Mike Godwin's First Essay On Encryption And The Constitution

from the going-back dept

Mike Godwin (you know who he is) was recently going through some of his earlier writings, and came across an essay (really an outline) he had written to the Cypherpunks email list 25 years ago, in April of 1993 concerning the Clipper Chip and early battles on encryption and civil liberties. If you don't recall, the Clipper Chip was an early attempt by the Clinton administration to establish a form of backdoored encryption, using a key escrow system. What became quite clear in reading through this 25-year-old email is just how little has changed in the past 25 years. As we are in the midst of a new crypto war, Godwin has suggested republishing this essay from so long ago to take a look back at what was said back then and compare it to today.

From: Mike Godwin
Subject: Some thoughts on Clipper and the Constitution To: e*c Date: Mon, 26 Apr 93 11:15:17 EDT

Note: These notes were a response to a question during Saturday's Cypherpunks meeting about the possible implications of the Clipper Chip initiative on Fourth Amendment rights. Forward to anyone else who might think these interesting.

--Mike

Notes on Cryptography, Digital Telephony, and the Bill of Rights By Mike Godwin

I.Introduction

A. The recent announcement of the federal government's "Clipper Chip" has started me thinking again about what the principled "pure Constitutional" arguments a) opposed to Digital Telephony and b) in favor of the continuing legality of widespread powerful public-key encryption.

B. These notes do *not* include many of the complaints that have already been raised about the Clipper Chip initiative, such as:

(1) Failure of the Administration to conduct an inquiry before embracing a standard,
(2) Refusal to allow public scrutiny of the chosen encryption algorithm(s), which is the normal procedure for testing a cryptographic scheme, and
(3) Failure of the administration to address the policy questions raised by the Clipper Chip, such as whether the right balance between privacy and law-enforcement needs has been struck.

C. In other words, they do not address complaints about the federal government's *process* in embracing the Clipper Chip system. They do, however, attempt to address some of the substantive legal and Constitutional questions raised by the Clipper Chip and Digital Telephony initiatives.

II. Hard Questions from Law Enforcement

A. In trying to clarify my own thinking about the possible Constitutional issues raised by the government's efforts to guarantee access to public communications between individuals, I have spoken and argued with a number of individuals who are on the other side of the issues from me, including Dorothy Denning and various respresentatives of the FBI, including Alan McDonald.

B. McDonald, like Denning and other proponents both of Digital Telephony and of a standard key-escrow system for cryptography, is fond of asking hard questions: What if FBI had a wiretap authorization order and couldn't implement it, either because it was impossible to extract the right bits from a digital-telephony data stream, or because the communication was encrypted? Doesn't it make sense to have a law that requires the phone companies to be able to comply with a wiretap order?

C. Rather than respond to these questions, for now at least let's ask a different question. Suppose the FBI had an authorization order for a secret microphone at a public restaurant. Now suppose it planted the bug, but couldn't make out the conversation it was authorized to "seize" because of background noise at the restaurant. Wouldn't it make sense to have a law requiring everyone to speak more softly in restaurants and not to clatter the dishes so much?

D. This response is not entirely facetious. The Department of Justice and the FBI have consistently insisted that they are not seeking new authority under the federal wiretap statutes ("Title III"). The same statute that was drafted to outline the authority for law enforcement to tap telephonic conversations was also drafted to outline law enforcement's authority to capture normal spoken conversations with secret or remote microphones. (The statute was amended in the middle '80s by the Electronic Communications Privacy Act to protect "electronic communications," which includes e-mail, and a new chapter protecting _stored_ electronic communications was also added.)

E. Should we understand the law the way Digital Telephony proponents insist we do--as a law designed to mandate that the FBI (for example) be guaranteed access to telephonic communications? Digital Telephony supporters insist that it merely "clarifies" phone company obligations and governmental rights under Title III. If they're right, then I think we have to understand the provisions regarding "oral communications" the same way. Which is to say, it would make perfect sense to have a law requiring that people speak quietly in public places, so as to guarantee that the government can bug an oral conversation if it needs to.

F. But of course I don't really take Digital Telephony as an initiative to "clarify" governmental prerogatives. It seems clear to me that Digital Telephony, together with the "Clipper" initiative, prefigure a government strategy to set up an information regime that precludes truly private communications between individuals who are speaking in any way other than face-to-face. This I think is an expansion of government authority by almost any analysis.

III. Digital Telephony, Cryptography, and the Fourth Amendment

A. In talking with law enforcement representatives such as Gail Thackeray, one occasionally encounters the view that the Fourth Amendment is actually a _grant_ of a Constitutional entitlement to searches and seizures. This interpretation is jolting to those who have studied the history of the Fourth Amendment and who recognize that it was drafted as a limitation on government power, not as a grant of government power. But even if one doesn't know the history of this amendment, one can look at its language and draw certain conclusions.

B. The Fourth Amendment reads: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

C. Conspicuously missing from the language of this amendment is any guarantee that the government, with properly obtained warrant in hand, will be _successful_ in finding the right place to be searched or persons or things to be seized. What the Fourth Amendment is about is _obtaining warrants_--similarly, what the wiretap statutes are about is _obtaining authorization_ for wiretaps and other interceptions. Neither the Fourth Amendment nor Title III nor the other protections of the ECPA constitute an law-enforcement _entitlement_ for law enforcement.

D. It follows, then, that if digital telephony or widespread encryption were to create new burdens for law enforcement, this would not, as some law-enforcement representatives have argued, constitute an "effective repeal" of Title III. What it would constitute is a change in the environment in which law enforcement, along with the rest of us, has to work. Technology often creates changes in our social environment--some, such as the original innovation of the wiretap, may aid law enforcement, while others, such as powerful public-key cryptography, pose the risk of inhibiting law enforcement. Historically, law enforcement has responded to technological change by adapting. (Indeed, the original wiretaps were an adaptation to the widespread use of the telephone.) Does it make sense for law enforcement suddenly to be able to require that the rest of society adapt to its perceived needs?

IV. Cryptography and the First Amendment

A. Increasingly, I have come to see two strong links between the use of cryptography and the First Amendment. The two links are freedom of expression and freedom of association.

B. By "freedom of expression" I mean the traditionally understood freedoms of speech and the press, as well as freedom of inquiry, which has also long been understood to be protected by the First Amendment. It is hard to see how saying or publishing something that happens to be encrypted could not be protected under the First Amendment. It would be a very poor freedom of speech indeed that dictated that we could *never* choose the form in which we speak. Even the traditional limitations on freedom of speech have never reached so far. My decision to encrypt a communication should be no more illegal than my decision to speak in code. To take one example, suppose my mother and I agree that the code "777", when sent to me through my pager, means "I want you to call me and tell me how my grandchild is doing." Does the FBI have a right to complain because they don't know what "777" means? Should the FBI require pager services never to allow such codes to be used? The First Amendment, it seems to me, requires that both questions be answered "No."

