top | item 9845122

Code Specialists Oppose U.S. and British Access to Encrypted Communication

417 points| conover | 10 years ago |nytimes.com | reply

217 comments

order
[+] phkahler|10 years ago|reply
This debate seems like a manifestation of a problem with governments: They think they can legislate anything they want. Need access to some communications - green light for massive data collection. Some of it is encrypted - just mandate a back door. School shooting - new gun laws. Any problem activity - we'll just make it illegal. Something not getting done - we'll just mandate someone take care of it. They really don't know how to stay at a higher level, it's all micromanagement. Some things are just not possible, but they'll try to make it so with the stroke of a pen.
[+] vezzy-fnord|10 years ago|reply
Not just with governments, but people's whims in general.

To quote G.K. Chesterton [1]:

   And then, last but the reverse of least, there plunged in
   all the people who think they can solve a problem they
   cannot understand by abolishing everything that has 
   contributed to it. We all know these people. If a barber
   has cut his customer's throat because the girl has 
   changed her partner for a dance or donkey ride on 
   Hampstead Heath, there are always people to protest
   against the mere institutions that led up to it. This 
   would not have happened if barbers were abolished, or if
   cutlery were abolished, or if the objection felt by
   girls to imperfectly grown beards were abolished, or if 
   the girls were abolished, or if heaths and open spaces
   were abolished, or if dancing were abolished, or if
   donkeys were abolished. But donkeys, I fear, will never
   be abolished.
[1] https://en.wikisource.org/wiki/The_Flying_Inn/Chapter_IX
[+] de_Selby|10 years ago|reply
> School shooting - new gun laws.

I agree with the sentiment of your post, but as a non-American this one jumps out at me. I don't think it fits the rest of your argument, adding more control and checks for something as dangerous as gun ownership is a good thing.. in particular, it would take a lot to convince me that private ownership of assault rifles is anything but bad news.

I have read some arguments about private protection against excessive government excesses, but I don't really buy it.

[+] bhauer|10 years ago|reply
> They think they can legislate anything they want

For Americans at least, that mentality has evolved over time as we further distance ourselves from the Constitution and its Amendments; trying our best to ignore their very clear limits on the capabilities of each branch of government. In today's American society, a diverse (and often mutually disagreeing) set of groups see the limits set in the Constitution as quaint and outdated, too inflexible for the modern world. Some see the Fourth Amendment as unreasonably limiting the effectiveness of national security and law enforcement. Some see the Second Amendment as a relic of a more violent world. Some see the First Amendment as intolerant of intolerance. Some see the Ninth and Tenth Amendments as needlessly frustrating the federal government's ability to quickly "fix" problems.

Today, I find the Constitution—and more importantly, those who bring it up in polite political conversation—to as often as not be marginalized as "extreme" or, worse, comedic. There is a rough equivalence of "Constitution" with "Murica" (or similar slang insults depending on the point of view of the person who sees the Constitution as an irksome trump-card used to roadblock their agenda).

As someone who believes the Constitution was a work of genius that facilitated this country's ascent, I also feel that for all our modern failings, the Constitution is one of the remaining bulwarks helping keep us afloat. I am sad when I see it attacked so successfully and relentlessly by myriad disagreeing groups. Those who seek facile, overreaching, and quick government solutions to complex problems routinely want to ignore the limitations set by the Constitution, not realizing that deliberation and careful thought were and should remain a cornerstone of our governmental model.

[+] ChuckMcM|10 years ago|reply
I agree with that problem statement, but it arises I suspect from the desire to do something rather than nothing. After all, if your a politician and someone you care about comes to you with a problem, the last thing you want to say is "Well there really isn't anything I can do about that."

Often banishment by mandate is conceptually easier to grasp than actually fixing the problem. Take any complex problem, for example hand guns and gun violence, you can try to fix the inanimate thing "guns" or the actual thing "gun violence" but often "gun violence" is really just "violence", rooted in a lifetime of hurts and little access to support, but "gun" is something you can ban from the market. Easy to walk up to someone and say "you have a gun, that is banned." into the jailhouse you go, it is much harder to walk up to say "you have unresolved anger management issues with an inability to control those impulses with respect to your fellow humans, into the sanitarium you go."

The latter case fixes the problem and the former case fixes one of the symptoms. We all know that angry people without regard for human life don't need a gun to kill people, they can do that with cars, or baseball bats, or rocks for that matter. But it is easier as a politician to try to patch over the symptom because sometimes you can make that happen.

[+] stephengillie|10 years ago|reply
Lawmakers (smart ones, anyway) don't break laws; they make what they want to do legal, and then just do it. Give a person a hammer, and everything's a nail; give a person a lawmaking ability and suddenly everything's illegal. Even when inaction is the wisest course, it looks too much like indecisiveness to be politically feasible.

