Senator John McCain Weighs In On 'Going Dark' Debate — Insists That He Understands Cryptography Better Than Cryptographers

from the maverick dept

Who knew that Senator John McCain understood encryption better than actual cryptographers? Late last week, he wrote an op-ed for Bloomberg View, in which he trots out all the usual talking points on how Silicon Valley just needs to nerd harder to solve the “Going Dark” problem. There’s lots of cluelessness in the piece, but let’s focus on the big one:

Top cryptologists have reasonably cautioned that ?new law enforcement requirements are likely to introduce unanticipated, hard to detect security flaws,? but this is not the end of the analysis. We recognize there may be risks to requiring such access, but we know there are risks to doing nothing.

Actually, it kind of is “the end of the analysis” because the core element of that analysis is the fact that any attempt to backdoor encryption doesn’t just make security weaker, it puts basically everyone at much greater risk. It introduces cataclysmic problems for any system that stores information that needs to be kept secure and private.

The following sentence is equally inane, in which he tries to place the “risks” of backdooring encryption on the same plane as the risk of ISIS using encryption. Let’s be clear here: the risk of backdooring encryption isn’t just significantly larger than the risk of ISIS using encryption, they’re not even in the same universe. Even worse, by backdooring encryption, you are almost certainly increasing the risk of ISIS as well, by giving them a massive vulnerability to attack and exploit. Trying to suggest that this is an “on the one hand, on the other hand” situation is so ridiculously ignorant, one wonders who the hell is advising Senator McCain on this topic.

The fact is that there are always some risks. Tens of thousand of people die in car accidents in the US every year, yet you don’t hear Senator McCain weighing the risks of driving versus the risks of banning cars. And that’s a much more reasonable position to stake out, because banning cars would actually reduce automobile deaths — but it would also cripple the economy. But here’s the thing: backdooring encryption has the potential to do much more damage to the economy than banning automobiles, because it would create vulnerabilities that could really completely shut down our economy. So, for McCain to pretend that there are somewhat equal risks on either side isn’t just ignorant and meaningless, it’s dangerous.

Some technologists and Silicon Valley executives argue that any efforts by the government to ensure law-enforcement access to encrypted information will undermine users? privacy and make them less secure. This position is ideologically motivated and profit-driven, though not without merit. But, by speaking in absolute terms about privacy rights, they bring the discussion to a halt, while the security threat evolves.

Honestly, this is not true. I know that Comey’s favorite line these days is that using strong encryption is a “business model decision,” but Silicon Valley’s interest in strong encryption doesn’t appear to be driven by their own bottom lines, frankly. If it was, they would have adopted it much earlier. Strong encryption actually undermines some companies’ business models, in that it makes it more difficult for them to collect the data that many of them rely on. The move towards stronger encryption has mostly been the result of a few things: (1) the fact that the NSA broke into their data centers and put their legitimate users at risk, (2) a better understanding of the wider risks from malicious attackers of what happens when you have weak encryption and (3) user demands for privacy. The last one may have indirect business model benefits in that it keeps users happier, but to argue that keeping users happy is somehow a purely money-driven decision, and frame it as somehow a bad thing, is pretty damn ridiculous.

And, honestly, while there are some activists who speak in absolute terms about “privacy rights,” you rarely hear that from Silicon Valley companies. In fact, those who have absolute views on privacy tend to be the most critical of Silicon Valley companies for taking a much less principled view on “privacy rights.” McCain pretending that this is driven by some sort of “privacy rights” advocacy suggests he’s (again) woefully misinformed on this issue.

To be clear, encryption is often a very good thing. It increases the security of our online activities, provides the confidence necessary for economic growth through the Internet, and protects our privacy by securing some of our most important personal information, such as financial data and health records. Yet as with many technological tools, terrorist organizations are using encryption with alarming success.

Actually, they’re not using encryption with “alarming success.” There are very, very, very, very few examples of terrorists using encryption successfully. The Paris attackers? Unencrypted SMS. San Bernardino? Unencrypted social media communication.

