Intelligence Committee Leaders Release Discussion Draft of Encryption Bill
feinstein.senate.gov
feinstein.senate.gov
We can argue all day about how the law doesn't prevent criminals from using technologies (it doesn't, which makes the law idiotic, from a logic perspective), but that's not the important part.
The important part is that this group of folks we're calling Government is trying to prevent us from being allowed to have secrets and whisper to each other.
Government is not as stupid as we'd like to think. Government doesn't believe that "terrorists" will stop using encryption. These laws are not for "terrorists". They're for us. Take away somebody's ability to keep secrets, and you've gained a pretty good advantage over their position[1].
This is about only one thing: leverage; and leverage is power.
1. https://en.wikipedia.org/wiki/Enigma_machine#Breaking_Enigma
We should tell other people that the law does not stop criminals from hiding their communications. Some people don't understand the nature of software or open source, and it can be explained.
> The important part is that this group of folks we're calling Government is trying to prevent us from being allowed to have secrets and whisper to each other.
Personally I think the people who support this kind of law are the same ones who believe they have nothing to hide from the government. So the privacy argument is lost on them. When you point out the law is harmful to their security and impossible to enforce, then there's a chance you'll be able to convince them.
This is a great opportunity for technologists to chat up their friends and family, start campaigns, or perhaps even run for office. This issue is an easy win if you can keep a cool head while explaining the facts.
The point I'm making is that I don't think it's lost at all. I think these people didn't all get to be in positions of power by being bumbling idiots. They know that they can convince some portion of the masses that they are in danger and need help. And that's all it takes to get a leg up on everyone; a portion of the masses.
I don't think our elected officials are bumbling idiots. But they aren't informed about everything either. It's impossible to be an expert across all fields.
As technologists, we think this issue is so straightforward that you must either be evil or a complete idiot if you support this law.
We'd do well to take a step back and observe our thought process. We often think things about computers are simple which others don't understand. That is why we get paid.
It seems like pretty common sense wisdom that being in power usually leads to wanting more power, and also that power often corrupts. One does not need to be a "conspiracy theorist" to come to this conclusion.
The real conspiracy is the apparently concerted effort to call anyone that believes the government is busy grabbing power a "conspiracy theorists".
It doesn't. You were saying some government officials are saying one thing to the public while knowing another to be true:
>> We love to think these people are much like our clients who don't know the difference between a popup window and a Python program. These people are informed by groups like the DIA, CIA, NSA, and every other TLA, with a wealth of information on these issues.
That implies some sort of secret plot that would harm the integrity of our government and country.
> It seems like pretty common sense wisdom that being in power usually leads to wanting more power, and also that power often corrupts. One does not need to be a "conspiracy theorist" to come to this conclusion.
I agree entirely.
> The real conspiracy is the apparently concerted effort to call anyone that believes the government is busy grabbing power a "conspiracy theorists".
Nobody said this. Claiming that there is a concerted effort by officials to lie, however, is accusing them of conspiracy.
This vibe of distrust hurts the ability of technologists to come together and be as effective as they're capable of being within government. Ultimately, society and its elected government is formed around trust. You have to believe that most of the people who enter into elected positions did so with the aim of improving our society before you can be effective within it yourself.
Yes. This is called lying. It doesn't require a "massive conspiracy".
> implies some sort of secret plot that would harm the integrity of our government and country
It implies nothing of the sort. It implies that Government is losing the leverage that gives it the power to levy taxes beyond what is acceptable by the population, and so Government's present endeavors (partly driven by outside commercial pressure - e.g., military contractors) are overshadowing its primary purpose, which is to protect us and our rights.
I don't think it is either. More likely it is the "something must be done, this is something" kind of thinking. You don't need to be absolutely evil or absolutely idiotic to subscribe to this philosophy.
The problem is that we end debating the right side of that claim (because that's what the uniformed masses and legislators focus on), what the something should be, rather than trying to convince people that the left side, the premise, is unfounded.
To fall into it without warning, no. Like all fallacies, it's a local maxima.
But to stick with it after it's pointed out... At best that's stupidity, at worst it's deceit and treachery.
The Press Secretary recently stated this about the President,
> he believes that strong encryption should be robustly deployed. At the same time, we should not set up a situation where bad actors -- terrorists -- can essentially establish a safe haven in cyberspace. [2]
There's also a commission that was formed yesterday to handle this question. It is called the President’s Commission on Enhancing National Cybersecurity [3] and they are due to give a report by the beginning of December (7.5 months).
[1] http://www.cnet.com/news/megan-smith-highlights-heritage-of-...
[2] https://www.whitehouse.gov/the-press-office/2016/04/12/press...
[3] https://www.whitehouse.gov/blog/2016/04/13/announcing-presid...
The fundamental issue here is that mutual trust between US government and the American people has been significantly eroded. Until this issue is addressed and trust is restored, all other discussions (however informed) are ultimately idle chatter.
Investigate the motive and the means, just like you would a crime, and you won't find yourself in the legislative branch of this government.
The people and Congress have the power to put a stop to bad ideas coming out of law enforcement agencies. Speak up about it.
Better: this law would effectively grant criminals infinitely more protection than law-abiding citizens.
grips forehead and moans
Senator Feinstein, who co-released this draft bill, is also the senator who introduced the assault weapons ban which was law from 1994 to 2004.
https://en.wikipedia.org/wiki/Dianne_Feinstein#Political_pos...
On the opposite side of things, Senator Paul opposes gun control but supports strong encryption.
https://www.paul.senate.gov/about-rand/issues/second-amendme...
http://www.usnews.com/news/articles/2015/03/16/rand-paul-sup...
It depends what is meant by "assault weapon". If you mean fully automatic weapons, then no, but those were essentially banned (with minor exceptions) for private ownership in 1986[0]. Ownership of those had been regulated since 1934[1]. The 1994–2004 "assault weapons" ban covered specific features[2] on guns. Since 2004, purchase of guns with (2 or more of) those features is once again legal. Note that some opposed to the 1994 assault weapons ban claim many of the features are cosmetic, rather than functional.
[0] https://en.wikipedia.org/wiki/Firearm_Owners_Protection_Act#...
[1] https://en.wikipedia.org/wiki/National_Firearms_Act
[3] https://en.wikipedia.org/wiki/Federal_Assault_Weapons_Ban#Cr...
The ban expired because that's what was in the original law. There were efforts to pass a new ban, but they didn't even make it out of committee[0]. Perhaps a presidential endorsement could have helped it go farther, but one can't hold the president responsible for what happens in the Senate and House committees.
[0] https://en.wikipedia.org/wiki/Federal_Assault_Weapons_Ban
During the AWB you could buy firearms functionally identical to banned ones, the only difference being cosmetics.
