Attorney General will ask Zuckerberg to halt plans for end-to-end encryption

You can get legal datasets for sick pr0n or warzone stuff you would like to keep off-platform that might have the same psychological effect on you.

They want a fishing net so they can catch these people by the thousands.

1. Privacy is important and good

2. It has almost certainly contributed to an explosion in the production and sharing of child pornography and abuse

The question is what is the moral way to reconcile the two, not to deny that either exists.

The USA took steps to actually protect property in its founding, something the Supreme Court has interpreted to include privacy as well. From this perspective, the rights of citizens wither away when the government is allowed to take the smallest step towards mass surveillance. For that reason I am very much against it.

My other perspective is from a security standpoint. I believe that if companies are not doing everything in their power to protect themselves and their users from data loss / hacking / theft, they put everyone at risk. Intentionally lessening the security of a product at the request of the US government means giving a potential thief or hacker more attack vectors to exploit.

There are two things I would point out: 1) I would be surprisesd that the ease of communication the internet brought did not benefit to criminals 2) The article describes several problems that won't be fixed by encryption ban (e.g. the lack of means for report clearing houses) and also gives exemples of cases solved despite encryption. I would like to understand why encryption is described as the problem here.

Not to mention:

Congress has regularly allocated about half of the $60 million in yearly funding for state and local law enforcement efforts. Separately, the Department of Homeland Security this year diverted nearly $6 million from its cybercrimes units to immigration enforcement — depleting 40 percent of the units’ discretionary budget until the final month of the fiscal year.

Or in other words, in order to fight the imaginary rapists that Mexico is allegedly sending us, DHS is diverting money originally allocated to investigate actual child rapists.

Anyone remember the FBI and Apple case a few years back? How quickly the FBI hacked the phone after Apple wouldn't cave? Other tools exist to do targeted surveillance and targeted attacks. Only authoritarians want mass surveillance.

Sure. Before the telegraph was invented. And even before that people used security measures, such as wax seals on letters to prevent tampering or at least have an ability to detect whether or not the message has been tampered with.

You seem to think of messaging systems as if they were spoken conversations in private. They are not. Just because you are chatting with someone from the privacy of your own home, doesn't negate the fact that your words are traveling through a lot of wires and boxes belonging to all sorts of private and public entities.

During WW2, American federal government established Office of Censorship whose sole purpose was to review and censor all communications coming into and out of the country. Now imagine them finding that someone is mailing letters written in an unbreakable code. How long do you think it would take for the FBI to break down that person's door?

I am not saying we should not have end to end encryption. I am saying that government spying on citizens is nothing new, it is not something that was ever limited to totalitarian dictatorships and it should not be surprising to anyone that the government is trying to fight it. The news is not that the government wants to keep an option to read your communications. The news is that first time in history there is a chance people might want to and be able to stop them.

"Why isn't your desk in front of the telescreen?" - 1984

The day will come when not having an Amazon Echo or Google Speaker will be considered probably cause for a search.

A secure E2EE system must resist even targeted, legally authorised attacks. Are you suggesting that secure, practical E2EE systems do not currently exist? Would a world in which law enforcement must install physical listening devices and exploit unpublished software vulnerabilities to surveil suspects be more private than our current world, where E2EE is available but often disabled by default, and trusted intermediaries like Facebook and Google can be legally compelled to disclose non-E2EE messages?

> Forbidding end-to-end encryption, in combination with our mass surveillance apparatus, changes the societal default to be that substantially all conversations are trivially and automatically accessible

That is not (publicly acknowledged to be) the case today, even though non-E2EE platforms like Facebook are widely used. While Facebook could currently comply with laws authorising mass surveillance, and implementing secure E2EE would prevent them from doing so, the warrants under which they currently hand over non-E2EE messages are at least somewhat targeted. This controversy is not about a proposal to relax the need for warrants, it's about asking Facebook to preserve their ability to comply with them.