One of the problems is that we can't figure out a better system of using humans to govern humans. Do you think we'll ever develop the fabled Sci-Fi computer overlord to govern us? Will it end in the traditional "disaster of ignorance", where the members of society return to a child-like state, and are unable to maintain the great machine we've built?

[+] darkmighty|10 years ago|reply
Very good point, but the problem of this approach is not that it doesn't work, that things are not possible. It's The conditions under which it is possible, and the undesirable effects.

In other words, it's a naïve approach.

For example, take the Digital copyright problem in the music industry. Almost anyone would agree musicians should get paid; so legislators feel they have to 'solve it'. And indeed legislators can 'solve it' using just that naive approach: make it illegal, put a huge fine to it. So when you download a music, you will consider the risk of getting caught. The issue then is obvious: if you only legislate, the chance of getting caught will be very low, so most people won't care. But if you set the fine/punishment high enough, it's pretty much a given people will start being careful. But how much is enough? If you have a 1 in a million chance of getting caught this has to be astronomically large: if people simply thought about expected value (we don't exactly, just to illustrate), you'd need to charge millions per infringement. It's a totally unreasonable punishment, basically a terrible system. This is (an example of) why symptomatic legislation/treatment often doesn't work: it's grossly ineffective/inefficient, it's usually best (but way more complex/demanding) to address the root causes.

So the best solution to terrorism/criminal activity is obviously not a surveillance state, but unfortunately it works to an extent. I feel legislators don't have at their disposal enough tools to handle the complexity of better solutions. It would be good if we could involve academia/industry way sooner in direct collaboration with legislators, reaching effective solutions -- I feel science is indispensable in finding them for most complex cases.

[+] idlewords|10 years ago|reply
A gun ban is a reasonable and effective way of reducing the number of school shootings, as any European on here will confirm. Not sure why you brought guns into this argument other than it being a pet issue.
[+] cmdkeen|10 years ago|reply
The problem isn't that they aren't changing anything they couldn't do before, namely reading communications, post, telephones etc have always been accessible to the state. The problem is that technology has allowed two things: a) Secure communications channels the government can't read b) The state to monitor mass communication in a way even the Stasi couldn't using humans

The notion that you should be able to communicate in a way that your government can't monitor if necessary is a comparatively new one, and one you will find an awful lot of citizens don't agree with.

[+] cmurf|10 years ago|reply
No one ever said sovereigns always come to the correct conclusion. That's not their mandate. It's social order. That's why it's important for citizens, and their representatives in this case, to be educated, and have the ability to affect decisions of the government. Sadly those with the most influence right now are simultaneously of narrow vision, and aren't that educated right now.

When Comey says that "two sides are talking past each other" who are on the other side? Because it's inappropriate for him to propose "two sides" are crypto experts and non-experts should be given equal weighting in the debate as if effectively breaking encryption has only mainly upsides.

[+] girmad|10 years ago|reply
Legislators job is to legislate, so this makes sense. Making laws IS the only tool at their disposal.

Of course when you're dealing with a hammer, everything will look like a nail.

[+] bshanks|10 years ago|reply
One potential fix is to insert a countervailing bias into political procedures to make it harder for restrictions on freedom to get passed. For example, one could say that a simple majority (>50%) is enough to repeal rules, increase individual rights, or decrease government authority; but a >=60% majority is needed to do the opposite (create new rules, decrease individual rights, increase government authority).
[+] jsprogrammer|10 years ago|reply
This paragraph is a manifestation of a problem with how people think about governments: Governments are not conscious or even sentient. There are no physical entities, 'governments', no matter how many times you refer to it in your language. There are interpretable codes, people who execute the codes, and people who assign the codes.
[+] yuhong|10 years ago|reply
Another one on my list is anti-discrimination laws. A better idea if it absolutely have to be done is to impose anti-discrimination restrictions on specific companies.
[+] jedmeyers|10 years ago|reply
Well, a lot of things are possible, but implementing a knee-jerk legislation usually is not a way to achieve it.
[+] CamperBob2|10 years ago|reply
When the only tools you have are a pen and a gun...
[+] dominotw|10 years ago|reply
There is always oppression in a democracy.
[+] beedogs|10 years ago|reply
The way I see it, law enforcement has had it far too easy for far too long. The Snowden revalations finally turned over all the rocks and people saw that they have been grossly overstepping both ethical and legal boundaries, and encryption is finally getting the mindshare it desperately needs.

So to their petulant cries of being unable to read our communications anymore, I say: fuck 'em. Time to earn your keep now, boys. You're not going to destroy our Internet just so you can keep feeding the mass-surveillance beast.

[+] LordKano|10 years ago|reply
I want law enforcement to be a difficult, time consuming job.

