President Obama: I'm A Big Believer In Strong Encryption... But...
from the let's-drop-the-but-part dept
Last Friday, at the White House's Cybersecurity Summit at Stanford, reporter Kara Swisher sat down for a half-hour interview with President Obama (and she even dragged her famous red chairs along). It's a better, more in-depth interview than you're ever likely to see from the established mainstream press, and touches on a variety of issues regarding technology and security. While I don't agree with some of the answers, I will say that the President appears to be extremely well-briefed on these issues, and didn't make any totally ridiculous or glaringly misleading remarks. You can see the whole interview here:Then he gets to the area I found most interesting and want to focus on, the question of encryption. After discussing how he's looking to update the rules for surveillance and his relationship with tech, the interview proceeds like this:
Obama: There's still some issues like encryption...I actually think this is a very good, nuanced answer to this issue. It doesn't descend into hyperbole about child predators and ticking time bombs like law enforcement officials have done. He admits that there are tradeoffs and, at least publicly, seems to be willing to admit that stronger encryption without compromise might be the best solution.
Swisher: Let's talk about encryption.
Obama: ... that are challenging, and that's something that's been brought up...
Swisher: What's wrong with what Google and Apple are doing? You have encrypted email.
Obama: Absolutely.
Swisher: Shouldn't everybody have encrypted email and have their protections?
Obama: Everybody should. And I'm a strong believer in strong encryption. Where the tension has come up, is historically what's happened is that... let's say you knew a particular person was involved in a terrorist plot, and the FBI is trying to figure out who else are they trying to communicate with to prevent the plot. Traditionally, what's been able to happen is they get a court order, the FBI goes to the company, they request those records, the same way they'd go get a court order to request a wiretap. The company technically can comply.
The issue here is, partly in response to consumer demand, partly in response to legitimate concerns about consumer privacy, the technologies may be built to a point where, when the government goes...
Swisher: They can't get the information.
Obama: ... the company says "sorry, we just can't pull it. It's so sealed and tight that even though the government has a legitimate request, technologically we cannot do it."
Swisher: Is what they're doing wrong?
Obama: No. I think they are properly responding to a market demand. All of us are really concerned about making sure our...
Swisher: So what are you going to do?
Obama: Well, what we're going to try to do is see if there's a way for us to narrow this gap. Ultimately, everybody -- and certainly this is true for me and my family -- we all want to know if we're using a smartphone for transactions, sending messages, having private conversations, we don't have a bunch of people compromising that process. There's no scenario in which we don't want really strong encryption.
The narrow question is going to be: if there is a proper request for -- this isn't bulk collection, this isn't fishing expeditions by government -- where there's a situation in which we're trying to get a specific case of a possible national security threat, is there a way of accessing it? If it turns out there's not, then we're really going to have to have a public debate. And, I think some in Silicon Valley would make the argument -- which is a fair argument, and I get -- that the harms done by having any kind of compromised encryption are far greater than...
Swisher: That's an argument you used to make, you would have made. Has something changed?
Obama: No, I still make it. It's just that I'm sympathetic to law enforcement...
Swisher: Why? What happened? Because you were much stronger on...
Obama: No, I'm as strong as I have been. I think the only concern is... our law enforcement is expected to stop every plot. Every attack. Any bomb on a plane. The first time that attack takes place, where it turns out we had a lead and couldn't follow up on it, the public's going to demand answers. This is a public conversation that we should be having. I lean probably further in the direction of strong encryption than some do inside law enforcement. But I am sympathetic to law enforcement, because I know the kind of pressure they're under to keep us safe. And it's not as black and white as it's sometimes portrayed. Now, in fairness, I think those in favor of air tight encryption also want to be protected from terrorists.
Swisher: True.
Obama: One of the interesting things about being in this job, is that it does give you a bird's eye view. You are smack dab in the middle of these tensions that exist. But, there are times where folks who see this through a civil liberties or privacy lens reject that there's any tradeoffs involved. And, in fact, there are. And you've got to own the fact that it may be that we want to value privacy and civil liberties far more than we do the safety issues. But we can't pretend that there are no tradeoffs whatsoever.
