Hollywood Is Betting On Filtering Mandates, But Working Copyright Algorithms Simply Don't Exist

from the hello-1st-amendment dept

Facebook whistleblower Frances Haugen may not have mentioned copyright in her Congressional testimony or television interviews, but her focus on artificial intelligence (“AI”) and content moderation have a lot of implications for online copyright issues. 

For the last decade, Hollywood, the music industry and others have been pushing for more technical solutions for online copyright infringement. One of the biggest asks is for Internet companies to “nerd harder” and figure out algorithms that can identify and remove infringing content. They claim content filters are the solution, and they want the law to force that onto companies.

And they have been successful in parts of the world so far. For example, the recent European Union Copyright Directive placed a filtering mandate on internet platforms. Hollywood and the record labels are pushing the U.S. to follow suit and make platforms liable for copyright infringement by users. They want NIST to develop standards for filtering software, and they are using the power of Congress and the U.S. Copyright Office to push for legislation and/or voluntary agreements to create more filters. 

There is one huge problem with all of this: the technology does not exist to do this accurately. What the Facebook whistleblower made clear is that even the most sophisticated AI-based algorithms cannot accurately moderate content. They make tons of mistakes. Haugen even suggested that a huge part of the challenge is the belief that “nerding harder” will work. She blamed Facebook’s mantra to solve problems through technology as the main reason they are struggling with content moderation. 

Copyright presents a unique context challenge to algorithms. It’s not easy to automatically determine what is copyright infringement and what is not. Even under today’s existing systems, about a third of takedown requests are potentially problematic, requiring further analysis. Most of these erroneous takedowns are done by algorithms. This analysis can be extremely complicated even for the American judicial system – so much so that the Supreme Court recently had to clarify how to apply the four-part fair use test. In court, each fair use case gets a very individual, fact-based analysis. Current AI-based algorithms are not close to being able to do the needed analysis to determine copyright infringement in fair use cases. 

So why is there a big push from Hollywood, the movie industry and others on this? They are smart enough to know that algorithmic solutions are not close and may never be able to handle filtering for infringement accurately. 

The reason is they do not want filtering technologies to be accurate. They want filtering technologies to over-correct and take anything that might be infringing off the internet. Congress cannot directly legislate such an overcorrection, because it is a clear violation of the First Amendment. But they might be able to introduce legislation that creates a de facto mandatory filtering requirement. Mandatory filtering legislation imposed via changing the Digital Millennium Copyright Act Section 512’s platform liability regime would lead companies to “voluntarily” implement over-correcting filtering solutions — or otherwise face a constant barrage of losing lawsuits and legal bills for any and all alleged infringement by users. And this could create an end run around the first amendment if a court decided that the company was “voluntarily” implementing. 

At this point it is important to recognize the types of activity that we are talking about here: transformative works of creativity, pop-art, criticism and parody. This includes teens sharing lip sync TikToks and videos of your little kids dancing to a song. But fair use doesn’t apply to just the creative arts. It also includes collaborative efforts on an internet platform to develop cybersecurity solutions that require reverse engineering and allows teachers to share materials with students on online education platforms. Documentarians depend heavily on fair use, and efforts to distribute documentaries online would face stiff challenges. 

All of these important capabilities would be severely at risk if we forced filtering requirements onto internet platforms via threat of liability. If we let Hollywood and music industry elites and the Members of Congress who do their bidding get their way, the rest of America will lose out.

Josh Lamel is the Executive Director of the Re:Create Coalition. This article was originally posted to the Re:Create Coalition blog.

Filed Under: ai, copyright, dmca, dmca 512, filters, hollywood, mandates

Is Mandated Sideloading The Answer To App Store Deplatforming?

from the breaking-the-walled-gardens dept

Smartphone app store policies have come into focus recently, following a series of recent conflicts between app makers and app store operators (principally Apple and Google). These include the removal of conservative-oriented social media platforms Parler and Gab, and the ensuing debate about balancing free speech and harmful content. There have also been numerous conflicts over monetization, including disputes over transaction fees for digital goods and services (e.g. Epic Games), and privacy changes that affect third party advertisers (e.g. Facebook).