Idle law enforcement is a terrible thing. When law enforcement has spare time, they will find ways to occupy it. Sometimes it will be by overzealous enforcement of low level laws and other times their idleness will be used an a pretext for politicians to pass even more micro-managing laws.

It's this kind of thing that led to women being arrested for wearing bathing suits that exposed their calves. It's this kind of thing that resulted in young men being arrested for the bad fashion decision of sagging jeans.

When they complain that something will make their job more difficult, I say good. I want law enforcement to be difficult and time consuming so that it loses its luster for the people who want to join up for all of the wrong reasons.

[+] tremon|10 years ago|reply
I have a lot of trouble viewing anything involving the NSA as "law enforcement". Like the CIA, aren't they specifically created to subvert the law in other countries and not operate in their own jurisdiction?
[+] a3n|10 years ago|reply
> “Such access will open doors through which criminals and malicious nation-states can attack the very individuals law enforcement seeks to defend,”

And there's the nut. The concern of law enforcement is not protection of citizens, it's ease of prosecution and resume building.

No one can claim credit for a general environment of ongoing secure communication, but cops and prosecutors can definitely claim credit for specific arrests and prosecutions, even if that general security environment is all but destroyed.

In fact, the more breaches, the more crimes, the more cops and prosecutors are needed. Job protection.

[+] gnu8|10 years ago|reply
The headline belies the utter ridiculousness of the idea. Why would the United States and United Kingdom be singled out to have backdoor access to all communications? To hang onto the tattered remnants of their empires while keeping their own people in line despite their declining political legitimacy.
[+] DamnYuppie|10 years ago|reply
If one looks around they will see most political regimes are very interested in keeping their "constituents" in line and maintaining their political legitimacy. As such it isn't a phenomenon specific to the west, it simply appears to be discussed here as we have slightly more open media than in other countries who would dearly love to have the same access to encrypted data.
[+] higherpurpose|10 years ago|reply
I actually wouldn't be surprised at all if the US and UK governments would be perfectly fine with China, Russia and so on being able to hack and spy most of their citizens and companies as long as they could also do that.

From their point of view it might be quite a good trade-off, because they probably think it's far more useful for them to spy and hack US and UK citizens than it is for China and Russia.

And they also probably think that they, the elites, could use something better than what everyone else uses, too. So there's no negative to this.

[+] jebblue|10 years ago|reply
The united States isn't an empire, that's what it was formed to get away from. It's a collection of people, living in different communities called states that strive to stay united to form a more perfect union. It isn't a perfect experiment because people are not perfect but it's the best effort history has seen so far.
[+] happyscrappy|10 years ago|reply
Maybe you think that China is ascendant, but the fact remains that the West is closely aligned and utterly dominant.
[+] graycat|10 years ago|reply
They can "oppose" all they want.

That's why we have PGP, in open source.

And that's why in the US we have:

"Amendment IV

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

I know; I know: Various people working for the people are all wound up about wanting to know and wanting to be sure, wanting to be sure they know just what is in all those e-mail messages. Their thinking might go:

"Those messages, they are sending lots of messages, are they planning something? Are those people up to something? Are we at threat? We want to know. Why do they encrypt their e-mail messages if they have nothing to hide?

"If they have something to hide, then definitely for the good of everyone we should know about it and they shouldn't use encryption. Else they might be planning something. If they have nothing to hide, then they shouldn't mind our knowing and shouldn't use encryption.

"Yes, definitely we should have full access to all e-mail and other communications, computer hard disks, private conversations, private thoughts, etc."

That's what some people working for the people think.

Sorry, guys, I'm one of the people you are working for, and you will just have to do your job without violating the Constitution. It's an old story, as is encryption, and e-mail, the Internet do not fundamentally change the situation.

[+] cortesoft|10 years ago|reply
Your first part is why I always find these talks silly. Encryption (at least the kind they are talking about) is just math - all the laws in the world aren't going to change the math. You can't legislate away the knowledge of that math; even if you force Apple or Google to insert your backdoor into THEIR implementation of the crypto, that doesn't mean that a 'terrorist' couldn't just use their own implementation of the readily available and widely known algorithms. That cat is out of the bag; you can't legislate it back in.
[+] conover|10 years ago|reply
Despite the political element, there is a poor history of keeping these kind of keys/methods secret. See the AACS encryption fiasco, the cable card hacking wars over the last decade, Clipper chip mentioned in the article, etc.
[+] domfletcher|10 years ago|reply
My favourite quote on this (from the UK perspective) from Ross Anderson (one of the co-authors): “A point I would like to make to the prime minister and his circle is: whoever put the prime minister up to this should get a complete bollocking. The proposals are wrong in principle and unworkable in practice.”

