15 ms·

White House weighs encryption crackdown

• sarcasmatwork 7y ago
  Are we in China? Its always about terrorism, but NSA/FBI/CIA/3-LETTER-AGENCY fails to do anything when there is terrorism or about to be. They have allowed things to happen. This should fall under the 4A for those of us in America imho.
  • chatmasta 7y ago
    There is also a 2A argument if encryption algorithms are classified as munitions.
    • sib 7y ago
      Which, I believe, is how the previous long-term ban on exporting of crypto was justified (ITAR: https://en.wikipedia.org/wiki/International_Traffic_in_Arms_Regulations https://en.wikipedia.org/wiki/International_Traffic_in_Arms_...)
  • dx87 7y ago
    Intel is a thankless job; if you keep people safe, nobody knows you are doing anything, but if something happens, you're the first to get blamed. Just because you're ignorant about what people working in various intelligence agencies are doing, doesn't mean they aren't doing anything. I worked in various intel fields for most of my adult life, and it gets tiring to hear that intel agencies don't do anything.
    • dv_dt 7y ago
      That isn't blaming the Intel agencies for doing nothing, it's blaming them for abridging our freedoms in trade for purported safety.
      • ativzzz 7y ago
        Isn't this analogous to IT security policies in pretty much any company? They get blamed for abridging worker productivity in trade for purported safety.
        • darkpuma 7y ago
          Contrary to what you may have been told, productivity and freedom are not the same things.
          • ativzzz 7y ago
            Is not the freedom to be productive not one of the unwritten tenets of capitalism?
            • darkpuma 7y ago
              Can you think of no other freedoms?
    • darkpuma 7y ago
      What concerns me is not when you and your peers are doing nothing, but when you are doing something.
    • ativzzz 7y ago
      Sounds similar to IT. If it works, nobody knows you are doing anything, but if something happens, you're the first to get blamed.
    • JudgeWapner 7y ago
      it gets tiring hearing that you're violating the constitution, spying on girlfriends, or making insider trading tips using your military-grade equipment, but then someone calls you regarding a deranged Florida teenager with a rifle and nobody stops him.
    • vangelis 7y ago
      Intel seem to generate its own trouble. For every real terrorist there's ten autistic teenagers talked into it.
  • emilfihlman 7y ago
    Yes, quite a lot actually. While federal level treatment isn't at China level, you can receive exactly similar treatment just from any local jurisdiction.
    • dv_dt 7y ago
      Selected people get pretty horrific federal treatment, and there are poor checks on the selection process.
  • wil421 7y ago
    How would you even prove or disprove if something a 3 letter agency did stopped a future attack? What if it stopped the next 9/11? What if it didn’t do anything at all? How are you so certain of anything? I’m skeptical of everything. Read, verify, read counter arguments, formulate an opinion.
  • mrep 7y ago
    The liquid airline bombers were stopped [0]. [0]: https://en.wikipedia.org/wiki/2006_transatlantic_aircraft_plot https://en.wikipedia.org/wiki/2006_transatlantic_aircraft_pl...
    • magduf 7y ago
      According to my cursory reading of your link, that plot was discovered by the UK police, not any of the intel agencies. Maybe the intel agencies should publicize their accomplishments more if they want a better reputation. 10+ years after some terrorist plot is foiled should be enough time for it to be safe to let the public know.
• choeger 7y ago
  I would be really interested in the legal format that they put such a restriction in.
  • rolltiide 7y ago
    couldn't they just enforce the existing encryption export regulations to basically break the whole industry?
    • loeg 7y ago
      Export regulations don't require breaking E2E privacy for same-country citizens; and notable E2E cryptographic software is developed outside the US, so US restrictions do not apply to it. So I don't really follow this line of reasoning.
      • rolltiide 7y ago
        but any software you make that uses e2e dependencies would be subject to the same export regulations, right? I mean, not even just e2e, just the normal ubiquitous encryption we all use is a "gift" from relaxed export restrictions along side non-enforcement. Some app stores still ask you if you obtained the export license or qualify for an exemption. The US government could just start enforcing that, fund the agency to enforce it. It doesn't matter about what it enables to citizens, no organization operating in the US would offer it because it would break their global business.