With scrutiny of the tech industry at an all time high, the otherwise niche issue of app store policies has become an increasingly salient part of the broader debate over digital market competition, raising the specter of new government regulation. But what is the optimal level of openness in a competitive app ecosystem, and how does public policy help achieve it? These are harder questions to answer than they seem—involving deep technical, economic, and legal issues.

A Tale of Two Smartphone Operating Systems

According to Statcounter, the global mobile operating system market is dominated by Google’s Android operating system (72% market share), followed by Apple’s iOS (27% market share). Despite having a substantially smaller user base, the Apple App Store earns substantially more direct revenue than the Google Play Store. But this is misleading at first glance.

First, there are important demographic differences. iPhone owners are more concentrated in developed nations, and even in those countries tend to be more affluent and spend more on apps. Their business models are also different. Unlike Apple, which has limited advertising offerings, Google earns substantial revenues through mobile advertising, and even pays Apple billions each year for the privilege to be its default search engine to expand the revenues it can capture. They are also designed in fundamentally different ways. Whereas iOS is a proprietary closed system, Android is (mostly) open source. Notably, there are versions of Android without Google Play or other Google services, particularly in mainland China where it doesn’t operate. Apple, on the other hand, operates the App Store on all iOS devices; and unlike Google, does business in the lucrative mainland China market.

As a result of these different architectures, a conspicuous difference between Android and iOS is that the former allows the installation of apps outside of its Play Store. This can be either through a pre-installed third party app store that ships with the device (e.g. Samsung’s Galaxy Store or the Amazon Appstore), or direct installation of apps or even other app stores, called “sideloading.” Circumventing the Play Store also means that developers can take payments without cutting Google in, typically 30%. Meanwhile, Apple requires users to go through its App Store to download apps, where it takes a similar cut.

Policymakers Respond

Grasping onto this difference, and facing pressure from lobbyists, policymakers in multiple states have proposed new legislation that would force Apple to redesign their operating system to allow circumventing both the App Store and In-App Purchase system (see similar bills in GA, ND, HI, AZ). Notably, a similar provision also exists in the European Commission’s proposed Digital Markets Act.

In theory, this sounds like a good idea. In the wake of recent controversies, many in Silicon Valley have been looking towards decentralization as the answer. Indeed, systems with more openness and interoperability tend to foster innovation and competition, and give users more freedom. The ability to install apps directly could also be an essential workaround when companies remove controversial apps, particularly where they are pressured to do so by activists or governments.

However, there are some good reasons to be wary of rushing to pass such a mandate, both as a substantial fix for digital market competition, and as a precedent for local governments dictating or overseeing software designs—something they’re not known to be particularly competent in.

Trade Offs of a Sideloading Mandate: Cybersecurity and Privacy

Suddenly forcing iOS to allow unvetted apps could introduce a flood of serious cybersecurity vulnerabilities, facilitating everything from spyware to ransomware to identify theft. Such an unanticipated requirement could pose a serious challenge to developers, potentially necessitating years of new work and investment.

A 2019 threat intelligence report from Nokia observed that Android devices were fifty times more likely to be infected than iOS, with the “vast majority” of malware distributed through trojanized sideloaded applications. Because of this risk, Android takes measures to discourage sideloading through user interface mechanisms. Google’s Advanced Protection Program also blocks sideloaded apps for this reason.

Because Android is a more open system than iOS, its privacy and security features are constructed differently. While both operating systems have some form of automated threat detection, app containerization, and other features to limit an app’s access to sensitive systems, these are architected based on different assumptions.

For Apple, a closed-system approach is at the heart of its strategy for iOS. If Apple engineers could no longer count on vetting during the app review process, they may be forced to build new redundancies from scratch, or even redesign major parts of the operating system. Because iOS isn’t open source like Android, it’s hard to tell how much of an architectural challenge this will be.

Apple’s preference for closed systems can be traced to Steve Jobs’ philosophy of end-to-end control of hardware and software, and lack of patience for consumer tinkering, going all the way back to the first Macintosh computer. In 2007, around the launch of the first iPhone, Steve Jobs described applying this thinking to iOS (then “iPhone OS”) in an interview with the New York Times:

You don’t want your phone to be like a PC. The last thing you want is to have loaded three apps on your phone and then you go to make a call and it doesn’t work anymore….These are devices that need to work, and you can’t do that if you load any software on them...That doesn’t mean there’s not going to be software to buy....but it means it has to be more of a controlled environment.

