On the topic of encryption, we're the only community with an understanding of what "breaking encryption" means. There are no skeleton keys, only vulnerabilities. We have a moral and ethical duty to fight for encryption, privacy, and security, not against it.
This is something really unique to digital technologies. In meat-space, everything has a vulnerability: force. With sufficient reason and circumstance, whether or not you give up your keys, the government is still able to claim dominion over anything you're trying to hide. All they have to do is break a few walls.
Digital technologies don't have this problem (feature if you're the government). If you have your key stored in your memory, and there is no back door in the software, no matter what court orders anyone has, if you don't tell them the key then the information is lost to them forever.
This kind of breaks some fundamental assumptions layed into law prior to tech. When you use encryption, tech really becomes an extension of your mind, and your 5th amendment rights effectively shut the government out of them completely. While I like this idea, it definitely poses problems for enforcement of basically every digital and financial law on the books, which can pose problems for all of us.
This is where the analogy breaks down - introducing backdoors and passkeys into digital security doesn't create the same trail in the physical world.
The better analogy would be - imagine that the government insisted that all locks be approved by the government, on the understanding that those locks would have master keys that the government owned. They would be able to come to a bank during the night, unlock the front door, the vault, and your safe deposit box; or come into your home when you were at work, unlock your filing cabinet and look at your records.
You would have to trust that government employees who had access to the master keys would only use them for legitimate purposes, and when authorized to do so. You would have to trust that the government could secure those keys at all times so they never fell into the wrong hands, and that no unauthorized duplicates would be made.
You would have to do all those things bearing in mind that the government regularly loses such master keys, has employees that exceed their authority, misuse government resources, demonstrate poor custody practices, and so on.
It doesn't seem like a good bet to me.
EDIT: oh yes, and I forgot to mention there's a whole bunch of other bad actors out there who know how to buy a government-approved lock, take it apart, and are highly motivated to make their own master keys.
Encryption was not the only point brought up by the OP, they were also against government regulation. My main point is that we are tech workers that have conflicts of interest and that we should look hard at our viewpoints and ask ourselves if they are better for us or better for everyone. We are humans and like other industries, greed has crept in and we don't always make great decisions when left on our own.
For my own part, I find it helpful to remember that questions over encryption have been ongoing for several decades. Historically, the arguments boiled down to shouting about CSAM, terrorism, drugs, etc. Mostly it tended to be really be about law enforcement agencies wanting to have the unfettered powers of surveillance.
What's perhaps most interesting to me is that the prevalence of encryption seems to have done very little to stop the FBI from catching people. I know this next point will be contentious, but perhaps there's room to question why these people who are indeed not idiots are so against encryption for you and me.
So yes, you're absolutely right. Let's look hard at our viewpoints and biases and expertise and paychecks and ask ourselves - why does the FBI want us to not have encryption? Why do we want it? Who has the valid view points here?
> What's perhaps most interesting to me is that the prevalence of encryption seems to have done very little to stop the FBI from catching people.
I don't think we can know this. Or maybe you have some data? But more importantly there's a big gap between "catching" someone and "convicting" someone. Having the content of specific communications can make a big difference in actually proving guilt.
I completely agree. My point was not that their motives are inherently evil per se, just that they're as self-centered as anyone and carefully gazing deep into our navels does not imbue their perspectives with extra validity or compelling strength.
> I don't think we can know this.
We do know that the FBI routinely arrests and prosecutes people, even ones that use encryption. There's no end of public sources showing it occurring again and again. The fate of Dread Pirate Roberts is a good example.
> Or maybe you have some data?
What data would you like? The FBI has statistics available going back to the 1930s: https://www.fbi.gov/services/cjis/ucr
> Having the content of specific communications can make a big difference in actually proving guilt.
You're absolutely right, it definitely can be! Which is why the FBI has learned how to both build cases without such things. They've also learned how to gain access to encrypted communications. Between the two, some might opine that it's enough to raise questions about if they really need to prevent you and I from having access to cryptography or not. They're clearly experts at law enforcement and perhaps have no need to confiscate the tools of mathematics from technologists.
Which brings me back to the point. Let's look hard at our viewpoints and biases and expertise and paychecks and ask ourselves - why does the FBI want us to not have encryption? Why do we want it? Who has the valid view points here? What have we gained from this navel-gazing?
