Senate encryption bill draft mandates 'technical assistance'
thehill.com
thehill.com
I posted my full thoughts after the first reading through this at https://rietta.com/blog/2016/04/08/feinstein-burr-encryption....
Specifically, any U.S company would be required to maintain the ability, through unspecified means, to retrieve the plain-text from any data “made unintelligible by a feature, product, or service owned, controlled, created, or provided by the [company].” And the company would then be required to turn over such data in real-time “concurrently with its transmission” or “expeditiously, if stored by the [company] or on a device.”
It's chilling.
Your response begs the solution.
Presumably, FOSS is not considered a "covered entity" under this bill. Arch or Gentoo linux, private mailserver, XMPP server with OTR, etc, is a simple circumvention.
If signed into law, this could compel maintainers to design libraries with gov't decryption in mind.
Worst case scenario, all US developers drop off the project, or contribute anonymously.
https://en.wikipedia.org/wiki/Source_code#Legal_issues_in_th...
Consider the amount of funding RH and Sun Microsystems have put into the linux desktop. Imagine if they were now required to provide technical assistance to people attempting to surveil through the tools they've invented.
I suggest you check your premises.
(EDIT: To clarify: from a rational perspective, some of her sponsored anti-gun laws primarily have the effect of alienating and galvanizing the opposition with nonsensical and ineffective laws. From a rational anti-gun perspective, they have done more harm than good.)
That means the direct evolutionary pressure is for legislators who focus on re-election above all else. Any actors who have different priorities are quickly outcompeted and kicked out of the gene pool.
In other words, government officials are not in fact bound by the rules of natural selection whatsoever, and they can live perfectly comfortable, happy lives without getting reelected.
She just passed a bill to legally protect American companies' trade secrets (https://twitter.com/SenFeinstein/status/717387073804767233), so it's not like she doesn't care about intellectual property. I think if she understood the implications, she wouldn't back this.
Give her a call or write a letter, especially if you're in her constituency: http://www.feinstein.senate.gov/public/index.cfm/state-offic...
Almost literally overnight. I suspect that someone would be trying to break into those vendors' networks in anticipation of the law's implementation.
Lawmakers have a tendency to expect that when they pass a bill to protect something, it will in fact be protected. Since they are at the top of the "security by policy" game, they don't really think about the value of "security by design".
So she passes a bill to protect trade secrets just before she proposes another bill that might put trade secrets in jeopardy. "Don't worry, they're still protected by this other bill!"
So she passes a bill to protect trade secrets just before she proposes another bill that might put trade secrets in jeopardy. "Don't worry, they're still protected by this other bill!"
Which would just mean open season for governments with state-sponsored hacking for industrial espionage. This includes China and the US.
What's even worse, is that she might be aware of what she is doing.
>Blum's wife, Senator Dianne Feinstein, has received scrutiny due to her husband's government contracts and extensive business dealings with China and her past votes on trade issues with the country. Blum has denied any wrongdoing, however.[4] Critics have argued that business contracts with the US government awarded to a company (Perini) controlled by Blum may raise a potential conflict-of-interest issue with the voting and policy activities of his wife.[5] URS Corp, which Blum had a substantial stake in, bought EG&G, a leading provider of technical services and management to the U.S. military, from The Carlyle Group in 2002; EG&G subsequently won a $600m defense contract.[1]
https://en.wikipedia.org/wiki/Richard_C._Blum#Controversy
Why isn't there a non-voluntary recusement protocol for government employees?
I agree it would be quite sad for a woman of such advanced age to sell out her country for a few dollars. Any age of course, but at that age it would be extra curious.
As I said, it wasn't a smear. Just a presentation of the facts and asking a question.
There are plenty of people in Congress and yet we have the member whose husband has an interest in a government contractor that provides technical services, drafting legislation that involves the mandating of technical services.
If members of congress don't have the dignity and integrity to recuse themselves in such situations where there are obviously avenues of inquiry even if everything is above board, but really how could it be, people's biases are subtle...
So the question is, if members of congress, and other governmental bodies can't recognize these potential biases in themselves and do the right thing and recuse themselves from conflicting matters, why aren't systems in place to make sure they recuse themselves?
But she's incredibly popular in California. Beating her is an uphill battle. And most people aren't willing to make encryption a primary issue in how they vote.
The scope is really much broader than that.
Does your non-"tech company" company use an online payroll system? That would negatively affected.
Do you buy food at a grocery store? Guess what, most of them transmit encrypted data on the internet!
etc. etc.
If tech companies want to be serious about security, they should be putting substantial money into getting this pariah kicked out of office.
A crypto-secured digital communication should be analogous to sending an untampered with letter, or having a private conversation in a secure location.
Just because the medium being communicated over changes, doesn't mean we should adopt wildly regressive policies.
By proposing that all this 'cryptographically secured'[0] communication can be accessed at a later date, they're basically saying that the contents of all snail mail letters should be photo copied, and all private conversations should be recorded.
[0] If there is a possibility of 'technical assistance,' then it is not cryptographically secure.
I don't think anything in the bill requires a provider to keep around copies of information they don't already keep. They need to be able to provide access contemporaneously with transmission (i.e. basically a wiretap), or if they have stored it or can access it on the device.
If you receive a sealed letter and the police get a warrant, they can search your drawer and open that letter. If you have a private conversation with someone, a prosecutor can subpoena that person and force them to testify about what you told them.
