Former Homeland Security Advisor: Tech Companies Have The Burden Of Proving Harm Of Backdoored Encryption

from the FORTUNES-READ-AND-IGNORED---$5 dept

Last week’s one-sided “hearing” on encryption — hosted by an irritated John McCain, who kept interrupting things to complain that Apple hadn’t showed up to field false accusations and his general disdain — presented three sides of the same coin. Manhattan DA Cyrus Vance again argued that the only way through this supposed impasse was legislation forcing companies to decrypt communications for the government. The other two offering testimony were former Homeland Security Advisor Ken Wainstein and former NSA Deputy Director Chris Inglis.

Not much was said in defense of protections for cellphone users. Much was made of the supposed wrongness of law enforcement not being able to access content and communications presumed to be full of culpatory evidence.

But one of the more surprising assertions was delivered by a former government official. Wainstein’s testimony [PDF] — like Vance’s — suggested the government and phone makers start “working together.” “Working together” is nothing more than a euphemism for “make heavy concessions to the government and prepare to deliver the impossible,” as Patrick Tucker of Defense One points out. Wainstein says phone manufacturers must do more than theorize that weakened encryption would harm them or their companies. They must hand over “hard data” on things that haven’t happened yet.

Kenneth L. Wainstein, a former assistant attorney general for national security at the Department of Justice, told lawmakers that the burden is on technology companies and privacy advocates to show how backdoors would harm user security, rather than on law enforcement to prove that altering the encryption scheme would be safe.

“For the tech industry and civil liberties groups, this means laying out technically specific support for the contention that a government accommodation would undermine the integrity of default encryption. They should provide hard data that demonstrates exactly how—and how much—each possible type of accommodation would impact their encryption systems. It is only when Congress receives that data that it can knowledgeably perform its deliberative function and balance the potential cybersecurity dangers posed by a government accommodation against the national security and law enforcement benefits of having such an accommodation in place,” he said.

The only thing harder than proving a negative is proving how badly things might go if backdoors are inserted or companies are required to retain encryption keys.

As usual, the “smart guys” are ahead of the curve on this bizarre demand. Last year, multiple encryption experts collaborated on a research paper [PDF] that laid out the problems that would result from government-mandated access.

In this report, a group of computer scientists and security experts, many of whom participated in a 1997 study of these same topics, has convened to explore the likely effects of imposing extraordinary access mandates. We have found that the damage that could be caused by law enforcement exceptional access requirements would be even greater today than it would have been 20 years ago. In the wake of the growing economic and social cost of the fundamental insecurity of today’s Internet environment, any proposals that alter the security dynamics online should be approached with caution. Exceptional access would force Internet system developers to reverse forward secrecy design practices that seek to minimize the impact on user privacy when systems are breached. The complexity of today’s Internet environment, with millions of apps and globally connected services, means that new law enforcement requirements are likely to introduce unanticipated, hard to detect security flaws.

So, if Wanstein is looking for answers, he already has them. So does James Comey. So does Cyrus Vance. (Although, to be fair, Vance hasn’t really feigned much concern for tech companies or their customers.) They just don’t like the answers they’ve received. This is why they continue to claim that a perfectly safe, government-mandated encryption backdoor is just a “smart guy” breakthrough away. Any day now, someone at Apple or Google will shout “Eureka” and hand over the unicorn Comey, et al insist must exist.

Filed Under: , , , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Former Homeland Security Advisor: Tech Companies Have The Burden Of Proving Harm Of Backdoored Encryption”

Subscribe: RSS Leave a comment
Anonymous Coward says:

Re: Re:

The government (and its employees) would be exempted, of course.

So what you do is announce mandatory adoption of a proof-of-concept deployment for the immediate family members of government employees.

No need to provide the backdoor key to China.

Just make it publicly known that the backdoor exists in the proof-of-concept system.

It’ll be secure, after all, so having their family members on the new code wouldn’t be an issue, right?

Anonymous Coward says:

Re: Re: Re:

You don’t even have to go that far: the mandatory adoption would be for all PRIVATE accounts of government employees — the cell phones, private email servers, etc. that aren’t under government control. After all, the government has a responsibility to be able to see the communications NOT going through their servers, right?

Machin Shin (profile) says:

Re: Re:

Really sad part is you can actually show proof from the last time we had this debate. I can’t remember all the details but there was a vulnerability in browsers that was found recently but was a holdover from last time we had this debate.

The issue is that you can show these guys actual hard proof of the damage they are trying to cause and they will just wave it off. They are messing with systems they don’t understand and they choose intentionally to not understand.

lars626 (profile) says:

Homeland insecurity

Nobody ever seems to ask these bozos the obvious question.
Why don’t they get the NSA to design this magical system?
It would have to be open source so that anyone can implement and rigorously test it but that is not hard.