Republican representatives have been pushing back against these bills. Representatives Amash, Issa, Labrador. Senator Paul.
Last weekend I was at the Colorado GOP state convention and I spoke in-person to Colorado's leading GOP senate nominee and he spoke at length of our need to block this sort of legislation. In addition, I spoke with State Sen. Tim Neville, who was the party favorite for the Senate nomination, and he spoke very highly of the efforts of Amash and Paul.
Of course, they're joined by Democrats like Lofgren and Wyden and Independents like Sen. King.
The GOP is not a homogenous group.
In my opinion, the only political identity that you might hope would fight back are Tea Partiers, and that's the same group that feels strongly about gun rights. I don't think you could be more wrong.
It will be interesting to see what Cruz does here when inevitably questioned about it. Will he alienate his new neoconservative base on this issue? Will he stick to his Tea Party roots?
Is that you, Bush Jnr?
You may disagree with a perhaps naive perspective like that, but that interpretation does not make it any less real. There are plenty of common folk who would agree in the above scenario data in plain text should be made available upon lawful request by either carrier or mfg. That's not "the government" and to think so kind of misses the mark.
We already have this concept of "the government can go through your stuff" in the form of search warrants. It's not a leap at all to apply that to encryption, too, even if some specific law gets it wrong at first.
I'm sure if pocket enigma machines were around when these laws were first being put to parchment, there'd have been something in there about encryption from the start.
The problem is that your government wants to break all forms of encryption regardless of where or how they are used. Either they want something like a skeleton key or a method of bypassing the security altogether.
So they're not requesting a search warrant. They are requiring that you hand over the keys to your home or install a special door for them that is always kept unlocked.
This is a relatively new area, so we must careful to be precise with the terms we are working with. Like naming variables.
>encrypted data should be made available in plaintext
'Encrypted' data that can be rendered as 'plain text' or any other interpretable form of data upon certain conditions being met outside the scope of the initial encrypter is not 'encrypted data.' But could rather be referred to as something like 'concealed data.'
Encrypted data is data that is only accessible to those who have been authorized to access it by the initial encrypter.(setting aside human error in encryption techniques)
This definition follows exactly from the use of modern encryption algorithms. Therefore, encrypted data accessible to anyone other than 'Alice' or 'Bob,' is not in fact encrypted.
The difference is that when it's not the government we're free to disagree. We're only concerned with people wanting to force it on us which these civilians with their personal concerns would not be doing.
> You may disagree with a perhaps naive perspective like that, but that interpretation does not make it any less real.
You may honestly hold a view but that does not make it any more real or sensical.
People want the comfort you describe (easy unlock) and perfect security. They believe it's possible but they resist thinking critically about it.
> For the common people this comes in the form "I believe my dead relative's phone has information which will expose their killer, I want the carrier or manufacturer to make that data available, it's legally my phone, not Apple's or Samsung's, I want that data."
And if the data was in a safe you'd be saying "It's legally my paperwork, not American Safe Co's paperwork. I want that paperwork." If you hadn't planned ahead they wouldn't be able to help you either.
If you don't have anything super-secret or valuable in the safe you can take advantage of bricks-and-mortar key escrow like putting the key/combo in a safe-deposit box, or trusting the manufacturer to hold it such as with restricted keyways and encrypted bitting patterns.
And similarly, you (or rather, the relative who might be killed) could buy a phone with some family unlock option on the cloud backup or they could put their unlock code on a piece of paper, put it in their safe-deposit box, and will it to you in event of their suspicious death.
We're all worse off if unlocking a phone or safe is easy to do without these measures. It's better that a few people lose their paperwork than that none of us are ever secure in ours.
Yes. This is a great way of saying this.
That is already the case. If you whisper a secret into my ear, the government can subpoena me and force me to tell a court what you said. They can force you to tell a court what you said so long as it's not incriminating to you, and even then they can do it if they give you immunity.
We can debate about what the law should be, but for the last several hundred years, the law has not really contemplated people keeping secrets from the Government. "Privacy" as it has been understood to date means protection from the government fishing for evidence without probable cause, not an absolute right to keep secrets.
Pervasive, unbreakable encryption is a game-changer that requires rethinking the existing framework. We're not just talking about not being able to get data from a terrorist's phone. We're talking about the bread-and-butter of many sorts of criminal prosecutions being opaque to the government. Good luck convicting someone on insider trading when all the relevant communications are opaque to the government.
I happen to think that the benefits of encryption outweigh the challenges to law enforcement. But its disingenuous to pretend that the government is trying to "take away" a right to "keep secrets" that you already had. Our whole legal system is built on being able to get whatever evidence is relevant wherever it may be found, with extremely narrow exceptions.
And while we're at it, why is the existing state of affairs not good enough? Why the attempts to subvert the message pipe? After all, the govt can still compel people to talk, and its people receiving those secret messages.
The reason is, to my cynical mind, that they're interested to avoiding the work of warrants etc. They'd like to sidestep privacy entirely, and just record everything in the pipe. Not entirely cynical; its exactly what they've done with the tools they already have.
In my mind there's an enormous gulf between subpoenas of a person for information, and the ability to get that information secretely and continuously.
That being said, the ostensible purpose of this bill is to govern what happens in response to a valid court order.
This is true, but they can't compel me to inform on someone who had a whispered conversation near me that I couldn't hear. To me, the current bill is more like the latter scenario.
If I invented a communication device consisting of two cans and a connecting string, then sold it as a way for neighbor kids to talk privately to each other, they could not compel me to divulge the contents of their conversations because I wouldn't have access, even though I built the canmunicator. I think that in this case, what they're doing is more like mandating that I have a way to let them monitor all string vibrations.
If they want to subpoena information, they can demand that one of the parties actually involved in the communication surrender their keys. If they refuse, then it seems like basically the same situation as when both parties to a whispered conversation refuse to talk about it.
Incorrect.
Government can attempt to legally compel you, but they cannot actually "force" you to do something. Even torture cannot actually "force" you to do something. What can force you to "tell a court what you said" is making it impossible for you to keep a secret; like mind-reading technology.
> ...legal system is built on being able to get whatever evidence is relevant wherever it may be found...
Think about it for a minute; Government says "tell us what you whispered", you say "no", then Government says "fine. you go to jail for contempt". Has our society collapsed because people said "no" to this question?
> ...being disingenuous to pretend that the government...
I'm not sure "disingenuous" was the word you meant to use here. There is nothing I've feigned ignorance about, and I've made my points pretty clear.
EDIT:
Ah, see @JoeAltmaier's already great sibling reply.