C. "Freedom of association" is a First Amendment right that was first clearly articulated in a Supreme Court case in 1958: NAACP v. Alabama ex rel. Patterson. In that case, the Court held that Alabama could not require the NAACP to disclose a list of its members residing in Alabama. The Court accepted the NAACP's argument that disclosure of its list would lead to reprisals on its members; it held such forced disclosures, by placing an undue burden on NAACP members' exercise of their freedoms of association and expression, effectively negate those freedoms. (It is also important to note here that the Supreme Court in effect recognized that anonymity might be closely associated with First Amendment rights.)

D. If a law guaranteeing disclosure of one's name is sufficiently "chilling" of First Amendment rights to be unconstitutional, surely a law requiring that the government be able to read any communications is also "chilling," not only of my right to speak, but also of my decisions on whom to speak to. Knowing that I cannot guarantee the privacy of my communications may mean that I don't conspire to arrange any drug deals or kidnapping-murders (or that I'll be detected if do), but it also may mean that I choose not to use this medium to speak to a loved one, or my lawyer, or to my psychiatrist, or to an outspoken political activist. Given that computer-based communications are likely to become the dominant communications medium in the next century, isn't this chilling effect an awfully high price to pay in order to keep law enforcement from having to devise new solutions to new problems?

V. Rereading the Clipper Chip announcements

A. It is important to recognize that the Clipper Chip represents, among other things, an effort by the government to pre-empt certain criticisms. The language of announcements makes clear that the government wants us to believe it has recognized all needs and come up with a credible solution to the dilemma many believe is posed by the ubiquity of powerful cryptography.

B. Because the government is attempting to appear to take a "moderate" or "balanced" position to the issue, its initiative will tend to pre-empt criticisms of the government's proposal on the grounds of *process* alone.

C. But there is more to complain about here than bad process. My rereading of the Clipper Chip announcements will reveal that the government hopes to develop a national policy that includes limitations on some kinds of cryptography. Take the following two statements, for example:

D. 'We need the "Clipper Chip" and other approaches that can both provide law-abiding citizens with access to the encryption they need and prevent criminals from using it to hide their illegal activities.'

E. 'The Administration is not saying, "since encryption threatens the public safety and effective law enforcement, we will prohibit it outright" (as some countries have effectively done); nor is the U.S. saying that "every American, as a matter of right, is entitled to an unbreakable commercial encryption product." '

F. It is clear that neither Digital Telephony nor the Clipper Chip make any sense without restrictions on other kinds of encryption. Widespread powerful public-key encryption, for example, would render useless any improved wiretappability in the communications infrastructure, and would render superfluous any key-escrow scheme.

G. It follows, then, that we should anticipate, consistent with these two initiatives, an eventual effort to prevent or inhibit the use of powerful private encryption schemes in private hands.

H. Together with the Digital Telephony and Clipper Chip initiatives, this effort would, in my opinion, constitute an attempt to shift the Constitutional balance of rights and responsibilities against private entities and individuals and in favor of law enforcement. They would, in effect, create _entitlements_ for law enforcement where none existed before.

I. As my notes here suggest, these initiatives may be, in their essence, inconsistent with Constitutional guarantees of expression, association, and privacy.

Filed Under: 1st amendment, 4th amendment, backdoors, clipper chip, crypto wars, encryption, free speech, law enforcement

Back Down The Rabbit Hole About Encryption On Smartphones

from the the-rule-of-law dept

Deputy Attorney General Rod Rosenstein wrote the disapproving memo that President Trump used as a pretext to fire FBI Director James Comey in May. But on at least one area of law-enforcement policy, Rosenstein and Comey remain on the same page—the Deputy AG set out earlier this month to revive the outgoing FBI director's efforts to limit encryption and other digital security technologies. In doing so, Rosenstein has drawn upon nearly a quarter century of the FBI's anti-encryption tradition. But it's a bad tradition.

Like many career prosecutors, Deputy Attorney General Rod Rosenstein is pretty sure he's more committed to upholding the U.S. Constitution and the rule of law than most of the rest of us are. This was the thrust of Rosenstein's recent October 10 remarks on encryption, delivered to an audience of midshipmen at the U.S. Naval Academy.

The most troubling aspect of Rosenstein's speech was his insistence that, while the government's purposes in defeating encryption are inherently noble, the motives of companies that provide routine encryption and other digital-security tools (the way Apple, Google and other successful companies now do) are inherently selfish and greedy.

At the same time, Rosenstein said those who disagree with him on encryption policy as a matter of principle—based on decades of grappling with the public-policy implications of using strong encryption versus weak encryption or no encryption—are "advocates of absolute privacy." (We all know that absolutism isn't good, right?)

In his address, Rosenstein implied that federal prosecutors are devoted to the U.S. Constitution in the same way that Naval Academy students are:

"Each Midshipman swears to 'support and defend the Constitution of the United States against all enemies, foreign and domestic.' Our federal prosecutors take the same oath."

Of course, he elides the fact that many who differ with his views on encryption—including yours truly, as a lawyer licensed in three jurisdictions—have also sworn, multiple times, to uphold the U.S. Constitution. What's more, many of the constitutional rights we now regard as sacrosanct, like the Fifth Amendment privilege against self-incrimination, were only vindicated over time under our rule of law—frequently in the face of overreaching by law-enforcement personnel and federal prosecutors, all of whom also swore to uphold the Constitution.

The differing sides of the encryption policy debate can’t be reduced to supporting or opposing the rule of law and the Constitution. But Rosenstein chooses to characterize the debate this way because, as someone whose generally admirable career has been entirely within government, and almost entirely within the U.S. Justice Department, he simply never attempted to put himself in the position of those with whom he disagrees.

As I've noted, Rosenstein's remarks draw on a long tradition. U.S. intelligence agencies, together with the DOJ and the FBI, reflexively resorted to characterizing their opponents in the encryption debate as fundamentally mercenary (if they're companies) or fundamentally unrealistic (if they're privacy advocates). In Steven Levy's 2001 book Crypto, which documented the encryption policy debates of the 1980s and 1990s, he details how the FBI framed the question for the Clinton administration:

"What if your child is kidnapped and the evidence necessary to find and rescue your child is unrecoverable because of 'warrant-proof' encryption?"