Yep. I'm pretty sure you just torpedoed any hope you may have had at a political career.

sounds like "War" to me.

1. They said that FB captures 99% of those illegal activities by themselves. What makes us think that government will be able to capture that last 1% on their own?

2. Encryption gets removed, potential perpetrators move to another platform that uses encryption and doesn't have the capability to catch those illegal activities that FB already catches using their internal systems. Congrats, now those perps that would have been caught (even if FB implemented the encryption) won't be caught at all.

And with the uncertainty that comes to mind with both of those points, one thing that is definitely guaranteed to come is further erosion of personal privacy.

I think everyone here is familiar with Pareto. Capturing 80% of criminals is easy. Catching the next 10% is harder than catching that first 80%. Catching that last 1% takes significant amounts of resources, way more than the previous 90%. So it just isn't economically viable to stop it all (exponential curve and we don't have infinite resources).

So I'm not sure that saying

> A number of horrible things will happen as a result of pervasive end to end encryption.

But I don't think it is necessarily wrong either. I think encryption enables it, but this sentence implies causation (which is the rhetoric of those that want to remove encryption: causation).

How I read the horsemen comment is that these topics are used as boogie men. Because what sane person wants that stuff to exist? OF COURSE we want 0%. How can you be against stopping child trafficking? (practically) No one is against that! These are also topics we care VERY much about. Because frankly we should do everything we can to stop child exploitation. But we know the goal is unobtainable and to get only a handful more than we currently get (which is almost all of them!) requires huge violations of privacy and significantly more resources to be allocated. The horsemen are being used to get us on board and make us not ask if these methods are meaningfully effective or ask what the costs are. It also says that anytime you hear officials talk about the horsemen that you should perk your ears up and start asking serious questions. How effective is this? Does it actually help? What are the costs? The Patriot Act is a good example. It is not clear that it meaningfully reduced terrorism in any way and yet we gave up a significant amount of privacy (I can quote founding fathers on this too).

So it boils down to "if giving up the privacy does not do an effective job at making any meaningful reduction in actual child trafficking <insert horseman>, why should we give that privacy up? There's clearly benefits to privacy. So is this issue really about child trafficking or is something else at play here and are they just feeding off my emotions?"

If you consider "not saving while you could" the same as "killing", it's very common. So much in fact that it has its own WikiPedia page:

https://en.wikipedia.org/wiki/Value_of_life

With a cosy link to a letter by the Department of Transportation:

> this guidance identifies $9.6 million as the value of a statistical life to be used for Department of Transportation analyses assessing the benefits of preventing fatalities and using a base year of 2015

https://www.transportation.gov/sites/dot.gov/files/docs/2016...

Sure, idiots do stuff like this all the time. Sure they get caught. But idiots usually get caught by other means, too. And you never catch all the idiots, there's just too many of them.

But the argument doesn't even make sense. It makes the horrible assumption that pedophiles will continue using a service they know to be insecure. That's literally a provably false assumption. The second they realize it's insecure (which will take exactly one raid), they'll switch to something else.

And ALL of the above assumes that there are no criminal programmers and thus they have no ability to just write their own tools if there isn't something sitting on the shelf. We know with 100% certainty this is also a false assumption.

But imagine if some crazy billionaire set up some sort of autonomous decentralized system that constantly attempted to MITM all the same systems the government likes wiretapping; and then, if it managed to extract any data from that attack, it would find names in that data, and put bounties out on those people on assassination markets (paid from anonymous accounts previously set up by the billionaire.)

Now the choice is between some people dead, and a lot of people dead! Everyone get on board the privacy train!

We see politicians regularly choosing to not enact overwhelmingly popular positions like universal background checks in the face of mass murders of children.

How many politicians have done anything to stop the Catholic church from hiding child rapists? This is a much more direct harm and no one who isn't a child rapist would lose anything if we fixed it.

Politicians are already choosing rape and murder when the stakes are much lower.