Apple may not give you every option you might want, but it may be a worthwhile tradeoff if your priority is security and privacy, or a seamlessly integrated ecosystem. In recent years Apple’s marketing department has leaned into this as a competitive advantage, and it’s what their customers have come to identify with its brand.

There are also ways out of Apple’s walled garden. The simplest workaround is to access applications directly from a mobile web browser. For instance, if you really want to use Gab, you can create a home screen icon from Safari and access it like an app. Similarly, you can make purchases there without Apple taking a cut. There are, of course, limitations to what you can do in a mobile browser (notably third party browsers are required to use Apple’s WebKit rendering engine and, as with other parts of iOS, Apple reserves some private API functions for itself).

In the US, determined users can legally jailbreak iOS devices to sideload apps without requiring too much technical skill (here’s a handy guide). This works on most Apple devices, after which users can install a range of unauthorized apps and even app stores. But caveat emptor. Unauthorized app stores don’t do much of anything to combat malware. There are other downsides of jailbreaking, including making it much harder to update software, having certain apps break, and potentially voiding your warranty. Notably, Apple has also argued for making jailbreaking illegal.

For those that don’t want to jailbreak their device, there’s also the option to sideload apps from your computer to iOS directly through a known exploit, or through developer environments like Xcode and Testflight. With this approach you can still access third party app stores, such as AltStore or AppValley, albeit with more limitations than jailbreaking. Importantly, installing unauthorized apps through these methods can still expose you to malware.

In short, it’s not *that* hard to circumvent Apple’s restrictions on unauthorized apps if you really want to. Particularly if you’re doing something simple like trying to access an alternative to Twitter that isn’t in the App Store. But if you decide to go all the way and jailbreak your phone, you might be wise to use your banking app on a different device.

Good Reasons to Limit Local Government Control of Digital Markets

There are good reasons to be wary of governments dictating and implementing software design requirements—particularly at the state and local level. As I’ve discussed at length elsewhere, both Congress and federal agencies face serious capacity gaps for in-house policy expertise—particularly for science and technology issues. Yet, relative to states, they have a wealth of competence.

According to the National Conference of State Legislatures, only 4-10 states have legislative bodies that can be considered full-time, well-paid, and sufficiently staffed. Many states have part-time legislatures where lawmakers work other jobs and are supported by a skeleton crew of staff. Whereas Congress is assisted by thousands of support staff at legislative agencies—including the Government Accountability, Congressional Research Service, and Congressional Budget Office—legislative support agencies in the states vary widely in staffing, resources, and services offered, and generally pale in comparison. For instance, while CRS has over 600 staff with expertise in different policy areas, Arizona’s service agency has only five staff, and is also in charge of fixing the computers. State regulatory agencies likewise vary in quality, staffing, and technical competence.

Given the cross-jurisdictional nature of digital commerce, it’s less than ideal to have a patchwork of state regulations, or to allow a single jurisdiction to dictate policies for everyone (as we’ve seen with California’s costly and error-filled privacy laws). As such, if we’re truly set on creating and implementing a mandate for app store interoperability, it would be best to leave this to Congress and federal regulators.

Conclusion

Questions of interoperability policy are tricky, involving a range of tradeoffs and technical challenges. As policymakers approach these issues, regulatory humility is warranted. While iOS is almost certainly below the optimal level of openness, it’s also worth remembering that Android phones are readily available and consumers are free to choose them.

Furthermore, it’s unclear that a sideloading mandate would dramatically change the competition landscape. Even on Android, few users in the US take advantage of sideloading. Nor has the availability of this option pushed down their ~30% Play Store transaction fees. Even in the market for PC software, where users can download anything from the Internet, popular stores like Steam and GoG still charge app developers around 30%. Although some are lower, like Epic Games (12%) and Microsoft (15%), large stores clearly add value (such as through vetting and aggregation) and are not just exploiting a captive market.

Enacting a sideloading mandate to allow Parler or Gab, as some Republican policymakers may want, also isn’t a compelling argument. These sites don’t require complex API access, and it’s easy enough to access them through a mobile browser. But that’s not to say the underlying concern about speech restrictions on closed platforms isn’t legitimate in some circumstances.

