6 ms·

It really is amazing to me that anyone thinks it's reasonable policy to ban end-to-end encryption. For the sake of national security, I would want to strengthen

It really is amazing to me that anyone thinks it's reasonable policy to ban end-to-end encryption. For the sake of national security, I would want to strengthen the security of digital data, not weaken it.

AlgorithmicTime 6y ago
Can't spy on your populace if they're end-to-end encrypted.
bayindirh 6y ago
As far as I understood, the problem stems from the Crypto AG era. Governments are addicted to be able to listen to communications of everyone and don't want to lose their toys. Also, EU is far more advanced in terms of invisible security so, they don't want to lose the tools which enable them to do it. We need to re-think security and people are lazy about it because, it's hard. Edit: My English gets a hit when I'm low on caffeine, hmm...
- scottisbrave84 6y ago
  In no way whatsoever is the eu far more advanced at anything at all. U are either a robot for them or some paid product placement. Go away eu
- bem94 6y ago
  What is meant by "invisible security"?
  - numpad0 6y ago
    Perhaps security as in national security, and invisible as opposed to clear military presence? IOW, espionage?
  - DyslexicAtheist 6y ago
    it is usually used in reference to the customer, but in a natsec/cyber context can also mean the citizen[1]. https://www.routledge.com/Handbook-of-Surveillance-Technologies/Petersen/p/book/9781439873151 https://www.routledge.com/Handbook-of-Surveillance-Technolog...
  - bayindirh 6y ago
    Disclaimer: This is my experience from many short travels to EU countries and having a lot of friends due to job network (my work promotes a lot of friendly work connections from many EU countries. As a whole, we work hard, we play hard). Europe has a philosophy of "feeling peaceful". Police, intelligence, surveillance, etc. is not done openly, on your face. Instead it flows just beneath the surface. There are a lot of civilian officers around and police officers are not very visible. Same for borders and higher security places like airports. If there's something suspicious happening, the concentration is increased invisibly. If something really happens, the area is silently surrounded like a python death hugs its prey, and it's over. This is possible with intelligence and surveillance, communications sniffing, etc. If you increase encryption, there's a risk of blinding security services. You may need more overt operations are much more manpower to keep tabs on everything. I'm an encryption proponent. I support it with all my being. Also, I'm aware that being able to see everything can and is being abused. However, I need to be a realist here: We're addressing the wrong problem here. Is encryption required? Undebatably yes. Do everyone has a right to privacy? Undebatably yes. Do we want to be secure and need security services? Possibly yes. So, we need to solve the problem of security with the presence of encryption. I.E. Security in a past-encryption era. The no-encryption ship has sailed. Trying to bring it back with the force of law is a last ditch effort. We need another solution to allow security services to their job with the presence of encryption, and without weakening it. I do not accept someone can just read my office messages or conversations with my family just because somebody may be trying to make a bomb or planning an uprising.
amelius 6y ago
Can't we have E2EE+G? (end-to-end encryption, plus government can see everything) Not saying this is a good idea, though.
- bayindirh 6y ago
  Welcome to 1998 aka "The Clipper Chip"[0] Also: We know how CSS, BluRay Master Keys, TSA Keys and other various signing keys fared in the wild. [0]: https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip
  - jjoonathan 6y ago
    Don't forget the OPM hack! The spooks compiled a self-blackmail database and couldn't even keep that secure. Yikes.
- danarmak 6y ago
  Yes, by giving the government access to one or both of the end devices. (Which is probably already a thing somewhere legally, and very likely is the factory state for some Android phones.) Note that banning E2EE implies banning encrypted p2p communications entirely. E2EE is a concept that applies only to centralized comms providers where all messages go through a server. Practically speaking, it's impossible to ban every encrypted protocol (TLS, SSH, ...). It's also (probably) impossible to ban IP communications that don't have an "approved server" participating. However, comms providers / social networks to date at least manage, authenticate, and introduce users at the serverside. Fully distributed projects have problems with spam. So governments would have to ban comms providers from "allowing" their clients to talk to each other directly and not via the backend. That's a hefty technological restriction, which would block a wide range of protocols (webrtc/SIP, torrents, probably a bunch of other Very Important things I'm not thinking of right now).