I'm amenable to the argument that the law shouldn't stand in the way of progress; it's possible to communicate much more securely now than it ever was in the past and the law shouldn't stand in the way of people taking advantage of those advances. But the bill isn't "regressive"--it's attempting to maintain powers the police already have with traditional means of communication.
If you are a bank with a lock box, are you required to have a key to a safe that a customer installs inside the lock box to store their valuables? Of course, a court can order you to give what you have but how can they order you to give them something you don't have?
And yes, courts regularly order banks to drill into their safe deposit boxes.
Hardware manufacturers as well. Say goodbye to bios passwords, hard drive smart locks, SSD encryption that permits instant formats and the only way to ensure that bad blocks don't leak your data to ebay buyers.
If multi-billion dollar companies were mandated to spend their development efforts on ineffective, insecure cryptographic systems, do you think that would be a positive or negative thing in terms of the availability and proliferation of the kind of effective and secure cryptographic systems that 'customers use themselves'?
This is broad-scope. It would compel encryption providers to maintain a master key to decrypt all traffic running through them. A single security incident with one of those providers would be enough to compromise the data of every customer. Communications providers to large American businesses with foreign competition would immediately become incredibly high value targets for bad actors.
If that's the case, then it's ridiculous and it appears nobody in the U.S. Government has learned from history. When they did this with export controls on encryption the only people overseas who had access to proper encryption were those who were outside the law, and those who developed encryption in countries that don't have restrictions.
Of course, I may not be following what is meant by "technical assistance". However, if such a term doesn't mean implementing a backdoor, then if unbreakable encryption is implemented then it won't matter how much technical assistance is rendered by U.S. companies, nothing will have been achieved except wasting a lot of company dollars on a futile effort!
Password hashes, if this were to become law then you'd have to store them in clear text or encrypt them with a controlled key. You frequently see that sort of practice turn up in massive security breaches. Also, homomorphic databases are out - you can't provide a service without being able to deliver plaintext to the state. So no decentralized security, you'd be forced to choose, during the handshake, between clear text or a CA model that offers no protection from state level attackers - which is no coincidence.
> But the bill isn't "regressive"--it's attempting to maintain...
Device manufacturers are covered. So even if it is unrelated to an ongoing service, it is still required to render assistance in compromising the product. That is regressive. And I've only mentioned the primary impact, this thing would make the manufacture of end user serviced devices economically impossible.
Unless we had a less horrible alternative... what if manufacturers where offered the alternative of installing a key escrow chip? I could swear that I've heard that idea proposed before.
Edit:
I forgot to include software developers, so let your imagination run over that. That bitlocker feature offered by Microsoft? That is covered.
> So even if it is unrelated to an ongoing service, it is still required to render assistance in compromising the product. That is regressive.
"Regressive" means stepping backward from the status quo. The government can already compel your bank to drill your safe deposit box; it can subpoena your accountant to spill the beans on the complex financial transactions he arranged for you; etc. Compelling assistance from tech companies might be a bad idea, but it's an extension of the status quo.
That isn't what I said or what I addressed. You said "...keep around copies of information they don't already keep.", that isn't true - for the reasons I previously explained. It isn't restricted to "communications", it is for any stored data - if you get it in plain text then you are required to render on demand in plain text. You are not allowed to use forward security as a feature of your product.
> "Regressive" means stepping backward from the status quo.
I know what the word means, you've misused it. The USG making it illegal to render information unusable to them for some theoretical future investigation is not the status quo. That logic would make manufacture of paper shredders illegal.
Signal by Whisper Systems is intended to work in such a way that a subpoena for someone's chat logs would be useless because there's nothing useful to subpoena. They cannot access the keys necessary to decrypt.
Assume for the sake of argument that they've achieved their goal from a technical standpoint. As a result they are unable to comply with subsection (a); they cannot provide the unencrypted information, and no amount of technical assistance on their behalf would allow them to do so.
Section 3. (c) "License Distributors" would appear to prohibit Apple from making the app available in its app store.
If the FBI can legally compel Apple to produce a backdoored firmware for their phones, they can also compel Open Whisper Systems to produce a backdoored version of the Signal app to intercept all plaintext on the client side. Since almost everybody has automatic updates turned on, they won't even need to find a way to push the rogue version to the target's device.
Every service that relies on a vendor-provided app is open to this kind of "technical assistance". Ditto for any webapp that relies on vendor-provided JavaScript crypto libraries. The vendor can "technically assist" themselves at any time to gain surveillance capabilities they previously did not have.
The analogy is that anybody who intercepts and stores encrypted communication data, has a kind of Schrodinger's Cat photo-copied letter.
If at some later date they acquire the encryption key, then they have a photo-copied letter never intended for them.
If they don't acquire the key, they don't have a letter.
(Or perhaps they still do 'have a letter' they just can't read it, that's kind of a metaphysical question)
Also, if you have a letter, you can discard of it as you see fit, and the information therein vanishes into the aether. This agency is removed when we move into the realm of bits over digital networks, where information can be copied and retained without one's authorization.
The agency to discard of the letter as you see fit, at a time of your choosing is in effect restored through the use of strong cryptography.
If you have a private conversation with someone, a prosecutor can subpoena that person and force them to testify about what you told them.
