Obama Sides with Cameron in Encryption Fight

http://blogs.wsj.com/washwire/2013/08/23/nsa-officers-someti... "Such admissions can arise, for example, when an employee takes a polygraph tests as part of a renewal of a security clearance."

I also want more internal checks than "hoping the bad actors can't fool polygraph examiners".

Oh he knows. Lip service to the public about terrorism is just that.

> Is anyone going to attempt to argue that encryption facilitates more fraud than it prevents?

No idea.

Keeping things on topic financial fraud, insider trading, etc is an example where strong encryption does complicate the state's ability to enforce and investigate illegal activity. The purpose here is to draw from a well of motivation other than oft cited but never seen use of encryption in 'terrorism'.

The government's fear is that ubiquitous access to these tools will deprecate the executive branch. All tools from nuclear enrichment to hammers to animal husbandry have noble and malicious potential. Encryption is no different. The executive branch's job is to allow the noble purposes and to discourage, prevent, investigate and indict the malicious.

From the perspective of the executive, encryption presents a serious hurtle to the pursuit of the malicious.

Yet disagreements between the public and the executive about the the scope and breath of executive practices along with the US incarceration rate, of legal exceptionality of the rich and powerful, and general unease with current power structure coupled with traditional mythical US values means that the public would like guarantees about their ability to communicate without being searched.

The US public wants its cake and to eat it too. Secure and private communication for the masses that can not be intercepted. But it wants the executive branch to be able to enforce the law and to investigate broadly.

The executive branch has made many proposals to this middle ground: the clipper chip and key escrow, proliferation of weak cryptography and the use of third party doctrine as a buffer zone mechanism all represent compromises the executive branch has made.

What it comes down to is that the US public does not trust the executive branch not to abuse a middle ground - it points to historical and current examples of extralegal abuse - and in general feels that its government represents their interests but only after compromises with other 'more important' interests (international and domestic elite).

That is to say that the current state of "front door" encryption is a compromise made by the executive but one that the public does not trust.

Yet the public still wants law enforcement to be able to investigate insider trading.

So the government is in a bind. The government is justified to the people by its ability to enforce the laws of the land - if it can't, even for technical reasons - it will have difficulty seeming justified. The government's solution is to invoke the boogieman. 'Terrorists' will get you if we don't compromise. 'Pedophiles' will get your kids if we don't compromise.

But no, it's not about terrorism - it's that the government does not know how it will be able to stand up to proper strong cryptography in the case of true and perceived malicious use.

Freedom is like a dove, yadda yadda.

Encryption is like osteoporosis.

> Right. I find it hard to believe that Obama and Cameron are going to take away our encryption and someone convince our adversaries to abide by those rules.

Entirely. Historically this has been achieved by subversion of cryptographic methods, consumer products and standards and misinformation about security margins. It has made legitimate strong cryptography hard to come by but not specifically illegal. It is likely to become more and more difficult to perform this sort of influence now that the cat is out of the bag.

"I've got no problem with that. I have nothing to hide."

(I have a friend who says _exactly_ that.) But at that point you really can't keep the argument/discussion going, because you're dealing with someone who clearly says one thing and would act differently. I'm sure if the camera crew arrived and started drilling in his house he'd change his tune, but what can you do short of that. The problem with debating with a lot of people, sadly.

The first option is to use provably broken cryptography, like 512-bit export grade RSA, that the government can just bust whenever they feel like it. Of course, so can pretty much anyone else, so this offers almost no protection.

The second option is to use secure cryptography, like 2048-bit RSA, that is thought to be difficult to bust in any reasonable timeframe. However, the government can compel you to hand over your private key, and they can then use that to decrypt whatever they want. An attacker could also steal the key and do the same thing.

The third option, which is what companies have begun to realize is the only method with actual security from criminals AND the government, is to transmit data without using a private key that they control. A good example is iMessage's use of device keys for parties of a conversation, without the use of a central key that lives on Apple's servers. They cannot be compelled to turn over the master key, and no one can steal the key either. If they have done their job correctly, there is no way to compromise the data that doesn't include obtaining someone's phone. This third option is what the ex-NSA lawyer doesn't even want to include in the conversation, even though it is what everyone is up in arms about right now.

It's also worth stating that this does not offer some new revelation in privacy. If I had sent you a letter in 1885, someone would have to actually GET the letter to read it and know what I told you. A system like iMessage functions in the same way: to know what I wrote you, you have to obtain one of our phones. The NSA is just sad that they can no longer pluck the message from the air.

One final note: there are so many methods of communication on the Internet, and more launch every month, that I can't imagine how they could all be monitored. Terrorists could be communicating with voice chat on Everquest 2. They could be arranging plants in their Farmville gardens to spell out coded messages. It's an arms race, and I don't want my freedoms compromised by governments trying to win it.