- christophilus 6y ago
  If you allow the +G, you allow hackers. It's as simple as that. If you want security, you can't have backdoors.
koonsolo 6y ago
It's a trade-off. Of course I want to preserve my privacy. But I get it that law enforcement wants to be able to look into communications. Let's say they find a terrorist (I'm close to Brussels, so not a hypothetical scenario here). Best case you want to see which phones they have, and look into all their communication to get an idea about their contacts etc. It's a very hard problem, and I'm not sure which one I would pick.
- chokeartist 6y ago
  You're overthinking terrorism investigations. They don't need to be able to defeat crypto. They just need to be able to threaten Muhammad or whomever with 20 years in the clink. Everyone rolls under that pressure. No one is "hard".
- koonsolo 6y ago
  Oof, a lot of downvotes. Can you please explain why it's not a tradeoff, or what else I said wrong?
  - kemonocode 6y ago
    People are probably considering what you said an appeal to emotion, "Think of the terrorists!" being up there with "Think of the children!" in terms of excuses for misguided policies. Governments already have plenty of tools to track down and deal with terrorists if so they wished: a distressingly amount of planning and radicalization is done over clear text in social media, and even in E2EE there's a wealth of necessarily unencrypted metadata you can make use of.
  - tehwebguy 6y ago
    Because there is no trade off, communication is end-to-end encrypted or there is a backdoor.
- ceilingcorner 6y ago
  Or perhaps you figure out why terrorism exists and work towards preventing it, instead of spying on your population and violating their rights “just in case”?
thomaslkjeldsen 6y ago
You claim that somebody thinks it is reasonable policy to ban e2ee. Who is that exactly? Consider this section from the resolution: Striking a right balance The principle of security through encryption and security despite encryption must be upheld in its entirety. The European Union continues to support strong encryption. Encryption is an anchor of confidence in digitalisation and in protection of fundamental rights and should be promoted and developed. Protecting the privacy and security of communications through encryption and at the same time upholding the possibility for competent authorities in the area of security and criminal justice to lawfully access relevant data for legitimate, clearly defined purposes in fighting serious and/or organized crimes and terrorism, including in the digital world, and upholding the rule of law, are extremely important. Any actions taken have to balance these interests carefully against the principles of necessity, proportionality and subsidiarity. See https://data.consilium.europa.eu/doc/document/ST-13084-2020-REV-1/en/pdf https://data.consilium.europa.eu/doc/document/ST-13084-2020-...
- autoditype 6y ago
  No the person you're responding to, but the OP article gives the impression. Either way I don't understand how the text you pasted intends to "strike the balance" when e2ee is present. Either they're talking about backdoors or they're in fantasyland
- extrememota 6y ago
  From the same document. I do not see how this is technically possible. > Technical solutions for gaining access to encrypted data must comply withthe principles of legality, transparency, necessity and proportionalityincluding protection of personal data by design and by default.
  - thomaslkjeldsen 6y ago
    If focusing on e2ee I agree, but how about hardware and software supply chains? How much is your e2ee worth if you are up against Apple or Google? Perhaps nation states are simply looking for similar powers?
- 6y ago
simonh 6y ago
Weakening the security of commercial communications and financial transactions would be a serious economic risk. National cyber security agencies should treat it as a primary responsibility to help businesses secure their communications in order to harden our economies from attack. They should be part of the solution, instead of intently beavering away at being part of the problem.
piokoch 6y ago
Exactly, and that only means that people behind anti-encryption regulations does not care about national security. Or they are so painfully incompetent that they don't understand that it is much better if one cannot figure out that some military officer or energy sector/government employee has a lover since such person could be blackmailed by foreign intelligence. Apparently they don't get that those pesky terrorists can encrypt message by themselves in thousands of ways. Internet is full of information how to do this.