Of course, where we're left with questions is about his requested "public debate." Where and how is that happening? Because, to date, the only noise on this issue coming out of his administration has been on the other side, pushing for new legislation that would require backdoors and compromise encryption. We haven't seen anyone in the administration presenting the other side at all. And, for those of us who strongly believe that a basic cost/benefit analysis of weakening encryption vs. letting law enforcement do their job through traditional detective work would show that the "costs" of weakened encryption vastly outweigh the "threats" of criminals getting away with stuff, it would be nice to see the government at least recognizing that as well.
President Obama chides civil liberties and privacy folks for not getting that there are tradeoffs here, and I don't think that's accurate. Most do recognize the tradeoffs. It's just that they believe the true benefit in terms of "stopping criminals" to weakening encryption is not very great, while the cost to everyone in risking their own privacy is massive. What we have not seen is any indication that law enforcement recognizes that there are tradeoffs, or that they care. Yes, as the President admits, they're weighing some of this against "not getting blamed" when an inevitable "bad event" happens -- but they don't seem to be willing to recognize, at all, the risks to everyone's privacy. That's why they keep talking about golden keys and magic wizards who can make special encryption that only good guys can use.
So I'm glad that the President at least seems to recognize this is a nuanced issue with tradeoffs, but I wish that others in his administration, especially from the law enforcement side, were willing to recognize that as well.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: barack obama, cybersecurity, encryption, kara swisher, law enforcement, mobile encryption, national security, president obama, privacy, security, surveillance
Reader Comments
Subscribe: RSS
View by: Time | Thread
You made your bed, now sleep in it
If people and companies are moving towards phones that are encrypted by default and require the owner to personally unlock them, it's because law enforcement has proven that they cannot be trusted to follow the laws that prohibit them from 'browsing' on a whim or hunch.
If society and the companies in it are pushing for more encryption, and more secure forms of communication, it's because those like the NSA have shown absolutely no restraint in scooping up everything they can get their hands on, just in case it might prove useful at some point down the road.
The government, and the police, have shown that they cannot be trusted, and the public is reacting accordingly. It would be nice if those in the government and police forces were willing and able to admit this, but given that would require them to first admit that they've done something wrong, I'll not hold my breath while waiting for it to happen.
[ link to this | view in chronology ]
Terrorists use encryption.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Terrorists use encryption
[ link to this | view in chronology ]
Re: Re: Terrorists use encryption
So if we ban grocery stores then the terrorists will all starve to death!
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
The solution: If we stop the good things they won't have a reason to exist. Obviously the best way to stop them is to stop the good things!
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
Re: Terrorists use encryption.
Government uses encryption.
Therefore, Government is a Terrorist.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Going on a philosophical tangent...
Not only that, we can get into the question of how well interrogation techniques that use coercion work over those that don't, and how that should inform the moral issue of whether or not a state can endorse torture while still addressing human rights concerns.
[ link to this | view in chronology ]
Re: Going on a philosophical tangent...
Wait, I think a goalpost moved here, since you've started saying "coercion" instead of "torture". They are different things. All interrogation techniques are coercive techniques, but most aren't torture. Also, not all torture is used as a coercive technique.
[ link to this | view in chronology ]
Interrogation vs. Coercion vs. Torture
Interrogation is merely asking questions. There may be an implication of purpose in the word, such as for inquisitional or investigatory purposes. But an interrogation is at its basest, no different from an interview. No coercion is required.
Coerced interrogation (e.g. answer my questions truthfully or I will make your life / your family's life less pleasant) falls into the same spectrum as enhanced interrogation (that is, interrogation with torture). Light forms of coercion, e.g. denying them food, hygiene and bathroom facilities, or even threatening torture (without ever resorting to it) might be considered as not technically torture by some. But if coercion by torture doesn't work, neither would coercion by not technically torture. If coercion by torture does work, then it figures you could do enough to a man that is not technically torture to be as effective as torture.
