6 ms·

E2EE is offered to all users, whether or not they are law-abiding. More precise is to say that E2EE is offered to users who are primarily law-abiding. Your poi

by E2EEd 5y ago

E2EE is offered to all users, whether or not they are law-abiding. More precise is to say that E2EE is offered to users who are primarily law-abiding. Your points are well-heard, even by those in the IC. What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC related to the growing entropy of E2EE wielded at scale by folks, a large subset of whom are engaging in criminal behavior. I strongly believe that fighting this issue with a hard-line no compromise response will result in an undesirable outcome for your agenda. I am not a fan of kneecapped cybersecurity in consumer endpoints, which is the elephant in the room. It's a compromise borne of the E2EE entropy problem, intentional or not. I don't support unchecked recoverable encryption in any centralized fashion, nor do I support covert backdoors or skeleton keys. Unfortunately, too many folks defend their position from libertarian ideals, a position which does have a technical justification. It just misses the bigger picture - that most folks in govt are just doing their job. A compromise will seek to enable those doing their job correctly while preventing abuses with technological means. Telling the govt "too bad, you can't stop math" will backfire. The law can be used to force tech companies to literally stop doing math at scale.

danShumway 5y ago
> What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC related to the growing entropy of E2EE wielded at scale by folks What would a "solution" for the IC allow them to do, and what would be the limits on it? Would the IC stop asking to weaken encryption after it was granted? "Meet us halfway" is meaningless if we don't know what halfway is or what the extent is of what you're asking for, and proponents of these bills never give an answer to that question because they don't have an answer to that question. Is "meet us halfway" on CSAM zero CSAM, because I've people advocate for that -- and if that's the position and any time that encryption gets in the way of that we need to compromise, then you are effectively asking to abolish encryption. Is it that there should never be any information that law enforcement can't access -- because if so, you're asking to ban encryption. Others have pointed out (correctly) that law enforcement today has unprecedented tools to monitor civilians and catch criminals, everything from facial recognition (which has largely not been banned across America) to digital dragnets to public social media to cooperation with companies that hoover up tons of PII. We carry devices that allow law enforcement with a warrant to ask cell companies for the name and location of everyone inside of a radius. That is a frankly wild amount of power. You have already been met hecking way more than halfway on the issue of privacy vs law enforcement, and it's just utterly dishonest to claim otherwise. What we're seeing is that on the one issue where law enforcement has less access than they used to have, that's suddenly an existential problem. And my takeaway from that is that what law enforcement is asking for is not to be met halfway, law enforcement is asking to weaken and disrupt literally any tool that makes their job harder in any way at all. Any technology that weakens their level of access to anything is an existential problem to them. It is not Libertarian to ask for end to end encryption, that is a normal, moderate position for people across all political spectrums to take. The characterization of "maybe police shouldn't be able to access everything about me at time, including my location and every single one of my conversations" as a Libertarian view is just so utterly disingenuous and dishonest. So what is a halfway position where people in the government will stop calling to weaken encryption? I do not believe that position exists, and I have never heard anyone try to articulate it using measurable criteria that don't boil down to "we'll constantly balance and use the courts". I have never seen law enforcement as a unified group argue, "you know what, we have too much access here and maybe we should have less, and it's good that this technology makes our job harder." It doesn't happen. There is not a solution to this problem that law enforcement will ever be satisfied with other than complete surveillance of everyone in the United States. And these are the people that whine that privacy advocates are "absolutists." I carry a hecking cell phone already; you have monitoring tools, stop acting like you don't. Stop pretending that an era of unprecedented surveillance at a level that has never before been seen in all of human history is actually super awful and hard for you because you can't also read every single text message I've ever sent across all of time.
mrandish 5y ago
