Illegal Math
blog.prakashvenkat.com
blog.prakashvenkat.com
I think this analogy is apt but it actually works against the author's point. Our government has legally been allowed to knock down whichever door it has wanted to for centuries assuming it has received the proper warrants. An encryption door cannot be knocked down. That is a very scary problem for the government and law enforcement. Things like personal notes, journals, communications all used to be accessible to the government through warrants. Now that information is all locked away behind encryption. This is a huge shift in the way governments fight crime. We need to recognize that fact in order to have any productive debate with anti-encryption folks and we can't just pretend the government is evil because they wanted to keep the status quo of the physical world alive into the digital era.
The government already has plenty of ways to collect evidence through legal means. A judge can compel you to provide access to your company files, to unlock your home, to decrypt your computer, etc. If you don't comply with the discovery process, you can be held in contempt of court. Encryption doesn't change anything in that equation.
The difference here is that the person in question is dead, so he can't provide the password. So the FBI wants to set a precedent that they can obtain information they want through means that would normally not be available to them.
Brain communication interfaces aren't that far off though, so maybe we can solve this "problem" with the our minds being dark to the FBI in a decade or two.
Moreover, more and more of that persistent information is casual communication that historically would have been securely erased by the whispering winds of time. No judge can grant investigators a time machine to travel back and spy on thousands of conversations over the last 5 years to fish for evidence. But now they can have the next-best thing (and getting better).
I think the discussion will get more useful when we'll stop talking about them and instead will talk about us. In civilized countries, the government represents the people. Law-enforcing organisms are mandated by people. The question is not whether some stranger wants to be able to enforce the law: the problem is whether we want to be able to enforce the law.
[1] http://www.businessinsider.com/major-study-finds-that-the-us...
The same citizens complaining that the rich control our country are the same citizens who don't register to vote because their opinion doesn't matter. The person who screams the loudest is the person heard. And the voice of America takes a sad me me me view that their voice doesn't matter, thus the rich get the power.
I'm far from a Sanders supporter, but his way of running this campaign has given America their Voice back. Ban super PACS, and limit corporate contributions to the same dollar amount that you and I are limited to donating, $2700.
In pursuit of enforcing the law, we need to be vigilant in maintaining the rule of law, which has proved difficult over the last century, with dire consequences.
But it hasn't been able to trawl for evidence mechanically and automatically. Now it has the technology to do that.
The default has always been privacy, for practical reasons. Encryption simply continues that tradition by continuing to make evidence gathering non-trivial.
I think for warrants, though, we're looking at a different beast. By their nature they are targeted. And people have been compelled to provide passwords in the court of law(See [0]). The right against self-incrimination is relatively narrow, so as to not hinder the government's discoverability powers too much.
I think the one thing about this, though, is that people can already be compelled through legal means to unlock things. There is a reading of the Apple case that they are being compelled to unlock something for which they have the key.
Generally, it feels like outlawing encryption isn't necessary for the gov't to pursue the discovery phase of an arrest. There are already a good amount of legal means to compel people to unlock the doors.
[0]:https://en.wikipedia.org/wiki/Key_disclosure_law#United_Stat...
You can have encrypted data that accept two different passwords, producing different decrypted data of your choice. This is like the 2nd code that mute the home security alarm when you are forced to do it, but still calls the police.
The courts will demand for both passwords or you'll get some nice sentencing for contempt of court.
Of course you could not tell anyone but that's a dangerous game.
Things that they own, yes. But Apple doesn't own the iPhone that the FBI wants to unlock.
> There is a reading of the Apple case that they are being compelled to unlock something for which they have the key.
No, they don't have the key. What the FBI is asking Apple to do is to redesign the lock so that the FBI can try as many different keys as it wants until they find one that unlocks it.
I agree that the situation is changing; the technology to batch surveil everyone at once is new, but the argument over privacy and where governments bounds are isn't.
Until governments can return confidence in their actions and motivations Avoid an even low chance 1984 scenario is more important than making law enforcement/counter terrorism do their jobs the old fashion way.
I understand that the NSA issue was a bad surprise for many many people but, actually, who has been damaged by those practices?
Before I am discovered no one is, but after I am discovered there can be a significant amount of mental anguish.
The question is not whether we are restraining the government from knocking down some special doors. The question is more like whether we are preventing the government from using telepathy or defying gravity. No, nobody is preventing that except reality itself.