It's not just a matter of "many small harms > few large harms" though. Not having privacy can lead to severe harms.

If the bad guys break into a system that allows them to effectively wiretap everybody, now they can snoop around and find blackmail targets. "I know what you did, have sex with me or everyone will know. Or send money. Or give me your employee access badge."

Results: Rape, financing child sex trafficking, facilitating an act of terrorism. Or any of the less visceral but nonetheless widespread and significant consequences like major financial fraud or corporate espionage.

And that's just blackmail. What about the suicides of people who get doxxed? Or the people in violent relationships whose abuser is in law enforcement or in a criminal enterprise that has compromised the surveillance apparatus? Or the mental health epidemic which results when people know their communication is exposed to people they don't trust to see their true selves and then self-censor into performance-art conformists riddled with anxiety and loneliness?

Privacy is about keeping perverts in law enforcement from reading the sexting that should only be between you and your spouse, but it's also about keeping the country and the people safe from terrorists and foreign powers, keeping victims safe from abusers and allowing people to satisfy the human need to be themselves in communications with people they trust.

Privacy isn't a trade off against security, it's a necessary component of having security.

FWIW, I applaud your willingness to make such a statement. (And no, this is not sarcasm!) Self-censorship is a horrible thing, and I feel like I die inside a little bit every time I catch myself doing it. But more and more these days it begins to feel like even hinting at a willingness to engage in "thought-crime" is exceedingly dangerous. I mean, shit, a woman got passed on for a job because she had a picture of herself in a bikini on her Instagram. Imagine if a prospective employer find a comment online which could even remotely be twisted into saying that some child deaths are a sacrifice that may be inevitable in order to protect an abstract principle like Freedom, or "Free Speech". Zoinks!

This was tried by a Canadian Minister at one point to sell surveillance in this extreme way:

> In February 2012, as Minister, Toews introduced the Protecting Children from Internet Predators Act (also known as Bill C-30).[118][119] The bill, which made no mention of children or "Internet predators" outside of its title,[120] would have granted police agencies expanded powers, mandate that internet service providers (ISPs) provide subscriber information without a warrant and compel providers to reveal information transmitted over their networks with a warrant. When criticised about privacy concerns, Toews responded that people "can either stand with us or with the child pornographers."[121]

* https://en.wikipedia.org/wiki/Vic_Toews#Federal_Minister_of_...

The legislation in question went down in flames as plenty of people sided "with the child pornographers":

* https://en.wikipedia.org/wiki/Protecting_Children_from_Inter...

This argument is so unbelievably stupid, that I don't even know where to begin.

First of all, encryption in WhatsApp is targeted towards consumers. You won't catch terrorists by limiting encryption. If terrorists and other criminals are not using encryption anyway, then they are so stupid that they deserve to be caught.

The only thing a lack of privacy does is throwing us further into dictatorship. Just imagine a madmen, like uhm... say Trump, with the full power of the secret service behind him and limited to privacy for end-users. Well this is just great. All the dirt he can dig up about his opponents. He asks foreign governments to dig up dirt, okay, that means right now the NSA isn't too much inclined to help this guy out, but what if they were?

If you water down privacy you are robbing the people of their only chance to organize protests and rise up to authoritarian governments.

Last but not least, the crimes prevented by not using encryption are absolutely negligible. The numbers are so freaking low that each day more people will die in car accidents in the US alone than would die globally because of pervasive usage of unbreakable encryption.

This analogy of `Uh a person could be prevented from getting raped is more important than preventing a fall into dictatorship` is so contrived that I don't even understand how anyone can eat this shit. Bad things happen all over the place and you are buying this sham argument that is preying on human psychology.

Who is more of more danger to you. A cabal of rich drug dealing terroist pedophiles or your own Government? The argument then becomes one of statistics and then of the lesser harm.

I imagine the answer is obvious with the Government being sigificantly more harmful. You're likely comparing a few hundred deaths of tens of thousands.

