Don't Panic: Seeking Points of Agreement on the “Going Dark” Debate

https://cyber.law.harvard.edu/pubrelease/dont-panic/

by finnn • 10 years ago

103 78 10 years ago

cyber.law.harvard.edu

jcr• 10 years ago

The submitted berklett "Don't Panic" article has a "Bruce Schneier" link to his "Security or Surveillance?" article on lawfareblog.com. It's also good reading.

[1] https://lawfareblog.com/security-or-surveillance

kmonsen• 10 years ago

This is what the debate is all about. The government wants to have surveillance of its citizens, but wants to call it something else.

Absentinsomniac• 10 years ago

My kneejerk reaction to this is to panic about the opposite of what the concern here seems to be. Seems to me like ubiquitous surveillance via any and all available technology is a bigger threat than "going dark" would be. I know encryption can provide an obstacle for law enforcement but my inclination is to worry about privacy in society over potential lawbreakers.

jeanetienne• 10 years ago

This ^

It seems to me that all this report is saying is: "Hey government, don't worry about tech 'going dark', we will still have the ability to spy on people through their poorly implemented Internet of Things devices, services that won't use end to end encryption, metadata, and because software is still fragmented."

But they don't seem to even slightly condemn the simple fact that governments are turning into surveillance machines...

CapitalistCartr• 10 years ago

This fake crisis of "Going Dark" as if we haven't been that way for all of time before the Internet is dangerous. The "scary" notion that the police won't be able to read everything about everyone is being recast by the Feds as if it really is national crisis. Benjamin Wittes suggests on Lawfare we make Common Carrier Immunity conditional on the company being able to make all data available in the clear to the government. This is dangerous ground.

https://www.lawfareblog.com/out-box-approach-going-dark-prob...

hellbanner2• 10 years ago

I think (most) of us on HN are on the same page here. But we are a minority... many people truly don't care and are not incentivized to care.

danharaj• 10 years ago

i think people are incentivized not to care, which is subtly different but far more pernicious.

izacus• 10 years ago

For pretty much any political issue the people caring are a minority (on each side) with middle being populated with people who don't care or don't know what's going on.

Those people on the sides that do care then shape the debate and ultimately the outcome of pretty much any democratic decision (as little as those are still left).

bobby_9x• 10 years ago

Even look at public wifi. Most non-tech savvy people I know really have no problem using piblic wifi to conduct business and login into important accounts.

They want the path of least resistance, which isn‘t good for security or privacy.

obrero• 10 years ago

The facts which Wittes gives are way off. He links to "civil suits against the companies who provide service to ISIS and other bad guys". The civil suit is regarding a Jordanian police officer who shot and killed an American military contractor. Other than this lawsuit, almost nothing is linking the officer to ISIS. If you read the lawsuit, they really have nothing linking this officer to ISIS either, other than a vague statement from a supposedly official ISIS source.

So the link to this military contractor's death to ISIS is very tenuous. This has to be established first, and there is almost nothing to establish it on - he was a Jordanian police officer, not an ISIS militant. Then you have to say Twitter is engaged in running afoul of material support of terrorism laws. These laws generally would mean something along the lines of that in some back office of Twitter, Jack Dorsey was storing up Kalashnikov rifles which he was going to ship to the Taliban in order to assault American bases there.

In 1929, the Republican (!) Secretary of State rolled up all the old World War I spying operations saying "Gentlemen do not read each other's mail". How far the US has fallen in freedom from the day Stimson uttered those words a century ago.

mirimir3• 10 years ago

Republicans in 1929 were more or less what we today call libertarians. Or maybe Victorians. Honor, and all that.

munin• 10 years ago

In 1929, the Republican (!) Secretary of State rolled up all the old World War I spying operations saying "Gentlemen do not read each other's mail". How far the US has fallen in freedom from the day Stimson uttered those words a century ago.