It is. But - I'm sure you've heard this better stated before, but - the first game-changer was the massive volume of everyday conversation and chatter that has moved from ephemeral speech to various digital forms, such as SMS, Facebook, messaging apps, or this very site, and thereby (usually inadvertently) preserved indefinitely, along with a ton of metadata such as location information. Digital message records are in theory the same type of information as, say, the result of a subpoena asking someone what they heard in a not particularly important conversation in a private space three years ago, but the former's volume and precision creates a significant qualitative difference. Using encryption to take that information out of the government's reach is in large part a return to the status quo.
Of course, for the case of stored information on a phone, an alternative to encrypting such data is just periodically wiping it - something which, if Snapchat is any indication, appeals to people at some level and should be more widespread.
That is, you said it is a "game changer," and not a game-changer. You have to issue subpoenas, conduct depositions, etc.
Point out all the times that government databases have been hacked, and that if their secrets are swept up in government dragnets, it's only a matter of time before blackmailers and identity thieves get hold of them.
The pro-privacy lobby has 2 big boogey men: "criminals" and "the Chinese". What's our third boogeyman? We must close the boogeyman gap!
I suppose "crooked LEOs" doesn't have enough of a ring to it.
Um... how about Government.
I'm not suggesting that Government is intrinsically a boogeyman (and I'm not an anarchist), but first and foremost on the list of entities that privacy and weapons protect citizens from is Government.
This is one of the things that the Snowden leaks should have made clear to everyone but sadly that isn't the case.
Sure, I don't think Obama is going to throw me in jail and I have nothing to hide now...but that doesn't mean in 20 years there won't be some Nationalist/Authoritarian type in control of the country like we saw with countless fallen democracies in the 20th century.
Similarly, the Government has shown it incapable of keeping a secret with the sheer number of security failures they've experienced. So anything they have, we can assume is both public and indefensible. They use this capability and they might as well hand the information to criminals on a silver platter.
A huge amount of my social and work communication is via IM, text, email etc. What is the justification this should all be recorded and reviewable but things I say in person are not? I don't see a huge difference at this stage given how much communication happens online now.
Feinstein's seat is up in 2018, and she'll probably retire. How do we ensure our next Senator has a more technically literate position on encryption? Who are the plausible candidates?
In the 2012 open primary, the next highest Democratic candidate only got 2 percent of the vote compared to Feinstein's 49.5. So who is waiting in the wings?
Donate to the EFF: https://supporters.eff.org/donate/button
Call your Reps: http://TryVoices.com
Petition the President: https://savecrypto.org/
Comment all you want on HN or whatever forums you like, but they're basically echo chambers, and nothing really matters unless you make yourself heard to the politicians.
[edit: I just called. It'll take you like two minutes]
[edit: I made the phone calls in front of my 11-year-old son, who was eating breakfast, explaining who I was calling and why. He totally gets it. I'm not sure why a certain set of senators do not get it.]
Maybe your friends think they have nothing to hide, but when they consider they may want to shield their children from harm, that might make them start to think about what is actually at stake.
An excellent point.
However, its power is limited by all the times "think of the children!" has been used as the rallying cry for anti-citizen legislation. So it has to be strengthened. You're on the right track. The cliche turns into a platform when you have concrete examples that are identifiable to the Android/iPhone toting parents. I am willing to guarantee that the "most frequently visited locations" available on both platforms would illuminate a parent's employer, home, maybe the favorite lunch place, and the school(s) of their young children. Possibly even that their kids have medical issues (pediatrician is a frequent stop) or are on the autism spectrum or have some other developmental delays (speech pathologist or occupational therapist or developmental pediatrician is a frequent stop). Or that they're new homeowners (lots of trips to Home Depot and "big box" stores) Possibly (gasp) where they take their lover when they're supposed to be with their spouse.
No it's not, because that's going to blow up in your face. This law is going to be put in place to protect the children. Bad people can't hide child porn. Bad people can't hide their plans to hurt your children. Bad people can't ... etc. Hand in hand goes 'good people' can track your children if they're kidnapped.
Think of the children always works in the favour of those trying to consolidate power.
In 2011 Americans made over 8 million phone calls to their representatives in opposition to SOPA/PIPA. The bills were defeated. [2]
[1] http://techcrunch.com/2014/08/05/inside-the-fccs-1-1-million...
[0] http://www.theverge.com/2015/12/18/10582446/congress-passes-...
People must understabd this, to disagree is to be disingenuous on the face of mountains of evidence. The American people have zero say on policy, the laws the government wants the government will get, it may take a few more years but it will happen.
The system cannot be reformed, it's very core is corrupt, those who disagree are for the status quo of the police state and they are our enemy and the enemy of justice.
Personally I like to comment on this issue because it's about free speech and I like talking about that with people who are willing. Also I think technologists have a good chance to practice speaking up about this issue and be heard. Normally we are back-office people =)
To get to that point sooner, we should elect more people who are knowledgeable about technology. If you disagree or feel that is an impossible route, you may be able to find others who feel similarly. Personally I think people who feel this way are part of a minority and that limiting your interactions to a certain group is isolating and not productive. I am always looking for ways to engage people with different ideas, both to learn and to share what I've learned.
Ultimately, I reject vox_mollis comment that participation in the democratic process is worthless or powerless. Just listen to This American Life's episode on "Take the Money and Run for Office" [1],
> Barney Frank: If the voters have a position, the votes will kick money's rear end any time. I've never met a politician-- I've been in the legislative bodies for 40 years now-- who, choosing between a significant opinion in his or her district and a number of campaign contributors, doesn't go with the district. [2]
Or look at how Lindsey Graham changed his mind in the encryption case [3]. Our representatives are not entirely useless. Similar to your day job or at your school, some people are good at what they do, and some are bad at it. That's no reason to throw the baby out with the bath water. We have the longest running democratic republic in the world. We should study it, contribute improvements by speaking up and voting, and be proud of it. Much of the rest of the world faces strict repercussions when they even speak against their government.
[1] http://www.thisamericanlife.org/radio-archives/episode/461/t...
[2] http://www.thisamericanlife.org/radio-archives/episode/461/t...
Richard Burr is up for reelection this year. Remember to send money to his opponents. We might want to look for any other groups that have issues with Burr and send them money too. Perhaps this is how you kill a bill.
There is definitely a market for this for anyone who wants to pioneer it. We ran a bunch of Cryptoparties and at each we had to clarify that we weren't a political organization - strictly an educational one. This seemed to disappoint a number of people.
That was my first time calling and it was surprisingly painless.
I opted to provide my name and zip code. I think that allows them verify that I am a resident and maybe makes my comment carry more weight than it would without personalizing it. They seemed willing to accept comments either with a name or without one.
You almost surely will be placed on a list of possible dissidents, your life will be sucked in a government database and your communications more closely watched.