Our system of government’s respect for free speech and the rule of law makes it so US policymakers have a limited ability to coerce companies like Apple and Google to take down apps. But this isn’t true everywhere. And this debate isn’t just about US consumers. For instance, Google’s transparency report indicates they complied with removal requests in Russia and Thailand for apps engaged in “government criticism.” Similarly, Apple’s transparency report shows governments, including China, have pressured or required the company to remove numerous apps. And mobile browsers aren’t safe. In some parts of the world, product design choices have implications for human rights, and for helping empower people to resist oppressive governments. 

Going back to the US, it’s not clear the sideloading mandate some states have proposed makes sense, either in theory, or how it would likely turn out in practice. Dramatic interventions in the market—such as dictating and overseeing software designs—should meet a substantial burden of proof to demonstrate their necessity and consistency with American principles governance. It’s not clear that the proponents of these proposals have overcome this burden.

But there’s also a normative question: Should Apple voluntarily embrace interoperability for iOS and allow third party app stores, alternative payment systems, and sideloading?

First, we have to consider the potential downsides. They could lose out on revenue from big apps like Fornite that can leverage alternative distribution channels, they would likely have to invest in architectural changes to their operating system, and it could weaken their reputation for security and reliability (e.g. devices your grandparents can use without accidentally downloading a virus). 

But smartphones have made a lot of progress since Steve Jobs expressed concerns about reliability and user experience in making the first iPhone in 2007. While sideloading still poses serious security risks, Android has demonstrated that it can be implemented as an option for advanced users, without compromising reliability for everyone else. Despite Android being more open, the Play Store still brings in a lot of revenue for Google, even without factoring advertising. If Apple were to move iOS towards being more open, it could also have benefits for diffusing criticism of the company, particularly as it expands its business in China and other repressive countries.

Today our phones are handling increasingly sensitive information—including our banking, identification, and health records. This makes them a valuable target for bad actors, and so it’s easy to see why many people would choose security over openness. But this can be a false dichotomy. If products are built with the right assumptions, we can have a high degree of both. This doesn’t mean risks go away; merely that users are allowed to make an informed decision to cross the guard rails and take them on.

Those interested in constructive ways to support a more open app ecosystem should also look to Cory Doctorow’s writings on “adversarial interoperability” at the Electronic Frontier Foundation. This concept outlines a series of mechanisms that support permissionless competition through reforming overbearing laws like software patents, the Digital Millennium Copyright Act (which governs jailbreaking), and the Computer Fraud and Abuse Act. These changes have the advantage of improving the entire ecosystem, rather than targeting one company, deregulating protectionist policies. Steve Jobs, who first teamed up with Steve Wozniak in the 1970s to sell illegal phone phreaking gear, might even approve.

Filed Under: apps, competition, content moderation, deplatforming, mandates, sideloading
Companies: apple, google

US Senators Unveil Their Attempt To Secure The Internet Of Very Broken Things

from the good-luck-with-that dept

Over the last few years we've documented in painstaking detail how the lack of any real security and privacy standards in "internet of things" devices is leading us down a path to some serious trouble. That shouldn't be particularly surprising if you've paid attention to how your refrigerator can now leak your Gmail credentials, your "smart" thermostat is now vulnerable to ransomeware attacks, your smart car could be hacked in order to kill you, your power outlets can be hacked and used to launch DDOS attacks, or how your vibrator is now busy collecting data on your daily behavior.

There's one root cause: companies that prioritized making a quick buck over implementing anything resembling sane security or privacy standards.

And despite this dysfunction now being the butt of endless jokes, things really haven't changed all that much, since actually giving a damn about the problem would erode profit margins for WiFi-enabled widget makers. The end result is the daily introduction of millions of new attack vectors for both homes and businesses on a global scale. As such, there's more than a few security experts that, no hyperbole intended, believe it's inevitable that this problem will impact core infrastructure leading to significant human casualties.

Given this is a global problem, and many of these companies are Chinese, legislating the problem away via U.S. law is likely going to be a steep uphill climb. That apparently doesn't seem to concern Congress, which this week introduced a new bill they hope will help secure the internet of very broken things:

"The new bill would require vendors that provide internet-connected equipment to the U.S. government to ensure their products are patchable and conform to industry security standards. It would also prohibit vendors from supplying devices that have unchangeable passwords or possess known security vulnerabilities. Republicans Cory Gardner and Steve Daines and Democrats Mark Warner and Ron Wyden are sponsoring the legislation, which was drafted with input from technology experts at the Atlantic Council and Harvard University. A Senate aide who helped write the bill said that companion legislation in the House was expected soon."