I don't want to live in a police state and I'm not sure of anyone else that does. I also don't want to live in complete anarchy or even a libertarian state because I think there are bad people out there that would take advantage of that and potentially hurt other people.
It always seems to be hand waved away on this forum, but perfect computer security could indeed help criminals out there. I don't know the numbers around how many more but I really believe that no one knows.
I make no assertion that one side is right and the other is wrong, just that it is a hard problem and that I don't know the answer.
Where and how do we find the balance? I know the law enforcement community pushes against computer security to attain better security (in the law enforcement sense) and I know that tech people generally push for computer security that limits law enforcement abilities. I don't think we can let one side of the argument completely win, but how do we find that balance?
If you seek numbers, the FBI invites you to inspect their data: https://www.fbi.gov/services/cjis/ucr
As you correctly and wisely say, the world is full of hard problems with many strong, clear, compelling, and valid viewpoints to balance. It may just be possibly worth considering that this might not be one such scenario where balance is possible, let alone achievable. Do you think there might be cases, in the fullness of the human experience, where one set of extremists on an issue are right, their opposite numbers are wrong, and any balance between them also wrong? What if what seems to be a balance is based on a false premise?
Perhaps we should stop, take a step back, and examine our biases?
> Do you think there might be cases, in the fullness of the human experience, where one set of extremists on an issue are right, their opposite numbers are wrong, and any balance between them also wrong?
Yes, I think there probably are cases where something like this happens but I would assume those cases would be a little less debatable. But yes, what you say makes a lot of sense and is probably a large part of the reason the current political climate is so tribal.
> Perhaps we should stop, take a step back, and examine our biases?
If you are talking about the current case though, what is the false premise or what are the biases?
There are indeed monsters out there that hurt women and children and use technology to accomplish those crimes. They are not made up bogey men. They flock to technology that provides them cover and punishments for crimes deter criminals from attempting those crimes. If criminals did not have to fear punishments, more crimes would happen. I certainly would speed more if I didn't have to worry about speeding tickets.
I'm glad we agree!
Here's where the hot take comes in: we're there now. Encryption is something we have access to. Law enforcement manages to work around it on a regular basis and has now for several decades.
> Yes, I think there probably are cases where something like this happens but I would assume those cases would be a little less debatable.
One would certainly hope so, but it's perhaps possible that this might not always be true. There are often people ready and willing to debate what should be undebateable. It shocks the conscience.
> If you are talking about the current case though, what is the false premise or what are the biases?
Some people have come to this conversation with the false premise that taking away encryption will substantially help law enforcement, improving safety and security for our vulnerable friends, neighbors, and community members. Their pain, suffering, and exploitation is very real, yet that perhaps does not always make functional what is done in the name of keeping them safe.
Some have come to this debate with the bias of assuming there is a useful policy medium to be found. Perhaps there is not, as we might be dealing with technical matters that are all-or-nothing in unavoidable ways.
Some may find these to be perhaps worthy of careful examination, as such things can perhaps lead to dangerously misguided policy - such as the Clipper chip or mass surveillance.
Thank you for being thoughtful and centering kindness, mercy, and compassion.
I feel strange having to point out that Governments are made up of people too. If it's not people that are making the good decisions, whom do we turn to?
Is Admiral Poindexter a preferable decision-maker?
That is a trait lacking in almost everyone these days, not just tech workers.
Some software engineers might be experts in the domain of encryption, but there are other professions who are experts in the domain of National Security.
As for her expertise, she worked in FB's civic integrity unit as a product manager. I may disagree with her, but she does have a reasonable basis to claim better knowledge on the topic than the average person.
How is using end-to-end encryption of private communications a case of greed trumping morals? If anything, encrypting private messages and preventing others from reading them - be it Facebook or the various world governments - seems like the obvious moral move.
I think a lot of people, tech or otherwise, are projecting their own ideals on to this Facebook leaker without looking closely at the details of what she’s been lobbying for. Most people seem to want less surveillance and interference with private communications by Facebook but she’s arguing for much, much more.
But that’s the problem: The issue has now been so dramatized in the media that the average viewer doesn’t really know what’s being proposed, they just see “Facebook bad, whistleblower good” and assume it’s what they want.
It’s up to people who know the subject matter, including the tech community who understand things like end-to-end encryption and government regulation thereof, to speak up.
