard interrogation techniques) show that despite lots of good people in law enforcement, law enforcement as a whole should not be trusted. If you want the public trust, you need to put MUCH better systems in place to ensure accountability and transparency. The end result will be *worse* for the bad guys, *better* for law enforcement, and would *enable* the kind of trust-ful environment you want to go after terrorists. (2) it weakens security generally, for technical reasons, and that's not to be glossed over. (3) It's not just about how it gets in the way of you going after the asshole who's trying to plan the next 9/11. It's also about what's the worst thing a person in government abusing their power would do with the information you're collecting. It's not about you; it's about the guy who stores information on the entire population and uses it for political purposes later when those people become Presidents, Senators, and CEOs.
It's about J. Edgar Hoover and Senator McCarthy. It's about people making lists of undesireables from information about religion or belief or google search or sexual mores. It's about control by the most evil of people using all the power of your office and the offices around you--the people who, even if you have a good culture today, could be in those offices with surprising speed.
Defense of Democracy is not just about Defense from foreign threats. It's about defense from domestic ones. It's about threats from enemies within our own power structure, and more than anything about preventing the corruption of power.
If your phone/computer OEM can force you to use only specified firmware, the spooks can force them to modify the firmware in ways that betray the user.
People always say "encryption can't be broken" but that is missing the point. They can mandate a pre-encryption backdoor in phones and tablets, and because those are relatively locked down platforms, it'll do the trick, forking over your data before it is encrypted, or on the other end, after it is decrypted for you to view it. Sure some people will find ways around, but the point is that 99.9% of the population never will even try, they won't even be aware it's a thing.
This is why it is so critical to keep control over hardware. The more we buy locked down hardware, the more control slips from our fingers. Even now PC hardware is edging that way, with all the hardware level DRM and "ring -1" features anymore.
Make no mistake: there is a war going on over who gets to control the mechanisms of the digital world. It's a long, slow loss, but the trend is clear. We're not winning this. Personal computers were much more under your control 30 years ago than today.
If the target is using end to end ecryption, get a F'ing warrant and hack the endpoint(s), assign tail teams... Mass surveillance does not protect the "citizens", and enables a government of the state, by the state, for the state, doing material harm to everyone on the planet.
Without the internet, without computer based encryption the IRA was able to coordinate terrorist activities for decades.
There are still "Numbers stations" which publicly just broadcast a series of numbers
There are thousands of ways to transmit information, all undetectable.
For example if a child wears a red t-shirt it could mean the house is under surveillance, the child knows nothing, its just what he was given to wear that day.
A loaf of bead gets bought before mid day, or after , there is a different meaning
If someone posts on a message board saying their cat has run away, it could have another meaning to others
Those that want to hide in plain sight and transmit encrypted information will still be able to do so with impunity, this just puts honest people at risk.
As for the "nothing to hide" argument , of course people have something to hide.
A GP who likes to dress as a baby in nappies, a male lawyer who likes to dress as cinderella, a wife who is having an affair with the gardener, a Jew who likes bacon, someone being an atheist , being gay, ex member of a hate group, illegitimate child, paying off a porn star and playboy model. There are millions of things we keep to ourselves and the government wants to be trusted with that information.... "I don't think so Tim".
"Pass an amendment requiring full open financial information on all elected officials and their family members, spouse & children."
Mod parent up! We live in societies that lack a depth of understanding. We are forced to vote for people we don't really know. Most people are ignorant about much of what happens around them that affects their lives.
Many people in government and in management of private companies have NO knowledge of technical issues. That doesn't prevent them from having what they consider to be a strong and sensible opinion. They don't recognize they are wildly ignorant.
De-encryption back doors are not an answer. They will ALWAYS eventually be compromised.
Encryption is ALWAYS available. Forcing back doors will merely hasten the development of additional encryption methods.
Headline: Agency who's job it is to spy on citizens thinks citizens shouldn't have technology which makes it difficult for them to be spied on.
...when Wikileaks, Anonymous, the Russians, etc. find the backdoor.
This is why government is a damn joke and the people need to take the power back from the fucking morons they gave it to in the first place.
If we can't have gun control becuase "the constitution says the right to own guns (arms technically) shall not be infringed"...then law enforcement should have to actually do a little work and deal with encryption since the constitution doesn't make exceptions for our right to privacy.
Otherwise your government is just a bunch of oppressive asshates; illegtimate; and need to be overthrown.
If your phone/computer OEM can force you to use only specified firmware, the spooks can force them to modify the firmware in ways that betray the user.
Except that the spooks have no legal authority to compel the tech firms to do that, and the tech firms have a huge incentive to refuse to cooperate and to publicly fight back.
The people will win on this because the corporations are on our side.
If there's a backdoor, there's no encryption.
Given we don't see politicians publishing their bank account details and credit card numbers, we can assume politicians really don't understand the consequences of their proposals.
Ignorance is a really bad place to be making decisions from.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
only outlaws will have encryption.