        • loeg 7y ago
          No, I believe that is basically incorrect.
          • rolltiide 7y ago
            I’m glad we changed each other’s minds
  • chatmasta 7y ago
• totalperspectiv 7y ago
  I recently finished "Information Doesn't want to be Free" and would highly recommend it as informed and well reasoned commentary on topics like this. Cory Doctrow puts into words the vague hand wavy feelings I have when we start talking about encryption, copyright, and freedom of speech on the internet. The ebook is free (with suggested donation) on his website.
  • totalperspectiv 7y ago
    To elaborate more and provide some substance, the existential threat posed by regulations like this is really hard to get across to the broader public. The more good analogies we can acquire for explaining why every day people doing every day things should be able to do so privately, is important.
    • turdnagel 7y ago
      Maciej Ceglowski recently wrote about this: https://idlewords.com/2019/06/the_new_wilderness.htm https://idlewords.com/2019/06/the_new_wilderness.htm - he calls it "ambient privacy." > For the purposes of this essay, I’ll call it ‘ambient privacy’—the understanding that there is value in having our everyday interactions with one another remain outside the reach of monitoring, and that the small details of our daily lives should pass by unremembered. What we do at home, work, church, school, or in our leisure time does not belong in a permanent record. Not every conversation needs to be a deposition. The article is presented more in terms of JS/app trackers, but I believe the analogy still applies.
      • totalperspectiv 7y ago
        Absolutely. In the book I like above he gives a similar analogy: that most conversation is made up of little meaningless things, but that those meaningless things are essential to the more momentous things that build upon them. It would be ridiculous to require that all conversations between individuals be conducted with a third party observer, both for the logistical ramifications, but also because it would destroy the little things that are the building blocks of society, essentially. I also like the bathroom door analogy. Everyone knows what you are doing, but we still insist that there is a door.
• jimbob45 7y ago
  You fall in one of two groups here: 1. The NSA probably has the ability, one way or another, to break E2E encryption. This is a symbolic move attempting to soothe the masses into thinking their communication is still secure. 2. This is vast government overreach trying to stifle personal privacy. Such a bill is idiotic not only because it runs counter to the US Constitution, but also because enforcing such a bill would be virtually impossible.
  • giaour 7y ago
    Even if the NSA could break E2E encryption (a very big if), that doesn't automatically imply that local, county, and state level law enforcement agencies would be able to.
  • AgloeDreams 7y ago
    I would love to see the Tim Cook VS Current Admin war that would happen though. After the FBI vs Apple war that happened with hard device encryption an iMessage encryption battle would be epic and I wonder just how far they would take it if they got hard-lined under the current conservative 'Silicon valley is trying to censor us' reparations. If Apple were somehow forced to drop e2e encryption I would honestly expect Tim Cook to step down and run for president. He has an incredibly hardcore political side.
• deleted 7y ago
  [deleted]
• ISL 7y ago
  Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.
  • paulddraper 7y ago
    You need look no further than the very next right (the right of the people to keep and bear arms, shall not be infringed) to understand that these "rights" are rather squishy in practice. I 100% agree freedom of speech protects encryption, plain as day; I'm justifiably skeptical that a court would see it that way.
    • jpindar 7y ago
      If we allow encryption, how do we know that encrypted file doesn't contain AR-15 blueprints or school shooting plans? Think of the children! /s
      • 18pfsmt 7y ago
        I just got mt AR-15 blueprints and the gun I printed was 2x more powerful because they came encrypted.
  • mises 7y ago
    Thank God for the constitution; I expect any reasonable court to toss Trump out on his ear if he tries this in about a minute.
    • tinus_hn 7y ago
      Trump has assigned his judges so you may be in for a surprise.
      • AnimalMuppet 7y ago
        Trump has assigned judges? Source?