While IOT legislation may be well-intentioned, many of these devices (like the security cameras and DVRs that contributed to the historically massive DDOS attack on Dyn last year) are made in China, where manufacturers will laugh off foreign legislative band aids. And while there's very legitimate concerns that legislation crafted by a Luddite Congress could stifle innovation and experimentation in the space, this particular proposal does at least apply some standards to the IOT devices purchased and used by the federal government, injecting at least a layer of sanity and reflection to the rapid expansion of poorly-secured IOT devices.

Security researcher Brian Krebs highlights another good part of the bill, namely the portion that expands legal protections for cyber researchers working in "good faith" to hack equipment to find vulnerabilities so manufacturers can patch previously unknown flaws:

"Those advocates were no doubt involved in shaping other aspects of this legislation, including one that exempts cybersecurity researchers engaging in good-faith research from liability under the Computer Fraud and Abuse Act (CFAA), a dated anti-cybercrime law that many critics say has been abused by government prosecutors and companies to intimidate and silence security researchers. Perhaps the most infamous example of prosecutorial overreach under the CFAA comes in Aaron Swartz, a Harvard research fellow who committed suicide after being hounded by multiple CFAA fraud charges by state and federal prosecutors for downloading a large number of academic journals.

All of that said, the legislation isn't going to do enough to prevent major, looming problems. Between 20 billion and 30 billion "IOT" devices are expected to be connected to the internet by 2020 worldwide. And as Bruce Schneier has noted on occasion, the origins of this market failure begin with an apathetic cycle of dysfunction between both hardware vendors and consumers, something that the market alone has shown it's not capable of -- or seriously interested in -- fixing:

"The market can't fix this because neither the buyer nor the seller cares. The owners of the webcams and DVRs used in the denial-of-service attacks don't care. Their devices were cheap to buy, they still work, and they don't know any of the victims of the attacks. The sellers of those devices don't care: They're now selling newer and better models, and the original buyers only cared about price and features. There is no market solution, because the insecurity is what economists call an externality: It's an effect of the purchasing decision that affects other people. Think of it kind of like invisible pollution."

So while this law may be a start, it's going to take a lot more than U.S.-specific legislation to fix this particular market failure, assuming such laws don't actually manage to make the problem worse. Smart networks, smarter engineers, better routers, better code, and better communications between companies, governments, activists, and other stakeholders are all essential to get ahead of this particular threat. Fixing the internet of broken things requires a massive, over-arching, holistic effort, one that doesn't exist yet, and unfortunately isn't likely to gain serious momentum until after the internet of broken things check comes due.

Filed Under: cfaa, congress, iot, mandates, researchers, security

The Teddy Bear And Toaster Act Is Device Regulation Done Wrong

from the not-the-right-approach dept

Should government to protect us from snooping teddy bears and untrustworthy toasters? The California State Senate seems to think so.

With traditional devices on the decline, laptop and desktop computers now account for less than 25 percent of internet network traffic. Indeed, American households now use, on average, seven connected devices every day. As this so-called “internet of things” continues to expand, an array of connected objects—from toasters to lightbulbs to dishwashers—now include embedded microprocessors, multiplying the number of potential threat vectors for data breaches and cyberattacks.

Notably, security researchers revealed recently that CloudPets, a company that sells connected stuffed animal toys with voice-recording capabilities, had a security vulnerability that leaked the information of more than 500,000 people. In response to accounts like these and concerns about data collection by internet-of-things devices, California is considering S.B. 327, legislation that would require certain security and privacy features for any connected devices sold in the Golden State.

Device insecurity is a real threat and it's encouraging to see legislators thinking about consumer privacy and security. But this bill, facetiously called the “teddy bear and toaster act” by its critics, would create more problems than it solves. These concerns do not merit a heavy-handed and wide-reaching legislative response.

First introduced in February, the bill targets a broad range of products that include “any device, sensor, or other physical object that is capable of connecting to the internet, directly or indirectly, or to another connected device.” It would require that their manufacturers “equip the device with reasonable security features.”