Having an unauthorized recording of an event, and asking someone to recount an event are very different things.
attempting to maintain powers
It's not about the 'police maintaining powers they already have' because the situations are different. If the situations were the same, the powers would be the same, and this conversation wouldn't exist.
The situations may seem similar to you, because we make sense of the world through analogy, but there are important differences.
The essentially instant and infinite nature of bits and digital data allows for all those 'warrants' and 'subpoenas' to be 'served' before they have even seen a judicial system. I.e. governments can suck up all the 'locked' data into giant 'pre-crime' databases. Or, require that communication networks retain data, when it's not already happening as a matter of course.
If governments are then given the key to that locked data they essentially have a time machine to attempt to dredge up any evidence, or whatever they want from people's personal effects.
There's nothing similar about that to anything. Nothing like that has ever existed in the history of the world.
So we have a new situation, and with it a new choice to make. This choice requires we ask ourselves, Do we want to lean towards tyranny or lean towards liberty?
Terms like 'progress' are relative and subjective, but still useful when there is mutual understanding. What is being progressed towards? A freer society with less potential for government overreach and tyrannical actions.
So in that case, yes this bill is regressive.
And, that's just one aspect of what makes this bill objectionable, and frankly, retarded.
Anyone with an inkling of how the modern economy works and it's reliance on cryptography, knows that this bill is ridiculous.
The simple matter is that you can't have modern strong cryptography with 'backdoors,' or whatever doors. It doesn't exist, it never will, the two are mutually exclusive. And further, the cryptography genie is not going back in the bottle, that is just as inconceivable. So it would be best for everyone if governments educated themselves on these matters and stopped wasting everyone's time and money on this.
You seem strangely narrowly focused on that. Who really cares about that? That is a point of minor interest.
The big issue at hand is this bill is attempting to coin some Orwellian doublespeak in mandating that there exist some secure cryptographic communication channels, with 'backdoors.'
That's a logical impossibility. That can't exist, it is either one or the other.
>but I don't read anything in there that precludes a service provider that doesn't store a history of users' communications.
Precludes from what?
But once again the data storage thing is a red herring, who cares, governments are not lacking in collected data. The fact that some of that data is now the form of secret codes bothers some in the government, but rendering the secret code making tools ineffective is not going to make the world a better place.
Quite clearly, you have lawerly skills, but that was a dirty trick.
It would be nice if you attempted to address the issue head on. Or, concede.
As important as these discussions tend to seem to us at the time, they are in fact awfully boring HN threads, because for the most part they're just nerds competing to see who can agree harder.
I recently watched the first season of The X-Files, circa 1993. Someone kidnaps Scully. Mulder traces the kidnapper's call to Scully's cell phone, which as a cell phone was then considered impossible to locate. The protagonists repeatedly bought airline tickets with cash under assumed names to avoid government surveillance. Mulder is at one point punished by being assigned to transcribe many hours of audio surveillance.
That was the state of the art not so long ago. There was no CALEA. Surveillance was an extremely labor intensive process. Mass surveillance was unfathomable. There was no after-the-fact record of the contents of realtime communications.
You either had a warrant ahead of time and planted a bug in the suspect's house and paid for many overtime hours for agents to sit in a van listening to the suspect talk, or everything the suspect said was gone as soon as they closed their mouth.
And there is still nothing that stops them from doing exactly that. Except now the bug is smaller and less expensive and they don't need a van to be in range of the transmitter and there is software to do the audio transcription and other software that will convert an audio recording of key presses into the text of the key presses and on and on.
People could encrypt 100% of everything in the world and the police would still be a thousand light years in front of where they were back then.
If this "maintenance of traditional powers" argument is to mean anything then it has to go both ways. It can't be that technologies that make privacy invasion easier are allowed and technologies that make it harder are prohibited. And it seems like it would make a lot more sense to let both citizens and police-with-a-warrant use whatever technology each can devise rather than hampering both to the detriment of everyone in an attempt to artificially maintain some largely subjective measure of balance.
1. Surveillance tech advancement will guarantee that in the future there will be even more of it, cheaper and more accessible through search and machine learning analysis; even if you don't use the internet, your face is still recorded on surveillance cameras, your financial transactions reported, and so on. Even if your state does not do internal surveillance, various companies and foreign states will.
2. The nature of social networks makes it very very expensive to maintain communication private, and in some cases impossible. Even if you use Tor, you still can't post on your regular FB page, or connect to any of your online accounts without disclosing your identity
3. They still can't stop people from communicating in secret, especially with a combination of steganography and cryptography, but that will be increasingly more difficult
4. People will increasingly self censure, with devastating effects on the balance between political class and the rest of society
So it's a defiant march of technology, nothing can stop it at this point. Privacy is dead, it died around year 2000 with the apparition of digital cameras, mobile phones and huge data centers.
I think part of the solution will require that we create new social standards around privacy and tolerance for various indiscretions we will do inevitably. Otherwise, it will be worse than the inquisition. Everyone watching you, all your actions judged by the mob or the powerful, blackmail material for everyone.
There is no intelligence oversight in the U.S. The intelligence agencies seem to be running the Senate, or at least the Senate Intelligence Committee.
When they realize people can talk to each other in private, they will surely outlaw private space.
I've only read the thing once and so may have overlooked it, but I didn't see anything that implies that companies will have to keep keys. For encrypted data, they have to provide technical assistance in decrypting the data, but I didn't see anything that would make assisting with a brute force attack not qualify as technical assistance.
