The Government Is Lying to Us About Cybersecurity
fee.org
fee.org
Same with guns. The police are okay with gun ownership because they have the right to gun citizens down. Not to judge, but that's the balance.
Same with why we tortured. It counterbalances their vulnerability to secrets. If torture didn't work, Kiefer Sutherland would never have gotten anywhere. But if everyone were against torture, the show wouldn't have existed.
They have an answer to locked doors, suspects with guns, and terrorists with secrets that -- at minimum -- make sense to them regardless of their effectiveness or consequences to society or our ethical reputation.
The main problem with encryption is there is no workaround. There is no counterbalance. The lock is unbreakable, and there is no one to shoot or torture when all they have is the device itself (and no one to torture always, if they're abiding by the law).
This scares law enforcement. This whole campaign is driven by fear, but they cannot admit fear, so it's all rationalizations and confabulations -- which work by the way -- hence they're keeping at it. And when those with power empathize with this fear in between the lines, they will sign off on these lies.
You don't need a back door on communications if you are "looking over the shoulder" of someone as they type it in. If the person is a suspect, then they can get a warrant to plant a bug.
The fundamental underpinnings of any related correct and incorrect behavior is still emotional though. And that is also why loaded words such as "terrorism" get the ball rolling fast, regardless of which way that ball is rolling...
The problem is that a preventive action usually hasn't been taken, but now, when a problem exists, they have something to do with it, and they can't.
They want a built-in backdoor exactly as a preventive measure, a bug.
The problem, of course, is that those breaking the law would still use the unbreakable version, the same way they use other illegal means, and the law-abiding majority will stay safely vulnerable.
Well, that's good. I think that law enforcement SHOULD be hard. It should be hard and complicated and time consuming. One of the worst things I can imagine is idle law enforcement officers. Bored cops will find something to do. Whether it's going from car to car and ticketing anyone who is 12.1 or more inches from the curb or ticketing people for spitting on the sidewalk, no good can come from idle police.
Idle prosecutors are every bit as much of a potential nightmare. We see District Attorneys being used as political weapons now. Just imagine if they had the power to go fishing through the electronic communications of every political rival.
If the work is difficult, they'll only do it when they have reason to believe a serious crime has been or soon will be committed. It's easy to justify overtime for surveillance on a suspected drug kingpin, organized crime figure, rapist or murderer. It's not so easy to justify it to monitor some guy from a TEA Party Group, BLM or Occupy just so find out what they're doing.
So... enforcing our existing laws? What's the point of having those laws if they're never enforced?
If you find a bad person and get someone to follow them with a really good camera you'll likely get the code (especially for a phone ). If you are at a mall in a high tech country I was told that you can read what they write on their phones ( No source, and if not think about the future ).
So you will need some police work but that's actually how it has been used for most part of the last hundred years, where you can't just look stuff up on a computer.
So yes there is no real guarantee that you can crack a phone. But if we learned anything from the dark markets it's that it's very hard to never makes mistakes.
If you study history and interrogation techniques you quickly realize that torture has nothing to do with information. It doesn't work that way. The 24 situation of a terrorist with a secret code in his head that will prevent a nuke going off is so circumscribed that if you think you are entering that situation you should assume that you are mistaken. Torture is about confession. It's about getting someone to say something that you want him to say regardless of whether it is true or not. That's the difference between actual intelligence and "actionable intelligence", the actionable stuff need not be true. If it is enough to justify a warrant or a raid accuracy doesn't matter. This is also why torture is so closely linked to religion. Only a puritan need torture out a confession. It's far easier to forge a signature.
Go through the history. Be it the English rack or American Gitmo, they didn't care about accurate information. What they wanted and got was signatures on documents written almost entirely by the interrogators. (I'll leave aside the other use of torture, as simple punishment, because that's a totally different debate.)
If you want to see a fictional counterpoint to the "torture works" argument, I'd encourage you to watch Burn Notice. It has a blacklisted CIA operative who fights crime in Miami and one of his mottoes is "Torture doesn't always get you the truth. It gets you the quickest lie that will stop the torture" (he does a voiceover narration). Instead of torture he uses deception, misdirection, and other tradecraft to extract secrets. For example, he kidnaps his target and holds him in a dark warehouse, then has himself beaten up by an associate and put in the warehouse as a "fellow" captive, thus gaining his confidence (it's much better on-screen, I've probably forgotten some details).