The NSA has a Lot of very smart people. Why can’t they ‘nerd harder’?

Or maybe it’s not really that easy.

Anonymous Coward says:

Re: Re: Homeland insecurity

huh? you didn’t grok anything.

what is being proposed is impossible to accomplish.

the NSA may have tried, but they would not have succeeded. They are asking for the impossible, using a well understood and known truth as a false and than asking for proof on something that has already been proven time and fucking again!

They are deflecting, a classic government maneuver that works too fucking well and too fucking much!

Politician A makes proposition.
Politician B gives alter proposition.
Politician A runs to media and said no one gave them any alternatives so we HAVE to go with A, when it reality A just did not like B’s proposition.

Therefore we ALL treat B like he never even happened. There is more than enough fucking proof on this subject and the Government is just sticking it fucking fingers in their ears and screaming la la la la la… and trying to say do it anyway.

That One Guy (profile) says:

Re: Homeland insecurity

Because if they did that, when the NSA failed to provide the impossible the tech companies could point to that and say ‘Look, a government funded agency filled with smart people couldn’t do it with a budget we could only dream about, what makes you think we could do it with less?’

At this point they have no excuse not to have familiarized themselves with the facts of the matter, which means unless the one making the claim is so colossally incompetent that they aren’t fit to run a gorram lemonade stand they know they are asking for the impossible, and they don’t want to provide a clear example of their own ‘smart people’ failing to achieve the impossible that could then be used against their idiotic claims by the companies they’re trying to pressure.

That One Guy (profile) says:

Re: Re: Re: Homeland insecurity

Given we’re talking about people who are theoretically employed to protect the public insisting on deliberately crippling security and making the public less safe, colossally incompetent in the general sense is pretty much a given, as they are showing that they seriously suck at their jobs.

Rather the distinction I was trying to make was between ‘Intentionally lacking in knowledge’ and ‘Knows better and lying’. Stupid or dishonest essentially, one or even both is possible, but at this point ‘neither’ isn’t.

beltorak (profile) says:

Re: Homeland insecurity

They already have tried. It was about to be foisted on us all. I think the only reason no one has bothered to fully break it was because nobody was insane enough to mandate its use. If it had been required on all telecommunications, you bet there would be cracks against the implementations (and possibly the algorithm itself) by now. Of course it’s also quite likely that only criminals would know about it.

Anonymous Coward says:

Anyone with half a brain understands that compromised encryption is harmful to everyone that uses it. But no matter how much proof you give guys like Wanstein or Comey they will never believe it because it’s never been about security to them, it’s about them having easy access to all our info and communications.

Anonymous Coward says:

Re: Re:

As a general rule, the split seems (by my informal assessment) to come down along the lines of education.

For the congress critters with a background in law, the “problem” is a lack of willingness on the part of the tech companies to comply.

The congress critters with math/science/engineering backgrounds seem to come down on the “wtf, no, that’s not how math works, this is a bad idea” side of the argument.

Anonymous Coward says:

Re: Re: Re:

As a general rule, the split seems (by my informal assessment) to come down along the lines of education.

Not really! While true this does have “some” play, the logic involved in this problem requires no education to understand!

The problem is nothing more than fundamental mental dissonance because someone needs an excuse to TAKE more power, nothing more. It is nothing ever more, in fact you should view about 100% of ALL government activity to work in this direction at all times and in all places. Even when they make it look like they are helping, it’s only because they gained a power they can use to crush with it.

And to never ever view the benevolence of one agent of the state as any benevolence of the state itself! The state has only 1 mode, malevolence and it must be rigorously controlled! This encryption debate is pure proof of that malevolence. The snarky comments about education, ignorance, stupidity, and other jokes on sanity are ill fitting of these times and do nothing to reveal the truth about government corruption.

orbitalinsertion (profile) says:

Ha. no, it’s up to these dancing monkeys to prove they need any such thing in the first place. What it really boils down to is giving law enforcement another way to intimidate and harass people. You know that any decryption scheme is just going to end up as some sort of general use tool that every nut who likes to rifle through people’s phones for no reason other than voyeurism will have. Because emergencies. Too complicated and time-critical to need to get a warrant or take it to some theoretically more tightly controlled decryption office.

That One Guy (profile) says:

Taking idiocy to it's (il)logical heights

Kenneth L. Wainstein, a former assistant attorney general for national security at the Department of Justice, told lawmakers that the burden is on technology companies and privacy advocates to show how backdoors would harm user security, rather than on law enforcement to prove that altering the encryption scheme would be safe.

While he’s at it he should demand that companies that create and sell locks provide hard evidence showing how easily picked or bypassed locks would be harmful to security, so he can ignore that too.

I know by this point that the anti-encryption crowd does’t actually have any good arguments to make but they could at least try to avoid the insanely stupid ones like ‘Provide evidence about how crippling security would present a threat to security’.