There was something in there about having to respond expeditiously (or something like that), but I think one could make a good argument that brute force is responding expeditiously as long as there is not a known faster way for that particular device.
That is the intent and the logical consequence, obviously they can't say "backdoor". If plain text goes into your device, software or service, and is stored, than you'd be required to provide the plain text on demand. Your product isn't a sha-2 algorithm that just happens to have a massive cloud backup service behind it, your product is a secure remote backup service. The folks who think this is a good idea are going to be the same ones nailing your ass to the wall for breaking their law, they won't entertain the excuse - they'll say that your choice in implementing a non-reversible feature demonstrates predetermination, a cyber booby-trap.
Okay, so I get that the main section of the bill requires companies which provide encryption to decrypt data upon receiving a court order demanding access to it. If the company is capable of decrypting its customers' data, that's a scary thought.
But it's followed by two very conflicting subsections: (b) nothing in this act may be construed to require or prohibit any specific design or operating system to be adopted by any covered entity, but (c) a provider of remote computing services to the public shall ensure such products are capable of complying with a court order to decrypt.
It seems like this could be read as "you must build backdoors", but also as "we're not telling you how to architect your product." These two sections are completely at odds.
By the way, Scribd sucks. Have a downloadable PDF: https://josephhall.org/f0eabaa89b8ee38577bf7d0fd50ddf0d58ecd... (it's still just non-OCR'd images though :<)
That's not really a lock, then, is it?
I learned my lesson; now I just buy new clothes/toiletries/etc. at my destination rather than take anything at all with me.
Obviously, this only works in the US. Other countries will have different laws on the ownership and transport of firearms.
Pro tip: pack the gun at home.
Analogies are models.
Analogies are pretty much precisely how we convey novel ideas. The problem is finding one which doesn't melt when pushed too hard.
I keep having to explain to my father that deleting data from storage doesn't speed up computers. Nor does leaking it. His response when I mentioned that the Panama Papers leaks were 2.6 terabytes of data was "well, that must have made their systems a lot faster" (because they were no longer bogged down by having 2.6 TB of data on them). That's wrong at least two ways: data-on-disk doesn't slow down computers, and leaking data (making a copy) doesn't remove it from the source.
And this is a reasonably intelligent human being. Who's used computers for many decades.
With a sufficiently robust indexing system, file search time is independent of corpus size. E.g., Google isn't scanning the Internet each time you submit a search query. Time to build an index increases, but not searches against it.
I think the TSA locks are a great example of why backdoors are completely idiotic.
Unless the lock is secured to something other than the zipper you can resecure it invisibly too.
And just like with TSA locks, there will be leaks and compromised systems that only hurt the general public.
I wonder what that means for software like Google Chrome. Chrome would need to send the parameters of every SSL session to Google on the chance that the FBI requires Google to decrypt it.
It would provide a major incentive to move anything security-relevant back to the endpoints where it should be in the first place.
If you make paper shredders, you are covered under this bill.
If you handle data, you need to make sure things like your fire suppression system doesn't damage it.
The bill does not care how the data is rendered unreadable to law enforcement. It only cares that you provide them with a readable copy if it was rendered unreadable by anything even remotely in your control.
I'm not well-versed in these things at all, but I wonder what implications this would have on VM providers like Amazon (EC2) or Google (GCE)? Does this mean they somehow have to magically ensure that you didn't install sshd on your Linux VM? Surely that can't be the intention (?), but the broad language is scary.
Which raises the question of whether a vendor could build a system they cannot themselves break into, and then "help" by providing the documentation showing how they've built the system (which they should post publicly anyway).
Still a bad bill for numerous reasons, of course.
It appears to be based on a clause from CALEA, which refers to "any law enforcement agency or officer" - see (b) (1) in:
How can we educate the wider public that breaking crypto makes everything less secure. Most of the arguments I've seen in the wider context seem to split down tech/non-tech lines with this being the key point that's not understood.
Laws dictating how to/not to encrypt things make news really quickly so it takes even takes out all the fun in security research.
(or, closer to what the article states: it's like requiring safe manufacturers to open any safe the government gives them, or at least require the manufacturer to provide technical assistance in breaking into their own safe)
But, of course, the government won't have to use breakable crypto; only the citizenry will be beholden to that requirement. So instead, it will merely be those 'essential' industrial players, now constantly finding their foreign rivals to have the upper hand in trade negotiations and to seemingly predict their moves.
I think that's the key here: broken crypto, on a large scale, doesn't just mean a panopticon; it also means whoever's using it will inevitably suffer large-scale economic stagnation. Standardizing on breakable crypto is equivalent to making laws with large loopholes to allow industrial espionage into the country.
If you want to scare people into defending crypto, point out that it's the shield on the arm of the negotiators who sign things like the TPP agreement. Small business owners—even if they themselves have no trade secrets to protect—will be directly affected by whether crypto can protect the secrets of their industry from their foreign equivalents. (Your local {sports clothing, christmas ornament, office furniture} industry recently take a nosedive? Maybe someone was cornered into a bad deal because all your local supply-chain logistics were plain on the table to China, but theirs were a mystery to us.) And small business owners are a pretty good voting bloc.
It's also too subtle and abstract to ever compete with "Apple is helping Terrorists hide stuff!"
From far away, it didn't look like it did.
