{"id":23741,"date":"2015-12-04T06:00:33","date_gmt":"2015-12-03T19:00:33","guid":{"rendered":"http:\/\/www.aspistrategist.ru\/?p=23741"},"modified":"2015-12-07T10:26:13","modified_gmt":"2015-12-06T23:26:13","slug":"u-cant-touch-this-the-inviolability-of-encryption","status":"publish","type":"post","link":"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/","title":{"rendered":"‘U Can\u2019t Touch This’: the inviolability of encryption"},"content":{"rendered":"

\"2291139919_cd960c5aa0_z\"<\/a>In his recent post on The Strategist<\/em><\/a>, Anthony Bergin makes many good points about the use of encryption by non-state actors like Daesh,\u00a0the related challenges to intelligence collection, and the importance of\u00a0balancing civil\u00a0liberties\u00a0and national security in times of heightened threat. While Anthony\u2019s recommendation that agencies focus on human intelligence is welcome (and in line with the government\u2019s national security statement<\/a>), what was missing was\u00a0a clarion call\u2014one in support of strong commercial encryption.<\/p>\n

The horror recently unleashed on Paris has prompted questions about what it means if\u00a0the terrorists\u00a0had used encryption to shield their plotting and communication from law enforcement and security agencies in Europe. Intelligence heads<\/a> and lawmakers<\/a> in the US were quick to claim<\/a> that encryption technologies were thwarting security efforts<\/a> and that \u2018backdoors\u2019 into devices and software are needed. Regardless of whether the Paris attackers used encryption, the\u00a0suggestion\u00a0of banning or weakening commercial encryption represents a patently wrong-headed approach to bolstering security.<\/p>\n

The encryption debate isn\u2019t a new one. The so-called ‘Crypto Wars’ have roots back to\u00a01976<\/a> when the discovery of ‘public key cryptography\u2019 gave individuals and businesses an\u00a0option to secure their communications, challenging the domestic monopoly on encryption that\u00a0the US government had maintained until that point. In the early 1990s, a battle unfolded as the US government lobbied telcos to submit to the \u2018Clipper Chip\u2019<\/a>, technology that \u2018relied on a system of \u201ckey escrow,\u201d in which a copy of each chip\u2019s unique encryption key would be stored by the government.\u2019 Concerns over deleterious security, privacy and economic consequences saw strong encryption win out after a few years of back and forth. Export controls on encryption were liberalised throughout the Clinton administration, and by 2005, the public\u2019s legal access to encryption was thought to be assured and the Crypto Wars were declared over (at least,\u00a0by some<\/a>).<\/p>\n

There were various attempts to water down encryption over the intervening years until Snowden\u2019s 2013 disclosure\u00a0of the NSA\u2019s Bullrun program<\/a> prompted companies like Apple and Google to begin to package privacy with their products and services. Those firms now offer\u00a0full-disk encryption<\/a>, meaning that the data and communications stored on their hardware or software is unable to be decrypted by anyone except the user, rendering access warrants impotent. Privacy and security by way of encryption became a selling point<\/a> and a strategy to win customers in a hotly contested market.<\/p>\n

Beyond the big tech companies, the last few years have seen a proliferation of mobile applications that enable encrypted communication. In March, then-Communications Minister Malcolm Turnbull name-checked a handful of apps<\/a> that could be used to subvert the government\u2019s data retention regime: \u2018Whatsapp or Wickr or Threema or Signal, you know, Telegram, there\u2019s a gazillion of them.\u2019 A few weeks earlier, Turnbull had spoken of the inherent insecurity of text messaging<\/a>\u2014\u2018messages are not encrypted in transit\u2026 [or] on the telco’s server\u2019\u2014and happily copped to using encryption services himself, including Wickr, WhatsApp and \u2018a number of others\u2026 because they’re superior over-the-top messaging platforms\u2026 You know, millions of people do, hundreds of millions of people use over-the-top applications.\u2019 Encryption is mainstream.<\/p>\n

