Why Governments Lie About Encryption Backdoors
http://lauren.vortex.com/archive/001137.html
Despite any firm evidence to suggest that the terrorist attackers in
Paris, in San Bernardino, or at the Planned Parenthood center in
Colorado used strong (or perhaps any) encryption to plan their killing
sprees, government authorities around the planet -- true to the
long-standing predictions of myself and others that terrorist attacks
would be exploited in this manner -- are once again attempting to
leverage these horrific events into arguments for requiring "backdoor"
government access to the encryption systems that increasingly protect
ordinary people everywhere.
This comes despite the virtual unanimity among reputable computer
scientists and other encryption experts that such "master keys" to these
encryption systems that protect our financial and ever more aspects of
our personal lives would be fundamentally weakened by such a government
access mechanism, exposing us all to exploits both via mistakes and
purposeful abuse, potentially by governments and outside attacks on our
data.
It's difficult -- one might say laughable -- to take many of these
government arguments seriously even in the first place, given the gross
incompetence demonstrated by the U.S. government in breaches that
exposed millions of citizens' personal information and vast quantities
of NSA secrets -- and with similar events occurring around the world at
the hands of other governments.
But there are smart people in government too, who fully understand the
technical realities of modern strong encryption systems and how
backdoors would catastrophically weaken them.
So why do they continue to argue for these backdoor mechanisms, now more
loudly than ever?
The answer appears to be that they're lying to us.
Or if lying seems like too strong a word, we could alternatively say
they're being "incredibly disingenuous" in their arguments.
You don't need to be a computer scientist to follow the logic of how we
reach this unfortunate and frankly disheartening determination regarding
governments' invocation of terrorism as an excuse for demanding crypto
backdoors for authorities' use.
We start with a fundamental fact.
The techniques of strong, uncrackable crypto are well known. The
encryption genies have long since left their bottles. They will not
return to them, no matter how much governments may plead, cajole, or
threaten.
In fact, the first theoretically unbreakable crypto mechanisms reach
back at least as far as the 19th century.
But these systems were only as good as the skill and discipline of their
operators, and errors in key management and routine usage could create
exploitable and crackable weaknesses -- as they did in the case of the
German-used "Enigma" system during World War II, for example.
The rise of modern computer and communications technologies -- desktops,
smartphones, and all the rest -- have allowed for the "automation" of
new, powerful encryption systems in ways that make them quite secure
even in the hands of amateurs, and as black hat hacking exploits have
subverted the personal data of millions of persons, major Web and other
firms have reacted by deploying ever more powerful crypto foundations to
help protect these environments that we all depend upon.
Let's be very, very clear about this. The terrorist groups that
governments consistently claim are the most dangerous to us -- al-Qaeda,
ISIL (aka ISIS, IS, Islamic State, or Daesh), the less talked about but
at least equally dangerous domestic white supremacist groups, and
others -- all have access to strong encryption systems. These apps are not
under the control of the Web firms that backdoor proponents attempt to frame
as somehow being "enemies" of law enforcement -- due to these firms'
enormously justifiable reluctance to fundamentally weaken their systems
with backdoors that would expose us all to data hacking attacks.
What's more -- and you can take this to the bank -- ISIL, et al. are
extraordinarily unlikely to comply with requests from governments to
"Please put backdoors into your homegrown strong crypto apps for us?
Pretty please with sugar on it?"
Governments know this of course.
So why do they keep insisting publicly that crypto backdoors are
critical to protect us from such groups, when they know that isn't true?
Because they're lying -- er, being disingenuous with us.
They know that the smart, major terrorist groups will never use systems
with government-mandated backdoors for their important communications,
they'll continue to use strong systems developed in and/or distributed
by countries without such government mandates, or their own strong
self-designed apps.
So it seems clear that the real reason for the government push for
encryption backdoors is an attempt not to catch the most dangerous
terrorists that they're constantly talking about, but rather a selection
of "low-hanging fruit" of various sorts.
Inept would-be low-level terrorists. Drug dealers. Prostitution rings.
Free speech advocates and other political dissidents. You know the
types.
That is, just about everybody EXCEPT the most dangerous terrorist groups
that wouldn't go near backdoored encryption systems with a ten foot
pole, yet are the very groups governments are loudly claiming backdoor
systems are required to fight.
Now, there's certainly a discussion possible over whether or not
massively weakening crypto with backdoors is a reasonable tradeoff to
try catch some of the various much lower-level categories of offenders.
But given the enormous damage done to so many people by attacks on their
personal information through weak or improperly implemented encryption
systems, including by governments themselves, that seems like an
immensely difficult argument to rationally make.
So our logical analysis leads us inevitably to a pair of apparently
indisputable facts.
Encryption systems weakened by mandated backdoors would not be effective
in fighting the terrorists that governments invoke as their reason for
wanting those backdoors in the first place.
And encryption weakened by mandated backdoors would put all of us -- the
ordinary folks around the planet who increasingly depend upon encrypted
data and communications systems to protect the most intimate aspects of
our personal lives -- at an enormous risk of exposure from data breaches
and associated online and even resulting physical attacks, including via
exploitation from foreign governments and terrorist groups themselves.
Encryption backdoors are a gleeful win-win for terrorists and a horrific
lose-lose for you, me, our families, our friends, and for other
law-abiding persons everywhere. Backdoors would result in the worst of
the bad guys having strong protections for their data, and the rest of
us being hung out to dry.
It's time to permanently close and lock the door on encryption
backdoors, and throw away the key.
No pun intended, of course.
Be seeing you.
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
I have consulted to Google, but I am not currently doing so.
My opinions expressed here are mine alone.
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