Torture without coercion (e.g. working a prisoner over regardless of how he answers questions) is not coercive interrogation, it's just torture, and at that point since the purpose of the torture comes to question, it's hard to argue that it works. I guess one can argue that if you make a prisoner miserable, he'll be less capable of guarding himself. He may also be more resentful and defiant. He also may be so damaged as a result of the torture that he is incapable of answering questions soundly.
So yeah, I did move the goalposts...back further and wider apart. I think the question of whether torture is right informs the question of whether more common practices are right (testimony deals, plea bargaining, back-room police interrogation techniques, Your daughter is a sweet kid. Shame if we had to bring her in too. et. al.).
[ link to this | view in chronology ]
Re: Re:
Perhaps because every single time someone claims that torture works, it's part of a larger argument that it's perfectly fine and desirable for the US to be doing it.
[ link to this | view in chronology ]
Uh... yeah
Considering our government and law enforcement agencies have been raping our privacy and civil liberties for the last decade and more, you're damn right!
Personally, I would have been much happier if we didn't stop every plot, and I didn't have to worry about what my government was snooping on - but I can see that will never happen.
[ link to this | view in chronology ]
Re: Uh... yeah
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
I used to think that was nutjob conspiracy theory crap.
Not so much anymore
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
This conversation is just about spying on everybody who doesn't care or doesn't know any better. It is not going to stop the determined terrorist who doesn't want their communications read.
[ link to this | view in chronology ]
Re:
You could import good cryptography from abroad. But you could not export it. So guess where all the good crypto products were developed? When anyone outside the US needed a product that contained any crypto technology, guess which country could NOT sell it to them? That means the US companies could not sell secure products to 94 % of the world's population.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Tradeoff
I value privacy and freedom far more than the potential benefit of being constantly spied on, but I think that he's glossing over something here -- the tradeoff is not nearly as clear-cut as he characterizes it. He seems to be assuming that LEOs don't present a risk to safety, but I think it's clear that they do. So it's not a simple equation where giving up privacy and liberty to them increases safety. It also increases danger from those very agencies.
[ link to this | view in chronology ]
Re: Tradeoff
[ link to this | view in chronology ]
Having the public debate.
Or have I become too cynical and have my tin-foil hat on too tight?
[ link to this | view in chronology ]
Re: Having the public debate.
gov: "Yes, while we were spying on the milk maid, all of the horses, cows, chickens, pigs, and we believe field mice have all managed to escape the barn"
farmer: "I understand that last time you got the barn manufacturer to 'let you in'.
gov: "I assure you it was all completely legal and above board"
farmer: "I didn't see no warrant."
gov: "A secret court had a secret review of our secret application based on a secret interpretation of a secret law."
farmer: "Huh?"
gov: "It was determined to be completely legal and above board, we are the most transparent administration the US has ever had."
farmer: "Uh huh, I'm sure it was." {tightens screws, test locks}
gov: "With these new self locking doors, we won't be able to indiscriminately, um I mean, stop the terrorists, pedophiles and other criminal elements."
farmer:"...or milkmaids...."
gov: "I think we should have a public debate before people start installing these more secure self locking doors."
farmer: "I think you should have thought about that 'before' you let the horses, cows, pigs, chickens out of the barn. Why _were_ you spying on the milkmaid for anyway?"
gov: "ummm... national security. It's all _very_ legal _very_ transparent..."
farmer: "but you can't actually _show_ me a warrant?"
gov: "National security, perfectly legal, most transparent ever...."
farmer: "Yea, {closes door and shakes it to make sure it's locked} well I needs to buy me some more; horses, cows, pigs, and chickens."
{walks away from the government man}
gov: "don't forget those field mice......."
[ link to this | view in chronology ]
Re: Having the public debate.
"The first time that attack takes place, where it turns out we had a lead and couldn't follow up on it, the public's going to demand answers."
Newsflash: we have attacks that take place ALL THE TIME where it turns out there's a lead LEOs couldn't follow up on. The public demands answers, and the answer is "Our leads hit dead ends" or "we weren't able to gather enough intelligence."
