Isn't that the entire purpose of agencies like the CIA?
It just bothers me when privacy is treated as a negative thing, for the greater good or not. Encryption is a tool to create privacy. The ability to create privacy should be a point of pride as not everyone has that luxury. It should be a human right.
This is the primary reason why I feel things like CISA/CISPA/etc take society in the wrong direction. It doesn't matter if the intentions are good or bad when everyone loses.
Information about the uncrackable padlock is widely available. Bad guys will always be able to get these padlocks from the black market. The question is whether we want the good guys (i.e. us) to have the padlocks too.
1. Depriving the the public of decent encryption does a lot of harm. If you let some people in through the backdoor you're going to let bad people in too.
This is different from nuclear bombs. It doesn't harm the public to deprive them of nuclear weapons. I like having my financial information encrypted, but I don't want a personal nuclear bomb.
2. Non-proliferation of encryption wouldn't work. The algorithms and ideas are already widespread. Every university teaches it. Millions of computers have the code already. The code and ideas can be proliferated anonymously, instantly, undetectably and cheaply.
This is different from nuclear bombs. Nuclear bombs are much more complex and expensive to transport, manufacture and hide.
(I haven't mentioned AK47s, but I'd say they fall somewhere between between encryption and nuclear bombs in benefit vs harm to the public and in ease vs difficulty of non-proliferation, which is why there are more of them around than there are nuclear bombs.)
Back to HN's world, one of the basic principles of human factors is "make the right thing easy and the wrong thing hard." You might not be able to prevent people from doing the wrong thing, but there is still value in making it harder to do.
All you need to write an encryption program is an explanation of the concept behind a single algorithm, someone with math smarts, and almost any computer.
But honestly, I think it'll result in bad guys using the same backdoored crypto that everyone else will be using, relying on steganography and disappearing in the noise - so basically, they'll do things in the same way as they always did, since assuming all communications is broken by the government is simply good OPSEC.
The bad guy may have told someone in person where the location is... or sent an encrypted email. But unless you were involved in either conversation, you are still in the dark.
Clever locksmiths will always be able to make powerful padlocks using that research.
Not really. It secures long distance communication, but I've always had the option of just talking to someone privately if I want something to be secret.
I agree; so does the UN in The Universal Declaration of Human Rights:
Article 12. No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.
Article 18. Everyone has the right to freedom of thought, conscience and religion; this right includes freedom to change his religion or belief, and freedom, either alone or in community with others and in public or private, to manifest his religion or belief in teaching, practice, worship and observance.
"In the exercise of his rights and freedoms, everyone shall be subject only to such limitations as are determined by law solely for the purpose of securing due recognition and respect for the rights and freedoms of others and of meeting the just requirements of morality, public order and the general welfare in a democratic society."
Without power to back it up it means nothing.
It actually is a human right.
The right to privacy is one of the most fundamental ones that we have.
I don't think this is a technical problem, and I don't think it's our responsibility to solve it.
If the US wants to stop terrorism they need to stop creating terrorists. The US created terrorists by starting economic wars, supporting violent dictators, creating economic that harm the common people and not the national leaders they purport to, providing conditional and earmarked aid that is sometimes actually harmful, and a wide variety of other internationally sociopathic behaviors. If we want to stop being attacked by people from other countries, we need to stop harming other countries.
People are good at having enemies, whether they deserve them or not. There are people who would kill me right now having done nothing particularly wrong. There are even places where it is legal and encouraged to do so.
Additionally, notice that what jacquesm said is never brought up in these debates much like what U.S. did in Operation Ajax or sanctions that followed wasn't factored into recent Iran debates. Much easier to pretend all this stuff happens in a vacuum that requires a surveillance or police state. Which doesn't work anyway:
https://news.ycombinator.com/item?id=10591617
https://www.schneier.com/essays/archives/2006/08/refuse_to_b...
You know who is involved in these regions? Countries with money. Because without money, you can't do anything but let dictators and mass-murderers trample around like vicious kings. Turning a blind eye to your abused neighbors isn't a way to prevent terrorism, either. You might reduce anti-US terrorism by ignoring the rest of the world, but a lot of people will die, and you're still going to have enemies. It's a factor, not a solution.
Though I suppose if the US were poor as dirt, we wouldn't have to worry about terrorism. Just civil war and invasion.
And so on and so forth. Vast majority of terrorism against the U.S. is by actors whose activities or capabilities are directly tied to U.S.'s own imperialism abroad. Not our money, democracy, religion, anything. Just doing evil dangerous stuff over there and funding/equipping those that do the same often to rip off resources.
Far from a mere "factor," it's been the single most consistent and driving force behind all terrorism against us. That means... that eliminating that while working to improve the situation over time might eliminate most terrorism against us? Well, let's do that then!
