President Obama: I'm A Big Believer In Strong Encryption... But...

from the let's-drop-the-but-part dept

Last Friday, at the White House's Cybersecurity Summit at Stanford, reporter Kara Swisher sat down for a half-hour interview with President Obama (and she even dragged her famous red chairs along). It's a better, more in-depth interview than you're ever likely to see from the established mainstream press, and touches on a variety of issues regarding technology and security. While I don't agree with some of the answers, I will say that the President appears to be extremely well-briefed on these issues, and didn't make any totally ridiculous or glaringly misleading remarks. You can see the whole interview here: In it, he admits that the "Snowden disclosures" (as he calls them) hurt "trust" between DC and the tech industry, and admits that the government has been "a little slow" in updating the laws for how the NSA operates online. However, he does say that surveillance on US persons is very carefully controlled and that he can say "with almost complete certainty that there haven't been abuses on US soil." He admits that's not entirely the case overseas, where there are basically no limits on the NSA's surveillance, and he recognizes that needs to change. Of course, if that's the case, he can do that right now -- because the NSA's authority for all of that is an executive order, 12333, and he could revoke it and write a new one. But he hasn't.

Then he gets to the area I found most interesting and want to focus on, the question of encryption. After discussing how he's looking to update the rules for surveillance and his relationship with tech, the interview proceeds like this:

Obama: There's still some issues like encryption...

Swisher: Let's talk about encryption.

Obama: ... that are challenging, and that's something that's been brought up...

Swisher: What's wrong with what Google and Apple are doing? You have encrypted email.

Obama: Absolutely.

Swisher: Shouldn't everybody have encrypted email and have their protections?

Obama: Everybody should. And I'm a strong believer in strong encryption. Where the tension has come up, is historically what's happened is that... let's say you knew a particular person was involved in a terrorist plot, and the FBI is trying to figure out who else are they trying to communicate with to prevent the plot. Traditionally, what's been able to happen is they get a court order, the FBI goes to the company, they request those records, the same way they'd go get a court order to request a wiretap. The company technically can comply.

The issue here is, partly in response to consumer demand, partly in response to legitimate concerns about consumer privacy, the technologies may be built to a point where, when the government goes...

Swisher: They can't get the information.

Obama: ... the company says "sorry, we just can't pull it. It's so sealed and tight that even though the government has a legitimate request, technologically we cannot do it."

Swisher: Is what they're doing wrong?

Obama: No. I think they are properly responding to a market demand. All of us are really concerned about making sure our...

Swisher: So what are you going to do?

Obama: Well, what we're going to try to do is see if there's a way for us to narrow this gap. Ultimately, everybody -- and certainly this is true for me and my family -- we all want to know if we're using a smartphone for transactions, sending messages, having private conversations, we don't have a bunch of people compromising that process. There's no scenario in which we don't want really strong encryption.

The narrow question is going to be: if there is a proper request for -- this isn't bulk collection, this isn't fishing expeditions by government -- where there's a situation in which we're trying to get a specific case of a possible national security threat, is there a way of accessing it? If it turns out there's not, then we're really going to have to have a public debate. And, I think some in Silicon Valley would make the argument -- which is a fair argument, and I get -- that the harms done by having any kind of compromised encryption are far greater than...

Swisher: That's an argument you used to make, you would have made. Has something changed?

Obama: No, I still make it. It's just that I'm sympathetic to law enforcement...

Swisher: Why? What happened? Because you were much stronger on...

Obama: No, I'm as strong as I have been. I think the only concern is... our law enforcement is expected to stop every plot. Every attack. Any bomb on a plane. The first time that attack takes place, where it turns out we had a lead and couldn't follow up on it, the public's going to demand answers. This is a public conversation that we should be having. I lean probably further in the direction of strong encryption than some do inside law enforcement. But I am sympathetic to law enforcement, because I know the kind of pressure they're under to keep us safe. And it's not as black and white as it's sometimes portrayed. Now, in fairness, I think those in favor of air tight encryption also want to be protected from terrorists.

Swisher: True.