> What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC Public policy orgs like EFF etc have proposed modifications to limit the most disastrous elements of this proposal but to the extent those proposals fix or limit the 'accidental' limitless liability for communications platforms, they are met only with disingenuous cries of "think of the children." I think it's pretty clear the lack of "good-faith discussion" lies with the people who've never openly acknowledged what all this is really about. > even by those in the IC. Hopefully the intelligence community, as opposed to the domestic law enforcement agencies, already understands how dangerous this legislation could be for U.S. national interests. The unintended consequences won't stop at social media. Platforms of all kinds will react to the liability exposure or merely the possibility of it. With other nations imposing their own in-country data requirements on trans-national platforms how many platforms (or their upstream technology providers) will maintain a separate insecure version for domestic tapping and a robustly secure version for international use? Just like our own backdoors being used against us, we've already seen how this kind of thing has a way of undermining our own security. Short-sighted bureaucrats are playing with fire here. > too many folks defend their position from libertarian ideals I don't see how this is tied to uniquely libertarian ideals. The 4th amendment prohibition on government search of citizen's "papers and property" isn't some aspirational ideal or partisan political viewpoint - it's always been at the very core of the nation. It's also been continuously endorsed by both liberal and conservative supreme courts for hundreds of years. > that most folks in govt are just doing their job. To the extent their actions undermine the constitution, it's no longer "law enforcement". Sadly, quite the opposite. If the law is the 'operating system', then the constitution is the 'secure kernel' - the last line of defense against both external AND internal threats capable of undermining the integrity of the entire system. Law enforcement has privileged accounts which are THE primary internal threat the secure kernel was designed to stop. From day one in the 1700s, the constitution has always made the job of law enforcement MUCH harder. That's not a bug. It's "As Designed" and perma-marked by the original designers (and the maintainers in SCOTUS) as "Won't Fix". Hell, it goes beyond just a feature - limiting the power of the government is the explicitly stated purpose of the thing - to the extent it puts a big fence around the few powers granted to government (with the barbs pointed inward) and grants everything else, mentioned or not, as powers granted to citizens. It's always been well understood, as well as taught in elementary school, that the unique freedoms the country was founded on came with a cost - and sometimes that cost would be high, but... preserving these freedoms, including making things harder on law enforcement (and potentially easier on criminals), was worth the cost. I suspect congress is going to be surprised by how non-partisan (and non-negotiable) the fundamental integrity of the system is for most users.
iamstupidsimple 5y ago
> Telling the govt "too bad, you can't stop math" will backfire. The law can be used to force tech companies to literally stop doing math at scale. There is no practical scenario where those who want to use e2e will not have that capability. Even if technology companies are totally banned from producing it domestically, it's trivial for foreign companies to provide the e2e software and supply it over the internet.
- b112 5y ago
  Until that becomes illegal. After all, torrent indexes are illegal, and they aren't directly pirating anything. Thus, supporting an end around, can be attacked as well..
  - plorkyeran 5y ago
    Torrent indexes are illegal, and yet a lot of them exist very publicly. Pushing e2e encryption into the same category as them does not seem very effective.
    - b112 5y ago
      The goal is to reduce common usage ; to make all which use encryption a criminal.
bradleyjg 5y ago
Law enforcement and IC are starting with the assumption that they are entitled to the best access they’ve ever had. Yes, things are going dark that they had access to 20 years ago, but 20 years before that they didn’t have access because most of the conversations were happening face to face. At that point they needed to rely on traditional boots on the ground police/intelligence work instead of electronic backdoors. Why is it impossible for them to go back to doing things that way?
- emmelaich 5y ago
  > Why is it impossible for them to go back to doing things that way? Because symmetry. Criminals using e2ee are not going back. Not to support the act, but your comment doesn't really address the issue.
  - bradleyjg 5y ago
    Why does that matter? Cops weren’t listening to those old face to face communications. That was practically impossible which is analogous to the technical impossibility of listening in on E2EE connections. Instead they were cracking cases in other ways (physical evidence, confidential sources, etc.)
    - wizzwizz4 5y ago
      To play Devil's Advocate: people had to meet up for face-to-face communications, but they don't have to meet up for remote communication.
      - citruscomputing 5y ago
        Does the devil need an advocate?
        wizzwizz4 5y ago
        The Catholic Church seems to think so, and they've got a notorious anti-Devil bias. It's useful to put forward arguments against things, even if you don't agree with them, because it helps to put into words why you don't agree with them.
