Giving Government 'Backdoor' Access to Encrypted Data Threatens Personal Privacy and National Security
The War on Terror is providing plenty of rhetorical ammunition to anti-encryption officials, but they are dangerously wrong.
The "Crypto Wars" are here again, which means federal officials are doing all they can to limit the technological tools that keep our personal data secure. President Obama and leaders from the National Security Agency (NSA), FBI, and Department of Homeland Security (DHS) have been pressuring the technology community to build "backdoors" that allow government access to encrypted data.
The War on Terror provides plenty of rhetorical ammunition to these anti-encryption officials, who seem to believe that purposefully sabotaging our strongest defenses against "cyberterrorists" is an effective way to promote national security. But they are dangerously wrong, as recent revelations of decades-old security vulnerabilities imposed by encryption restrictions make all too clear.
Encryption allows people to securely send data that can only be accessed by verified parties. Mathematical techniques convert the content of a message into a scrambled jumble, called a ciphertext, which looks like nonsense in electronic transit until it is decoded by the intended recipient. Simple ciphers have been used to secure communications since the days of the Egyptian Old Kingdom, when a particularly devoted scribe took to fancying up the tomb of Khnumhotep II with cryptic funeral prose. Our own Thomas Jefferson regularly used ciphers in communications with James Madison, John Adams, and James Monroe to "keep matters merely personal to ourselves."
State military and research offices were the main 20th century beneficiaries of advanced encryption techniques until the development of public-key cryptography in the 1970s, which afforded commercial and private users a means to protect their data against unwanted infiltration. Now, what was once a mere means to share secrets has become an indispensable component of personal and national data security.
An estimated 40 million cyberattacks occurred in 2014, imposing millions in costs and weeks of frustration for organizations and individual users alike. Many of these costly breaches could be prevented through encryption techniques that regulate data access, authenticate users, and secure sensitive information. A secret report from the U.S. National Intelligence Council—ironically, leaked by Edward Snowden thanks to the government's own poor authentication practices—even made the case that encryption was the "best defense" to protect private data. Yet intelligence agencies and their allies have consistently set out to limit encryption technologies (many of which they developed or relied upon themselves previously).
The seeds of the first Crypto Wars were sown during the Cold War, when the U.S. imposed strong export controls on encryption techniques to keep them away from the Ruskies. Only a small set of relatively weak techniques approved by the Commerce and State Departments could be used in international business. But this practice was dangerously self-defeating. Compelling foreign users to settle for weakened encryption standards ultimately made U.S. users more vulnerable by introducing unnecessary fragility.
A timely case in point is the recent revelations of security vulnerabilities in thousands of Web browsers and mail servers—vulnerabilities that were directly introduced by the artificially weak encryption programs compelled by the earlier export ban. In March, a massive vulnerability affecting the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols ubiquitous to most users' Internet experiences, called "FREAK," was discovered. Later in May, researchers discovered a similar TLS vulnerability, LOGJAM, which attacked a different kind of key exchange technique. These dual security bugs exposed countless Internet users to potential "man-in-the middle-attacks," allowing malicious hackers (or tight-lipped intelligence agents) access to supposedly secure data for decades.
Export controls on encryption were easier to enforce before the advent of personal computing, when only institutional (and usually government-connected) organizations operating huge supercomputers would be effected by such bans—although academics did not exactly hide their discontent at the inconvenience dealt to their research projects. The rise of the home computer dramatically changed the calculus. The export ban on encryption imposed arbitrary boundaries on a network that is borderless by definition.
Enter the cypherpunks: a ragtag, homebrew crew of anti-authoritarian hackers hell-bent on subverting spooks and protecting privacy on the 'Net. These luminaries developed the tools and rhetoric to make bad laws irrelevant by making them unenforceable. For example, Phil Zimmerman's Pretty Good Privacy (PGP) program, a mainstay of modern email delivery, which Zimmerman posted to Usenet in 1991. After a three-year criminal investigation, the U.S. Attorney's Office decided not to prosecute Zimmerman for sharing the encryption protocol. Throughout the '90s, federal officials continued to ease strict export restrictions, and the future of encryption seemed secure.
Edward Snowden's 2013 revelations, however, made it clear that the so-called "Crypto Wars" were actually far from settled. Snowden revealed that the NSA worked with foreign spooks to compromise encryption by controlling international standards for their own purposes and even out-and-out colluded with technology firms through the "BULLRUN" program. Only after these outrageous methods were exposed to the world did the forces of surveillance bother attempting to legitimize these practices through less illegal public means—albeit with the rhetorical gall of concealing obvious spying ambitions in the more reasonable garb of genuine law enforcement concerns.
Proposed new encryption-weakening schemes tend to take one of two major forms. First, messaging service providers such as WhatsApp that allow users to communicate though end-to-end encryption, which conceals data content even from the service provider itself, could be compelled to issue a dummy key to users while sneaking a real key to the NSA for intercepting or changing the content. Alternatively, the government could mandate a "key escrow" arrangement, creating a master key for officials capable of unlocking any of the encrypted data. Functionally, compelling backdoors to be baked into encryption standards that governments can use to access private data at any time is no different than surreptitiously breaking encryption behind the scenes. If mandated through law, such schemes would present blatant constitutional threats. For now, agency heads opt for a softer touch, ham-handedly sweet-talking Silicon Valley into doing their dark bidding "voluntarily."
We may be superficially saved from the more dramatic end of this spectrum of measures by officials' own technical illiteracy: computer science experts doubt that such hijinx are even technically feasible to the seamless degree that officials imagine. And even if these proposals do "work," they would be likely to introduce more unforeseen vulnerabilities into the fabric of the Internet. Besides, foreign countries such as China and Russia are unlikely to simply comply with America's dramatic decryption measures without pursuing these very same policies themselves (something Obama, of course, opposes).
As more of our lives come to rely on digitized data maintenance, encryption becomes all the more critical to protect our livelihoods and security. The prospect of intentionally weakening these techniques in an effort to crack down on shadowy cybercriminals should be as unthinkable today as a proposal to cripple real-world keys, locks, and walls to root out property thieves.