Even though we know it's impossible, we should disregard that and lay out common sense tenants that such system would require, even if it can't be feasibly built. We could then base our arguments on those tenants, and those are public fights I think could be won, because its things non technical people could understand.
For instance, one tenant could be any key escrow system must be open source. We can't base it off keeping the code secret, as then if the code is ever stolen or leaked, the whole system is compromised.
If you can win those arguments, and it just happens such a system can't be built due to the laws of mathematics, you then fall back to arguing which tenants you should break, and ideally breaking any of the tenants would be unpalatable.
My concern is that any increase in already substantial state powers poses a twofold threat. Firstly, it makes future increases more difficult to oppose. Secondly, it risks falling into the hands of irresponsible future office holders.
I suggest that you wouldn't be able to trust your government with your text messages if you fell into one of the following three categories: freedom fighter, wrongly suspected of crime due to unchallengeable secret evidence and targeted for state-imposed restrictions without explanation, actual criminal (possibly under a homophobic, misogynistic or racist law).
I'm not sure about the banks, but maybe some of the above applies to them, too.
The New Zealand parliament has identified five "institutionalised checks on executive power". (They are a codified constitution, an elected head of state, a bicameral legislature, devolved powers and proportional representation.[0]) Only two exist in my country (the United Kingdom), neither of which is available to me, because one of our legislative chambers is unelected and (like the majority of the population) I don't live under the jurisdiction of a devolved legislature.
I don't understand your last sentence. By "insurance", do you primarily mean checks and balances? If so, which ones matter to you?
[0] See Table 2 on this page http://www.parliament.nz/en-nz/parl-support/research-papers/...
Then after reaching the public there must be a compelling relatable story. Applied did it a bit when replying to FBI's request:
-- Weak encryption means more identity theft. This is a good one. Everyone knows someone who lost a phone, a wallet and then thieves emptied bank accounts, caused grief, time wasted and pain for years to come. This works and is great.
Others I can think of:
-- Point to large scale data breaches, even Government's own OPM office was hacked by Chinese. Having back-doors in everything means more such large scale failures.
-- Take their own rhetoric and spin it around. Look Snowden stole all those documents right under the nose of the NSA. Point to their own incompetence and say imagine future such incidents with a perpetrator walking away with "master keys". Remember to repeat phrases like "it is not a matter of if but a matter of when". That was used by talking head security experts on TV post 9/11, this one works great. I like it.
-- Point to physical analogies where master key has been lost. Was it a case for NYFD or some place like that. Where it was mandated all these places have a master key and it was copied and used for criminal activity.
-- Find something with terrorists. Nobody will ever defend terrorists. Any case where Chinese terrorists hacked Google through a backdoor created to handle government's access to data.
-- Everyone loves freedom of speech and hates when worthy dissidents in countries we don't like are martyred. Point out how strong encryption has saved lives and provided the only channel for communication freedom fighters.
The list goes on... but that's the gist basically
I would point out that these "keys" are actually computer files that act like digital keys (obviously), and the bad guy will instantly make 100,000 plus copies of the key and distribute it to his network of bad guys (bot net) and begin breaking into hundreds of thousands of houses every hour.
Also, what happened to all the talk about cybersecurity? It seems like the TV media was interested in cybersecurity for awhile, but I don't hear about it anymore.
This is dangerously naive. Technically-minded people often make the serious mistake of assuming politics follows any kind of logic. It doesn't; politics is often self-contradictory.
These people know how crypto works, at least at a high level. Many of these players knew 20 years ago in the first crypto war. They just don't care; rules that are hard to implement or require interpretation can be selectively enforced.
This is a power play against technology companies. If they want to survive, tech companies need to start banding together and fighting this in the court of public opinion. As half of those companies are involved in advertising, this shouldn't be hard.
The near future will reveal who is willing to fight for their own future and who is a collaborator.
I respectfully disagree.
I believe they think they know how crypto works, and that they may even have excellent advisors who know exactly how crypto works. But I believe that they cling to the notion that the underlying math can somehow be compromised with a back door (that only the government knows), and yet still remain secure.
I absolutely understand that this is a power-play, but the senators would frame it as technology companies being "uncompromising," implying that there is some sort of gray area where the math is concerned. This suggests either they are ignorant, or they're lying to gain position, or both.
Given that the FBI is claiming they can be trusted with secrets (escrow keys, privileged source, etc.) while apparently having their private networks play host to a variety of hackers, unnoticed for years--would you rather believe your leadership is lying or ignorant?
EDIT
The community can down vote but can't respond to the truth.
Same problem exists in "red" states, where conservative politicians can get away with all kinds of corruption and madness because who's going to vote for a baby eating liberal? Basically if your state is very Democrat or very Republican you have single party rule and your politicians are dictators.
The culture war must die if we ever want any meaningful progress on any other kind of issue.
The point is the tech scene can't even get their representatives to represent them in their core issues. Belief in elections mattering is akin to belief in the tooth fairy or Santa Claus.
Your vote alone doesn't matter, you say? Do what you can to educate those around you on the issues. Make them think twice before re-electing someone with such a bad record.
For the last 40 years, Americans have been bombarded with the idea that voting doesn't matter. That "both" sides are just the same. That all politicians are crooked and corrupt. These are all lies.