That's a stupid and suicidal policy.
>Far from a mere "factor," it's been the single most consistent and driving force behind all terrorism against us.
So you say. But I can't distinguish that whether that statement is fact or ideology. So I don't believe you, and I shouldn't until you've got some convincing evidence that it's true. You can tell me a story. I don't want a story.
And I really don't see how people committing acts of terrorism are making good decisions that we should support by giving them what they want for doing so. Seems like a bunch of grudge-holders that need to grow up before negotiations become an option.
Surely you can discern why disagreeing with someone on HackerNews is different from invading their country, seizing their resources, and killing their family members.
> So you say. But I can't distinguish that whether that statement is fact or ideology. So I don't believe you, and I shouldn't until you've got some convincing evidence that it's true. You can tell me a story. I don't want a story.
And you can distinguish fact from ideology when people say that the solution to terrorism is more of what we're already doing?
I can understand you discarding information because you don't believe it's reliable. What I don't understand is that in the absence of information you believe to be reliable, you've still decided to form an opinion and argue for it. If you don't have enough information, it's okay to admit you don't know.
> And I really don't see how people committing acts of terrorism are making good decisions that we should support by giving them what they want for doing so.
I really don't see anyone proposing that.
So you're saying we should have committed mass murder and armed terror groups throughout the Middle East in the name of stealing resources or manipulating politics? Did you do any research to back this or are you writing up some far-fetched, sophist comment since you can't counter my points?
"And I really don't see how people committing acts of terrorism are making good decisions that we should support by giving them what they want for doing so."
Last I checked, the U.S. was still trying to screw with and control much of the Middle East instead of support them. The regions where we have the most meddling are among the least stable. Doing good over there instead of evil might actually accomplish something. Further, areas with groups like ISIS aren't terrorism vs Some Good Government rather than a group of competing evil groups all set on controlling and oppressing the area. So, fighting one isn't fighting terrorism so much as fighting one group while putting another into power.
You won't see the U.S. truly fight oppression over there because it's not in power-players financial and political interests. There's benefits to be had from continued partnerships with dictators and theocracies. Just ask Saudi Arabia.
>Did you do any research to back this or are you writing up some far-fetched, sophist comment since you can't counter my points?
No, I didn't do any research. I took a class on West Asia and North Africa in school. I lived in Iraq for a year.
But I don't think you've done any research, either. You're just saying talking points.
>Last I checked, the U.S. was still trying to screw with and control much of the Middle East instead of support them.
You checked? Let me know what you checked. Where you checked. Who you checked with.
>You won't see the U.S. truly fight oppression over there
Truly? Isn't there a term for this kind of waffling? "No true scotsman" or something?
> So, fighting one isn't fighting terrorism so much as fighting one group while putting another into power.
That's what fighting is. Any fight you do is going to put someone in power. It doesn't matter if you're fighting terrorism or not; that's the whole point of fighting.
The point of the discussion is U.S. government and a chunk of America wants to stop foreign terrorists from trying to blow us up. The foreigners doing that have exclusively done it due to interference, often violent and imperialistic, in the Middle East. So, many of us draw the logical connection that this was the cause of actual attacks against us rather than terrorism in general which we don't care about. So, to reduce number of attacks, we must stop doing what caused them and modify our strategy of dealing with the mess we're in to account for this. Otherwise, our actions over there, esp collateral murder (err damage) & weapons distribution, will likely just create the next wave of terrorists like Bush/Cheney Administration just did with ISIS.
That's my claims. Now, do you have any counter to those specific points or would you like to add to them? To be extra clear, given your sophistry, I've claimed the following:
1. The U.S. takes overt and covert action against Middle Eastern countries for financial and political reasons rather than for survival. So, it shouldn't have taken that action and should reconsider future behavior like that.
2. Disruptive U.S. actions in the Middle East creates opponents, including the organizations that attacked us. So, they should stop doing that and fewer terrorists that attack us would be created.
3. Previous handling of opponents equipped and trained likely long-term foes before abandoning them. They consistently ended up turning into problems: Taliban; Saddam; ISIS. The U.S. needs to stop doing that. Throw their best minds on fresh strategy before doing any major interventions and with much focus on long-term effects with regard to terrorism blowback.
But with money, you can arm those dictators and mass-murders so that they can become actual vicious kings.
> Turning a blind eye to your abused neighbors isn't a way to prevent terrorism, either.
That's true, which is why it's so puzzling that we so frequently turn a blind eye to our abused neighbors and fund the abusers.
I'm definitely not proposing isolationism. I'm proposing we spend aid money actually helping the populations of nations instead of funding whatever militant promises to protect US interests.
Bingo!
This statement would have more resonance if the US fell into the "or not" category. ISIS is basically America's Frankenstein[1].