He also turned it all back on, to 11, as the secretary of war, once stuff heated up in Europe.

rayiner6• 10 years ago

While I oppose things like encryption backdoors, I think it's disingenuous to say this is a "fake crisis." The 4th amendment has always required balancing security and privacy--that's why the distinction between "unreasonable searches" and reasonable ones appears right there in the text. And society has always balanced those two interests with a simple mechanism: the police can only search with a warrant, but once they have a warrant their power to search is nearly limitless.

Thus, the government has always had a way to search the long-distance communications mechanisms of its day. Wiretapping telegraph or telephone lines was not deemed a violation of the 4th amendment until 1967. Even after that, a wiretap was authorized with a warrant.

Now, you have a pervasive mechanism of long-distance communications, and it's increasingly opaque to the government, even with a warrant. That's an unprecedented state of affairs.

JoshTriplett4• 10 years ago

Prior to the Internet, cipher schemes existed that could delay or foil the best government analysts, and that took significant government efforts to even attempt to crack. It was never illegal to use such a code and transmit the result on a letter, postcard, or phone. And a government warrant would not compel the decipherment of such a scheme, unless someone had possession of a physical key usable for decipherment.

The two differences now: we've made that technology available to non-experts, and we hope that no amount of government effort can crack the scheme (as opposed to obtaining the key).

I agree with your comment that it's not a "fake crisis", though. It's one with only one right answer, but it's a "crisis" in the sense that no possible path forward will make both parties happy, so we fundamentally need the government to either realize they're wrong or to lose. Government positions don't change easily, and governments do not like to lose.

While it bothers me to see terms like "common ground" used, as they imply that both positions have grounds worth considering, I do think one of the few paths that has a hope of success is to convince the government that there exists a position they can adopt that doesn't look like it goes back on their current stance.

schoen2• 10 years ago

We could also say that Americans have always had a right to encrypt their long-distance communications, and the government is now questioning this right for what may be the first time.

http://vjolt.net/vol2/issue/vol2_art2.html

As Eben Moglen also observed in a closely related context, Americans have also always had the right to use languages or shorthands of their choice when communicating, many of which significantly (perhaps even entirely) hindered the government from understanding them, and sometimes by design.

http://old.law.columbia.edu/publications/yu-encrypt.html

Zigurd4• 10 years ago

Warrants have never enabled truly limitless powers of search. Aerial search, blood tests, etc are new inventions, and nothing says that technology always favors the searcher. "Unprecedented" just means "get used to it."

rsync• 10 years ago

"While I oppose things like encryption backdoors, I think it's disingenuous to say this is a "fake crisis." The 4th amendment has always required balancing security and privacy--that's why the distinction between "unreasonable searches" and reasonable ones appears right there in the text."

That would be mildly interesting - if this were a 4th amendment issue. It's not.

It is a first amendment issue. If I choose to communicate with you with a (seemingly) random stream of numbers, that is protected by the 1A of the Bill of Rights. Just like a KKK rally.[1] Just like burning a cross.[2] Just like Piss Christ.[3]

[1] https://en.wikipedia.org/wiki/Brandenburg_v._Ohio

[2] https://en.wikipedia.org/wiki/Virginia_v._Black

[3] https://en.wikipedia.org/wiki/Piss_Christ

pash• 10 years ago

What's unprecedented to an even greater degree is the scale at which mundane communications are now recorded. In the past, the bulk of private communications were opaque to the government, even with a warrant, because people exchanged private information mostly verbally, face to face.

Today many analogous conversations take place online, in instant messages, in email, and in other persistent media. Even when the content of a communication isn't recorded as an artifact of its medium of expression and transmission, there's almost always a record left behind to indicate that the communication took place, revealing associations and hinting at what was said.

So by emphasizing the legal history of searches of "long-distance communications", you've moved the goalposts by a mile. Changes in the way we communicate with one another, reflecting changes in communications technology (and changes in society), mean that governmental powers in searches and surveillance, powers which formerly applied only to relatively rare forms of communication, now apply very broadly. At the same time the government's cost of performing such searches and surveillance has plummeted, multiplying the power of police and spies to monitor our words and use them against us.

