Don't Panic about "going dark"

The rising use of encrypted communication channels, coupled with more system-wide encryption on devices like phones, has been increasingly fingered by law enforcement and other government agencies as an impediment to doing their jobs. This is the so-called "going dark" problem that posits that the ability to thwart terrorism and other crimes is slowly being reduced because these organizations can't see inside the encrypted data—even if they have obtained the legal authority to do so. A recent report [PDF] from a panel of security experts frames the debate a bit differently, as its title ("Don't Panic") might indicate.

The report comes from a "a diverse group of security and policy experts from academia, civil society, and the U.S. intelligence community" under the auspices of the Berkman Center for Internet & Society at Harvard University. The group was convened by Matt Olsen, Bruce Schneier, and Jonathan Zittrain. The latter two are reasonably well-known in our communities; Olsen is former director of the US National Counterterrorism Center (NCTC) and former general counsel to the US National Security Agency (NSA). The report and its conclusions were endorsed by the private sector participants (including Olsen), but the government officials "are precluded from signing on because of their employment"; they were simply thanked for participating in the discussions over the last year.

The "going dark" argument has been used to bolster the idea of encryption backdoors that can "only" be used by properly authorized law enforcement or national security agencies. The idea is as appealing as it is impossible, but debunking it is not really the thrust of the report. Instead, it looks at the reality of the computing landscape and concludes, rather ironically, that various factors will increase, not decrease, the ability to do surveillance.

The "findings" section (pages five and six of the PDF) is kind of eye-opening. For one thing, end-to-end encryption is "unlikely to be adopted ubiquitously by companies, because the majority of businesses that provide communications services rely on access to user data for revenue streams and product functionality", it states. In addition, the "Internet of Things" (IoT) will provide many more avenues for surveillance through sensors, audio, video, and the like.

Beyond that, metadata (e.g. email headers, phone and SMS call records, or location information) is typically not encrypted and is unlikely to be encrypted anytime soon. "This information provides an enormous amount of surveillance data that was unavailable before these systems became widespread." The report points to fragmentation in the software ecosystem as another reason not to panic about going dark. In fact, the report questions the metaphor itself:

From a security and privacy standpoint, the findings are worrisome, as the report acknowledges. The hope that more and better-integrated encryption will lead to better privacy seems to be dashed by the realities of the market. Companies will still want to track users and their data so they can use (or abuse) that information—or sell it to others. New devices will roll out with insufficient security and privacy safeguards that will spill our secrets left and right. While the report may provide some solace for the agencies that are concerned about going dark, it can only be viewed with some sadness by privacy and security advocates.

The moderately lengthy report provides some background on the debate, including its roots in the "crypto wars" of the 1990s (and earlier). It also gives more detail on the bullet points in the findings section. It builds a fairly strong case that companies and fragmentation in the market will lead to less encryption or, at least, less encryption where the users hold the only keys.

The IoT will likely bring a whole new range of surveillance options. There are several examples given of existing devices (automobile assistance systems with in-car microphones, smart TVs, wireless cameras, even the "OK Google" feature in the Chrome browser) that have the potential to be used for surveillance. Court orders could be used to force those companies to arrange for law enforcement to use these products for surveillance. While the report doesn't directly address it, there is the risk that organizations or individuals could exploit security vulnerabilities in the devices to do the same—with no court order required.

There are also three "individual statements from signatories" attached as Appendix A (page 19), which offer some additional perspectives. Susan Landau focused on the "business case" for encryption:

Schneier pointed out that there are multiple uses for encryption, from protecting credit card numbers to helping dissidents avoid arrest to journalists communicating with sources, all of which are worth protecting—and protecting well.

He also reprises another common theme in his writing:

In his statement, Zittrain reiterates the avenues that are being opened up by new technology:

As can be seen, the report is a bit bleak, at least for privacy advocates, but it does paint a realistic picture of where we are today—and where we are likely to be in the near future. There are few, if any, who are arguing that there are no circumstances that should allow government access to private data. But there is a balance to be struck and, at least rhetorically, politicians generally seem to want to magically legislate around the realities of encryption, instead of recognizing the limits of their power. As this report shows, the sky is not falling: law enforcement can get most of what it needs without endangering the real, important uses of encryption. Hopefully the politicians are listening.