Rethinking Encryption

A really interesting article on the encryption debate from Jim Baker, who was the FBI’s general counsel when it tried to get Apple to decrypt the iPhone of one of the San Bernardino shooters in 2016.

Baker argues that despite law enforcement facing the prospect of losing access to plain text messages from various sources, and the extra difficulties involved investigating certain cases, widespread encryption should be encouraged by all public officials to counter the much graver threat posed to national security from insecure networks and communications.

Today, digital technology is pervasive and society relies on a range of devices, networks and services to conduct its most important affairs. The political, economic and military power of the United States, as well as the health, safety and welfare of Americans, depend heavily on the secure and reliable operation of a complex digital ecosystem. We have connected our most vital international, national, regional and local systems to an inherently vulnerable network of networks. Glenn Gerstell, the general counsel of the National Security Agency, recently wrote a compelling piece about the complexities of the global digital network and the many challenges it presents to the United States.

It is, therefore, essential that we safeguard the confidentiality, integrity and availability of data on those networks. But we have not done so. The failures are systemic and involve poor design, poor implementation and poor risk management. The cybersecurity problems of the United States and its allies are profound.

With China, in particular, aggressively hacking everything from universities, to companies and Governments, Baker points out that the ongoing threat from that activity far outweighs the loss of access to some criminals’ messages.

Refreshing to see this argument put forward when we’re so often only presented with the simplistic “do this or criminals/terrorists/paedophiles will escape justice.” The fact is that our entire society now relies on strong encryption and weakening it will have far-reaching unintended consequences.

Encryption Wars

Governments all over the world are terrified of losing access to what the public is talking about, warning that all sorts of doomsday scenarios will happen if they can’t snoop on our every word. This despite the fact that they have never had access to this information until arguably the widespread adoption of email from the mid-90s, and particularly since the advent of social media in the mid-00s.

Prior to that they could get a warrant and tap your phone, or perhaps try to steam open your letters, but they, with the possible exception of the NSA, couldn’t do it to all people, all the time.

The internet has provided the biggest boon to the surveillance community, with Snowden revealing the NSA’s now-relistic goal to record all the information, store it and have it searchable forever.

Stanford’s Center for Internet and Society have a good article looking at the latest attempts to get the tech platforms to minimise their use of end-to-end encryption, or to provide some other way for Governments to snoop on message contents.

But we do not live in a world where that system always stays tightly confined to CSAM [child sexual abuse material], or malware scanning, and doesn’t end up enabling censorship of individuals’ private personal conversations with other people over content that is not illegal or harmful. That already happens in China (which is increasingly an object of envy by U.S. law enforcement). China uses its online censorship capabilities to keep its citizens from using WeChat to talk about Winnie the Pooh or “Tiananmen Square”. An end-to-end encrypted messaging system that would do client-side scanning of content against a blacklist before it’s encrypted and report the positive hits? China would rush to fund that work, and likely already has.

The whole article is worth a read, but it’s important to recognise the end-goal.

The rationale may change — national security and terrorism one day, and if that doesn’t work, child abuse the next — but the goal is the same: for governments to have the ability to eavesdrop on your every conversation, the legal power to require that all your conversations be recorded, and the authority to make private-sector providers do their bidding in the process. To have total control. And, if they really succeed, they will reach the ultimate goal: to not even need to exert that control to restrict what you say and do and hear and think — because you’ll do that yourself. You will save them, and Facebook, a lot of time.