Senator John McCain Weighs In On 'Going Dark' Debate -- Insists That He Understands Cryptography Better Than Cryptographers
from the maverick dept
Who knew that Senator John McCain understood encryption better than actual cryptographers? Late last week, he wrote an op-ed for Bloomberg View, in which he trots out all the usual talking points on how Silicon Valley just needs to nerd harder to solve the "Going Dark" problem. There's lots of cluelessness in the piece, but let's focus on the big one:Top cryptologists have reasonably cautioned that “new law enforcement requirements are likely to introduce unanticipated, hard to detect security flaws,” but this is not the end of the analysis. We recognize there may be risks to requiring such access, but we know there are risks to doing nothing.Actually, it kind of is "the end of the analysis" because the core element of that analysis is the fact that any attempt to backdoor encryption doesn't just make security weaker, it puts basically everyone at much greater risk. It introduces cataclysmic problems for any system that stores information that needs to be kept secure and private.
The following sentence is equally inane, in which he tries to place the "risks" of backdooring encryption on the same plane as the risk of ISIS using encryption. Let's be clear here: the risk of backdooring encryption isn't just significantly larger than the risk of ISIS using encryption, they're not even in the same universe. Even worse, by backdooring encryption, you are almost certainly increasing the risk of ISIS as well, by giving them a massive vulnerability to attack and exploit. Trying to suggest that this is an "on the one hand, on the other hand" situation is so ridiculously ignorant, one wonders who the hell is advising Senator McCain on this topic.
The fact is that there are always some risks. Tens of thousand of people die in car accidents in the US every year, yet you don't hear Senator McCain weighing the risks of driving versus the risks of banning cars. And that's a much more reasonable position to stake out, because banning cars would actually reduce automobile deaths — but it would also cripple the economy. But here's the thing: backdooring encryption has the potential to do much more damage to the economy than banning automobiles, because it would create vulnerabilities that could really completely shut down our economy. So, for McCain to pretend that there are somewhat equal risks on either side isn't just ignorant and meaningless, it's dangerous.
Some technologists and Silicon Valley executives argue that any efforts by the government to ensure law-enforcement access to encrypted information will undermine users’ privacy and make them less secure. This position is ideologically motivated and profit-driven, though not without merit. But, by speaking in absolute terms about privacy rights, they bring the discussion to a halt, while the security threat evolves.Honestly, this is not true. I know that Comey's favorite line these days is that using strong encryption is a "business model decision," but Silicon Valley's interest in strong encryption doesn't appear to be driven by their own bottom lines, frankly. If it was, they would have adopted it much earlier. Strong encryption actually undermines some companies' business models, in that it makes it more difficult for them to collect the data that many of them rely on. The move towards stronger encryption has mostly been the result of a few things: (1) the fact that the NSA broke into their data centers and put their legitimate users at risk, (2) a better understanding of the wider risks from malicious attackers of what happens when you have weak encryption and (3) user demands for privacy. The last one may have indirect business model benefits in that it keeps users happier, but to argue that keeping users happy is somehow a purely money-driven decision, and frame it as somehow a bad thing, is pretty damn ridiculous.
And, honestly, while there are some activists who speak in absolute terms about "privacy rights," you rarely hear that from Silicon Valley companies. In fact, those who have absolute views on privacy tend to be the most critical of Silicon Valley companies for taking a much less principled view on "privacy rights." McCain pretending that this is driven by some sort of "privacy rights" advocacy suggests he's (again) woefully misinformed on this issue.
To be clear, encryption is often a very good thing. It increases the security of our online activities, provides the confidence necessary for economic growth through the Internet, and protects our privacy by securing some of our most important personal information, such as financial data and health records. Yet as with many technological tools, terrorist organizations are using encryption with alarming success.Actually, they're not using encryption with "alarming success." There are very, very, very, very few examples of terrorists using encryption successfully. The Paris attackers? Unencrypted SMS. San Bernardino? Unencrypted social media communication.
The jihadists' followers and adherents use encryption to hide their communications within the U.S. FBI Director James Comey recently testified that the attackers in last year's Garland, Texas, shootings exchanged more than 100 text messages with an overseas terrorist, but law enforcement is still blinded to the content of those texts because they were encrypted.Notice that this is the only example that comes up in these discussions. That's because it's the only example. And it's not even a very good one. Because, as with most encrypted communication, the metadata was still perfectly accessible. That's why they know that the attackers exchanged messages with a terrorist. Sure, they may not be able to understand the direct contents of the message, but the same thing would have been true if the attacker and the people he communicated with had worked out a code before hand. Or, you know, if they had met and talked in person. Is McCain going to ban talking in person too?
Finally, McCain's "solution" to all of this is to make a law telling Silicon Valley to nerd harder and solve the problem... or else:
As part of this effort, Congress should consider legislation that would require U.S. telecommunications companies to adopt technological alternatives that allow them to comply with lawful requests for access to content, but that would not prescribe what those systems should look like. This would allow companies to retain flexibility to design their technologies to meet both their business needs and our national security interests.In other words, despite the fact that all of the best cryptographers in the world have said that what you're asking for is basically impossible and would make everyone less safe, just do it anyway -- and do it in a way that when it falls apart and everyone is made more vulnerable, Congressional leaders like John McCain can spin around and blame the companies rather than themselves.