matheusmoreira 5y ago
Law enforcement issues don't override all other concerns. If life is difficult for them, good. That's the point. It should be difficult in order to prevent abuse of power. Encryption is a perfectly reasonable reaction to governments that give themselves the right to surveil the entire planet. Nobody really cares that it makes their life harder. That's exactly what it's supposed to do. It should be incredibly hard if not impossible for the NSA employee to spy on his spouse. If they want to investigate stuff, they should have to get warrants and literally send out operatives to physically compromise the targeted equipment. This puts a limit on the scale of government operations. This is how it's supposed to be.
- catlifeonmars 5y ago
  > This is how it's supposed to be. According to you, which is OPs point exactly. The discussion needs to be framed in a way that stakeholders are walking in common ground, not yelling at each other at a distance from their respective ideological ivory towers. FWIW I happen to agree with you, but IMO “this is how it’s supposed to be” is not a productive argument.
  - emptysongglass 5y ago
    But we shouldn't be having this argument over and over because some people didn't like the way it turned out the first time. We need, as a society, to find a way to limit the ability of lawmakers to turn around a scant two years later with some new approach to pushing their shot down proposal through. It's a devious exhaustion tactic and it's unethical (without commenting on the bill itself, which I find abhorrent to a free and just society)
  - MereInterest 5y ago
    Why isn't it a productive argument? This is a question about what goals society should optimize towards. There's no amount of objective measurements that can determine the relative worth of cheaper policing compared with decreased privacy. The only way for such an argument to proceed is to convince enough people that such a trade results in a world not being how it is supposed to be. TL;DR: This argument lies on the "ought" side of Hume's is-ought distinction [0]. [0] https://en.wikipedia.org/wiki/Is%E2%80%93ought_problem https://en.wikipedia.org/wiki/Is%E2%80%93ought_problem
quanticle 5y ago
>What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC related to the growing entropy of E2EE wielded at scale by folks, a large subset of whom are engaging in criminal behavior. I think that the tech community has extended entirely too much "good faith" towards a law enforcement and intelligence community who feel entitled to review and record all communication at their own sole discretion. I know you think that you're the "good guys", trying to keep us safe from "adversaries", but you have to understand that after the Snowden leaks, many people in the tech. industry don't see you that way. They see you as the diet-Coke version of the Chinese Ministry of State Security, and feel that if you were able to slip your legal bonds, you'd attack free speech just harshly as the Chinese Communist Party does. Of course, from your perspective, it's not cracking down on free speech. It's "preserving democracy" by "suppressing misinformation" planted by "hostile adversaries" and "non-state actors".
randomhodler84 5y ago
mr_toad 5y ago
> What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC related to the growing entropy of E2EE wielded at scale by folks, a large subset of whom are engaging in criminal behavior. How about a good faith discussion of the fact that crime rates are at historic lows, or the fact that many crimes (burglary, car theft) are never investigated, or the fact that surveillance is never going to solve, let alone prevent the real issues that people care about, like domestic violence, gun violence, or the epidemic of prescription pain killer addiction. Focus on crime prevention, not more law enforcement empire building.
guy98238710 5y ago
> It just misses the bigger picture - that most folks in govt are just doing their job. Any office with excessive power will be a magnet for assholes. Excessive power will be abused.
guy98238710 5y ago
> E2EE wielded at scale by folks, a large subset of whom are engaging in criminal behavior You cannot really engage in criminal behavior exclusively via E2EE communication. Victim would use the communication as evidence. All the crimes you are talking about have an essential component outside E2EE communication, which means that detection and evidence gathering is possible without breaking E2EE.
- maccolgan 5y ago
  You'd just have deniable encryption.
- wutbrodo 5y ago
  Aren't there criminal acts which consist solely of communicating information to a willing third party? Eg sharing classified information with a foreign agent?
jmcnulty 5y ago
How secure is E2EE anyway when, like WhatsApp, it's implemented such that you blindly trust a 3rd party to distribute the public keys and instruct your client who it should be encrypting and sending your messages to? How do you know your mobile app isn't also sending encrypted copies of your messages to a ghost user you have no visibility of? A ghost user that could be WhatsApp, law enforcement or anyone.

