Re: Obama on Fetishizing Our Phones

A while back he advised some kids in College to never type anything into a computer if they want it to remain private. For him, it probably seems completely reasonable. I doubt he's touched a keyboard since he became president. His daughters are the only teenagers in America who've never been near Snapchat (the Secret Service will keep it that way). And he's literally surrounded by security officers and spooks everywhere he goes. They manage every interaction he has so you can imagine their worldview is going to affect him.

I'm not trying to make excuses for him. He's so completely off the deep end nowadays (between this and TPP) that it's heartbreaking as a long time supporter. I hope he leaves the presidency, leaves Washington and spends a few years thinking about what went wrong before writing his memoirs. It would be an amazing insight into the corrosive influence of Washington on a person's integrity.

Obama's campaign promises are as empty as those of any other politician. He's used his presidency to bring a windfall to the Halliburtons of healthcare and escalated the war on whistleblowers and the attack on privacy.

His successor will do the same.

We can hope that his supporters become appropriately disillusioned, but so much of politics is about loyalty in exchange for spoils, not ideas or accountability, so I'm not optimistic.

I voted for Obama twice. I regret both.

Ted Cruz/Paul Ryan/Ron Paul might be the closest thing to that. Bernie Sanders, maybe, although I'd have a hard time seeing him maintain an 8 year long fight. Everyone else is basically establishment to some degree (Trump doesn't strike me as ideological as much as opportunist++, although certainly different in style than the others.)

(And maybe you want someone reasonable/rational/etc. but not ideological as President.)

I haven't always been happy with some of his decisions and policies. But, my guess is that he's constantly being whispered the worst case scenarios.

A president probably feels responsibility for the well being of hundreds of millions of people. And, all that it takes are a few highly polished ex-lobbiest communicators whispering, 'if you won't strengthen this program, Mr. President, then a terrorist will unleash a dirty bomb on the east coast and injure tens of millions.' Who would want to be responsible for that? 'Oh, just wiretap citizens? I guess that doesn't seem too bad if it's an either-or-decision.'

Unfortunately, I don't see a way out of this mess. Bin Laden won when he turned the US into a 24-7 terror watch. Now, we live by fear and over-protection against an enemy that we can't see.

According to who? The definition of liberty is still a matter of philosophical debate, as far as I understand it.

What did you expect?

I'm not sure this is the argument to make to Obama and the DOJ. They are already framing this as a privacy issue

The factors they understand are the public safety and economic impacts. Let us speak to those points and allow privacy to be a secondary concern. Obama himself told President Xi last year that the exact same policies would dramatically hurt Xi's economy [1]

[1] http://www.reuters.com/article/us-usa-obama-china-idUSKBN0LY...

He's at fault for keeping them in place, but that's about it.

It's about security vs. security. [1] [2] [3]

On balance, putting backdoors in phones will make us less secure, because criminals will just use other methods to communicate, and the public will be putting their data within reach of every hacker in the world through a government-imposed weakness.

The administration is unlikely to understand our privacy concerns. They do understand economic and public safety issues, and it is the facts around these issues that we must share with them. President Obama himself told President Xi last year that introducing backdoor legislation would hurt his economy [4]. Let's make Obama's argument back to him

[1] https://youtu.be/g1GgnbN9oNw?t=3h35m52s

[2] https://youtu.be/g1GgnbN9oNw?t=3h11m46s

[3] https://youtu.be/g1GgnbN9oNw?t=3h19m39s

[4] http://www.reuters.com/article/us-usa-obama-china-idUSKBN0LY...

There's no good reason they have to have access to electronic devices, they can install cameras and mics. It's just easier going straight to the phones and emails.

But they had that power and they abused it massively, and are now suffering the backlash, and why should privacy stop given they've demonstrated they can't be proportional in their surveillance?

They were not specific with what they got from the phones and emails, so they've demonstrated they're not responsible or measured and now strong encryption is necessary as government has clearly shown that secret courts === warrantless mass surveillance.

The other thing that's clear is that the US couldn't care less about privacy for anyone not in the US, so all us non-US citizen need this encryption to protect us from your peeping tom government.

