4 ms·

I'm in favor of Apple's choices, but I can see the government's side of this too, I don't think it's as cut and dried morally as people are making it. I like to

I'm in favor of Apple's choices, but I can see the government's side of this too, I don't think it's as cut and dried morally as people are making it. I like to mentally "game out" repercussions of various scenarios to see where they lead, and I don't think it is bad with such wide sweeping and powerful technologies, to play devils advocate and argue on both sides. A lot of people don't seem to want get into the fine details and debate at all. They just want to declare absolute privacy, like absolute freedom of speech, a done deal, and move on. I think there are interesting sociological, economic, and political issues to discuss not to curtail debate like that. I also don't like the way the sides are demonized. Perhaps the end result is to enact a shift in the way police work is done and the way regulations are prosecuted. Perhaps the government can rule that privacy is a right only for personal communications, and does not apply to computers used for business sectors that are regulated. They can mandate anti-privacy, mandate transparency and paper trails, for say, health insurers, or makers of chemicals. But the nuance and fine details need to be worked out.

eigenvector 11y ago
I think with respect to business regulation, encryption won't pose much of a problem. People in criminal prosecutions have a right not to incriminate themselves. But if the government wants to investigate, say, DuPont for chemical dumping and there's a law on the books saying companies have to keep chemical storage records for 7 years, DuPont can't just throw away the key for their encrypted internal data. They'll have broken the law requiring them to keep their data and be liable to regulatory sanctions for that. In contrast to criminal law, most regulatory schemes use a reverse onus. That is to say, the onus to prove compliance is on the regulated entity. So you can't just say, "sorry, we don't have that data / we encrypted it". That will be de facto non-compliance. So if you are encrypting internal data (which of course you should be doing, just so it isn't stolen), you had better have the means of decrypting it when the government comes knocking. The thorny issues will be in criminal prosecutions where disclosure of the accused's (encrypted) stored data will now need the active participation of the accused, who of course can exercise their Fifth Amendment rights to refuse. And the government won't be able to go around them and get the device vendor to unlock it. But companies facing regulatory sanctions already don't have these rights.
- cromwellian 11y ago
  Thank you, I think this is a much clearer argument for how to proceed and how to address transparency required in business and satisfies some of my concerns. I think we may need additional regulations for the political class however. Government communications need to be secure, but I think being a politician abdicates some privacy rights, and IMHO, if you are an elected representative, you either must use some kind of key escrow, or, you must be able to provide access to your communications under warrant, and if you fail to do so, it's grounds for impeachment. The risk of collusion between politicians and industry is too great IMHO.
  - neltnerb 11y ago
    Yes, that would be a lovely outcome. Everyone gets to keep normal functional encryption, but employees (especially Senators) have to provide a backdoor key to their employer to use it for work..

eigenvector 11y ago

I think with respect to business regulation, encryption won't pose much of a problem. People in criminal prosecutions have a right not to incriminate themselves. But if the government wants to investigate, say, DuPont for chemical dumping and there's a law on the books saying companies have to keep chemical storage records for 7 years, DuPont can't just throw away the key for their encrypted internal data. They'll have broken the law requiring them to keep their data and be liable to regulatory sanctions for that. In contrast to criminal law, most regulatory schemes use a reverse onus. That is to say, the onus to prove compliance is on the regulated entity. So you can't just say, "sorry, we don't have that data / we encrypted it". That will be de facto non-compliance. So if you are encrypting internal data (which of course you should be doing, just so it isn't stolen), you had better have the means of decrypting it when the government comes knocking. The thorny issues will be in criminal prosecutions where disclosure of the accused's (encrypted) stored data will now need the active participation of the accused, who of course can exercise their Fifth Amendment rights to refuse. And the government won't be able to go around them and get the device vendor to unlock it. But companies facing regulatory sanctions already don't have these rights.

cromwellian 11y ago
Thank you, I think this is a much clearer argument for how to proceed and how to address transparency required in business and satisfies some of my concerns. I think we may need additional regulations for the political class however. Government communications need to be secure, but I think being a politician abdicates some privacy rights, and IMHO, if you are an elected representative, you either must use some kind of key escrow, or, you must be able to provide access to your communications under warrant, and if you fail to do so, it's grounds for impeachment. The risk of collusion between politicians and industry is too great IMHO.
- neltnerb 11y ago
  Yes, that would be a lovely outcome. Everyone gets to keep normal functional encryption, but employees (especially Senators) have to provide a backdoor key to their employer to use it for work..