Beyond securing our personal communications, encryption is fundamental to the protection of our online privacy, banking, passwords and corporate assets. In this way, it\u2019s a central contributor to the health of the global economy and business competition. Security and systems experts, cryptographers, digital privacy advocates and tech leaders have all said that weakening encryption is a bad idea<\/a> and that there\u2019s no way to build a backdoor for government use that won\u2019t also be exploited by terrorists, malicious hackers, tech-savvy criminals, foreign spies and industrial competitors, among others. A few months back, a draft US National Security Council paper determined<\/a> that \u2018the benefits to privacy, civil liberties and cybersecurity gained from encryption outweigh the broader risks that would have been created by weakening encryption\u2019. Mandating that US tech giants\u00a0introduce backdoors will only push consumers and criminals<\/a> alike toward products developed in other countries or toward home-brewed encryption. Encryption begets the security and trust that lies at the heart of the\u00a0internet.<\/p>\n

Law enforcement should have the necessary powers and tools to detect and prevent attacks, but weakening or banning cryptography won\u2019t make the masses more secure. Instead, we need to think around<\/em>\u00a0encryption. Intelligence agencies should focus on hacking the phones and computers of surveillance targets to exfiltrate private encryption keys, and on breaking into devices to target communications before encryption and after decryption<\/a>. Greater\u00a0public\u2013private collaboration and problem solving is needed between the highest levels of the US government and tech firms\u00a0like Apple, Google, Microsoft and Facebook: government needs a deeper understanding of the technology and the consequences of tweaking it, while private players need to understand the huge operational challenges faced by those charged with keeping us safe. The Australian government should make strong representations in Washington to this end.<\/p>\n

We don\u2019t yet have an answer as to\u00a0the extent to which the Paris terrorists\u00a0employed encryption.\u00a0It\u2019s important to remember, however, that many of those who carried out the attacks were on the radar<\/a> of intelligence services in both Belgium and France, where some\u00a0were on the high-security watch list La Fiche S<\/a>\u2014<\/em>along with more than 10,000 others. It has been reported that Turkish authorities contacted their French counterparts twice in the last year<\/a> to flag\u00a0one of the 13\/9 assailants, Omar Ismail Mostefai, as a terrorist threat; it was only in the aftermath\u00a0of the attacks that French authorities allegedly replied requesting information about Mostefai. That the attacks occurred seems less likely\u00a0due to an inability\u00a0to unlock encrypted communications data\u00a0than due\u00a0to a failure of\u00a0coordination, follow-up, targeting and action.<\/p>\n

The encryption debate is incorrectly characterised\u00a0as being about security versus liberty. It’s actually about security versus vulnerability,\u00a0and always has been.<\/p>\n","protected":false},"excerpt":{"rendered":"