by E2EEd 5y ago

danShumway 5y ago

> What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC related to the growing entropy of E2EE wielded at scale by folks What would a "solution" for the IC allow them to do, and what would be the limits on it? Would the IC stop asking to weaken encryption after it was granted? "Meet us halfway" is meaningless if we don't know what halfway is or what the extent is of what you're asking for, and proponents of these bills never give an answer to that question because they don't have an answer to that question. Is "meet us halfway" on CSAM zero CSAM, because I've people advocate for that -- and if that's the position and any time that encryption gets in the way of that we need to compromise, then you are effectively asking to abolish encryption. Is it that there should never be any information that law enforcement can't access -- because if so, you're asking to ban encryption. Others have pointed out (correctly) that law enforcement today has unprecedented tools to monitor civilians and catch criminals, everything from facial recognition (which has largely not been banned across America) to digital dragnets to public social media to cooperation with companies that hoover up tons of PII. We carry devices that allow law enforcement with a warrant to ask cell companies for the name and location of everyone inside of a radius. That is a frankly wild amount of power. You have already been met hecking way more than halfway on the issue of privacy vs law enforcement, and it's just utterly dishonest to claim otherwise. What we're seeing is that on the one issue where law enforcement has less access than they used to have, that's suddenly an existential problem. And my takeaway from that is that what law enforcement is asking for is not to be met halfway, law enforcement is asking to weaken and disrupt literally any tool that makes their job harder in any way at all. Any technology that weakens their level of access to anything is an existential problem to them. It is not Libertarian to ask for end to end encryption, that is a normal, moderate position for people across all political spectrums to take. The characterization of "maybe police shouldn't be able to access everything about me at time, including my location and every single one of my conversations" as a Libertarian view is just so utterly disingenuous and dishonest. So what is a halfway position where people in the government will stop calling to weaken encryption? I do not believe that position exists, and I have never heard anyone try to articulate it using measurable criteria that don't boil down to "we'll constantly balance and use the courts". I have never seen law enforcement as a unified group argue, "you know what, we have too much access here and maybe we should have less, and it's good that this technology makes our job harder." It doesn't happen. There is not a solution to this problem that law enforcement will ever be satisfied with other than complete surveillance of everyone in the United States. And these are the people that whine that privacy advocates are "absolutists." I carry a hecking cell phone already; you have monitoring tools, stop acting like you don't. Stop pretending that an era of unprecedented surveillance at a level that has never before been seen in all of human history is actually super awful and hard for you because you can't also read every single text message I've ever sent across all of time.

