Hacker News Reader

Comment by pif | Hacker News Reader

To the downvoters and commenters who do not get that "the children" is just a straw man:

The issue at hand can be described very, very easily: law enforcement agencies' mission is going to get harder to fulfil if they lose the possibility to wiretap suspects. The solution is, unfortunately, not that easy!

Now, HNers can cry their lungs out that mathematics forbid a perfectly safe backdoor and what not, but they are missing the point: they are simply ignoring the question and lacking any respect for the people posing it in the first place.

The issue exist; and it makes sense. Furthermore, wire-tapping has always been accepted, at least as a necessary evil, by democracies all over the world. At the same time, absolute remote privacy has never existed, much less been guaranteed. E2EE is a big game changer, and you expect people with governing responsibility to just ignore it?

View on HN

At the risk of being very directly contrarian: is it?

Is it actually getting harder for law enforcement? Do we have evidence of E2EE harming cases, hurting conviction rates, or similar? At this point in time law enforcement has been routinely dealing with and lawfully overcoming encryption for several decades. Encryption is no longer a novelty law enforcement has no idea how to deal with.

I understand that law enforcement officers may sincerely believe that encryption makes their jobs more difficult and thus the public less secure. Since they are public officials, I am happy to accept their claims as truth. I just need to see supporting evidence. At that point we can begin to weight public safety against privacy. Until then, I can only consider a demonstrable loss of privacy against a purely hypothetical impairment of law enforcement functionality.

Speaking only and solely for myself, I in no way expect people with governing responsibility to ignore end to end encryption. I do expect them to ask questions when people with a demonstrated capacity to function in the presence of E2EE claim it is making their jobs too difficult.

> At the risk of being very directly contrarian

Please, be! Discussion is welcome.

What I despise is only immature people ignoring important societal issues with a sweep of their hands, while crying a void "because privacy".

Basically, I need law enforcement to prove they're not full of shit. Law enforcement and intelligence systems have a long and ugly history of abusing easy access to private information. They also have a long history of working around technical privacy protections at need, in pasts both distant and very recent.

Until then, I think we should give their claims all the weight of all the evidence they have provided. Or failed to provide.

I just think it's really funny but also terrifying that it's the cool thing to hate on the CIA now, knowing all the exposed operations against their own fellow countrymen, and yet people still think they should be the ones with backdoor access into our private lives.

So, I worked for intelligence agencies for much of my early career, and my wife still does, and I get the impression Hacker News fundamentally misunderstands their mission and the way they operate. This sort of effort involving wiretaps and backdoored encryption with state access to service providers is a law enforcement capability, not an intelligence agency capability. Intelligence agencies do not operate within the law and they largely don't care about things like CSAM or internal political dissent. That's the FBI and other part of DHS's concern. Intelligence agencies are at least somewhat constrained in what they do domestically by cleared legislative oversight committees, but internationally, they do whatever they want. They don't need warrants. They may often have, but certainly don't need, the cooperation of governments or law enforcement where they operate. Their tools aren't legal tools. They may use device-level compromise, remote sensing technologies the commercial community and general public doesn't know exists, human spies, and these can be used against foreign service providers or against specific high-value targets directly.

Whatever the law says law enforcement within your own country can or can't do has no bearing at all on what foreign intelligence agencies can do.

All of which is to say, if you're thinking of things like MK Ultra, nobody ever publicly argued we should give that kind of capability to the CIA and it was already illegal at the time they did it and they did it anyway. Trying to make telecom service providers legally obligated to provide an encryption workaround for law enforcement is a completely different thing.

One thing to bear in mind is that any technical lawful intercept capability is also a technical intercept capability for a hostile intelligence agency. Note that "hostile" and "foreign" are not always the same thing.

With this in mind, I think making the tools resistant to abuse is a highly desirable design goal, up there with making the detection of abuse very easy.

Alright fine, CIA was my <insert three letter agency here> choice. NSA is probably more appropriate.