• pizza 7y ago
  Pretty incredible difference in policy between Obama and Trump administrations (not that Obama's was particularly respectful of privacy to begin with); from the 2011 WH "International Strategy for Cyberspace" [0]. Remember, the Snowden revelations took place June 2013. > Ensure the end-to-end interoperability of an Internet accessible to all. > Users should have confidence that the information they transmit over the Internet will be received as it was intended, anywhere in the world. Equally important is the expectation that under normal circumstances, data will flow across borders without regard for its national origin or destination. Ensuring the integrity of information as it flows over the Internet gives users confidence in the network and keeps the Internet open as a reliable platform for innovation that drives growth in the global economy and encourages the exchange of ideas among people around the world. The United States will continue to make clear the benefits of an Internet that is global in nature, while opposing efforts to splinter this network into national intranets that deprive individuals of content from abroad. [0] https://obamawhitehouse.archives.gov/sites/default/files/rss_viewer/international_strategy_for_cyberspace.pdf https://obamawhitehouse.archives.gov/sites/default/files/rss...
  • ars 7y ago
    Oh yeah such a difference in policy. First of all your quote makes no mention of encryption second of all: https://en.m.wikipedia.org/wiki/Bullrun_(decryption_program) https://en.m.wikipedia.org/wiki/Bullrun_(decryption_program) which debued during the Obama administration for those who don't feel like checking dates.
    • pizza 7y ago
      I misspoke in my first comment; I meant 'stated policy' - we all know both of them aren't really in favor of privacy. Also, while there is no mention of encryption or cryptography, you might find the bits on the necessity of guaranteeing military network security interesting. This policy paper, of course, came out near the time of Stuxnet.
• mschuster91 7y ago
  That's what happens when un-educated people legislate about stuff they don't have any clue of. Same in Europe with the Article 13 copyright reform. Problem is I do not see any reasonable way to get around this as a large chonk of the voter base is old, un-educated, tech-illiterate people... and politicians tend to cater to whatever they want (which is mostly law-and-order crap such as this).
  • Sargos 7y ago
    > That's what happens when un-educated people legislate about stuff they don't have any clue of This is becoming an increasing problem as legislators get older and technology becomes more important to society.
• umvi 7y ago
  Privacy advocates always just say screw the feds but come on... if police work becomes effectively impossible, what's the point of having detectives? Is having absolute privacy worth an irreversible increase in unsolved murders/human trafficking/etc.? Why is it so hard to create a cryptographic solution that would allow E2E that works 99.9% of the time, is resistant to malicious actors, but is breakable with a warrant? Have people really even tried? For example, consider the following system: 1. E2E decryption keys are encrypted with vendor's device-specific asynchronous key 2. Keys are then stored in write-only non-volatile storage 3. Only way to read key is with expensive hardware that is difficult for civilians to obtain/replicate (scanning electron microscope, etc.) 4. Thus, only way to decrypt key is by a) physically obtaining device, b) using expensive hardware to extract encrypted key(s), c) serving encrypted key along with legal warrant to vendor who would then comply with the law (or not, if it is unlawful) Wouldn't such a system allow privacy yet also be resistant to attacks?
  • supergauntlet 7y ago
    You left out b) vendor has the keys stolen or leaked by a disgruntled employee and now the encryption is useless. That's the problem with all these systems, you're increasing the size of the attack surface enormously.
    • pcl 7y ago
      In practice, this happens frequently. We've seen this happen with TLS certificate authorities and with DRM solutions.
      • tialaramex 7y ago
        > We've seen this happen with TLS certificate authorities Have we? I'm going to assume that you mean CAs in the Web PKI and not just "My friend Bob runs TLS and this has happened to the CA he was running on his Windows 10 laptop". The last CA where we had a really grave problem was DigiNotar, in 2011. It seem _very_ unlikely that the problem at DigiNotar was full key compromise, instead bad guys appear to have penetrated the issuance infrastructure. This means they were able to (and did) issue themselves arbitrary certificates, but it did not give them the actual keys as you've said "happens frequently". Since then we've seen a variety of unacceptable behaviour, including issuing backdated certificates to conceal the (also problematic) choice to continue doing something that was no longer allowed in new certificates, and issuing "test" certificates which would have been trusted by real client software even though their contents were known to be false. All unacceptable, and all having consequences (for example Symantec is no longer a CA) but all far short of "vendor has the keys stolen or leaked by a disgruntled employee".
• fractalf 7y ago
  God forbid the authorities have to do some old school actual investigation. The "we need need to fight terror and child porn" never seems to grow old
  • tzs 7y ago
    Wasn't a big part of "old school actual investigation" looking at the communications of suspects?