Neither are from security professionals, and both really downplay the risks associated with <insert 3 letter agency> having escrow of keys. The number of leaks and breaches across the various government orgs shows that it is near impossible to maintain the security of keys held in escrow.
"Trust us, we'll keep it secret" has been empirically proven to be not as true as they want us to believe.
Taken from the "other side", it does not seem universally true that generally deployed strong, unbreakable encryption built into "secure" general-purpose commodity hardware is in the best interests of humanity going forward. It seems to be an open question. It was nice to see rational/objective/neutral discourse on HN in the past that considered all sides. But, such a universal perspective seems to be missing of late, and the more recent parochial attitude seems a natural form of pushback, given the current chaos. Hopefully good comes of this.
"Snow Dawg" is currently partaking in thoughtful discussion arguing against NSA's policies on his twitter, if anyone is interested.
Can you prove that there is no such thing as a "perfect" backdoor? Can you show that the existence of a skeleton key introduces risk beyond losing the key? Has this been formally proven?
That might be a good starting point, and I apologize if my understanding is wrong, but can't one build a skeleton key into encryption that cannot be broken with any greater likelihood than otherwise would be possible by compromising the encryption itself? If the surface area of attack is doubled at most, that seems a viable trade-off. Yes, it's potentially a huge SPOF if designed sub-optimally (I'd suspect that there is a way to build something akin to a one-time use set of segregated skeleton keys), but that risk needs management like all risks.
(redact)
The second supposed "lie" is possibly the closest to reality. Although there are plenty of people who would agree that there is something of a difference between "not encrypted" and "encrypted, but the NSA has a a separate key that can decrypt it". Like everyone who thinks TLS isn't completely broken.
The third is simply a conspiracy theory. Don't be surprised if the press, and anybody who isn't already on your side, laughs at you if show up with an argument about how it's all a plan by the NSA/Congress/Disney to control money/brains/Hitler's secret moon base.
Packaging such weak arguments in the language of "lies" weakens your position if you're trying to defend the public's right to strong encryption. Because people will focus on your assumptions that they know to be wrong, such as the government being on some super-secret mission to get your bitcoin or whatever. And they will extrapolate from there.
Instead, start from shared assumption, and build good will, before making actual, strong arguments. One such basis would be acknowledging that, yes, some hypothetical, completely ethical, FBI agent may today have a harder time, because where they would previously find lots of incriminating documents in nicely labelled binders, today a search may often just result in an USB stick with binary gibberish.
Once you've build some rapport, this would be a real argument: I don't trust judicial oversight, because it has been abused too often by, for example, the FISA court and national security letters. Moreover, the government's surveillance powers were previously limited in two less-excplicit ways than judicial oversight, namely the costs and manpower involved with physically searching a place, and surveilling people, as well the nature of such actions as being publicly visible. But these safeguards do not apply to electronic surveillance, making it too likely that such powers will be used in massive operations without probable cause.
From https://en.wikipedia.org/wiki/ECHELON
> In 2001, the Temporary Committee on the ECHELON Interception System recommended to the European Parliament that citizens of member states routinely use cryptography in their communications to protect their privacy, because economic espionage with ECHELON has been conducted by the U.S. intelligence agencies.[7]
My guess is that the real benefit that the NSA provides is largely economic and military espionage. terrorism hasn't been reduced or increased regardless of NSAs activity, and the folks that run the show are not stupid.
>This is why the U.S. intelligence budget of over $75 billion did not prevent most American’s personal details from being leaked
This was the one that most annoyed me. Why would you expect the US intelligence budget to be spent on security for private corporations?
Edit: > There is nothing the U.S. government can do to improve “cybersecurity” other than prosecuting criminal behavior.
Also ridiculous, there are many things the U.S. government could to to improve cybersecurity including apparently protecting equifax from itself.
edit edit: > U.S. citizens who do not report foreign bank accounts (under FACTA) can be fined $250,000 or 5 years in jail
What does the IRS prosecuting for tax evasion have to do with any of this?