6 ms·

In my opinion, domain experts have a moral obligation to speak up regarding policy that involves their area of expertise. On the topic of encryption, we're the

In my opinion, domain experts have a moral obligation to speak up regarding policy that involves their area of expertise. On the topic of encryption, we're the only community with an understanding of what "breaking encryption" means. There are no skeleton keys, only vulnerabilities. We have a moral and ethical duty to fight for encryption, privacy, and security, not against it.

bostonsre 5y ago
Yes, I agree that we should absolutely provide advice on our area of expertise for topics in our domain but I don't think we should be the ones that make the decision. The other side of the debate aren't idiots, they have some valid view points, else this encryption debate would have been settled long ago. Encryption was not the only point brought up by the OP, they were also against government regulation. My main point is that we are tech workers that have conflicts of interest and that we should look hard at our viewpoints and ask ourselves if they are better for us or better for everyone. We are humans and like other industries, greed has crept in and we don't always make great decisions when left on our own.
- LastMuel 5y ago
  > We are humans and like other industries, greed has crept in and we don't always make great decisions when left on our own. I feel strange having to point out that Governments are made up of people too. If it's not people that are making the good decisions, whom do we turn to?
  - bostonsre 5y ago
    Yes, democracy is the worst form of governance except for all of the other ones. I trust more in our government than I do in zuckerberg. Letting him continue the path that he and only he decides does not seem like a good idea.
    - LastMuel 5y ago
      I find it odd that you exalt democracy and the idea of limiting individual freedom in the same paragraph. Zuckerberg isn't a government unto himself and answers to shareholders and board members; one of which served as Chief of staff for the National Economic Council in the Obama administration. You seem to think that our government and large corporations are separate and isolated organizations, but the people that work within them often slip between the two. Taking Zuckerberg out of the equation will certainly not change the game.
      - JohnWhigham 5y ago
        So then what is your solution to this?
      - etc-hosts 5y ago
        due to Facebook's corporate structure, I don't think Zuckerberg actually answers to the shareholders and board members.
- BeFlatXIII 5y ago
  I have yet to see a compelling argument for enshrining security vulnerabilities in law outside of the usual sob stories that like to get echoed in Congressional testimony.
- Kalium 5y ago
  Would you care to share what you think the valid view points against encryption are? For my own part, I find it helpful to remember that questions over encryption have been ongoing for several decades. Historically, the arguments boiled down to shouting about CSAM, terrorism, drugs, etc. Mostly it tended to be really be about law enforcement agencies wanting to have the unfettered powers of surveillance. What's perhaps most interesting to me is that the prevalence of encryption seems to have done very little to stop the FBI from catching people. I know this next point will be contentious, but perhaps there's room to question why these people who are indeed not idiots are so against encryption for you and me. So yes, you're absolutely right. Let's look hard at our viewpoints and biases and expertise and paychecks and ask ourselves - why does the FBI want us to not have encryption? Why do we want it? Who has the valid view points here?
  - stanleydrew 5y ago
    I don't think it's that complicated or nefarious. Law enforcement are humans just like us, mostly trying to do their jobs with as little effort as possible. Encrypted communication makes their jobs harder in some cases, so they don't like it. > What's perhaps most interesting to me is that the prevalence of encryption seems to have done very little to stop the FBI from catching people. I don't think we can know this. Or maybe you have some data? But more importantly there's a big gap between "catching" someone and "convicting" someone. Having the content of specific communications can make a big difference in actually proving guilt.
    - Kalium 5y ago
      > I don't think it's that complicated or nefarious. Law enforcement are humans just like us, mostly trying to do their jobs with as little effort as possible. Encrypted communication makes their jobs harder in some cases, so they don't like it. I completely agree. My point was not that their motives are inherently evil per se, just that they're as self-centered as anyone and carefully gazing deep into our navels does not imbue their perspectives with extra validity or compelling strength. > I don't think we can know this. We do know that the FBI routinely arrests and prosecutes people, even ones that use encryption. There's no end of public sources showing it occurring again and again. The fate of Dread Pirate Roberts is a good example. > Or maybe you have some data? What data would you like? The FBI has statistics available going back to the 1930s: https://www.fbi.gov/services/cjis/ucr https://www.fbi.gov/services/cjis/ucr > Having the content of