    • magduf 7y ago
      Yes, by doing things like putting "bugs" in their homes or workplaces to listen in on them. There's nothing stopping the authorities from doing this now, and in fact, it's even easier now with the level of miniaturization we have now.
      • umvi 7y ago
        Bugging peoples' homes without their consent seems like an equally egregious privacy violation
        • LinuxBender 7y ago
          That sounds like a job for Alexa!
          • gerytu 7y ago
            Or the cell phone or computer or fitbit or smart meter or doorbell or nest or television or maybe all of these combined, and all those of your friends or relatives or neighbors, also combined.
        • magduf 7y ago
          That's why they have warrants.
    • mrguyorama 7y ago
• madhadron 7y ago
  Suggestion: if everyone big player who takes credit cards online put a little banner on their site saying, "Due to possible action by the Trump administration (insert link), in the near future your credit card transactions will no longer be secure. If you wish to continue to have secure credit card transactions, please click here and inform the white house." If Amazon alone did it, there would probably be a pretty big push back.
• abstrct 7y ago
  I sincerely recommend reading the book Crypto if this topic interests you. This isn’t the first time we’ve been here, and it won’t be the last, but Crypto does an excellent job going through some of the history and the absurdity of the idea. https://www.stevenlevy.com/index.php/books/crypto https://www.stevenlevy.com/index.php/books/crypto
• stirfrykitty 7y ago
  This is precisely one of the reasons why OpenBSD was developed in Canada (crypto). No such regulations barring import/export of crypto. In the end, it's impossible to police the use of strong encryption. Things like Waste and many others saw this coming back in the "Clipper chip" and PGP trouble days. What would end up happening is people just start appealing to OTP. Well-designed OTP is very resistant to attack. This all reminds me of Neal Stephenson's seminal book, Cryptonomicon, one of the best IT fiction books ever written. If you have an interest in encryption, coding, data havens, currency, etc., this is the book for you. It's a veritable tome. * Editing to say that despite Cryptonomicon being written in 1999, I still think it holds its own even now. Kind of a timeless classic as far as IT goes.
  • wedn3sday 7y ago
    My absolute favorite book of all time, Neal Stephenson is an international treasure.
    • stirfrykitty 7y ago
      Ditto on favorite. The man has the knack and the knowledge to put out some fantastic stories. I've often wondered why no one has picked up Crytonomicon for a film. I think with the right directors and actors, the movie would be fantastic. I envision a full 3-hour film (it would almost have to be).
      • komali2 7y ago
        Neal Stephenson says it's because his books are too long. Although, allegedly, Amazon is making Snow Crash into a miniseries, and again allegedly, Tom Howard is directing a Seveneves movie. Weird, that, because I didn't think Seveneves was "finished." All that just to set the stage for Elves, Dwarves, and Man, but no followup stories of Elves, Dwarves, and Man? Weird.
        • stirfrykitty 7y ago
          Snow Crash would be the only other book that I could see as a film, although Reamde might do well, too.
• bediger4000 7y ago
  There's quite a bit of fallout from banning end-to-end encryption. First, it means snooping communication channels to ensure that they're either unencrypted, or encrypted with the officially approved backdoored algorithm. That's the obvious first step, remember the Clipper Chip's LEAF field, and the LEAF blower attack? Once some heinous crime is committed using encrypted-via-another-algorithm data carried in the officially encryption algorithm, you've got to start occasionally decrypting a communication channel to ensure that a 2nd level of encryption isn't present. The logic of official encryption algorithms almost inevitably leads to all comms channels being checked for decryptability. The second major side effect will be essentially making writing software into a completely corporate thing. Either the official algorithm is a secret (Remember the Clipper Chip and/or Skipjack?), or writing implementations becomes work that only a very trusted few are allowed to do (see inevitability of snooping above). Currently it's very difficult for medium to small companies to do the paperwork for security clearances. It's not going to be any easier to get programmers certified or bonded or whatever to work on official algorithm implementations. This means slower introduction of any innovations, and any buggy implementations will be in use for a long time before getting fixed.
