Why We Positively, Absolutely, Can't Trust the Government with Encryption
http://lauren.vortex.com/archive/001123.html
By now you're hopefully aware that the U.S. federal government is
engaged in a major effort to pressure technology firms like Google and
Apple to provide "backdoors" into encryption systems (particularly for
mobile devices) that are increasingly designed so that the firms
themselves cannot even decrypt the data without cooperation from the
devices' owners. Simultaneously, there are efforts to pressure Congress
into mandating such backdoors if the firms refuse to voluntarily
cooperate.
Despite the fact that essentially every reputable security, encryption,
and privacy expert agrees that it is technically impossible to design
such a backdoor that would not massively increase the potential for
black-hat hacking -- and so dramatically decrease the security of these
systems -- law enforcement continues to imply that if you don't see
things their way -- well, perhaps you're not a loyal American.
This was very nearly stated explicitly by the FBI and CIA directors at
the Intelligence and National Security Summit in Washington yesterday,
where the men bemoaned negative public opinion, "deep cynicism," and
"venom" directed at the backdoor access plans -- with CIA Director John
Brennan suggesting that persons promulgating these views "may be fueled
by our adversaries."
Mr. Brennan's remark is reminiscent of President Richard Nixon's
paranoid delusions that antiwar Vietnam protesters were all the puppets
of ghostly Communist agents.
Well, Mr. Brennan, let me help set you straight regarding your comment,
which I believe many of us in the technology community find to be
extremely misguided and offensive.
We don't have any foreign masters. We simply don't trust you.
And it's not just you. Almost everywhere we look at the intersection of
technology and any agencies involved even peripherally in law
enforcement activities, there's a long list of lies, errors,
mismanagement, screw-ups, and abuses galore.
It's an ironic situation to be sure, given that the technology
displaying these very words at this very moment can trace their ancestry
to a Department of Defense computer networking project.
But the sad truth is that at every level of government, no matter
whether Democrats or Republicans are in power, it's generally the same
story.
It starts at the local level, with municipalities lying to citizens
about red light cameras, license plate readers, and police surveillance
systems.
At the state level it moves up to abuse and foul-ups of DMV databases
and more.
And at the federal level the list is almost too long to even begin.
The recently revealed Office of Personnel Management hack exposed the
personal data -- including sensitive security clearance applications and
related forms -- of perhaps four million people or more. A 29-year-old
contractor waltzes out of NSA with a thumb drive filled with reams of
the agency's most sensitive documents.
No -- Mr. CIA Director and Mr. FBI Director -- you're not going to sell
us your foreign influence bogeymen this time.
We simply believe that we cannot trust government agencies to have the
honesty and competency to be entrusted with keys to our own
encryption -- the security of which is rapidly becoming a fundamental
requirement of our day-to-day lives.
Frankly, even if there were a magic wand that could create that
impossible backdoor system in a seemingly secure and safe manner -- we
still wouldn't and couldn't entrust you not to find avenues to abuse it.
This is overall a very unfortunate state of affairs, because yes, we
know that encryption may be leveraged for evil in very serious ways.
But you still can't get blood out of a stone.
The technical reality is that the kinds of encryption backdoors you want
cannot be made secure and would themselves represent horrific security
risks.
Perhaps someday you'll find ways to earn back our trust. But all the
trust in the world won't change the technical realities that make
encryption backdoors a non-starter.
And the sooner you understand these truths, the better it will
be for us all.
--Lauren--
I have consulted to Google, but I am not currently doing so.
All opinions expressed here are mine alone.
- - -
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