Obama: One of the interesting things about being in this job, is that it does give you a bird's eye view. You are smack dab in the middle of these tensions that exist. But, there are times where folks who see this through a civil liberties or privacy lens reject that there's any tradeoffs involved. And, in fact, there are. And you've got to own the fact that it may be that we want to value privacy and civil liberties far more than we do the safety issues. But we can't pretend that there are no tradeoffs whatsoever.

I actually think this is a very good, nuanced answer to this issue. It doesn't descend into hyperbole about child predators and ticking time bombs like law enforcement officials have done. He admits that there are tradeoffs and, at least publicly, seems to be willing to admit that stronger encryption without compromise might be the best solution.

Of course, where we're left with questions is about his requested "public debate." Where and how is that happening? Because, to date, the only noise on this issue coming out of his administration has been on the other side, pushing for new legislation that would require backdoors and compromise encryption. We haven't seen anyone in the administration presenting the other side at all. And, for those of us who strongly believe that a basic cost/benefit analysis of weakening encryption vs. letting law enforcement do their job through traditional detective work would show that the "costs" of weakened encryption vastly outweigh the "threats" of criminals getting away with stuff, it would be nice to see the government at least recognizing that as well.

President Obama chides civil liberties and privacy folks for not getting that there are tradeoffs here, and I don't think that's accurate. Most do recognize the tradeoffs. It's just that they believe the true benefit in terms of "stopping criminals" to weakening encryption is not very great, while the cost to everyone in risking their own privacy is massive. What we have not seen is any indication that law enforcement recognizes that there are tradeoffs, or that they care. Yes, as the President admits, they're weighing some of this against "not getting blamed" when an inevitable "bad event" happens -- but they don't seem to be willing to recognize, at all, the risks to everyone's privacy. That's why they keep talking about golden keys and magic wizards who can make special encryption that only good guys can use.

So I'm glad that the President at least seems to recognize this is a nuanced issue with tradeoffs, but I wish that others in his administration, especially from the law enforcement side, were willing to recognize that as well.

Filed Under: barack obama, cybersecurity, encryption, kara swisher, law enforcement, mobile encryption, national security, president obama, privacy, security, surveillance

President Obama To Encourage Cybersecurity Information Sharing, Highlighting Why We Don't Need CISPA

from the don't-destroy-privacy-in-the-name-of-cybersecurity dept

There's a big "White House Cybersecurity Summit" down the road at Stanford today, where the President will release the details of a new executive order promoting "a framework for sharing information about cyber threats" which the administration hopes will lead organizations to better protect their data from malicious hacks.

The new executive order encourages businesses to form "information sharing and analysis organizations," or ISAOs, which would gather data about hacking attacks and share it with companies and the government.

And, of course, a bunch of companies are going to announce that they're doing just that:

A number of companies will announce Friday that they are incorporating the administration's cybersecurity framework, which was created after a 2013 executive order, into their companies. The framework helps businesses decide how to use cybersecurity investments, ways to implement cybersecurity for new companies and measure their programs against others. Intel, Apple and Bank of America use framework and will announce that they will require all vendors to use it. Both QVC and Walgreens will say they will employ the framework in their risk management practices, while Kaiser Permanente will commit to using it as well.

Of course, if you've been following the big fights over the past few years on cybersecurity legislation, you'll know that such "information sharing" has been a key component in most of the proposed bills, none of which have become law. Most of the bills have focused on one key thing: giving companies liability protection, so that they can't be sued over the information they share. From the beginning, however, we've asked a pretty simple question that no one has answered: what is currently preventing companies from sharing such threat information?

The answer, as reinforced by this move today by the White House, is absolutely nothing. Companies can (and in some cases already do) share "threat" information, and having them do so in a more organized fashion to prevent malicious attacks is, in fact, a good idea. What's not needed is a law that basically gives blanket immunity for companies to share almost any information to any government agency. That's been the problem with CISPA, CISA and similar bills: they're not about truly making information sharing about threats easier, since that can be done already. They're about giving blanket cover for companies to share even more information with government agencies such as the NSA.