specific communications can make a big difference in actually proving guilt. You're absolutely right, it definitely can be! Which is why the FBI has learned how to both build cases without such things. They've also learned how to gain access to encrypted communications. Between the two, some might opine that it's enough to raise questions about if they really need to prevent you and I from having access to cryptography or not. They're clearly experts at law enforcement and perhaps have no need to confiscate the tools of mathematics from technologists. Which brings me back to the point. Let's look hard at our viewpoints and biases and expertise and paychecks and ask ourselves - why does the FBI want us to not have encryption? Why do we want it? Who has the valid view points here? What have we gained from this navel-gazing?
- jimbokun 5y ago
  > My main point is that we are tech workers that have conflicts of interest and that we should look hard at our viewpoints and ask ourselves if they are better for us or better for everyone. That is a trait lacking in almost everyone these days, not just tech workers.
- adolph 5y ago
  > I don't think we should be the ones that make the decision Is Admiral Poindexter a preferable decision-maker? https://en.wikipedia.org/wiki/Total_Information_Awareness https://en.wikipedia.org/wiki/Total_Information_Awareness
golemotron 5y ago
Tech people have tech knowledge, but they are not policy experts. Our job is to give the people creating policy information on our area of expertise, not theirs. If you don't agree, look at that comments on this post. They are shallow and tech centric, not considering all of the various impacts of a comprehensive policy.
- peterwei87 5y ago
  It's not obvious that Ms. Haugen provides any additional expertise in policy matters. What are her achievements in the policy space that merit deference to expertise?
  - ineedasername 5y ago
    Her expertise and motives are separate from the public utility of what she revealed. I'm not going to denounce her for leaking this material: I can separate the utility of having this material in the public record from her reasons for putting it there. As for her expertise, she worked in FB's civic integrity unit as a product manager. I may disagree with her, but she does have a reasonable basis to claim better knowledge on the topic than the average person.
BobbyJo 5y ago
> There are no skeleton keys, only vulnerabilities. This is something really unique to digital technologies. In meat-space, everything has a vulnerability: force. With sufficient reason and circumstance, whether or not you give up your keys, the government is still able to claim dominion over anything you're trying to hide. All they have to do is break a few walls. Digital technologies don't have this problem (feature if you're the government). If you have your key stored in your memory, and there is no back door in the software, no matter what court orders anyone has, if you don't tell them the key then the information is lost to them forever. This kind of breaks some fundamental assumptions layed into law prior to tech. When you use encryption, tech really becomes an extension of your mind, and your 5th amendment rights effectively shut the government out of them completely. While I like this idea, it definitely poses problems for enforcement of basically every digital and financial law on the books, which can pose problems for all of us.
- NovemberWhiskey 5y ago
  The use of force generally leaves evidence of its use, however. If the government cuts the door off your safe, and doesn't have a warrant to conduct that search, then the facts will speak for themselves when you avail yourself of your rights - e.g. to have evidence from an unlawful search suppressed in court and the subsequent civil rights lawsuit. This is where the analogy breaks down - introducing backdoors and passkeys into digital security doesn't create the same trail in the physical world. The better analogy would be - imagine that the government insisted that all locks be approved by the government, on the understanding that those locks would have master keys that the government owned. They would be able to come to a bank during the night, unlock the front door, the vault, and your safe deposit box; or come into your home when you were at work, unlock your filing cabinet and look at your records. You would have to trust that government employees who had access to the master keys would only use them for legitimate purposes, and when authorized to do so. You would have to trust that the government could secure those keys at all times so they never fell into the wrong hands, and that no unauthorized duplicates would be made. You would have to do all those things bearing in mind that the government regularly loses such master keys, has employees that exceed their authority, misuse government resources, demonstrate poor custody practices, and so on. It doesn't seem like a good bet to me. EDIT: oh yes, and I forgot to mention there's a whole bunch of other bad actors out there who know how to buy a government-approved lock, take it apart, and are highly motivated to make their own master keys.
secondcoming 5y ago
To play Devil's Advocate and use your own point against you; Some software engineers might be experts in the domain of encryption, but there are other professions who are experts in the domain of National Security.

