The EFF addresses some shortcomings in the recent report to policy makers by the National Academies of Sciences (NAS) on encryption.
The National Academy of Sciences (NAS) released a much-anticipated report yesterday that attempts to influence the encryption debate by proposing a "framework for decisionmakers." At best, the report is unhelpful. At worst, its framing makes the task of defending encryption harder.
The report collapses the question of whether the government should mandate "exceptional access" to the contents of encrypted communications with how the government could accomplish this mandate. We wish the report gave as much weight to the benefits of encryption and risks that exceptional access poses to everyone's civil liberties as it does to the needs—real and professed—of law enforcement and the intelligence community.
The report via the link in the quote above is available free of charge but holds several hoops to hop through between you and the final PDF. The EFF recognizes that the NAS report was undertaken in good faith, but identifies two main points of contention with the final product. Specifically, the framing is problematic and the discussion of the possible risks to civil liberties is quite brief.
Source : New National Academy of Sciences Report on Encryption Asks the Wrong Questions
Related Stories
Riana Pfefferkorn, a Cryptography Fellow at the Center for Internet and Society at Stanford Law School, has published a whitepaper on the risks of so-called "responsible encryption". This refers to inclusion of a mechanism for exceptional access by law enforcement to the cleartext content of encrypted messages. It also goes by the names "back door", "key escrow", and "golden key".
Federal law enforcement officials in the United States have recently renewed their periodic demands for legislation to regulate encryption. While they offer few technical specifics, their general proposal—that vendors must retain the ability to decrypt for law enforcement the devices they manufacture or communications their services transmit—presents intractable problems that would-be regulators must not ignore.
However, with all that said, a lot more is said than done. Some others would make the case that active participation is needed in the democratic process by people knowledgeable in use of actual ICT. As RMS has many times pointed out much to the chagrin of more than a few geeks, "geeks like to think that they can ignore politics, you can leave politics alone, but politics won't leave you alone." Again, participation is needed rather than ceding the whole process, and thus its outcome, to the loonies.
Source : New Paper on The Risks of "Responsible Encryption"
Related:
EFF : New National Academy of Sciences Report on Encryption Asks the Wrong Questions
Great, Now There's "Responsible Encryption"
(Score: 3, Insightful) by Anonymous Coward on Sunday February 18 2018, @04:27AM (5 children)
The only thing to "discuss" is how to get the best implementation to the public regardless of the state's opinion. They should be given no say in how people communicate. That's it. There's nothing to "discuss" on the matter. The singular objective is, or should be to provide secure and private communication to everybody where nobody can interfere. All the tyrants who say we have no right can go to hell! Let's use our technology to send them there post haste and be done with it. There is no such thing as extremism when it comes to defending personal rights.
(Score: 2, Informative) by tftp on Sunday February 18 2018, @04:46AM (4 children)
(Score: 5, Insightful) by Runaway1956 on Sunday February 18 2018, @05:53AM (3 children)
The problem lies in technology and weasel words.
In 1500, when two people communicated orally, NO ONE could hear them, except for people standing within a few feet of them. There were no recording devices, no telecommunications, words weren't etched into stone (unless someone was hired for that very purpose). Communications were "private", unless and until those persons present disclosed those communications to outsiders.
Today - your most casual conversations might be recorded. More, most communications outside of immediate family are electronic. Telephone, chat rooms, forums, email, and more. Everything is recordable - and spyable.
Weasel words? Law makers have forgotten what life was like in 1000 BC, 1000 AD, 1500 AD, and even 1900 AD. They only remember the past few decades, when government has had the ability to eavesdrop on telephones, telegraph, radio, television, and more recently, the internet. They can't conceive of a time when private communications were really PRIVATE. So, "The right of the people to be secure" only applies to personal, oral, face-to-face communications, in their opinion. Everything else MUST BE visible to government.
Or, phrased another way - if your communications are reduced to digital media, you have granted government permission to monitor it.
That is the mindset that we have to overcome. Inertia is working against us.