mrandish 5y ago

> What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC Public policy orgs like EFF etc have proposed modifications to limit the most disastrous elements of this proposal but to the extent those proposals fix or limit the 'accidental' limitless liability for communications platforms, they are met only with disingenuous cries of "think of the children." I think it's pretty clear the lack of "good-faith discussion" lies with the people who've never openly acknowledged what all this is really about. > even by those in the IC. Hopefully the intelligence community, as opposed to the domestic law enforcement agencies, already understands how dangerous this legislation could be for U.S. national interests. The unintended consequences won't stop at social media. Platforms of all kinds will react to the liability exposure or merely the possibility of it. With other nations imposing their own in-country data requirements on trans-national platforms how many platforms (or their upstream technology providers) will maintain a separate insecure version for domestic tapping and a robustly secure version for international use? Just like our own backdoors being used against us, we've already seen how this kind of thing has a way of undermining our own security. Short-sighted bureaucrats are playing with fire here. > too many folks defend their position from libertarian ideals I don't see how this is tied to uniquely libertarian ideals. The 4th amendment prohibition on government search of citizen's "papers and property" isn't some aspirational ideal or partisan political viewpoint - it's always been at the very core of the nation. It's also been continuously endorsed by both liberal and conservative supreme courts for hundreds of years. > that most folks in govt are just doing their job. To the extent their actions undermine the constitution, it's no longer "law enforcement". Sadly, quite the opposite. If the law is the 'operating system', then the constitution is the 'secure kernel' - the last line of defense against both external AND internal threats capable of undermining the integrity of the entire system. Law enforcement has privileged accounts which are THE primary internal threat the secure kernel was designed to stop. From day one in the 1700s, the constitution has always made the job of law enforcement MUCH harder. That's not a bug. It's "As Designed" and perma-marked by the original designers (and the maintainers in SCOTUS) as "Won't Fix". Hell, it goes beyond just a feature - limiting the power of the government is the explicitly stated purpose of the thing - to the extent it puts a big fence around the few powers granted to government (with the barbs pointed inward) and grants everything else, mentioned or not, as powers granted to citizens. It's always been well understood, as well as taught in elementary school, that the unique freedoms the country was founded on came with a cost - and sometimes that cost would be high, but... preserving these freedoms, including making things harder on law enforcement (and potentially easier on criminals), was worth the cost. I suspect congress is going to be surprised by how non-partisan (and non-negotiable) the fundamental integrity of the system is for most users.

iamstupidsimple 5y ago

> Telling the govt "too bad, you can't stop math" will backfire. The law can be used to force tech companies to literally stop doing math at scale. There is no practical scenario where those who want to use e2e will not have that capability. Even if technology companies are totally banned from producing it domestically, it's trivial for foreign companies to provide the e2e software and supply it over the internet.

b112 5y ago
Until that becomes illegal. After all, torrent indexes are illegal, and they aren't directly pirating anything. Thus, supporting an end around, can be attacked as well..
- plorkyeran 5y ago
  Torrent indexes are illegal, and yet a lot of them exist very publicly. Pushing e2e encryption into the same category as them does not seem very effective.
  - b112 5y ago
    The goal is to reduce common usage ; to make all which use encryption a criminal.

bradleyjg 5y ago

Law enforcement and IC are starting with the assumption that they are entitled to the best access they’ve ever had. Yes, things are going dark that they had access to 20 years ago, but 20 years before that they didn’t have access because most of the conversations were happening face to face. At that point they needed to rely on traditional boots on the ground police/intelligence work instead of electronic backdoors. Why is it impossible for them to go back to doing things that way?

emmelaich 5y ago
> Why is it impossible for them to go back to doing things that way? Because symmetry. Criminals using e2ee are not going back. Not to support the act, but your comment doesn't really address the issue.
- bradleyjg 5y ago
  Why does that matter? Cops weren’t listening to those old face to face communications. That was practically impossible which is analogous to the technical impossibility of listening in on E2EE connections. Instead they were cracking cases in other ways (physical evidence, confidential sources, etc.)
  - wizzwizz4 5y ago
    To play Devil's Advocate: people had to meet up for face-to-face communications, but they don't have to meet up for remote communication.
    - citruscomputing 5y ago
      Does the devil need an advocate?
      - wizzwizz4 5y ago
        The Catholic Church seems to think so, and they've got a notorious anti-Devil bias. It's useful to put forward arguments against things, even if you don't agree with them, because it helps to put into words why you don't agree with them.

matheusmoreira 5y ago

Law enforcement issues don't override all other concerns. If life is difficult for them, good. That's the point. It should be difficult in order to prevent abuse of power. Encryption is a perfectly reasonable reaction to governments that give themselves the right to surveil the entire planet. Nobody really cares that it makes their life harder. That's exactly what it's supposed to do. It should be incredibly hard if not impossible for the NSA employee to spy on his spouse. If they want to investigate stuff, they should have to get warrants and literally send out operatives to physically compromise the targeted equipment. This puts a limit on the scale of government operations. This is how it's supposed to be.