Those things this is crazy have had their head buried in the sand this last decade.
The political process is broken, America is despotic police state ruled by an illegitimate, unaccountable elite.
There of thousands examples of government abuse at every level and officials are never held accountable.
Torure? Pass. Bomb a hospital? Pass. Assisinate children and emergency responders? Pass.
The people on HN live ina fantasy world where they still think calling btheir rep does anything besides putnthem on the government shit list.
How can you utter that sentence and simultaneously not understand why your bill is effectively worthless for its stated purpose?
Pious idolization of the State.
Not to say that I'd approve this farce.
I hear hand guns in particular are quite accident prone. Even if there's less crime, we might still have more deaths.
PS: I have actually been paid to look into crime statistics. Guns are bad, really really bad. But, you can twist statistics to say the sky is orange if you want to.
He came into it with a bias but still ended up with the opposite book from his intentions, due to honest research.
Either way you meant it, that is your individual belief based upon your own preferences, and there are literally millions of people who would disagree with you on this particular point. If there were no exceptions, where would all those dissenters go?
Not even close to factual.
This is more akin to knife control.
Of course the knife analogy is still useful. We all know the futility of outlawing software.
I would prefer to see lock analogies. Here's a half baked example: This is like a law requiring all builders of buildings to install locks that can be opened by any person who gets access to a copy of a law enforcement key.
> Just look at gun control arguments
> to see why people think outlawing
> activity will stop criminals.
>The authors conclude that "the hypothesis that Australia's prohibition of certain types of firearms explains the absence of mass shootings in that country since 1996 does not appear to be supported
>In 2006, the lack of a measurable effect from the 1996 firearms legislation was reported in the British Journal of Criminology. Using ARIMA analysis, Dr Jeanine Baker and Dr Samara McPhedran found no evidence for an impact of the laws on homicide.
>In 2005 the head of the New South Wales Bureau of Crime Statistics and Research, Don Weatherburn,[49] noted that the level of legal gun ownership in NSW increased in recent years, and that the 1996 legislation had little to no effect on violence.
One of the only 'wins' seems to be that people who committed suicide were less likely to use guns, but more likely to use other methods.
>As hanging suicides rose at about the same rate as gun suicides fell, it is possible that there was some substitution of suicide methods. It has been noted that drawing strong conclusions about possible impacts of gun laws on suicides is challenging, because a number of suicide prevention programs were implemented from the mid-1990s onwards, and non-firearm suicides also began falling.
>Most recently, McPhedran and Baker found there was little evidence for any impacts of the gun laws on firearm suicide among people under 35 years of age, and suggest that the significant financial expenditure associated with Australia's firearms method restriction measures may not have had any impact on youth suicide.
You think legislators do not understand the subject because of what they said?
You believe what the politicians say?
Depends. Frequently not as can be seen when the policy to achieve "x" does nothing of the sort, loses them the election or becomes some sort of personal vanity thing. Of course it depends on if the views expressed are of the politician or the party after you've attempted to pick out the double meaning. :)
> You believe what the politicians say?
If it's an independent I might. A party politician of any colour, usually not.
"c) LICENSE DISTRIBUTORS. - A provider of remote computing service or electronic communication service to the public that distributes licenses for products, services, applications, or software of or by a covered entity shall ensure that any such products, services, applications, or software distributed by such person be capable of complying with subsection (a)."
I suspect it would practically impossible for FOSS projects to comply, and everyone who creates or distributes free and open source software that is capable of encrypting anything would fall under this definition. Also I don't see any provision for existing software... if this bill passes, are we just supposed to stop distributing software on Day 1 until it can be rewritten to make it possible to comply?
This bill is astonishingly stupid, even when compared to the unusually high level of stupidity of federal legislators.
I do not believe this Congress will succeed in passing a bill that would require Bank of America to escrow keys with IBM and Symantec.
The closest you get is the 4th amendment which only protects against unreasonable search and seizure (without a warrant).
Some argue that the 3rd amendment implies a right to privacy and was the intent of the amendment, but alas it only protects against being forced to house soldiers.
Disclaimer: IANAL
If they proposed something saner and lost, they'd lose completely. But propose something insane and lose and you still might win something.
She is the equivalent of Mitch McConnell for the Democrats.
She fully understands exactly what she's proposing and she's the biggest hypocrite for it.
I really think this country would be better off if CA and TX were not allowed representation in the Senate (and I say this as a Texan).
Removing national government representation would be more antithetical to democracy than anything that's going on now. A better solution, in my opinion, would probably be new state redistricting. Voters are apathetic because they feel their votes don't count due to overwhelming concentrations of opposing viewpoints, which probably should be split off into their own states (Bay Area, New York City, so on).
If it's just Feinstein and Burr, they can keep dreaming, but I imagine there are a few more.
My point being, the anti-encryption side has the support of nearly everyone who isn't informed about encryption and computing, which is a whole lot of people.
That just means there is more of a chance for technologists to take a leading role in this discussion through activism. It's an easy win if you can keep a cool head while explaining the issues.
Ultimately you shouldn't feel pressured by what other people ask of you. The choice of what to do and how to feel about it is always yours. When other people say it's your responsibility, like even if I had said that, that would just be me trying to convince you. That means nothing when you choose how to feel about it.
But I'm sure that's just a coincidence, and Feinstein is just that loved in California. After all, US is a democracy, not some banana republic!
http://www.csmonitor.com/USA/Elections/2012/1026/Could-e-vot...
https://www.washingtonpost.com/news/worldviews/wp/2016/03/21...
https://en.wikipedia.org/wiki/Nonpartisan_blanket_primary#Ca...
[1] https://en.wikipedia.org/wiki/Moscone%E2%80%93Milk_assassina...
(Edit: What I'm trying to say is that she was the person that found Harvey Milk shot and was one of the people that police asked to identify the bodies of both Milk and Moscone. Certainly being that close to the aftermath of violence changes a person.)
If the 60s counterculture and the rest of America had been geographically segregated like the South and the North in the 1860s, you'd have had secession and civil war.
* There are a lot of Republican voters in California who are happy to vote for Democrats, so even better if they're more towards the right
* I'm not old enough to have voted in too many elections, but her opponent in 2012 was a joke
* She doesn't really have an anti-Silicon Valley reputation (yet)
* California is more than just Silicon Valley
* Likelihood of voting correlates directly with age, and Silicon Valley is dominated by young people
* Her family is just so established in California politics, so the money's rolling in. Her husband is chairman of the University of California Board of Regents.
I'm not a fan either.
California is a conservative state outside of SF and LA, although because of their populations, the state is owned by the Democractic party.
Feinstein is a party machine candidate who can appeal across the aisle to those conservatives. Sure, she'll lose some Democrats, but the base will stick to voting with the party, and enough conservatives will crossover that it all works out.
