Schneier on Security

I wonder privacy vs saftey ? • August 31, 2008 8:13 PM

One idea, just food for thought. What would you do you were a government that needed vital intel which technology threatened to obscure from you in the name of privacy ? I was reading this and I had an interesting idea as to what I would do as a government agency assuming I were at lease as smart as or employing the smartest in the information security field. BTW if I were this smart you’d never know I was employing their services and they would not achieve any recognition or fame only monetary reward for their prowess.

If I were a Government and wanted to be sure I could always track and read anyones data without a court order or without visibility, and had vast time and resources at my disposal.

I would create foundations for privacy, personal security and anonymity. I would introduce excellent, top notch and free encryption solutions as projects donated to the open source community and updated by various individuals who had been contributing random software projects for years and would make sure it was so good that many individuals and even commercial organizations would adopt it. I would ingrain a sophisticated back door via a method that was likely to go unrecognized, and perhaps which was out side of current private sector research scope so as to be off the radar. Then I would insure it was such that if discovered could at most be labeled a bug with no known exploits targeting it.

Then as for traffic monitoring:

I would not attempt to monitor all public traffic where the monitoring would always be subject to some level of oversight or exposure, where I would have to know what I was looking and where someone, somewhere would know I was intentionally monitoring it. I would myself instead adopt the principal of plausible deny-ability in my surveillance and would create and donate the privacy, or anonymous networks which I could unofficially and anonymously scoop for any and all information. From time to time I would grumble about them as letting criminals , software pirates , hackers and child pornographers or worse potently elude me with relative impunity. Local law enforcement would decry them and civil libertarians would defend them. Perhaps feeble legislation would attack them but inevitably be struck down as unconstitutional. Such a system would no doubt be great “honey pot’ attracting those with “interesting data” seeking to protect conceal themselves and the ratio of unimportant even if illegal, or simply confidential or embarrassing data by those simply concerned with personal privacy , or petty theft of peoples credit card numbers and so forth to say that of “truly interesting data” such as that of real national security or significant criminal investigative importance would surely be higher than what one would find casting a wide net over general public communications assuming one could justify doing so without specific reason and stating targeted objectives. If I needed to cast a wide net and constantly monitor everything so that I need only know what interests me once I have seen it and can have quick and exhaustive access to the most likely useful information what would it do ? I would leave the public communications mostly alone and protected even though it’s security would surely be suspect to those motivated and knowledgeable enough. I would wait for those desperate to avoid it’s risk, (those who likely might really have something to hide for good reason), to seek alternatives. rather than try to play catchup via legislation or cracking of technologey that threatened to conceal vital intel from me I would instead make sure people had such alternatives and I would be one to create the best, most popular and totally free alternatives to plainly sending info over exposed public commercial channels. It would be free since I know payment leaves a trail which discourages use by those who truly wish to hide from me and who understand my basic, well known, resources for tracking them. So their would exists services for anonymity and or privacy that would in fact provide this in most cases as far as most user were ever concerned. I would however directly mine them deniabley with impunity for any and all data but never use this information to compromise the privacy or anonymity of 99% of it’s users and would not make it known to any other purposed or lesser agencies even in my own organization. It would be setup on a need to know basis and as few as humanly possible would in fact have this need. I would admit to and recant on some feeble, marginally useful public monitoring that would be exposed briefly in the media which would offend civil libertarians and would be my expected panicked attempts at “big brother-ish” information monitoring via quasi-legal backbone and wiretapping schemes.

I would never revel my source to information and would let most illegal, and detrimental information flow freely past my gaze without reaction save in a few most severe cases when an unrelated 3rd party might accidentally be given the chance to possibly notice a red flag that may prompt them to decide examine someone closer using common known surveillance to be ready to catch other slip ups or leaks which would always be the justified and apparent cause of suspicion which prompted the noted legitimate visible legal investigation and prosecution. Otherwise I simply would let the drug dealers, pedophiles, hackers, credit card thieves and so forth enjoy their perceived anonymity and protections while taking their chances with common civil law enforcement agencies just as if my surveillance did not exist what so ever. I would know that while use of my intel in investigating common below the law civil crimes would surely eventually raise suspicion and I would know that conversely the apparent successful use of these services by these elements with no repercussions would encourage trust by those I truly need to be ware of and who’s assumed anonymous data I would need to always see in order to make important decisions regarding national security matters above petty common civil law. If the public wanted to have secrecy, anonymity and privacy then I would I be sure at the end of the day, they got it from me , on my network and their data lived in my house. So I (or my select single tasked agents) could quietly be in the know and myself generally valuing freedom of speech, anonymity and privacy could offer such to 99% of them with one important deniable and discrete exception never to be compromised by use for anything other than discreet reaction to matters of true importance to my nations security. Would this be acceptable as long as I could avoid the pitfalls of abuse and not slide down the slippery slope of permanently legislating away my peoples civil liberties? If most people assumed I was bloated , dumb, inefficient and recognized me as seemingly being constantly behind the curve of technological developments always reacting to new technologey when it popped up as if it were but a confusing thorn in my old fashioned bureaucratic side, well then all the better.

Of course even if this could be the case with Tor coming out of the Navy and ending up with EFF which I think it most likely isn’t that being more the plot of a Tom Clancy novel or James Bond movie most likely. I’m not sure I’d mind something like this so much given the state of the world today and the assumption that the government is made of people just like you who although not perfect do want to preserve their right to privacy, just like you or I, but recognize a need to balance that with safety and security. Certain examples excluded of course such as the lamentable exploitations by some of our politicians or the ill conceived knee jerk panic legislations by some of our elected officials in the wake of the tragedy we have in the last decade, for what ever reason, (be it oil dependence, corporate greed, poor foreign policy, or simply shear ill fate in an evolving, growing, still competitive and consequently volatile global society) been made as a people to endure and attempt to address as best we can.