From a political perspective, THIS is the place to start the debate. Not with a bunch of conjecture. However, history has shown that instead of debate, the organization that gets hit with the media spotlight responds with apologies (or not) and finger pointing instead of "You know what? We need public debate on this issue, as it's obvious that more could have been done had we handled encryption differently as a country."
Maybe the debate that needs to happen ISN'T between the public and law enforcement -- maybe what needs to happen is education of law enforcement and public officials, so they understand why end-to-end encryption is a necessary evil, and how they can change their procedures and media presentations to account for that (metadata anyone?).
[ link to this | view in chronology ]
Public debate
As for "not getting blamed" - well, if they want to play it that way, then I say we get to blame them each and every time something bad happens because someone exploited a cryptographic system that was deliberately weakened in the name of improved law enforcement. I include in that anything bad done by government employees that they were only able to do because the cryptographic system was weak.
[ link to this | view in chronology ]
Re: Public debate
[ link to this | view in chronology ]
Re: Re: Public debate
[ link to this | view in chronology ]
Oh, they get it. He traded off the Constitution without getting much in return. And he was not authorized to do that.
When people said Obama was the first black president of the U.S.A., I thought they were referring to his complexion.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
The "Snowden disclosures" didn't damage trust
[ link to this | view in chronology ]
"I'm a big believer in..."
"A little like saying "I'm a big believer in human
rights...but torture works".
Alternatively, let's also say:
"I swore an oath to protect the constitution, but undermining it gives us even more tools to hunt for terrorists, especially if undermining it gives us tools that anyone can use, once they're discovered."
We're weakening our protections in the name of security, but an exploit doesn't care who is using it. Stuxnet code is already being adapted as a weapon against us, right? Each weakness we add to software in the name of giving the NSA more power to protect us only hands our enemies another weapon.
[ link to this | view in chronology ]
No, being distrustful and abusing power hurt the "trust" between DC and the tech industry. Snowden's documents merely shined a light on it, but the trust was hurt entirely due to the government's own actions, not the revelation of it.
Please, PLEASE stop shooting the messenger.
[ link to this | view in chronology ]
Sure, they give it lip service, but the bottom line is power, which is what most of them are about.
They all swore to uphold it, yet they work as hard as they can to get around it. That is not the sign of people who believe in its principles.
I'm becoming ashamed to be an American, not because I no longer agree with those principles, but because our principles have been sold to the highest bidder.
[ link to this | view in chronology ]
The attitude that "we must prevent crime" is the same attitude that makes everyone a potential suspect, since anyone is capable of committing a crime.
[ link to this | view in chronology ]
Re:
However, he's not entirely wrong: if a terrorist attack were to happen, the various federal agencies will certainly catch a ton of hell from the public about it. However they will catch hell from the public no matter what they have or have not done. The solution to that problem isn't to become even more oppressive and strip the public of even more liberty, but for them to stop being so thin-skinned.
[ link to this | view in chronology ]
The first company that comes out and says we guarantee these spy agencies aren't in our product will walk away with the market if they don't force this issue.
[ link to this | view in chronology ]
Re:
How could any company actually be sure of that, though? It seems to me that any company that makes such a declaration, no matter how sure they are that it is true, is a company that is in danger of being sued out of existence when people find out that the product has been compromised.
[ link to this | view in chronology ]
Re:
The US agencies use gag orders, and tell companies to lie to their customers. This makes any such statement suspect from the get go.
[ link to this | view in chronology ]
Re: Re:
It would also help to make a sworn statement under another country's laws, with serious penalties for making a false statement, which one wouldn't be willing to do if one knew one was lying.
[ link to this | view in chronology ]
Re:
As long as NSL's and gag orders exist, no US company can say that with any degree of honesty, because while it might be true then, nothing's stopping the government from coming in at a later date and demanding that they compromise their product, and blocking them from speaking out or challenging the order.
[ link to this | view in chronology ]
Let's debate?
It's just the politicians that don't accept the outcome and want to re-open the debate.