It's an unprecedented state of affairs, indeed.

vgugghvhu• 10 years ago

A government which condones torture and war crimes is no longer a legitimate sovereign.

libeclipse• 10 years ago

Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety

mirimir3• 10 years ago

The 4th Amendment doesn't protect foreigners.

PhasmaFelis• 10 years ago

The government has always been able to spy on people, but before the internet, it was hard, so there was a motivation for them not to waste time and resources on it without real justification. (Not to say that surveillance never happened for stupid or malicious reasons, but there was at least a practical cap.)

In the age of the internet, that protection has been lost, and the government has taken advantage of the increased ease of surveillance to try to monitor everyone, all the time. Unfortunately, there's no way to put the genie back in the bottle--we either put up with ubiquitous surveillance, or fight it; either way, the era of limited, focused surveillance is over.

defenestration• 10 years ago

To summarize: end-to-end encryption is making online surveillance harder. However, standards for end-to-end encryption are still fragmented and companies have incentives to not adopt it. Besides that, connected sensors, 'the internet of things' and unencrypted metadata give new surveillance possibilities.

its2complicated• 10 years ago

"legitimate government interests" should be enough to scare everyone. It's not for criminals, just like gun control is not about criminals. Think the worst, 'cause it don't get any better!

mmaunder7• 10 years ago

If we could only make them understand that forcing the good guys to not encrypt doesn't take encryption away from the bad guys. Legislators don't understand that encryption doesn't have to be made by Apple for the bad guys to have encryption. A shared key and XOR gives you unbreakable encryption. A high school comp sci. kid could implement that.

fleitz2• 10 years ago

Incorrect, if the key is shared the encryption is breakable. If you're just doing one round of XOR it's pretty easy to break the key given a known plaintext, in the same way that AES is very breakable in ECB mode.

For unbreakable encryption, I'd suggest XORing with the contents of /dev/random (assuming /dev/random is unknowable). Of course decryption may be an issue.

schoen2• 10 years ago

In context, I'm sure the parent commenter meant "a random key the same length as the plaintext", not a repeating key or a reused key.

mmaunder7• 10 years ago

Wrong. It's just not secure in all contexts e.g. your example where you have a known plaintext that you can use to crack the key which then lets you decrypt something encrypted with the same key. You're discovering why XOR isn't widely used in a real-world setting.

dllthomas• 10 years ago

"If you're just doing one round of XOR it's pretty easy to break the key"

If you're doing two rounds, it's even easier!

venomsnake• 10 years ago

yep. Crete 3tb of one time pads, exchange hard disks and enjoy.

hellbanner2• 10 years ago

Related: Apple's patent for "polluting online social networks with fake profiles".. based on variants of the real profile.

http://www.darkreading.com/risk-management/apple-gets-patent...? (Or google for other articles)

fredgrott• 10 years ago

put in proper context

Imagine if its WWII and that they asked for all mail to be un-sealed..Shocking but did almost happen..as far as they got was asking Military Personnel to 'volunteer' not to seal mail..

marshray2• 10 years ago

They forced everyone to turn in their shortwave radios too.

kwhitefoot• 10 years ago

Who? Where? In the UK that would have meant pretty much every radio would have had to be given up. At least every radio I have seen from the period had LW, MW, and SW.

cubano• 10 years ago

Something learned in my 30y career as low level felon and spending fairly significant amounts of time (to me at least...a week in jail is no picnic!) locked up in both jail and prisons...

95% of cases are made via informants and not CSI-type investigations, so the whole "going dark" thing, I feel, isn't going to affect law enforcement the way a lot of people think it might.

I did notice, however, my last time through the system last year, that the State is now making a bunch of cases using cell tower information to put the defendants near the crime scene during the approx time of the situation.

Just FYI.

bigiain• 10 years ago

"isn't going to affect law enforcement" - at least the way it is now (and has been forever), but it greatly affects the way law enforcement would _like things to be_.