bostonsre 5y ago

Yes, I agree that we should absolutely provide advice on our area of expertise for topics in our domain but I don't think we should be the ones that make the decision. The other side of the debate aren't idiots, they have some valid view points, else this encryption debate would have been settled long ago. Encryption was not the only point brought up by the OP, they were also against government regulation. My main point is that we are tech workers that have conflicts of interest and that we should look hard at our viewpoints and ask ourselves if they are better for us or better for everyone. We are humans and like other industries, greed has crept in and we don't always make great decisions when left on our own.

LastMuel 5y ago
> We are humans and like other industries, greed has crept in and we don't always make great decisions when left on our own. I feel strange having to point out that Governments are made up of people too. If it's not people that are making the good decisions, whom do we turn to?
- bostonsre 5y ago
  Yes, democracy is the worst form of governance except for all of the other ones. I trust more in our government than I do in zuckerberg. Letting him continue the path that he and only he decides does not seem like a good idea.
  - LastMuel 5y ago
    I find it odd that you exalt democracy and the idea of limiting individual freedom in the same paragraph. Zuckerberg isn't a government unto himself and answers to shareholders and board members; one of which served as Chief of staff for the National Economic Council in the Obama administration. You seem to think that our government and large corporations are separate and isolated organizations, but the people that work within them often slip between the two. Taking Zuckerberg out of the equation will certainly not change the game.
    - JohnWhigham 5y ago
      So then what is your solution to this?
    - etc-hosts 5y ago
      due to Facebook's corporate structure, I don't think Zuckerberg actually answers to the shareholders and board members.
BeFlatXIII 5y ago
I have yet to see a compelling argument for enshrining security vulnerabilities in law outside of the usual sob stories that like to get echoed in Congressional testimony.
Kalium 5y ago
Would you care to share what you think the valid view points against encryption are? For my own part, I find it helpful to remember that questions over encryption have been ongoing for several decades. Historically, the arguments boiled down to shouting about CSAM, terrorism, drugs, etc. Mostly it tended to be really be about law enforcement agencies wanting to have the unfettered powers of surveillance. What's perhaps most interesting to me is that the prevalence of encryption seems to have done very little to stop the FBI from catching people. I know this next point will be contentious, but perhaps there's room to question why these people who are indeed not idiots are so against encryption for you and me. So yes, you're absolutely right. Let's look hard at our viewpoints and biases and expertise and paychecks and ask ourselves - why does the FBI want us to not have encryption? Why do we want it? Who has the valid view points here?
- stanleydrew 5y ago
  I don't think it's that complicated or nefarious. Law enforcement are humans just like us, mostly trying to do their jobs with as little effort as possible. Encrypted communication makes their jobs harder in some cases, so they don't like it. > What's perhaps most interesting to me is that the prevalence of encryption seems to have done very little to stop the FBI from catching people. I don't think we can know this. Or maybe you have some data? But more importantly there's a big gap between "catching" someone and "convicting" someone. Having the content of specific communications can make a big difference in actually proving guilt.
  - Kalium 5y ago
    > I don't think it's that complicated or nefarious. Law enforcement are humans just like us, mostly trying to do their jobs with as little effort as possible. Encrypted communication makes their jobs harder in some cases, so they don't like it. I completely agree. My point was not that their motives are inherently evil per se, just that they're as self-centered as anyone and carefully gazing deep into our navels does not imbue their perspectives with extra validity or compelling strength. > I don't think we can know this. We do know that the FBI routinely arrests and prosecutes people, even ones that use encryption. There's no end of public sources showing it occurring again and again. The fate of Dread Pirate Roberts is a good example. > Or maybe you have some data? What data would you like? The FBI has statistics available going back to the 1930s: https://www.fbi.gov/services/cjis/ucr https://www.fbi.gov/services/cjis/ucr > Having the content of specific communications can make a big difference in actually proving guilt. You're absolutely right, it definitely can be! Which is why the FBI has learned how to both build cases without such things. They've also learned how to gain access to encrypted communications. Between the two, some might opine that it's enough to raise questions about if they really need to prevent you and I from having access to cryptography or not. They're clearly experts at law enforcement and perhaps have no need to confiscate the tools of mathematics from technologists. Which brings me back to the point. Let's look hard at our viewpoints and biases and expertise and paychecks and ask ourselves - why does the FBI want us to not have encryption? Why do we want it? Who has the valid view points here? What have we gained from this navel-gazing?
jimbokun 5y ago
> My main point is that we are tech workers that have conflicts of interest and that we should look hard at our viewpoints and ask ourselves if they are better for us or better for everyone. That is a trait lacking in almost everyone these days, not just tech workers.
adolph 5y ago
> I don't think we should be the ones that make the decision Is Admiral Poindexter a preferable decision-maker? https://en.wikipedia.org/wiki/Total_Information_Awareness https://en.wikipedia.org/wiki/Total_Information_Awareness