The Clinton administration's answer—deriving directly from George H.W. Bush-era intelligence initiatives—was to try to create a government standard built around a special combination of encryption hardware and software, labeled "the Clipper Chip" in policy shorthand. If the U.S. government endorsed a high-quality digital-security technology that also was guaranteed not to be "warrant-proof"—that allowed special access to government agents with a warrant—the administration asserted this would provide the appropriate "balance" between privacy guarantees and the rule of law.

But, as Levy documents, the government's approach in the 1990s raised just as many questions then as Rosenstein's speech raises now. Levy writes:

"If a crypto solution was not global, it would be useless. If buyers abroad did not trust U.S. products with the [Clipper Chip] scheme, they would eschew those products and buy instead from manufacturers in Switzerland, Germany, or even Russia."

The United States' commitment to rule of law also raised questions about how much our legal system should commit itself to enabling foreign governments to demand access to private communications and other data. As Levy asked at the time:

"Should the United States allow access to stored keys to free-speech—challenged nations like Singapore, or China? And would France, Egypt, Japan, and other countries be happy to let their citizens use products that allowed spooks in the United States to decipher conversations but not their own law enforcement and intelligence agencies?"

Rosenstein attempts to paint over this problem by pointing out that American-based technology companies have cooperated in some respects with other countries' government demands—typically over issues like copyright infringement or child pornography rather than digital-security technologies like encryption. "Surely those same companies and their engineers could help American law enforcement officers enforce court orders issued by American judges, pursuant to American rule of law principles," he says.

Sure, American companies, like companies everywhere, have complied as required with government demands designed to block content deemed in illegal in the countries where they operate. But demanding these companies meet content restrictions—which itself at times also raises international rule-of-law issues—is a wholly separate question from requiring companies to enable law-enforcement everywhere to obtain whatever information they want regarding whatever you do on your phone or on the internet. This is particularly concerning when it comes to foreign governments' demands for private content and personal information, which might include providing private information about dissidents in unfree or "partly free" countries whose citizens must grapple with oppressive regimes.

Technology companies aren't just concerned about money—it's cheaper to exclude digital security measures than to invent and install new ones (such as Apple's 3D-face-recognition technology set to be deployed in its new iPhone X). Companies do this not just to achieve a better bottom line but also to earn the trust of citizens. That's why Apple resists pressure, both from foreign governments and from the U.S. government, to develop tools that governments—and criminals—could use to turn my iPhone against me. This matters even more in 2017 and beyond—because no matter how narrowly a warrant or wiretap order is written, access to my phone and other digital devices is access to more or less everything in my life. The same is true for most other Americans these days.

Rosenstein is certainly correct to have said "there is no constitutional right to sell warrant-proof encryption"—but there absolutely is a constitutional right to write computer software that encrypts my private information so strongly that government can't decrypt it easily. (Or at all.) Writing software is generally understood to be presumptively protected expression under the First Amendment. And, of course, one needn't sell it—many developers of encryption tools have given them away for free.

What's more, our government's prerogative to seek information pursuant to a court-issued order or warrant has never been understood to amount to a "constitutional right that every court order or search warrant be successful." It's common in our law-enforcement culture—of which Rosenstein is unquestionably a part and partisan—to invert the meaning of the Constitution's limits on what our government can do, so that that law-enforcement procedures under the Fourth and Fifth Amendments are interpreted as a right to investigatory success.

We've known this aspect of the encryption debate for a long time, and you don't have to be a technologist to understand the principle involved. Levy quotes Jerry Berman, then of the Electronic Frontier Foundation and later the founder of the Center for Democracy and Technology, on the issue: "The idea that government holds the keys to all our locks, even before anyone has been accused of committing a crime, doesn't parse with the public."

As Berman bluntly sums it up, "It's not America."

Mike Godwin (@sfmnemonic) is a distinguished senior fellow at the R Street Institute.

Filed Under: crypto wars, doj, encryption, going dark, privacy, rod rosenstein, rule of law

New Attorney General Loves Him Some Encryption Backdoors, Which Should Pair Up Nicely With FBI Director's Plans For The Future

from the you-make-it,-you-break-it dept

It looks as though this administration may be the Decrypto Party. Trump's pick for Attorney General has already made it clear he thinks asset forfeiture is a damn good thing for the American public, even if it often deprives the public of their property without evidence of criminal wrongdoing or providing a valid avenue of recourse.

Now, he's (once again) confirmed encryption shouldn't keep law enforcement from accessing devices. The EFF reports that Sessions strongly hinted he's in favor of encryption backdoors during his confirmation hearing.

Question: Do you agree with NSA Director Rogers, Secretary of Defense Carter, and other national security experts that strong encryption helps protect this country from cyberattack and is beneficial to the American people's’ digital security?

Response: Encryption serves many valuable and important purposes. It is also critical, however, that national security and criminal investigators be able to overcome encryption, under lawful authority, when necessary to the furtherance of national-security and criminal investigations.

This dim view of the public's use of encryption is nothing new for Jeff Sessions. While still a senator, Sessions made it clear he feels law enforcement's "needs" should come before the general security of phone users. During the battle over access to the San Bernardino shooter's iPhone, Sessions offered his support of an anti-encryption bill.

Republican Senator Jeff Sessions of Alabama questioned Cook’s position. "Coming from a law enforcement background, I believe this is a more serious issue than Tim Cook understands," Sessions said. He said accessing phones is critical to law enforcement.

"In a criminal case, or could be a life and death terrorist case, accessing a phone means the case is over. Time and time again, that kind of information results in an immediate guilty plea, case over," Sessions said. He added that the ability for government to access a phone should not be abused.

Well, yeah… "should not be abused." That should go without saying. But would it be abused? Probably. Law enforcement used to search phones all the time without warrants until the Supreme Court put a stop to that. FBI plug-and-play kiosks allow LEOs to perform forensic searches at their convenience. Presumably the proper paperwork is in play, but it's not as though the FBI's going to frisk cops on the way to the FORENS-O-MATIC.

Add a backdoor and no phone is secure -- not from the government and not from anyone who steals the device.

Sessions and backdooring encryption go back even further than last year's iPhone battle. When Dianne Feinstein decided consumer devices had too much security, Sessions was there to pitch leading softballs and confirm her radicalization-via-Playstation Network fears.

I suspect what happened in the aftermath of Snowden, particularly Europe got very conservative with respect to encryption. And companies back away. Now, that's changing with Paris and God forbid what might happen in the future. I think the world is really changing in terms of people wanting the protection and wanting law enforcement, if there is conspiracy going on over the internet, that encryption ought to be able to be pierced.

