Worse. Terror (fear) is a well tested 'problem' which people are strongly conditioned to demand solutions for. 'Real' or 'Manufactured' the result is usually the same; power brokers proclaim they don't have enough power. It's an emergent effect that power will tend to expand through all means available and fear happens to be the most powerful motivator of human action. If you keep people in this state (the 'strategy of tension') they are more pliable because being in a state of fear impairs decision making.

Are you suggesting that certain power centres are deliberately turning a blind eye to potential terrorist intelligence in order to maintain the "state of tension", as long as that threat is not directly affecting their own citizens and home country?

I.e. the NSA deliberately withholding intelligence from the French in order to bring the French government into the " ignore a basic right to privacy and liberty, we need you to support our bulk surveillance hard-line "?

That would be pretty callous and downright Machiavellian.

It's not that terrorists with good operational procedures would not be able to find more secure means, but migrating to those means would do two things:

Fewer operatives would have the rigor to operate securely all the time. You just need one to trip up to give the house away, but with ubiquitous encr. anyone and their nona can encrypt without leaking.

Two, switching to alternate means would mean a big slowdown in comms speed and throughput/dissemination and comms can be compromised/altered via interception.

I feel like encryption is easy enough to do now by so many means that taking it out of consumer grade apps won't have much effect at all. It's pretty much as easy as installing an app to get (close enough to) perfect encryption from open source solutions and once installed they are as easy to use as Whatsapp.

One guy managed to get his hands on a freaking rocket launcher. Same with one of the Charlie Hebdo attack guys, who sneaked an assault weapon into a country with strict gun laws. Are you telling me that if they are really committed these guys can't get access to an app they can use for encrypted communications?

The problem is there are too many signals, only made worse - not better - by mass surveillance (making the "hay" in which to find the needle bigger and all that). Here's an excerpt from Schneier in 2005:

> Let's look at some numbers. We'll be optimistic -- we'll assume the system has a one in 100 false-positive rate (99 percent accurate), and a one in 1,000 false-negative rate (99.9 percent accurate). Assume 1 trillion possible indicators to sift through: that's about 10 events -- e-mails, phone calls, purchases, web destinations, whatever -- per person in the United States per day. Also assume that 10 of them are actually terrorists plotting.

> This unrealistically accurate system will generate 1 billion false alarms for every real terrorist plot it uncovers. Every day of every year, the police will have to investigate 27 million potential plots in order to find the one real terrorist plot per month. Raise that false-positive accuracy to an absurd 99.9999 percent and you're still chasing 2,750 false alarms per day -- but that will inevitably raise your false negatives, and you're going to miss some of those 10 real plots.

> This isn't anything new. In statistics, it's called the "base rate fallacy," and it applies in other domains as well. For example, even highly accurate medical tests are useless as diagnostic tools if the incidence of the disease is rare in the general population. Terrorist attacks are also rare, any "test" is going to result in an endless stream of false alarms.

> This is exactly the sort of thing we saw with the NSA's eavesdropping program: the New York Times reported that the computers spat out thousands of tips per month. Every one of them turned out to be a false alarm.

99.9% and 99.9999% accuracy and you still get those huge false positive numbers. Even the drone strike program has much lower accuracy than that (yes, they do kill people based on "mostly assumptions" that they are terrorists, if that's news to anyone). I mean, in the US, they start spying on people if they have a >51% of not being an American (an amazingly low threshold - basically flipping a coin). So - maybe it's time to admit that mass surveillance is actually detrimental to catching these guys and that these spy agencies are hurting national security?

https://www.schneier.com/essays/archives/2005/03/why_data_mi...

Countries can demand app stores comply with their laws, if they wanted to. They could demand access to interception or else the app [store] is not allowed. They could further have carriers block jailbroken sets.

With regard to noise, you can make it more manageable by building a graph. As you initially ID terrorists, you follow the graph and calibrate the signal. You don't have to enmesh everyone.

Every single ones of those techniques can and would be bypassed (the app store banning would be the easiest). The ISPs would be operating on an "anti-virus" principle, and they'd be too slow to stop "zero-day-like" hiding of encrypted communications before an attack would happen. There are already plenty of apps that stop carriers from knowing when someone is using tethering apps, when the carriers don't want them to use those types of apps.

As someone was saying on Twitter, intelligence agencies should not want terrorists to start using steganography...which would make their passive traffic analysis much harder. But if they start censoring and banning encryption apps (which use metadata all in the clear), that's exactly what will happen.

Also, it seems most people live with the impression that "if only current apps such as Signal, Tor, etc" would be banned, that should pretty much put an end to encrypted, hidden communications, right? Wrong. Dead wrong. Right now they are being "lazy" and just use what's available to them, like Telegram and whatnot. But if those apps were actively banned, they would focus on building their own, perhaps with forked Signal/Telegram sources. But even without those, they could still commit to building their own solutions.