The jihadists’ followers and adherents use encryption to hide their communications within the U.S. FBI Director James Comey recently testified that the attackers in last year’s Garland, Texas, shootings exchanged more than 100 text messages with an overseas terrorist, but law enforcement is still blinded to the content of those texts because they were encrypted.

Notice that this is the only example that comes up in these discussions. That’s because it’s the only example. And it’s not even a very good one. Because, as with most encrypted communication, the metadata was still perfectly accessible. That’s why they know that the attackers exchanged messages with a terrorist. Sure, they may not be able to understand the direct contents of the message, but the same thing would have been true if the attacker and the people he communicated with had worked out a code before hand. Or, you know, if they had met and talked in person. Is McCain going to ban talking in person too?

Finally, McCain’s “solution” to all of this is to make a law telling Silicon Valley to nerd harder and solve the problem… or else:

As part of this effort, Congress should consider legislation that would require U.S. telecommunications companies to adopt technological alternatives that allow them to comply with lawful requests for access to content, but that would not prescribe what those systems should look like. This would allow companies to retain flexibility to design their technologies to meet both their business needs and our national security interests.

In other words, despite the fact that all of the best cryptographers in the world have said that what you’re asking for is basically impossible and would make everyone less safe, just do it anyway — and do it in a way that when it falls apart and everyone is made more vulnerable, Congressional leaders like John McCain can spin around and blame the companies rather than themselves.

We have to encourage companies and individuals who rely on encryption to recognize that our security is threatened, not encouraged, by technologies that place vital information outside the reach of law enforcement. Developing technologies that aid terrorists like Islamic State is not only harmful to our security, but it is ultimately an unwise business model.

Does John McCain seriously not employ a single knowledgeable staffer who could point out to him that basically every encrypted technology that ISIS uses is not made by an American company? Seriously, look at the list of ISIS’s preferred encryption technologies:

So who, exactly, is developing technologies that “aid terrorists like Islamic State” and need their encryption undermined?

Meanwhile, we haven’t even touched on the biggest issue, as was highlighted in that big paper from Harvard last week. And it’s this: the whole Going Dark thing is a total myth, because for the tiny, tiny, tiny bit of information that is now blocked out by strong encryption, there’s a mountain of other data that is now accessible to law enforcement and the intelligence community. Things have been getting lighter and lighter and lighter for decades.

Shouldn’t a sitting Senator understand these basic facts?

Filed Under: , , , , , , , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Senator John McCain Weighs In On 'Going Dark' Debate — Insists That He Understands Cryptography Better Than Cryptographers”

Subscribe: RSS Leave a comment
35 Comments
Anonymous Coward says:

Re: Taste your own medicine

The problem isn’t really technological, it’s about policy and politics. Multikey cryptography is a solved problem. The unsolved problem is how to manage the keys and when access should be granted and by whom and under what conditions.

You say the government should develop its own encryption standard. I’d be careful what you ask for. The encryption standards already exist, only the policy is missing and that’s one thing the government likes to do. It would be very easy for them to mandate all phones sold in the US must be decryptable. Yes, hackers might be able to remove that capability, but most people wouldn’t and that’s probably good enough.

Almost Anonymous (profile) says:

Re: Re: Taste your own medicine

All of this has already happened. The NSA developed a backdoored encryption algorithm and then pushed ANSI, ISO, and the National Institute of Standards and Technology to adopt it as a formal standard. The NSA also paid off several companies to utilize it as a basis in their encryption products. The fact that the everyday American doesn’t know anything about this makes me a sad panda.

mcinsand (profile) says:

the risks of doing nothing

I facepalm whenever someone tries to pull this on me because usually they’re arguing for doing something questionable because ‘we can’t just do nothing.’ Actually, we can and we need to do nothing if our only choices are between doing something self-destructively stupid and nothing.

When it comes to encryption, we can pick three choices right now: backdoors, doing nothing, or start requiring broader use of strong encryption. The middle choice leaves our risk constant, the last choice reduces risk by making it harder for ‘the bad guys’ to gain useful information, or we could increase risk by undermining encryption.

Anonymous Coward says:

The politicians should be the beta testers.