There is no quicker way of alienating people who understand complex things than by pretending that you know better and have thought of a brilliant solution.

[+] rm_-rf_slash|10 years ago|reply
Being HN I'm sure many of us have dreams about future computers that are seamless extensions of our bodies, doing more than we could ever imagine with a phone or a watch.

Do we also have nightmares about a hacker stealing a government's back door key and giving us a heart attack in our sleep?

[+] ionised|10 years ago|reply
At this point I'd be more worried about the government giving me a heart attack in my sleep.

They can't and shouldn't be trusted with this kind of power.

[+] noir_lord|10 years ago|reply
> Do we also have nightmares about a hacker stealing a government's back door key and giving us a heart attack in our sleep?

While hackers interfering with embedded devices in people is worrying I'd be more frightened about bugs in the devices from sloppy minimum cost systems.

While not awesome current stuff is ok(ish) largely because it's a relatively small market so the people in it are better than the average dev.

I've been programming a long time, I'm a reasonably talented developer and I wouldn't touch that stuff at all.

[+] gonzo41|10 years ago|reply
Have you seen Ghost in the Shell? I'm don't more integrated computers are the answer.

But on the encryption front, the more the better. If everyone adds complexity then 'they' have to discriminate more. Which is good for everyone.

[+] jakeogh|10 years ago|reply
The attack on our ability to encrypt is in the end an attack on the right to private thought. Loosing this, while we merge with our digital creations, is an existential threat.
[+] jackgavigan|10 years ago|reply
Perhaps governments need to apporach the problem from a different angle: How can we limit the extent to which bad actors (e.g. terrorists, organisaed crime, etc.) can benefit from private/secure communications technologies without compromising civil liberties and our citizens' right to privacy?

If anyone can solve that problem, surely it's us - the technologists, the problem-solvers?

[+] adestefan|10 years ago|reply
How is there no mention of CALEA[0] in this document? They even hint at it in the Executive Summary:

Indeed, in 1992, the FBI’s Advanced Telephony Unit warned that within three years Title III wiretaps would be useless: no more than 40% would be intelligible and that in the worst case all might be rendered useless [2]. The world did not “go dark.” On the contrary, law enforcement has much better and more effective surveillance capabilities now than it did then.

[0] https://en.wikipedia.org/wiki/Communications_Assistance_for_...

[+] mc808|10 years ago|reply
"Michael S. Rogers, the director of the N.S.A., has proposed that technology companies be required to create a digital key that could unlock encrypted communications, but divide and secure the key into pieces so that no one person or government agency could use it alone."

Conveniently, Microsoft has a patent on just that. http://www.google.com/patents/US8891772

Michael S. Rogers should disclose any financial interest he may have in Microsoft. Or does he have something to hide?

[+] naveen99|10 years ago|reply
They already ban encryption on ham radio... :(

Maybe somebody can start a pay to broadcast service using namecoin atomic name changes https://wiki.namecoin.info/?title=Atomic_Name-Trading 1. Service announces public nmc pay to address. 2. People mail them a message as a name update transaction combined with payment to that address using snailmail. 3. They broadcast if the perceived risk of broadcasting is less than the value of fee provided.

This could be anonymous and encrypted if the source name coins are sufficiently anonymous.

[+] forgottenpass|10 years ago|reply
They already ban encryption on ham radio... :(

This bugged me too, but ham is already not general purpose. I've come to accept it as the cost of preventing a disallowed uses of the ham bands inside an impenetrable envelope of allowed use.

And besides, it's usually possible (but less fun) to set up (or use existing) radio networking links in different bands.

[+] d_theorist|10 years ago|reply
Would it have killed them to link to the paper?
[+] johanneskanybal|10 years ago|reply
Can we stop the sharing of pay-walled content please, just pick another source?

ot: What do they (cameron and c/o) think the best case scenario is for this folly? Disrupt a few mainstream services while pissing everyone off in the process whilst the real criminals move on to slightly more obscure services?

[+] a3n|10 years ago|reply
> The costs to the developed countries’ soft power and to our moral authority would also be considerable.”

That moral authority undermined in part from the risk of secure government data being exposed, and government operations then being exposed.

Breakable encryption is definitely a double-edged sword.

[+] EGreg|10 years ago|reply
How would they feel if China and Russia was given the same backdoors? What would they legislate then? It's not as if internet traffic can be quarantined.
[+] delinka|10 years ago|reply
Can't it? The Great Firewall is a shining example.

(all irony intended.)

[+] hellbanner|10 years ago|reply
Right - and "the government" isn't a single entity. Members can defect (ala: Snowden and others).
[+] logfromblammo|10 years ago|reply
Members can also corrupt, or even just operate too long without the moderating effects of effective oversight.