Our voting levels are abysmal, especially at the local levels where politicians such as Feinstein get their start. Low voting levels means only a small and vocal minority of people actually have to be convinced to vote for a person. Or at least not vote for another person. Running for election continues to cost more and more money, which perpetually give money an advantage.
Meanwhile, many places like Arizona continue to make voting as difficult as they legally can. Most other places continue to avoid making it easy to be an informed voter. My favorite state's approach to voting is still Oregon. Vote by mail and including a wonderfully produced voter pamphlet to help inform voters.
Elections can have huge impacts. It just requires people to ACTUALLY VOTE. Most of these politicians represent the people who do vote. Or at least strive to not work against things they value. Look at how powerful the Tea Party style Republicans are right now.
I won't say money isn't a problem in elections. It is. I won't say popular vote doesn't have its downsides. It does. Elections in America need to be reformed to allow more nuances than two party platforms and to help ensure everybody can take a part in the process.
It's a perverse fantasy to look at elections and declare them a fantasy. They do matter and have changed this country so much since the Civil Rights Act reshaped the country. Conservatives figured out how to use a minority of very motivated voters to craft a political movement that has changed everything about this country. For good or ill will depend on your politics, but it would be the height of ignorance to pretend it didn't.
Elections do not matter, not for anything important. The civil rights act happened because people were willing to go to jail over what was right, the same goes for the draft.
Gerrymandering has made most elections farcical, and money does the rest.
Running as an independent is a way to get exactly nothing passed as both parties, which really are just one two-headed Hydra, will shut out outsiders.
And this only covers elected officials, most laws and regulations are made by life long bureaucrats.
It's amazing the myopia of people, this bill is but one of the thousand examples of our corrupt illegitimate government. Again the government does not care for you or your beliefs, it cares for power and money, it will pass secret trade deals, it will pass secret laws in secret courts, it will torture and imprison those that oppose it.
Does anyone have an honest response? America is a corrupt police state run by an unaccountable elite.
Amazing how so many people refuse to see the truth that is so obvious.
In any case, our entire system of government was built around the idea of protecting against a tyranny of the majority. For entirely valid reasons, a majority of the people might support a disastrous policy. Ideally, our system is able to protect against the implementation of those policies. Doing so doesn't make your efforts corrupt and illegitimate.
Money is always going to be involved in politics. There's no getting around it, and anyone who argues that you can "undo it" is deluding themselves. You can, however, push for policies that increase accountability and make sure that funding takes place in the light of day. But that's an entirely separate, complex issue.
There was 15% voter turnout for the 2012 primary in which Feinstein (49.5%) and Emken (12.7%) were nominated. In other words Emken got on the ballot to challenge Feinstein with only 1.9% of voter support.
To run a successful campaign to challenge incumbent Democrats with pro-liberty Democrats in the general, you possibly only need to get ~ 2% voter turnout for your candidates.
This is pretty feasible to do if California residents actually cared.
https://en.wikipedia.org/wiki/United_States_Senate_election_...
Talk here is fine, but it's more useful to let folks on the hill know what's up.
I think the bill is over-the-top bad; they are obviously going for a compromise of some kind. By appearing to reach a middle ground they can paint the pro-crypto camps as being uncooperative.
Of course, there's no middle ground with math.
The US government may be able to spend billions on specialized devices but eventually they are going to be left behind. Sounds like Assange's goal behind Wikileaks. Eventually, they can keep no secrets.
I think the CIA-NSA is smart enough to figure this out. It's not going to fly.
There was a report of someone speeding. Use the awesome government powers to subpoena cell phone connectivity, credit card transactions, or whatever to identify the speeder.
Police have auctions for seized stuff, presumably you could just auction off that data off to recover the costs (and then some)
Then repeat, over and over.
If you're feeling really enthusiastic, start targeting aws's DOD stuff. [1]
If this passes and five years later computer security is swiss cheese, politicians know that most people will blame the computer companies and vendors not the government.
If this fails due to tech company opposition, they will get to avoid any criticism for not preventing the next terrorist attack. Instead they will simply find one encrypted iPhone and blame Apple.
All thoughts on civil liberties aside, it's sad that these officials don't even realize that what they're asking for is (or will hopefully shortly be) impossible for companies to do.
Then the real fighting will start. I'm sure Congress sees this proposal as a middle-ground between DOJ desires and freedom/privacy, but once it dawns on them that things like "no knowledge" encryption are really what it says on the tin, they will feel backed into a corner, with the only visible choices being something asinine like, criminalize encryption or ... give up?
Maybe that's something for this community to start thinking about, if we want to have a constructive say in this whole mess. Come up with a way to frame the "Give up" option in a better light, so Congress can point to it and tell the DOJ "look we did X for you", while still not outlawing encryption.
Let's keep in mind that our legislators are responding to a genuine fear in the electorate. It's our job(s) as technophiles to educate the electorate and legislature as to why this isn't the right move.
This is where SCOTUS really pays off as a check against Congress. They can be surprisingly practical (sometimes). This blog article by djb [1] really makes a good case for why encryption is speech (and the fact that it has utility is orthogonal). Recall that Bernstein v US was a driver for real progress in the government's understanding and treatment of encryption technology.
While I agree with this, I don't think the most important part of crypto == math is the connection to speech. The most important part is that math doesn't compromise. You can't make math kinda work...it either does or it doesn't. You can't make math work for some people and not others. Math is absolute, so this debate is absolute. The result is either secure applications or fundamentally insecure applications.
