Lawmakers Need To Learn More About Encryption Before Regulating It, Says U.S. House Report
The House Committee on Homeland Security issued a report called “Going Dark, Going Forward,” in which it found after more than 100 meetings and briefings with stakeholders impacted by the use of encryption that the whole encryption debate may be flawed. What they learned is that there’s no simple solution without “troublesome trade-offs” regarding encryption and “going dark.”
How The Encryption Debate Began
What started the encryption debate in the first place was the fact that both Apple and Google announced stronger local storage encryption enabled by default for their devices back in 2014. The public fight against strong encryption has been mostly championed by FBI Director James Comey, who then took it up a notch when Apple said it wouldn’t help the agency unlock the iPhone of the San Bernardino shooter.
Apple has been adamant that such a move would serve only to weaken the security of its devices, which then sparked a larger national debate about whether Apple and other companies should be compelled to decrypt their devices. However, that ultimately culminated with the FBI backing off and saying it found an alternative way to unlock the iPhone.
Anti-Encryption Bill
Senator Diane Feinstein, who has been a champion of surveillance laws such as the 2008 FISA Amendments Act and its 2012 renewal, as well as the “Cyber-Patriot Act” legislation passed under the guise of “cybersecurity legislation” last year, also tried to pass an anti-encryption bill in the Senate.
However, the bill’s draft has been highly criticized by security experts, as well as by Senator Ron Wyden (apparently the only member of the Senate Intelligence Committee that ever seems to want less surveillance rather than more), who promised he would filibuster it.
The authors of the recent report also seem to believe that Feinstein and Senator Richard Burr’s anti-encryption bill would’ve had major unintended consequences.
“Initially, lawmakers and some among law enforcement personnel believed the solution was simple: statutorily authorize law enforcement access to obtain encrypted data with a court order,” said the report authors.
“Unfortunately, this proposal was riddled with unintended consequences, particularly if redesigning encryption tools to incorporate vulnerabilities – creating what some refer to as ‘backdoors’ – actually weakened data security. Indeed those vulnerabilities would naturally be exploited by the bad guys – and not just benefit the good guys,” they added.
Security Vs. Security
The FBI and other members of the U.S. government have tried to paint this debate as “privacy vs. security”. The authors of the “Going Dark, Going Forward” report learned that the debate is really one about “security vs. security,” because what encryption does as its principal goal is protect data.
This is partly the reason why the European Union calls its digital privacy laws “Data Protection” regulations, because what we really mean by “digital privacy” is the ability to protect our data, and for that, encryption is critical.
Therefore, if we want our data to be properly protected, then strong encryption with no weaknesses is needed. Otherwise, those weaknesses will be discovered and abused by bad actors. The House Committee on Homeland Security agreed in the report that strong encryption can be used to protect personal communications and information, but also critical infrastructure, trade secrets, financial transactions, and other types of sensitive information.
No Simple Solutions
The report also said that we’re just beginning to understand the impact of encryption on society, and it would be a mistake for Congress to put a burden on technology companies by restricting what type of encryption they can use. It also said that it could hurt U.S. companies’ competitiveness, in contrast to what the CIA director recently said about foreigners having no choice but to use U.S. products and services.
“In our estimation, the best way for Congress and the nation to proceed at this juncture is to formally convene a commission of experts to thoughtfully examine not just the matter of encryption and law enforcement, but law enforcement’s future in a world of rapidly evolving digital technology,” said the members of the House Committee on Homeland Security.
They added that, “We believe that experts in the fields of commercial technology, computer science and cryptology, privacy and civil liberties, law enforcement, intelligence, and global economics are best equipped to deconstruct this extraordinarily complex problem, and propose novel solutions that will stand the test of time.”
House Homeland Security Chairman Michael McCaul (R-TX) and Senator Mark Warner (D-VA) have proposed the formation of a “Digital Security Commission” that brings together all stakeholders to further explore this issue for another year, before recommending policies and legislation to Congress.
However, it’s not clear whether this type of commission can find an ideal solution, likely because it will mostly be interested in finding a “balance” between law enforcement needs and data protection needs. That type of balance may just not be possible in practice, or at least law enforcement may have to find ways around encryption and around forcing companies to backdoor their products or to keep them vulnerable so law enforcement can continue to exploit them.
The type of policies that will be proposed will also likely depend on the makeup of the commission. If too few stakeholders that care about privacy or data protection are invited to be part of it, then chances are the commission won’t decide policies that would be too much in favor of stronger privacy.
However, this type of commission may also be an opportunity for the rest of Congress to further educate itself on encryption and technology, which is generally a good thing, as that can also lead to more people discovering that encryption is beneficial and not something to be feared and banned.
Source | Tomshardware