I am not trying to throw my hands up in defeat but pointing to an intransigent problem that is not easily fixable however simple every side of the argument tries to frame it and why they should be the arbiters of power/control. I understand the reluctance of any individual or company to hand over a large portion of control to a government or other community that doesn't have a track record - it is a fraught situation.
There is no governance beyond zuckerberg currently and he has proven that he is aligned with zuckerberg and not society. Continuing with the status quo and doing nothing does not seem like a good idea to me.
You can probably argue that he's wrong on this, but it's hard to say that he just cares about himself.
The dude is a classics nerd, and supposedly a bunch of the original FB mottos were in Latin (Fortune Favours the Bold, at least). That isn't surprising to me, at least.
Give users a lot more control. Over their feeds. Over what they receive or not. How they receive it.
Alternatively, abolish the feeds entirely. Make people seek out updates by other users manually. It's time consuming, it drastically slows down the reaction-agitation cycle. People then focus on consuming only what's most important to them to a far greater degree, as their time is limited. Facebook moved away from that early approach by intention to spur time-on-platform, consumption, engagement.
In the offline space you have a small number of actual friends, a small number of people you can actually keep up with, because of time constraints. That's a good thing, not a bad thing. It keeps people focused on what's most important to them. Facebook seeks to generate the opposite outcome, they want max engagement and consumption, so now you've got two thousand fake friends, and two hundred more relevant people within those two thousand fake friends that you receive updates from on a daily or weekly basis. That's insane. There's no other good way to put, it's insanity. It's bullshit. It's fake, it's inhuman. That mass consumption of content, that the feed/wall was built to accomplish, how much of it matters to the end user? I think the answer is very little. Put it back into the user's hands to seek out profile page updates, to seek out updates by their friends - they'll do it if it really matters to them, and they'll massively neglect the users that don't matter to them. This is also where Facebook's finances implode; most FB employees are self-interested in that outcome not happening.
The central issue is: the core mission of Facebook (today) is a fraud. Everyone should not be connected. Everyone does not want to be connected to everyone else. It is not a great ideal to pursue connect-everyone, it's fundamentally anti-human. It will not make the world a better place. That ideology needs to be challenged, and it rests at the center of Facebook.
Facebook has built itself to agitate for attention. They designed the feed/wall to prompt artificially high levels of engagement. Give that control back to the user in spades. People will adjust their systems, they do know what's best for them when it comes to this matter (and a lot more so than a politician thousands of miles away that has never met this person, or Facebook corporate).
Society sculpting by some ruling authority, some group that happens to be dominant at a given time, is a truly horrific approach. It will accelerate the splintering into tribes, and accelerate oppression by the government.
Encryption is not a pro-tech position. It is a pro-privacy position and you don't need to be a tech expert to see the value in that.
As an engineer, I'm in a better position to understand what the f is going on regarding encryption and, say, nuclear power than most people.
No amount of wishful thinking will change that.
> It is a massive country with many opposing viewpoints.
World. Not country.
Yes, you are an engineer and understand the implementation details and potential side effects, but what about the opposing viewpoints like those from law enforcement? Are you an expert in law enforcement? Your viewpoints should trump theirs why exactly? You really don't think that it's possible that you can't see the forest for the trees?
Do nuclear scientists define nuclear energy policies or do they provide advice to those that define them?
> World. Not country.
I don't think we have a world government that will make regulations in regards to facebook.
You're right, I may be ignorant of the issues that support the need for weakening encryption, but the fact is that I can evaluate the other side of the equation. And if the side pushing against encryption is making terrible arguments, I can see how terrible they objectively are.
> Do nuclear scientists define nuclear energy policies or do they provide advice to those that define them?
Similar thing: the arguments against nuclear power are idiotic and typically plain wrong and based on irrational appeals to fear.
Just like the previous issue, if a decision has to be made, it has to balance the pros and cons. Even if I can only properly evaluate only one side of the equation and find it lacking, I can certainly have serious doubts as to the legitimacy of the choice presented. And that's one side more than most people can grasp.
When it comes to encryption, tech activists say tech should take a back seat to policy-makers and let them decide on the rules. When it comes to internet censorship, tech activists says "but my private companies!" and argues that techies decide on the limits of acceptable discourse for the whole world.
What do these stances have in common? That activists are arguing that tech should do what power wants.