Regulatory enforcement is fairly easy: in order to have a license to operate your coal plant, you agree to hand over documents x, y, z. If in your crypto-dystopia I handed over encrypted docs instead of the plaintext for my coal plant I would just have my business fined out of existence just like would happen now.

If I have incriminating documents and no crypto I'm not going to encrypt them, I'm going to slag the hard drives they're on and burn the paper copies.

If you're a public official: make it illegal to use encryption beyond the provided email encryption (which the agency IT dept can also read). I think you can make the case that it is already illegal since an internally encrypted message that you refuse to decrypt (at the request of a superior, a court, or investigation) would have to have been misuse of gov't property (your first amendment rights do not allow you to use government systems for private use and you explicitly have no privacy with respect to the scenario mentioned above when you use them).

People have always had plenty of ways to be shitheads and get away with it, and there have always been mechanisms to make those decisions costly. These things continue to be true despite the presence of strong crypto.

The reason an "absolutist" position here makes sense is because this is a binary choice between everyone legally having security, or no one legally having security. Until now we haven't had to make this choice because neither was an option, we just all existed in a vague middle ground dictated by our circumstances, number of shits given, and technical acumen. True, you might not have had access to cryptography, but you didn't have data to encrypt so you lost nothing by having no encryption. Now everyone has a lot to lose but not everyone realizes that.

In the past, Apple had your iMessage data, or at least the ability to decrypt it on-demand. It was understood that this data would be private by default, but would be disclosed to the government through an established, case-by-case process supervised by the courts. Everyone was pretty much OK with this. You and I got our data kept private, unless there was some material, specific reason for the government to suspect it was related to a crime. The government got to dump the data of people under investigation, if a court thought there was good reason to do so.

Then the government went nuclear. They said, here's a National Security Letter that compels you to give us everything you have. Bulk data. Any cooperation that is physically possible. You can't talk about it and you can't appeal to the courts. If you have to capability to MiTM all of your users and pipe everything to us, you have to do it. No oversight, no transparency and no safeguards. Whatever we do with the data is up to us.

In this context, what alternative do tech companies have besides to similarly escalate and build systems that make it physically impossible for them to cooperate?

The government destroyed the social compact between telecom providers and law enforcement with forced, secret bulk surveillance. If the government is willing to step back and make binding, unequivocal commitments that companies that do maintain the ability to decrypt their users' communications won't be forced to secretly use them en masse, maybe we can go back to the old status quo. But the government doesn't seem willing to do that. They want cooperation, but they also want the ability to bust in the back door with an NSL and say "give us everything, on everyone."

The legal system has become so tilted in the government's favour (see: the inability to challenge the constitutionality of bulk surveillance, because you can't prove it happened to you), that companies will no longer trust in the old procedural safeguards. The only thing we can trust is the mathematically proven safety of encryption. And that's the government's fault. So now we are forced to chose between absolute privacy and zero privacy.

So far, I think Apple is making the right choice.

In any case, I surely hope my bank is already practicing that kind of opsec. That doesn't mean they suddenly stop giving reports to the government. Why would it? That's just.. what?

And there's nothing preventing law enforcement to find about these by tons of other means, including checking suspected bank transactions with a warrant.

People determined to communicate without anyone hearing, e.g. to setup their tax-haven accouts-- can do it in 2000 ways. Mass surveillance is about all the others who casually exchange data and discussions.

>The end result of going full tilt on crypto is cryptoanarchy.

That sounds like, but is not, a thing.

Now the suspect's money is in a Goldman Sachs account and the bank tells the gov't they couldn't just break into their client's financial records and find out who transferred them money. This is a "secret trust" account where nobody - not even Goldman employees - can recover transnational records. What kind of precedent would that set? What about if China wanted to find out bank transactions?

Some say this is hate-crime is one of the worst in decades and it's worth finding out if we are at risk for more. Opponents say banking privacy is an absolute right.

Can anyone tell me if they story ran in national news, the CEO of Goldman would not be facing charges of treason right now?