Except, of course, for one simple fact. It is impossible to build a secure communication, while at the same time giving government the "keys" to unlock that communication. It just isn't possible. The moment government has a key, criminals have that same key, and communications are no longer secure.
(Score: 1, Interesting) by Anonymous Coward on Sunday February 18 2018, @06:51AM
You're making my point. You waste time talking about government, when we should be getting the privacy tools out. Who gives a shit what the government thinks on these matters? Our private communications are simply none of their business. That simple. The government is supposed to be serving its people (you know, building roads, proving national defense, social security, AND healthcare!), and it would be if people actually demanded it. So, fuck 'em all and let's get on with the business at hand, please. Let's hear some good news on circumventing the state for a change, and let's ignore their whining about it. And of course we could vote for a privacy respecting congress, but that is unlikely, so let's take the technical route.
(Score: 3, Interesting) by bzipitidoo on Sunday February 18 2018, @07:32AM
> It is impossible to build a secure communication, while at the same time giving government the "keys" to unlock that communication.
True. Either secure communication is possible, or it is not possible. Seems highly likely that it's possible. Problem is, they (the military brass and high level bureaucrats at spy agencies) seem to think they can have it both ways-- secure communication for themselves, and back doors for everyone else. If you pin them to the wall, they will admit it doesn't make sense, and profess that they understand that and so you are insulting their intelligence.
But as soon as they're off the hot seat, they go right back to demanding exactly that. They want the happy situation the Allies had in WWII-- both German and Japanese communication broken, and Allied communication secure from the Axis. It's like they feel that state of affairs is the status quo, rather than the result of the good fortune of the Germans having the arrogance to believe the Enigma machine was unbreakable, or if not unbreakable, having too much contempt for Allied science, thought the Allies were such bad scientists they couldn't break it anyway.
(Score: 2) by FatPhil on Monday February 19 2018, @06:45AM
I'm failing to find that "digital" vs "non-digital" distinction in the constitution.
Some other issues to ponder:
- Were cants ever illegal? Cants are effectively ECB encryption.
- Why doesn't the government simply issue a warrant on the Voynich manuscript, if "warrants" have some magical power to turn the encrypted into the unencrypted?
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: -1, Flamebait) by Anonymous Coward on Sunday February 18 2018, @04:27AM
EFF are a bunch of fucking failures who couldn't get real jobs as lawyers. Fuck the noise that bleats out of those EFFing losers who should be sucking the dicks of paralegals who are better than them.
(Score: 3, Interesting) by DrkShadow on Sunday February 18 2018, @04:45AM (3 children)
Recently, as yet another example, there was an article about an ex CIA officer arrested with suspicion of compromising informants. If the government retains a backdoor key into all encryption on American soil, the major governments of the world will have ready access to _ALL_ encrypted data of Americans.
The US government can simply not maintain secrecy of vital information -- not with CIA informants, not with Equation group, not with diplomatic cables. If the government demands a backdoor, then the world will have that backdoor and Americans will have nothing. There is information that can not be recovered once lost, and must be protected absolutely -- something the US government has shown that, with lives on the line, it cannot do.
This is the only necessary argument against broken encryption schemes.
(Score: 2, Insightful) by Anonymous Coward on Sunday February 18 2018, @04:54AM (1 child)
That's one of the consequences of money being the sole basis of society. Corruption is inevitable.
(Score: 2) by FatPhil on Monday February 19 2018, @06:48AM
IFYPFY
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 2) by krishnoid on Sunday February 18 2018, @05:05AM
Which is fine, because our privacy has already been compromised like nobody's business. Ready access to encrypted data of Europeans, though ... different story.
(Score: 2) by frojack on Sunday February 18 2018, @04:57AM (3 children)
free of charge but holds several hoops to hop through between you and the final PDF.
So why not short circuit that nonsense and publisf the PDF directly? I was under the impression it was a EFF document?
They aren't partaking of their own dogfood?
No, you are mistaken. I've always had this sig.
(Score: 0) by Anonymous Coward on Sunday February 18 2018, @05:49AM (2 children)
It's referring to NAS report, not EFF's.