There are no principles at work here. There's only a "who, whom" power dynamic. Activists will say whatever is effective in the moment for achieving their immediate aims, and right now, that's being good little sycophants for people with broad, unclear, and definitely undemocratic influence over public affairs.
I think "we" have been largely absent from the conversation as heard by the rest of society. You can't say "trust the software engineers" like you can say "trust the doctors," not because we don't have ethics or expertise, but because what most people think of as the voices of our profession are the PR mouthpieces for companies like Facebook and Google.
Speaking person to person and in online forums such as this, you'll find most engineers concerned about privacy and the societal and emotional harm of social media, and reflexively distrustful of corporations that speak about issues they have a financial stake in. But that's not what non-engineers think we think. The assumption seems to be, well, you're a techie, so of course you uncritically embrace all that stuff. People who know me better and know I don't think that way seem to regard me as less of a techie for that reason, which goes to show how little they are aware of sentiment in our profession. I think that's what we need to fix.
A profession like medicine suffers a little bit from the same bias, where people tend to assume that doctors are personally pro-surgery, pro-drugs, etc., but doctors have a professional structure that creates recognized authorities, which means journalists have somebody to talk to when they want to get the overall take of "doctors" on an issue where their expertise applies. When writing about a public health issue, journalists have no problem getting an independent perspective from doctors with credibility, relevant expertise, and no direct financial stake in the issue.
Software is in a position analogous to if the only doctors visible in the media were PR flacks for hospitals and pharmaceutical companies.
A big cultural difference between medicine and software is that doctors are traditionally trained to bear the mantle of authority. They are trained that commanding the trust and respect of patients is vital to providing care to them, and that it is a skill separate from and equally necessary to the technical skills that make a doctor worthy of that respect. Tech people are socialized to beware of the dangers of authority and distrust those who seek it. I may be speaking as an old-timer here, but when I was young, I learned to lionize the scientists and engineers who rejected the accoutrements of authority, who wore cheap and frumpy clothes, who let their hair go crazy, who reveled in stories of their own stupid mistakes, who actively punctured the mystique of authority so that they would only have as much respect as their knowledge and achievements alone would earn them.
In other words, medicine comes from an old tradition, which long accepted that wielding authority and being worthy of it were separate skills. Keeping the two connected was a moral responsibility that fell on individual doctors and on the profession as a whole. The tradition of software is much younger and was much more deeply marked by the counterculture, which took an opposite approach to the problem of authority, declaring that we could and should unlearn our reflexive deference to the superficial aspect of authority and replace it with a critical, informed consumption of the expertise of other members of society. To the counterculture mindset, it was unacceptable that society should be at the mercy of the closed ranks of a profession privileged by its exclusive knowledge.
I think that the counterculture perspective was an important corrective, but it is incomplete, because the problem of authority hasn't gone away. Even if we despise authority, we still depend on it, so the question is: how should we as a profession create and elevate professional authority? How do we make it possible for a journalist to easily get a read on what software engineers think as professionals, distinct from the official line of large corporate employers of software engineers?
Maybe software needs a replacement for the old professional societies, except with an emphasis on policy and public education, instead of expensive journals and social events designed to help you find your way into the old boys' club. I have no idea what such a group would look like, though.
I don’t think people have any idea what end-to-end encryption means, they just hear maybe the occasional slogan (“it keeps your messages private”, “it lets terrorists hide from cops”) and assume there’s some valid choice between totally cripple online security and totally cripple people stalking your communications. I don’t even think people understand the implications of what communications means. Why else are we still talking about this issue in abstract terms when the harms are precisely enumerable and the supposed benefits can be completely debunked as fantasy?
All this stuff is so depressing. Free speech online is no longer in vogue, the ACLU, EFF, and other usual heroes of these sorts of battles feel asleep at the wheel. It’s sad to think I might see the death of something so beautiful.
I feel like we as a tech community should take a step back and consider whether or not we should not be the only ones that decide what should or should not be done. It is a massive country with many opposing viewpoints.
We have massive conflicts of interest and some tech companies have shown over and over that greed trumps morals in many cases. We are humans and we are not a group of enlightened arbiters that know what is best for the world.
We have done a shit job so far of managing ourselves. Sure in lots of cases we have made the world a better place but I think we need to be honest with ourselves and acknowledge that greed has crept in and supplanted that "making the world a better place" mission.