[1] Yes, yes it was the doctor's name.
That being said, could you provide examples as to how the Middle East has reacted to meddling as opposed to South East Asia?
Just because some politician claimed that it's tech's people responsibility to fix their flaws, it does not make it true.
It's repetitive, but the police did have all the information they needed to go after such people even before the murdering. What does the GP want? A machine that queries the news from the day after tomorrow? (Because tomorrow won't do - the police had warning that it would happen at the previous day.)
If the Paris police had all the information they needed to go after such people, but didn't, that's the technical problem that really needs solved, not an encryption backdoor.
Better data organization tools are another (a family member is studying forensic science and has done internships with large-ish police departments that still largely use printed and hand-written documents to manage cases)
But that's my point. I haven't done much thinking on this either, so I can't see around the corners of time to see what it could be. But just more yelling back and forth about encryption isn't accomplishing much.
Maybe it's not a bits and bytes technical problem, but it's technical according to the definition of the adjective, "of or relating to a particular subject, art, or craft, or its techniques." If the Paris police had the information, but were unable to properly analyze it, that's completely a technical problem.
But I still don't think this should distract from a conversation about encryption. Encryption has very importat implications for free press and privacy far outside of preventing terrorism, and it's important that it stay legal and accessible to normal people. Experts need to make their voices heard so that legal decision isn't made by people unconcerned with these important issues.
Speak for yourself. I'm an American citizen and I don't want to start economic wars, support violent dictators, create economic sanctions that harm the common people and not the national leaders they purport to, provide conditional and earmarked aid that is sometimes actually harmful, and a wide variety of other internationally sociopathic behaviors. I think most people would agree if they actually understood that that's what's happening. But most people think we're spreading peace and freedom and protecting human rights.
That's the public face. The underlying motives are much more closely aligned to the power structure and the flow of money and votes than keeping folks in suburbs "safe".
That's the problem: they can't. The tech just moves information around in ways that are visible and can be invisible. Even the subtle timing of the signal can be used to communicate. What you're asking is that tech companies do two things:
(a) Ensure every tech with communication mechanisms can only work in a way known perfectly ahead of time and controlled to prevent all leaks.
(b) Ensure that every message, regardless of its words or properties, isn't aiding evil somewhere.
(c) Ensure that it's impossible for a user to put obstacles between their identity and a communication tech so we know exactly who the evil-doer was.
That's simply impossible. It can't be done at all. Talking about lay terms, North Korea has the most totally controlled Internet and country locked down by both technology and terror. Possession of a cell phone can get you locked up and leaving can get them after your family. Yet, there's regularly communication from small numbers of courageous people coming out of that country. If that ideal surveillance setup won't work, how on Earth could any tech accomplish the same thing with the diversity of sites, language, interactions, and tech that exist in Western countries like America?
It just can't because it can see bits and read the minds/hearts of those that create them. That's what the government wants. It's not possible. Otherwise, they'd probably have eliminated most crime already looking at people's homework in school or text messages divining their character. ;)
Also, the problem's been known so long there's even a meme for it:
Its not a tech problem or a solvable problem in the way you imply. It sounds reasonable but it is like solving lightning strikes. You can't actually "solve" lightning.
You can reduce the causalities through reasonable precautions but people are still going to die.
Its frankly irrational to talk about this problem as an actual problem. Terrorism is less dangerous to me than preventable medical errors for fuck's sake.
http://www.propublica.org/article/how-many-die-from-medical-...
> In 1999, the Institute of Medicine published the famous “To Err Is Human” report, which dropped a bombshell on the medical community by reporting that up to 98,000 people a year die because of mistakes in hospitals. The number was initially disputed, but is now widely accepted by doctors and hospital officials — and quoted ubiquitously in the media.
> In 2010, the Office of Inspector General for Health and Human Services said that bad hospital care contributed to the deaths of 180,000 patients in Medicare alone in a given year.
> Now comes a study in the current issue of the Journal of Patient Safety that says the numbers may be much higher — between 210,000 and 440,000 patients each year who go to the hospital for care suffer some type of preventable harm that contributes to their death, the study says.
Shaving 1% off 98,000 deaths a year will save more people than preventing the Paris attack.
How the fuck is it rational to be focusing on anything other than major causes of preventable deaths?
Sorry, honestly, at this point I'm just disgusted with anyone who suggests terrorism is a threat worth throwing billions of dollars and lives away on while they casually ignore far more dangerous sources of human deaths.
Get back to me when funding preventable harm in medical care is worth hundreds of billions of government funding.
People aren't scared of dying in traffic or by a preventable medical error. Maybe they should, but they aren't. Those risks are real, but they don't affect how people go about their lives. Terrorism is a tiny risk of death but an enormous cost in terms of percieved safety.
