There may be no more important data security topic today than law enforcement’s persistent calls to weaken ‘unbreakable’ encryption (the FBI’s term for ‘high-assurance’ encryption) by forcing vendors to add backdoors to their security products.
Across the US, UK and Europe, law enforcement agencies are dedicating time and resources to pursuing this counter-intuitive and potentially dangerous proposition; all in the name of counter terrorism.
It’s a truism to say that new technologies are just as available to good guys as they are to bad guys. Whatever the new technologies, the only difference lays in their use – the good guys use them for better purposes than the bad guys.
Why is high-assurance encryption ‘unbreakable’? In short specific law enforcement agencies are referring to high assurance encryption products that have a number of security attributes. The most significant attribute is the use of state-of-the-art client side encryption key management.
Although the current debate is one around weakening high-assurance encryption, discussions started with calls to ban it completely. In March 2015, the Guardian reported the FBI’s and Europol’s calls for a ban on ‘unbreakable” encryption.
In November 2015, the Daily Telegraph profiled the UK’s new Investigatory Powers Bill, which requires service providers to hand over decrypted customer data when a warrant is issued; thus killing providers’ (such as Apple and Facebook) ability to offer customers genuinely high-assurance encryption security.
This latter situation of ‘investigative powers’ is now being fully tested in the US – the FBI versus Apple. The FBI on the face of it reasonably argues that Apple should do everything to assist it to ‘break’ the security features of its iPhone product in one specific case of a known terrorist (who did enormous harm) whose iPhone is expected o contain a great deal of valuable information that is not only ‘highly’ encrypted, but protected by a ’10 failed attempts destroys the data’ feature.
Apple argues that it would be in breach of customers’ ‘trust’ if it were to break even this criminal’s iPhone security. CEO, Tim Cook publicly argues that such action would compromise its technology that benefits the majority of law-abiding citizens. His point is two-fold – the FBI has 100% access to the metadata and that data would likely meet the FBI’s investigative needs. He also argues the line that ‘for the greater good’ should not be empowered to undo a security feature commonly used by all Apple customers.
It seems clear that Tim Cook’s underlying concern includes the lack of certainty when it comes to law enforcement’s ability to self-regulate. And this is where this one case about one terrorist’s iPhone is closely linked to enforcement of mandatory back doors. But, they are all the same two different issues that share a similar use of ‘unbreakable’ encryption.
Don’t leave the keys under the mat
Encryption technology has protected data networks and sensitive data in transit for the general public, governments and commercial organisations for decades.
As the threats of cyber-criminals and terrorist activities have accelerated, high-assurance encryption products have been protecting us all from financial loss, identity theft, business disruption, infrastructure damage and theft of intellectual property.
In light of this, propositions that require vendors to deliberately weaken high-assurance encryption by providing ‘backdoors’ for law enforcement agencies are both counter-productive and potentially dangerous.
Technology has no morals. It is equally available to both the good guys and the bad guys. With the best will in the world, if you develop backdoors for law enforcement, law breakers will have access to them too.
There is simply no such thing as a high-assurance security solution with a backdoor. Encryption security is either high-assurance – providing end-to-end encryption without any weak-points – or it is not.