The scope and scale of that definition would appear to cover everything from smartphones to cars to tweet-happy toasters. Sweeping such a broad range of connected devices under its rules ignores that all of these items have unique functions, capabilities, and vulnerabilities. What constitutes a “reasonable security feature” for one might be completely unreasonable for another. This one-size-fits-all regulatory approach threatens to chill innovation, as companies from a host of different sectors expend resources just to make sense of the rules.

Should the bill move forward, we should also expect a range of consumer items will be equipped to blink and buzz and beep in ways more annoying than informative. The bill decrees that: “a manufacturer that sells or offers to sell a connected device in this state shall design the device to indicate through visual, auditory, or other means when it is collecting information.”

For some types of devices—such as virtual and augmented reality systems and autonomous vehicles—this requirement is simply infeasible. These devices use sensors to collect data constantly in order to perform their core functions. For always-on devices like IP security cameras, Amazon Alexa or connected cars, an indicator would just be synonymous with an “on” button. Many of these indicators will be superfluous, misunderstood and costly to implement—costs that disproportionately would hit smaller businesses.

Other provisions of the bill urge sellers of connected devices to notify consumers at checkout where they can find the item's privacy policy and information about security patches and updates. This is valuable information, but the point-of-sale may not be the best time to communicate it. For many devices, a verbal or web-based tutorial likely would be more effective. Companies need the flexibility to figure out the best ways to inform their customers, while these design requirements would remove that flexibility.

In an interconnected world, balancing privacy rights and security is a hugely difficult undertaking. Enshrining that balance in law requires a nuanced and targeted approach. Policymakers at both the state and federal levels should focus their efforts on provable privacy or security harms, while empowering consumers with baseline information, where appropriate. Applying design requirements and compliance tasks in a haphazard way, as S.B. 327 does, will harm innovation without meaningfully improving data security.

Anne Hobson is technology policy fellow with the R Street Institute.

Filed Under: california, iot, mandates, security, teddy bear, toaster

As US Turns Away From Idea Of Backdooring Crypto, David Cameron Has A Problem

from the saber-rattling dept

Last week, Mike wrote about what seems an important shift in US government policy on encryption, as the White House finally recognizes that adding backdoors isn't a sensible option. That leaves a big question mark over what the UK will do, since David Cameron and intelligence officials have been hinting repeatedly that they wanted to undermine encryption in some unspecified way. Just last week, the new head of MI5, the UK's domestic intelligence service, gave the first-ever live media interview by a senior British intelligence official. Asked about the alleged danger of parts of the Internet "going dark", he said:

"It requires the cooperation of the companies who run and provide services over the internet that we all use. It is in no one's interest that terrorists would be able to plot and communicate out of the reach of any authorities with the proper legal power."

That's from The Guardian, and another article there points out that the UK government's strategy of trying to get the big US online services to co-operate now looks in trouble:

If the White House does drop the battle [over backdoors] it will leave Britain with little option but to accept the widespread use of encryption. The UK's ability to directly lobby the big American technology firms is limited, and in a report leaked in June the former British diplomat Sir Nigel Sheinwald said that a new international treaty was the only way to get the co-operation of the companies. Without the support of the White House such a treaty seems unlikely.

Without the co-operation of the tech firms what the UK government can do when facing widespread encryption is limited. In June the Home Office confirmed that, for extreme cases, it was considering inserting "black box" probes into the transatlantic cables, to collect data leaving and entering the UK. But if the communications were encrypted on their way to the US, such collection would have little value.

Of course, a lot depends on the detailed policy adopted by the US government, and whether the US intelligence community manages to exploit any future terrorist attacks to get backdoors on the agenda again. But for the moment, it seems that David Cameron's anti-encryption saber-rattling will remain just that.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: backdoors, david cameron, encryption, going dark, mandates, uk

India's Government Looking At Mandating Backdoors In Encryption

from the selling-out-the-people-for-the-good-of-the-people dept

Here in the US, the FBI really really really wants to be able to let itself in your backdoor if it feels the urge to paw through your personal communications. (Perhaps the FBI's lack of respect for encryption is due to its own unwillingness to encrypt its communications...) Congress isn't pushing this forward and the administration has indicated it won't back an encryption backdoor mandate. Over in Europe, a mixed bag of terrorism-related legislation is going the other way, pushing for "good guys only" holes in encryption, with any negative use by criminals and foreign governments apparently being the price that must be paid to secure whatever liberty still remains once the "securing" is completed.