You'll always find a subset of the population who thinks the death of citizens or harm is justified in some way, because they took some action that broke the law.

But find enough examples where the offernder did no direct harm to anyone else and I suspect you'll give most reasonble people pause for concern.

And if the facts don't match your gut, then maybe you're wrong and privacy isn't all that important.

The thing to point out is that we all make the implicit choice to let people die for convenience every single day: Almost all of us could choose to pay a bit more to charity to save a life, almost no matter how much we're currently giving or what we're currently doing, or could choose to take jobs that would do more to make the world a better place.

We just rarely have to face what choosing differently would have meant, so we get to pretend it doesn't have much to do with us. And granted, most of the time the consequences are many steps removed from our choices.

Wow. I can't agree with that one even a little bit. The real concern is totalitarian abuse. But being inconvenienced allows us to kill? That rings as downright pathological.

Estimates say there are something like 20-40 million slaves in the world, and that 50,000 people are trafficked per annum in the USA. Something like 20% of slaves are sold for sex. Facebook is believed to be a common platform to facilitate this, though I haven't been able to find numbers.

https://en.wikipedia.org/wiki/Slavery_in_the_21st_century

In contrast, despite the occasional news post of a particularly incompetent company leaking a database of plaintext passwords, Facebook's data storage is pretty safe, and encryption does still afford a lot of protection. The idea that hundreds of thousands of people are going to have their private data extracted from Facebook through individual attacks against the servers is not well corroborated.

Totalitarianism is an important long-tail risk, but I don't think it's reasonable to suggest that these programmes are a path to it. Overall privacy rights quite plausibly are, but that issue exists primarily as a matter of policy and law, not as a matter of technology. If the laws are bad, Facebook illegally preventing protection of trafficking victims will not help those laws change to a more moderate position, and if the laws are reasonable, cooperating to prevent trafficking victims would not be harmful to positive political outcomes.

The scale of abuses would have to be multiple orders of magnitude smaller, or detection mechanisms incredibly ineffective, before this tradeoff made sense to me.

<braces for backlash>

I think this kind of dark-sounding reasoning only holds up when you phrase it not as “a mere inconvenience” but as tyranny, which is what encryption and privacy in general protect against.

I support personal rights to privacy, and believe that we should find ways to enforce laws without violating privacy. Representative governments need the ability to alter their own power structure in order to function, and yet human power structures naturally resist change, including by spying on those who conspire against them: therefore, privacy is essential for representative government. Representative government’s alternative is tyranny, which we know creates incalculably-large-scale suffering.

Human nature is at the root of why privacy is costly and also why it is necessary; however, much evidence suggests that the set of aspects of human nature we express is mutable and dependent on environment.

While I would never argue that we can remove those aspects of our nature, I believe we can alter our environment to reduce how frequently we express the more sinister ones.

In short, I’d rather work on reshaping our environment, including and especially our culture, to make privacy less necessary and costly, than to debate whether it is either. It is both, and it will always be both, but we can make it less of both, or more of both, with our culture. Same for guns.

The letter specifically describes an offender who was sentenced to 18 years' imprisonment, detected when Facebook read his non-E2EE communications with a child victim. Are you suggesting this was an unimportant or unrepresentative case?

Specifically Apple-related and North American examples?

Many smartphones have this, and will respond to "Ok Google" or "Hey Siri". Do you view this differently?

In fact, I wouldn’t be surprised if data could be generated that shows cyber bullying on Facebook results in more child suicides than children murdered in school shootings per year.

You are now the thorn in the side of every AI salesman trying to pitch you his Neural Net based wonder machine, or politician trying to sell you on giving up rights because they need to be able to violate everyone's privacy because statistics.

If you understand the actual nature of these measurements, it becomes quite a bit more difficult to let the "zomg neato" factor run away with you.

No, I'd ask you what your methodology was when you measured. For instance, going to the DMV and getting a list of all registered vehicles, and using that as a representative dataset to reason from is fine. (Depending on your definition of cars in San Francisco, and whether or not that is meant to include cars transiently moving through or not.)