All government agencies and officials should be the beta testers for all the crap they are trying to put the population thru.

All of them should use airport security and be subjected to the TSA and coach seats.

All of them and their staff should have use ‘law enforcement accessible’ encryption.

All of them should be subjected to the NSA surveillance before allowing laws to be enacted that the citizens of the United States are subjected to.

Let them lead by example or get out of the way.

While I’m at it, all lobbyists engaged in talking to government officials or their staff must be done with full public disclosure. Any lobbyist materials must be made public and all political donations to PACS must be made transparent.

We also need term limits for senators and congressman.
Government of the people, by the people, for the people – we should not fear the government, we should control it.

Self-governance is the basis of the United States Constitution.

We need to stop being sheeple and reclaim what is ours!

WAKE UP and Stop the B.S.

Anonymous Coward says:

Re: Re:

Government of the people, by the people, for the people

… that would be the Gettysburg Address, rather than the constitution.

> Self-governance is the basis of the United States Constitution.

… if by self-governance, you mean “a government over its own people”, which England was not, then yep. If you’re thinking of a “pure democracy”, well… you might want to read the document again.

Headmaster says:

how do you expect to get your pudding

These people are like children told they can’t have something totally ridiculous to ask for in the first place and then pitching a bloody fit when they are turned down.

I can see the lot of them yelling and screaming, between bouts of holding their breath until they turn blue (not a bad idea,) as they writhe around on the supermarket floor.

Anonymous Coward says:

Here is the most stupid part...

If they backdoor encryption and advertise that fact as they have been, then the terrorists will use other encryption that hasn’t been developed and backdoored by governments. So the sheeple will be freely hacked by the worlds criminal element and the terrorists will still have gone “dark”.

I think the only thing being backdoored here are the sheeple.

Mike Acker (profile) says:

homework

anyone who thinks surveillance is about fighting terrorism and protecting the people needs to do their home work.

suggested start

http://www.newsmax.com/Newsfront/dhs-isis-destroy-records/2016/02/06/id/713047/

the control of information has always been about protecting the organization — whether that be a corporation or a government. the real target is unwanted exposure. in the case of government this refers to dissidents .

Someone more Intelligent than McCain says:

Back at ya McCain

Some politicians and government officials argue that any efforts by the public to prevent criminal access to their encrypted information will undermine the governments ability to collect more data and fight terrorism. This position is ideologically motivated and profit-driven, though not without merit. But, by being complete morons about security and cryptography, they bring the discussion to a halt, while the security theater continues.

Anonymous Coward says:

The US Military use encryption to hide their communications worldwide. FBI Director James Comey recently testified that if there were backdoors in the encryption our military secrets will be put at risk. But since terrorists use encryption he felt it was better to allow the enemy to decrypt our communications so we can decrypt their communications, leveling the playing field so each side has an equal chance at success!

Almost Anonymous (profile) says:

Typical BS

Top cryptologists have reasonably cautioned that “new law enforcement requirements are likely to introduce unanticipated, hard to detect security flaws,” but this is not the end of the analysis. We recognize there may be risks to requiring such access, but we know there are risks to doing nothing.

Typical BS politician statement, “there may be risks to requiring such access”… No, there are *absolutely* risks, no “may” about it, which begins with a very strong possibility, and increases over time to near certainty, that the encryption backdoor will be discovered and used by criminals and other adversaries.

Why can’t they get this through their heads? What dementia affects career politicians that they don’t get that OUR ENEMIES will be able to read our most closely guarded secrets if they get their way?

/rant

Anonymous Coward says:

This is not about finding a good solution...

The good solution doesn’t exist, and they know it. They have been told by countless experts and probably their own people as well.
What they are after is that by law, they will be able to demand the shitty solution after a while when another way isn’t found.
They don’t want a fair deal here… they want everything for nothing, because I will bet everything I own that they won’t just go “oh, I guess it really was impossible. We better give up on this fools errand”. After a year, at the most, they will complain about how they were forced to use the most crappy solution ever, because the tech companies didn’t work hard enough or didn’t cooperate.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...