Two Of The Most Ridiculous Statements From Senators At Yesterday's Encryption Hearings

Say That Again

from the these-people-are-in-charge? dept

We already wrote a bit about the two Senate hearings that FBI Director James Comey participated in yesterday, concerning his alleged desire to have a “discussion” about the appropriateness of backdooring encryption. The phrase tossed around at the hearings was about the FBI’s fear of “going dark” in trying to track down all sorts of hypothetical bad guys (and it always was hypothetical, since no actual examples were given). However, not all of the crazy statements came from Comey. There was plenty of nuttiness from Senators as well. It is, of course, difficult to pick out the most ridiculous, so here are two that stood out to me, personally. And, to avoid any charges of bias, I’ll include one from each hearing and one from a Democrat and one from a Republican.

Let’s start with the first hearing, the one before the Senate Judiciary Committee, where Senator Sheldon Whitehouse decides to add his bizarrely ignorant statements (starting around 1 hour, 18 minutes into the recording). Whitehouse starts out with a hypothetical (again!) story of a girl being kidnapped outside of her home (“taken into a van”), but having her phone left inside. He claims that in the past, law enforcement could get a warrant for the phone “to help locate the girl.” And now “they cannot do that.” This hypothetical makes no sense for a variety of reasons. First, the number of actual abductions like that is pretty rare. But, more importantly, if the phone is at home then it’s not exactly going to help law enforcement locate her any more. He’s mixing up a variety of different things involving location versus stored data encryption. It’s just a scare story that has little to do with the issue of stored data encryption, which is what the hearing is supposed to be about.

But, from there, he goes on to make an even more bizarre statement, claiming that companies pushing encryption are doing so solely for their own corporate benefit, creating harm for the public. In fact, he compares encryption to pollution, and then argues that there could be civil liability because encrypted phones make it difficult to find hypothetical kidnapped girls:

It strikes me that one of the balances that we have in these circumstances, where a company may wish to privatize value — by saying “gosh, we’re secure now, we got a really good product, you’re gonna love it” — that’s to their benefit. But for the family of the girl that disappeared in the van, that’s a pretty big cost. And, when we see corporations privatizing value and socializing costs, so that other people have to bear the cost, one of the ways that we get back to that and try to put some balance into it, is through the civil courts. Through the liability system. If you’re a polluter and you’re dumping poisonous waste into the water rather than treating it properly somebody downstream can bring an action and can get damages for the harm they sustained, can get an order telling you to knock it off.

This appears to be a thing that Senator Sheldon Whitehouse does. He makes up ridiculous hypotheticals of situations that aren’t happening and then jumps to flat out wrong arguments based on those hypotheticals.

Here, he’s just wrong that companies employing encryption are “privatizing value and socializing costs.” In fact, as many, many, many people will argue, companies that are putting in place end-to-end encryption actually can make it more difficult for them to make money, since they close off avenues such as targeted advertising, since they lose access to the information being transmitted. But, even more to the point, this entire argument is based on the simply wrong (and completely ignorant) argument that the there’s a “cost” to the public of greater encryption. That’s not just wrong, it’s so wrong as it should call into question the career choices of whatever clueless staffer fed that line to Senator Whitehouse. The whole crux of the argument, as has been explained over and over again, is that greater encryption better protects the public from cyberattacks, from those seeking to violate their privacy and from other potential malicious actors.

In other words, the actual scenario that Whitehouse should be concerned about is not the mythical girl being abducted into a van (again, a scenario that rarely happens), but the malicious online actors who are seeking to break into the girl’s bank account or other online accounts in order to cause all sorts of actual problems for her in real life. That’s the much more likely threat, and it’s the one that strong encryption helps protect. The whole idea that strong encryption is the equivalent of pollution is hilariously wrong. Pollution is a negative externality. But strong encryption is not a negative externality. It better protects the public. It’s a public benefit.