This is where the government's "we've got to find a compromise" rhetoric rings hollow, naive or disingenuous, depending on how much credit you're willing to give them when it comes to technical acumen. Compromise, when it comes to encryption, means compromised. When encryption is compromised, that encryption is fundamentally broken and dangerous. Crypto == math means there can be no compromise with the government's agenda. And it's not because we don't want to be reasonable, it's because math doesn't care about court orders, the law, the government's authority or good intentions.
The government is not one uniform thing. I think there's elements of the government who feel like the compromise is appropriate and don't realize that Key Escrow is the only possible compromise and don't realize why it's already been reviewed and rejected. They might mistakenly think that the objections are somehow needlessly idealized or dogmatic. I don't think they're naive at all. They're just mistaken. On the other side, there's other elements of government who are totally aware and willing to exploit the fear of the electorate and legislators in order to achieve their goals. That group is definitely disingenuous.
So it is any surprise that a lot of our legislators (at least those who aren't leading the charge here) are grouping arguments against backdoors into the same category based on their past experiences? They don't have the background or theoretical grounding to realize that, this time, the realities of mathematics really do make this issue unique.
It's a mess, with no clear path in sight. In addition to lobbying and supporting new candidates, any united effort to defend against these intrusions is going to have to include a massive education program meant to inform legislators on the dangers of what they're proposing. And it'll have to be tailored to how legislators actually think about policy. The arguments that work amongst the tech world aren't going to work in Congress. Not because they're idiots or anything like that, but because radically different backgrounds and experiences can affect how information is processed.
The drafters of the bill clearly don't fully understand or care about those issues though, and if they did they'd probably see it as an acceptable compromise to security in order to enable government to see all communications.
[1]https://en.wikipedia.org/wiki/Door-in-the-face_technique
I disagree with the conclusion that the DOJ needs to be offered anything. It's like giving a rude, angry, loud customer a discount to appease them. You're just training them to be more rude, angry, and loud in the future.
They should lose as much face as possible. That's the only way to shut them up. If they look completely incompetent, they risk losing funding, because nobody likes wasteful government spending on incompetent agencies.
Obviously there's no financial incentive for any of this.
The government already has e-mail inboxes with a nearly-unusable UX, messages that pass through so many unreliable contracted-out systems that they might not get delivered for several days, hideously obsolete "smart"phones... and yet this pain isn't felt by the people making the laws, just by their staff.
We're talking about a place where the Blackberry is advanced technology.
Your suggestions would involve companies dropping their government contracts out of spite, for an effect that the government would barely notice.
How can we stop this...Vote! Vote the people that support this out of office.
....also...If they want to make everything unsecure...hack the congress members bank accounts, private information, Ashley Madison account, every email and text they send, every phone call they make...every password they've used on any site ever. Make them wish they never made such a stupid law. Maybe then they will learn how important encryption is.
Not the first time: https://en.wikipedia.org/wiki/Indiana_Pi_Bill
If your company ever has any way to view the data, the government will find a way to force you to give it to them.
[0] http://www.nbcnews.com/id/4534017/ns/technology_and_science-...
What would we do if this passed? I suppose I would winnow and chaff the hell out of my data, sending literally 42 gigabytes of garbage bytes for every one-kilobyte file. That way, if somebody wants to decrypt it, they will at least have to sift through tons and tons of garbage to do so.
It seems to say that if a company can read their customers data in plain text, then that plaintext should also be provided to authorities upon request/warrant.
So the bottom line is: use strong crypto and build products with strong crypto and ensure only the end users hold the keys to the data. Then all the aid you can give authorities is "no can do" - and that's still acceptable? I'm kind of fine with that.
Anyway, if there's a product out there which doesn't provide this capability, no amount of bill passage is going to make that product work like some congressperson wants.
"covered entities must provide responsive, intelligible information or data, or appropriate technical assistance to a goverment pursuant to a court order."
I assume that this includes secret FISA orders, but what's with the language about "a government"? Could this be construed to include non-American governments? (i.e. Five Eyes?) Or is that a term of art?
> Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction.
If you've done anything illegal, they can't compel you to work?
Seems to make this whole thing sound unconstitutional.
We must combat ignorance by educating the ignorant, and that includes elected officials. Many here at HN have knowledge and high level of awareness of the importance of privacy and security, and I'm sure there are more than a few genuine experts tuning in. In any case most of us probably have salient information and experience to share, and it certainly needs to be shared.
If you are a US citizen by all means write to your Representative and Senators. Voters' opinions do matter, particularly in an election year.
This afternoon, I sent messages to all 3 members of my congressional delegation exclaiming how bad an idea the Burr-Feinstein bill happens to be. I urge you do do the same.
One of the major gripes of the American revolution was the forced quartering of soldiers in people's homes.
It will be handled that way until the process makes its way through the courts.
So no more Hash functions I guess, better store those passwords in clear text. Also encryption is the key to any form of distributed system where you have misbehaving actors.., you know like the internet..
(written on an rk3288-based ARM laptop from China, over a VPN from Iceland)
Could someone explain what this would look like, in a practical sense? Would self-signed keys become illegal, and all PKI would have to have a "government" parent key of some kind?
Based on this it appears not. Here's how I imagine it going.