> I think this analogy is apt but it actually works against the author's point. Our government has legally been allowed to knock down whichever door it has wanted to for centuries assuming it has received the proper warrants. An encryption door cannot be knocked down. That is a very scary problem for the government and law enforcement. Things like personal notes, journals, communications all used to be accessible to the government through warrants. Now that information is all locked away behind encryption.
Well, there was nothing stopping someone from writing their journals or notes in code so nobody could understand them. There is a question of whether someone would be forced to explain the code used for the notes. But the current scheme would be akin to the government requiring schools to spread misinformation about how to make a secure cipher and making it illegal to write a book about how to make a secure cipher without making the cipher broken.
This is a huge shift in how we think about information and learning. There appears to be a general mystery about software as though technology has changed our underlying morals. It hasn't. If you reframe moral questions about software as moral questions about other things, the answers become more obvious. For example, the morals behind free software become immediately obvious if you consider mathematics or even things like blueprints (since a software program is both the design and implementation in a way).
Of course there's the danger of a false parallel (and you might argue that I've drawn such a parallel), but I think my argument holds.
They only think that information is locked away behind encryption. There is no proof that the information they seek actually exists in the white-noise they claim it does unless the plaintext is recovered.
I also think that the effect sizes on the pro vs. con debate of encryption has been overblown, and that it will be many years before we get a body of literature on which to anchor claims of magnitudes in our debate.
That being said, I think that leading the discussion on anti-encryption with discussions of terrorism and child porn is dishonest on its face. They're dishonestly exaggerated in effect size, and terrorism is the worse of the bunch, as the war on terror has costed mountains more than terrorism itself, both in money and in life. Unfortunately, these are often the top discussion points for any encryption debate.
That's mostly true, but not completely. There are a number of doors that have always been barred:
- Self-incrimination
- Incrimination of a spouse
- Attorney-client relationship
- Minister/priest - parishioner relationship
- Doctor - patient relationship (?)
The doctor simply cannot force you to bear witness against yourself. Nor can they force your attorney to reveal what you said to him.
Some of these examples have a sort of exception, where a doctor or an attorney must give warning it they know that the subject person is going to commit murder, for example. But that's not the same as saying that the government can go back and look at past communications.
Would it be possible to outlaw the possession or transfer of data that appears random? Nearly all data is random data, and nearly all processes randomize data. All data could be "proven" to contain information under at least one encryption scheme. It is the ultimate guilty until proven innocent argument.
If your credit card were erased with a magnet, could you now be prosecuted for the possession of encrypted data, because it could be proven that using a certain one-time pad it could be transformed into something meaningful to humans?
It doesn't end there. All things could be interpreted as information. We would have to start explaining the arrangement of books on a shelf, of spices in a rack, colours of stitching in clothing. If encryption were illegal, we would all be guilty all the time.
Fine, some would argue that random data isn't proof of guilt. What about the means of encryption? Now all random data are one-time pad keys. Prepare to rot in jail.
By a similar argument, any phrase someone says to someone else might have been code for "kill that guy". Except usually it's not, and unless there is convincing evidence you did mean to kill that guy, you'll be set free.
Conversely, if you have previously agreed a code where "2+2=4" means "kill that guy", and then you say "2+2=4", you can't argue in court that "Oh, I was just saying a true statement of maths, how could that possibly be illegal?"
Plants are just biology and burning things is just chemistry. You can't make it illegal for a plant to grow and for a human burn it and inhale it, can you?
Well...if you pass a law that pi=3 it doesn't change the nature of the universe, but it does regulate human transactions, and human behavior can be and sure is regulated using some strange laws.
Doing physics or chemistry can directly harm people. Doing math or drawing pictures can't.
Like the article said analogies are no fun. I agree with your premise but not with your conclusion.
You will perhaps agree that encryption has the potential to directly harm people just as physics or chemistry?
This argument might have worked, up until the point when they criminalized cartoon child pornography.
You will perhaps agree that encryption has the potential to directly harm people just as physics or chemistry?
No.
I would not agree. Encryption can only indirectly harm people, in the same vein as speech.
Obviously there is much more to conspiracy than "talking about a murder," or Stephen King would be locked up in Supermax. It's as if Comey is asking for the right to review every murder mystery or horror novel before it hits the shelves. If he wants his job to be that easy, he should send his resume to North Korea.