catlifeonmars 5y ago
> This is how it's supposed to be. According to you, which is OPs point exactly. The discussion needs to be framed in a way that stakeholders are walking in common ground, not yelling at each other at a distance from their respective ideological ivory towers. FWIW I happen to agree with you, but IMO “this is how it’s supposed to be” is not a productive argument.
- emptysongglass 5y ago
  But we shouldn't be having this argument over and over because some people didn't like the way it turned out the first time. We need, as a society, to find a way to limit the ability of lawmakers to turn around a scant two years later with some new approach to pushing their shot down proposal through. It's a devious exhaustion tactic and it's unethical (without commenting on the bill itself, which I find abhorrent to a free and just society)
- MereInterest 5y ago
  Why isn't it a productive argument? This is a question about what goals society should optimize towards. There's no amount of objective measurements that can determine the relative worth of cheaper policing compared with decreased privacy. The only way for such an argument to proceed is to convince enough people that such a trade results in a world not being how it is supposed to be. TL;DR: This argument lies on the "ought" side of Hume's is-ought distinction [0]. [0] https://en.wikipedia.org/wiki/Is%E2%80%93ought_problem https://en.wikipedia.org/wiki/Is%E2%80%93ought_problem

quanticle 5y ago

>What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC related to the growing entropy of E2EE wielded at scale by folks, a large subset of whom are engaging in criminal behavior. I think that the tech community has extended entirely too much "good faith" towards a law enforcement and intelligence community who feel entitled to review and record all communication at their own sole discretion. I know you think that you're the "good guys", trying to keep us safe from "adversaries", but you have to understand that after the Snowden leaks, many people in the tech. industry don't see you that way. They see you as the diet-Coke version of the Chinese Ministry of State Security, and feel that if you were able to slip your legal bonds, you'd attack free speech just harshly as the Chinese Communist Party does. Of course, from your perspective, it's not cracking down on free speech. It's "preserving democracy" by "suppressing misinformation" planted by "hostile adversaries" and "non-state actors".

randomhodler84 5y ago

mr_toad 5y ago

> What isn't occurring, is a good-faith discussion on solving the issues faced by law enforcement and the IC related to the growing entropy of E2EE wielded at scale by folks, a large subset of whom are engaging in criminal behavior. How about a good faith discussion of the fact that crime rates are at historic lows, or the fact that many crimes (burglary, car theft) are never investigated, or the fact that surveillance is never going to solve, let alone prevent the real issues that people care about, like domestic violence, gun violence, or the epidemic of prescription pain killer addiction. Focus on crime prevention, not more law enforcement empire building.

guy98238710 5y ago

> It just misses the bigger picture - that most folks in govt are just doing their job. Any office with excessive power will be a magnet for assholes. Excessive power will be abused.

guy98238710 5y ago

> E2EE wielded at scale by folks, a large subset of whom are engaging in criminal behavior You cannot really engage in criminal behavior exclusively via E2EE communication. Victim would use the communication as evidence. All the crimes you are talking about have an essential component outside E2EE communication, which means that detection and evidence gathering is possible without breaking E2EE.

maccolgan 5y ago
You'd just have deniable encryption.
wutbrodo 5y ago
Aren't there criminal acts which consist solely of communicating information to a willing third party? Eg sharing classified information with a foreign agent?

jmcnulty 5y ago

How secure is E2EE anyway when, like WhatsApp, it's implemented such that you blindly trust a 3rd party to distribute the public keys and instruct your client who it should be encrypting and sending your messages to? How do you know your mobile app isn't also sending encrypted copies of your messages to a ghost user you have no visibility of? A ghost user that could be WhatsApp, law enforcement or anyone.