Close the N.S.A.’s Back Doors

It's not a useless bill at all. I don't know about that specific provision, but this is actually the most aggressive anti-NSA bill yet. Its main purpose is actually to repeal both the Patriot Act and the FISA Amendments Act in full, and it would also require standard warrants for any surveillance request. But it also includes other provisions about backdoors and whatnot. You can read it here:

http://holt.house.gov/index.php?option=com_content&task=view...

This is quite the conundrum -- isn't it? -- as it's not just "those companies" named in the Snowden documents. There was nothing particularly unique about them that permitted them to be corrupted and compromised other than their nodal market position. If the spirit of your argument causes a perceptible shift in market share to new players, then these too should be instantly distrusted. Even if fully open cryptographic implementations become the norm (which doesn't matter if they give up their keys), remote closed-source services will need clear text to provide service algorithmically. What then?

Except, we never learned that they added backdoors, sidedoors, or firehose access for the NSA. The most probable and likely thing that happened is that the NSA simply tapped their inter-datacenter fiber just like the NSA tapped Soviet undersea fiber, and that the NSA scooped up any non-encrypted SMTP traffic. The NSA may even be able to tap internal networks without entering the building through TEMPEST like techniques.

There has never once been presented a single shred of evidence that they knowingly cooperated with the NSA in any manner other than the normal court approved processes via warrant or NSL that they've already alluded to and are petitioning the government to give more transparent details of.

On top of that, Google has been adding security for years on the front end that the NSA won't like, for example, using SSL for everything, doing SSL on mail traffic whenever possible, using forward-secrecy with Chrome, adding Channel-ID support to Chrome. All indications are that they are trying their best to secure things as much as possible, but with a state actor with virtually limitless resources and a half century of experience of penetrating tough adversaries, it's not enough.

Rather than breaking out the pitchforks for these companies, people should be breaking out the pitchforks for the NSA. Technical solutions are not going to solve the problem when the government is against you.

Backdoors will always be there for everybody, eventually.

I don't think you can rule out the fact that they are not aware of such backdoors. If NSA can pay people to write such backdoor from time to time, other countries would have similar resource devoted to decipher the complexity of openssl (just an example) to find exploit. I am also sure this backdoor business is not new to the intelligence community anyway!

If NSA opsec was such that an outlier like Snowden, ideologically motivated and willing to up sticks and lose a career and a nice untroubled life, could access and deliver detailed information on backdoors (we haven't seen any specifics, but indications seem to be that they are likely in the docs Snowden lifted) and cover his tracks, then it seems at least worth considering that "normal" spies, where the motivation is money, sometimes blackmail, who will stay in place or exit gracefully, have already delivered similar information to parties with the means to procure such, including the ones you list; so they might not need to brute-force anything.

The infamous Google/Gmail hack December before last was specifically targeted at an internal Google system designed to allow access by law enforcement.

At the time it was made to sound like it was used by conventional warrants, but it is pretty clear now it was probably mostly used by for FISA requests.

The (allegedly Chinese-linked) attack successfully penetrated that, and used it to access email accounts used by Chinese dissidents.

Actually the truth is almost exactly the opposite.

Every government in history has not had the ability to monitor and record the majority of conversations people have; the cost would have been too great. The USA with the NSA is the first to approach that ability.

    "Comprehensive Counter-Terrorism Act of 1991"
    "Sponsor: Sen Biden, Joseph R., Jr. [DE] (introduced  1/24/1991)"
    "Cosponsor: [...] Sen Reid, Harry [NV] - 1/30/1991"

"It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law."

edit: link is not working, but search for the title, it will open up from something like this: http://thomas.loc.gov/cgi-bin/bdquery/z?d102:S266:

There are legal requirements that exist that are laws like "If you break into a building, you go to jail". But there are also effective "legal requirements" like "if you don't install this back door, we're going to find a reason to make your life suck in every imaginable way". Or more subtly "we'll fail to forgive this crime that we know about".

For instance: http://www.theguardian.com/technology/2013/sep/11/yahoo-ceo-...

> Mayer said executives faced jail if they revealed government secrets [...] Mayer was asked why tech companies had not simply decided to tell the public more about what the US surveillance industry was up to. "Releasing classified information is treason and you are incarcerated," she said.

To quote that reddit thread about that article:

> She'd go to jail, but it wouldn't be for breaking the gag order. It'd be because she was suddenly prosecuted for one of the other 1,000 illegal things that any CEO does in a given quarter. Just ask the CEO of Qwest, who blabbed about the NSA surveilling his customers and then was thrown in prison on insider trading charges

So, what happened to the former CEO of Qwest: https://en.wikipedia.org/wiki/Qwest#Refusal_of_NSA_surveilla...

> Qwest was allegedly the lone holdout, despite threats from the NSA that their refusal to cooperate may jeopardize future government contracts [...] Former Qwest CEO Joseph Nacchio, convicted of insider trading in April 2007, alleged in appeal documents that the NSA requested that Qwest participate in its wiretapping program more than six months before September 11, 2001. Nacchio recalls the meeting as occurring on February 27, 2001. Nacchio further claims that the NSA cancelled a lucrative contract with Qwest as a result of Qwest's refusal to participate in the wiretapping program. Nacchio surrendered April 14, 2009 to a federal prison camp in Schuylkill, Pennsylvania to begin serving a six-year sentence for the insider trading conviction. The United States Supreme Court denied bail pending appeal the same day

I'm not sure how it overlaps with other laws, but at least there's this about CALEA:

> not only does the law speak about encryption, but it specifically protects the right of companies to build strong encryption for which only the customer has the decryption key into their products.

http://paranoia.dubfire.net/2010/09/calea-and-encryption.htm...

If that's true, then companies could actually use CALEA on their side to implement true end to end encryption, that they can't decrypt themselves, for their customers.

One imagines that this is the reason Lavabit shut its doors.

Of course the American government engages in covert assassinations. That we tried to kill Castro several times, at least, is common knowledge. Every modern government probably has an office they call on to get their "laundry" cleaned, legally or no.

I don't think that has any relevance on whether or not this particular bill will pass, though.