8 ms·

Don't Panic: Seeking Points of Agreement on the “Going Dark” Debate

103 points by finnn 11y ago

jcr 11y ago
The submitted berklett "Don't Panic" article has a "Bruce Schneier" link to his "Security or Surveillance?" article on lawfareblog.com. It's also good reading. [1] https://lawfareblog.com/security-or-surveillance https://lawfareblog.com/security-or-surveillance
- kmonsen 11y ago
  This is what the debate is all about. The government wants to have surveillance of its citizens, but wants to call it something else.
Absentinsomniac 11y ago
My kneejerk reaction to this is to panic about the opposite of what the concern here seems to be. Seems to me like ubiquitous surveillance via any and all available technology is a bigger threat than "going dark" would be. I know encryption can provide an obstacle for law enforcement but my inclination is to worry about privacy in society over potential lawbreakers.
- jeanetienne 11y ago
  This ^ It seems to me that all this report is saying is: "Hey government, don't worry about tech 'going dark', we will still have the ability to spy on people through their poorly implemented Internet of Things devices, services that won't use end to end encryption, metadata, and because software is still fragmented." But they don't seem to even slightly condemn the simple fact that governments are turning into surveillance machines...
CapitalistCartr 11y ago
This fake crisis of "Going Dark" as if we haven't been that way for all of time before the Internet is dangerous. The "scary" notion that the police won't be able to read everything about everyone is being recast by the Feds as if it really is national crisis. Benjamin Wittes suggests on Lawfare we make Common Carrier Immunity conditional on the company being able to make all data available in the clear to the government. This is dangerous ground. https://www.lawfareblog.com/out-box-approach-going-dark-problem https://www.lawfareblog.com/out-box-approach-going-dark-prob...
- hellbanner 11y ago
  I think (most) of us on HN are on the same page here. But we are a minority... many people truly don't care and are not incentivized to care.
  - danharaj 11y ago
    i think people are incentivized not to care, which is subtly different but far more pernicious.
  - izacus 11y ago
    For pretty much any political issue the people caring are a minority (on each side) with middle being populated with people who don't care or don't know what's going on. Those people on the sides that do care then shape the debate and ultimately the outcome of pretty much any democratic decision (as little as those are still left).
    - laotzu 11y ago
      "Never doubt that a small group of thoughtful, committed citizens can change the world; indeed, it's the only thing that ever has." -Margaret Mead
  - bobby_9x 11y ago
    Even look at public wifi. Most non-tech savvy people I know really have no problem using piblic wifi to conduct business and login into important accounts. They want the path of least resistance, which isn‘t good for security or privacy.
- obrero 11y ago
  The facts which Wittes gives are way off. He links to "civil suits against the companies who provide service to ISIS and other bad guys". The civil suit is regarding a Jordanian police officer who shot and killed an American military contractor. Other than this lawsuit, almost nothing is linking the officer to ISIS. If you read the lawsuit, they really have nothing linking this officer to ISIS either, other than a vague statement from a supposedly official ISIS source. So the link to this military contractor's death to ISIS is very tenuous. This has to be established first, and there is almost nothing to establish it on - he was a Jordanian police officer, not an ISIS militant. Then you have to say Twitter is engaged in running afoul of material support of terrorism laws. These laws generally would mean something along the lines of that in some back office of Twitter, Jack Dorsey was storing up Kalashnikov rifles which he was going to ship to the Taliban in order to assault American bases there. In 1929, the Republican (!) Secretary of State rolled up all the old World War I spying operations saying "Gentlemen do not read each other's mail". How far the US has fallen in freedom from the day Stimson uttered those words a century ago.
defenestration 11y ago
To summarize: end-to-end encryption is making online surveillance harder. However, standards for end-to-end encryption are still fragmented and companies have incentives to not adopt it. Besides that, connected sensors, 'the internet of things' and unencrypted metadata give new surveillance possibilities.
its2complicated 11y ago
"legitimate government interests" should be enough to scare everyone. It's not for criminals, just like gun control is not about criminals. Think the worst, 'cause it don't get any better!
mmaunder 11y ago
If we could only make them understand that forcing the good guys to not encrypt doesn't take encryption away from the bad guys. Legislators don't understand that encryption doesn't have to be made by Apple for the bad guys to have encryption. A shared key and XOR gives you unbreakable encryption. A high school comp sci. kid could implement that.
- fleitz 11y ago
  Incorrect, if the key is shared the encryption is breakable. If you're just doing one round of XOR it's pretty easy to break the key given a known plaintext, in the same way that AES is very breakable in ECB mode. For unbreakable encryption, I'd suggest XORing with the contents of /dev/random (assuming /dev/random is unknowable). Of course decryption may be an issue.
  - schoen 11y ago
    In context, I'm sure the parent commenter meant "a random key the same length as the plaintext", not a repeating key or a reused key.
    - mmaunder 11y ago
      Thanks. Yup.
    - fleitz 11y ago
      Some people when faced with an encryption problem think 'I know, I'll use a non-repeating random text to XOR against the plain text', now they have two encryption problems.
      - mmaunder 11y ago
        Three if you count entropy.
  - mmaunder 11y ago
    Wrong. It's just not secure in all contexts e.g. your example where you have a known plaintext that you can use to crack the key which then lets you decrypt something encrypted with the same key. You're discovering why XOR isn't widely used in a real-world setting.
hellbanner 11y ago
Related: Apple's patent for "polluting online social networks with fake profiles".. based on variants of the real profile. http://www.darkreading.com/risk-management/apple-gets-patent-for-polluting-electronic-profiles/d/d-id/1104952 http://www.darkreading.com/risk-management/apple-gets-patent...? (Or google for other articles)
fredgrott 11y ago