We have to encourage companies and individuals who rely on encryption to recognize that our security is threatened, not encouraged, by technologies that place vital information outside the reach of law enforcement. Developing technologies that aid terrorists like Islamic State is not only harmful to our security, but it is ultimately an unwise business model.Does John McCain seriously not employ a single knowledgeable staffer who could point out to him that basically every encrypted technology that ISIS uses is not made by an American company? Seriously, look at the list of ISIS's preferred encryption technologies:
Meanwhile, we haven't even touched on the biggest issue, as was highlighted in that big paper from Harvard last week. And it's this: the whole Going Dark thing is a total myth, because for the tiny, tiny, tiny bit of information that is now blocked out by strong encryption, there's a mountain of other data that is now accessible to law enforcement and the intelligence community. Things have been getting lighter and lighter and lighter for decades.
Shouldn't a sitting Senator understand these basic facts?
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: benefits, costs, cryptography, encryption, going dark, isis, john mccain, national security, risk, security, threat
Reader Comments
Subscribe: RSS
View by: Time | Thread
[ link to this | view in chronology ]
Taste your own medicine
It will either prove good enough for the NSA's own use or fall nicely flat on its face.
[ link to this | view in chronology ]
Re: Taste your own medicine
[ link to this | view in chronology ]
Re: Taste your own medicine
You say the government should develop its own encryption standard. I'd be careful what you ask for. The encryption standards already exist, only the policy is missing and that's one thing the government likes to do. It would be very easy for them to mandate all phones sold in the US must be decryptable. Yes, hackers might be able to remove that capability, but most people wouldn't and that's probably good enough.
[ link to this | view in chronology ]
Re: Re: Taste your own medicine
[ link to this | view in chronology ]
Re: Re: Re: Taste your own medicine
Backdoored crypto is an entirely different beast than multi-keyed crypto.
[ link to this | view in chronology ]
Re: Taste your own medicine
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
the risks of doing nothing
When it comes to encryption, we can pick three choices right now: backdoors, doing nothing, or start requiring broader use of strong encryption. The middle choice leaves our risk constant, the last choice reduces risk by making it harder for 'the bad guys' to gain useful information, or we could increase risk by undermining encryption.
[ link to this | view in chronology ]
Re: the risks of doing nothing
[ link to this | view in chronology ]
All government agencies and officials should be the beta testers for all the crap they are trying to put the population thru.
All of them should use airport security and be subjected to the TSA and coach seats.
All of them and their staff should have use ‘law enforcement accessible’ encryption.
All of them should be subjected to the NSA surveillance before allowing laws to be enacted that the citizens of the United States are subjected to.
Let them lead by example or get out of the way.
While I’m at it, all lobbyists engaged in talking to government officials or their staff must be done with full public disclosure. Any lobbyist materials must be made public and all political donations to PACS must be made transparent.
We also need term limits for senators and congressman.
Government of the people, by the people, for the people – we should not fear the government, we should control it.
Self-governance is the basis of the United States Constitution.
We need to stop being sheeple and reclaim what is ours!
WAKE UP and Stop the B.S.
[ link to this | view in chronology ]
Re:
... that would be the Gettysburg Address, rather than the constitution.
> Self-governance is the basis of the United States Constitution.
... if by self-governance, you mean "a government over its own people", which England was not, then yep. If you're thinking of a "pure democracy", well... you might want to read the document again.
[ link to this | view in chronology ]
how do you expect to get your pudding
I can see the lot of them yelling and screaming, between bouts of holding their breath until they turn blue (not a bad idea,) as they writhe around on the supermarket floor.
[ link to this | view in chronology ]
Here is the most stupid part...
I think the only thing being backdoored here are the sheeple.
[ link to this | view in chronology ]
Of course McCain understands cryptography
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Response to: Jason on Feb 9th, 2016 @ 10:30am
[ link to this | view in chronology ]
homework
suggested start
http://www.newsmax.com/Newsfront/dhs-isis-destroy-records/2016/02/06/id/713047/
the control of information has always been about protecting the organization -- whether that be a corporation or a government. the real target is unwanted exposure. in the case of government this refers to dissidents .
[ link to this | view in chronology ]
Their argument comes down to this:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Your move now.
[ link to this | view in chronology ]
Make It So
Impossible, you say? Not with The Borg bearing down on our starship. When Jon Luc says, "Make it so," your job is not to argue. Your job is to make it so.
[ link to this | view in chronology ]
Back at ya McCain
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Sooo
[ link to this | view in chronology ]
Re: Sooo
[ link to this | view in chronology ]
Typical BS
Why can't they get this through their heads? What dementia affects career politicians that they don't get that OUR ENEMIES will be able to read our most closely guarded secrets if they get their way?
/rant
[ link to this | view in chronology ]
This is not about finding a good solution...
What they are after is that by law, they will be able to demand the shitty solution after a while when another way isn't found.
They don't want a fair deal here... they want everything for nothing, because I will bet everything I own that they won't just go "oh, I guess it really was impossible. We better give up on this fools errand". After a year, at the most, they will complain about how they were forced to use the most crappy solution ever, because the tech companies didn't work hard enough or didn't cooperate.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Whatever the fuck that means
[ link to this | view in chronology ]
[ link to this | view in chronology ]
McCain is yet another dinosaur
[ link to this | view in chronology ]
[ link to this | view in chronology ]