Encryption Working Group Releases Paper To 'Move The Conversation Forward'

(Mis)Uses of Technology

from the what-conversation? dept

One of the frustrating aspects of the “debate” (if you can call it that) over encryption and whether or not law enforcement should be able to have any kind of “access” is that it’s been no debate at all. You have people who understand encryption who keep pointing out that what is being asked of them is impossible to do without jeopardizing some fairly fundamental security principles, and then a bunch of folks who respond with “well, just nerd harder.” There have been a few people who have suggested, at the very least, that “a conversation” was necessary between the different viewpoints, but mostly when that’s brought up it has meant non-technical law enforcement folks lecturing tech folks on why “lawful access” to encryption is necessary.

However, it appears that the folks at the Carnegie Endowment put together an actual working group of experts with very varying viewpoints to see if there was any sort of consensus or any way to move an actual conversation forward. I know or have met nearly everyone on the working group, and it’s an impressive group of very smart, and thoughtful people — even those I frequently disagree with. It’s a really good group and the paper they’ve now come out with is well worth reading. I don’t know that it actually moves the conversation “forward” because, again, I’m not sure there is any conversation to move forward. But I do appreciate that it got past the usual talking points. The paper kicks off by saying that it’s going to “reject two straw men,” which are basically the two positions frequently stated regarding law enforcement access to encrypted communication:

First of all, we reject two straw men?absolutist positions not actually held by serious participants, but sometimes used as caricatures of opponents?(1) that we should stop seeking approaches to enable access to encrypted information; or (2) that law enforcement will be unable to protect the public unless it can obtain access to all encrypted data through lawful process. We believe it is time to abandon these and other such straw men.

And… that’s fine, in that the first of those statements is not actually the position those who support strong encryption actually hold. I mean, there have been multiple reports detailing how we’re actually in the “golden age of surveillance”, and that law enforcement has so much greater access to basically every bit of communications possible, and that there are plenty of tools and ways to get information that is otherwise encrypted. Yes, it’s true that some information might remain encrypted, but no one has said that law enforcement shouldn’t do their basic detective work in trying to access information. The argument is just that they shouldn’t undermine the basic encryption that protects us all to do so.

Where the paper gets perhaps more interesting is that it suggests that any debate about access to encrypted data should focus on “data at rest” (i.e., data that is encrypted on a device) rather than “data in motion” which is the data that is being transferred across a network or between devices in some form. The paper does not say that we should poke holes in encryption that protects data at rest, and says, explicitly:

We have not concluded that any existing proposal in this area is viable, that any future such proposals will ultimately prove viable, or that policy changes are advisable at this time

However, it does note that if there is a fruitful conversation on this topic, it’s likely to be around data at rest, rather than elsewhere. And, from there it notes that any discussion of proposals for accessing such data at rest must take into account both the costs and the benefits of such access to determine if it is viable. While some of us strongly believe that there is unlikely to ever be a proposal where the costs don’t massively outweigh the benefits, this is the correct framework for analyzing theses things. And it should be noted that, too often, these debates involve one group only talking about the benefits and another only talking about the costs. Having a fruitful discussion requires being willing to measure both.

From there, the group sets up a framework for how to weigh those costs and benefits — including setting up a bunch of use cases against which any proposal should be tested. Again, this seems like the right approach to systematically exploring and stress testing any idea brought forth that claims it will “solve” the “problem” that some in law enforcement insist encryption has created for them. I am extremely skeptical that any such proposal can pass such a stress test in a manner that suggests that the benefits outweigh the costs — but if those pushing to undermine encryption require a “conversation” and want people to explore the few proposals that have been brought up, this is the proper, and rigorous, way to do so.

The question, though, remains as to whether or not this will actually “move the conversation forward.” I have my doubts on that, in part because those who keep pressing for undermining encryption have never appeared to have much interest in actually having this type of conversation. They have mostly only seemed interested in the “nerd harder, nerds” approach to this, that assumes smart techies will give them their magic key without undermining everything else that keeps us secure. I fully expect that it won’t be long before a Willam Barr or Chris Wray or a Richard Burr or a Cy Vance starts talking nonsense again about “going dark” or “responsible encryption” and ignores the framework set out by this working group.

That’s not so say this wasn’t a useful exercise. It likely was, if only to be able to point to it the next time one of the folks listed above spout off again as if there are no tradeoffs and as if it’s somehow easy to solve the “encryption problem” as they see it.

Filed Under: data at rest, encryption, going dark, law enforcement, nerd harder, responsible encryption