put in proper context Imagine if its WWII and that they asked for all mail to be un-sealed..Shocking but did almost happen..as far as they got was asking Military Personnel to 'volunteer' not to seal mail..
- marshray 11y ago
  They forced everyone to turn in their shortwave radios too.
  - kwhitefoot 11y ago
    Who? Where? In the UK that would have meant pretty much every radio would have had to be given up. At least every radio I have seen from the period had LW, MW, and SW.
    - marshray 11y ago
      http://www.radiomuseum.org/forum/radios_confiscated_in_us_during_wwii.html http://www.radiomuseum.org/forum/radios_confiscated_in_us_du...
cubano 11y ago
Something learned in my 30y career as low level felon and spending fairly significant amounts of time (to me at least...a week in jail is no picnic!) locked up in both jail and prisons... 95% of cases are made via informants and not CSI-type investigations, so the whole "going dark" thing, I feel, isn't going to affect law enforcement the way a lot of people think it might. I did notice, however, my last time through the system last year, that the State is now making a bunch of cases using cell tower information to put the defendants near the crime scene during the approx time of the situation. Just FYI.
- bigiain 11y ago
  "isn't going to affect law enforcement" - at least the way it is now (and has been forever), but it greatly affects the way law enforcement would _like things to be_. And I'm not at all happy with the implications of what "they" want...
- LordKano 11y ago
  Going dark has a significant effect on law enforcement. It'll force them to rely on active investigations instead of passively collecting data that they can review at their leisure. I think this will reduce their ability to target people for political reasons.
mmaunder 11y ago
If you want to beat it, brand it. Obamacare, The Surge, War on Terror. Going Dark is just the latest. Expect letsnotencrypt.gov any day now.
- dragonwriter 11y ago
  > If you want to beat it, brand it. Obamacare, The Surge, War on Terror. The Surge and the War On Terror were branded by their supporters. Obamacare was branded that way by those trying to defeat it, but it hasn't worked. So, not sure your examples illustrate your point.
  - mmaunder 11y ago
    I shall be sure to quote more pertinent examples in future.
    - laotzu 11y ago
      >The receptivity of the great masses is very limited, their intelligence is small, but their power of forgetting is enormous. In consequence of these facts, all effective propaganda must be limited to a very few points and must harp on these in slogans until the last member of the public understands what you want him to understand by your slogan. As soon as you sacrifice this slogan and try to be many-sided, the effect will piddle away, for the crowd can neither digest nor retain the material offered. In this way the result is weakened and in the end entirely cancelled out.
      - mmaunder 11y ago
        The subtitled versions of his speeches certainly shed new light on the guy. You realize how powerful (and potentially dangerous) charisma can be.
voodootrucker 11y ago
Why do we need to agree? That's how this works. You compromise a bit, and they don't budge. Then you compromise again. Repeat the process until all liberties are gone. Also, why is this framed as "going dark"? That's the ignorant people's wording. Why doesn't the author call it what it is: key escrow, or back-dooring? Use the terms of the industry you are talking about.
batz 11y ago
It's not just about tech. The real issue is that government is running up against scaling limits. Arguably, a government can only rule over how people relate within boundaries it can defend and control. Previously the boundaries were physical geographies, and then regulated channels (mail, PSTN, etc). Now, we have a kind of fractal boundary of peer-to-peer connections that provide tremendous freedom to organize and transact on a diminishingly microscopic scale. Sovereignty is zero sum. Crypto provides a kind of micro-sovereignty to users, and for a few privileged or outlying people this is an acceptable risk, but when you have constituencies of people achieving that micro-sovereignty, it cuts into the sovereignty of the state at critical level. Imagine the strategic consequences for U.S. national security if Rhode Island became it's own country, with an impenetrable laser air shield, with it's own allies, currency, tax laws, extradition treaties, defense systems, resources, etc. It would be such a constant threat, it would make more sense to just invade. Tor and similar systems could reach that critical mass, where they become a constant threat to the sovereignty of nations. Tech is naively forcing hard questions about the conventions that provide "stability." The feds know they might just have to just outlaw crypto. The technology exists to detect and round up most people who use it, or enough of them that it will be hard to find people to use it with. If they have to, they will. This dance they are doing is political posturing, testing the edges to see what kind of resistance they get, and how much political capital it is going to cost. Like voting and graffiti, if crypto really changed anything, it would be illegal.
- milesokeefe 11y ago
  Is graffiti not illegal?
  - simoncion 11y ago
    I've never lived in a district where it wasn't.
  - marcosdumay 11y ago
    Don't know about your place, but here it's only illegal if done against the will of the wall's owner.
  - 11y ago
mirimir 11y ago
There's an underlying issue that the report dances around, but doesn't address directly: sovereignty. Understandably enough, US authorities expect US companies to comply with US law. When foreigners are involved, as users or counterparties, things get iffy. Diplomatic relationships, treaties, agreements, etc become dispositive. For example, the US supports Chinese dissidents, and maybe Thai dissidents, but for sure not ISIS. And so decrypted ISIS messages would be widely shared, but decrypted messages from Chinese dissidents would not be shared with China. Old-school sovereignty just doesn't work on the Internet. If the US pushes hard enough, some firms will fold. But some may just leave. Consider the extent to which Apple has already left the US, for tax purposes.
unicornporn 11y ago
Apparently, authorities are not really worried: https://theintercept.com/2016/02/01/is-law-enforcement-going-dark-because-of-encryption-hardly-says-new-report/ https://theintercept.com/2016/02/01/is-law-enforcement-going...
Zigurd 11y ago
Regulating strong encryption out of consumer products is functionally the same as banning it. Using encryption would draw special attention. Encryption needs to be routine in order to protect the public, outside of special situations.