To give you an analogy, look what's happening with the Silk Road-like world. Authorities stopped Silk Road - like twice or third times already. But the underground online drug market is bigger than ever - it just split into multiple smaller markets. If that happened with drug businesses and drug delivery, it should be much easier to happen with "chat apps".

People would still want strongly encrypted apps especially if they were actively banned by oppressive governments.

> They could demand access to interception or else the app [store] is not allowed.

Thus forcing terrorists to use Android or a desktop OS? Big whoop.

It's not as if they can't tell Google to put out a 'special' version for their country. Or put out their own infiltrated version and take whatever measures necessary to "own" the OS. They could poison DNS for "favorite terrorist distro".

It's not to make it 100% foolproof, it's to make it so that any misstep would reveal them. In other words, make the whole of their communications system leaky _somewhere_ not necessarily everywhere.

The systems are already leaky (like the metadata, for instance, but also the weak end-point security most devices have, poor HTTPS implementations, and so on). This is not a problem. The problem is the intelligence agencies have too many "targets". They're only making things harder for themselves putting everyone on "lists". At least one of the terrorists from the recent Paris attack was on such list - an "extremist" list even. Didn't seem to help.

I think it's becoming more clear that intelligence alone is not enough.

I'm also very worried that 10 years from now we'll have an even bigger problem than Daesh in the Middle East, even if Daesh is "wiped out" - Al Qaeda was wiped out, too, unless we forget. Daesh is much bigger than Al Qaeda was, which means they have many more relatives and children than Al Qaeda had - children that may rise up again in 10 years to avenge their fallen fathers and cousins.

France's reaction feels very much knee-jerk and 20th century thinkining - "Someone attacked us? Let's bomb the hell out of them then!". It kind of reminds me of when the French generals ordered their foot troops into the Germans' machine guns a century ago, because that was their 19th century thinking at the time.

This is a whole other discussion that also needs to happen, and I think a much bigger issue than the encryption one.

The problem isn't the volume of data, it's the analysis and graphing. They need to develop better mining technology.

Conversely, if there is too much data and everything is hidden because there is too much, then why bother with the clamor for encryption? I mean, there is so much data, it's unfindable?

I think it was Poland and Russia sending cavalry and barely armed infantry into modern battle, not France during WWII.

In almost all the terrorist attacks that have happened recently at least one of the perpetrators has been known to the authorities. This tells me that the problem is failing to properly follow up on leads rather than missing people completely. This leads me to suggest that more dragnet surveillance is not needed instead we need targeted surveillance.

Encrypted traffic is pretty easy to detect. If only terrorists use encryption, you can catch them easily.

The amount of encrypted traffic in use by normal people every day far outweighs that of any terrorists.

If only pigs could fly, then any flying animal would be a pig. But.

Banks use encryption too.

And three: The mere use of banned encryption tools can now be a crime in itself.

Not necessarily, it's what they call a "signal". Just like driving a white van does not mean yours was the one involved in the hold up, but it's a signal: "Look at white vans more suspiciously".

I drive a white van and I use encryption daily. Maybe I should go and invest in some bullet proof attire?

What do you think, does that sound sensible to you?

In a world where mass consumer products don't offer end to end encryption, either the terrorists use encryption, and they can be arrested for that, or they don't, and they can be arrested on the basis of their plain-text communication. Or at least, maybe that's their justification...

Of course, that does not take the elephant in the room into account. By using proper steganography, terrorists could use encryption pretty much unnoticed.

But only if you also keep transmitting junk data over the same mediums. There is plenty of research available for detecting the presence of applied steganography by entropy measurements. [0, 1, lots of others]

If you only apply steganography when you have real[tm] communication needs, those transmissions will stand out. So, from information theoretic standpoint you need to ensure that transmission is undetectable from steady-state with no payload.

Incidentally this is also one part of Pond's threat model. [2]

0: https://ntrl.ntis.gov/NTRL/dashboard/searchResults/titleDeta...

1: https://www.blackhat.com/docs/asia-14/materials/Ortiz/Asia-1...

2: https://pond.imperialviolet.org/

Definitely, but like cryptography, this is very much a cat-and-mouse game. In some data uniform noise is harder to detect than other data. You also have to exploit streams that are large or expensive to analyze. But I think that there are many stochastic processes with near-uniform properties waiting to be exploited (such as e.g. some word order choices in some languages with free word order).

The thing is that with steganography, plausible deniability is much easier than pure cryptography.

Doesn't properly compressed data look just like junk data? You could simply compress some file, add a number of random bits ("corrupted during transfer"), and use just a few of those bits for encrypted communication.