With this new executive order and companies adopting the suggested framework, many of the "benefits" backers of cybersecurity legislation talk about will happen without the need for any new legislation. True threat information can be shared and companies can get wiser about protecting their information. But it doesn't give them blanket immunity if they start handing over other information to the government for other purposes, such as surveillance. That's important.

Yes, working together to prevent the growing number of online attacks is important. But that should never be used as a backdoor process to enable greater surveillance. Doing it this way, rather than by passing a questionable law, seems like a much more reasonable first step.

Filed Under: cisa, cispa, cybersecurity, cybersecurity summit, cyberthreat information, dhs, executive order, information sharing, obama administration, president obama, white house

Obama To Germans Worried About NSA Surveillance: 'Hey, Trust Us!'

from the why? dept

It's often been said that trust is something that you earn -- or that you completely destroy in irredeemable ways. So it's a little bizarre to see President Obama trying to restore German trust in the US (and specifically over NSA surveillance) with a bogus "hey, trust us" line, when his own government has spent the past few years doing everything possible to undermine any residual trust. Yet here he is, in a joint appearance with German Chancellor Angela Merkel, asking for "the benefit of the doubt."

There are going to still be areas where we’ve got to work through these issues. We have to internally work through some of these issues, because they’re complicated, they’re difficult. If we are trying to track a network that is planning to carry out attacks in New York or Berlin or Paris, and they are communicating primarily in cyberspace, and we have the capacity to stop an attack like that, but that requires us then being able to operate within that cyberspace, how do we make sure that we’re able to do that, carry out those functions, while still meeting our core principles of respecting the privacy of all our people?

And given Germany’s history, I recognize the sensitivities around this issue. What I would ask would be that the German people recognize that the United States has always been on the forefront of trying to promote civil liberties, that we have traditions of due process that we respect, that we have been a consistent partner of yours in the course of the last 70 years, and certainly the last 25 years, in reinforcing the values that we share. And so occasionally I would like the German people to give us the benefit of the doubt, given our history, as opposed to assuming the worst -- assuming that we have been consistently your strong partners and that we share a common set of values.

And if we have that fundamental, underlying trust, there are going to be times where there are disagreements, and both sides may make mistakes, and there are going to be irritants like there are between friends, but the underlying foundation for the relationship remains sound.

Yes, I can understand why President Obama would want that, but that doesn't mean that he deserves it. This is the same president who allowed the surveillance to happen in the first place, who acted surprised when told it covered Angela Merkel, and who has done nothing more than paid lip service to the idea of reforming surveillance. This is the president who could have ended the bulk collection of phone records just by ordering the NSA to not seek a renewal for its authority, but has not done so.

This is the same President who has prosecuted more whistleblowers and journalists under the Espionage Act than all other Presidents combined (and then doubled). And this is the same administration who has fought off nearly every attempt at transparency over these actions.

So, I'm sorry, but it seems rather hilarious to just say "trust us" when no reason has been given for that trust. No effort has been made to show why the US is trustworthy on this matter. Yes, mistakes are made at times, and then it's quite right to recognize that not everyone is perfect. But to suggest that the US's surveillance actions over the past decade have all been a result of such slip ups doesn't hold any water at all. There is a consistent pattern of stretching the boundaries further and further and playing games with definitions in the law and ever increasing the powers of the surveillance state.

President Obama and the US government may have had the benefit of the doubt in the past, but on surveillance, at this point in time, it seems like it's going to need a hell of a lot more than "hey, we're the good guys!" to get people to trust them on that again.

Filed Under: angela merkel, barack obama, benefit of the doubt, germany, nsa, president obama, surveillance, trust

YouTubers Got To Interview The President Because They're More Legitimate Than Traditional News

from the among-the-disrupted dept

If there's one overarching theme of this blog for the 16+ years that it's been around, it might be "disrupted industries behaving badly." It seems to be a fairly constant theme. And the news business is no exception. And, boy, have they been bitching and whining about it a lot lately. If you want to see the quintessential example of clueless self-pity, it has to be Leon Wieseltier's recent NY Times whinefest, Among the Disrupted. Wieseltier is definitely among the disrupted, having recently lost his longtime job at the New Republic as part of a publication-wide freakout over the fact that the new management (led by Facebook co-founder Chris Hughes) wanted to try to make the magazine a bit more relevant to the younger generation. It is a paean to elitism, eloquently insisting that without the cultural elite guiding the way, the digital riffraff online will never understand the true cultural meaning of anything.