I thought there were some constitutional protections in the US to prevent this type of thing from happening, but I guess not.
Most of the terrorist activities I've seen reported were using unencrypted communications.
Social media sites provide a treasure trove of suspects with simple searches. I mean really, just start with all the twitter/youtube/facebook rants and work your way down from that.
But I guess that's too hard for the 5 eyes.
I blame Booz Allen and the NSA more than Snowden. Even if Snowden hadn't leaked, the slipshod way everyone was dealing with classified information would have eventually led to some form of disclosure.
Spycraft is a highly specialized and weird world, and the tradecraft and secrets involved should not be available to those without a need to know. The NSA should have compartmentalized and encrypted their own secrets much better. All Snowden should have seen, as an IT worker and poorly-vetted young contractor, were streams of random characters sitting in inboxes and file systems. He could still mount filesystems and keep data flowing through networks without being able to read or understand the data.
If the NSA isn't employing quantum computing both for encryption and decryption by now, then every US citizen should be prepared to have foreign terms forced upon them in some arena. That's a polite way of saying we'll get our asses kicked. I sincerely hope that the ad nauseam calls for back doors is just a smoke screen or false flag maneuver.
Now, this is probably going to be highly unpopular here, but here's my take on privacy: If the feds are able to crack my private encrypted messages, the all the more power to them. If they use my private information in dealing with hostile foreign actors, I got no complaint. However, if they use this information - directly - to persecute me for any activity, illegal or not, then that's crossing a red line. If instead they tip the FBI who are able to obtain warrants, and then they bust me, then that's fair. if, on the other hand, I use encryption techniques that they cannot reasonably crack, then they can park a van across the street from my house and peer at me through the windows. Or just knock on the door and offer to clean my carpets for free.
But trying to tell a US citizen within the borders of the United States that they cannot communicate and encrypt using any method available to them - i.e. math and creative problem solving - is crossing the red line of tyranny.
Shpx lbh, lbh ynml pbpx fhpxref. Dhvg ovgpuvat gung lbhe wbo vf uneq naq chfu gur obhaqnevrf bs grpuabybtl gb trg lbhe fuvg qbar. Sbe rknzcyr, frr gur uvfgbel bs gur Ravtzn pbqr naq gur ahpyrne obzo.
"Every time I see an adult on a bicycle, I no longer despair for the future of the human race." - H. G. Wells
Encryption will be broken, but each time this gets close to happening, new and more interesting and novel encryption methods are published.
We did not grant rights to these elected governments to have ultimate surveillance powers over us, citizens.
Those that read this: vote. Query your candidates for their position on privacy and surveillance. Ask them outright, and feel free to distribute the answers to these questions. Then vote. Get those who can't easily vote to the polls. Make your positions known.
---- Teach Peace. It's Cheaper Than War.
> Except that the spooks have no legal authority to compel the tech firms to do that,
They can, and have, in the past. Remember when SSL keys were limited to 80-bits for export use? Remember when they've insisted that Cisco include backdoor keys in their hardware? Remember the design of the Clipper Chip, which was only discarded when it was found that people could generate their own private keys that passed the checks for the "Law Enforcement Agency Field" checks?
How about the government can have as much privacy as it's citizens.
I think a government should have far _less_ privacy than it's citizens.
Unfortunately the force of law is absolute and apparently trumps the law of physics. Am I the only one here rolling my eyes at the Five Eyes? The reason that cluster exists is TO SKIRT THEIR OWN LAWS. The governments are breaking their own laws by unlawfully obtaining information by proxy. That way they can claim someone else provided the information and they weren't actually spying on their own people.
After that there isn't really any point having laws and they become a pure tool of oppression.
Lo and behold though, the cost of the fraud they enable via these backdoors will be passed on to the citizenry. I don't think we can do anything about it now though, you can't vote against an international council. That's basically "we understand your objections but fuck you".
There is no such thing as a "government only" backdoor. At the very least, it's not YOUR government-only for long. Backdoors allowing decryption of data are the holy grail of espionage. You think actors like North Korea would have any qualms of hijacking your wife and kids if you're holder of such a key to get you to hand it over? Not that they survive, mind you, you're killed alongside them but the key is in the hands of NKor afterwards. And that key is the key to your companies' trade secrets, their R&D, their development and yes, your cutting edge weapon technology.
Aside of that direct damage to your economy, there's the indirect one. Because no company on this planet will store their data with you. They'll send that data abroad. If need be, to Iran or even China, if that's the last place where it's safe from your laws. You are essentially destroying your data storage industry with such a law.
And in the end, you don't even accomplish anything with it. Because what will you get. A few felons with some trivial charges you can tack onto them. You will catch exactly zero terrorists with it. As soon as this becomes law, they will simply shift to the next variant of hiding from you. They have one asset you do not have: Manpower. They have access to cheap manpower. If everything fails, you'll see them use written messages transported via sneakernet again.
I know it's tempting to think that this is the way ahead. But at best it's useless. At worst, and way more likely, it's an economic disaster.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.