There’s been an increasing call in recent weeks and months for encryption to have government ‘backdoors’ put into them. This is a bad idea. No really, it’s an incredibly bad idea. Even if we took the assumption that it is a push that’s made with only the purest of intentions, and the government universal key is kept 100% safe and secure and never leaked or misused, it’s still a really, unbelievably, stupid idea.
Makes me angry tax money is used for research and engineering how to break citizen’s encryption, how to make my devices less secure.
Goes against everything I learned in IT security and software engineering in general. Of course this introduces bugs, unexpected side effects, and creates opportunities for 3rd parties with more competence but worse intentions.
Nah, it’s a great idea. As we know, the bad guys would NEVER use a backdoor put in place for the good guys. So it’s fine.
There’s an irony in the British government going on about this all the time, while at the same time fighting in court to prevent their WhatsApp messages being turned over to the Covind inquiry because of privacy concerns.
More generally, I think it’s a symptom of governments not being at all as tech savvy as they like to think they are.
The UK also has RIPA, under which it can compel a user to hand over passwords to encrypted material. For those of us in the US, that’s prohibited by the Fifth Amendment.
There’s a penalty specified by RIPA. Depending upon the specifics of what they believe to be at stake, up to between 2-5 years in prison for failing to provide access.
As far as the US goes, that’s incorrect. The issue is a 1A issue, not a 5A issue.
tl;dr - you are required to provide keys, combinations, fingerprints, etc. when there’s a warrant. You might not be required to provide passwords.
Let’s say cops have a search warrant for your house, and you have a safe in your house that they think the evidence of the crime they’re investigating is hidden in. But it’s locked. You are obligated to unlock that safe for them, whether it’s a physical key, a combination, or a fingerprint. If you refuse, you can be compelled, and can be held in contempt of court and held in jail until you comply. (Or course, in the case of a physical safe, refusing the provide the key would mean that they’d hire a security expert to destroy the safe in order to retrieve the contents. But that’s not possible with encrypted data.)
The problem is that a password is both a key and speech. I can be compelled to provide a key, but I can’t be compelled to engage in certain speech. So far, courts have been divided on what a password is, and I don’t believe that the question has been addressed by SCOTUS yet. (Although, knowing SCOTUS, I wouldn’t expect them to be tech-savvy enough to make a good ruling.) In some cases, people that have been under court orders to provide passwords have been held in jail on contempt charges until they’ve divulged the password, even when they say that they’ve forgotten the password in question.
Keep in mind that the people that this is often applied to are not usually people you’d want to be friends with; most of that cases I’ve seen in the news involve people that are accused of having child pornography, either uploading or downloading it, or terrorism. But obvs. revoking rights to deal with exceptionally scummy people also means that those rights get revoked for everyone else…
As far as the US goes, that’s incorrect. The issue is a 1A issue, not a 5A issue.
No, it’s a Fifth Amendment issue. The Wikipedia article I linked to discusses it. Being compelled to provide a password runs into some of the same problems that compelling self-incriminating testimony does.
search
You’re confusing the Fourth Amendment – which deals with searches – and the Fifth Amendment. You’re right that it’s not an issue of protection against illegal searches, which is what one might assume to be the case, but not correct as to the actual rationale that it runs into.
(Although, knowing SCOTUS, I wouldn’t expect them to be tech-savvy enough to make a good ruling.)
Honestly the current SCOTUS has largely been finding in line with those things explicitly and literally within the US Constitution. I could see them considering being required to provide a password being required to provide evidence against yourself, which is a Fifth Amendment violation, or compelling speech in violation of the First, like you said. It’s not impossible it violates both, and I’d expect to see that argument made in the decision.
Quis custodiet ipsos custodes?
Great article, and spot on about why backdoors in algorithms can’t functionally happen large scale.
One important thing to note that’s touched lightly on in the article though, is that services absolutely can have backdoors. That includes things like SMS messages, which go through various cell phone companies servers, and email, which is stored on your email provider’s servers, as well as common chat apps like Discord. So, if you have to send something sensitive via an uncontrolled channel like that, encrypt it first (using separate encryption tools).
Always the same awful takes from governments when it comes to encryption, just give us access to everyone’s data so we can monitor for terrorism. As if that access will stay in the right hand.
Don’t forget the ‘think of the children’ crowd who simultaneously pass policies that make kids starve. Whenever you hear those two justifications given for why a policy needs to be implemented you have to read it at least twice as hard, because they’re often used as cover to pass some of the most draconian shit.