India's government -- never one to shy away from overreach, censorship or other bad ideas -- similarly sees encryption backdoors as A Good Thing. A draft proposal from India Department of Electronics and Technology, posted by essential government doc stash Public Intelligence, indicates that the government may be looking to mandate a variety of encryption backdoors in the near future.

It starts out with some positive thinking…

The recognition of the need to protect privacy and increase the security of the Internet and associated information systems have resulted in the development of policies that favour the spread of encryption worldwide. The Information Technology Act 2000 provides for prescribing modes or methods for encryption (Section 84A) and for decryption (Section 69). Taking into account the need to protect information assets, international trends and concerns of national security, the cryptographic policy for domestic use supports the broad use of cryptography in ways that facilitates individual / businesses privacy, international economic competitiveness in all sectors including Government.

...before cutting the floor away entirely.

This policy is not applicable to sensitive departments / agencies of the government designated for performing sensitive and strategic roles. This policy is applicable to all Central and State Government Departments (including sensitive Departments / Agencies while performing non-strategic & non-operational role), all statutory organizations, executive bodies, business and commercial establishments, including public sector undertakings and academic institutions and all citizens (including Personnel of Government / Business performing non-official / personal functions).

The "policy" is mandated backdoors -- not for "sensitive" and "strategic" government agencies, but for everyone else, from other government agencies to "all citizens."

The suggested policy splits up the country's population in three groups, with businesses and citizens designated as "B" and "C." The government says, yes, use encryption for better privacy and security... but don't lock us out.

B / C groups (i.e. B2C, C2B Sectors) may use Encryption for storage and communication. Encryption algorithms and key sizes will be prescribed by the Government through Notification from time to time. On demand, the user shall reproduce the same Plain text and encrypted text pairs using the software / hardware used to produce the encrypted text from the given plain text. All information shall be stored by the concerned B / C entity for 90 days from the date of transaction and made available to Law Enforcement Agencies as and when demanded in line with the provisions of the laws of the country. In case of communication with foreign entity, the primary responsibility of providing readable plain-text along with the corresponding Encrypted information shall rest on entity (B or C) located in India.

And any ISP looking to provide service in India -- including those not actually located in India -- is expected to give the government access to encrypted transmissions.

Service Providers located within and outside India, using Encryption technology for providing any type of services in India must enter into an agreement with the Government for providing such services in India. Government will designate an appropriate agency for entering into such an agreement with the Service provider located within and outside India. The users of any group G,B or C taking such services from Service Providers . are also responsible to provide plain text when demanded.

On top of that, creators of encryption products would be required to register with the government and submit to a "security evaluation." Presumably, the evaluation will include discussion of where to best place backdoors and/or involve a handover of Golden Keys.

The proposal also suggests the government take a more active role in the development of "indigenous" encryption products. While not specifically detailed in the draft, one assumes any government-produced, pre-compromised encryption products will make their debut accompanied by mandates requiring use going forward, if not retroactively as well.

For what it's worth, the Indian government is accepting comments on the proposed policy until October 16th. Presumably, the draft will move forward despite any negative feedback, given the country's track record on internet freedom and human rights. Factor in the threat of terrorism, and there's very little chance the government won't find some way to push this through mostly unaltered.

Filed Under: backdoors, encryption, going dark, india, mandates

Having Lost The Debate On Backdooring Encryption, Intelligence Community Plans To Wait Until Next Terrorist Attack

from the this-is-ridiculous dept

We already wrote about the Obama administration considering its options on how to handle the whole "going dark" debate concerning backdooring encryption. The key point in all of that is that there is no chance in hell that backdoors will be mandated by law. The administration recgonizes that's a lost cause. However, within the Washington Post's article that revealed this, there was also a somewhat disturbing argument from the losing side of this battle. The intelligence community seems to be gleefully awaiting the next terrorist event, knowing that it can then reintroduce its push for backdoors:

Although “the legislative environment is very hostile today,” the intelligence community’s top lawyer, Robert S. Litt, said to colleagues in an August e-mail, which was obtained by The Post, “it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.”