Note that if SV goes to war over this, and it should, it could change the balance in the state. The problem with this from the SV point of view is that if you sabotage Feinstein, you don't get another Democrat. You get a Republican. And I imagine the Republicans are looking for a little payback if they can ever get the levers of power back.
So what do you do? Do you get rid of Feinstein over this one-issue, idiotic and harmful security state nonsense, then end up with a bunch of folks in power that might hurt you on a bunch of things, or do you grit your teeth and bear it?
Looks like the compromise is to let her posture a bit for the conservatives, then fund the opposition to make sure that nothing she proposes gets through. That's a tricky game to play, though.
Well, not necessarily. California abolished partisan primaries a few years ago. The way it works now is that all candidates for a position run in the same primary, and the top two advance to the general election, regardless of affiliation.
I'm not sure if there have been any races so far that involved two Democrats (it's only been two or so election cycles since the change) but the 2016 Senate race seems likely to be between two Democrats.
Of course there's still the problem of finding a Democrat with enough clout and balls to challenge Feinstein in 2018.
Fetch my geritol before you gear up, sonny.
Things have dramatically changed since then, unfortunately. It'd be fascinating to uncover what caused this marked phase change.
Find Feinstein's comments. Doesn't look like anything changed.
Incidentally, my testimony in the second session that day is at http://www.csl.sri.com/neumann/judiciary.html, along with my answers to subsequent written questions from Senators Thurmond, Grassley, Leahy, and Feinstein. At the end of the first session. Senator Feinstein excused herself to go to another hearing, but remarked that if FBI Director Freeh said he needed access to essentially everything, we'd better give it to him.
She also has access to oodles of money from her husband (TPG Capital).
She's not opposed to being a hippocrite. She rails against guns but has a concealed gun permit. Her secret service detail carries automatic weapons and that's OK with her. It's not OK with most of her neighbors, but again, apathetic voters.
We made the decision to go with an appliance over hosted services because this way if we get hacked, our customers don't.
Part of our product is a secure secret store, and of course we use encryption for many other purposes. Our customers use our software (or standard tools) to generate their own key material to encrypt their secrets.
Very importantly, we can't help the government, or anyone else, get access to our customers secrets. We can't reasonably be asked to backdoor the software, because many of our customers do code reviews and audits on it before buying.
Can someone help me understand how this law would affect my company and others like it, our customers, and their users?
This bill effectively makes it illegal for US companies and persons to build or use secure enclaves / TPMs and to publish cryptosystems without either including backdoors or retaining and storing keys. It also implies that companies would need to store keys indefinitely, otherwise they would not be able to decrypt data, as no time limitations are set on the capability of accessing data.
This would not make SSH or TLS illegal or require users to hand over keys. It could mean that if a US person or corporation contributed to an SSH or TLS library, they could be expected to provide a backdoor mechanism to the government. (EDIT: would not require to hand over keys enmass, or in any way above and beyond current statutes)
Interestingly, this bill covers vendors and presumably US persons that "provide a product or method". You'll still be able to legally use foreign-developed tools. The US would have grounds to ask those foreign agents to decrypt data, but would have limited means of enforcement.
Section 2 (4) spells it out: communication service and software providers. That's the maker of every app on your phone, the phone manufacturer, your phone company, emails provider, retailer (they're communicating your data to their data warehouses).
The summary clearly says "software manufacturers" (aside: manufacture software? facepalm), "providers of wire...electronic...[or] remote communications services, or any person that provides a product or method to facilitate a communication or to process or store data" are all "covered entities" and that they're responsible when they or "another party on their behalf" have made data unintelligible.
The bill, in section 3 (c) includes "license distributors", e.g. thr App Store and Google Play.
Now that I've typed all that out, and please pardon the profanity, but:
What. The. Actual. Fuck.
"No one is above the law", except clearly the legislators and enforcers themselves. "Protect ... Privacy with strong data security", which doesn't exist with the sort of recovery mechanism the bill would require.
If the data is made intelligible again by a party other than the person who uttered it and their intended recipient, it has, by definition, been breached. You've been pwned. Game over. Full stop. You've lost control of your data.
(Edit: clarity)
What changes here is that if you deployed SSH/TLS using a HSM (Hardware security module), you'd need to be prepared to provide a plaintext stream upon a court order. Obviously, the alternative is to choose the non-HSM route which is, and has always been, vulnerable to subpoena.
I would say the HSM example is likely the government's understanding of the law as it exists today anyway. This is a matter of codifying and clarifying that position.
All of the above-such systems are such where the vendor or operator already controls the means and mechanisms for encryption and decryption. These are already vulnerable to subpoena.
The serious changes in this bill are around building systems where only the end-user can control access to their data.
Forgive me if I'm wrong, but doesn't SSH always use a Diffie-Hellman key agreement, where the keys are destroyed after their use? No subpoena has the power to recover keys destroyed in the past, even if no HSM had been used. The same applies to modern TLS using DHE or ECDHE suites, and AFAIK the current TLS 1.3 proposal allows only these suites.
They might be able to subpoena the authentication keys, but these are useless to recover the ephemeral keys of past connections (except from older TLS cipher suites which didn't use DHE/ECDHE), and even for future connections they would have to be used with an active attack.
This is likely to make it less obviously a 1st-amendment issue.
Saying "authors of software" makes it a fairly obvious restraint of speech.
It's free and I have no affiliation. I just saw it on r/apple's monthly appreciation thread [2]
Representatives do care about your calls. They get reports on them every day
[2] https://www.reddit.com/r/apple/comments/4d71kg/monthly_appre...
Security has always been the first resort of tinpots and despots for self seeking behavior. Only those ignorant of history or too distracted with material gain and hubris will fall for it. There always has to be a balance because ultimately everyone is safe in a cage. But that's not what we mean by free democratic societies.
Spying on everyone gives some individuals a sense of power and the logical response to that must be to prosecute them in open courts so their regressive mindsets can be exposed for the sickness they perpetuate. Privacy is much more important and valuable than making day to day law enforcement and governance easier.
Now back to the real world if there was any serious interest in dealing with terrorism Saudi Arabia would have been tackled 30 years ago rather than let them fund and spread Wahhabi ideology globally and the latest round of terror. Yet even today they are the USA and UK's closest allies in the middle east while Iraq, Libya, Syria and Iran who have nothing to do with global terror campaigns are casually destroyed with millions dead and millions in disarray making a complete mockery of the world we live in and the humanity we claim for ourselves.
There is no legitimate argument for a surveillance society other than coming from ignorance of history or narrow self interest. It's high time this country makes an example of those emboldened enough to advocate it and reiterate its commitment to its fundamental values.