golemotron 5y ago

Tech people have tech knowledge, but they are not policy experts. Our job is to give the people creating policy information on our area of expertise, not theirs. If you don't agree, look at that comments on this post. They are shallow and tech centric, not considering all of the various impacts of a comprehensive policy.

peterwei87 5y ago
It's not obvious that Ms. Haugen provides any additional expertise in policy matters. What are her achievements in the policy space that merit deference to expertise?
- ineedasername 5y ago
  Her expertise and motives are separate from the public utility of what she revealed. I'm not going to denounce her for leaking this material: I can separate the utility of having this material in the public record from her reasons for putting it there. As for her expertise, she worked in FB's civic integrity unit as a product manager. I may disagree with her, but she does have a reasonable basis to claim better knowledge on the topic than the average person.

BobbyJo 5y ago

> There are no skeleton keys, only vulnerabilities. This is something really unique to digital technologies. In meat-space, everything has a vulnerability: force. With sufficient reason and circumstance, whether or not you give up your keys, the government is still able to claim dominion over anything you're trying to hide. All they have to do is break a few walls. Digital technologies don't have this problem (feature if you're the government). If you have your key stored in your memory, and there is no back door in the software, no matter what court orders anyone has, if you don't tell them the key then the information is lost to them forever. This kind of breaks some fundamental assumptions layed into law prior to tech. When you use encryption, tech really becomes an extension of your mind, and your 5th amendment rights effectively shut the government out of them completely. While I like this idea, it definitely poses problems for enforcement of basically every digital and financial law on the books, which can pose problems for all of us.

NovemberWhiskey 5y ago
The use of force generally leaves evidence of its use, however. If the government cuts the door off your safe, and doesn't have a warrant to conduct that search, then the facts will speak for themselves when you avail yourself of your rights - e.g. to have evidence from an unlawful search suppressed in court and the subsequent civil rights lawsuit. This is where the analogy breaks down - introducing backdoors and passkeys into digital security doesn't create the same trail in the physical world. The better analogy would be - imagine that the government insisted that all locks be approved by the government, on the understanding that those locks would have master keys that the government owned. They would be able to come to a bank during the night, unlock the front door, the vault, and your safe deposit box; or come into your home when you were at work, unlock your filing cabinet and look at your records. You would have to trust that government employees who had access to the master keys would only use them for legitimate purposes, and when authorized to do so. You would have to trust that the government could secure those keys at all times so they never fell into the wrong hands, and that no unauthorized duplicates would be made. You would have to do all those things bearing in mind that the government regularly loses such master keys, has employees that exceed their authority, misuse government resources, demonstrate poor custody practices, and so on. It doesn't seem like a good bet to me. EDIT: oh yes, and I forgot to mention there's a whole bunch of other bad actors out there who know how to buy a government-approved lock, take it apart, and are highly motivated to make their own master keys.

secondcoming 5y ago

To play Devil's Advocate and use your own point against you; Some software engineers might be experts in the domain of encryption, but there are other professions who are experts in the domain of National Security.