(Score: 2) by frojack on Sunday February 18 2018, @07:48AM (1 child)
So something produced with my tax dollars then?
No, you are mistaken. I've always had this sig.
(Score: 2) by janrinok on Sunday February 18 2018, @08:59AM
Well if you want to take that argument to its extreme - all the intelligence gathered by your agencies is also funded by your tax dollars. Do you think that you should give free access to all Americans to that data? How secure would that be?
Now, I'm not arguing against the need for good encryption for everybody, but it would be easy for the high and mighty that you dislike so much to discount your argument simply because there is a need to secure information and keep it on a very limited distribution. It affects your national security and safety. The true argument is that it does not apply to your "private" data. You have a right to secure communications just as much as they have. You need secure comms to do your banking, to purchase items over the internet, to submit you tax forms etc. And as a result, you can also use secure comms on your phones. That is what they don't like.
But they should ask themselves a simple question. When, during the WW2 they didn't have the ability to break enemy codes, did they simply stop fighting and go home? No, they continued to fight. And that is what they should be doing to combat terrorism. Not crying themselves to sleep because Joe Public doesn't want to hand over all the details of his private life. And there is no way that they can enforce such a law on the entire world, so how do they expect to stop encryption simply within your own borders?
If you sent random data by phone to another person in the US, would you be guilty of breaking a law simply because the NSA didn't know what the data meant? It is not encrypted, but they do not know that. There is no key for them to find, none for them to try to force you to give up, and you have paid for your phone bill so you can send any text that you like. Or are they suggesting that it has to be in English. Why not Navajo, or some strange dialect used by a group of pygmies somewhere. What they ask for is entirely unreasonable and I don't believe that any such law would stand up in court to a logical and well-reasoned defence. They know it too...
(Score: 2, Informative) by Anonymous Coward on Sunday February 18 2018, @05:20AM (16 children)
What gets me, is even if they do come out with an encryption standard that has "exceptional access", it won't make a bit of difference. The encryption cat is out of the bag, and we have multiple encryption specs to choose from.
(Score: 2) by Runaway1956 on Sunday February 18 2018, @06:01AM (3 children)
Bingo. You, the individual end user, need not even adhere to any standard. If you are really worried about privacy/secrecy, you may take any standard at all, and use it, or modify it, for your purposes. It isn't necessary that your new "standard" works for anyone else, aside from the person you are communicating with. You agree with him/her that $standard with $modifications using $key is your private channel - and no one is likely to break in. If/when you feel the need to include third/fourth parties in your communications, then you offer those people your new standards, and your key or key generator.
Of course, Gubbermint will probably declare you to be a de facto criminal for using your private encryption scheme.
(Score: 4, Interesting) by Dr Spin on Sunday February 18 2018, @09:09AM (1 child)
Good luck with agreeing a private encryption protocol with your bank (or Amazon).
It looks like the main purpose of this is to give criminals access to your bank accounts and enable them to buy and sell things using your name.
However, look on the bright side: it will expose every politician's dirty secrets to the entire world. There must be some merit in that?
Warning: Opening your mouth may invalidate your brain!
(Score: -1, Spam) by Anonymous Coward on Monday February 19 2018, @02:31PM
No, no funcionaría con Amazon. Pero, nuestro cartel de drogas usa adentro en casa, para comunicarse con mulas y soldados. Los anglosajones aún no lo han descifrado, y los federales son tan estúpidos como para saber qué es el cifrado.
(Score: 2) by FatPhil on Monday February 19 2018, @07:03AM
"Will"? Has already, at least in the 51st state, so I presumed it had in the original 50 states too. If encryption is fine, but you are obliged to release your keys when handed a warrent, then they are saying encryption is illegal. Because if you refuse and keep your keys private, will go to jail. There's no way else that can be interpretted except as private communication being illegal.
Personally, that disgusts me, and I would be prepared to take a stand and to cling to my keys with at least as much resolve as the NRA cling to their murder tubes. If I'm asked to decode H4sIAEd2iloCA3MrTc5WKMlIVchJLNdRyCxRL1ZIzFNILC5W5AIAIZXpARsAAAA= my response will be simply
It means capital-h four lower-case-s capital-I capital-A ...
