(Original posting date: 13 December 2015)
Despite a lack of firm evidence to suggest that the terrorist attackers in Paris, in San Bernardino, or at the Planned Parenthood center in Colorado used strong (or perhaps any) encryption to plan their killing sprees, government authorities around the planet — true to the long-standing predictions of myself and others that terrorist attacks would be exploited in this manner — are once again attempting to leverage these horrific events into arguments for requiring “backdoor” government access to the encryption systems that increasingly protect ordinary people everywhere.
This comes despite the virtual unanimity among reputable computer scientists and other encryption experts that such “master keys” to these encryption systems that protect our financial and ever more aspects of our personal lives would be fundamentally weakened by such a government access mechanism, exposing us all to exploits both via mistakes and purposeful abuse, potentially by governments and outside attacks on our data.
It’s difficult — one might say laughable — to take many of these government arguments seriously even in the first place, given the gross incompetence demonstrated by the U.S. government in breaches that exposed millions of citizens’ personal information and vast quantities of NSA secrets — and with similar events occurring around the world at the hands of other governments.
But there are smart people in government too, who fully understand the technical realities of modern strong encryption systems and how backdoors would catastrophically weaken them.
So why do they continue to argue for these backdoor mechanisms, now more loudly than ever?
The answer appears to be that they’re lying to us.
Or if lying seems like too strong a word, we could alternatively say they’re being “incredibly disingenuous” in their arguments.
You don’t need to be a computer scientist to follow the logic of how we reach this unfortunate and frankly disheartening determination regarding governments’ invocation of terrorism as an excuse for demanding crypto backdoors for authorities’ use.
We start with a fundamental fact.
The techniques of strong, uncrackable crypto are well known. The encryption genies have long since left their bottles. They will not return to them, no matter how much governments may plead, cajole, or threaten.
In fact, the first theoretically unbreakable crypto mechanisms reach back at least as far as the 19th century.
But these systems were only as good as the skill and discipline of their operators, and errors in key management and routine usage could create exploitable and crackable weaknesses — as they did in the case of the German-used “Enigma” system during World War II, for example.
The rise of modern computer and communications technologies — desktops, smartphones, and all the rest — have allowed for the “automation” of new, powerful encryption systems in ways that make them quite secure even in the hands of amateurs, and as black hat hacking exploits have subverted the personal data of millions of persons, major Web and other firms have reacted by deploying ever more powerful crypto foundations to help protect these environments that we all depend upon.
Let’s be very, very clear about this. The terrorist groups that governments consistently claim are the most dangerous to us — al-Qaeda, ISIL (aka ISIS, IS, Islamic State, or Daesh), the less talked about but at least equally dangerous domestic white supremacist groups, and others — all have access to strong encryption systems. These apps are not under the control of the Web firms that backdoor proponents attempt to frame as somehow being “enemies” of law enforcement — due to these firms’ enormously justifiable reluctance to fundamentally weaken their systems with backdoors that would expose us all to data hacking attacks.
What’s more — and you can take this to the bank — ISIL, et al. are extraordinarily unlikely to comply with requests from governments to “Please put backdoors into your homegrown strong crypto apps for us? Pretty please with sugar on it?”
Governments know this of course.
So why do they keep insisting publicly that crypto backdoors are critical to protect us from such groups, when they know that isn’t true?
Because they’re lying — er, being disingenuous with us.
They know that the smart, major terrorist groups will never use systems with government-mandated backdoors for their important communications, they’ll continue to use strong systems developed in and/or distributed by countries without such government mandates, or their own strong self-designed apps.
So it seems clear that the real reason for the government push for encryption backdoors is an attempt not to catch the most dangerous terrorists that they’re constantly talking about, but rather a selection of “low-hanging fruit” of various sorts.
Inept would-be low-level terrorists. Drug dealers. Prostitution rings. Free speech advocates and other political dissidents. You know the types.
That is, just about everybody EXCEPT the most dangerous terrorist groups that wouldn’t go near backdoored encryption systems with a ten foot pole, yet are the very groups governments are loudly claiming backdoor systems are required to fight.
Now, there’s certainly a discussion possible over whether or not massively weakening crypto with backdoors is a reasonable tradeoff to try catch some of the various much lower-level categories of offenders. But given the enormous damage done to so many people by attacks on their personal information through weak or improperly implemented encryption systems, including by governments themselves, that seems like an immensely difficult argument to rationally make.
So our logical analysis leads us inevitably to a pair of apparently indisputable facts.
Encryption systems weakened by mandated backdoors would not be effective in fighting the terrorists that governments invoke as their reason for wanting those backdoors in the first place.
And encryption weakened by mandated backdoors would put all of us — the ordinary folks around the planet who increasingly depend upon encrypted data and communications systems to protect the most intimate aspects of our personal lives — at an enormous risk of exposure from data breaches and associated online and even resulting physical attacks, including via exploitation from foreign governments and terrorist groups themselves.
Encryption backdoors are a gleeful win-win for terrorists and a horrific lose-lose for you, me, our families, our friends, and for other law-abiding persons everywhere. Backdoors would result in the worst of the bad guys having strong protections for their data, and the rest of us being hung out to dry.
It’s time to permanently close and lock the door on encryption backdoors, and throw away the key.
No pun intended, of course.
Be seeing you.
–Lauren–
I have consulted to Google, but I am not currently doing so — my opinions expressed here are mine alone.