FBI official: It’s America’s choice whether we want to be spied on (original) (raw)

Encryption secures our data—and helps terrorists, bureau’s general counsel says.

FBI General Counsel James Baker discussing encryption with cybersecurity policy expert Susan Landau. Credit: Jon Brodkin

BOSTON—FBI General Counsel James Baker today spoke about how encryption is making it increasingly difficult for law enforcement agencies to conduct surveillance. While the FBI has previously argued in favor of backdoors that let authorities defeat encryption, Baker said the issue must ultimately be decided by the American people.

“We are your servants,” Baker said. “The FBI are your servants, we will do what you want us to do.”

Baker was speaking in a panel discussion titled “Going Dark: The Balance Between Encryption, Privacy, and Public Safety” at the annual Advanced Cyber Security Center conference in Boston.

But while FBI officials are America’s servants, Baker argued that encryption is making it harder for the bureau to protect the nation from terrorism and other criminal activity. Even when law enforcement agencies get a warrant, they aren’t always able to get the information they want, he said.

“We go to judges, we do what the law requires, we show up with the order and we can’t get the fruits of surveillance for a variety of technical reasons, increasingly due to encryption,” he said.

Federal officials are becoming more frustrated by security on the iPhone. Last year, Apple said it updated iOS to make it impossible for the company to bypass customers’ passcodes in order to extract data in response to government warrants.

Baker and other panelists discussed the idea of “split-key encryption,” in which tech companies would give governments the ability to decrypt data. But Baker’s fellow panelists called the idea impractical and dangerous, and even Baker seemed to acknowledge that it isn’t likely to happen.

“It's tempting to try to engage in magical thinking and hope that the amazing technology sector we have in the United States can come up with some solution, and maybe that's just a bridge too far,” he said. “Maybe that is scientifically and mathematically not possible.”

FBI Director James Comey told a congressional panel last month that the Obama administration won't ask Congress for legislation requiring the tech sector to install backdoors that let authorities access encrypted data. However, Comey said the administration will lobby private companies to create such backdoors.

Baker said today that it’s important to balance all the different concerns. That includes the data security and Constitutional rights of ordinary citizens, the ability of American companies to be competitive in a global marketplace, and law enforcement’s ability to monitor terrorists.

“There are many ways to think about the ‘going dark’ problem,” Baker said. "At the most fundamental level, it really is about the relationship between the people and the government, in particular... when it relates to surveillance by the government of the people and under what set of circumstances do the people want that to happen. What do you want us to do and what risks are you willing to take on all sides of the equation?”

Despite the Obama administration’s decision not to seek legislation from Congress, Baker said that “it’s up to the people and Congress to help us figure out how we're going to deal with this issue, because there are a lot of risks out there and we need to deal with them effectively and smartly before something happens.”

Complexity of split-key encryption “unimaginable”

Baker was joined by Susan Landau, professor of cybersecurity policy at Worcester Polytechnic Institute, and Eric Wenger, director of cybersecurity and privacy at Cisco.

Landau has been working in cryptography since the 1970s and was a senior staff privacy analyst at Google before moving to WPI last year. Landau said that split-key encryption would open too many security holes.

“The complexity of having 200 nations, each with access to keys, is just unimaginable,” she said.

Backdoors would disrupt important security measures such as forward secrecy, which uses an ephemeral key to encrypt communications, she said.

Wenger agreed that split-key encryption would make our data less secure. “The more complex you make the system, the more difficult it is to secure it,” he said. “I don’t see how you could develop a solution that is key-based, that secures things the way we want to without at the same time creating a great deal of complexity associated in enabling government access.”

There’s plenty of information the government can obtain, even when devices themselves are encrypted, Wenger said. He pointed out that Web-based services that provide convenience often let the vendors examine people’s personal information.

“Your Gmail operates the way it does because Google can monetize the communications,” he said. “You could pay for a service that doesn’t operate that way, but most people don’t tend to… Are we really going dark or are we living in a golden age of surveillance?”

Modern devices and cloud services have in many ways “created gold mines for law enforcement,” he said.

While technology companies have resisted government attempts to access customer data, Baker said law enforcement has more success with some companies than others.

In some cases, a company will tell law enforcement that it can only provide metadata or a “snapshot of the account once a day” instead of the real-time surveillance authorities want, he said.

The FBI has an easier time getting data from companies whose business models depend on viewing customer data, he said.

Some companies “want to monetize the analysis of communications of their customers, for example those companies that actually look at e-mail and analyze it and send you targeted ads,” Baker said.

Baker didn’t mention any specific companies, but this is a practice in place at Google.

“None of that is encrypted, so we can go there and get the order and have the order be effective, and that's good,” Baker said.

Spying doesn’t have to be easy

Besides reducing Americans' privacy, encryption backdoors would harm American companies according to Landau and Wenger. Backdoors open companies up to the loss of intellectual property, Landau said.

More than half of Cisco’s business comes from overseas, and backdoors would make it difficult for customers to trust the company with their data, Wenger said.

“More widespread use of encryption and other security technologies, on balance, would dramatically help our ability to advance the growth of the economy,” Wenger continued. “There are certainly costs in making the work of law enforcement more complicated, and I don’t have an easy answer to the problems [Baker] has laid out.”

Baker complained that encryption can make terrorist communications “impervious to law enforcement.” Landau countered that it’s not actually impervious—it’s just more difficult and expensive to access.

“Somebody from the NSA once said to me, ‘Look, the law in the case of a wiretap warrant gives us the right to collect the information; it doesn't say it should be easy,'” Landau said.

Landau said that the FBI and local and state law enforcement agencies have an extremely difficult job because people expect there to be zero cases of terrorism in the US. But a zero failure rate isn't plausible, and dramatically expanding surveillance abilities to get close to a zero failure rate would create a society that Americans wouldn’t want to live in, she said.

Baker insisted that the FBI is "very much in favor of strong encryption" and doesn't want to weaken Americans' security.

"We understand that the encryption genie is out of the bottle. We can't put it back in," he said. "This stuff is widely available around the world. That is reality, and we have to deal with it."

Listing image: Jon Brodkin

Jon is a Senior IT Reporter for Ars Technica. He covers the telecom industry, Federal Communications Commission rulemakings, broadband consumer affairs, court cases, and government regulation of the tech industry.

157 Comments