Now if you told me you were using a Neural Network to recognize all Subaru models that drove by a particular camera, I'd start asking you questions, and want to see your training data, output, etc.

>Sure it may be true in my dataset, but that doesn't mean it will generalize to all possible permutations of traffic ever. Well, no shit. But that's not the statement being made.

That generally is the statement being made when people make claims about the accuracy of neural networks. Particularly the marketing people. You can only measure their accuracy within a constrained dataset, and overfitting is a thing.

>If I wanted to know the accuracy of an important system. I'd do continual audits. Take a (stratified) sample of all things, get ground truth labels for whether they should have been detected, and see what percent were in fact detected. Then I could estimate how much my systems did and didn't catch at any point in time.

Which, again means you're operating off things you know a priori to be the case. You don't know the full extent of everything to begin with, which phrasing in this article implies.

I'm not saying audits can't be useful; it'll get you a number, and sometimes that's all you need. You just need to be clear about what the numbers actually mean.

There's lies, damn lies, and statistics after all.

I would personally even go one further and say that anyone or anything beyond a certain level of power should be radically transparent, and privacy should be reserved for the weak. If you want some privacy, step down from power and influence, and donate your money, because transparency is the only way we can even start to wield democracy properly and prevent the gross abuses of power we see in our society.

One is our job that we are directly and morally responsible for (like a civil engineer being responsible for having a bridge not collapse at a load of >2 cars), the other is not. Call me callous, call me cold, but that is not explicitly up to us, we can't be under the delusion that we are the one key to everything and anything. It wouldn't make sense to have a "quick-release" button forcibly installed on all bridges that would cause an instant collapse if triggered "because countless children that are victims of human trafficking are taken over bridges everyday."

The reality is that the organizations responsible for looking into these reports of abuse only have enough resources to investigate those where the child's life is in immediate danger.

The venn diagrams of "internet chat surveillance" and 'solutions to the problems of child abuse" are mutually exclusive.

Politicians are grossly morally corrupt to use child abuse as an argument against encryption when they're the ones controlling the purse strings for Child Services-type organizations. Feathering their own nests at the cost of actual, real progress on protecting children from abuse.

If a police battering ram is stolen, you can't really use it to attack millions of houses in a day. There have been known cases of police personnel misusing their roles. Police have broken into houses without warrants. But the scope of damage is limited.

Whereas digital backdoors can be used to jeopardize millions of devices in a very short period of time.

Sure, you could require a warrant. But it doesn't reduce the risk of someone misusing digital backdoors.

All it requires is one breach.

It also totally changes how government has to force Facebook into giving them something. They can't just request access to some server anymore.

The main way to defeat a state is to make mass survailance difficult enough that it doesn't scale well.

Unless the state itself is criminal. Not only can law stray from morality, authorities of the state can even violate the laws of that state itself. If you can imagine an extreme authoritarian state with a constitution, can't you also imagine that the leaders of that state choosing to ignore that constitution?

But before even getting into the above, you've assumed the possibility of perfect surveillance. Who or what and how could that ever be possible?

The only way I can conceive of perfect law enforcement is to have very few if any laws. Everything else is an excuse for the personal fancies of authoritarians.

How would you handle corrupt senior police officers covering the tracks for themselves, their fellow officers, and friends in high places?

I know you're trying to point out some supposed hypocrisy for not criticizing Obama or Clinton or something, so I'll let you know I think they too enacted unforgivable political violence. Happy?

People exist outside the Republican/Democrat spectrum.

How about we techies stop kissing ass to the advertising execs and stand up to them for once??

They want more data, more relevant ads, more more more more more. Their ask is impossible without massive invasions of privacy. Fuck them, I say

Return to scattershot ads, they can understand me as an audience without having to mine every ounce of my life for it. That approach will produce more relevant ads for me anyway