Well, Sessions was wrong about what the world wanted. Governments still remain reluctant to mandate encryption backdoors -- despite law enforcement's continual pleas and ongoing attacks in European nations. But being wrong never stopped anyone from exploiting tragedies to push agendas -- even when Sessions' view of the public mindset contradicts the public's actual mindset

Adding to the mix is the federal government's own Donnie Darko, FBI Director James Comey. Comey has yet to switch up talking points on encryption and continues to point to an impending criminal apocalypse that can only be thwarted by

a.) smart people making impossible things happen

b.) smart people being told what's what by legislation mandating decryption/backdoors.

Comey now has a very sympathetic AG watching over his agency and his office. Very little good can come of that.

Filed Under: attorney general, crypto wars, doj, encryption, fbi, going dark, jeff sessions

Congressional Committees Say Backdooring Encryption Is A Bad Idea

from the sorry,-Jim,-but-thanks-for-asking! dept

Two bipartisan Congressional committees are the latest to express their opposition to government-mandated encryption backdoors. The House Judiciary Committee and the House Energy and Commerce Committee have arrived at the same conclusion as the experts FBI director James Comey insists on ignoring: encryption backdoors are a net loss for everyone, no matter what gains might be experienced by law enforcement and intelligence agencies.

This is stated plainly in the first bullet point of its encryption report [PDF]:

Any measure that weakens encryption works against the national interest

While the committees acknowledge encryption can impede investigative efforts, the downsides of backdoors cannot be offset by making things easier for certain government agencies.

[S]takeholders from all perspectives acknowledged the importance of encryption to our personal, economic, and national security. Representatives of the national security community told the EWG that strong encryption is vital to the national defense and to securing vital assets, such as critical infrastructure. Civil society organizations highlighted the importance of encryption for individual privacy, freedom of speech, human rights, and protection against government intrusion at home and abroad. Private sector stakeholders—in particular, their information security officers—and members of the academic community approached the question from an engineering perspective—against a wide array of threats, foreign and domestic, encryption is one of the strongest cybersecurity tools available.

However, the committees still believe there might be a way to reconcile competing interests, even though it has more questions than answers at this point. The report suggests more "collaboration" between tech companies and law enforcement agencies -- a term that generally means most of the compromises will be made by the private sector. Whether this means companies collecting more data and communications and storing them where law enforcement can access them or creating "one time" backdoors in response to court orders remains to be seen.

More encouragingly, the report suggests the "smart guys" in law enforcement haven't fully taken advantage of the tools and data available to them.

It also remains unclear whether the law enforcement community is positioned to fully leverage the unencrypted information still held by many companies. A number of stakeholders acknowledged the potential benefit of improving law enforcement’s understanding of what data or information is available, who controls it, and how it could be useful to investigators. In particular, companies are often able to provide volumes of unencrypted metadata associated with their products or services. In some cases, this source of information could be useful to investigators. In others, one representative of a law enforcement agency told the EWG, access to a stream of metadata might be more like “looking for a particular grain of sand on the beach.”

This is probably the result of the law enforcement mindset. It often seems agencies are more interested in what is quickest and easiest, rather than what might be more productive, if just a bit more difficult. (A number of cases where warrants were never obtained, despite officers having both the time and probable cause to do so, is evidence of this mindset.) The report suggests this is one area where things could be improved by collaboration with private companies. It's not a terrible suggestion but it's one that requires agencies to move on from their defeatist attitudes and to stop pretending advances in technology are always far more beneficial to criminals than to law enforcement.

The report also inadvertently points out just how disingenuous it is to shrug off mass surveillance concerns by saying, "It's just metadata."

Metadata may not completely replace the loss of encrypted content, but metadata analysis could play a role in filling in the gap. The technology community leverages this information every day to improve services and target advertisements. There appears to be an opportunity for law enforcement to better leverage this information in criminal investigations.

The report also touches on "legal hacking" as a potential solution -- albeit one with very limited practical application. If this is the route the government chooses to go more frequently in response to encrypted devices, it will signal the end of the already mostly-worthless Vulnerabilities Equity Process. It would also -- as the report acknowledges -- only further the "us vs. them" conflict between tech companies and law enforcement, as the government's interest in keeping vulnerabilities secret would tend to outweigh its obligation to divulge security holes to affected companies.

While the report breaks very little new ground in terms of issues raised, it does at least signal that legislative efforts to undermine encryption aren't likely to find much bipartisan support. So, for the time being, device encryption is still safe. It's the other issues raised -- legal hacking, compelled disclosure, etc. -- that will need to be watched closely in the future.

Filed Under: backdoors, congress, crypto wars, encryption, going dark, house energy & commerce committee, house judiciary committee, james comey

Hillary Clinton's Staff Recognize She Doesn't Understand Encryption And Is Supporting 'The Impossible'

from the that's-at-least-marginally-reassuring dept

Hillary Clinton's position on encryption -- like so much of her tech policy -- has been kind of vague and wishy-washy. Saying things that possibly sound good, but could easily turn out to be bad depending on what is really meant. It's sort of the classical politician's answer on things, trying to appease multiple sides of an issue without getting fully pinned down on something that might come back to bite you later.

It started back in November of 2015, when Clinton gave a speech, which put her firmly into the "but Silicon Valley should nerd harder to figure out a backdoor" camp. A few weeks later, she doubled down on the "nerd harder" response in an interview with George Stephanopoulos:

STEPHANOPOULOS: How about Apple? No more encryption?

CLINTON: This is something I've said for a long time, George. I have to believe that the best minds in the private sector, in the public sector could come together to help us deal with this evolving threat. And you know, I know what the argument is from our friends in the industry. I respect that. Nobody wants to be feeling like their privacy is invaded.

But I also know what the argument is on the other side from law enforcement and security professionals. So, please, let's get together and try to figure out the best way forward.

A few weeks after that, she went even further, calling for a "Manhattan Project" on backdooring encryption. As we noted at the time, that made no sense and suggested a complete cluelessness about encryption and the issues related to it.

Now, with the release of the hacked emails from Clinton campaign manager John Podesta, we get to find out that Clinton's staff basically agreed with us that her statements on encryption were ridiculous, and felt that she should not support any effort to backdoor encryption. It started with an internal discussion in response to an inbound request from Politico, where some of her staffers sought to avoid answering the question on backdooring encryption, while admitting internally the reality. Here were the "boiled down" talking points, presented by Ben Scott (a former State Dept official who also ran Free Press for a few years):

1-The bad guys could already get crypto -- we helped the good guys get it.