1. There's something the government wants that you've stored on some SaaS website like Dropbox.
2. But you've encrypted all of your files with your GPG key so Dropbox gives the gov't access to the files and then tells them that's all they can do.
3. Now the government needs your key so they raid your house and take your say, Dell laptop.
4. Now you use FDE and Secure Boot with a custom key so your device is locked tight.
5. The gov't then goes to Dell and demands that they use any exploit they know to unlock your device.
6. So long as you've chosen a good strong passphrase Dell will do their best but ultimately tell the gov't that there's nothing they can do.
If you're talking TLS, whomever holds the private key would have to use it to decrypt either stored or transmitted data and turn that data over to the feds. If you're talking PGP or something, then either the makers of PGP would have to put in a backdoor, or stop making it.
To implement this all the government would need is to send an NSL to anyone who creates, owns or operates any tool with encryption technology, or anyone who operates a network or service that encryption is going over.
If not, then perhaps a lot of big US tech companies will move offshore?
Thoughts?
So, as we set out this year to defeat the divisive forces that would take freedom away, I want to say those fighting words for everyone within the sound of my voice to hear and to heed, and especially for you, Mr. <insert politician here>: 'From my cold, dead hands!'
— Crypto's Charlton HestonThe bill mandates technical assistance, yes, but the obvious argument is that no amount of technical assistance can accomplish that which is impossible. If the data can't be accessed, it can't be accessed. Interpreting this as barring companies from implementing those implementing those features would require an unduly expansive reading of the text, to say nothing of issues with Sect. 3(b).
Sect. 3(c) seems to contradict that, but 18 USC § 2711 defines a "remote computing service" as "the provision to the public of computer storage or processing services by means of an electronic communications system" [0]. That would seem to include iCloud services, for instance, but not the iPhone itself. For reference, 18 USC Chapter 121 covers the storage of electronic communications and access to transactional records.
It's possible that this is part of a long-game. Breaking the encryption debate down into smaller pieces lets them control the narrative a bit more and defuse some of the strongest arguments against backdoors and weakening encryption. They can point to this bill a few months down the road and see "look, nothing bad happened. The evil hackers those San Francisco techies were complaining about never stole your identity." It would make the opposition appear more reactionary, and give them more time to muddy the water further.
To the average person, the bill seems entirely reasonable. Who could object to companies giving assistance when they have to comply with a court order? In that sense, it's a perfect starting point.
But most likely, this is a trial balloon meant to help them refine their arguments and position before they get around to a concerted push. That seems likely given that the Senate Intelligence Committee doesn't really have jurisdiction over this issue [1][2]. If they can pass it, great for them. If not, they'll come back around for another go in a bit. They've got the time, and for various reasons, they've chosen this hill to fight upon.
If the want to stop these efforts before they eventually manage to stumble into a "success," the tech industry eventually has to gear up for a lobbying and PR war with a degree of cynicism that's unheard of in Silicon Valley. Eventually, simply reacting to the government's efforts isn't going to be enough.
Groups like the RIAA and MPAA, even when they've failed to actually implement their policy proposals, have had remarkable successes in manipulating Congress to go along with their plans. At least until they backfire. Like the NRA with the second amendment, encryption will have to be the primary focus. Everything else has to be secondary. Supporting backdoors and the weakening of encryption has to be transformed into a toxic issue for politicians. Hammer home the potential consequences to every retiree and everyone else who doesn't like the idea of their identity being stolen and their assets being spread amongst the criminal element.
With this debate, there's really no room for optimism or taking the "high road." There's no high road in sight, and success is the only metric that matters here.
0. https://www.law.cornell.edu/uscode/text/18/2711
1. https://www.eff.org/deeplinks/2016/04/burr-feinstein-proposa...
It is the sense of Congress that--
no person or entity is above the law;
economic growth, prosperity, security, stability, and liberty require
adherence to the rule of law;Confused here, I thought that the process between Apple and the FBI was taking place in the courts and not on some kind of aquatic platform in international waters.
If encryption becomes widespread and providers/individuals start using it correctly, then it will greatly hinder law enforcement's ability to gather physical evidence for certain types of crimes.
At the end of the day this is just another situation where we have to weigh the positive of greater freedom against the negative of the impunity this freedom may provide to those breaking laws that we all support.
I don't know what the answer is, but acting like anyone who supports this legislation is just after more control is immature.
To suggest otherwise is to say that security isn't important at all.
Or could you concretely suggest some areas where communications shouldn't be encrypted? Offer up some sacrificial lambs.
There's nothing anyone can do about this, you cannot hinder encryption, it is just pure math.
You can ban encryption all you want, it will never ever stop terrorism in any way. All that will do is harm the good people that have legitimate reasons to protect their secrets from everyone, not the bad people.
What's the question?
>acting like anyone who supports this legislation is just after more control is immature.
It's mostly driven by fear based emotional responses rather than logic, the terrorists have successfully hijacked their amygdalas[1], a classic social engineering technique.
When a target cannot be directly and effectively neutralized, scare tactics are used to make the target compromise themselves.
"As for us, we behave like a herd of deer. When they flee from the huntsman's feathers in affright, which way do they turn? What haven of safety do they make for? Why, they rush upon the nets! And thus they perish by confounding what they should fear with that wherein no danger lies. . . . Not death or pain is to be feared, but the fear of death or pain. Well said the poet therefore:—Death has no terror; only a Death of shame!"
-Epictetus