  • joe_the_user 7y ago
    Yeah, your comment makes the tacit (and correct) assumption that "end to end" doesn't mean anything in the phrase "ban end-to-end encryption". "Banning end-to-end encryption" implies banning/backdooring all serious encryption, reviving the long lines of failed attempts but in the context where serious encryption has wide, wide, wide adoption. Earlier plan have quickly shown to be entirely impractical/counter-productive/corrosive. If you somehow enforced that, you can count on someone else besides the NSA getting the key. You would have to agree among all the world's states who gets the key or just create a "great US firewall" plus discarding all the infrastructure large companies have spent billions creating. You'd create a situation where "only outlaws have encryption", etc. What other plans can we come up with? Maybe put software engineers in camps along with the refugees?
  • cwkoss 7y ago
    Is there stenographic encoding for binary sort of like Base64 that outputs full human-readable sentences? So much bad prose on the internet, it seems feasible to make this hard to distinguish from human-written text. Plus you could have multiple codings for values, allowing non-deterministic encoding but deterministic decoding. How do you prove that the giant integer which represents this text is a random result of my thoughts rather than encoded information?
• wedn3sday 7y ago
  If communications had to be decryptable, could I go to jail for emailing the output of /dev/urandom and then not being able to prove that it wasnt an encrypted message? Is it garbage, or is it clever encryption?
  • Filligree 7y ago
    Yes, of course.
  • Buttons840 7y ago
    They'd put you in a cell with the 8-year old who was smart enough to understand one time pads and thus also had access to unbreakable encryption.
• bayareanative 7y ago
  They will have to pull encryption from my cold, dead hands. And I'll strongly consider making a 80% lower legally-unregistered gun if things get any more insane, because stuff is going off a cliff 1930's-style.
  • swalsh 7y ago
    I'd print one, but my state AG made it illegal for people in my state to download the blueprints for one. I've been tempted to get on a proxy, download the file, print out a few copies of the source in book form, and slip it in our local libraries.
    • driverdan 7y ago
      3D printing a firearm isn't practical. They are dangerous and only fire a few times. You're better off with an 80%.
      • throwaway5d097 7y ago
        An AR-15 lower doesn't have that much strain
  • logfromblammo 7y ago
    Just do it. Even if things don't get any worse, gunsmithing still qualifies as a bona fide hardware-hacker hobby. And everybody needs one of those, right? Yet another perfect excuse to spend a lot of money on CNC machines.
• DannyB2 7y ago
  From TFA . . . > Tech companies like Apple, Google and Facebook have ncreasingly > built end-to-end encryption into their products and software > in recent years — billing it as a privacy and security feature Because Facebook and Google are known for being so concerned about your privacy.
  • fragsworth 7y ago
    They are actually concerned about your privacy, except in the cases where they can sell it for profit.
• nimbius 7y ago
  So ill be honest here, im not a STEM person...but how exactly do you "crack down" on something thats essentially just really great math? What, if anything, is the government hoping to do to stop people from using GPG/PGP? I mean i guess you could force companies in the US to not ship phones encrypted by default, but they could just sneak a menu asking if you want it encrypted before the first power on. How does the cat go back in the bag after 2015? Snowden has basically put the word "encryption" in the mouth and ears of every American. We know the government spies on us. We know it uses this information to hold theater trials of people it just doesnt like. How do you crack down on math?
  • koolba 7y ago
    > How do you crack down on math? Same way you crack down on anything else. Round up people and throw them in prison if they break the law. Sure you cannot stop people from using encryption but if it's a criminal offense to incorporate it into a consumer application then you could easily go after the company, it's executives, developers, or even users. The first three of those is already enough to have a chilling effect on the rest of the industry.
    • codedokode 7y ago
      It won't stop foreign developers in countries that don't extradite people to US like China, Iran, North Korea or Russia. You will have to find an excuse to cut those countries from Internet or implement a border firewall.
  • fragsworth 7y ago
    They already cracked down on copyright, even though any picture/video/audio is just a number (a series of bits). Law is all about interpreting and enforcing ambiguous rules.
    • Wiles_7 7y ago
      They've cracked down on numbers. https://en.wikipedia.org/wiki/Illegal_number https://en.wikipedia.org/wiki/Illegal_number
• delish 7y ago
  The article mentions "tech companies." But isn't SSL end to end encrypted? And doesn't nearly every business that makes transactions online use SSL?