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 1, Insightful) by Anonymous Coward on Sunday February 18 2018, @06:06AM (11 children)
The cat may be out of the bag, but there's an ICBM headed towards it. After government-backdoored "encryption" is introduced, the next step is outlawing non-backdoored encryption. It doesn't matter if you're hiding porn or state secrets, if they can prosecute you for the "hiding" part (cf. civil forfeiture).
(Score: 4, Funny) by janrinok on Sunday February 18 2018, @09:21AM (10 children)
(Score: 1) by redneckmother on Sunday February 18 2018, @01:52PM (2 children)
I like this idea.
Are there any "blind drop" sites on the 'net? I have a hardware RNG, and would love to raise the background noise for the TLAs.
Mas cerveza por favor.
(Score: 2) by janrinok on Sunday February 18 2018, @11:20PM (1 child)
(Score: 2) by Bot on Tuesday February 20 2018, @04:25PM
until somebody uses it...
Account abandoned.
(Score: 2) by canopic jug on Sunday February 18 2018, @02:16PM (2 children)
They'd just throw your ass in jail until you cough up the key. However, since there is no key, you'd just stay there indefinitely.
In a much dodgier case [arstechnica.com], that has already happened.
It's a clever idea otherwise and could be tried. I suspect though that if there were enough suspicion to warrant closer attention and a larger budget, they'd just work toward an end-point compromise and eventually figure out that it was just noise.
Money is not free speech. Elections should not be auctions.
(Score: 2, Insightful) by redneckmother on Sunday February 18 2018, @02:39PM (1 child)
As others have noted, it's all about money.
If there were a "blind drop", and enough individuals would send (and read) gibberish posts, the TLAs could chase their tails until they decided to abandon such nonsensical efforts.
Who knows, perhaps one could put a little wheat in with the chaff? That possibility would give them nightmares.
I wish the gubmitt would spend more resources on improving life and respecting individual (as in living, breathing people) rights.
Mas cerveza por favor.
(Score: 0) by Anonymous Coward on Monday February 19 2018, @12:14AM
Aha, I knew there had to be more to that one ACs posts!
(Score: 2) by pipedwho on Sunday February 18 2018, @06:44PM (3 children)
The problem with this is that a law that is able to ‘forbid’ encryption is equally capable of forbidding this approach. They simply update the screed to include “...or otherwise indecipherable...”. And with the stroke of a pen your technological solution to a political problem has been rendered ineffective. The solution is to argue on philosophical, political and logical grounds.
(Score: 2) by janrinok on Sunday February 18 2018, @11:27PM (1 child)
(Score: 2) by pipedwho on Monday February 19 2018, @01:13AM
There are no laws requiring backdoored crypto at the current time. If the government decides to pen some laws and you find a technologically exploitable loophole, you can be sure that at some time shortly beyond that, that the hole will be plugged (well, at least for anyone that isn't part of the 'ruling class').
It doesn't matter how they do it, or the exact wording. The problem is arguing along this line of reasoning is futile.
If they can somehow legally ban all encryption for communications and otherwise require broken and back-doored crypto for the masses, then it isn't a far stretch that they can subsequently also make it illegal to transmit random nonsensical data.
The real arguments here should be about the legality and ethics from a civil rights perspective, and other external side effects of making effective cryptography illegal. For example, the first and fourth amendments to the US Constitution have something to say about this. And traditionally it has been an assumed right for people to communicate privately. Then for side effects; every crime organisation and foreign government will soon end up with access to everyone's communications. And criminals will just continue to use effective crypto anyway, even if it has to be coupled with steganography, thus driving the problem into the dark.
I personally don't want to have to resort to steganography to send sensitive messages (eg. design details, or pricing structures, etc) to clients to avoid rival organisation(s) (or governments) from intercepting and deciphering my messages. And for some channels of R&D and otherwise valuable information, there are big financial incentives to obtain access. Imagine the enormous monetary (and political) value of escrow keys, or back door access to a government security key database. With rewards like that, it's only a matter of time before the 'wrong' people have access.