2-The Internet Freedom investments in these technologies were strongly bipartisan (and remain so).

Those are good points. I wish she'd actually said that, rather than what eventually came out.

The second email comes right after that "Manhattan Project" comment at the debate in the middle of December, and there her staffers discuss what a terrible analogy it is and how they should tell the tech industry that Hillary won't support backdoors, but instead supports using hacking/malware to spy on terrorists (which is a better solution all around, though it raises some other issues).

The email thread starts off with lawyer and Clinton (and former Obama) advisor Sara Solow first highlighting the flip-floppy nature of Clinton's comments, and then followed it up by noting that the "flop" side of (supporting backdooring encryption) is "impossible":

She basically said no mandatory back doors last night ("I would not want to go to that point"). In the next paragraph she then said some not-so-great stuff -- about there having to be "some way" to "break into" encrypted content-- but then she again said "a backdoor may be the wrong door."

Please let us know what you hear from your folks. I would think they would be happy -- she's certainly NOT calling for the backdoor now -- although she does then appear to believe there is "some way" to do the impossible.

Teddy Goff, a political strategist and the digital director for Obama for America during the 2012 campaign, responds, calling it "a solid B/B+" and suggests that someone tell Clinton never to use the Manhattan Project line again. He also highlights the point that Ben Scott had raised a month earlier, and that it was clear that Clinton did not understand, that there is open source encryption out there that anyone can use already, and any attempt to backdoor proprietary encryption won't stop anyone from using those other solutions. Finally, he suggests that having "pledged not to mandate backdoors" will be useful going forward.

i think it was fine, a solid B/B+. john tells me that he has actually heard nice things from friends of ours in SV, which is rare! i do think that "i would not want to go to that point" got overshadowed in some circles by the "some way to break in" thing -- which does seem to portend some sort of mandate or other anti-encryption policy, and also reinforces the the ideological gap -- and then, more atmospherically, by the manhattan project analogy (which we truly, truly should not make ever again -- can we work on pressing that point somehow?) and the cringe-y "i don't understand all the technology" line, which i also think does not help and we should avoid saying going forward.

speaking of not understanding the technology, there is a critical technical point which our current language around encryption makes plain she isn't aware of. open-source unencrypted messaging technologies are in the public domain. there is literally no way to put that genie back in the bottle. so we can try to compel a whatsapp to unencrypt, but that may only have the effect of pushing terrorists onto emergent encrypted platforms.

i do think going forward it will be helpful to be able to refer to her having pledged not to mandate a backdoor as president. but we've got to iron out the rest of the message. i actually do believe there is a way to thread the needle here, which i am happy to discuss; it requires us to quickly pivot from encryption to the broader issue of working with tech companies to detect and stop these people, and not getting into the weeds of which app they happen to use and that sort of thing.

Finally, Solow responds to Goff agreeing that the "some way in" line implies undermining encryption, but suggests that they quietly let the tech world know that they don't mean backdoors, but just mean hacking/malware:

That she says no backdoor, which is good, but then says we need a way in, and then the bad line about not understanding technology. The latter two points make the first one seem vulnerable.

But in terms of wanting a way to break in - couldn't we tell tech off the record that she had in mind the malware/key strokes idea (insert malware into a device that you know is a target, to capture keystrokes before they are encrypted). Or that she had in mind really super code breaking by the NSA. But not the backdoor per se?

There are some obvious concerns with the hacking/malware stuff, but it's at a very different level than breaking encryption. While it's still ridiculous that Clinton won't just come out and say that backdooring encryption gives us both less security and less privacy, it does appear that she has people on her team who get the basics here. That's at least moderately encouraging. It would be better if there were some stronger indication that Clinton is actually listening to them.

Filed Under: backdoors, crypto wars, encryption, going dark, hillary clinton, manhattan project, nerd harder

Former Homeland Security Advisor: Tech Companies Have The Burden Of Proving Harm Of Backdoored Encryption

from the FORTUNES-READ-AND-IGNORED---$5 dept

Last week's one-sided "hearing" on encryption -- hosted by an irritated John McCain, who kept interrupting things to complain that Apple hadn't showed up to field false accusations and his general disdain -- presented three sides of the same coin. Manhattan DA Cyrus Vance again argued that the only way through this supposed impasse was legislation forcing companies to decrypt communications for the government. The other two offering testimony were former Homeland Security Advisor Ken Wainstein and former NSA Deputy Director Chris Inglis.

Not much was said in defense of protections for cellphone users. Much was made of the supposed wrongness of law enforcement not being able to access content and communications presumed to be full of culpatory evidence.

But one of the more surprising assertions was delivered by a former government official. Wainstein's testimony [PDF] -- like Vance's -- suggested the government and phone makers start "working together." "Working together" is nothing more than a euphemism for "make heavy concessions to the government and prepare to deliver the impossible," as Patrick Tucker of Defense One points out. Wainstein says phone manufacturers must do more than theorize that weakened encryption would harm them or their companies. They must hand over "hard data" on things that haven't happened yet.

Kenneth L. Wainstein, a former assistant attorney general for national security at the Department of Justice, told lawmakers that the burden is on technology companies and privacy advocates to show how backdoors would harm user security, rather than on law enforcement to prove that altering the encryption scheme would be safe.

“For the tech industry and civil liberties groups, this means laying out technically specific support for the contention that a government accommodation would undermine the integrity of default encryption. They should provide hard data that demonstrates exactly how—and how much—each possible type of accommodation would impact their encryption systems. It is only when Congress receives that data that it can knowledgeably perform its deliberative function and balance the potential cybersecurity dangers posed by a government accommodation against the national security and law enforcement benefits of having such an accommodation in place,” he said.

The only thing harder than proving a negative is proving how badly things might go if backdoors are inserted or companies are required to retain encryption keys.

As usual, the "smart guys" are ahead of the curve on this bizarre demand. Last year, multiple encryption experts collaborated on a research paper [PDF] that laid out the problems that would result from government-mandated access.

In this report, a group of computer scientists and security experts, many of whom participated in a 1997 study of these same topics, has convened to explore the likely effects of imposing extraordinary access mandates. We have found that the damage that could be caused by law enforcement exceptional access requirements would be even greater today than it would have been 20 years ago. In the wake of the growing economic and social cost of the fundamental insecurity of today's Internet environment, any proposals that alter the security dynamics online should be approached with caution. Exceptional access would force Internet system developers to reverse forward secrecy design practices that seek to minimize the impact on user privacy when systems are breached. The complexity of today's Internet environment, with millions of apps and globally connected services, means that new law enforcement requirements are likely to introduce unanticipated, hard to detect security flaws.