103 points by finnn 11y ago

jcr 11y ago

The submitted berklett "Don't Panic" article has a "Bruce Schneier" link to his "Security or Surveillance?" article on lawfareblog.com. It's also good reading. [1] https://lawfareblog.com/security-or-surveillance https://lawfareblog.com/security-or-surveillance

kmonsen 11y ago
This is what the debate is all about. The government wants to have surveillance of its citizens, but wants to call it something else.

Absentinsomniac 11y ago

My kneejerk reaction to this is to panic about the opposite of what the concern here seems to be. Seems to me like ubiquitous surveillance via any and all available technology is a bigger threat than "going dark" would be. I know encryption can provide an obstacle for law enforcement but my inclination is to worry about privacy in society over potential lawbreakers.

jeanetienne 11y ago
This ^ It seems to me that all this report is saying is: "Hey government, don't worry about tech 'going dark', we will still have the ability to spy on people through their poorly implemented Internet of Things devices, services that won't use end to end encryption, metadata, and because software is still fragmented." But they don't seem to even slightly condemn the simple fact that governments are turning into surveillance machines...

CapitalistCartr 11y ago

This fake crisis of "Going Dark" as if we haven't been that way for all of time before the Internet is dangerous. The "scary" notion that the police won't be able to read everything about everyone is being recast by the Feds as if it really is national crisis. Benjamin Wittes suggests on Lawfare we make Common Carrier Immunity conditional on the company being able to make all data available in the clear to the government. This is dangerous ground. https://www.lawfareblog.com/out-box-approach-going-dark-problem https://www.lawfareblog.com/out-box-approach-going-dark-prob...

