Doctorow, Cory - The FBI wants a backdoor only it can use – but wanting it doesn’t make it possible - The Guardian 20160301
Much like climate change denialists, politicians continue to debate encryption – ignoring the consensus of experts that it must not be compromised
There is a precedent for when something urgent is considered a settled matter in expert circles, but is still a political football in policy circles: climate change. Denialism is a deadly feature of 21st-century life.
The FBI’s demand that Apple create a defeat device for decrypting a phone that belonged to a mass murderer has all the ingredients for a disastrous public conversation.
Combine a highly technical debate about information security with an emotionally charged subject matter, then confuse the whole issue with a 24-hour news cycle tick-tock about who did what, when, and you end up bogged down in questions like, “Does it matter if the FBI directed the local cops to try to change the phone’s password, inadvertently creating the lockout?”
The questions raised by this court order are deliberately the wrong ones: questions whose answers don’t get us any closer to a lasting peace in the crypto wars. After all, the order emanates from a lowly magistrate judge, meaning that no matter how the ruling comes down, it will be appealed, possibly all the way to the supreme court, given the seriousness of the issue. It could be years before we even get a final ruling.
That final ruling will have very limited applicability, since the court’s order directs Apple to build a defeat device that wouldn’t work on its latest phones, nor will it work on its future devices, no matter how the judgment goes. This is the title sequence for Crypto Wars II, not the closing credits.
The first Crypto War was fought in the 1990s when the NSA insisted on a ban on strong crypto in civilian hands, and the US classed the underlying mathematics as munitions.
The Clinton administration lobbied for mandatory backdoors, insisting that it was possible to make a backdoor that only the good guys could walk through – precisely the same argument raised by the Obama administration in 2016 (see also: 2015, 2014, 2013, 2012, etc).
The thing about this controversy is that it isn’t one. Independent cryptographers are virtually unanimous in their view that you can’t properly secure a system while simultaneously ensuring that it ships with a pre-broken mode that police can exploit.
The fact that this would be useful doesn’t make it possible: as security experts Meredith Whittaker and Ben Laurie recently wrote: “Wanting it badly isn’t enough.”
Another urgent issue considered settled in expert circles, but still debated in policy circles: climate change
Law enforcement would also be assisted by anti-gravity devices, time machines, psychic powers, and the ability to selectively reverse entropy, but that doesn’t make them possible. Likewise uncontroversial is the gravity of the cybersecurity question. Cybersecurity isn’t just about protecting your location data and your private emails: it’s about making sure randos aren’t spying on your children through your baby monitor, or driving your car off the road, or killing you where you stand by wirelessly hacking your insulin pump – or stealing entire hospitals.
If you’re not worried about this stuff, you’re not paying close enough attention.
There’s precedent for this kind of contradiction, where something urgent is considered a settled matter in expert circles, but is still a political football in policy circles: climate change. Denialism is a deadly feature of 21st-century life.
The people who deny climate change have a range of motivations, from good-faith (but ill-founded) scientific disagreements to self-delusion to self-interest (and self-delusion driven by self-interest, of course). Many tactics have been tried in the denialism battles, but there have been few successes.
A notable exception is solar power and energy independence. This decade’s massive investment in solar power, driven by state subsidies, has bridged the gap between climate change denial and renewal energy advocacy. As the saying goes, “solar is a technology, not a fuel,” so it gets better (and cheaper) with investment and scale. The combination of better energy, good solar industry jobs and energy independence (with the promise of fewer disastrous foreign wars) has won over many climate deniers, who still think the Earth isn’t getting hotter, or that humans aren’t responsible for it, but nevertheless are some of solar’s biggest fans.
The rallying cry of economics is “incentives matter”. Given the right incentives, denial’s effects can be overcome, even if the underlying mistaken beliefs remain intact. Vaccine denial is another matter. While vaccination denial is deadly and urgent, the most successful strategy for combatting it has been all stick, no carrot. In California, SB277 simply prohibits children from attending school unless their parents get them vaccinated.
As a parent in a California school district, I can tell you that it’s working: the bus-shelter outside our local pharmacy may sport a nutty anti-flu-jab ad, and I still hear parents fretting about canards like mercury and “too many vaccinations in one shot”, but all the kids in our local school are vaccinated, full stop.
When we missed a doctor’s appointment for a Hep B shot, we got a note from the school nurse with a firm deadline to make it up, after which our daughter would no longer be welcomed on the premises. Measles, whooping cough and other preventable diseases are receding into the background. We hear stories about home-schooled, unvaccinated friends being disinvited from birthday parties because it’s simply ceased to be socially acceptable for someone to let their unfounded beliefs endanger their neighbors and their kids.
The difference between the carrot approach (climate) and stick approach (vaccines) can be explained by looking at the social power of each denial movement.
Vaccine denial makes a small number of unscrupulous celebrity alternative medicine advocates rich, but they’re small potatoes next to the Koch brothers. Their supporters can be pushed around in state legislatures with relative impunity.
Denial by the powerful has been addressed with bribes; denial by the powerless has been addressed with coercion.
Math denial – the belief that cryptographers are nefariously keeping all the cool stuff under wraps – is an idea with some powerful backers. One form of math denial is the belief in the ability to make computers that prevent copyright infringement.
Computers only ever work by making copies: restricting copying on the internet is like restricting wetness in water. Nevertheless, big corporations with hawk-eyed activist investors get away with buying “digital rights management” technologies that purport to prevent unauthorized copying.
Cryptographers (who don’t work for DRM companies) think this is ridiculous, the alternative medicine of computer science. But just as the NHS funds homeopathic “medicine” in public hospitals, legislatures continue to treat digital locks as going concerns, because orthodoxy and political expedience demands it. The entertainment industry is a powerful adversary, the security services are more powerful still.
It’s tempting to play along with them here, offer them more magic beans in the form of backdoors that we pretend only the good guys can fit through, or in the form of purportedly copy-proof bits, but the stakes are awfully high, and climbing steadily.