National Security Officials Offer Hedged Support For Strong Encryption

from the we-like-it,-but-just-for-us dept

As Dianne Feinstein and Richard Burr mount another attempt to legislate holes in encryption, national security officials are offering testimony suggesting this is no way to solve the perceived problem. Another encryption hearing, again hosted by a visibly irritated John McCain (this time the villain is Twitter), featured testimony from NSA Director Michael Rogers [PDF] and Undersecretary of Defense for Intelligence Marcel Lettre [PDF] — neither of whom offered support for mandated backdoors.

As nice as that sounds, the testimony wasn’t so much “We support strong encryption,” as it was “We support strong encryption*.”

Lettre’s testimony follows statements of support for encryption — and opposition to legislated backdoors or “golden keys” — with the veiled suggestion that the government will be leaning heavily on tech companies to solve this problem for it.

We need to strengthen our partnership with industry to find ways to protect against the national security threats to the United States. We will continue to work closely with our industry partners to find innovative ways to outmaneuver malicious actors’ adoption of strong encryption, while ensuring that individual privacy interests are protected.

The problem here is that encryption isn’t so much a privacy issue as it is a security issue. Approaching it from this incorrect angle suggests Lettre isn’t opposed to backdooring encryption as long as access isn’t abused by the government. But that limitation isn’t going to stop malicious actors from abusing backdoors or other security holes built at the government’s behest. It could be that Lettre misspoke, but that misreading of the real issue casts doubt on the sincerity of the rest of that paragraph.

I believe any steps we take as a government must be carefully considered to avoid introducing unintentional weaknesses in the protection of our commercial networks and national security systems. We should also be careful not to negatively affect our economic competitiveness as a world leader in technology, which could unintentionally drive technology innovation outside the United States.

This isn’t quite as supportive as it might look at first glance either. Lettre wants to protect “commercial networks” and “national security systems.” This wouldn’t appear to cover computers, cellphones, or other personal devices that utilize encryption to protect their contents. Nor does it appear Lettre wants to extend his “hands off” approach to communications platforms that offer end-to-end encryption.

The NSA director’s testimony is a bit better. There’s far less hedging in Roger’s statement than in Lettre’s. Then again, it’s far more vague in terms of the NSA’s intentions. His statement poses more questions than answers (both figuratively and literally — it ends with a “where do we go from here” question), but it does hint at being aligned with Lettre’s suggestion that partnering with tech companies is a better solution than legislative mandates.

However, in the NSA’s case, its “partnerships” with tech companies often don’t appear to include approaching them directly. If anything, the “way forward” is the way things have been done for years by the NSA’s Tailored Access Operations. Why ask for mandated backdoors when you can just intercept hardware shipments to install your own? Or reroute server traffic with man-in-middle attacks that grab content before encryption is applied?

While it is heartening to see natsec leaders refusing to back legislation pushed by Security Committee members, the fact is that there’s still a powerful law enforcement lobby that can’t be ignored — one that begins with James “My god, it’s full of darkness” Comey and runs all the way down to local-level district attorneys.

These entities may not offer much vocal support for mandated backdoors and do actually realize the harm they’ll cause, but as long as their own stuff stays relatively protected, they’re not necessarily opposed to anything that makes it easier to access communications and data.

Filed Under: , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “National Security Officials Offer Hedged Support For Strong Encryption”

Subscribe: RSS Leave a comment
That One Guy (profile) says:

Just a suggestion...

We need to strengthen our partnership with industry to find ways to protect against the national security threats to the United States.

If you want to ‘strengthen [your] partnerships with industry’, have you perhaps considered not treating them as idiots, adversaries, or both?

Ignoring the tech sector when they tell you that something’s not just difficult it’s impossible, going around their backs to undermine their products when you’re not slapping them with insane demands coupled with gag clauses, arguing that tech companies should be forced to implement government demands that stand to cost the company serious cash and public goodwill, for no real gain…

So long as the government continues to treat the tech sector as idiotic adversaries they will respond in kind, and the idea of a ‘partnership’ in any sense beyond ‘Do it or we’ll make you do it’ will remain a pipe dream.

DannyB (profile) says:

Privacy and Security

Privacy and Security are more similar than the congress critters and national security buffoons would like to admit.

Consider these issues:
* I don’t want you to break into my ${thing}
* I don’t want you to remove items from my ${thing}
* I don’t want you to add items to my ${thing}
* I don’t want you to see what is in my ${thing}

Are the above items Privacy issues or are they Security issues?

They seem to be Privacy issues when ${thing} = Computer / Phone

They seem to be Security issues when ${thing} = Home / Car

But why is Computer / Phone so different than Home / Car? Why does Warrant Required and Unreasonable Search And Seizure, and be Secure in Papers and Effects suddenly mean something different for Home / Car / Papers than it does for Computer / Phone?

To make it seem like they are different, the words Security or Privacy are used to categorize them.

It’s also amusing that one applies to us while other applies to them:
* It’s no big deal if we hack you even though it invades your Privacy but doesn’t cause any actual harm
* It’s a major crime for you to hack us and violate our Security even though you didn’t cause any actual harm

When it’s us, it’s just our privacy. When it’s them, it’s their security.

That One Guy (profile) says:

Re: Privacy and Security

But why is Computer / Phone so different than Home / Car? Why does Warrant Required and Unreasonable Search And Seizure, and be Secure in Papers and Effects suddenly mean something different for Home / Car / Papers than it does for Computer / Phone?

Because they really, really don’t like the limitations the law (theoretically) imposes on them with regards to home/car/papers, and while ideally they’d like those limitations removed entirely, they’ll settle, for now, for making sure that the limitations don’t exists with regards to anything else.

Anonymous Coward says:

We won't learn until it's too late....

It’s a bad idea to build technologies with capabilities you wouldn’t want your worst case enemy to be able to use as well.

Dear Congress: What happens to the US if the boogey-man du jour somehow manages to get control of this capability? Leave aside the “how” and focus on the result. Is that what you want? Are you sure?

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...