国产视频

In Short

Is the Cold War Over Encryption at a Boiling Point?

Cyber
CC0 Public Domain

Since Edward Snowden blew the lid off of the National Security Agency鈥檚 broad range of bulk surveillance and hacking programs鈥攊ncluding the NSA鈥檚 directly into Yahoo and Google鈥檚 private data links, and its use of a of security vulnerabilities in a range of U.S. tech companies鈥 hardware and software products鈥攔elations between the feds on the East Coast and techies on the West Coast have been downright chilly. From the perspective of many in the American tech industry, the NSA鈥檚 actions represent an 鈥溾 similar to the cyber-threats posed by organized crime or Chinese intelligence, while also by undermining worldwide consumer trust in the security of American companies鈥 products.

The relationship between the feds and techies got even chillier over the winter, when the FBI director and the U.S. attorney general Apple and Google for securing the data on iPhone and Android smartphones with strong that only the phone鈥檚 owner could bypass, and when President Obama with U.K. Prime Minister David Cameron that tech companies should build surveillance backdoors for the government into their products.

The relationship practically iced over in the past week as not one but two bombshell stories broke about how the NSA is undermining the security of our computers and cell phones: , the story that NSA has figured out how to hide spyware in the firmware of a wide variety of brands of computer hard drives, so that the infection persists even when the hard drive is completely wiped and the operating system is reinstalled; , the story that NSA had supported the U.K.鈥檚 signals intelligence agency GCHQ in breaking into the servers of SIM card manufacturer Gemalto and stealing millions of encryption keys enabling mass cellphone surveillance.

That icy conflict turned hot this Monday at a hosted by 国产视频 (where I work for the Open Technology Institute) to launch its new . There, the director of the NSA was confronted by the head of security at Yahoo, who had a simple question: If the federal government cares so much about cybersecurity, why does it want us to make our products less secure?

A transcript of the question-and-answer exchange between Yahoo Chief Information Security Officer Alex Stamos and Adm. Mike Rogers, director of the NSA and U.S. Cyber Command, is available . But it basically boiled down to this: Stamos wanted to know why Rogers agreed with FBI Director James Comey that companies should build backdoors into their encrypted products to facilitate government surveillance, when all the technical experts say that cannot be done without other than the government. In response, Rogers quibbled with the use of the term 鈥渂ackdoor鈥 just as Comey has鈥斺淲e aren鈥檛 seeking a back-door approach,鈥 Comey said in an earlier on the topic; 鈥淲e want to use the front door鈥濃攁nd stated his belief that it was 鈥渢echnically feasible鈥 that surveillance capability could be built into products without otherwise compromising security, so long as we put in place an appropriate legal framework to guide its use.

However, as noted security expert Bruce Schneier put it later in the conference during his own keynote conversation: 鈥淚t鈥檚 not the legal framework that鈥檚 hard, it鈥檚 the technical framework.鈥 Put another way, as Schneier has before, 鈥渢here鈥檚 no technical difference between a 鈥榝ront door鈥 and a 鈥榖ack door鈥,鈥 only a semantic difference, and whatever you call it, it will undermine security overall. Stamos likened the introduction of backdoors into encrypted products to 鈥渄rilling a hole in the windshield鈥濃攂y trying to provide a narrow entry point just for the government, you end up undermining the overall integrity of the encryption shield. Indeed, as Stamos pointed out in his exchange with the NSA director, 鈥渁ll of the best public cryptographers in the world would agree that you can鈥檛 really build backdoors in crypto鈥濃攁 fact that can be verified by looking at this extensive of all of the writing on the subject that鈥檚 been published since the Apple/Google crypto debate first flared up last year. When Rogers replied that he had a lot of 鈥渨orld-class cryptographers鈥 at the NSA, Stamos indicated that he had talked to some of them too and they agreed with his position. Echoing Stamos, ACLU technologist Chris Soghoian his expectation that there would be 鈥渇acepalms鈥 back at NSA HQ by mathematicians embarrassed by their director鈥檚 statements.

By joining with the FBI director and the attorney general in condemning encryption that doesn鈥檛 allow for government snooping, Rogers on Monday increased the chances that the cold war between the feds and the techies is about to get hot. However, President Obama himself offered a much more nuanced position just a couple of weeks ago while visiting the West Coast for the at Stanford. In an after that summit鈥攚here Apple CEO Tim Cook that he and others in his industry had a responsibility 鈥渢o do everything in our power to protect the right to privacy鈥濃攖he president offered an olive branch on the encryption issue and backed away from the stronger statements of his law enforcement and intelligence officials, saying that he was 鈥渁 strong believer in strong encryption,鈥 that 鈥渢here鈥檚 no scenario in which we don鈥檛 want really strong encryption.鈥 And although he recognized that such technology may pose challenges to law enforcement and that 鈥渨e鈥檙e really gonna have to have a public debate鈥 about how to address those challenges, he suggested that 鈥淚 lean probably further in the direction of strong encryption than some do inside of law enforcement.鈥

The techies on the West Coast should be heartened by the president鈥檚 comments, even if they would have an even stronger statement in favor of encryption, and even if they were ultimately by the president鈥檚 call at Stanford for more cooperation between government and industry on cybersecurity. (鈥淲hy are people going to want to share with a government that鈥檚 weaponizing our technologies?鈥 asked one commentator). But when the president, or the NSA director, or anyone else in government calls for a public debate on the issue, they should be reminded: we already had this debate twenty years ago in the so-called 鈥溾 of the 鈥90s. When faced with the choice between strong encryption or government backdoors, policymakers ultimately chose strong encryption, recognizing that it was the cornerstone of information security and therefore also a cornerstone of the information economy and American competiveness in a global tech marketplace.

Today鈥檚 policymakers should learn from that history and follow the of the Review Group appointed by the president to examine the NSA鈥檚 programs: The U.S. government must support, rather than undermine, the use of strong encryption. Following that advice would help mend the fences between the feds and the techies and better ensure that government and industry can work together to address the serious cybersecurity threats that we all face. However, if we fail to heed the lessons of the Crypto Wars, we will be , and in a war between the tech industry and the federal government, everyone鈥檚 security will suffer.

This article originally appeared on Future Tense, a collaboration among , , and .

More 国产视频 the Authors

Kevin Bankston
Kevin Bankston
Is the Cold War Over Encryption at a Boiling Point?