The Privacy BlogThoughts on privacy, security, and other stuff.

This NYTimes article discusses a bill which the Obama administration is proposing to submit to congress. The general background of the bill is that evolving technology has made it more difficult for law enforcement to conduct effective wiretaps and other intercepts because much of the targeted communication now takes place on the Internet and is often encrypted.

The actual text of the proposed bill does not appear to be available, but the article lists the following likely requirements.

  1. Communications services that encrypt messages must have a way to unscramble them.
  2. Foreign-based providers that do business inside the United States must install a domestic office capable of performing intercepts.
  3. Developers of software that enables peer-to-peer communication must redesign their service to allow interception.

The first of these is similar to the CALEA law which requires telecommunications carriers to design their services to enable automated real time intercepts. While this generally sounds reasonable when “we” say it, the idea is more ominous when coming from some other governments.

The second of these feels uncomfortably familiar. See my past blog posts (and here)on the attempts of privacy hostile countries to require similar concessions from RIM.

The third proposal is completely outrageous. In effect it says that I may not speak in a way which is unintelligible to the wire tappers. As a colleague quipped “I am hiring Navajo code talkers.” This would require a back door be inserted in to cryptography tools. Experience shows that any crypto system with such a back door will be breached and then left vulnerable to the enormous number of criminal hackers on the Internet today.

In 1993 the US Government proposed a system called the “Clipper Chip” which would provide all encryption for personal computers, but to which the US Government would have back door access. This was a terrible idea then, it was widely ridiculed, and suffered a well justified death by 1996. This third proposal would be much worse. It is asking huge numbers of non-crypto experts to build back doors in to their systems. Frankly, the cryptography in most software is already badly broken in many cases. Something as subtle and complex as a secure and effective law enforcement back door would be far beyond their abilities and render currently poor security completely untrustworthy.

All this is not to mention the potential abuse by oppressive regimes, who will pounce on the capability to further crush dissent within their countries. Finally, it will be largely ineffective against serious threats. Very strong and easy to use cryptography is already available world wide, for free (GPG, ZPhone, TrueCrypt, etc.). This is a classic case of damaging the innocent while leaving the guilty and dangerous unaffected.

It seems to me that there is a pendulum swing to these things. Technology cuts both ways. Some times it favors the interceptor and some times it favors the communicator. In most ways the Internet has been a fantastic boon to law enforcement. Cloud computing, email hosts, social networking, open WiFi, and huge hard drive that encourage people to save everything all provide law enforcement with enormous amounts of information they could never have collected in the past.

It may not be shocking to anyone that there is no federal push to make that more difficult to access while pushing to enhance their ability to intercept encrypted communications.

All this is argument about a bill we have not seen yet. Let us hope that the furor that has swirled around it will cause it to be retraced or modified significantly before it is actually delivered to congress.

No tags

1 comment

  • Anon Tor · October 20, 2010 at 5:21 pm

    The NY times article uses some interesting phrasing “The bill, which the Obama administration plans to submit to lawmakers next year, raises fresh questions about how to balance security needs with protecting privacy and fostering innovation”.

    In fairness if the bill is indeed passed it will actually do more for innovation in the absolute sense as there will always be people who will create better techniques to work around. Except that given it will be off the records it will be more difficult to access and the lay public would have to rely on obscure shady sources in order to gain access to it. Some of whom will indeed be true to their word. While others including the intelligence gather agencies will have an insincere motive. Again leading to the scenario you mention where the system might be abused by those who can and want to. But then, the cynic in me says, has it not always been the case?

    As the old Assyrian Quote goes

    “Our Earth is degenerate in these later days; there are signs that the world is speedily coming to an end; bribery and corruption are common; children no longer obey their parents; every man wants to write a book and the end of the world is evidently approaching.”

    (2800 BC)

    One just needs to get some perspective and well maybe a bit of smartness would do :)

    Anon

Leave a Reply

<<

>>