Comment by Kalium | Hacker News Reader

Comment by Kalium | Hacker News Reader

Parent Full thread

At the risk of being very directly contrarian: is it?

Is it actually getting harder for law enforcement? Do we have evidence of E2EE harming cases, hurting conviction rates, or similar? At this point in time law enforcement has been routinely dealing with and lawfully overcoming encryption for several decades. Encryption is no longer a novelty law enforcement has no idea how to deal with.

I understand that law enforcement officers may sincerely believe that encryption makes their jobs more difficult and thus the public less secure. Since they are public officials, I am happy to accept their claims as truth. I just need to see supporting evidence. At that point we can begin to weight public safety against privacy. Until then, I can only consider a demonstrable loss of privacy against a purely hypothetical impairment of law enforcement functionality.

Speaking only and solely for myself, I in no way expect people with governing responsibility to ignore end to end encryption. I do expect them to ask questions when people with a demonstrated capacity to function in the presence of E2EE claim it is making their jobs too difficult.

> At the risk of being very directly contrarian

Please, be! Discussion is welcome.

What I despise is only immature people ignoring important societal issues with a sweep of their hands, while crying a void "because privacy".

Basically, I need law enforcement to prove they're not full of shit. Law enforcement and intelligence systems have a long and ugly history of abusing easy access to private information. They also have a long history of working around technical privacy protections at need, in pasts both distant and very recent.

Until then, I think we should give their claims all the weight of all the evidence they have provided. Or failed to provide.

I just think it's really funny but also terrifying that it's the cool thing to hate on the CIA now, knowing all the exposed operations against their own fellow countrymen, and yet people still think they should be the ones with backdoor access into our private lives.

So, I worked for intelligence agencies for much of my early career, and my wife still does, and I get the impression Hacker News fundamentally misunderstands their mission and the way they operate. This sort of effort involving wiretaps and backdoored encryption with state access to service providers is a law enforcement capability, not an intelligence agency capability. Intelligence agencies do not operate within the law and they largely don't care about things like CSAM or internal political dissent. That's the FBI and other part of DHS's concern. Intelligence agencies are at least somewhat constrained in what they do domestically by cleared legislative oversight committees, but internationally, they do whatever they want. They don't need warrants. They may often have, but certainly don't need, the cooperation of governments or law enforcement where they operate. Their tools aren't legal tools. They may use device-level compromise, remote sensing technologies the commercial community and general public doesn't know exists, human spies, and these can be used against foreign service providers or against specific high-value targets directly.

Whatever the law says law enforcement within your own country can or can't do has no bearing at all on what foreign intelligence agencies can do.

All of which is to say, if you're thinking of things like MK Ultra, nobody ever publicly argued we should give that kind of capability to the CIA and it was already illegal at the time they did it and they did it anyway. Trying to make telecom service providers legally obligated to provide an encryption workaround for law enforcement is a completely different thing.

Alright fine, CIA was my <insert three letter agency here> choice. NSA is probably more appropriate.

One thing to bear in mind is that any technical lawful intercept capability is also a technical intercept capability for a hostile intelligence agency. Note that "hostile" and "foreign" are not always the same thing.

With this in mind, I think making the tools resistant to abuse is a highly desirable design goal, up there with making the detection of abuse very easy.

Reply on news.ycombinator.com