AlgorithmicTime 6y ago

Can't spy on your populace if they're end-to-end encrypted.

bayindirh 6y ago

As far as I understood, the problem stems from the Crypto AG era. Governments are addicted to be able to listen to communications of everyone and don't want to lose their toys. Also, EU is far more advanced in terms of invisible security so, they don't want to lose the tools which enable them to do it. We need to re-think security and people are lazy about it because, it's hard. Edit: My English gets a hit when I'm low on caffeine, hmm...

scottisbrave84 6y ago
In no way whatsoever is the eu far more advanced at anything at all. U are either a robot for them or some paid product placement. Go away eu
bem94 6y ago
What is meant by "invisible security"?
- numpad0 6y ago
  Perhaps security as in national security, and invisible as opposed to clear military presence? IOW, espionage?
- DyslexicAtheist 6y ago
  it is usually used in reference to the customer, but in a natsec/cyber context can also mean the citizen[1]. https://www.routledge.com/Handbook-of-Surveillance-Technologies/Petersen/p/book/9781439873151 https://www.routledge.com/Handbook-of-Surveillance-Technolog...
- bayindirh 6y ago
  Disclaimer: This is my experience from many short travels to EU countries and having a lot of friends due to job network (my work promotes a lot of friendly work connections from many EU countries. As a whole, we work hard, we play hard). Europe has a philosophy of "feeling peaceful". Police, intelligence, surveillance, etc. is not done openly, on your face. Instead it flows just beneath the surface. There are a lot of civilian officers around and police officers are not very visible. Same for borders and higher security places like airports. If there's something suspicious happening, the concentration is increased invisibly. If something really happens, the area is silently surrounded like a python death hugs its prey, and it's over. This is possible with intelligence and surveillance, communications sniffing, etc. If you increase encryption, there's a risk of blinding security services. You may need more overt operations are much more manpower to keep tabs on everything. I'm an encryption proponent. I support it with all my being. Also, I'm aware that being able to see everything can and is being abused. However, I need to be a realist here: We're addressing the wrong problem here. Is encryption required? Undebatably yes. Do everyone has a right to privacy? Undebatably yes. Do we want to be secure and need security services? Possibly yes. So, we need to solve the problem of security with the presence of encryption. I.E. Security in a past-encryption era. The no-encryption ship has sailed. Trying to bring it back with the force of law is a last ditch effort. We need another solution to allow security services to their job with the presence of encryption, and without weakening it. I do not accept someone can just read my office messages or conversations with my family just because somebody may be trying to make a bomb or planning an uprising.

amelius 6y ago

Can't we have E2EE+G? (end-to-end encryption, plus government can see everything) Not saying this is a good idea, though.

bayindirh 6y ago
Welcome to 1998 aka "The Clipper Chip"[0] Also: We know how CSS, BluRay Master Keys, TSA Keys and other various signing keys fared in the wild. [0]: https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip
- jjoonathan 6y ago
  Don't forget the OPM hack! The spooks compiled a self-blackmail database and couldn't even keep that secure. Yikes.
danarmak 6y ago
Yes, by giving the government access to one or both of the end devices. (Which is probably already a thing somewhere legally, and very likely is the factory state for some Android phones.) Note that banning E2EE implies banning encrypted p2p communications entirely. E2EE is a concept that applies only to centralized comms providers where all messages go through a server. Practically speaking, it's impossible to ban every encrypted protocol (TLS, SSH, ...). It's also (probably) impossible to ban IP communications that don't have an "approved server" participating. However, comms providers / social networks to date at least manage, authenticate, and introduce users at the serverside. Fully distributed projects have problems with spam. So governments would have to ban comms providers from "allowing" their clients to talk to each other directly and not via the backend. That's a hefty technological restriction, which would block a wide range of protocols (webrtc/SIP, torrents, probably a bunch of other Very Important things I'm not thinking of right now).
christophilus 6y ago
If you allow the +G, you allow hackers. It's as simple as that. If you want security, you can't have backdoors.