Yet regulators seem to still be able to get the information they need. They're often nearly toothless, but that's because of politics, not technology.

fortunately, that never happens. Even the strongest defenses consistently fall to human error

Having access to proper crypto at all, as an option, does not mean everything will inevitably be encrypted and not controlled for. Companies will still have the power to set their own device rules and so on. There's plenty of existing laws in place to allow for any kind of reporting still happen; you do not need to break all crypto forever.

Yes, though I'd like to see your argument for that.

However, the failure mode of crypto-anarchy is perfectly secret digital companies arising, who then proceed to affect the real world for digital currency. (Such as a hitman, or an army of anonymous mercenaries conducting irregular warfare for hire.) So, basically large scale terrorism.

Probably much better than the failure mode of a bit overzealous police state.

> some of the same people who constantly criticize Swiss bank accounts, Cayman island financial shenanigans.

That's their shortsightedness. There are ways to tax that don't rely on looking into people's bank accounts. And a lot of the current expenditures could be replaced by projects that require proof of payment. So, you need to show a proof of payment otherwise no school for your kids, no healthcare, no pension, you can't use public roads, etc. And people can vote to enforce collection of money, just like now, foreclosure and repossession works on physical things.

> companies

People can vote to make records keeping mandatory (just like now), and employees have it in their interest to get things in writing. Otherwise they (also) go to jail if they did something really stupid. (It was an order is not an acceptable defense for some time.)

> Will Democracy be able to audit nothing of the interactions of citizens or our institutions in the future?

As it was unable to do so before digital records. And as it is unable to do so for criminal organizations.

And since cryptography exists and computing is becoming more and more accessible, it's getting easier and easier to maintain a secret organization with a secret ledger.

So, all in all, it's a bad thing to rely on those backdoors. It's not even a stopgap measure.

The biggest holdout will be operating systems - Google and Microsoft very much do not want to lose their backdoors (or front doors) into everyone's data. But within ten years, we will finally have a "year of Linux on desktops" in which both grandma and the young university student can both buy an Ubuntu computer and have it work how they need it to. And phones will run an OS that can't be maliciously updated remotely, and doesn't leak user data to apps and OS providers.

The final step will be near anonymous internet usage, which we are currently in the infancy of. There will be a shift to a more decentralized availability (but not necessarily storage) of data in most of the applications we use most often. Essentially Freenet, but without all the usability problems. The Facebook of the future will have open source (and encrypted) data where your info is only viewable to you and your friends. There are currently platforms that exist like this, but they are mostly in "testing" stages and are not ready for widespread use.

Um, this is pretty easy to refute: we've been complaining about copyright and DRM for ages now, and not only are they not waning, they're at least as strong now as they've ever been. There's no indication whatsoever that copyright law is going anywhere or being relaxed in any way, in fact it's the opposite. Sure, it's generally easy to copy digital stuff (absent DRM), but that doesn't make it legal, nor has the internet become a free-for-all (quite the opposite in fact; it's more dangerous to commit copyright violations now than ever I think). Same goes for DRM: despite all the complaints, DRM is still present in many places, and you still need to use it for things like watching Netflix. It is possible to defeat it (I'm not going to say technically easy though, because a lot of it is unbroken), but what the DRM-users have proven to us is that it's non-trivial now, and more importantly it only has to be "good enough": as long as it prevents most users from doing something the copyright holder doesn't want, that's all they really care about.

We will probably start seeing a lot more people getting locked up for decades for "contempt of court" by refusing or being unable to decrypt their personal data for a judge. Current record for contempt is 14 years - with no conviction and no jury.

The reason the Apple case is in the courts is nobody wanted to put their name on this encryption bill without understanding it. Feinstein is one of the only ones willing to so far [2]. Basically, any politician who feels they are at about the end of their career might put forth such legislation, but all the others know it'd be suicide.

[1] https://youtu.be/uk4hYAwCdhU?t=1m44s

[2] http://www.politico.com/tipsheets/morning-cybersecurity/2016...

Making broad swathes of widely used software into contraband will be a law enforcement nightmare.