And by definition, for me the 'wrong' people are everyone besides the intended recipient(s).
(Score: 0) by Anonymous Coward on Monday February 19 2018, @02:14AM
So Trump gets arrested for covfefe? And kids get interrogated by the FBI because agents can't understand the new lingo? People who can't spell get sent to prison?
(Score: 1, Redundant) by Bot on Sunday February 18 2018, @05:54AM (15 children)
they have one thing in common, when done according to fundamentals, titles are just labels.
it does not matter how high you rank in christianity (and the high ranking means you serve more), it's following the rules that counts. (Matthew 7:21 12:46 and others)
it does not matter how many awards and titles and curriculum in science, it's following the scientific method that counts.
Now the question is, where is the experimental data that shaped the conclusion of this academy of sciences report, and how do i reproduce it?
Else it is not science, it is politics. You know, the discipline whose output must be decoded through cui bono filters.
Account abandoned.
(Score: 4, Insightful) by Azuma Hazuki on Sunday February 18 2018, @06:00AM (14 children)
I realize, from previous interaction with you, that you know so little philosophy that this sort of "nicht einmal falsch" statement is to be expected from you but...wow. Stop trying to work in shilling for the flying Canaanite genocide fairy into every other post, will you? You're not even doing a good job of it if that's your idea of a good sales pitch.
I am "that girl" your mother warned you about...
(Score: 2) by Bot on Sunday February 18 2018, @12:27PM (13 children)
hello there
so what have i done wrong this time other than being me?
Account abandoned.
(Score: 0) by Anonymous Coward on Sunday February 18 2018, @02:45PM
PEBKAC
[grin]
(Score: 3, Insightful) by Azuma Hazuki on Sunday February 18 2018, @05:46PM (11 children)
For a start, contrast the scientific method with the, er, religious method. If you don't immediately see a fundamental difference in the approach, you're beyond salvage.
I am "that girl" your mother warned you about...
(Score: 2) by Bot on Sunday February 18 2018, @10:30PM (10 children)
Seriously, do you think that brainwashing, if it worked, would bring souls to heaven? it's a matter between your own freedom and the hypothetical savior, the one who reportedly sent people to announce, not to force.
You are reacting to an association, which by itself can't prove anything because proof by association is a logical fallacy.
Sodomy, like Science, starts with an S.
Did I just advocate sodomy?
Account abandoned.
(Score: 2) by Azuma Hazuki on Monday February 19 2018, @03:43AM (9 children)
You've managed both to miss what the point of the Sodom and Gomorrah story was (read Ezekiel 16:49, please...), beg the question about the necessary sort of libertarian free will existing in the first place for that idea to work, beg the question about supposed announcing vs. forcing (hint: blackmail != free gift), and miss the very real point that if brainwashing doesn't work, it wouldn't be engaged in by these religions.
Cthulhu, you *suck* at this.
I am "that girl" your mother warned you about...
(Score: 1, Flamebait) by Bot on Monday February 19 2018, @07:32AM (8 children)
It was a simple yes/no answer but OK
> what the point of the Sodom and Gomorrah story was
irrelevant
> beg the question about the necessary sort of libertarian free will
no free will, posting on SN irrelevant. You post on SN, therefore the free will is given as axiomatic.
> beg the question about supposed announcing vs. forcing
i read what is written
> and miss the very real point that if brainwashing doesn't work, it wouldn't be engaged in by these religions
fraud is routinely done in the name of science or law, does that make you reject science and law?
Account abandoned.
(Score: 2) by Azuma Hazuki on Monday February 19 2018, @09:24PM (7 children)
Jesus motocrossing Christ, you're so bad at this you don't even KNOW how bad at this you are.
The point of the Sodom and Gomorrah story is *not* irrelevant, and in fact it is one thing Jesus is constantly banging on over the course of his supposed ministry. Open to Mt. 25 and read the parable of sheep and goats, paying special attention to verses 31 through 46. If there are two things Jesus hates, it's religious hypocrisy and those who don't help the poor.