And I'm not at all happy with the implications of what "they" want...

LordKano• 10 years ago

Going dark has a significant effect on law enforcement. It'll force them to rely on active investigations instead of passively collecting data that they can review at their leisure.

I think this will reduce their ability to target people for political reasons.

mmaunder7• 10 years ago

If you want to beat it, brand it. Obamacare, The Surge, War on Terror. Going Dark is just the latest. Expect letsnotencrypt.gov any day now.

dragonwriter• 10 years ago

If you want to beat it, brand it. Obamacare, The Surge, War on Terror.

The Surge and the War On Terror were branded by their supporters. Obamacare was branded that way by those trying to defeat it, but it hasn't worked. So, not sure your examples illustrate your point.

mmaunder7• 10 years ago

I shall be sure to quote more pertinent examples in future.

voodootrucker• 10 years ago

Why do we need to agree? That's how this works. You compromise a bit, and they don't budge. Then you compromise again. Repeat the process until all liberties are gone.

Also, why is this framed as "going dark"? That's the ignorant people's wording. Why doesn't the author call it what it is: key escrow, or back-dooring? Use the terms of the industry you are talking about.

batz2• 10 years ago

It's not just about tech. The real issue is that government is running up against scaling limits.

Arguably, a government can only rule over how people relate within boundaries it can defend and control. Previously the boundaries were physical geographies, and then regulated channels (mail, PSTN, etc). Now, we have a kind of fractal boundary of peer-to-peer connections that provide tremendous freedom to organize and transact on a diminishingly microscopic scale.

Sovereignty is zero sum.

Crypto provides a kind of micro-sovereignty to users, and for a few privileged or outlying people this is an acceptable risk, but when you have constituencies of people achieving that micro-sovereignty, it cuts into the sovereignty of the state at critical level.

Imagine the strategic consequences for U.S. national security if Rhode Island became it's own country, with an impenetrable laser air shield, with it's own allies, currency, tax laws, extradition treaties, defense systems, resources, etc. It would be such a constant threat, it would make more sense to just invade.

Tor and similar systems could reach that critical mass, where they become a constant threat to the sovereignty of nations. Tech is naively forcing hard questions about the conventions that provide "stability."

The feds know they might just have to just outlaw crypto. The technology exists to detect and round up most people who use it, or enough of them that it will be hard to find people to use it with. If they have to, they will.

This dance they are doing is political posturing, testing the edges to see what kind of resistance they get, and how much political capital it is going to cost.

Like voting and graffiti, if crypto really changed anything, it would be illegal.

milesokeefe• 10 years ago

Is graffiti not illegal?

simoncion• 10 years ago

I've never lived in a district where it wasn't.

marcosdumay• 10 years ago

Don't know about your place, but here it's only illegal if done against the will of the wall's owner.

batz2• 10 years ago

Banksy reference. he tagged, "If graffiti changed anything it would be illegal."

mirimir3• 10 years ago

There's an underlying issue that the report dances around, but doesn't address directly: sovereignty. Understandably enough, US authorities expect US companies to comply with US law. When foreigners are involved, as users or counterparties, things get iffy. Diplomatic relationships, treaties, agreements, etc become dispositive.

For example, the US supports Chinese dissidents, and maybe Thai dissidents, but for sure not ISIS. And so decrypted ISIS messages would be widely shared, but decrypted messages from Chinese dissidents would not be shared with China.

Old-school sovereignty just doesn't work on the Internet. If the US pushes hard enough, some firms will fold. But some may just leave. Consider the extent to which Apple has already left the US, for tax purposes.

unicornporn• 10 years ago

Apparently, authorities are not really worried: https://theintercept.com/2016/02/01/is-law-enforcement-going...

Zigurd4• 10 years ago

Regulating strong encryption out of consumer products is functionally the same as banning it. Using encryption would draw special attention. Encryption needs to be routine in order to protect the public, outside of special situations.

Don't Panic: Seeking Points of Agreement on the “Going Dark” Debate

Related Stories