Senator Whitehouse’s argument is based on a near total misunderstanding of what encryption does and how it protects people, and is devoid of any understanding of actual threats that people face in the world — both the low likelihood of random abduction and the high likelihood of having your online accounts under attack. It’s so far from reality that it feels like Senator Whitehouse ought to issue an apology.

On to the second hearing before the Intelligence Committee. In this case, the Senator we’ll pick on is Senator John McCain. His part starts a little after the 1 hour and 15 minute mark into that video. And he’s focused on the worst kind of political grandstanding, hyping up FUD around ISIS, followed by a “but we must do something!” argument that ignores the simple fact that the plan he supports actually makes the problem worse, not better. As you’ll see, Senator McCain doesn’t care about that. He just wants something done. This one involves some back and forth with Comey, starting with the scare stories to start things out:

McCain: Is it true that, you have stated on several occasions, that ISIS poses over time a direct threat to the United States of America?

Comey: Yes.

McCain: And that is the case today?

Comey:: Yes. Everyday they’re trying to motivate people here to kill people on their behalf.

McCain: And every day that they take advantage of this use of the internet, which you have described by going to unbreakable methods of communicating, the more people are recruited and motivated to, here in the United States and other countries to attack the United States of America. Is that true.

Comey: Yes sir.

Okay, let’s just cut in here first of all to note that it’s not actually true. I mean, it’s possible that this is happening, but there still has yet to be a single credible story about ISIS successfully “recruiting” people in the US to perform an attack in the US. All of the ISIS “arrests” so far have been part of the FBI’s own plots, where it’s an FBI informant doing the “recruiting and motivating.”

McCain: So this is not a static situation. This is a growing problem, as ISIS makes very effective use of the internet. Is that correct?

Comey: That’s correct sir.

McCain: So with all due respect to your opening comments, this is more than a conversation that’s needed. It’s action that’s needed. And, isn’t it true that, over time, the ability of us to respond is diminished as the threat grows and we maintain the status quo?

Comey: I think that’s fair.

Actually, it’s not fair. It’s wrong. I mean, it depends on what kind of “action” we’re talking about — but since the entire hearing focused on backdooring encryption, it’s difficult to argue that the “ability to respond diminishes” over time because any plan to backdoor encryption wouldn’t be an actual response that matters. ISIS would quickly just switch to encrypted systems that aren’t backdoored by the US government, and there are plenty to choose from.

McCain: So, we’re now — and I’ve heard my colleagues, with all due respect talking about attacks on privacy and our Constitutional rights etcetera — but it seems to me that our first obligation is the protection of our citizenry against attack. which you agree is growing. Is that a fact?

Comey: I agree that is our first responsibility. But I also…

McCain: So the status quo is not acceptable if we support the assertion that our duty is to protect the lives and property of our fellow citizenry. That is our first priority. You agree with that?

Okay, first off, you should really watch this point to see the dismissive way he shrugs off the part about “privacy” and “our Constitutional rights etcetera.” It’s really quite disturbing, frankly. And that’s because the next line is just wrong. The Oath of Office given to Senators is that they will “support and defend the Constitution of the United States against all enemies, foreign and domestic.” It does not say anywhere that they are to “protect our citizenry against attack.” And it especially does not say that the role of a Senator is to protect the citizenry from attack over protecting the Constitution. It says the exact opposite. It says that his sole job is to protect the Constitution.

That a Senator who has been in office as long as McCain is flat out ignoring the Oath he’s taken many times, and actually arguing for a policy that he is admitting violates that oath is somewhat stunning. He is flat out saying, in violation of his oath, that his job is to undermine the Constitution if he believes it will protect the American people from attack.

And, just to highlight how incredibly stupid this statement is, pushing for backdoors on encryption doesn’t even do what he thinks it does. It actually makes Americans more open to attack by making their digital information less safe and secure. So even if we took McCain’s argument at face value and ignored that it’s directly in contrast to his oath of office, he’s still wrong, because he’s putting more Americans at risk, rather than “protecting” them.