hellbanner 11y ago
I think (most) of us on HN are on the same page here. But we are a minority... many people truly don't care and are not incentivized to care.
- danharaj 11y ago
  i think people are incentivized not to care, which is subtly different but far more pernicious.
- izacus 11y ago
  For pretty much any political issue the people caring are a minority (on each side) with middle being populated with people who don't care or don't know what's going on. Those people on the sides that do care then shape the debate and ultimately the outcome of pretty much any democratic decision (as little as those are still left).
  - laotzu 11y ago
    "Never doubt that a small group of thoughtful, committed citizens can change the world; indeed, it's the only thing that ever has." -Margaret Mead
- bobby_9x 11y ago
  Even look at public wifi. Most non-tech savvy people I know really have no problem using piblic wifi to conduct business and login into important accounts. They want the path of least resistance, which isn‘t good for security or privacy.
obrero 11y ago
The facts which Wittes gives are way off. He links to "civil suits against the companies who provide service to ISIS and other bad guys". The civil suit is regarding a Jordanian police officer who shot and killed an American military contractor. Other than this lawsuit, almost nothing is linking the officer to ISIS. If you read the lawsuit, they really have nothing linking this officer to ISIS either, other than a vague statement from a supposedly official ISIS source. So the link to this military contractor's death to ISIS is very tenuous. This has to be established first, and there is almost nothing to establish it on - he was a Jordanian police officer, not an ISIS militant. Then you have to say Twitter is engaged in running afoul of material support of terrorism laws. These laws generally would mean something along the lines of that in some back office of Twitter, Jack Dorsey was storing up Kalashnikov rifles which he was going to ship to the Taliban in order to assault American bases there. In 1929, the Republican (!) Secretary of State rolled up all the old World War I spying operations saying "Gentlemen do not read each other's mail". How far the US has fallen in freedom from the day Stimson uttered those words a century ago.

defenestration 11y ago

To summarize: end-to-end encryption is making online surveillance harder. However, standards for end-to-end encryption are still fragmented and companies have incentives to not adopt it. Besides that, connected sensors, 'the internet of things' and unencrypted metadata give new surveillance possibilities.

its2complicated 11y ago

"legitimate government interests" should be enough to scare everyone. It's not for criminals, just like gun control is not about criminals. Think the worst, 'cause it don't get any better!

mmaunder 11y ago

If we could only make them understand that forcing the good guys to not encrypt doesn't take encryption away from the bad guys. Legislators don't understand that encryption doesn't have to be made by Apple for the bad guys to have encryption. A shared key and XOR gives you unbreakable encryption. A high school comp sci. kid could implement that.

fleitz 11y ago
Incorrect, if the key is shared the encryption is breakable. If you're just doing one round of XOR it's pretty easy to break the key given a known plaintext, in the same way that AES is very breakable in ECB mode. For unbreakable encryption, I'd suggest XORing with the contents of /dev/random (assuming /dev/random is unknowable). Of course decryption may be an issue.
- schoen 11y ago
  In context, I'm sure the parent commenter meant "a random key the same length as the plaintext", not a repeating key or a reused key.
  - mmaunder 11y ago
    Thanks. Yup.
  - fleitz 11y ago
    Some people when faced with an encryption problem think 'I know, I'll use a non-repeating random text to XOR against the plain text', now they have two encryption problems.
    - mmaunder 11y ago
      Three if you count entropy.
- mmaunder 11y ago
  Wrong. It's just not secure in all contexts e.g. your example where you have a known plaintext that you can use to crack the key which then lets you decrypt something encrypted with the same key. You're discovering why XOR isn't widely used in a real-world setting.

hellbanner 11y ago

Related: Apple's patent for "polluting online social networks with fake profiles".. based on variants of the real profile. http://www.darkreading.com/risk-management/apple-gets-patent-for-polluting-electronic-profiles/d/d-id/1104952 http://www.darkreading.com/risk-management/apple-gets-patent...? (Or google for other articles)

fredgrott 11y ago

put in proper context Imagine if its WWII and that they asked for all mail to be un-sealed..Shocking but did almost happen..as far as they got was asking Military Personnel to 'volunteer' not to seal mail..

marshray 11y ago
They forced everyone to turn in their shortwave radios too.
- kwhitefoot 11y ago
  Who? Where? In the UK that would have meant pretty much every radio would have had to be given up. At least every radio I have seen from the period had LW, MW, and SW.
  - marshray 11y ago
    http://www.radiomuseum.org/forum/radios_confiscated_in_us_during_wwii.html http://www.radiomuseum.org/forum/radios_confiscated_in_us_du...

cubano 11y ago

Something learned in my 30y career as low level felon and spending fairly significant amounts of time (to me at least...a week in jail is no picnic!) locked up in both jail and prisons... 95% of cases are made via informants and not CSI-type investigations, so the whole "going dark" thing, I feel, isn't going to affect law enforcement the way a lot of people think it might. I did notice, however, my last time through the system last year, that the State is now making a bunch of cases using cell tower information to put the defendants near the crime scene during the approx time of the situation. Just FYI.