Its a cliché to say "defend our way of life", but throwing money at creating the illusion of safety so I dare go to the football stadium is just that. I wish we didn't have to spend millions securing a football match, but one can't dismiss it as a waste without assigning a zero value to the idea of going to watch the match. Times many thousand spectators.
The perception stems from the difference in media coverage and political grandstanding imho.
At least you have a legitimate objection, I just don't agree with it.
Why are they knowingly allowing people who fought for ISIS to return to Europe?
People don't lose their rights just because they travel to the Middle East...
Toss them in jail when they get home, but they still get to come back.
I think the need for strong encryption and no backdoors (which has Schneier explains, are always a double-edged sword) are very important and I support them, but that those on the side of it who also have in-depth knowledge about the finer details don't deign to articulate just what exactly the policy looks like without resorting to just a list of what we shouldn't do and vague allusions to "just go old-school" or "utilize human assets more."
A coherently articulated, normative counterfactual security platform would be a better place to argue from.
It's a cousin to the negative liberty arguments: they only list what not to do to in order to avoid hurting people, rather than what we can do to help them (positive liberty.)
Maybe we could frame the question as "If we let the EFF and Bruce Schneier redesign the United States security apparatus from scratch, what would it look like?"
Strong encryption cannot be back doored in an effective way, this is just a fact. Ignoring that fact because we wish it were otherwise, or asking the people that point out that fact what we're supposed to do in light of that fact, doesn't change that fact.
The group constantly pushing for backdoored strong encryption fails to realise that they are asking for regulations to ensure that all water is only ever sold in ice form. This does not, and cannot, mean that all water will only be available as ice. This needs to be realised, accepted and moved on from.
Only then we can start actually trying to formulate a coherent asymmetric warfare strategy, cognisant of the actual facts on the ground rather than wishful thinking and ignorance.
130 people were killed in those attacks. 361 people died in automobile accidents in Minnesota in 2014, to find a random statistic. Terrorism is simply not a real threat, and eliminating it will not make anyone any safer.
It's often used as code for "a woman is speaking, plz ignore" the same way bitch is.
I would just politely suggest you use a more descriptive word for what you were alluding to.
In any case, in the above comment it is used to refer to the way the pitch of male and female voices rises when frightened or exited and is far from being a gender-specific slur.
Why do you say this? It seems you are accusing parent of making a big leap in logic and then doing the same type of leap yourself.
Do you have any evidence that they want to do more than keeping people safe?
I've worked with and talked to many who work in the DoD space and while there were some who didn't seem to understand how technology worked I never met one who didn't seem genuine in wanting to keep people safe. Sure plenty of contractors just want the money and don't give two shits either way and sure this is only anecdotal but do you have anything better?
Seems the easiest, least complex reasoning is people who are not well enough versed in the technology but have good intensions are trying to do what they think is most correct when it may not be.
This is one reason I tend to think intelligence agencies should be disbanded and their best people merged into police forces. The police have a clear and (relatively) focused mission: fight crime. Most of those criminal investigations are about keeping people safe in one form or another. Police forces aren't tasked with economic wellbeing or "cyber defence" or any of the other crap that the intelligence community has tried to take on for itslf.
Bonus points if you show the risk to them personally: makes them most likely to act against it politically. :)
Given:
Things like mass phone surveillance, passively breaking legitimate encryption used by non criminals, introducing vulnerabilities, and other plainly illegal behavior is being deployed against citizens
..with no recourse..
..which are answered with outright lies when challenged (c.f. Snowden, Clapper's lies before Congress)..
..and the methods are of dubious actual effectiveness when it comes to "keeping people safe"
..and they in fact reduce safety when it comes to introducing vulnerabilities which can be misused by criminals
Therefore:
The aims of said behavior is plainly not to "keep people safe", but some other alterior motive. Simple statistics show that garden variety cybercriminals are a more real threat to the average person than terrorists - so do no statisticians work for the feds, or is there a different plan we're not seeing?
Lets say we do manage to come up with an alternative that would keep people safe without requiring mass surveillance then it would not remove any of the other motivations (say business espionage). I think appealing to a technical solution for a political problem is unlikely to work, but it could be possible.
Think through something like this, outside of your expertise, that you think the powers-that-be should just do. Maybe it's something with your local municipality's approach to road resurfacing, maybe it's the quarterback on your favorite football team, maybe it's your local zoning board.
Chances are better than even that there is a decent technical reason why they don't do what they do. Looking at things that way will save you a lot of headache in your life, and set you on the path to getting on someone's side to affect change, rather than just being another shrill voice yelling against them.
So politicians and intelligence services calling for encryption want, institutionally, to keep people safe. How can tech companies do that without breaking or backdooring encryption? That's the real problem to solve, and the first person to figure out how to do that will be way ahead.