So, if Wanstein is looking for answers, he already has them. So does James Comey. So does Cyrus Vance. (Although, to be fair, Vance hasn't really feigned much concern for tech companies or their customers.) They just don't like the answers they've received. This is why they continue to claim that a perfectly safe, government-mandated encryption backdoor is just a "smart guy" breakthrough away. Any day now, someone at Apple or Google will shout "Eureka" and hand over the unicorn Comey, et al insist must exist.

Filed Under: chris inglis, crypto wars, cy vance, encryption, homeland security, john mccain, ken wainstein

Michael Bloomberg Comes Down On The Wrong Side Of The Crypto Wars: Supports Backdooring Encryption

from the you're-wrong dept

This is perhaps not surprising, but still disappointing. Former NYC mayor and current billionaire media/tech company boss Michael Bloomberg has come down on the wrong side of the "going dark" encryption fight. In a Wall Street Journal op-ed (possible paywall link) he scolds tech execs for daring to side with Apple over the FBI and the Justice Department on the question of backdooring encryption. Bloomberg does not appear to actually understand the issues at play.

The fireworks and parades this weekend will give Americans a chance to celebrate the nation’s independence from England and show their love of country. But true patriotism involves more than flying the flag—and more than paying taxes and casting ballots. It requires putting America’s needs above individual interests when national security and public safety are at stake.

Generations of Americans have honored that principle, risking their lives to preserve a nation “conceived in Liberty,” as Lincoln remarked in his Gettysburg Address, “and dedicated to the proposition that all men are created equal.” Today, 1.3 million men and women serve in the military on active duty, often in dangerous situations overseas. Yet here at home, some executives in an industry that thrives on freedom—technology—are resisting government efforts to safeguard it. They are dangerously wrong.

Note the false framing here. Bloomberg is setting up the argument that backdooring encryption for the sake of the FBI/DOJ is "good for national security and public safety." He's wrong. It's not. It's not even close. It actually puts many more people at risk, because the only way to backdoor encryption effectively is to break that encryption and put everyone who uses it at much more risk. Yes, it means that the FBI/NSA won't be able to track some people, but it's a very small number of people, and they have other ways to track them without undermining the security of everyone else.

The freedom that Americans enjoy requires shared sacrifices, and not only by soldiers. “We the people” impose limits on our personal liberty to protect ourselves and those around us. We are free to speak our minds, but we cannot yell “Fire!” in a crowded theater. We are free to travel without restriction, but driving a vehicle requires a license, and boarding a plane requires official identification. We are free to smoke tobacco, but today in most states we cannot do so indoors.

This is also dangerously wrong. We've discussed this many times before, but the lame "we cannot yell fire in a crowded theater" line is simply incorrect. It's based on an ignorance of the actual law in that space (the court case where this statement was made is no longer the accepted standard under the law). It's also just a weak excuse for someone who is about to strip away other rights. It's basically a warning sign of someone who doesn't have a strong argument for why they want to strip away rights, so they'll make a misleading and incorrect statement claiming that you can't yell fire in a crowded theater (even though, in most cases, you actually can).

We also limit our right to privacy. The Fourth Amendment protects against “unreasonable searches and seizures,” but it also explicitly authorizes warrants based on probable cause. Every day, judges approve warrants authorizing searches of homes, cars and computers. Even our bodies can be subject to search warrants, as drunken-driving suspects learn when they attempt to refuse a blood test. Those suspected of other crimes may have their calls tapped and mail opened—all with the safeguard of an independent judiciary certifying the public need, to protect both our liberty and safety.

This is an especially intellectually dishonest move. He goes from "fire in a theater" to arguing that we already "limit our right to privacy" because judges issue warrants. But this is different. The 4th Amendment directly includes the warrant exception, unlike the First Amendment which includes no exception. And, really, many people question a lot of things that Bloomberg finds acceptable violations of privacy. That's not a huge surprise though. After all, as mayor, Bloomberg was a major supporter of the unconstitutional stop and frisk program that the police used under his watch... until a court threw it out. Of course, he also was against any transparency of his own administration or of the NYPD.

When Apple refused to unlock a cellphone used by one of the San Bernardino terrorists (and owned by his public employer), many in the tech industry came to the company’s defense. They argued, in effect, that they shouldn’t be forced to cooperate with a search warrant for one of their products, even though failure to comply could put more innocent lives at risk. Thankfully, the government was able to unlock the phone on its own. But next time, the public may not be so lucky. Imagine if the government is in possession of a cellphone that it has reason to believe contains information about an imminent hijacking—or an effort to detonate a dirty bomb. Should we allow the manufacturer to refuse a court order to unlock it?

This, again, totally misrepresents the situation. The issue was not the court order to unlock, but the fact that based on the encryption used on the phone, the only way to "unlock" it was to create a revamped operating system that undermined a number of key security features -- which would likely create much more risks for everyone. This was not a question of just turning a key as Bloomberg implies. The issue was not whether the government could just force a company to "unlock" an encrypted phone, but rather whether or not it could force them to build technology that deliberately undermines security.

And, really, this stupid game of "but what about the next time..." is ridiculous. THERE IS ALWAYS SECRET INFO THAT LAW ENFORCEMENT DOESN'T KNOW ABOUT. And it's not the end of the world. There is information in people's heads. There is information that they already destroyed. And somehow, law enforcement survives. The fact that some information may get scrambled by encryption is like that other kind of info. It's not the end of the world. In fact, we deliberately designed our legal system with the recognition that law enforcement does not have an automatic right to every bit of information.

Of course not. We are a nation of laws, and no industry is above them. The Constitution doesn’t carve out an exception for tech companies.

This is the most frustrating line in the article, because it's complete bullshit. No one is arguing they're above the law. Exactly the opposite. They're questioning whether or not having a valid warrant would then require tech companies to construct a new tool to deliberately undermine security. Being "above the law" is doing things like deliberately hiding documents and emails from the public despite being legally required to reveal them. Being above the law is doing things like refusing to accept a decision of the City Council against your unconstitutional policies. Those were things that Mayor Bloomberg did. What the tech companies are doing is not above the law at all.

Yet Apple responded to the investigation with a troubling announcement: In the future, phones will be designed to prevent even Apple from opening them, just as the makers of some messaging services have already done. Such a move would be an unprecedented rejection of public authority and a potentially catastrophic blow to public safety. The prospect of criminals and terrorists communicating with phones beyond the reach of government search warrants should send a shiver down the spine of every citizen.

