23 ms·

You're completely right that there are undesirable consequences to mathematically absolute privacy that can't be compromised by any means. But I'd argue that th

You're completely right that there are undesirable consequences to mathematically absolute privacy that can't be compromised by any means. But I'd argue that the government has brought this scenario upon itself by blowing up the old system of procedural (rather than mathematical) safeguards. In the past, Apple had your iMessage data, or at least the ability to decrypt it on-demand. It was understood that this data would be private by default, but would be disclosed to the government through an established, case-by-case process supervised by the courts. Everyone was pretty much OK with this. You and I got our data kept private, unless there was some material, specific reason for the government to suspect it was related to a crime. The government got to dump the data of people under investigation, if a court thought there was good reason to do so. Then the government went nuclear. They said, here's a National Security Letter that compels you to give us everything you have. Bulk data. Any cooperation that is physically possible. You can't talk about it and you can't appeal to the courts. If you have to capability to MiTM all of your users and pipe everything to us, you have to do it. No oversight, no transparency and no safeguards. Whatever we do with the data is up to us. In this context, what alternative do tech companies have besides to similarly escalate and build systems that make it physically impossible for them to cooperate? The government destroyed the social compact between telecom providers and law enforcement with forced, secret bulk surveillance. If the government is willing to step back and make binding, unequivocal commitments that companies that do maintain the ability to decrypt their users' communications won't be forced to secretly use them en masse, maybe we can go back to the old status quo. But the government doesn't seem willing to do that. They want cooperation, but they also want the ability to bust in the back door with an NSL and say "give us everything, on everyone." The legal system has become so tilted in the government's favour (see: the inability to challenge the constitutionality of bulk surveillance, because you can't prove it happened to you), that companies will no longer trust in the old procedural safeguards. The only thing we can trust is the mathematically proven safety of encryption. And that's the government's fault. So now we are forced to chose between absolute privacy and zero privacy. So far, I think Apple is making the right choice.

cromwellian 11y ago
I'm in favor of Apple's choices, but I can see the government's side of this too, I don't think it's as cut and dried morally as people are making it. I like to mentally "game out" repercussions of various scenarios to see where they lead, and I don't think it is bad with such wide sweeping and powerful technologies, to play devils advocate and argue on both sides. A lot of people don't seem to want get into the fine details and debate at all. They just want to declare absolute privacy, like absolute freedom of speech, a done deal, and move on. I think there are interesting sociological, economic, and political issues to discuss not to curtail debate like that. I also don't like the way the sides are demonized. Perhaps the end result is to enact a shift in the way police work is done and the way regulations are prosecuted. Perhaps the government can rule that privacy is a right only for personal communications, and does not apply to computers used for business sectors that are regulated. They can mandate anti-privacy, mandate transparency and paper trails, for say, health insurers, or makers of chemicals. But the nuance and fine details need to be worked out.
- eigenvector 11y ago
  I think with respect to business regulation, encryption won't pose much of a problem. People in criminal prosecutions have a right not to incriminate themselves. But if the government wants to investigate, say, DuPont for chemical dumping and there's a law on the books saying companies have to keep chemical storage records for 7 years, DuPont can't just throw away the key for their encrypted internal data. They'll have broken the law requiring them to keep their data and be liable to regulatory sanctions for that. In contrast to criminal law, most regulatory schemes use a reverse onus. That is to say, the onus to prove compliance is on the regulated entity. So you can't just say, "sorry, we don't have that data / we encrypted it". That will be de facto non-compliance. So if you are encrypting internal data (which of course you should be doing, just so it isn't stolen), you had better have the means of decrypting it when the government comes knocking. The thorny issues will be in criminal prosecutions where disclosure of the accused's (encrypted) stored data will now need the active participation of the accused, who of course can exercise their Fifth Amendment rights to refuse. And the government won't be able to go around them and get the device vendor to unlock it. But companies facing regulatory sanctions already don't have these rights.

cromwellian 11y ago

I'm in favor of Apple's choices, but I can see the government's side of this too, I don't think it's as cut and dried morally as people are making it. I like to mentally "game out" repercussions of various scenarios to see where they lead, and I don't think it is bad with such wide sweeping and powerful technologies, to play devils advocate and argue on both sides. A lot of people don't seem to want get into the fine details and debate at all. They just want to declare absolute privacy, like absolute freedom of speech, a done deal, and move on. I think there are interesting sociological, economic, and political issues to discuss not to curtail debate like that. I also don't like the way the sides are demonized. Perhaps the end result is to enact a shift in the way police work is done and the way regulations are prosecuted. Perhaps the government can rule that privacy is a right only for personal communications, and does not apply to computers used for business sectors that are regulated. They can mandate anti-privacy, mandate transparency and paper trails, for say, health insurers, or makers of chemicals. But the nuance and fine details need to be worked out.

eigenvector 11y ago
I think with respect to business regulation, encryption won't pose much of a problem. People in criminal prosecutions have a right not to incriminate themselves. But if the government wants to investigate, say, DuPont for chemical dumping and there's a law on the books saying companies have to keep chemical storage records for 7 years, DuPont can't just throw away the key for their encrypted internal data. They'll have broken the law requiring them to keep their data and be liable to regulatory sanctions for that. In contrast to criminal law, most regulatory schemes use a reverse onus. That is to say, the onus to prove compliance is on the regulated entity. So you can't just say, "sorry, we don't have that data / we encrypted it". That will be de facto non-compliance. So if you are encrypting internal data (which of course you should be doing, just so it isn't stolen), you had better have the means of decrypting it when the government comes knocking. The thorny issues will be in criminal prosecutions where disclosure of the accused's (encrypted) stored data will now need the active participation of the accused, who of course can exercise their Fifth Amendment rights to refuse. And the government won't be able to go around them and get the device vendor to unlock it. But companies facing regulatory sanctions already don't have these rights.