The best analogy I can think of is the document shredder. As a society we accept that individuals can protect their personal privacy and safety even if this occasionally frustrates law enforcement investigations. Shedder manufacturers aren't forced to limit how good a job they do to potentially aid LE as this would do more harm than good. And, after all, if you banned shredders, criminals would still be able to just burn their incriminating papers.
Yes - except diplomats, journalists, doctors, as well as conversations between people in person are all "warrant-proof", and therefore "above the law" as Feinstein calls it.
As Zdziarski also says in his post below [1], the 4th amendment doesn't grant the U.S. government anything. It tries to restrict the U.S. government from overreach. It says only upon probable cause can the government request personal information, but it doesn't say the government MUST get that information and in a format that's intelligible as well.
But when the U.S. government has started interpreting the Constitution however it gives it more power, even saying that your "emails" can be obtained without a warrant because they've been "opened" [2], or when it believes that spying on millions of people at once is "relevant" to a specific investigation (3-hop spying) then it's no surprise that they also believe the 4th amendment gives it the power to require the data in an intelligible format.
> No new collection authorities. The bill does not create any new collection authorities for the government to obtain communications. The bill simply requires covered entities to ensure that the government’s lawfully-obtained evidence is readable—so that law enforcement can solve crimes and protect our communities from criminal and terrorist activities.
Well, that's a lie. Until now, only "covered entities" under CALEA could be forced to facilitate spying. Now everyone else can be forced as well, including open source developers. I'd say that's quite an expansion of its "collection abilities", no?
[1] - http://www.zdziarski.com/blog/?p=5912
[2] - https://www.eff.org/deeplinks/2016/04/eff-supports-rep-goodl...
So let's say Microsoft provides me with a computer.
I go make some cool encryption program on the computer. Now I can use the computer to encrypt data.
One court order later and Microsoft is now required to decrypt the data I encrypted using their computer.
All Microsoft did was provide a programmable computer. Now they must do the impossible. This bill is ungodly horrible.
Interestingly, this bill covers vendors and presumably US persons that "provide a product or method". You'll still be able to legally use foreign-developed tools. The US would have grounds to ask those foreign agents to decrypt data, but would have limited means of enforcement.
Communication, by their definition btw, includes electronic and ORAL communication. As others have mentioned, it literally covers whispering if someone or something amplifies or transmits your whisper thus facilitating a communication.
The assumption of liability is on vendors. Vendors are expected to sell you broken goods. Developers of VeraCrypt in the above example would be expected to provide a backdoor. If they're foreign, then it will be largely unenforceable, although those developers will likely face difficulties visiting the USA.
Where users are restricted is wherein they become vendors or providers of software or services. Running a Tor server may require being prepared to provide keys or offer a backdoor, for instance. I think the bill as written could have trouble with distributing VM and container images as well, although a case may be made that they are not operating as "software manufacturers" and are simply distributors, with the liabilities reaching back to Canonical, RedHat, Microsoft, etc.
Or maybe MS decides it is untenable for them to reverse engineer whatever the end user is doing, so it makes business sense to them to simply build tablets good only for consuming content and not producing stuff?!
For example, it doesn't exempt the FISA court, as far as I can tell, and seems to embrace that use.
I'm having a little trouble with the paradoxes... "Nothing in this Act may be construed to authorize any government officer to require or prohibit any specific design". Is this a fig leaf? If you design a system that makes it impossible for you to comply with the act, you're still required to comply, right?
I pray this can't pass in my country.
https://act.eff.org/action/tell-congress-stop-the-burr-feins...
Right off the top of my head a few ways terrorists would thwart this:
- Use end-to-end encryption that's easy to overlay on an existing medium (e.g. PGP).
- Create or use an app that doesn't comply with this law and use that for communication. At least on android all you need to do is allow 'Unknown sources' and you can install apps outside of the play store.
-Use something other than text. Go in an online game and spell something out on the wall.
By repeatedly trying to start this "conversation" it really seems the politicians don't want to accept that it's impossible to prevent encryption at the long tail of users (where the terrorists would be). Instead they're going to stick their heads in the sand. It could be a deliberate attempt to gather session keys for the intelligence services to do their bulk harvesting, but what it definitely won't do is stop terrorism.
I'm sure the senators involved put in as much outrageous stuff knowing it'll be watered down. This with the hopes a few key provisions are not watered down.
That's why in my opinion that bills like these should not be put up for discussions, amendments, and vote. I fear the worst though.
I feel like politicians see tech as an easy target to walk all over to rally the technophobe base, and with good reason - there's really no consequences for doing so.
Why is a company like Apple, at time when it has a historic stockpile of cash, trying to duke out political battles by writing open letters to the press and appealing for public support to uphold basic security practices when other industries manage to bend political will in their favor to do truly greedy things at the public's expense on a regular basis?
Will they simply be held in contempt of court until they finish brute forcing an encryption key at the heat death of the Universe?
[1] http://www.opensecrets.org/politicians/contrib.php?cid=n0000...
That is the essence of the bill in my opinion and nothing else.
(b) DESIGN LIMITATIONS.—Nothing in this Act may be construed to authorize any government officer to require or prohibit any specific design or operating system to be adopted by any covered entity.
If the bill says the government cannot place restrictions on the design of devices, but the bill says providers have to do things they can't do with existing designs (e.g. Whatsapp end to end crypto) what does this bill actually do?
From my perspective it says "you need to hand over the plaintext if law enforcement asks for it," which would imply that a master key of some sort needs to exist.
But then it also says that nothing in this act can be construed to require a specific design. But requiring a master key to exist would be requiring a specific design.
The proposed law sounds internally inconsistent to me.
So any crypto researcher, in the USA, must be able to also defeat their own 2 channel crypto?
Also, since government compensation is listed, how does that work with intractable cryptanalysis of said work?
This would ironically only jeopardize the safety of law-abiding Americans and lawful American interests. It would be utterly useless for anything else, including terrorism, espionage, criminality and foreign interests.
It seems like this could be an anchoring tactic -- now that we've seen the intelligence and law-enforcement wish-list, we should supposedly be happy with any other "compromise" bill that's not quite as apocalyptic.
We can't trust the Government to properly issue court orders anymore, so it would be irresponsible for the People to give them any more power than they've abused already.
I'm having trouble understanding the meaning of that, but is it saying if you provide a means of encrypting customers data you must be able to access it unencrypted?
If this law passed in its current form, wouldn't entire industries have to choose which laws to break when storing data?
What are we going to do a out it? Maybe Wikipedia or Google will deface their own websites, and the bill will die only to resurrect shortly after.
A better solution would be for the millions of tech workers to unite and vote GOP just to send a message that we don't automatically vote for anyone or any party.