A similar piece appeared last week, in the SF Chronicle, by Jon Carroll, in which he does his best impression of telling the digital kids to get off his lawn, while trying to come to terms with the fact that those darn kids today just don't really trust or believe in the "real media" any more (though he seems to use a rather arbitrary description of who is good -- Al Jazeera -- and who is crud -- Fox News).

But to see the truly hysterical old media in action, you need to just pay attention to the collective freakout over the White House's decision to let three YouTube stars interview President Obama. It quickly became an easy punchline for sneering elites that this was somehow "beneath the dignity" of the White House. Much of the focus was on one of the three, GloZell Green, a comedian who does funny stuff on her YouTube channel -- including silly challenges, like (the one that everyone keeps bringing up) taking a bath in cereal.

Hank Green, one of the other two YouTubers who took part in the interview has hit back with an absolutely fantastic post explaining why it totally makes sense for the White House to have such YouTubers interview the President, rather than the mainstream media. And it's because most people don't think the mainstream media is legitimate any more. It's lost its legitimacy, because the facade of what the news does has come down. The traditional news report -- what Jay Rosen has repeatedly referred to as "the church of the savvy" or "the view from nowhere" -- focuses on playing up their own connections and insiderness, rather than honesty and earnestness.

But these YouTubers, by contrast, are real -- and people trust them and view them as legitimate because they're real. As Green writes:

I think sub-consciously they understand the really terrifying thing here. Glozell and Bethany and I weren’t put in a chair next to President Obama because we have cultivated an audience. We were put there because we have cultivated legitimacy.

The source of our legitimacy is the very different from their coiffed, Armani institutions. It springs instead (and I’m aware that I’m abandoning any modicum of modesty here) from honesty. In new media this is often called “authenticity” because our culture is too jaded to use a big fat word like “honesty” without our gallbladders clogging up, but that’s really what it is.

Glozell, Bethany and I don’t sit in fancy news studios surrounded by fifty thousand dollar cameras and polished metal and glass backdrops with inlayed 90-inch LCD screens. People trust us because we’ve spent years developing a relationship with them. We have been scrutinized and found not evil. Our legitimacy comes from honesty, not from cultural signals or institutions.

And with young people having no reasons to trust those cultural signals that we older folks were raised with, this is the only thing that works for them anymore. Our values and interests mesh with theirs enough that they’ve come to trust us. They trust us to make content that they will enjoy and they trust us to be the kind of people they can look up to. People who betray that trust risk losing everything that they have built.

What's amazing is that the Carroll article I mentioned earlier actually is an almost perfect mirror of Green's article in some ways. They both mock the fakeness of Fox News. And they both admit that people now trust their friends and social media contacts more than such news providers. But in Carroll's world, this is dangerous and a sign of the people today not wanting "content" but just snippets:

People don’t want content anymore. They want diversion, and there’s plenty of that. Even the occasional discussion of public issues is diverting; have an opinion, post and go. The formats do not encourage complex discussion, and wit is prized above knowledge.

People don’t care what the media say. They care what their friends say; they get what information they get from people just like themselves. They don’t buy the new, friendlier one-to-many model; it’s still just strangers babbling. You know your friends; you trust them. If they say a restaurant is good, it’s good. If a media site says it, who cares?

Of course, it’s not as simple as that. We’re in a transitional phase; old-media outlets may be shrinking but they still make a lot of money, while the business model for digital publication is a work in progress. But the trends are clear. Objective reporting is now considered impossible, so why bother? And equally: Why bother with complexity?

