US Government Continues Encryption War
blog.privacytools.io
blog.privacytools.io
Those who build a centralized system that can control every aspect of humans life just don't realize they are building Hell on Earth.
Decentralization and fairfull consensus between every acting party, no matter how much power they have - this is the only way to build a great culture and a system.
Unfortunately, we are still too far from this. Too much people are still trying to build this ugly human pyramid of subordination, just like in a primal tribe or mafia organization.
I have two main objections to this line of thinking:
1. Even if a tendency or behavior can occur in "nature", that doesn't necessarily make it correct. By that measure murder, infanticide, rape etc. should also be considered acceptable since they occur in nature (both with humans and animals).
2. If you take a look at smth like The World Until Yesterday or other similar work it will become apparent that the kind of large scale hierarchies of power present in the modern world are relatively recent constructions. To me they're more a hallmark of contingency and deliberate human choices, not of "nature". If we want to make a less hierarchical society we can, it's in our power to change the design of society (to a significant extent at least).
2. I agree that large scale beauracracies are not in the best interests of humanity. I would argue for hierarchy, with less power the higher up the chain you go. E.g. Local governments should have more power than federal/national governments. But that doesn't mean there shouldn't be a national government.
I can see how one can see it that way, it is probably what those who rigging the game were thinking when they first started, and like the saying goes "those who play a rigged game gets stupid over a long period of time". That's probably why empires collapse, too much corruption and too many people playing the rigged game. A rigged game kinda corrupt workability of the whole system. The short term advantage may not be so good in the long run.
In a very centralized government systems you can't make top management accountable. Moreover, in such systems top management actually support master-slave relations between people, like between men-women, rich-poor, etc. It's then easier to hold power.
This isn't really true for most large firms. Since people are dependent on their wages, they are generally subjects to their boss' whims. You just have to look at Amazon workers wearing diapers to realize that workers don't generally get a say, even if they are not technically slaves.
The observation of a behavior or inclanation in the wild is not a good basis for the structuring of a civilization.
Well, there is a argument, that this is the case, because having leaders and followers is somewhat build in our DNA, if our ancestors lived like that for millions of years.
But the power structure in primal tribes were seldom true pyramidical. (That developed later in civilisation.) You had council of elders, the shamans, priests, etc. different kinds of power balance. Also the very important difference to civilisation power pyramids: in primal societies power was based much more on merit, not inheritance.
But with (different) authorities. Organizing the hunt in bigger animals or groups seem to require authority. Alpha male who leads the pack.
Those institutions which are longer lived are usually subject to tons of change. Think of the imperial Chinese system with its many dynasties or the church with its schisms. And despite behaviourally modern humans having lived on this planet for tens of thousands of years, thousands of generations, you won't find any institution that has survived longer than a few hundred generations.
What we have today is a tiny, tiny, tiny modification of that, where our savanna-adapted meat brains put in accoutrements of due process and fair trials, but it’s all just for show so that political elites can say one thing (freedom, due process, fairness) but do another (court packing, systemic racism, regulatory capture, corporate shilling).
Note also that the US has one of the longest lived current governments in the world. There are plenty of countries that have been around longer, but most of them have forms of government that came into effect there later than when the US got its current form of government.
I neither made nor implied any inferences, so it is hard to see how there can be survivorship bias.
He has also co-sponsored legislation in support of privacy of personal identifiable information, but not for the general population or anything just US Federal judges [2].
[1] https://www.congress.gov/member/lindsey-graham/G000359
[2] https://www.congress.gov/bill/116th-congress/senate-bill/471...
I am very confused by this statement from Barr.
Protecting consumer data is protecting a business' operations.
If user data is properly encrypted, then a dataleak is necessarily less of a liability. You cannot lose what you do not have access to. Protecting the customer, protects the business.
"I work in law enforcement, and I am uncomfortable with the idea that the public might have effective tools to communicate privately. But I can't say that directly because then people who aren't paying attention will be upset. So instead I'll be a bit confused about what my point is and draw some distinctions that don't make sense"
There is a very compelling case that law enforcement should be denied some powers even at the risk of criminals escaping justice. That case is complicated and takes several pages to explain. It is rare that law enforcement officials will make that case, and rare that the public understands when law enforcement is too powerful.
Then we've reached a crisis point in our moral development, because that statement had been axiomatic since the founding of this country.
"That the individual shall have full protection in person and in property is a principle as old as the common law." [1]
[1] https://www.cs.cornell.edu/~shmat/courses/cs5436/warren-bran...
