National Security Officials Offer Hedged Support For Strong Encryption
from the we-like-it,-but-just-for-us dept
As Dianne Feinstein and Richard Burr mount another attempt to legislate holes in encryption, national security officials are offering testimony suggesting this is no way to solve the perceived problem. Another encryption hearing, again hosted by a visibly irritated John McCain (this time the villain is Twitter), featured testimony from NSA Director Michael Rogers [PDF] and Undersecretary of Defense for Intelligence Marcel Lettre [PDF] -- neither of whom offered support for mandated backdoors.
As nice as that sounds, the testimony wasn't so much "We support strong encryption," as it was "We support strong encryption*."
Lettre's testimony follows statements of support for encryption -- and opposition to legislated backdoors or "golden keys" -- with the veiled suggestion that the government will be leaning heavily on tech companies to solve this problem for it.
We need to strengthen our partnership with industry to find ways to protect against the national security threats to the United States. We will continue to work closely with our industry partners to find innovative ways to outmaneuver malicious actors' adoption of strong encryption, while ensuring that individual privacy interests are protected.
The problem here is that encryption isn't so much a privacy issue as it is a security issue. Approaching it from this incorrect angle suggests Lettre isn't opposed to backdooring encryption as long as access isn't abused by the government. But that limitation isn't going to stop malicious actors from abusing backdoors or other security holes built at the government's behest. It could be that Lettre misspoke, but that misreading of the real issue casts doubt on the sincerity of the rest of that paragraph.
I believe any steps we take as a government must be carefully considered to avoid introducing unintentional weaknesses in the protection of our commercial networks and national security systems. We should also be careful not to negatively affect our economic competitiveness as a world leader in technology, which could unintentionally drive technology innovation outside the United States.
This isn't quite as supportive as it might look at first glance either. Lettre wants to protect "commercial networks" and "national security systems." This wouldn't appear to cover computers, cellphones, or other personal devices that utilize encryption to protect their contents. Nor does it appear Lettre wants to extend his "hands off" approach to communications platforms that offer end-to-end encryption.
The NSA director's testimony is a bit better. There's far less hedging in Roger's statement than in Lettre's. Then again, it's far more vague in terms of the NSA's intentions. His statement poses more questions than answers (both figuratively and literally -- it ends with a "where do we go from here" question), but it does hint at being aligned with Lettre's suggestion that partnering with tech companies is a better solution than legislative mandates.
However, in the NSA's case, its "partnerships" with tech companies often don't appear to include approaching them directly. If anything, the "way forward" is the way things have been done for years by the NSA's Tailored Access Operations. Why ask for mandated backdoors when you can just intercept hardware shipments to install your own? Or reroute server traffic with man-in-middle attacks that grab content before encryption is applied?
While it is heartening to see natsec leaders refusing to back legislation pushed by Security Committee members, the fact is that there's still a powerful law enforcement lobby that can't be ignored -- one that begins with James "My god, it's full of darkness" Comey and runs all the way down to local-level district attorneys.
These entities may not offer much vocal support for mandated backdoors and do actually realize the harm they'll cause, but as long as their own stuff stays relatively protected, they're not necessarily opposed to anything that makes it easier to access communications and data.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: admiral michael rogers, encryption, going dark, marcel lettre, privacy
Reader Comments
Subscribe: RSS
View by: Time | Thread
[ link to this | view in thread ]
Re:
That's OK. All you have to do is label those holes on the outside with something like "HOLE FOR LAW ENFORCEMENT USE ONLY" so that the bad guys will know not to aim there.
[ link to this | view in thread ]
a visibly irritated John McCain
The shakes, weak knees, stutter, and bloodshot eyes are next.
[ link to this | view in thread ]
Unfortunately
[ link to this | view in thread ]
Just a suggestion...
If you want to 'strengthen [your] partnerships with industry', have you perhaps considered not treating them as idiots, adversaries, or both?
Ignoring the tech sector when they tell you that something's not just difficult it's impossible, going around their backs to undermine their products when you're not slapping them with insane demands coupled with gag clauses, arguing that tech companies should be forced to implement government demands that stand to cost the company serious cash and public goodwill, for no real gain...
So long as the government continues to treat the tech sector as idiotic adversaries they will respond in kind, and the idea of a 'partnership' in any sense beyond 'Do it or we'll make you do it' will remain a pipe dream.
[ link to this | view in thread ]
Re: Unfortunately
They've got time, they just need to keep leaning and will eventually push this (or something worse).
[ link to this | view in thread ]
Privacy and Security
Consider these issues:
* I don't want you to break into my ${thing}
* I don't want you to remove items from my ${thing}
* I don't want you to add items to my ${thing}
* I don't want you to see what is in my ${thing}
Are the above items Privacy issues or are they Security issues?
They seem to be Privacy issues when ${thing} = Computer / Phone
They seem to be Security issues when ${thing} = Home / Car
But why is Computer / Phone so different than Home / Car? Why does Warrant Required and Unreasonable Search And Seizure, and be Secure in Papers and Effects suddenly mean something different for Home / Car / Papers than it does for Computer / Phone?
To make it seem like they are different, the words Security or Privacy are used to categorize them.
It's also amusing that one applies to us while other applies to them:
* It's no big deal if we hack you even though it invades your Privacy but doesn't cause any actual harm
* It's a major crime for you to hack us and violate our Security even though you didn't cause any actual harm
When it's us, it's just our privacy. When it's them, it's their security.
[ link to this | view in thread ]
We won't learn until it's too late....
Dear Congress: What happens to the US if the boogey-man du jour somehow manages to get control of this capability? Leave aside the "how" and focus on the result. Is that what you want? Are you sure?
[ link to this | view in thread ]
[ link to this | view in thread ]
Re: Privacy and Security
Because they really, really don't like the limitations the law (theoretically) imposes on them with regards to home/car/papers, and while ideally they'd like those limitations removed entirely, they'll settle, for now, for making sure that the limitations don't exists with regards to anything else.
[ link to this | view in thread ]
Um... is it just me, but he ALWAYS looks irritated.
[ link to this | view in thread ]
Re: Re:
[ link to this | view in thread ]
[ link to this | view in thread ]