| Information |  | |
Derechos | Equipo Nizkor
| ||
| Information | | |
Derechos | Equipo Nizkor
| ||
07Jul15
UK and US demands to access encrypted data are 'unprincipled and unworkable'
Demands by US and British security agencies for access to encrypted communication data have been dealt a serious blow in a report by an influential group of cryptographers and computer scientists who dismiss the move as unprincipled and unworkable.
They warn that such access "will open doors through which criminals and malicious nation states can attack the very individuals law enforcement seeks to defend".
The report says: "The costs would be substantial, the damage to innovation severe and the consequences for economic growth hard to predict. The costs to our moral authority would also be considerable."
The expert opinion comes on the eve of an appearance before the US Senate intelligence committee by the FBI director, James Comey, who last year savaged tech companies for embracing end-to-end encryption, claiming it would deprive the security services of potentially life-saving information.
David Cameron and the home secretary, Theresa May, are proposing to introduce legislation in the autumn to force companies such as Apple, Google and Microsoft to provide access to encrypted data. The proposed legislation has been requested by the intelligence agencies, which say encryption has made their job much more difficult.
The 26-page report, Keys Under Doormats, is written by largely the same group of cryptographers and computer scientists who two decades ago challenged a similar move by the intelligence agencies in both the US and UK. Their contribution helped force the Clinton administration to back down.
The authors of the new report set out various technical and practical obstacles facing the US and UK governments' attempts to secure access.
"Political and law enforcement leaders in the United States and the United Kingdom have called for internet systems to be redesigned to assure government access to information - even encrypted information. They argue that the growing use of encryption will neutralise their investigative capabilities. They propose that data storage and communications systems must be designed for exceptional access by law enforcement agencies.
"These proposals are unworkable in practice, raise enormous legal and ethical questions, and would undo progress on security at a time when internet vulnerabilities are causing extreme economic harm."
Among problems they identify is the ability of the US government and its law enforcement agencies to protect the security credentials that would unlock data. "If law enforcement has guaranteed access to everything, an attacker who gains access to these keys would enjoy the same privilege," the report says.
Turning to the UK, the authors focus on the government's promised legislation to compel communication service providers, including US-based corporations, to grant access to UK law enforcement agencies, with other countries certain to follow suit.
"China has already intimated that it may require exceptional access. If a British-based developer deploys a messaging application used by citizens of China, must it provide exceptional access to Chinese law enforcement? Which countries have sufficient respect for the rule of law to participate in an international exceptional access framework?" the report says.
The authors conclude that the governments raise more questions than they answer. "Absent a concrete technical proposal, and without adequate answers to the questions raised in this report, legislators should reject out of hand any proposal to return to the failed cryptography control policy of the 1990s," the report says.
The authors include Whit Diffie, one of the pioneers of public key cryptography; Bruce Schneier, author of several books on computer security; Josh Benaloh, senior cryptographer at Microsoft Research; Susan Landau, former senior staff policy adviser at Google; Steven Bellovin, professor at Columbia University and a pioneer of firewalls; and Ross Anderson, professor of security engineering at Cambridge University.
Anderson looked ahead to the UK government's proposed legislation. "What Cameron wants isn't just against the principles of good security engineering, but violates human rights principles too.
"There are three tests for exceptional access to be compatible with human rights. The required access must be set out in law sufficiently clearly for its effects to be foreseeable, it must be proportionate and it must be necessary in a democratic society. The government demands for access to everything fail all these tests by a mile."
Anderson added: "A point I would like to make to the prime minister and his circle is: whoever put the prime minister up to this should get a complete bollocking. The proposals are wrong in principle and unworkable in practice."
He asked where Cameron had received his advice from on matters of cryptography, assuming it was from GCHQ and May, and suggested it was time he spoke to representatives from civil society and companies such as Google, Facebook and Twitter.
[Source: By Ewen MacAskill, The Guardian, London, 07Jul15]
Donate
Radio Nizkor
Privacy and counterintelligence
 | This document has been published on 08Jul15 by the Equipo Nizkor and Derechos Human Rights. In accordance with Title 17 U.S.C. Section 107, this material is distributed without profit to those who have expressed a prior interest in receiving the included information for research and educational purposes. |