Anonymous Coward says:

Re: Taking idiocy to it's (il)logical heights

Mechanical locks have ANSI grades that describe their physical characteristics.

For example, ANSI 156.2, “Bored and Preassembled Locks and Latches”, Establishes performance requirements for bored and preassembled locks and latches, and includes cycle tests, strength tests, operational tests, security tests, material evaluation tests, finish tests, and dimensional criteria.

Similar criteria are available for safes, etc.

If you know the specs the physical lock was made to withstand, you know what’s required to break it.

_This_ is probably what non-technical legislators are thinking of when they’re saying “make crypto accessible”

To be fair, crypto also has ratings that are somewhat analogous to physical locks – key sizes, ciphers, hashes, etc.

Where locks and crypto differ, however, is in how they can be accessed. Assuming I live in the US, a hacker physically located china is going to have an exceedingly difficult time using a crowbar to pry open my front door.

The same cannot be said of internet-connected devices.

mcinsand (profile) says:

weaknesses are a problem even when not added intentionally

Vance might have a semitheoretical point if not for the hard fact that software has weaknesses even when those weaknesses are unintentional. This is merely a matter of entropy; as the software become more complex and more developed, security becomes more difficult. Determined people find software weaknesses every day that were not added intentionally. People that think an intentionally-added weakness would somehow escape notice really aren’t qualified for this discussion.

We need for Vance et al to be ready to put their money where their ignorance is; are they willing to take personal responsibility when a software weakness (backdoor) falls into the wrong hands and puts citizens at risk? They have received multiple warning that undermining security puts citizens at risk and they have ignored those warnings. Do they have the backbone and sense of responsibility to allow themselves to be treated as accomplices when the exploit they want to introduce puts people in harm’s way?

That One Guy (profile) says:

Re: 'Put your money where your mouth is' in a more literal sense

At this point I’d love to see someone call their bluff by demanding that if they really don’t think crippled encryption is that big of a deal they should match actions to words by having all of their personal data protected by deliberately crippled encryption. Medical, bank, personal email… all of it should be ‘protected’ by the very same level of security that they are insisting should be acceptable for anyone else.

They’d hire someone, or someone would volunteer(and I imagine there would be many volunteers for something like this) to intentionally create crippled encryption with a unicorn door, with the key to be held in a ‘secure’ location that is as accessible as a major company could manage. Once that’s done all their personal data would be ‘protected’ by the encryption, and the public would be informed that it exists, though given no other details beyond that.

They’d never do it of course, because while they’re incredibly dishonest I doubt any of them are that stupid, but it would be nice watching them squirm for a bit and try to explain how crippled encryption is plenty to protect the public, but not enough for public servants like themselves.

Norahc says:

Re: Re: 'Put your money where your mouth is' in a more literal sense

Even if they did do this, they’d just charge whoever hacked the data with violations of the anti-circumvent provisions of the Copyright Act, and throw in the CFAA charges along with a few others.

That way nobody could prove how dangerous encryption backdoors are without getting arrested and charged.

Anonymous Coward says:


The government can have this evidence as far as I’m concerned…right after they produce the evidence establishing with 100% verifiable proof that no hacker or government employee at the local, state, or federal level has EVER seen any information in the government’s possession on a US citizen without following a publicly defined procedure establishing a clear business need.

I’m waiting. Until that evidence is produced don’t even think of messing with my encryption.

In the interest of protecting taxpayers money, I suggest that the government start gathering their evidence by googling “OPM hack”

Anonymous Coward says:

To play devil’s advocate: Non-encryption-based security has been a cornerstone of societal security for centuries. If law enforcement and national security types have access to what encrypted info is protecting, they’ll have a greater likelihood of tracking down and catching bad people.

Problem is that they can’t be everywhere at once. Tracking down bad people after-the-fact of a crime rings hollow if that crime could’ve been prevented with use of unbreakable encryption.

This is a security (successfully responding to crime/espionage) vs. security (successfully preventing crime/espionage) issue. No amount of resources given to law enforcement and national security types could equal the security benefits to society that unbreakable encryption provides.

Tim R says:

Senate Hearing

Senator McCain: Call to order. We finally have an expert witness from the tech field here with us, who’s going to use his weak arguments and failed analysis to try and tell us why weakened security is a bad thing.

Industry Nerd: Thank you senator for your time. I’ll be brief, I only have one exhibit. This is what happens when security is weakened.

(boots up a ten-year-old Windows computer with no updates)

(picks up mic off stand, drops it on the floor, and walks out)

Manok says:

Since internet… mobile phones… are being used world wide, that means that ALL governments get access to these backdoors, right? And that NOT meaning, they can do a request to the U.S. to help them gain access, but they can access the backdoor themselves.