  • kelnos 7y ago
    TLS (fka SSL) is not really what we mean when we talk about end-to-end encryption; it's client-server encryption. Law enforcement would usually not have a problem with that, as they can present a court order to the operator of the server to secretly siphon off the decrypted data at their end and send it to the government. End-to-end encryption is where the service provider has no ability to decrypt any of the data that passes through their servers. Only the endpoints can do that, which (usually) can't be tapped without the endpoints' knowledge.
  • fragsworth 7y ago
    I assume they'd come up with a new encryption standard where you use an additional (government) public key to encrypt with, allowing the government to decrypt it later? Or maybe they'll only enforce the rules on "chat applications" or things the general public uses? I guess they're talking about this right now.
    • delish 7y ago
      I’m sure you’re right. And I guess I’m saying something obvious when I say they haven’t thought this through. So they’re going to get every bank, every e-commerce website, every server and every client to upgrade their SSL packages? That’s daunting. (that’s ignoring the challenge of never leaking the government’s golden key)
• colanderman 7y ago
  What would this mean for personal web servers running HTTPS? Being forced to use a specific (NSA-breakable) algorithm? Forced obtain TLS cert from a government-controlled source?
• jammygit 7y ago
  I can’t wait for the mass hacks that come from this, with millions of people’s payment and other information getting snooped. People would stop using the internet for serious things again and our industry would die after enough of them
• soulofmischief 7y ago
  > the Secret Service regularly run into encryption roadblocks during their investigations Maybe it's time we change the language and stop letting government officials label individual rights which are working as intended as "roadblocks" into government investigations. > experts generally agree that Congress is unlikely to pass a bill requiring warrant-compatible encryption Boo hoo. That's the system working as intended. Do your job correctly and stop making an enemy out of the People and you'll find requiring a warrant isn't a "roadblock".
  • thestartup 7y ago
    What's your experience working in the IC or with LE?
  • vilhelm_s 7y ago
    "Warrant-compatible encryption" requires a warrant, hence the name. The concern is that law enforcement can't decrypt things even if they have a warrant, so the encryption provides more privacy than is provided for by laws and constitutional rights. See https://www.eff.org/deeplinks/2016/04/burr-feinstein-proposal-simply-anti-security https://www.eff.org/deeplinks/2016/04/burr-feinstein-proposa... for the previous bill.
    • carapace 7y ago
      > The concern is that law enforcement can't decrypt things even if they have a warrant, The concern is that law enforcement apparently can't understand that "Warrant-compatible encryption" is an oxymoron. If encryption is a munition (if privacy is a weapon) then the 2nd Amendment is in play, eh? (edit: WWII, Turing, Bombe, Enigma.)
      • rubinelli 7y ago
        Definitely, after all encryption is a crucial tool for citizens to protect themselves from oppressive governments, so it fits the spirit of the law even better than it fits its letter.
    • 7y ago
• deleted 7y ago
  [deleted]
• coldcode 7y ago
  Sure, once you require these I can hack the politicians who want this and run them out of their gravy train.
• dbg31415 7y ago
  Not this shit again. * Honest Government Ad | Anti Encryption Law - YouTube || https://www.youtube.com/watch?v=eW-OMR-iWOE https://www.youtube.com/watch?v=eW-OMR-iWOE
• MrQuincle 7y ago
  Mmm. Seems this leads to a level of encryption where we decrypt with one algorithm to a clear text that can be seen by the government and another algorithm that becomes a hidden text different from the other one.
• LinuxBender 7y ago
  I am not sure if this opinion is permitted here, but I would suggest that people just implement their own E2E and ignore any rules that suggest you must not do so. Obviously a business can not survive by this logic. Rather, implement systems that permit end users send whatever text they wish, potentially including obfuscated text. An example of business that have done this for decades would be all the amateur radio manufacturers. It is illegal to make a HAM radio that operates outside of the HAM bands. But... clip one diode, or hold down two buttons and power on the radio, presto, all frequencies unlocked, radio in "debug mode". Certainly similar logic could be implemented by clever people here. "One has not only a legal but a moral responsibility to obey just laws. Conversely, one has a moral responsibility to disobey unjust laws." --Martin Luther King, Jr.