It really seems like Carroll and Green are discussing the same phenomenon, but from very different perspectives. Green is surfing the wave, while Carroll is being dragged under by it. And, frankly, Carroll is wrong. People absolutely do want "content." They crave it. What they want is honest content -- and that's the point that Green is making. They care what their friends say because that's honest, and as even Carroll admits in his piece, the media doesn't do that very well.

But from honesty can come complexity. And investigative reporting and a variety of other things. Carroll argues that this new wave has killed off such investigative reporting, but that's ridiculous and wrong. He whines about crusaders, but it's those crusaders who have taken a deep interest in key issues that allows them to do the investigative reporting that needs to be done -- and to do it in a manner that people trust. Because it's real. Glenn Greenwald isn't a traditional investigative reporter, but he's built up a mountain of trust, because his own personality shines through in everything that he does. Agree with him or not, no one can deny that Greenwald is quite real and unlike the interchangeable heads seen on cable news. And the same is true for other "real" figures that the traditional media likes to mock, like Jon Stewart or Jon Oliver. They take different paths, but they really connect with their viewers. And it's the same for the YouTubers that the White House invited in.

The legacy media players may not like it, but mainly because it rips down the facade they've been living behind for so long. The facade that pretends they're all about "objective news reporting" when the reality has long been that they're more focused on being seen as important. The gatekeepers of the news. But the news has no more gatekeepers, and the public seems to prefer honesty, rather than made up objectivity. The view from nowhere now means that many people (especially younger people) see those newscasters as being nowhere at all. And that's why it completely makes sense for the White House to reach out to those people who are real, who have built up trust, and who will continue to be real, even if they ask questions that the mainstream media considers beneath them.

Filed Under: authenticity, glozell green, hank green, interview, jon carroll, journalism, leon wiesteltier, president obama, state of the union

President Obama Drops His Promise To Take Phone Metadata Away From NSA... But Perhaps That's Fine [Updated]

from the so-much-for-reform dept

Update: After talking to a few people about this, it's beginning to look like we may have overreacted to Reuters overreacting. The Reuters report focused on just one aspect of the proposal -- taking the data out of the NSA and giving it to a "trusted" third party. The problems that almost everyone pointed out at that time was that it's unclear how that "trusted third party" would actually be any safer than the NSA -- and many had assumed that idea was dropped long ago. Instead, everyone -- including the White House -- shifted the focus to just letting the telcos hang onto the data, like they do already, and hand it over when required by law. And the White House still supports that plan. In short, the only thing that was dropped was the bad idea of creating some new third party -- and that's an idea that most had assumed was dropped months ago for being nonsensical. We apologize for being misleading and not digging deep enough to understand the details. Original post below

As you may recall, about a year ago, President Obama gave a speech pledging some fairly weak NSA reforms in response to the Snowden revelations. There were some good things proposed, but he could have gone much further. One specific promise: the NSA would stop hoarding metadata on every phone call. As he said, it was time to "transition away" from using Section 215 of the Patriot Act to collect all those phone calls for the NSA to snoop through. Of course, he left the details up to Congress. And, Congress, in true Congress-like fashion, completely dropped the ball and failed to approve any of the proposed legislative changes that would have ended the metadata collection program.

So, President Obama is giving up. He apparently is breaking his promise to take the metadata away from the NSA:

President Barack Obama's administration has quietly abandoned a proposal it had been considering to put raw U.S. telephone call data collected by the National Security Agency under non-governmental control, several U.S. security officials said....

[....]

The Obama administration has decided, however, that the option of having a private third party collect and retain the telephone metadata is unworkable for both legal and practical reasons. "I think that's accurate for right now," a senior U.S. security official said.

It is neither unworkable for legal nor practical reasons. It's only unworkable because of political reasons in that Congress couldn't get its act together to bar the practice.

Furthermore, if President Obama had ever actually been serious about ending the program, he could have easily done it himself. That's because his administration has to go back to the FISA Court every few months to renew the program -- and he could have simply not had them do so. But, instead, the DOJ has just kept on renewing over and over again since then.

And thus, the NSA gets to keep on collecting all that metadata -- unless the courts magically put a stop to it or Section 215 isn't renewed by Congress in June of this year...

