Congressional Committees Say Backdooring Encryption Is A Bad Idea

Say That Again

from the sorry,-Jim,-but-thanks-for-asking! dept

Two bipartisan Congressional committees are the latest to express their opposition to government-mandated encryption backdoors. The House Judiciary Committee and the House Energy and Commerce Committee have arrived at the same conclusion as the experts FBI director James Comey insists on ignoring: encryption backdoors are a net loss for everyone, no matter what gains might be experienced by law enforcement and intelligence agencies.

This is stated plainly in the first bullet point of its encryption report [PDF]:

Any measure that weakens encryption works against the national interest

While the committees acknowledge encryption can impede investigative efforts, the downsides of backdoors cannot be offset by making things easier for certain government agencies.

[S]takeholders from all perspectives acknowledged the importance of encryption to our personal, economic, and national security. Representatives of the national security community told the EWG that strong encryption is vital to the national defense and to securing vital assets, such as critical infrastructure. Civil society organizations highlighted the importance of encryption for individual privacy, freedom of speech, human rights, and protection against government intrusion at home and abroad. Private sector stakeholders—in particular, their information security officers—and members of the academic community approached the question from an engineering perspective—against a wide array of threats, foreign and domestic, encryption is one of the strongest cybersecurity tools available.

However, the committees still believe there might be a way to reconcile competing interests, even though it has more questions than answers at this point. The report suggests more “collaboration” between tech companies and law enforcement agencies — a term that generally means most of the compromises will be made by the private sector. Whether this means companies collecting more data and communications and storing them where law enforcement can access them or creating “one time” backdoors in response to court orders remains to be seen.

More encouragingly, the report suggests the “smart guys” in law enforcement haven’t fully taken advantage of the tools and data available to them.

It also remains unclear whether the law enforcement community is positioned to fully leverage the unencrypted information still held by many companies. A number of stakeholders acknowledged the potential benefit of improving law enforcement’s understanding of what data or information is available, who controls it, and how it could be useful to investigators. In particular, companies are often able to provide volumes of unencrypted metadata associated with their products or services. In some cases, this source of information could be useful to investigators. In others, one representative of a law enforcement agency told the EWG, access to a stream of metadata might be more like “looking for a particular grain of sand on the beach.”

This is probably the result of the law enforcement mindset. It often seems agencies are more interested in what is quickest and easiest, rather than what might be more productive, if just a bit more difficult. (A number of cases where warrants were never obtained, despite officers having both the time and probable cause to do so, is evidence of this mindset.) The report suggests this is one area where things could be improved by collaboration with private companies. It’s not a terrible suggestion but it’s one that requires agencies to move on from their defeatist attitudes and to stop pretending advances in technology are always far more beneficial to criminals than to law enforcement.

The report also inadvertently points out just how disingenuous it is to shrug off mass surveillance concerns by saying, “It’s just metadata.”

Metadata may not completely replace the loss of encrypted content, but metadata analysis could play a role in filling in the gap. The technology community leverages this information every day to improve services and target advertisements. There appears to be an opportunity for law enforcement to better leverage this information in criminal investigations.

The report also touches on “legal hacking” as a potential solution — albeit one with very limited practical application. If this is the route the government chooses to go more frequently in response to encrypted devices, it will signal the end of the already mostly-worthless Vulnerabilities Equity Process. It would also — as the report acknowledges — only further the “us vs. them” conflict between tech companies and law enforcement, as the government’s interest in keeping vulnerabilities secret would tend to outweigh its obligation to divulge security holes to affected companies.

While the report breaks very little new ground in terms of issues raised, it does at least signal that legislative efforts to undermine encryption aren’t likely to find much bipartisan support. So, for the time being, device encryption is still safe. It’s the other issues raised — legal hacking, compelled disclosure, etc. — that will need to be watched closely in the future.

Filed Under: backdoors, congress, crypto wars, encryption, going dark, house energy & commerce committee, house judiciary committee, james comey