koonsolo 6y ago

It's a trade-off. Of course I want to preserve my privacy. But I get it that law enforcement wants to be able to look into communications. Let's say they find a terrorist (I'm close to Brussels, so not a hypothetical scenario here). Best case you want to see which phones they have, and look into all their communication to get an idea about their contacts etc. It's a very hard problem, and I'm not sure which one I would pick.

chokeartist 6y ago
You're overthinking terrorism investigations. They don't need to be able to defeat crypto. They just need to be able to threaten Muhammad or whomever with 20 years in the clink. Everyone rolls under that pressure. No one is "hard".
koonsolo 6y ago
Oof, a lot of downvotes. Can you please explain why it's not a tradeoff, or what else I said wrong?
- kemonocode 6y ago
  People are probably considering what you said an appeal to emotion, "Think of the terrorists!" being up there with "Think of the children!" in terms of excuses for misguided policies. Governments already have plenty of tools to track down and deal with terrorists if so they wished: a distressingly amount of planning and radicalization is done over clear text in social media, and even in E2EE there's a wealth of necessarily unencrypted metadata you can make use of.
- tehwebguy 6y ago
  Because there is no trade off, communication is end-to-end encrypted or there is a backdoor.
ceilingcorner 6y ago
Or perhaps you figure out why terrorism exists and work towards preventing it, instead of spying on your population and violating their rights “just in case”?

thomaslkjeldsen 6y ago

You claim that somebody thinks it is reasonable policy to ban e2ee. Who is that exactly? Consider this section from the resolution: Striking a right balance The principle of security through encryption and security despite encryption must be upheld in its entirety. The European Union continues to support strong encryption. Encryption is an anchor of confidence in digitalisation and in protection of fundamental rights and should be promoted and developed. Protecting the privacy and security of communications through encryption and at the same time upholding the possibility for competent authorities in the area of security and criminal justice to lawfully access relevant data for legitimate, clearly defined purposes in fighting serious and/or organized crimes and terrorism, including in the digital world, and upholding the rule of law, are extremely important. Any actions taken have to balance these interests carefully against the principles of necessity, proportionality and subsidiarity. See https://data.consilium.europa.eu/doc/document/ST-13084-2020-REV-1/en/pdf https://data.consilium.europa.eu/doc/document/ST-13084-2020-...

autoditype 6y ago
No the person you're responding to, but the OP article gives the impression. Either way I don't understand how the text you pasted intends to "strike the balance" when e2ee is present. Either they're talking about backdoors or they're in fantasyland
extrememota 6y ago
From the same document. I do not see how this is technically possible. > Technical solutions for gaining access to encrypted data must comply withthe principles of legality, transparency, necessity and proportionalityincluding protection of personal data by design and by default.
- thomaslkjeldsen 6y ago
  If focusing on e2ee I agree, but how about hardware and software supply chains? How much is your e2ee worth if you are up against Apple or Google? Perhaps nation states are simply looking for similar powers?
6y ago

simonh 6y ago

Weakening the security of commercial communications and financial transactions would be a serious economic risk. National cyber security agencies should treat it as a primary responsibility to help businesses secure their communications in order to harden our economies from attack. They should be part of the solution, instead of intently beavering away at being part of the problem.

piokoch 6y ago

Exactly, and that only means that people behind anti-encryption regulations does not care about national security. Or they are so painfully incompetent that they don't understand that it is much better if one cannot figure out that some military officer or energy sector/government employee has a lover since such person could be blackmailed by foreign intelligence. Apparently they don't get that those pesky terrorists can encrypt message by themselves in thousands of ways. Internet is full of information how to do this.