In his recent post on The Strategist, Anthony Bergin makes many good points about the use of encryption by non-state actors like Daesh,\u00a0the related challenges to intelligence collection, and the importance of\u00a0balancing civil\u00a0liberties\u00a0and national security …<\/p>\n","protected":false},"author":207,"featured_media":23745,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[1012,750,1570,170,332],"class_list":["post-23741","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","tag-daesh","tag-data-retention","tag-encryption","tag-intelligence","tag-technology"],"acf":[],"yoast_head":"\n'U Can\u2019t Touch This': the inviolability of encryption | The Strategist<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"'U Can\u2019t Touch This': the inviolability of encryption | The Strategist\" \/>\n<meta property=\"og:description\" content=\"In his recent post on The Strategist, Anthony Bergin makes many good points about the use of encryption by non-state actors like Daesh,\u00a0the related challenges to intelligence collection, and the importance of\u00a0balancing civil\u00a0liberties\u00a0and national security ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/\" \/>\n<meta property=\"og:site_name\" content=\"The Strategist\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/ASPI.org\" \/>\n<meta property=\"article:published_time\" content=\"2015-12-03T19:00:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2015-12-06T23:26:13+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2015\/12\/2291139919_cd960c5aa0_z.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"427\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"David Lang\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@ASPI_org\" \/>\n<meta name=\"twitter:site\" content=\"@ASPI_org\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"David Lang\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#website\",\"url\":\"https:\/\/www.aspistrategist.ru\/\",\"name\":\"The Strategist\",\"description\":\"ASPI's analysis and commentary site\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.aspistrategist.ru\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-AU\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/#primaryimage\",\"url\":\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2015\/12\/2291139919_cd960c5aa0_z.jpg\",\"contentUrl\":\"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2015\/12\/2291139919_cd960c5aa0_z.jpg\",\"width\":640,\"height\":427},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/\",\"url\":\"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/\",\"name\":\"'U Can\u2019t Touch This': the inviolability of encryption | The Strategist\",\"isPartOf\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/#primaryimage\"},\"datePublished\":\"2015-12-03T19:00:33+00:00\",\"dateModified\":\"2015-12-06T23:26:13+00:00\",\"author\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/cf4ff2cfb006f536b2f5f3b363b47ee2\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/#breadcrumb\"},\"inLanguage\":\"en-AU\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.aspistrategist.ru\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"‘U Can\u2019t Touch This’: the inviolability of encryption\"}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/cf4ff2cfb006f536b2f5f3b363b47ee2\",\"name\":\"David Lang\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-AU\",\"@id\":\"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4c76694186876290e4bc2df2ebc462c6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4c76694186876290e4bc2df2ebc462c6?s=96&d=mm&r=g\",\"caption\":\"David Lang\"},\"url\":\"https:\/\/www.aspistrategist.ru\/author\/david-lang\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"'U Can\u2019t Touch This': the inviolability of encryption | The Strategist","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/","og_locale":"en_US","og_type":"article","og_title":"'U Can\u2019t Touch This': the inviolability of encryption | The Strategist","og_description":"In his recent post on The Strategist, Anthony Bergin makes many good points about the use of encryption by non-state actors like Daesh,\u00a0the related challenges to intelligence collection, and the importance of\u00a0balancing civil\u00a0liberties\u00a0and national security ...","og_url":"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/","og_site_name":"The Strategist","article_publisher":"https:\/\/www.facebook.com\/ASPI.org","article_published_time":"2015-12-03T19:00:33+00:00","article_modified_time":"2015-12-06T23:26:13+00:00","og_image":[{"width":640,"height":427,"url":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2015\/12\/2291139919_cd960c5aa0_z.jpg","type":"image\/jpeg"}],"author":"David Lang","twitter_card":"summary_large_image","twitter_creator":"@ASPI_org","twitter_site":"@ASPI_org","twitter_misc":{"Written by":"David Lang","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/www.aspistrategist.ru\/#website","url":"https:\/\/www.aspistrategist.ru\/","name":"The Strategist","description":"ASPI's analysis and commentary site","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.aspistrategist.ru\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-AU"},{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/#primaryimage","url":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2015\/12\/2291139919_cd960c5aa0_z.jpg","contentUrl":"https:\/\/www.aspistrategist.ru\/wp-content\/uploads\/2015\/12\/2291139919_cd960c5aa0_z.jpg","width":640,"height":427},{"@type":"WebPage","@id":"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/","url":"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/","name":"'U Can\u2019t Touch This': the inviolability of encryption | The Strategist","isPartOf":{"@id":"https:\/\/www.aspistrategist.ru\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/#primaryimage"},"datePublished":"2015-12-03T19:00:33+00:00","dateModified":"2015-12-06T23:26:13+00:00","author":{"@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/cf4ff2cfb006f536b2f5f3b363b47ee2"},"breadcrumb":{"@id":"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/#breadcrumb"},"inLanguage":"en-AU","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.aspistrategist.ru\/u-cant-touch-this-the-inviolability-of-encryption\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.aspistrategist.ru\/"},{"@type":"ListItem","position":2,"name":"‘U Can\u2019t Touch This’: the inviolability of encryption"}]},{"@type":"Person","@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/cf4ff2cfb006f536b2f5f3b363b47ee2","name":"David Lang","image":{"@type":"ImageObject","inLanguage":"en-AU","@id":"https:\/\/www.aspistrategist.ru\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4c76694186876290e4bc2df2ebc462c6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4c76694186876290e4bc2df2ebc462c6?s=96&d=mm&r=g","caption":"David Lang"},"url":"https:\/\/www.aspistrategist.ru\/author\/david-lang\/"}]}},"_links":{"self":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/23741"}],"collection":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/users\/207"}],"replies":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/comments?post=23741"}],"version-history":[{"count":18,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/23741\/revisions"}],"predecessor-version":[{"id":23807,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/posts\/23741\/revisions\/23807"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/media\/23745"}],"wp:attachment":[{"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/media?parent=23741"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/categories?post=23741"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.aspistrategist.ru\/wp-json\/wp\/v2\/tags?post=23741"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}