Filed Under: metadata, nsa, patriot act, president obama, section 215, surveillance

12 Nobel Peace Prize Winners Ask Nobel Peace Prize Winning President Obama To Release CIA Torture Report

from the what-happens-when-nobel-peace-prize-winners-fight? dept

We've been writing a ton about the Senate's CIA torture report, which goes into great detail on the CIA's torture program in a way that the CIA does not like (at all). The fight over the release of the report has been going on for quite a while now, even though the Senate Intelligence Committee voted to declassify the executive summary. Now a dozen Nobel Peace Prize winners have sent a letter to President Obama, himself a Nobel Peace Prize winner, asking him to release the report.

The open admission by the President of the United States that the country engaged in torture is a first step in the US coming to terms with a grim chapter in its history. The subsequent release of the Senate Select Committee on Intelligence summary report will be an opportunity for the country and the world to see, in at least some detail, the extent to which their government and its representatives authorized, ordered and inflicted torture on their fellow human beings.

We are encouraged by Senator Dianne Feinstein’s recognition that “the creation of long-term, clandestine ‘black sites’ and the use of so-called ‘enhanced-interrogation techniques’ were terrible mistakes,” as well as the Senate Committee’s insistence that the report be truthful and not unnecessarily obscure the facts. They are important reminders that the justification of the torture of another human being is not a unanimous opinion in Washington, or among Americans as a whole.

We have reason to feel strongly about torture. Many of us among the Nobel Peace Prize laureates have seen firsthand the effects of the use of torture in our own countries. Some are torture survivors ourselves. Many have also been involved in the process of recovery, of helping to walk our countries and our regions out of the shadows of their own periods of conflict and abuse.

It is with this experience that we stand firmly with those Americans who are asking the US to bring its use of torture into the light of day, and for the United States to take the necessary steps to emerge from this dark period of its history, never to return.

The letter goes on about the problems with torture and then lists out four specific policies it hopes President Obama will follow:

a. Full disclosure to the American people of the extent and use of torture and rendition by American soldiers, operatives, and contractors, as well as the authorization of torture and rendition by American officials.

b. Full verification of the closure and dismantling of ‘black sites” abroad for the use of torture and interrogation.

c. Clear planning and implementation for the closure of Guantanamo prison, putting an end to indefinite detention without due process.

d. Adoption of firm policy and oversight restating and upholding international law relating to conflict, including the Geneva Convention and the UN Convention against Torture, realigning the nation to the ideals and beliefs of their founders – the ideals that made the United States a standard to be emulated.

The signatories of the letter are Desmond Tutu, Jose Ramos-Horta, Mohammad ElBaradei, Leymah Gbowee, Muhammad Yunis, Oscar Arias Sanchez, John Hume, F.W. De Klerk, Jody Williams, Carlos X. Belo, Betty Williams and Adolfo Perez Esquivel. One hopes that this would help drive things forward on actually releasing the report, except that the CIA seems dead set against it.

Last week, Senator Ron Wyden pointed out that the CIA's focus in the declassification process has been to distort the truth:

"The intelligence leadership [is] doing everything they can to bury the facts," said Wyden.

Among the things the two sides are fighting about is whether or not to use pseudonyms for CIA agents. The CIA wants those redacted, but the Senate Intelligence Committee notes that this will hide how deeply involved certain individuals were in questionable actions -- and also that other intelligence reports have used pseudonyms without problem. In response, the CIA is blaming the Senate for "delaying" the release of the report, arguing that the Senate's demand for the report to actually reflect what happened is the real stumbling block.

It is “the Committee’s objections to the redactions” that “have delayed the process,” [CIA spokesman Ryan Trapani] said.

Technically both sides are holding it up, but that's because one side wants it to be accurate, and the other is deliberately seeking to obfuscate the details of the report. Who knows if 12 Nobel Peace Prize winners can help push the debate one way or the other, but at the very least it shows that the world is watching what the Obama Administration ends up doing.

Filed Under: barack obama, cia, desmond tutu, jose ramos-horta, nobel peace prize, president obama, ron wyden, senate, senate intelligence committee, torture report