bigiain 11y ago
"isn't going to affect law enforcement" - at least the way it is now (and has been forever), but it greatly affects the way law enforcement would _like things to be_. And I'm not at all happy with the implications of what "they" want...
LordKano 11y ago
Going dark has a significant effect on law enforcement. It'll force them to rely on active investigations instead of passively collecting data that they can review at their leisure. I think this will reduce their ability to target people for political reasons.

mmaunder 11y ago

If you want to beat it, brand it. Obamacare, The Surge, War on Terror. Going Dark is just the latest. Expect letsnotencrypt.gov any day now.

dragonwriter 11y ago
> If you want to beat it, brand it. Obamacare, The Surge, War on Terror. The Surge and the War On Terror were branded by their supporters. Obamacare was branded that way by those trying to defeat it, but it hasn't worked. So, not sure your examples illustrate your point.
- mmaunder 11y ago
  I shall be sure to quote more pertinent examples in future.
  - laotzu 11y ago
    >The receptivity of the great masses is very limited, their intelligence is small, but their power of forgetting is enormous. In consequence of these facts, all effective propaganda must be limited to a very few points and must harp on these in slogans until the last member of the public understands what you want him to understand by your slogan. As soon as you sacrifice this slogan and try to be many-sided, the effect will piddle away, for the crowd can neither digest nor retain the material offered. In this way the result is weakened and in the end entirely cancelled out.
    - mmaunder 11y ago
      The subtitled versions of his speeches certainly shed new light on the guy. You realize how powerful (and potentially dangerous) charisma can be.

voodootrucker 11y ago

Why do we need to agree? That's how this works. You compromise a bit, and they don't budge. Then you compromise again. Repeat the process until all liberties are gone. Also, why is this framed as "going dark"? That's the ignorant people's wording. Why doesn't the author call it what it is: key escrow, or back-dooring? Use the terms of the industry you are talking about.

batz 11y ago

It's not just about tech. The real issue is that government is running up against scaling limits. Arguably, a government can only rule over how people relate within boundaries it can defend and control. Previously the boundaries were physical geographies, and then regulated channels (mail, PSTN, etc). Now, we have a kind of fractal boundary of peer-to-peer connections that provide tremendous freedom to organize and transact on a diminishingly microscopic scale. Sovereignty is zero sum. Crypto provides a kind of micro-sovereignty to users, and for a few privileged or outlying people this is an acceptable risk, but when you have constituencies of people achieving that micro-sovereignty, it cuts into the sovereignty of the state at critical level. Imagine the strategic consequences for U.S. national security if Rhode Island became it's own country, with an impenetrable laser air shield, with it's own allies, currency, tax laws, extradition treaties, defense systems, resources, etc. It would be such a constant threat, it would make more sense to just invade. Tor and similar systems could reach that critical mass, where they become a constant threat to the sovereignty of nations. Tech is naively forcing hard questions about the conventions that provide "stability." The feds know they might just have to just outlaw crypto. The technology exists to detect and round up most people who use it, or enough of them that it will be hard to find people to use it with. If they have to, they will. This dance they are doing is political posturing, testing the edges to see what kind of resistance they get, and how much political capital it is going to cost. Like voting and graffiti, if crypto really changed anything, it would be illegal.

milesokeefe 11y ago
Is graffiti not illegal?
- simoncion 11y ago
  I've never lived in a district where it wasn't.
- marcosdumay 11y ago
  Don't know about your place, but here it's only illegal if done against the will of the wall's owner.
- 11y ago

mirimir 11y ago

There's an underlying issue that the report dances around, but doesn't address directly: sovereignty. Understandably enough, US authorities expect US companies to comply with US law. When foreigners are involved, as users or counterparties, things get iffy. Diplomatic relationships, treaties, agreements, etc become dispositive. For example, the US supports Chinese dissidents, and maybe Thai dissidents, but for sure not ISIS. And so decrypted ISIS messages would be widely shared, but decrypted messages from Chinese dissidents would not be shared with China. Old-school sovereignty just doesn't work on the Internet. If the US pushes hard enough, some firms will fold. But some may just leave. Consider the extent to which Apple has already left the US, for tax purposes.

unicornporn 11y ago

Apparently, authorities are not really worried: https://theintercept.com/2016/02/01/is-law-enforcement-going-dark-because-of-encryption-hardly-says-new-report/ https://theintercept.com/2016/02/01/is-law-enforcement-going...

Zigurd 11y ago

Regulating strong encryption out of consumer products is functionally the same as banning it. Using encryption would draw special attention. Encryption needs to be routine in order to protect the public, outside of special situations.