Stronger encryption on consumer devices is required for national security
“It’s crucial that users demand the highest level of security to both protect our personal privacy and mitigate the potential harm that can result from theft of personal data. Unquestionably, encrypting the content of smartphones makes it more difficult to access that information; that’s the point,” said Nuala O’Connor, head of the Center for Democracy and Technology. “However, there are still many legal channels police can pursue to access encrypted data.”
Mr. Comey and intelligence officials have criticized companies such as Google and Apple for strengthening encryption on consumer devices because they say it will stymie law enforcement as they track criminals and terrorists. While the 73 percent of Influencers largely acknowledged that encryption will occasionally pose some obstacles to law enforcement, they insisted they were not severe enough to justify built-in government access to data.
“Evidence that this is a serious problem demanding a policy response is laughably weak,” said Cato Institute senior fellow Julian Sanchez.
“We live in a Golden Age of Surveillance. Never in human history have police had such easy access to such vast quantities of data about people. They’ll still be able to use subpoenas or court orders (and the threat of contempt penalties or even obstruction charges) to compel people to decrypt data; they can still surreptitiously attempt to get people’s passphrases through physical surveillance,” Mr. Sanchez continued. “It is flat out insane to suggest that we should undermine the security of a technology used by hundreds of millions of people for legitimate purposes because of the minuscule fraction of cases where crypto will be the make-or-break factor in a legitimate investigation.”
Security pros also had objections, taking issue with intelligence officials’ assertions that it would be technologically feasible to provide government access to encrypted data through a secure channel without compromising users’ security.
“Much greater harms to national security would result from the government deliberately weakening encryption protocols (again) as the FREAK vulnerability demonstrated this past week,” said Chris Finan, chief executive officer of Manifold Security. “DC policymakers shouldn’t seek a middle-ground solution on this issue, because it simply doesn’t exist when it comes to cryptography.
“The only answer is to support the strongest possible encryption protocols, while also enabling law enforcement professionals with the resources needed to conduct classic police work,” Mr. Finan continued. “The FBI director should realize that the days of relying on backdoor technology shortcuts are over. Encryption is as empowering a technology as gunpowder or firearms, policymakers need to appreciate the irreversibility of this paradigm shift and adapt. Quite simply, governments no longer enjoy a monopoly on technologies like cryptographic protocols or offensive cyberwarfare exploits. There are no tech magic bullets to address these policy challenges.”
The Passcode Influencers Poll brings together a diverse group of more than 80 security and privacy experts from across government, the private sector, academia, and the privacy community. To preserve the candor of their responses, Influencers have the choice to keep their comments anonymous, or voice their opinions on the record.
“While it may make it harder for the government to protect us, I see no difference between this and a file locked in a cabinet in my house,” said one Influencer who chose to remain anonymous. “This to me is a Fourth Amendment issue.”
Comey did have some backing among 27 percent of Influencers. “We need government and industry to work together on a solution that protects our nation through lawful intercept and ensures civil liberties and privacy,” said (ret.) Gen. Keith Alexander, chief executive officer of IronNet Cybersecurity and former National Security Agency director.
Robust encryption, another Influencer added, “is important to protect American’s privacy and to protect our infrastructure from cyberattacks. But encryption that allows criminals or terrorists to operate with impunity beyond the reach of lawful process would threaten our national security. There must be a balance between the two.”
This idea, another Influencer said, “is nothing short of revolutionary in that it challenges the very premises of the Fourth Amendment. Privacy has always been central to our Republic but it has also always been circumscribed via balanced rules, execution, and oversight by our three branches of government. Encryption without any state access eliminates this well-worn historical (and Constitutional) approach.”