The claim I was responding to is that CALEA and PATRIOT have the effect of compelling all major US technology companies to implement key escrow or, more generously, some cryptographic or UX compromise with the same effect, in order to effectuate SIGINT.
I know this claim to be false. I said so, and, within the limits of my ability (for obvious reasons), provided my evidence.
If you want to keep talking about how you don't trust tech companies, that's fine by me. We don't have a live argument on that issue; I'm not interested in it.
For those reading it should be clear that the US 'voluntells' US corporations to provide access to information and keys and to build in key escrow mechanisms through regulatory and financial leverage, through partnerships, contracts and kickbacks, legal pressure, and otherwise.
Tap and trace laws force telecommunications companies to subvert over-the-wire encryption - they can not subvert end-to-end encryption because they do not provide it. However Bush era interpretations of tap-and-trace and pen register laws expanded analog and phone communications to digital media. Skype, for example was fully and willingully subverted (Snowden docs, again) - the end-to-end crypto removed from the original versions of the product.
If one enters into these conversations only wanting to examine single sentences of law and not the legal process/architecture, one fundamentally introduce a bias. That's okay (freedom of speech). But readers beware that they aren't going to be able to get a full story from legal reductionism.
Do you trust all of them? I doubt it. Of course some companies are more trustworthy than others.
My point is that in a time when trust is in crisis, NONE of the major tech companies is providing users with strong tools for privacy that can't be circumvented for law enforcement or spying.
As far as is publicly known, this is correct.
> Occam's Razor suggests to me that the popular idea that big tech companies spy on their users for the USG is fallacious.
But that the second part doesn't, at all, follow from the first.
For example, telcos have spied on Americans for the government since there were telcos. At best, you could argue that the heavy lifting is done in NSA equipment in terms of DPI and word-spotting, etc. But there are plenty of technology companies that are ass-deep in spying on the American people.
I suppose you mean that it isn't obvious that Google and other companies with a strong reputation for being careful with customer data are spying on Americans. OK, it isn't obvious, but let's go back to the first premise: CALEA doesn't require companies to break encryption to make surveillance possible. IF there isn't some hidden agreement about that, why are there exactly zero major services that provide user-controlled keys, end-to-end encryption, and web-of-trust key exchange?
All of these companies could get past any suspicion of surveillance by providing the means to be truly private. None have done so.