16 ms·

So let's consider how we might encode this notion into an authorisation protocol. A given computer system allows access to a set of individuals who, according

So let's consider how we might encode this notion into an authorisation protocol. A given computer system allows access to a set of individuals who, according to some criteria, have been granted authorisation (by some party) to have access that system. This lists consists, at minimum, of: 1) The owner of the system 2) Other users who have been granted access by the owner of the system 3) Law enforcement agencies from one or more jurisdictions If one were to implement this, then this would involve the software explicitly granting access to the law enforcement agencies in question. And if we assume this is desirable, then the next question to arise would be which agencies should be granted access. Now, this is where politics and international law come in. Australia, for example, would love to have access to government systems of Indonesia. Similarly, China for the US. And arguably all permutations of these, and every country in the world. And in many cases they likely already do. If you were to take the transitive closure of the desires and claims of all law enforcement agencies worldwide, then this would result in a situation where all such agencies have access to all system worldwide. If this is the case, then why even bother with exploits? It should be explicitly encoded in the default ACLs of all operating systems, perhaps using a regularly updated list obtained from a reliable source. Microsoft, Apple, and the Linux kernel developers could then embed this list, and the necessary update mechanisms, directly into the OS. This would ensure that all agencies have access to the systems they desire. The problem that comes here of course is that which agencies should be granted access to which systems. Should it be only those within the same country? Should it be those of allied countries as well? How do you determine whether country A should have access to systems in country B? I understand there are legitimate needs of law enforcement. But I also, by default, take the position that computer systems should be secure, and that everyone who's work touches on this should be focused on ensuring this. This is the difference between white hats (the "good guys") and black hats (the "bad guys"). Disclaimer: I'm a computer scientist, not a politician, intelligence analyst, or international law expert. My views have also been influenced by the overreach of the NSA and it's partner agencies.

adestefan 12y ago
You just described CALEA.
mike_hearn 12y ago
I would say you've summed up one of the biggest and most important issues of our time. The internet is international. Governments aren't. What now?! My own gut feeling is that we should try and head in the same direction as the email system. The internet largely conquered spam without needing government intervention or international treaties through automatic reputation systems, blacklisting of email abusers and so on. It's basically a giant group consensus system in which spam is defined as "whatever our users think spam is" instead of an explicit law. It works! Similar techniques could be applied to other systems like Tor, if only the developers cared (they don't).

adestefan 12y ago

You just described CALEA.

mike_hearn 12y ago

I would say you've summed up one of the biggest and most important issues of our time. The internet is international. Governments aren't. What now?! My own gut feeling is that we should try and head in the same direction as the email system. The internet largely conquered spam without needing government intervention or international treaties through automatic reputation systems, blacklisting of email abusers and so on. It's basically a giant group consensus system in which spam is defined as "whatever our users think spam is" instead of an explicit law. It works! Similar techniques could be applied to other systems like Tor, if only the developers cared (they don't).