Why would Europe, Russia, and China want to use such non-encryption? Spy-encryption? Why would non-U.S. companies want to implement such schemes, except if they really really want to get access to that market?

Anonymous Coward says:

The question that first comes to mind is:

Where does this guy presume to derive the jurisdiction to compel so much as clenching an elevator fart?

On further reflection I suspect his intention is to bait people in the tech sector into take a position that is empirically correct but politically untenable. He wants to create a bullshit debate so he can go McCarthy on them and start locking the commi’s up for doing science, again.

Crypto is classified as a munition. If consumers use it and no harm is intrinsic to it’s use, material posession of it is protected by the second amendment. The action of using it is protected by the 4th amendment. The institutional subversion of it, is a violation of the 3rd amendment.

But before you even GET to any of those arguments, the institutional surveillance infrastructure that is currently in place is corrosive to the first amendment, and a violation of the third amendment WITHOUT encryption even being a factor.

So if there is anyone that needs to be brought to heal in terms of proving their patriotism, it sure as fuck isn’t anyone in the scientific community.

It isn’t just that these guys are wrong scientifically. They are wrong scientifically AND wrong legally. The burden of jurisdiction, precedes the burden of proof. In this case, once the former is served, the latter becomes irrelevant.

If truth has already been conceded for political expediency, then the continuation of debate is futile. Which would likely be why Apple didn’t show up in the first place.

John Fenderson (profile) says:

Re: The question that first comes to mind is:

“Crypto is classified as a munition.”

This is misleading. Crypto is not considered a munition by any US law.

It is considered a munition by ITAR (International Traffic in Arms regulations), but that only comes into play when in imports and exports. It has nothing to do with what US citizens can possess and use.

Also, the ITAR restrictions themselves were relaxed years ago, but certainly not eliminated. To the best of my knowledge, there has been only a single instance of someone being sanctioned under ITAR in over a decade:

Anonymous Coward says:

Re: Re: The question that first comes to mind is:

“This is misleading.”

If they’ve taken punitive action based on it, then it is recognized law. Absent more specific interpretations, stare decisis should apply, should it not?

Which is my whole point. They have already decided WHAT cryptography is. What they are trying to do now, is manufacturing a basis of bullshit to deprive citizens of the benefits of it.

This entire issue is a “separate but equal” law, where an aristocracy reaps the benefits of the labors produced by a technological labor class, while formally depriving that class of the product of it’s own labor.

This isn’t about national security, it never has been. It is about blackbirding the domestic technician population. The same motive has been behind the demonization of computer technicians across modern pop culture. It is about preserving power in a market that is consistently finding people “too sophisticated” to be bothered with computers, less valuable.

They are unconcerned for the offense they give. Perhaps even unaware of it. So were the Romans to the Visigoths.

John Fenderson (profile) says:

Re: Re: Re: The question that first comes to mind is:

“If they’ve taken punitive action based on it, then it is recognized law.”

Fair enough. I was drawing a distinction between regulations and law that isn’t really relevant in this situation.

Nonetheless, it only applies to imports and exports, and has nothing to do with what citizens can possess and use.

Anonymous Coward says:

Re: Re: Re:2 The question that first comes to mind is:

“Nonetheless, it only applies to imports and exports, and has nothing to do with what citizens can possess and use.”

Personally I think it would be hard to convince a jury, not to extend second amendment protections to strong crypto. Once you explained to them that strong crypto is currently what protects their financial security, I doubt many would concede to allowing the fed to make crypto it’s own exclusive domain.

I suspect this argument would have come up if Lavabit hadn’t had it’s right to habeas corpus violated.

So the fact that the fed is having this argument AT ALL, is likely the result of Constitutional malpractice. They aren’t on the slippery slope anymore. Now it is more like careening down the side of a mountain.

John Fenderson (profile) says:

Re: Re: Re:3 The question that first comes to mind is:

There is no Constitutional problem with ITAR that I can think of. What would be the Constitutional argument against it?

(Just to be clear, I think the ITAR classification of crypto is a really bad thing, but that’s different than whether or not there’s a Constitutional problem.)

Anonymous Coward says:

A practical demonstration

Put a well-guarded safe on display in Central Park.
Put $100,000 in the safe.
Anyone with a valid key is allowed to open the safe and take the money.
Set the desktop background of every computer in the NYPD to a picture of the key and instruct the police to keep that picture secret and out of view at all times.

See how well that works out.

Beetle Bailey says:

Tyranny and Dictatorship in the making

This is just another example of how the government feels comfortable in furthering their espionage against it’s populous while downgrading the people’s personal rights of privacy; advocating that we are all terrorists unless they have the means to prove otherwise.

No entity is above the law; government or otherwise – unless tyranny and dictatorship follow. And the people are stripped of their legal right to live a free life without government interferences.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...