There is value, he said, in “keeping our options open for such a situation.”

In other words, Litt admits that his side has lost this battle, but he doesn't want the administration to come out totally against legislation, because, you know, if there's an attack, then maybe the idiots in the public will finally accept the intelligence community shoving backdoors down their throat. After all, such a plan worked out pretty well with the PATRIOT Act, which took a bunch of bad and rejected ideas and rushed them into law. In fact, it's almost amazing that the law enforcement community didn't get backdooring encryption into the PATRIOT Act back in 2001 in the first place...

Either way, given this, it really looks like Litt is hoping for another attack to get through, just so he can better spy on people. Why are these people in positions of power again?

Filed Under: backdoors, encryption, going dark, mandates, nsa, robert litt, surveillance, white house

Stop The NSA's Backdoor: Call Congress Today To Support Key Amendment

from the speak-up-now dept

Last week, we noted that there was an effort underway to introduce an amendment for this week's Defense Appropriations bill in the House that would effectively limit some of the most nefarious aspects of the NSA's ability to spy on Americans via two different types of backdoors: (1) so-called "backdoor searches" on Americans' information collected under Section 702 of the FISA Amendments Act and (2) mandating tech companies build in backdoors to their technology for the NSA to go snooping. The Defense Appropriations bill is expected to hit the House floor sometime soon, under open rules, meaning that the amendment in question won't be blocked by the House Rules Committee, as happens on a variety of other bills.

The amendment has powerful bipartisan backing, sponsored by Reps. James Sensenbrenner, Thomas Massie and Zoe Lofgren, along with co-sponsors Reps. Conyers, Poe, Gabbard, Jordan, O’Rourke, Amash, and Holt. Having Sensenbrenner bring out this amendment is a big deal. This amendment would restore at least one aspect of the USA Freedom Act that was stripped out at the last minute under pressure from the White House. Sensenbrenner sponsoring this bill highlights that he's clearly not satisfied with how his own bill got twisted and watered down from the original, and he's still working to put back in some of the protections that were removed. Conyers is a powerful force on the other side of the aisle, whose support for the USA Freedom Act was seen by some as a signal that the bill was "okay" to vote on. Having both of them support this Amendment suggests that neither were really that satisfied with the bill and felt pressured into supporting it.

While this Amendment doesn't fix everything, it is an important chance for members of Congress to show that they really do support protecting Americans' privacy. But they need to know that. Please contact your Representative today to let them know you want them to support this amendment. The EFF and others have set up a website, ShutTheBackDoor.net, to help you contact your official. Please do so today.

Filed Under: backdoors, defense appropriations, jim sensenbrenner, john conyers, justin amash, mandates, nsa, surveillance, thomas massie, zoe lofgren

USTR Wants 'Trade Promotion Authority' In An Effort To Ram TPP Through Congress With Little Debate

from the so-that's-how-they'll-do-it... dept

While we've noted that the White House and the USTR have insisted that ACTA is not a treaty and does not require Congressional ratification (something that many, many observers believe is wrong), with the followup TPP agreement, there's no question that it's a broad agreement that will require Congressional approval. But, now we know how the USTR is hoping to streamline that process as much as possible, too.

AndyB points us to the news that Ron Kirk, the USTR, has directly asked Congress to provide the administration with "trade promotion authority," which more or less abdicates Congress's ability to substantially question or modify any international agreement. Trade promotion authority basically forces Congress to vote on any trade agreement put forth by the administration within a very short period of time (90 days) and denies them the ability to offer any amendments (i.e., to do their job). The "reasoning" behind this is to give the administration/USTR authority to negotiate with foreign countries, such that there aren't any questions in those countries of whether or not the US will actually agree to the deal, or if they'll try to change a deal once negotiated.

And, of course, the main reason for seeking this trade promotion authority... is to ram through the Trans Pacific Partnership (TPP) by the end of the year.

But, such a provision is basically Congress giving up its powers. There's a reason why Congress is supposed to ratify treaties: and it's to keep the executive branch from negotiating something horrible and having us be bound to it. It's crazy to think that Congress would just give up this important check and balance on the executive branch.

Filed Under: congress, mandates, tpp, trade promotion authority, ustr