Interestingly, the encryption system underlying WhatsApp was developed by the US government for people in oppressive states to use to avoid surveillance and restrictions on access to information.

This is short-sighted and blatantly wrong.

We need to share facts in this debate..

We know about technology, they know about law enforcement

Let us each bring facts to the table and resist coming up with conclusions from the outset. Obama is missing some facts, and in order to convince him that's true I think we need to be open to the idea that there may be some things we do not know

We're not going to find out about those things by conjecturing. We need the administration to share any relevant details as much as they need to understand encryption technology

What baffles me is that nobody has been able to convince the President of that simple fact. Surely, he must know about Signal and Snowden, and that Signal can easily be downloaded to any device...

From his rhetoric, it sounds like he wants to appeal to technologists by arguing he keeps them very close to him in the White House. He's saying, "see? I have tech friends and I give them cool jobs where they feel appreciated."

He's also implying that they should count towards him being informed about technology. But we know that's not the case.

So he's trying to say he has trusted technology advisors, but he doesn't. It's scary. Join me in tweeting at them [1]

[1] https://twitter.com/usds

I wonder if Obama and his speechwriters have research about how many people (and from which demographics) that phrase is going to be read in which ways? (I wonder if they've worked out that they've already lost the tech crowd on this issue, and there's a statistically significant crossover between the tech crowd and the people for whom fetishes are considered a positive thing?)

https://en.wikipedia.org/wiki/Commodity_fetishism

Next he accused me of clinging to my religion, but since I was an atheist, I was like, meh, whatever.

Then he accused me of clinging to my smartphone, and oh, boy. It's on now, motherfucker.

However, most of society is simply not active. Most of society would never pick up any pitchforks one way or the other, without things getting REALLY bad. At some point a highly motivated minority of the population (but still a lot of people) basically needs to make the change for everyone. I'm not saying that's right or wrong, just saying what seems to be the case.

Our phones contain both a) things we consider privacy-sensitive and b) security-sensitive. Family photos and bank accounts. The Googler dispels one of Sam's analogies. Digital security and insecurity is highly scalable. We lock our doors, and police can force them open if needed. Generally, there are not many burglars around. Here I will quote Sam's reading of the Googler's email,

> "The digital world is like having a house at zero distance from every burglar in existence, including the planet's top lock pickers. They have zero cost and near-zero risk attempting to break into my door. The "police" are virtually non-existent, and even if identified the bad guys are probably out of reach of prosecution. Even the amateurs have tools that allow them to probe millions of doors per second, and the pros have access to the same heavy tools that the police would use to force my door. And perhaps I live in a huge condo with a single door, so hacking that one lock will expose millions to ransacking. That's the nature of every digital device connected to the internet. Attacking them is a highly scalable task. You're not protected by your location, there's no affluent neighborhood with low crime and good police, where the wealthy can live and feel safe. Nope, the internet is a dystopian world when it comes to security. It's a Mad Max scenario where you're only safe if your front door and your entire house and your personal car is blinded like Fort Knox's safes, and armed with flame throwers."

Before I realized Sam had recanted his position, I wrote a point-by-point response to his first video [3]. I think the Googler did a better job relating to non-technologists.

[1] https://www.youtube.com/watch?v=ZQAmlVFjJ9k

[2] https://youtu.be/9HK4IBscfMQ

[3] https://pastelink.net/151k

Everything he does involves telling people what to do.

I don't understand this line of thinking regarding the big encryption debate. Yeah it sounds good if you don't know anything about encryption. "Look, he's being reasonable. Why is everyone saying he's wrong instead of striking a balance".

The problem is it's a binary problem. There is zero way to strike any type of balance here. You either encrypt communication to prevent others from accessing it or you provide a backdoor or escrow key to access the data in which case all encrypted communications are now insecure.

There isn't a middle ground there. If there is I have yet to see anyone suggest it and I can't think of a technical way to do it. Too many attack vectors when you purposefully impose multiple party keys or backdoors.

The FISA court is already a rubber stamp. Encryption is one of the only ways to non-passively protest.

