Theresa May is asking for back doors in encryption (here).
"These companies have some of the best brains in the world. They must focus their brightest and best on meeting these fundamental social responsibilities."
I don't know how many times we have to try and explain that mathematics does not work like that. You cannot make a way to decrypt something only when there is a valid warrant issued by a judge. Maths does not understand judges or law. The only way it could work is if someone, somewhere, on accepting the warrant as valid, uses some back door that has been built-in to allow access.
Even just that one person, as if it would be only one person, could, on a whim, for their own amusement (or because criminals are paying them enough to move to a new country) decide to do the thing they would do if presented with a valid warrant. That person has means to hack in to encrypted communications - they have to have in order to enact the warrant, so the encryption is inherently flawed to allow that.
The system only works if there are flaws and back-doors, and no matter how you try, these will be exploited by criminals. Simple as that.
So my thought is how the hell do we explain this to politicians.
They are using "passive-aggressive flattery". They are saying we are smart and so surely we can work it out.
Well the same applies to the politicians, surely. They are smart. Surely we have some of the best brains in politics and law making. Surely they can just "make a law" which somehow only applies to "terrorists" and bans them using encryption and is a workable law that they will abide by. This leaves the rest of us the protection that strong encryption affords, but allows the government to see the communications of terrorists. Simples!
Surely they can make a law that would do that? They just need to get the best brains in law making together to focus on making such a law. How hard can it be?
I am no law maker, but surely this must be possible. And I will refuse to accept the comments from anyone being so negative as to suggest that "that is not how law works". They are just not trying hard enough.
Just make an effective and workable law that bans all terrorists from using encrypted communications. How hard is that? Do it!
Go on then? You have a civic responsibility to make such a law, get on and do it already?
You misunderstand Adrian - _they_ want to be able to hack everyone's communication, terrorist or not and most likely warrant or not. They are just using fear of terrorism or paedophilia as the levers to make it acceptable to the public.
ReplyDeleteBefore I called our PM a moron who has no idea how the Internet works. Hopefully she'll be ousted at some point.
ReplyDeleteI will now add to that statement: she's a moron who has no idea how encryption and mathematics works.
These people want everything. All to "keep us safe" of course. Even though GCHQ can't keep track of known terrorist suspects. Even though we know this stuff gets abused.
My biggest worry is that it will become illegal to own any electronic device without a government-sanctioned backdoor built in.
ReplyDeleteBecause criminals and terrorists will abide by that law, obviously.
DeleteWhat will happen is that some idiot will suddenly decide that ownership or possession of any device capable of encryption requires one to hold a licence. This will, of course, fix everything. This kind of stupidity is currently afflicting the property industry. "We hate landlords, therefore we will force them to hold licences, which prove nothing, but demonstrate to the public that we are clamping down on landlords".
DeleteI reckon there will be a terrorist incident in the UK at some point and the govt will take advantage of it to try and push this again. We will be told that the perps were known to the security services but all they could access were encrypted chats. If only they could read them this could have been prevented.
DeleteThe public will demand that "something must be done" and demand the very things that the govt has wanted to implement all along. The govt will then point to that as proof that they are justified in bringing in legislative changes.
A contrary view could be taken that they DO understand maths and that their statements are simply made to mold the public's view that government oversight of everything they do is a good thing.
ReplyDeletePerhaps your approach should be to assume that government advisors are reasonably competent and attempt to educate the public rather than government.
They naturally would put a backdoor in the "Pen Paper and Dice" method while at it. Politics seems to have magical powers.
ReplyDelete"I don't know how many times we have to try and explain that mathematics does not work like that."
ReplyDeleteI think I know: Theresa doesn't really care about anything except how the message she sends is perceived by potential voters. You'll need to keep explaining until she believes that potential voters don't want to hear this particular message about encryption.
I completely agree with you, but just to try to present a semblance of a counter argument...
ReplyDeleteHow about an encryption regime whereby a government issued public key is used (possibly this key even regularly cycles or is per company or something) and it is encrypted n of n style, so that either the intended recipient or the government can decrypt?
You could potentially require multisig authentication to use this government key, one held by say the secretary of state and one held by the head of the judiciary or something.
I'm sure there are flaws with this, not least that the government private key is a single attack point....
And I haven't addressed if we should WANT to do this, which I don't think we should!
But that is weakening security, instead of one person having a key (intended recipient) there are not two. That key can be used by a person, a person can be bribed, and a person can be incompetent. Making a system where even literally one person has the key is still a flaw, and you know that it would never work if every time they want to intercept something they have to got to that one person - it would be too much work, so that person would delegate it, and before long you have a whole department that has access to the keys.
DeleteAnyway, what you describe is a "back door" and they keep saying they don't want a back door :-)
Not to just spout tech buzzwords but this in some ways seems like an application for blockchain and smart contracts. An open ledger that shows each time this access had been used and whose private key was used etc.
DeleteOf course you are right, there is no way to do any of this without a non zero level of risk, and by definition you are opening additional attack vectors that did not previously exist.
All of this backdoor nonsense assumes that you have a benevolent government. What happens when it becomes malevolent or a dictatorship? We have been lucky so far as we have been in a period of relative stability. i.e no World Wars. If we behave like sheeple we get the government we deserve.
DeleteA 2nd decryption key might weaken security a little bit, but we have to be realistic in terms of degrees of weakening. It would weaken it a bit, but only by an immaterial amount compared with many other security weaknesses.
DeleteThe end users computer will likely have many other more serious security weaknesses (physical security, zero day exploits etc) that mean the level of weakening of a 2nd key would not cause a material security deterioration to the vast majority of the public.
But to the government, the benefit of eaves dropping on encrypted conversations would be huge in terms of being able to find out what the bad guys are up to...
Why would a criminal or terrorist follow that law though? Being nabbed for faulty crypto would be a good tip off that they are being investigated. Also see https://youtu.be/LwcBaRj02qI
DeleteAnd presumably you would want this to apply to all https as well. Else the criminals just use https! I think that would be very hard to enforce on all foreign web sites and probably means alll credit card transactions would not be allowed with uk users.
DeleteNever mind the concerns about weakening security — any kind of government-mandated "encryption regime" is simply unenforceable.
DeleteMany, if not most, encryption tools are developed outside of the UK, meaning that they cannot be forced to add the required government decryption key. Criminals, along with normal citizens who value their privacy, will just continue to use Signal, Telegram, ProtonMail, GPG or whatever. Attempting to block access to such foreign tools is hopeless, since blocking is laughably ineffective.
The only way to make this work would be to completely disconnect the UK from the global internet, turning it into an isolated British network under the government's jurisdiction. At which point we might as well be living in North Korea.
If reports are to be believed as accurate than even some North Koreans have access to the real/wider Internet. Reports say this is trusted Party workers and senior government officials. But they are not completely cut off.
DeleteBanning or trying to limit encyption won't achieve anything. Back in, I think, 2004 I was a sys admin in London for a major corporate. The firm was taking its first steps into Russia and Moscow. Moscow was to come under our EMEA Region which was headquartered in London. So I was asked to build a Windows XP laptop and ship it to the new fledgling Moscow office. Simple.
ReplyDeleteOur lawyers took some six months to negotiate this single laptop's entry into Russia as it contained encryption capabilities which, apparently, fell under "weapons laws" in Russia. I don't know whether it was true nor to what extent.
But all it really achieved was to delay our firm's entry into the Russian market and delay our contribution to the Russian economy.
The meeting ith government ministers and industry experts must be along these lines...
ReplyDeletehttps://www.youtube.com/watch?v=BKorP55Aqvg