This is again a misrepresentation of reality. Apple had already said that the phones would be designed that way well before this investigation. And the reason they did so was not to "reject public authority," but rather because it's a better way to protect public safety. Don't ask me, ask the NYPD who used to go around telling people to encrypt their phones to make them less appealing to thieves, who steal thousands upon thousands of those devices all the time, often seeking to get the info that's on the devices.

Google, Facebook, Snapchat and WhatsApp are all working to increase encryption in ways that will make it impossible for the courts and law-enforcement officials to obtain their users’ data. They argue that if they are forced to comply with government requests for data, terrorists will simply choose open-source encryption apps instead. But lone wolves are not always that sophisticated. Those that are may have no regard for investigations following their death. And for those that do want to cover their tracks: Why should we help them?

Again, the efforts they're making are not to keep law enforcement out, they're to keep criminals out. It's about protecting the public. And, as for "lone wolves" not always being "that sophisticated," that's exactly why this shouldn't be a huge concern. Because as we've noted time and time again, unless you're really good, you're probably going to make a mistake when you try to encrypt stuff, and you'll leak out plenty of info for law enforcement. So if they're really not that sophisticated, none of this is actually a problem.

It’s true that encryption may make it harder for repressive regimes to crack down on dissent, but it also makes it harder for democratic societies to protect themselves against terrorists and criminals. We can work to undermine repressive regimes in ways that do not compromise our own safety, and we should expect tech leaders to help lead the way.

Again, this is misrepresenting why encryption is so important. It DOES NOT make it harder for democratic societies to protect themselves against terrorists or criminals. It does the exact opposite, by providing the tools for people to better protect themselves against both of those things.

It’s worth remembering that the U.S. taxpayers, beginning under President Eisenhower, funded the R&D that led to the development of the internet and other technological advances without which these companies would not exist. And while many of them claim to be concerned about their customers’ privacy, let’s also remember that many turn around and sell their customers’ personal information to advertisers. If anyone thinks they are more concerned about privacy than profits, I have a bridge to sell you.

Again, this is not the actual argument. Bloomberg is throwing out so many strawmen, you'd think that they were on clearance. The fact that the government helped fund the development of some of these technologies is kind of irrelevant. It also helped fund plenty of research into encryption as well. So what? That doesn't mean we should undermine it all and make us all less safe. And, the whole "but companies sell your info to advertisers" point is a complete red herring. Having stronger encryption actually gives individuals more ability to take control over their own info and prevent that kind of thing. Sure, companies are mostly interested in their own profits, as, I assume, is Bloomberg's own company. But that's why they're building better encryption as well. Because they know that making their customers safer and keeping them from having devices stolen or hacked creates a better product.

When America entered World War I, Thomas Edison devoted most of his time to naval research. His work led to various military inventions and improvements, including instruments to detect torpedoes. It is perhaps too idealistic to expect Silicon Valley’s best minds to give up their jobs to serve the government in the fight against terrorism. But a little cooperation shouldn’t be too much to ask.

Lots of people in Silicon Valley are proactively helping in the fight against terrorism. It's complete bullshit to argue that because we think that working encryption is necessary, people are refusing to help the government. The whole point is that breaking encryption doesn't help stop terrorism. It doesn't help stop crime. It puts us all at more risk.

It's too bad Bloomberg doesn't have anyone working for him who could have explained this to him before he sounded off so ignorantly in the WSJ. But, really, if Bloomberg thinks that tech companies need to build compromised, backdoored encryption, here's a solution: he can put some of his billions towards building just such a product, and see what the market thinks of it. If he's right and this is what the public needs to be safe, won't he be making tons of profits? After all, where else is he getting that bridge he wants to sell us...

Filed Under: backdoors, crypto wars, encryption, michael bloomberg, security, silicon valley, technology

If You Want To Know How Supporting Techdirt Can Help Shift The Debate In Washington DC, Read This

from the important-stuff dept

Wondering if coverage like ours can really make a difference? In 2014, former Senate staffer Jennifer Hoelzer sent us this unsolicited piece about Techdirt's influence on lawmakers in the SOPA fight. With today's encryption debate now shifting back to Congress, she's given us her support in republishing the story (with a few minor edits) to drive that point home. If you want quantitative data to go with her anecdotal experience, you can see this Harvard study that highlighted Techdirt's influence in that debate. Please help us do the same for the fight over encryption as well.

Help Techdirt Make Sure Congress Doesn't Sell Out Our Privacy & Security

Hi. My name is Jen... and I was once a Congressional staffer who knew so little about Internet policy that I had no idea how little I knew about Internet policy. (I think this is where you're supposed to supportively say, "Hi, Jen," and reassure me that this is a safe space for me to continue my embarrassing confession. Because it gets worse.)

In late 2010, when my former boss -- U.S. Senator Ron Wyden -- announced that he was putting a hold on the Combating Online Infringement and Counterfeits Act (COICA) – the predecessor to PIPA and later, SOPA -- I not only didn't know how the DNS system worked, I'm not sure I knew what infringement meant. (I'm not proud of these things, but they're true.)

If my boss hadn't involved himself in this issue, odds are I would never have heard of it and, heck, if by some chance I had learned that the Judiciary Committee had unanimously passed legislation giving law enforcement (what their press release called) "important tools" to go after illegal activity, I probably wouldn't have given the issue any thought beyond thinking it was nice that Democrats and Republicans remembered how to work together.

Worse yet, when my chief of staff stopped by my office to let me know that the Senator would be placing a hold on the legislation, I didn't drop what I was doing to alert reporters or ask one of my deputies to pound out a press release. I'm not sure I even looked up from my computer.

Honestly, it didn't occur to me that anyone would consider what my boss did that afternoon news, until I got a Google News Alert that a blog called, Techdirt, had written about it.

Now, in my defense, the above does not mean that I was lazy or willfully ignorant. From the outside, I realize Congress doesn't appear to do anything, but there are so many bills and issues swirling around Capitol Hill at any one time that it's a challenge just to stay on top of the sliver of them that pertains to your job. On an average day, Senator Wyden could go from a breakfast forum on health reform, to a committee hearing on tax reform, to introducing legislation on renewable energy, to questioning the forest service on resources for firefighting, before giving a floor speech on NSA surveillance, and that would just be before noon. So, the odds of my being on top of something that happened in a Committee my boss wasn't assigned to -- like the Judiciary Committee -- were slim.