That's not a debate, that's whining!
[ link to this | view in chronology ]
Re: Let's debate?
[ link to this | view in chronology ]
[ link to this | view in chronology ]
The Snowden disclosures didn't cause harm
[ link to this | view in chronology ]
A world of acceptable risks
Dear President Obama,
No, we're NOT expecting our law enforcement to stop "every plot - every attack."
Just like we're not expecting them to stop domestic abuse by planting cameras in every household in the country. And we're not expecting them to stop car crashes by taking driving licenses away from everybody.
We live in a world of acceptable risks - as a risk-adverse world only exists in delusional fantasy.
And, unpalatable as it may be to politicians seeking re-election and frightened of social media backlash or to military/security agencies seeking to justify their ever increasing budgets and endless wars, if there is the choice between some people having horrible things happen to them because of drug-deaing-terrorist-pedophiles and all of us having our privacy, digital security, and tech industry decimated by the very people that say they want to "protect" us...
...then we say, okay. We can live with some plots and attacks.
The-powers-that-be need to find ways to catch criminals, pedophiles and terrorists that don't reduce our freedoms. Because our freedom is sacred. But if they miss some of the bad guys, sometimes, that's an acceptable risk.
Just like we're prepared to take a risk crossing the road, catching an airplane, or eating donuts.
Sincerely,
America
[ link to this | view in chronology ]
I'm with TJ
Thomas Jefferson
Frankly, the chances of any one person being killed or injured in a terrorist attack are quite small. The chances they will have their credit, identity or credit card compromised in a hacking attack are quite large. I would prefer to have strong encryption over the internet, through the companies network and right on into the database. Nothing should be stored in the clear anymore, not even something as lowly as a phone number.
[ link to this | view in chronology ]
Re: I'm with TJ
Just the mere accusation of being criminal can get you put away for months on end waiting for trial or release with all assets frozen, family financially fucked, and your job lost!
The real terrorists are the boys in blue that don't give a fucking shit about you.
[ link to this | view in chronology ]
Uh huh....
http://en.wikipedia.org/wiki/LOVEINT
[ link to this | view in chronology ]
Re:
Silly Obama, the internet never forgets!
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
The point he misses is that if it's targeted it is still easily done, by actively intercepting the targets communication! The encryption we are talking about doesn't prevent wiretapping and seeing everything in and out of a targets phone in real time . It only prevents the browsing(fishing) through things already stored on the phone.
[ link to this | view in chronology ]
What he should have followed up with is: "Now we just use National Security Letters that work as federal gag orders to request anything we want."
[ link to this | view in chronology ]
Obama != security!
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Something not stated.
1. The internet needs a few fixes. one that would track most emails is that every server needs to place a tag on the email passing thru it.
2. HARDWARE back doors. The CIA has been installing hardware backdoors in alot of devices for years. Also the Manufacturers have master resets incase you mess something up, it can be reconfigured.
3. Monitoring the net, no matter how thorough,can not cover everything. There are to many ways to Hide what you are doing or what is being said. Unless you think WOW is copying everything said/typed...Or Mabinogi is doing the same...The odds of finding people doing bad things is not that easy. Other wise we would all be under Puritan laws, and every child molester would be arrested.
For those that dont get it, the internet hasnt changed much, its only being covered up by LOTS of pretty interfaces. The old net is still there. BURIED..under a browser..and pretty colors..
[ link to this | view in chronology ]
Believe me, I fully understand the tradeoffs/risks of government mandated, backdoored encryption. Just say no to backdoors. It won't end well for humanity.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
How do you believe a serial liar
[ link to this | view in chronology ]
A change of wording that might someday indicate progress...
Fix'd.
[ link to this | view in chronology ]
I'm A Big Believer In Strong Encryption... But...
"I support the left though I'm leaning to the right
"But I'm just not there when it's coming to a fight"
Politician by Clapton, Baker, Bruce
[ link to this | view in chronology ]
I Woudn't Trust the Government to start with the letter "G"
[ link to this | view in chronology ]