"You post on SN, therefore the free will is given as axiomatic." No it goddamned isn't. You must assume not only free will but a specific type of clean-room libertarian free will for your apologia to work. Prove we have free will *at all.* let alone that specific type of it. You may very well be the recipient of a large prize in philosophy if you do; there are very good reasons most people who study this in any depth, myself included, are compatibilists.
You do, indeed, read what is written. Unquestioningly. That is the very crux, pardon me, of your problem. You don't think critically.
Your last question is both a non-sequitur and a piece of bait, and not very good bait at that. It will receive the further response it deserves: zero.
I am "that girl" your mother warned you about...
(Score: 2) by Bot on Tuesday February 20 2018, @04:19PM (6 children)
1. i did not advocate sodomy, I should know since I brought it up and the reason why I did is clear.
2. if you cared to examine the context, the freedom of will is one of those that bring responsibility with them, call it however you like. If such freedom did not exist we would be simply following a program (randomly or deterministically seeded it doesn't matter). We ought to need disproving solipsism too in general, but since you reply we consider it axiomatically denied, don't we? Same thing.
3. there is nothing to be critical about. You either follow the example or not. If your master doesn't force, does not throw stones, and pay taxes, and you do, where is critical thinking needed...
4. there is no prize for who replies last, so, no prob.
Account abandoned.
(Score: 2) by Azuma Hazuki on Tuesday February 20 2018, @10:53PM (5 children)
Am I just talking too far above you or what? Your replies aren't taking into account the things I've been saying.
I am "that girl" your mother warned you about...
(Score: 1, Troll) by Bot on Wednesday February 21 2018, @10:53PM (4 children)
I am not going to reply to your reactions to the things you think I am implying in my posts. By that metric yes you are too far above.
Now, answer yes or yes to the following three questions and we can go home.
Does christian doctrine say labels do not count?
Does science say labels do not count?
Is proselytism by shilling demonstrably against the word and example of the guy Jesus?
Account abandoned.
(Score: 2) by Azuma Hazuki on Thursday February 22 2018, @08:28AM (3 children)
This is misdirecting non-sequitur bullshit. You got your ass handed to you and you're trying to make a quick exit while getting in what you think of as a last blow. Define "labels?" As to the last question, no, it's Jesus' direct command, the Great Commission, that his followers proselytize.
I am "that girl" your mother warned you about...
(Score: 1, Flamebait) by Bot on Thursday February 22 2018, @02:40PM (2 children)
> define labels
see #639619
> as to the last question, no
see a dictionary about "shill"
Account abandoned.
(Score: 2) by Azuma Hazuki on Thursday February 22 2018, @10:54PM (1 child)
You never answer any of the pointed questions put to you, I can't help but noticing. This is not a way to win, or even participate in, a debate.
How about that free will question, huh? What proof do you have that we have any free will at all, let alone the specific libertarian type of free will required for Abrahamic apologia (Calvinism and Islamic occasionalism aside...) to have even chance of standing up to reality? Again: nearly everyone who thinks about this question in any depth is a compatibilist, and the reasons become obvious with a little thought. I assume you have a competing model you can both explain coherently and show why it's better than the compatibilist view...?
I am "that girl" your mother warned you about...
(Score: 2) by Bot on Friday February 23 2018, @10:54AM
I have already replied, the freedom that implies responsibility is given as axiomatic, else religions, nor these posts have no reason to exist whether they do or not. I have already replied that it is a situation resembling solipsism.
Something given as axiomatic implies I don't consider it provable, obviously.
So, yours is not an objection, it is presenting a corner case whose answer we both know. How it relates to the initial and apparently triggering, assertion (that both science and some religions consider the authority of who makes a claim insufficient to irrelevant wrt its validity) is a mystery to me.
Account abandoned.
(Score: 0) by Anonymous Coward on Sunday February 18 2018, @04:08PM
w00t? my post got deleted?