Furthermore, my deputies and I -- as Wyden's communications director -- could barely keep up with all of the questions and requests we got from reporters. We didn't have the time or resources to tweet about everything he did, let alone proactively promote all of his work. I mean, just writing and distributing a press release can take a few hours, coming up with a messaging strategy, educating reporters, planning events and writing the various one-pagers, FAQs, op-eds and speeches needed to support a successful advocacy campaign can take days, weeks, even months and that's if nothing else is going on (which is rarely the case).

The day Senator Wyden put a hold on COICA, was the same day he introduced legislation to amend the Affordable Care Act with Senator Scott Brown. I was getting inundated with questions from reporters and bloggers wanting to understand "why in the hell he'd do such a thing," plus the Democratic caucus wanted us to put out and promote a statement pushing for the repeal of Don't Ask Don't Tell, which had my deputy tied up, in addition to the various other things that tended to make the end of session a sprint.

I didn't jump at the opportunity to publicize my boss's hold announcement, because I didn't know enough about the issue to judge its news value, let alone explain it to reporters or write a quick press release, and I didn't have the time to learn enough about it to do any of those things before the end of the day. So, I told my chief of staff "great" and went back to talking to reporters about health policy.

Again, I'm not proud of the above story, but I was moved to share it, when I read that Techdirt's coverage of the COICA/PIPA/SOPA debate ultimately cost them more than 50% of their advertising revenue and has since forced them to operate at a loss.

I don't want to imagine a tech debate without Techdirt in it.

I can't even begin to imagine how the COICA/PIPA/SOPA debate would have gone without Mike Masnick and Techdirt's coverage.

But I can imagine where I -- personally -- would have been without Techdirt's coverage. All I have to do is close my eyes and remember November 18, 2010. Now, as much as I'd like to tell you that Mike's November post on Ron Wyden's COICA hold changed everything for me, it didn't. One post couldn't make me an expert on Internet issues any more than a single story could have won the debate. But I can say the more I learned about the issues surrounding COICA and later PIPA and SOPA – and the more confident I grew in my knowledge and ability to explain those issues -- the more involved I got, the more press releases, speeches, FAQ's and blogs I wrote in support of Ron's work, the more reporters I talked to, coverage I influenced, and interviews I secured for the senator.

I can also say, I wouldn't have been able to do any of those things (at least not well) without Mike Masnick and the rest of the guys at Techdirt, because they're the guys who taught me tech policy.

That's not to say, I didn't work with really smart people who taught me a lot, I did and they did; but with Techdirt, I never had to ask a stupid question or admit what I didn't know. (I just kept reading.) Techdirt's posts were consistently straightforward, easy to understand and timely. Sure, another site might put together one or two good posts or a definitive explainer, but reading Techdirt every day was like taking a college course on the issues with every new post helping me understand a new aspect of what I'd learned previously. I often found some of the site's shorter posts and illustrative examples the most helpful, because they were the examples I ultimately used to explain the issues to others. For example, I've yet to find a better way to get someone to see the potential harm bills like SOPA and PIPA can do to free speech than pointing out that Universal once tried to blacklist 50 Cent's personal website, a fact I learned from a 6/21/11 Techdirt post, entitled "Did Universal Music Declare 50 Cent's Own Website A Pirate Site?" (Seriously, that story alone helped me convince at least a dozen – non-tech – reporters to write about the issue, not to mention all of the Hill staffers I shared it with.)

If you care about your privacy and security, you want Techdirt to be at full strength in the encryption debate. You want them to be educating more lawmakers and their staffers (like my former self) to understand these issues and be confident enough in their knowledge to take a stand against invasive government.

I'm donating to Techdirt's campaign because I know where I would have been without their work and I don't want a tech debate to take place without them. I hope you will do the same. It's also a great way to say thanks.

Help Techdirt Make Sure Congress Doesn't Sell Out Our Privacy & Security

Filed Under: all writs act, congress, crypto wars, education, encryption, washington dc
Companies: apple

EFF Director Cindy Cohn On Why You Should Support Techdirt's Encryption Crowdfunding Campaign

from the it's-important dept

With our ongoing crowdfunding campaign concerning our coverage of the encryption fight, EFF Executive Director Cindy Cohn kindly offered to write a plea on our behalf as to why you should fund our efforts.

Help Techdirt Cut Through The Confusion In The Crypto Fight
Techdirt is a key part of the digital revolution. They cover our work at EFF, of course, but more importantly, their original reporting and in-depth research help us nail down facts across our issues, and their analysis is strong. The clear way in which Techdirt's reporters lay out both technical and non-technical aspects of their stories provides an example for everyone looking to speak to many audiences at once.

I was so happy to hear that Techdirt is planning to gear up its coverage of the current fight to protect strong security and privacy in our digital world. We sometimes call this Crypto Wars Part Deux here at EFF. The FBI's efforts to undermine and compromise the tools we all increasingly rely upon and trust with our most intimate communications, information and plans create risks us all. EFF has been down this road before. We were leaders in the first Crypto Wars in the 1990s; I personally handled the Bernstein v. DOJ case that first freed encryption from government export controls and established that the First Amendment applied to the act of writing code. We thought we won that battle, but the FBI is back again (and the NSA apparently continued all along) seeking in various ways to undermine our security. We've stepped up again to protect our privacy and push for the common sense notion that we need to be able to trust the digital tools that hold, carry and store an increasing amount of our most sensitive information.

I was excited to have Techdirt focus on this because of Techdirt's long track record of trustworthy reporting. Techdirt's coverage of copyright issues, for instance, has resonated with musicians and technologists alike. During the height of the battle over music file sharing, Techdirt picked apart music industry "solutions" to show they weren't as attractive as they may have sounded. Nor is Techdirt afraid to take a stand. On top of their informative reporting on the Cyber Intelligence Sharing and Protection Act of 2011 (CISPA), Techdirt actively participated in a coalition, along with EFF, that organized a massive Twitter protest campaign against the privacy-invasive bill. Already, as the debate over iPhone security has brought encryption to broad public attention, Techdirt has done amazing work separating what people are saying from what their words actually mean, as well as providing the underlying legal documents so people can read them for themselves.

This time around the issues surrounding encryption are much bigger than they were 20 years ago and reach far beyond the technical community. More than ever we need media and analysis that won't be confused or misled, that will follow stories past the headlines and scare tactics and that will help the much wider range of people affected by this debate understand what's at stake. Luckily, Techdirt is up for the task and all they need is a little help from their audience to get there. I hope you will help.

Help Techdirt Cut Through The Confusion In The Crypto Fight

Filed Under: crowdfunding, crypto wars, encryption, techdirt