Edit: Can't reply to my replies, likely because of the down votes on my parent's comment.

Re: FISA, yes to both. That anecdote may be truth but I am still hung up on NSA employee looking up ex-girlfriends' emails the day he got access to do so.

Re: Army, you aren't wrong but that's not encouraging. It's true, at the end of the day the most powerful military will win.

But it's an argument that only wins against those with something to lose, like people who care about their family or nation states with a future. I guess that's why the ultimate response over a long enough timeline to an unbeatable military force is terrorism.

This is the problem Snowden exposed. There is not enough transparency to verify judicial processes.

Secondly, it's seems that if information collection, safety, and exchange were working well, the FBI wouldn't be asking for more.

Obama's ability to unite and create dialog is welcomed. However, I don't think phones are fetishized. There's simply a lack of education everywhere. As Jobs said, “Privacy means people know what they are signing up for”.

This is an extreme statement and a false dichotomy. I think there's plenty of room between "completely trust government" and "unfit for society". If I'm uncomfortable with the potential for abuse of monitoring (which has already happened plenty of times), that means what exactly? I should remove myself from public discourse?

I would like to hear your definition of normal society. I personally feel that there are thousands of unique societies in the world.

Considering that technology knows no borders, I hope you and the "society filled with other people" have normal society figured out for us all.

That argument had weight pre-Snowden. It carries no water now.

We are talking about introducing back-doors to what essentially already is an extension to our brains. If you understand computers, you know that analogies between the "real world" and our abstract world of modern information systems usually don't hold well.

Please try to think through all the subtleties, you clearly don't have to be labeled "libertarian" to foresee a death-by-a-thousand-cuts of our civil liberties (as with democracy, the US still sets global trends btw).

Beyond that:

> If government is monitoring your communications, then there's a pretty dammed good reason, as determined by a judge.

Not even close to true. We have documented evidence at this point that the government is monitoring all communications. They have no discretion.

For the moment, I trust that the government has not yet descended so far that it will arbitrarily arrest or detain everyone who attempts to maintain the security of their information. That doesn't mean I trust the government to unilaterally decide whose information it can access.

Government brokenness is not binary. There's a spectrum from "theoretical perfection" to "absolute tyranny". The US and UK governments are currently attempting to take a step in the wrong direction; that doesn't immediately imply that anyone opposing that step "ceases to be able to function in a society". Or are you seriously attempting to suggest that the government is entirely infallible and incorruptible?

The safeguard for privacy isn't just the court system. That provides a modest amount of protection against abuse of information that was left insecure to begin with, such as information left unencrypted with a third party. However, for information that truly needs security, the privacy of that information is maintained by the system holding it; that system neither has nor needs any concept of "a user other than the owner who somehow has access".

Let's ignore the Apple case for a moment, since Apple fundamentally does have access to the device. Even additions like the more recent security chip have potential ways to bypass security, albeit by dissecting a tamper-resistant chip; that's a tradeoff for supporting insufficiently long user PINs, and wouldn't be needed with a secure passphrase. Whether Apple wins or loses, the much more interesting question is whether challenges arise to the construction of devices that genuinely cannot be accessed by anyone other than the device owner.

As a simple example, consider an encrypted device, using a key and passphrase, where the passphrase uses an appropriate strengthening technique to make it computationally intensive to test a single possibility. Easy to get in if you know the passphrase, but if done right, computationally infeasible to brute force even with NSA-level computing resources and centuries of time.

Laptops regularly use that level of security today (modulo the user's chosen passphrase). Phones should as well.

If I had a perfect eidetic memory, I could memorize huge volumes of information and keep no records of them; in that case, that information is completely secure (against anything except rubber-hose). Encryption provides an amplification mechanism there: instead of memorizing gigabytes of data, I can instead memorize a passphrase, and gain access to arbitrarily large amounts of information that nobody else can access (modulo security bugs, or physical device compromise followed by my continued access).

Note that "most incidents are self reported" kinda sounds good, but really means "we don't have any good systems for finding it", and probably means many incidents are never discovered.