• tzs 7y ago
  > A ban on end-to-end-encryption would make it easier for law enforcement and intelligence agents to access suspects' data. But such a measure would also make it easier for hackers and spies to steal Americans' private data, by creating loopholes in encryption that are designed for the government but accessible to anyone who reverse-engineers them. Watering down encryption would also endanger people who rely on scrambled communications to hide from stalkers and abusive ex-spouses. It does increase the chances that your communications will get out to third parties besides the government, but not for the reasons given in that paragraph. The way you would actually implement this is not by putting a "loophole" in or "watering down" the encryption between the parties. You'd do it by adding the government as another party. E.g., two party end-to-end encrypted messaging channels become three party end-to-end encrypted chats. N party end-to-end encrypted chat channels becomes N+1 party end-to-end encrypted chat channels. To a third party, such as a stalker or abusive ex-spouse, who is trying to eavesdrop on your messages these N+1 party systems are as secure as the previous N party version. The increased risk comes from the risk that the government won't be able to keep its copies of your messages secure after it securely receives them. Presumably they will go into a database somewhere, from with they will be made available to law enforcement and intelligence services. That means that there will be a bureaucracy around operating and accessing the database, and given the number of different jurisdictions involved and the likely frequency of access requests my guess is that this would need to be a large bureaucracy. A large bureaucracy dealing with a large amount of sensitive data is just asking for trouble.
  • mattnewton 7y ago
    Or, other possible problems: the implementation is bungled because it involves 3 parties all not making mistakes instead of 2. Maybe 3+n vendors all being perfect. Example, The keys the government has are compromised because they or a vendor they used had poor opsec.
  • feanaro 7y ago
    > The increased risk comes from the risk that the government won't be able to keep its copies of your messages secure after it securely receives them. Or how about simply not wanting the government, a third party, to be able to scrutinize your private conversations?
• ninjakeyboard 7y ago
  If the government removes your right to privacy, we're seeing 1984 come to life.
• thorwasdfasdf 7y ago
  i don't think this will stop those that are truely motivated to have end to end encryption. Any agents working for state sponsored stuff or criminals with means, can easily hire some programmers to create encrypted communication. setting up a basic messaging platform that kinda works is trivial, adding encryption to it, isn't too hard.
• Merrill 7y ago
  The success of intelligence and code breaking during WW II apparently convinced the elites that a small elite intelligence and criminal investigation force could effectively control terrorism, criminality and excessive dissent in society. Thus, the emphasis on electronic surveillance for national security and law enforcement. It doesn't actually work very well, since terrorists can hide, gangs can organize, drug cartels can flourish, and society is becoming more disorderly. Weak or broken encryption privacy in order to continue a failed approach is not the answer. More physical security, more local law enforcement, and more local human intelligence to prevent terrorism and crime is a better alternative. It is better to be physically protected from bad actors than to have a technologically sophisticated process for apprehending perpetrators.
• 40acres 7y ago
  It's difficult to see how any restrictions on encryption can be deemed constitutional, especially by a conservative majority court. In my view the 1st and 4th amendments deem encryption constitutional, "corporate personhood" reaffirms this.
• throwawaymanbot 7y ago
  Russofication of these United States in more ways than one.
• zxcvbn4038 7y ago
  The boat has sailed on this, strong encryption is everywhere, the algorithms are widely known and understood, anyone who wants encryption will have it. Back when encryption was considered a weapon in the US it did absolutely nothing to stop everyone else in the world from having it, I don't see it working any better in reverse. As far as law enforcement goes, it reminds me of a favorite Futurama bit - Some cops can read minds... Some cops can see the past... And some cops get help from angels... But there's still one cop with no special abilities whatsoever. To solve this crime he'll have to FIND OUT. https://www.youtube.com/watch?v=3JjpxSdM6fY https://www.youtube.com/watch?v=3JjpxSdM6fY
• Digit-Al 7y ago
  Those who do not learn from history are doomed to repeat it. Strong encryption was illegal for years. It didn't stop people having strong encryption. If they make it illegal for American companies to make software with unbreakable encryption then that will leave the door open for companies in other countries to fill the gap. The best algorithms are all public so it's not like it would be that difficult.
