Schneier on Security

Skeptical • October 21, 2015 7:44 PM

@rgaff: I also wonder why on earth they only serve their site through HTTPS when they’re the ones spreading the word that nobody needs anything to be encrypted… I guess bureaucracies are known for being hypocritical…

No one has ever made such an argument.

The question has always boiled down to this:

whether the sum of the costs of (i) a security gap between a system of encryption in which as few as 1 person can decrypt a given message and a system of encryption in which 1 person and (a government agency acting with lawful authorization) can decrypt a given message, and the cost of (ii) implementing the latter system (assuming that for some cost it could be)

is greater than

the benefits of government agencies acting with lawful authorization having the ability to decrypt messages they would otherwise not possess.

The answer to the question is unlikely to be the same across all configurations of technology, use of technology by individuals and groups within the applicable society or societies, and political and social factors.

For example, a society with a legitimate government composed of robust institutions with safeguards against abuse that is under the extreme duress of attacks by terrorist cells hiding within society might find the costs and benefits appreciably different than a society in different circumstances.

Where it gets really complicated is when we attempt to factor non-rational responses by society to various events in either the presence or absence of a given system.

At present, I don’t think there’s a clear answer either way – which may be an argument in favor of the status quo. I don’t think the implementation of such a system would spell the end of meaningful security or destine us for tyranny, but neither, at present, does it seem that the non-implementation of such a system will come with great costs.

Whether that casual assessment of non-implementation continues to hold true… who can say. But I do find it at least somewhat ironic that certain nations may continue to ameliorate the dilemmas faced by US and allied signals intelligence agencies by deliberately adopting technology that is distinguished from that used in US and allied information systems, both government and private.

Skeptical • October 23, 2015 11:19 AM

@Winter: I assume you somehow want to suggest this is the USA.

No, I explicitly say that the US is not in such a position. But then what would you have written in response?

And I go on to say that that fact may form part of a persuasive argument in favor of the status quo. I note that I don’t think the implementation of such a system would spell the end of meaningful liberty or the dawn of tyranny, and that I also don’t think that catastrophe awaits us if we do not implement such a system.

@Dirk: I’m pretty sure that’s exactly how Assad & co. see it too. It starts with some harmless mass surveillance and private-public sector collusion. Then a little censorship and internet kill switches. You move on to collecting DNA and encryption backdoors because of terrorists and criminals. Eventually you end up barrel bombing a population that’s sick and tired of the paranoid sh*t of an authoritarian ruling class that only serves itself.

I’m sure Assad has many rationalizations for his actions. They are no more persuasive than your assumption of an incredibly steep slippery slope, on which a single step quickly transforms that society’s government into an authoritarian beast that survives only by virtue of its ability to slaughter the very people it claims to represent.

Western democracies undertook many internal security measures during periods of duress, such as World War II, and some of which were in fact unjustified. But that did not transform them into authoritarian nations, ending in civil war.

But such an assumption does make it easier to answer complex policy questions. Unfortunately it does so only by ignoring important components of reality.