Or rather, it's rare that anyone (including people against this war on encryption) makes a blunt argument that criminals will escape because the police are constrained. The blunt tradeoffs argument is from a classroom or bar. It's not the kind of argument that will be made (bluntly) in a legal, policy or legislative setting.
In any case... I don't think "denied some powers" should be assessed against "risk of criminals escaping justice." One is abstract and the other concrete. The actual tradeoff is between criminals escaping and actual abuse of power by law enforcement. Some amount of both is guaranteed. This tips the scale.
Do "large business enterprises" use exclusively "customized encryption", or do they use the same encryption "consumer products" use? In my experience, it's the later. The biggest example is TLS: for instance, every business which uses Microsoft Office 365 relies on the same TLS used by "consumer products". The same applies to full disk encryption (BitLocker and/or LUKS), smart phones (large business do use smart phones, and they are the same smart phones everyone else uses), email, and so on.
As a personal example, the software we develop at work is used by "large business enterprises". When we added encryption to it, we didn't use "customized encryption"; we used standard TLS.
Like “warrant-proof” rooms and houses that, even with a valid warrant, won't record conversations and send them to the police.
And just like encryption, those “warrant-proof” protections can be circumvented by planting physical or software bugs on target houses or computers.
They're not complaining that law enforcement can't subvert privacy protections - they're complaining that they're not already subverted, ahead of time, for everyone.
>...We all know what it is: Thought Crime...
>Scotland’s proposed hate crime bill will penalise anyone whipping up hatred against “protected groups.” That includes people making “insulting” remarks within their own home, Justice Secretary Humza Yousaf has revealed.
[Many other sources are available, if RT's line is not to your liking]
We've already seen many examples of how pwople's phone data has been used in prosecutions. How long before someone is taken to court for an un-PC remark which they made in the [supposed] privacy of their own home, but which was then picked up by their Alexa, transcribed at Amazon HQ and then reported to the authorities as a "hate crime"?
I know using the phrase "virtue signalling" tends to merit a bucket load of downvotes here on HN. But I really do think we've arrived at a farcical situation in the West [especially in Europe] where legislators are falling over themselves to draft ever more idiotic laws intended to show how much more "liberal" and "progressive" they are than the next guy.
With, ironically, the consequence that these same laws are actually making society less free and more controlled, as people are becoming too frightened to express opinions that don't conform, for fear of being branded a bigot / racist / sexist/ <alphabetti-spaghetti>phobe
Ironic that so few people in the West can see that we're mirroring exactly the same kind of 'dissenting viewpoint not tolerated' society that we used to deride the Soviet Union and Eastern Europe for and continue to condemn China for today.
Perhaps because it is an unfalsifiable claim. If someone does something that they think is good, and someone else notices, were they "virtue signalling"? In the case of public figures, especially legislators, many of their actions are broadcast to the public, so condemning "virtue signalling" is like condemning virtue itself, or merely stating that you disagree on which acts are virtuous (as is expected in a society where we are free to disagree).
> legislators are falling over themselves to draft ever more idiotic laws intended to show how much more "liberal" and "progressive" they are than the next guy.
I imagine that legislators think "Violent people often have a history of saying bigoted things, but none of my friends say things that I think are bigoted, so locking up the people who say bigoted things will only have a positive outcome on society." Unfortunately there are enough people who can't imagine any bad consequences of such a law (even to themselves, eventually) that there is a genuine democratic mandate for it in some places.
*no pun intended.
I personally don't believe that most supporters of such policies are consciously motivated by a desire to harm those in majority groups, as many of these supporters are themselves in majority groups. They probably just don't think that the policies will affect them, or realise that the policies could backfire and be used against minorities.
"Last October, Facebook, Google and Twitter were asked by Hawaii Senator Mazie Hizono to draw up a “mission statement” to “prevent the foment of discord.”"
https://www.rollingstone.com/politics/politics-features/face...
If anything strong encryption gives better support of outlawing it, from a governments perspective.
The fact that you can be a lawless individual and ignore it and obfuscate everything has no bearing on the legality of it. But it does mean that if they suspect you are doing anything illegal they don't have to figure out if you and what you are doing, since your obfuscation is enough to send you to jail.
You can force companies to put backdoors in their encryption products, but the governments already do that (even though using them may not be convenient for them). Further, this will push crypto in the hands of people, and to outside US, to outside cloud, push for decentralization, which the US government doesn’t like.
The security by and large lies in end points. Back-door in hardware, operating systems etc for access to key material seems to be the focus of the governments.
It’s a golden age for intelligence agencies; they probably want a handle on the cloud.
If the court is basing decisions like abortion access on a right to privacy, then they should also start enforcing an actual right to privacy, including access to encryption.