So, if you want to try to use this metaphor, the situation is actually a little bit different. Try this:
"Seat belts make it safe to go faster than 20 MPH, and tolerable to go faster than 80 MPH. Unfortunately, sometimes bank robbers use them while going faster than 80 MPH, so we have to ban seat belts entirely to prevent them from robbing banks."
However, it's a slippery slope to say that encryption can't be illegal because in is math, and math can't be illegal.
It's equivalent to say that making bombs is chemistry, and chemistry can't be illegal. It's an oversimplification.
Presenting the practical consequences of a backdoor produces a far more sound argument.
Even when an encryption algorithm is implemented on a computer, it's still not a physical object, it's just a mathematical algorithm.
A computer simulation of explosive chemical reaction is not going to get you arrested, why should an encryption algorithm?
I think the banning of encryption or forcing encryption products to have government backdoors would be horrifically bad policies, I don't think there is anything in our current legal framework that prevents it.
Math can not harm anybody because math isn't real, it's speech (yes, maybe except for psychological harm). Chemistry is quite real.
Anyway, I don't see merit on the author's argument. It's true, but useless. The discussion is about protected speech and evidence gathering, nobody is claiming cryptography directly harms people.
This debate should really be about whether or not people have the right to have secrets.
If your answer is "no" then you ought to explain how you square that with the fact that many of our everyday activities can be considered criminal in some jurisdictions.
I think next time you pose this argument, you should remove the bit about how your actions might be illegal in some jurisdiction or other. It isn't doing the work for you that you think it is.
The whole debate is about what's grey vs what's gray. I don't think there's a clear cut answer either way to the question "Is encryption an inviolable right?" The exercise here is to try and find a border between gray and grey, preferably avoiding any knee-jerk reaction such as backdooring every encryption scheme.
Note that I'm assuming such a border exists, which is, to be honest, not on such solid ground. It might very well be that this is an "all or nothing" deal, considering the nature of encryption...
Government is limited by reality, math, physics, the height of walls, the fact that telepathy isn't a thing, etc. Encryption is just one more limitation.
But that doesn't seem to be what you're remarking on.
I'm not sure what you see as the problem with my argument. Some people, if private messages were read by people around them or by their local law enforcement, could be sentenced to death, in certain jurisdictions. For "crimes" like being Christian, Muslim, atheist, Gay, etc.
How is that a good thing?
How is it a bad thing that people want to protect themselves with encryption?
Or if you're saying you get the argument and I'm just doing a bad job of making it, yes, maybe so, but maybe it's a hard side of the argument to take. Any suggestions on how to put it better?
Or maybe you're saying it's entirely the wrong argument to make, tactically. I'm still not sure why. Having not heard a reason for not making this argument, I think it's good to make it because it seems to be discussed too little.
Instead, you need to argue that completely innocent people need encryption, and you need to explain why they need it.
I understand what you are saying, and it's a good point for the current case, for a discussion with the general (non-techie) public. I'll keep that in mind.
Quoting AnimalMuppet:
>If you remove the last part ... then all you're left with is that people should be able to conceal the evidence of crimes.
OK, that is precisely why I did NOT remove the last part, and it's precisely why the last part is important. The part about other jurisdictions having (sometimes) laws we might not all approve of.
So, what I think I'm getting from you (you two) is that most people will just snip that last part off in their minds, and they'll be left with something they would never agree with. OK, fair enough, and thanks for pointing it out.
Sometimes I think the general public wonders what the hell Apple's problem is, and why would they place SUCH a high value on (what is perceived as simply) privacy.
My point about other jurisdictions is also just my own speculation on what kind of issues Apple is thinking about, in addition to the fundamental insecurity of effectively having a back door. It may not be a large part of their thinking, or maybe it is, I can see it both ways... On the one hand Tim is a corporate man, and on the other hand he's also running a company that goes out on limbs for corporate [edit: and social] responsibility.
>Instead, you need to argue that completely innocent people need encryption, and you need to explain why they need it.
This makes sense, yes. The obvious answer being safety from bad guys who might gain illicit access to information that allows them to do harm.
You also need to weaken "allowed to have secrets" to "allowed to have secrets in the presence of a warrant".
Then as many have pointed out, that these devices are becoming extensions of our minds.
So I can see those companies thinking that they have a corporate responsibility to protect their users. Especially if not doing so puts their users in danger.
I don't assume that freedom loving countries like the US are the only countries where warrants are issued. Some warrants are issued in other countries, some of them with oppressive laws, and device makers need to think about users in those countries as well, not just about US users.