As for Comey agreeing that this is a first priority, he’s wrong about that too. Some might think that is the first priority for the FBI, even if it isn’t for Congress, but it’s not. The FBI’s oath is also to “support and defend the Constitution against all enemies, foreign and domestic.”

McCain then drags out a bunch of leading questions in which he continues to try to make it out like “something must be done to stop this nasty encryption” stuff, getting Comey to (mostly) agree, even to completely bogus statements.

Comey: I agree that this is something that we have to figure out what to do about.

McCain: So now we have a situation where the major corporations are not cooperating and saying that if we give the government access to their internet, that somehow, it will compromise their ability to do business. Is that correct also?

Comey: (Shakes his head back and forth in a way suggesting he disagrees, but then says): That’s a fair summary of what some have said.

McCain: So we’re discussing a situation in which the US government — i.e., law enforcement and the intelligence community — lack the capability to do that which they have the authority to do. Is that correct?

Comey: Certainly with respect to the interception of encrypted communications and accessing locked devices, yes.

McCain: So we’re now in an interesting situation where your obligation is to defend the country, and at the same time, you’re unable to do so, because these telecommunications… these organizations are saying that you can’t, and are devising methodology that prevents you from doing so, if it’s the single key, only used by the user. Is that correct?

Comey: I wouldn’t agree, Senator, that I’m unable to discharge my duty to protect the country. We’re doing it every single day using all kinds of tools…

McCain: Are you able to have access to those systems that only have one key?

Comey: No, we can’t break strong encryption.

McCain: So, you can’t break it. And that is a mechanism which is installed by the manufacturer prevent you [sic] from using… that there’s only one key that is available to them… to you.

Comey: That’s correct.

Now, to his very slight credit, after this misleading back and forth, Comey eventually plays a slight devil’s advocate here, and at least attempts to channel the views of all of those computer security experts who have pointed out that backdooring encryption makes people less safe.

McCain: So suppose that we had legislation which required two keys. One for the user and one that, given a court order, requiring a court order, that you would be able to — with substantial reason and motivation for doing so — would want to go into that particular site. What’s the problem with that?

Comey: Well, a lot of smart people, smarter than I, certainly, say that would have a disastrous impact on broader security across the internet, which is also part of my responsibility.

McCain: Do you believe that?

Comey: I’m skeptical that we can’t find a solution that overcomes that harm. But a lot of serious people say “ah, you don’t realize, you’ll rush into something and it’ll be a disaster for your country. Because it’ll kill your innovation, it’ll kill the internet.” That causes me to at least pause and say “well, okay, let’s talk about it.”

At which point McCain totally ignores that point to go back to his but we need to do something! mantra.

McCain: But, we’ve just established the fact that ISIS is rushing in to trying… attempting… to harm America and kill Americans. Aren’t we?

Comey: They are.

McCain: So I say with respect to my colleagues, and their advocacy for our constitutional obligations and rights, that we’re facing a determined enemy who is, as we speak — according to you and the director of Homeland Security — seeking to attack America, destroy America and kill Americans. So it seems to me that the object should be here, is to find a way not only to protect Americans’ rights, but to protect American lives. And I hope that you will devote some of your efforts — and I hope that this Committee… and I hope the Congress will — understand the nature of this threat. And to say that we can’t protect Americans’ Constitutional rights in the same time protect America, is something that I, simply, won’t accept.

Except, we can protect Americans’ Constitutional rights and, at the same time, protect America: by enabling strong encryption that better protects the security and privacy of everyone, without adding unnecessary vulnerabilities in the form of government backdoors. McCain completely ignored the rebuttal point that his position actually makes America less safe by opening things up to those who wish to attack us.

Don’t we deserve Senators who don’t spout pure ignorance, focused on scaring the American public in ways that make us both less safe and take away the Constitutional rights they’ve sworn to defend?

There were plenty of other ridiculous claims made by Senators in both hearings, but these were the two nutty ones that stuck out for me. We deserve better elected officials.

Filed Under: congress, constitution, encryption, going dark, james comey, john mccain, senate, sheldon whitehouse