The textualist theory on privacy is basically: "no trespass, no problem". The trespass theory of privacy is why Scalia was in the majority on United States v. Jones (cant attach a GPS tracker to a car without a warrant) and Kyllo v. United States (cant invade the house with an IR camera without a warrant). The lack of a physical trespass explains why his intellectual bedfellows dissented in Carpenter.
Given that, what does the balance here look like?
Might make an interesting constitutional rights case before the supreme court.
What a time!
It is comparatively harder for people to build a mental model of how encryption stops an unseen hacker accessing their data, and obviously most people value their life more than their data.
The difference in threat models applicable to end-to-end encryption versus hop-by-hop encryption is even more subtle, allowing disingenuous politicians to claim to support encryption while simultaneously weakening it.
I seriously doubt governments lack the surveillance tools and require more access with backdoors or breaking encryption. For example AES encryption calls CPU instructions to hardware that exists only by a few companies. DNS is either through a handful of public cache servers or captured at the OS level. The network backbone is by a handful of companies world wide. Of course the US is world leader of breaking privacy but this is theater
I expect there is a phase-change somewhere before "all my communications are monitored in real time".
This is entirely anedotal. But the vast majority of my co-workers I've spoken to don't seem to care about too much about things like privacy, free speech, open specs, source code availability and think I am a wacko for self hosting and running (mostly) applications and operating systems. However I am a .NET dev and the fact I am decent with a command line is seen as a bit odd.
The general attitude I've encountered is well "it only happens to the bad people and nobody cares about what I do, so I don't need to worry about it and you must be a weirdo for worrying about it"
Lindsey Graham is a turtle.
#1 Split brain
The "same" government that gave us Tor (onion routing) wants to take it away. So at least some of the players understand the practical need for encryption. I'd rather those pro and con insiders fight it out, instead of fighting by proxy thru us citizens and consumers.
#2 Fishing expeditions
What possible value does unlocking, decryption have after the fact?
Does the FBI really need to unlock a spree shooter's iPhone? Why? What could they possibly learn? They already have all the meta data like FOAF, location, purchases. What more are they looking for? To better establish guilt?
And any one already under surveillance has already had their entire life rootkitted. So again no need for after the fact unlocking.
#3 Trusting trust, time boxed secrecy
I've had many, many fruitless conversations about computer security (wrt election integrity) with non-tech policy makers. I have yet to figure out how to convey the understanding that backdoors and security thru obscurity is no security at all.
The best policy compromise proposal that I can imagine, and I'm spitballing here, is formalizing some kind of temporal privacy.
Using voting and secret ballots as an example:
I absolutely do not want any one any where to know anyone's votes during an election. I don't even want precounts, so that pols and admins can preview tabulations. But I also don't care at all if someone knows how I voted after the election is certified. (Sure, there's still some risk of coercion and vote buying. But there are easier attack vectors for which we have no mitigation, so it's comparatively minor.)
So instead of trying to protect all secrets for all time, I think all the players might be able to chill a bit if we time boxed most secrets.
(I have other proposals for protecting personal privacy, like with medical records.)
This is probably why "same" is in quotes, but it's clear that this is higher-up political players wanting more power to spy on the people in the name law enforcement - tor came from the military who made the tech to fix an actual problem they had (encrypted communication).
For example, the cleartext has evidence of a crime, and law enforcement needs a way to access that info.
> backdoors
Responsibly built lawful access doesn't necessarily use backdoors or flaws, but rather 3rd party access.
Reminiscent of the 'bargaining' stage of grief. IOW, can't make 'deals' with death, either.
It’s the fact that the rest of us haven’t solved the problems of creating an open but also trustable and usable alternative.
For a small percentage of users with the means and motivation, this may be true, but "making a deal with math/science" likely isn't the goal.
0: https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...
It will be interesting to see how things play out though since section 230 reform seems pretty bi partisan. While that doesnt necessarily mean the reform needs to address encryption I would be surprised if it doesn't
I wouldn't worry, any of his actions will be backed up by the required votes.
I would. Spying and warmongering are those very few things that both major party establishments readily agree on, and I hate to pay for either of those things, or being spied upon even more than I already am.
I cannot tell if [1] meets the requirements for being a reasonable cause in your (or anybody else's) opinion. Decide for yourself.
[1] https://www.palantir.com/pt_media/palantir-is-providing-coro...
Edit: [1] just contains a link to Forbes, so you can go directly to:
https://www.forbes.com/sites/thomasbrewster/2020/03/31/palan...
He's fully on board with backdoors. I guarantee it.