If California's vote is locked for a certain party, then it is taken for granted.
But that will probably never happen, because forming and operating a political party is too much like joining a union with its own PAC. And also, third parties don't count for much in the US.
Its playing the two sides off each other that might work. Make the GOP think will vote for them. Make the democrats think they'll loose our contributions.
Getting rid of Feinstein will be an excellent first step.
It is about the service provider.
Basically, hackers just offer plausible deniability as a service, ransom evidence that you weren't the party sending the data, setup human targets, etc.
To submit a bill like this shows a complete disregard for how it will function in the wild.
Tech workers should support senators like Wyden or R. Paul and take steps to really knock down Feinsteins or Burrs.
On one end, I feel like security is hard enough that we don't need to go weakening it, in any way, to allow the government to be able to (with a lawful warrant) read the data. I feel like the citizens of the US are overall more secure with end to end encryption that no-one can backdoor.
On the other end, security is hard and we fail in so many other obvious, exploitable ways. Even with mandating that e.g. Apple be able to decrypt the contents of any iPhone it does not actually reduce our security in a meaningful way because there's so many other ways we routinely fail at security.
> The government cannot require or prohibit any specific design or operating system for any covered entity to use in complying with a court order.
This seems to specifically exclude one of the main concerns of the whole Apple/FBI thing.
I also don't see anything explicitly requiring back doors or security loopholes.
If a customer's data is encrypted and the service doesn't have the keys, I'm not sure how this bill would help.
Of course, if it really doesn't change anything, I see that as a reason to not pass the bill.
Of course they're trying to change something. But, the bill contradicts itself. It was written by people who don't understand technology.
It's an attempt by the authors to outline goals without stating how to achieve those goals.
They would be hard pressed to find a technologist who would support it.
Government clearly understands what is going on and has every reason to support laws like this.
What may not be clear, is that in my opinion, average person understands what is going on, but is afraid. Understanding this fear, and how to counter it is the key, not figuring out how to help people understand how the bill would function in the real world.
If encryption is deemed illegal for whatever reason, then perhaps start creating new things that legally don't fall under the category of encryption, but accomplish the same thing.
There are countless creative, imaginative and intelligent people on this site. PR teams, please let folks brainstorm first.
Once any work has begun, the government can force (subpoena) the vendor to testify regarding results, without any payment whatsoever.
I want a private key that is only creatable by N separate individuals, who will only release their part of the key when they can ascertain I am not under coercion. Is there a system that does this?
That said, as it is, I think things are like this:
- House majority will not support it, unless it's dramatically watered down (The House has been quite privacy-friendly/anti-backdoors lately). However, that could still be bad news for us, if say they only demand large companies to never use end-to-end encryption for any of their products, and to only make local disk encryption optional on smartphones (but no backdoor). Apple would have to sell iPhones unencrypted, Whatsapp would have to go back to Hangouts-style encryption, and Google will never implement its End-to-End tool for Gmail. You can forget about research for homomorphic encryption for healthcare or other services (which I think Microsoft, for one, is doing right now).
- Senate majority will likely support it as is.
Edit: Senator Ron Wyden promises to filibuster it, so we have that going for us as well, although I'm not sure if this can guarantee it's dead. I think he threatened a filibuster with the USA Freedom Act as well, but didn't go through with it at the last moment, when they compromised on something else (I may not be remembering this exactly):
https://www.wyden.senate.gov/news/press-releases/wyden-state...
- Obama wants to look "neutral" right now, but I don't think he is. I think he wants the Senate version passed as well. But he would probably accept a watered down version as well.
Bottom line, if we want to stop it completely, as we did for SOPA, then we need to organize, and we need companies to do what they did for SOPA, too, and alert the public about it en masse.
They still do not understand that it's not possible to force criminals to use government-approved encryption software. Criminals can write their own encryption.
The sooner we voice up and vote out those who support such unreasonable laws, the sooner we can progress as a society towards finding the right ways to keep each other safe.
Does anyone know if there is a list of representatives showing their positions on this bill?
I think in this instance this is a case of you assuming ignorance where malice is far more likely. Looking at the comprehensive mass surveillance of, well, everyone (by the NSA et al), I think the point here is to further the goal of population control i.e. they don't care about criminals who would write their own, they just want always-on access to everyone.
I doubt it because (1) this would involve a wide-ranging conspiracy, and (2) they won't achieve their goal. If they were informed, they would know they will fail. As it is, Obama, Comey, etc will go down in history as asking technologists to perform magic. Nothing about this law helps them catch terrorists, and it hurts the US government's relationship with technologists going forward.
> they don't care about criminals who would write their own, they just want always-on access to everyone
That will not happen without a fight from companies like Apple. Ultimately, this just brings more awareness to users. It is not hard for companies to convince their users that backdoors for government make their data less secure. Tim Cook already took the first step.
More likely, I think, is technologists view government as lying about everything. We are iconoclasts seeking to break down cultural conservatisms. Also, we generalize too easily. We see government being disingenuous about one thing and assume they're dishonest about everything.
Ultimately, it doesn't matter if certain members of government are lying or not. We should be educating the public and our representatives about the fact that we can't force criminals to use government-mandated encryption.
Then mods only defense is to say trust them and none of this is true, but ample evidence exists to the contrary.
American government is corrupt and HN Moderation policy is to abide and abet that corruption.
Dear Senator,
I am writing today to explain how a draft bill, the Compliance with Court Orders Act of 2017, will affect me.
For the last 7 years I have been developing a data backup program, HashBackup. HashBackup allows people to securely backup their computer data to cloud storage, without worrying about the storage company or one of its employees accessing confidential data through the use of strong encryption.
There are many reasons for maintaining strict confidentiality: - financial records - medical records - company trade secrets - top secret intelligence - general privacy protection - and yes, committing crimes
The purpose of this bill as I understand it is to compel any person or company who provides software or devices that can create unintelligible (encrypted) data, to assist the goverment in producing the original, unencrypted data, with a court order.
The critical piece of information to have in order to produce the original data is the encryption key. Without that, no one in the world can produce the original data, whether they wrote the software or not. So this bill's ultimate purpose is to compel individuals and companies selling encryption products to use subversive technical means to obtain encryption keys from its customers, presumably without the customers' knowledge.
My backup program, HashBackup, creates keys on each customer's computer. The customer is responsible for their key, just like the lock on their front door. Similar to a lock manufacturer, I do not know or have access to any customers' encryption keys. If the customer loses their key, they lose their backup, and there is nothing I can do to help them recover it.
If my customer uses HashBackup to store their data at Amazon or Google, and the government decides they want that data, I am the one who will get a court order to provide it since I wrote the software that encrypted it. The only way I could possibly comply with the order is to install special "backdoor" code in HashBackup that relayed the customer's key to the government. If customers realize that their encrypted backup data is not really secure and private, I will be out of business.