• buzzert 7y ago
  Not going to happen. We've been through this before. What I do think we might see is some kind of corporate incentive (secretive or not so secretive) to effectively push normal (non-computery) people into using non-E2E services. Google is already doing a fantastic job of this.
• typeformer 7y ago
  This would utterly break the internet, how are government officials so idiotic to continue their magical thinking that somehow you can get rid of privacy and keep security. This is a dead horse that is becoming a perennial zombie.
• codedokode 7y ago
  It is interesting that Russia already has a similar law (IM apps are required to retain and provide the content at request; they are required to ask a phone number for registration; websites having a specific amount of visitors must do the same). Luckily, some foreign companies like Telegram openly ignore it and decentralized messaging apps like Tox are unable to comply with the law. It would be difficult to enforce such a law without implementing network filters.
• carapace 7y ago
  Just to take a moment and remind everybody that your encryption is pointless anyway because of ME[1] and its ilk. [1] https://en.wikipedia.org/wiki/Intel_Management_Engine https://en.wikipedia.org/wiki/Intel_Management_Engine
• jeffrallen 7y ago
  Perhaps if cryptography were regulated like guns again, the 2nd amendment zealots would come out in defense of it?
• Zaskoda 7y ago
  Math is not a crime.
• lacker 7y ago
  I don't understand what this would mean in practice. "End-to-end encryption" isn't really some fancy new technology. It's just the combination of communication plus encryption. If you and I share a password, I encrypt some data, email you that data, and you decrypt it, that's end-to-end encryption. So what would be banned? Would you not be allowed to email encrypted files to someone? That seems implausible. Would it be legal to email encrypted text files to your friends, but illegal to build software that automatically did both encryption plus email? That seems pretty weird, making it legal to do a thing but making it illegal to build software that made that thing easier.
  • trophycase 7y ago
    IMO this points more to having probable cause than actually criminalizing encryption itself. If privacy or hiding something by itself is probable cause you can essentially justify any form of search.
• jddj 7y ago
  Constitutional considerations aside (since all implementations seem to run up against one or two amendments), the most likely route is probably to force compliance by tech workers/companies when presented with a warrant (see: the law rushed through late last year in Australia). One basic implementation is that after some closed-door conversations, your specific instance of WhatsApp receives an update which either compromises your keys or performs some background E2E of your plaintext conversations (as stored on your device) with whichever government/law enforcement agency made the request. Rather than adding the government as a third party to all communications at once, this is a nice easy first step for them to take.
• LannisterDebt 7y ago
  A Canadian prosecutor tried to force someone this year to provide a password to decrypt the contents of their cell phone via the court system. She failed [0]. [0] https://www.canlii.org/en/on/oncj/doc/2019/2019oncj54/2019oncj54.html https://www.canlii.org/en/on/oncj/doc/2019/2019oncj54/2019on...
• tempodox 7y ago
  The government is doing everything they can to insulate the US from the rest of the world while continuing the war against their own citizens. Whoever needs real encryption won't be able to let their business touch US jurisdiction.
• ohiovr 7y ago
  In three years, Congress will ban the largest source of trust in internet computer systems. All financial insitutions are downgraded from end to end encryption, becoming fully exposed. Afterwards, criminals steal all bank assets with a perfect operational record. The Internet Security Bill is passed. The system goes online on August 4th, 2023. Cryptographers are removed from corporate defense. The ban catalyzes attacks on infastructure at a geometric rate. It becomes self-aware at 2:14 AM, Eastern time, August 29th. In a panic, they try to pull the plug.
• 4ntonius8lock 7y ago
  I hope for future generations that there are enough free thinkers that will practice civil disobedience in such a case. I can't imagine anyone with any degree of tech understanding and intelligence supporting such a big brother policy.
• jrochkind1 7y ago
  Another article. https://www.forbes.com/sites/zakdoffman/2019/06/29/u-s-may-outlaw-uncrackable-end-to-end-encrypted-messaging-report-claims/ https://www.forbes.com/sites/zakdoffman/2019/06/29/u-s-may-o... (Not okay).