Re: Obama on Fetishizing Our Phones

If I can gain access to your customer's data by gaining access to a cell phone owned by one of your employees then you are doing something deeply, deeply wrong.

You should fix that.

Let's get the facts straight about encryption and security. The DOJ needs our help, and we need theirs

We need a grassroots movement here. I know we have the EFF and Apple and a slew of others. But we all need to be writing about this to have our voices heard.

I am in between projects and writing about this extensively online. Would anyone like to work together to organize facts and promote discussion in a concerted manner? The goal would be a) to make a concise message that is understandable by a non-techie, b) back it up with facts and primary source, and c) seek out public figures who can share our message. I have a running summary of events here which I will put in a github repo [1]

Dear technologists:

The task of educating the public and our government on encryption may be even harder than you think. Everyone needs to understand the issues at stake in order to make up their own mind, and it could take years to educate the general public about encryption.

We can expect to continue seeing terrorists attacks in the news regardless of what laws Congress passes. This much we know, and this is, of course, out of our control. However, uninformed law enforcement will blame encryption and they will blame technologists for not allowing them to catch these attacks. Unless all law enforcement truly understands the technology, then they will always blame citizens for fighting for their right to privacy.

Of course, we know this is about security vs. security, not security vs. privacy. Privacy is a secondary focus for many. But law enforcement believes our primary focus is privacy.

My primary concern is that law enforcement does not know how to keep us safe in a world where criminals can sometimes communicate with smartphones across the world in a way that cannot be monitored with a warrant. Regardless of whether Cyrus Vance, James Comey, Loretta Lynch or Obama truly understand this or if they are putting up a smoke screen, the fact is that law enforcement across the country trust them the most. Non-technologists will be more moved to understand the security and economic implications of forcing backdoors upon Americans and US phone manufacturers. For the most part, they are not going to see eye to eye with us on privacy concerns. Lindsey Graham has already changed his view. We can share facts with others and let them make up their own minds.

Some damage is already done. The fact that Vance and Comey have been fighting this for so long is going to make it difficult for them to go back and convince officers of the law that technologists were right, and they were wrong. Many officers will continue to feel snubbed by the tech community.

If we're to advance to the next level of our mutually trusting society, we must all understand encryption technology and its implications. To the extent that we do not all understand encryption, and the ease of which it can be used regardless of government mandates, we will continue infighting and not progress together.

The idea that technologists feel the issue is black and white or absolutist is absolutely incorrect :-). Math is black and white, but our public safety and security is not. It is a complex equation that must be balanced, and we have that focus just as President Obama does. The difference between us and the DOJ is we understand a few more pieces to the equation. I'm open to the idea there are pieces that technologists do not know about, and I encourage the administration to share these details with us. Until all the details are on the table, we won't be able to come up with a solution together. Let's focus on discussing and sharing the variables and their weights. Given information, people can make up their own minds.

If backdoor laws are passed, it's not the end of the world, but our industry will suffer while non-technologists struggle to understand why terrorist attacks continue to occur. It'll be another 4-8 years until we can dig ourselves out of that hole. Let's keep the great country we have and bring facts to the table for open discussion.

[1] https://www.reddit.com/r/SandersForPresident/comments/49otvu...

Sanders will criticize Obama, one of the things I love about him. Especially compared to his opponent that wraps herself in Obama.

This is largely overblown though. Even with unfettered access to great and easy to use crypto your society doesn't collapse. It turns out that maintaining anonymity is a giant pain in the ass, no more people are going to go full on tinfoil ghost on society to dodge taxes any more than they already disappear and live off the grid. Most businesses are easier to conduct in public and even derive benefit from it.

Regulatory enforcement is fairly easy: in order to have a license to operate your coal plant, you agree to hand over documents x, y, z. If in your crypto-dystopia I handed over encrypted docs instead of the plaintext for my coal plant I would just have my business fined out of existence just like would happen now.

If I have incriminating documents and no crypto I'm not going to encrypt them, I'm going to slag the hard drives they're on and burn the paper copies.

If you're a public official: make it illegal to use encryption beyond the provided email encryption (which the agency IT dept can also read). I think you can make the case that it is already illegal since an internally encrypted message that you refuse to decrypt (at the request of a superior, a court, or investigation) would have to have been misuse of gov't property (your first amendment rights do not allow you to use government systems for private use and you explicitly have no privacy with respect to the scenario mentioned above when you use them).

People have always had plenty of ways to be shitheads and get away with it, and there have always been mechanisms to make those decisions costly. These things continue to be true despite the presence of strong crypto.

The reason an "absolutist" position here makes sense is because this is a binary choice between everyone legally having security, or no one legally having security. Until now we haven't had to make this choice because neither was an option, we just all existed in a vague middle ground dictated by our circumstances, number of shits given, and technical acumen. True, you might not have had access to cryptography, but you didn't have data to encrypt so you lost nothing by having no encryption. Now everyone has a lot to lose but not everyone realizes that.

I'm in favor of Apple's choices, but I can see the government's side of this too, I don't think it's as cut and dried morally as people are making it. I like to mentally "game out" repercussions of various scenarios to see where they lead, and I don't think it is bad with such wide sweeping and powerful technologies, to play devils advocate and argue on both sides.

A lot of people don't seem to want get into the fine details and debate at all. They just want to declare absolute privacy, like absolute freedom of speech, a done deal, and move on. I think there are interesting sociological, economic, and political issues to discuss not to curtail debate like that.

I also don't like the way the sides are demonized. Perhaps the end result is to enact a shift in the way police work is done and the way regulations are prosecuted. Perhaps the government can rule that privacy is a right only for personal communications, and does not apply to computers used for business sectors that are regulated. They can mandate anti-privacy, mandate transparency and paper trails, for say, health insurers, or makers of chemicals.

But the nuance and fine details need to be worked out.