Both Michael Hayden And Michael Chertoff Surprise Everyone By Saying FBI Is Wrong To Try To Backdoor Encryption

Say That Again

from the going-dark? dept

Well, here’s one we did not see coming at all. Both former Homeland Security boss Michael Chertoff and former NSA and CIA director Michael Hayden have said that they actually disagree with current FBI director Jim Comey about his continued demands to backdoor encryption. Given everything we’ve seen in the past from both Chertoff and Hayden, it would have been a lot more expected to see them both toe the standard authoritarian surveillance state line and ask for more powers to spy on people. At the Aspen Security Forum, however, both surprised people by going the other way. Marcey Wheeler was the first to highlight Chertoff’s surprising take:

I think that it?s a mistake to require companies that are making hardware and software to build a duplicate key or a back door even if you hedge it with the notion that there?s going to be a court order. And I say that for a number of reasons and I?ve given it quite a bit of thought and I?m working with some companies in this area too.

First of all, there is, when you do require a duplicate key or some other form of back door, there is an increased risk and increased vulnerability. You can manage that to some extent. But it does prevent you from certain kinds of encryption. So you?re basically making things less secure for ordinary people.

The second thing is that the really bad people are going to find apps and tools that are going to allow them to encrypt everything without a back door. These apps are multiplying all the time. The idea that you?re going to be able to stop this, particularly given the global environment, I think is a pipe dream. So what would wind up happening is people who are legitimate actors will be taking somewhat less secure communications and the bad guys will still not be able to be decrypted.

The third thing is that what are we going to tell other countries? When other countries say great, we want to have a duplicate key too, with Beijing or in Moscow or someplace else? The companies are not going to have a principled basis to refuse to do that. So that?s going to be a strategic problem for us.

He’s right on all accounts, and does an astoundingly good job summarizing all of the reasons that many experts have been screaming about ever since Comey first started whining about this bogus “going dark” claim. But then he goes even further and makes an even more important point that bears repeating: it’s not supposed to be easy for law enforcement to spy on people, because that has serious risks:

Finally, I guess I have a couple of overarching comments. One is we do not historically organize our society to make it maximally easy for law enforcement, even with court orders, to get information. We often make trade-offs and we make it more difficult. If that were not the case then why wouldn?t the government simply say all of these [takes out phone] have to be configured so they?re constantly recording everything that we say and do and then when you get a court order it gets turned over and we wind up convicting ourselves. So I don?t think socially we do that.

On top of that, he points out, as we and many others have, that even if you can’t figure out what’s in an encrypted message it does not mean you’ve really “gone dark.” There are other ways to figure out the necessary information, and people always leave some other clues:

And I also think that experience shows we?re not quite as dark, sometimes, as we fear we are. In the 90s there was a deb ? when encryption first became a big deal ? debate about a Clipper Chip that would be embedded in devices or whatever your communications equipment was to allow court ordered interception. Congress ultimately and the President did not agree to that. And, from talking to people in the community afterwards, you know what? We collected more than ever. We found ways to deal with that issue.

Soon after that, at the same conference, Hayden spoke to the Daily Beast and more or less agreed (it is worth noting that Hayden works for Chertoff at the Chertoff Group these days). Hayden’s denunciation of Comey’s plan is not so detailed or thought out, and he admits he hopes that there is a magic golden key that’s possible, but recognizing it’s probably not, he thinks the damage may be too much:

?I hope Comey?s right, and there?s a deus ex machina that comes on stage in the fifth act and makes the problem go away,? retired Gen. Michael Hayden, the former head of the CIA and the NSA, told The Daily Beast. ?If there isn?t, I think I come down on the side of industry. The downsides of a front or back door outweigh the very real public safety concerns.?

As the Daily Beast notes, this is — to some extent — a roll reversal between Hayden and Comey who famously clashed over Hayden’s original warrantless wiretapping program after 9/11, with Comey actually arguing against some of the program (though what he argued against wasn’t as complete as some believe). Still, it’s quite amazing to see both Chertoff and Hayden point out what the tech sector has been telling Comey for months (decades if you go back to the original “crypto wars.”) This isn’t a question about “not wanting to do the work” but about the fact that any solution is inherently much more dangerous for the public.

Filed Under: encryption, going dark, james comey, jim comey, michael chertoff, michael hayden, mobile encryption