>wire-tapping has always been accepted

The wiretapping of yesterday is not the mass surveillance of today. John from the police taskforce snooping on your landline and taking notes is not even in the same ballpark as mass data collection and categorization of everything, everywhere all the time.

I also accept the former as a necessary evil, but it's a completely different beast from my latter example.

That being said, you raise good points. I don't know what would be the ideal solution to these relatively new worries of governments. I feel like this bump in internet privacy is counteracted by the surveillance network that has been built in the real world, so we could call it even in some ways.

Wiretapping was also used by all police states to preserve dictators, by eliminating competition and punishing citizens for wrongthink. As citizens of a country behind the Iron Curtain, my parents were always afraid to talk on the phone, because the secret police was always listening, either directly or via informants.

You're going to say that in democracy, the state uses warrants issued by a judge for wiretapping and there's due process. How's that working out in the US, given Snowden's revelations and the Patriot Act?

Leftists wrongly think that the state represents the will of the people. It doesn't. Democracy is preserved primarily by (1) a culture of liberalism and (2) the state having limited powers. But as could be seen in WW2, democracy is fleeting, actually.

Being from Eastern Europe I've got to say that seeing privileged Westerners willingly give up freedoms, that other people died for, has been such a huge disappointment.

---

As for crime prevention and investigation, you can still follow individuals around, install bugs in their home, compromise their personal devices. But it's never enough, is it?

> As for crime prevention and investigation <...>, compromise their personal devices.

How do you compromise someone's device that's running iOS 17 and using an encrypted messaging app?

> But it's never enough, is it?

The reality is that people are using E2E en masse, and it's not possible to compromise modern devices the same way it possible to compromise a phone line in 90's. I can open telegram and buy any number of substances/devices/items, paying with Cash App. This just wasn't feasible even 10-15 years ago in the way it is now. So what do we do? (I don't have an answer, fwiw).

If you want to compare abilities, in the 90s you also didn't have Internet-connected cameras on every corner, or in public transportation, also able to do face recognition even with masks on, you couldn't use Wi-fi to see through people's walls, or to monitor the IPs a home connects to, etc.

As for iOS, there are always vulnerabilities that state-level actors can exploit. Not long ago simply sending a message to someone via iMessage could have compromised an iPhone. Which is why iPhones now have a "lockdown mode". Criminals are either dumb enough to expose themselves via insecure devices, or competent enough to use an extra layer of encryption, which can't be prevented. Even if you outlaw general-purpose computing, people can just send encoded messages with custom algorithms, WW2-style.

If you target someone specifically, and have access to their location, there's no way they can protect themselves while also keeping a communication channel open. Let's be honest, this isn't about targeting someone specifically, but about fishing for wrongthink.

> So what do we do?

As a citizen, not my problem. Law enforcement should do their jobs without encroaching on my privacy. Or my child's privacy for that matter.

If scientists invent a way to read people's thoughts, what next? Mass surveillance for people's brains directly because there's no other way?

If the question is mass surveillance, NO is always the answer as far as I'm concerned.

At least in the US you cannot outlaw encryption. It is covered under 1A.

Thank you for expressing your opinion, I appreciate it.

Actually, I don't have a strong opinion because I recognize the issue to be very complex.

Are we sure it's complex? Or is it portrayed as complex for political reasons?

So far we've seen a lot of assertions that encryption is a major hazard to public safety, mostly from groups with a long history of abusing access to wiretaps. We've seen precious little evidence to support this. The other group claims that encryption enhances privacy and pushed back against abuse. There's plenty of evidence to support this.

More than once in my life, I've seen people attempt to advance an unsupported position by claiming it's very complex. Sometimes this is true and they just need time to support their points. Sometimes it's completely untrue, and the idea is to leave uninformed onlookers with the impression of complexity that needs to be negotiated.

How sure are we that this issue is genuinely very complex, versus the real possibility of false complexity in an effort to confuse you and me?

Reply on news.ycombinator.com