A somewhat scary discussion, but one that we might see sometime, would be is there some kind of metric we can apply to governments to see whether their judicial process is up to snuff in terms of protection of rights, where we then create systems that respect only those warrants from jurisdictions that meet a standard of rights protection. In other words build into whatever solution a recognition that not all warrants are created equal.
Not that this would surmount the security issues of having a backdoor that could be hacked. That's such a devastating flaw in the anti-Apple side that I'm not sure it can be overcome without the help of blinders.
Educating HN and SV on this topic is throwing so many logs on the fire - I literally haven't met anybody in tech that doesn't strongly support Apple / encryption.
On the other hand analogies - like "locks, doors, and burritos" - are the only chance we have to sway the POPULAR opinion in this country which currently sits 52% in favor of handing the govt the keys. (2)
And Donald Trump has recently shown with great effect what speaking like / explaining thing simply (at a 3rd grade level in fact) can do to reach Americans. (3)
And, as for "Illegal Math" in general, unfortunately there's prior art in this department as well ;-) (4) (5)
(1) http://www.people-press.org/files/2016/02/2-22-2016-iPhone-r...
(2) http://www.people-press.org/files/2016/02/2-22-2016-iPhone-r...
(3) http://www.politico.com/magazine/story/2015/08/donald-trump-...
(4) http://everything2.com/title/Copyrighting%2520a%2520number
(5) http://mathbric.blogspot.com/2009/01/just-how-small-is-small...
He says that to avoid this to happen the citizens need to demand access to strong cryptography.
[0] He writes about it here (danish to english): https://translate.google.com/translate?sl=da&tl=en&js=y&prev...
"No law of Congress can place in the hands of officials connected with the Postal Service any authority to invade the secrecy of letters and such sealed packages in the mail; and all regulations adopted as to mail matter of this kind must be in subordination to the great principle embodied in the fourth amendment of the Constitution."
(Ex parte Jackson, 96 U.S. 727, 733 (1877))
Why does this not also apply to newly invented forms of communication
> Any image file or an executable program can be regarded as simply a very large binary number. In certain jurisdictions, there are images that are illegal to possess, due to obscenity or secrecy/classified status, so the corresponding numbers could be illegal.
Various government agencies are crooning that they should be able to knock down whichever doors they please because the interests of being able to have somebody find out what people are doing under certain scenarios is preferable to never being able to do it.
The fact you misrepresent the argument as simply "because they're the government" means you either don't understand the opposing side or you're willfully misrepresenting them. In either case, why would anyone who doesn't already agree with you take what you said seriously?
If all you want to do is bring down the government then you can distribute one time pads on microsd cards and there is not much legislation can do to stop that. Any governments planning to ban xor?
So it will be interesting to see where the US goes on this. The lines are being drawn.
(To be clear, I am absolutely not in favor of putting any sort of restrictions on the use of encryption)
This is a similar debate we had 20 years ago, when people were fighting against the government who wanted to limit encryption to 56-bit DES. Stronger algorithms were not allowed (and then they acquiesced and allowed stronger keys to be used within the US only, unless you applied for special licenses). But you could print out the same encryption algorithms as a book or even a t-shirt and it would be totally legal and exportable. The government was saying that they were protecting us, but really it did nothing.
It was ridiculous and we had a few years of relative peace on the encryption front until this whole faux-terrorist debacle.
I wouldn't go so far as to say that the author made no interest points, but statements like this are a perfect example of that STEM worker arrogance stemming from the logical fallacy that just because you control systems which masses of people don't understand but rely on heavily (and make good money doing it in a secure comfortable job), that you have adequate knowledge to make sweeping statements in other areas outside of engineering knowledge.
It isn't the math, but the activity of _applying_ that math in actual communications which is subject to legal statutes and regulation, which I don't pretend to be an expert on, but know enough of my own ignorance about the theory and practice of the law (and having a number of attorneys in the family to check my own tendency toward that aforementioned arrogance) to understand that it isn't a simple freedom of expression or open knowledge issue.
Specific example: chemistry is physics & physics is math. Should all chemical processes be protected on these grounds?
I agree with your conclusion that we should let people secure their own information, but not because the process of securing information is an algorithm derived from math research.
Has anyone written about the probable unintended consequences? I think it could happen and I am concerned.
I could babble about the similarities, but smarter, better educated minds have already done that.