Our government presents this issue as a way for law enforcement to prosecute crime and prevent terrorism. But as we all know, criminals and terrorist do not obey laws; the laws end up only affecting the law-abiding. If this law is passed, criminals will be unaffected, as they can easily encrypt their own data and hide their keys.
Some people may believe that encryption is a complex technology that only big companies like Apple can use. It is not. Encryption is a simple technology that anyone can use. It doesn't require any special computer skills, training, or equipment. Criminals and terrorists will continue to use simple encryption after this law is passed.
To show how easy it is to encrypt and decrypt messages, here are two very simple programs to encrypt and decrypt messages. These are written in the Python computer language, but similarly simple programs can be written in most modern computer languages.
The first example program encrypts a message. The lines beginning with # are comments to explain what the program is doing:
import binascii
import AES
import os
# create a key and display it
key = os.urandom(16)
print 'Key:', binascii.hexlify(key)
# here's the message to protect;
# add spaces until it a multiple of 16 letters
message = 'this is a secret'
# encrypt and display the same message 3 times
for i in range(3):
iv = os.urandom(16)
encrypted = AES.new(key, AES.MODE_CBC, iv).encrypt(message)
print 'Encrypted message:', binascii.hexlify(iv + encrypted)
import binascii
import AES
import os
import sys
# get the key and encrypted message
key = binascii.unhexlify(sys.argv[1])
encrypted = binascii.unhexlify(sys.argv[2])
# separate the iv
iv = encrypted[:16]
encrypted = encrypted[16:]
# decrypt and display the original message
print 'Original message:', AES.new(key, AES.MODE_CBC, iv).decrypt(encrypted)
[jim@mb ~]$ py easy1.py
Key: 9cba06caad965229457652b3ae760595
Encrypted message: 4c77810f6f39946a2e525b2ef0e2fe6ed70201d22bb263734dd3aebbbf11af0d
Encrypted message: d262cca8d9da4aa01c36be5dcf2809d212348438752ffea491a13dacd2999ba9
Encrypted message: 0749d160d9e751a67bb908ba8df7800a177e53ea03fad3694bbeab54cd680469
[jim@mb ~]$ py easy2.py 9cba06caad965229457652b3ae760595 4c77810f6f39946a2e525b2ef0e2fe6ed70201d22bb263734dd3aebbbf11af0d
Original message: this is a secret
[jim@mb ~]$ py easy2.py 9cba06caad965229457652b3ae760595 d262cca8d9da4aa01c36be5dcf2809d212348438752ffea491a13dacd2999ba9
Original message: this is a secret
[jim@mb ~]$ py easy2.py 9cba06caad965229457652b3ae760595 0749d160d9e751a67bb908ba8df7800a177e53ea03fad3694bbeab54cd680469
Original message: this is a secret
No matter what laws our government passes, criminals will not obey them. If a criminal wants to keep something secret using technology, it is not hard: all they have to do is privately share a key with someone, then send encrypted message like the above.
An important point is that these encrypted messages can be sent over ANY communication medium. Whether the government has access to them or not, they cannot be decoded without the key. Criminals can encrypt GPS coordinates and times for example, send them as a simple text message, and the government, Apple, nor anyone else would be able to see the original message.
I have no problem with law enforcement doing an authorized search to obtain a suspected criminal's encryption key(s) FROM THE SUSPECT. But as a producer of software, I should not be compelled to violate my customers' trust by stealing their key without their knowledge. Then I become the criminal.
Please do not pass this bill. It will not affect criminals or terrorists - just the rest of us law-abiding citizens.
Thank you, Jim Wilcoxson
Dear Senator,
The draft bill, the Compliance with Court Orders Act of 2017, fails to take into account the necessity of convenient, effective encryption for protecting things like online commerce and it fails to account for how easy it is to access encryption technology that is not compliant with the bill. An example of readily available software that does not comply with the requirements of the bill is "Pretty Good Privacy" often referred to as PGP. This software is widely used and available outside of US jurisdiction.
Many well qualified technologists are speaking out against the bill. Their reservations and the apparent lack of input from the broader technology industry is very worrying.
I consider support for a bill with these issues disqualifying and will vote as such in all future elections.
Thank you,
Max Erickson
The tech community's solutions WAY too often feel like they're motivated only by libertarian concerns for freedom which, while extremely important, are not exhaustively fundamental or final to -- and certainly do not settle the question for -- non-libertarians.
1. https://act.eff.org/action/tell-congress-stop-the-burr-feins...
Period.
We are not surfs, we are not subjects.
Without the trust of its people, a government is not legitimate, has no "right" to look at its people's behavior, is simply afraid of losing power.
If instead of spying, governments focused on increasing overall goodwill there could be trust, not suspicion, on both sides of this encryption line.
Again, not many people live in or around the libertarian bubble. And there are lots of intelligent people who avoid it for very, very good reasons.
-----
1. http://www.theatlantic.com/national/archive/2016/02/apple-fb...
2. http://www.gallup.com/poll/1597/confidence-institutions.aspx
Firstly because, well, that's just the way it is sometimes. Putting a gate in your wall can let in bad guys who can plunder your city, yes. But it can also let in good guys who can fortify it. You just need to design and use your gate well...and, I suppose, think of the government as good guys. (Soz, I've been indulging in some nostalgia with AOE 2: HD recently....)
And two: who says this has to involve decreasing IT security? I haven't seen enough evidence of cooperation between the gov't and the tech industry on this for me to believe that an agreement on this would require decreasing IT security.
Which type of system would you feel safer guarding all of your most personal information in? Keep in mind that the system doesn't care if you're a "bad guy" or a "good guy":
1. A system which was designed to be "unbreakable"
2. A system which was designed to be breakable
Without encryption there is no IT security (if there even was such a thing).
Love me some AOE btw.
Also, I think there's something different about getting access to someone's digital communications that makes digital data different from data previously obtained by warrants. Digital databases increasingly contain the entire history of people's communications. That's never been true before and it warrants additional discussion at the very least.
The other argument against this bill is it is unenforceable. Terrorists won't be using the government-mandated encryption tools. They'll create their own.
This is an opportunity for technologists to step up and take a larger role within government by educating representatives and the public, starting campaigns or non-profits, or perhaps running for office.
[1] https://youtu.be/g1GgnbN9oNw?t=3h35m52s
Remember right now a huge proportion of the US population does NOT agree with us, no matter how many facts you explain to them.
Telling, for example, president Obama that he's an idiot and doesn't understand technology is both a lie and not helpful. He has hundreds of advisors who each know as much as the smartest of us here.