One security start-up that had an encounter with the FBI was Wickr, a privacy-forward text messaging app for the iPhone with an
Android version in private beta. Wickr's co-founder Nico Sell told CNET at Defcon, "Wickr has been approached by the FBI and asked for a backdoor. We said, 'No.'"
The mistrust runs deep. "Even if [the NSA] stood up tomorrow and said that [they] have eliminated these programs," said Marlinspike, "How could we believe them? How can we believe that anything they say is true?"
Where does security innovation go next? The immediate future of information security innovation most likely lies in software that provides an existing service but with heightened privacy protections, such as webmail that doesn't mine you for personal data.
Group items matching
in title, tags, annotations or url
1More
New Box.net CMS Release Leverages Cloud, Partnerships - ecrmguide.com - 0 views
-
PALO ALTO, Calif - Box.net unveiled a redesign of its cloud-based content management (CMS) and collaboration system at a press event here today at company headquarters. The new interface, features and partnership announcements with NetSuite, Samsung and VMware are all part of the company's strategy to win over more enterprise customers. "This is an all new version of Box, remade for the enterprise, enabling a new set of workflows and features," Box CEO Aaron Levie said in opening remarks. Storage in the free version of Box has been upgraded to five gigabytes (up from one) and is unlimited for enterprise users of the paid version. Box has also increased the viewing area for content by 30 percent, added real-time updates of content including new comments, edits or deletions of a document. Updates are also ranked and collated to present the user with the most important information. Another improvement is a simplified administrative console designed to improve readability and organization. Overall, Box said it has developed a much more scalable framework for its user interface that makes it easier to roll out new features.
1More
Glide Extends the IPad, Converts Flash on the Fly - PCWorld Business Center - 2 views
-
Wow! 30GB free. 250 file formats with a "universal translation engine". And HTML5. excerpt: "You can't have convergence unless you have the ability to translate files across different platforms and devices," Donald Leka, TransMedia's CEO, told Macworld. "There's a war between the big tech companies like Adobe, Apple, Microsoft, and Google, and these compatibility issues are not going to go away." Glide also lets you share any documents or media in your account with other users or the public. And with new desktop clients for Mac and PC that can sync a local folder up to your cloud storage space, Glide is taking on popular competitors like Dropbox, SugarSync, and Apple's own iDisk. Glide is free to use in desktop browsers and on the iPad, and free accounts get 30GB of space to start. Premium accounts offer 250GB of space for $50 per year.
6More
shared by Paul Merrell on 06 Aug 13
- No Cached
Surveillance scandal rips through hacker community | Security & Privacy - CNET News - 0 views
news.cnet.com/...-rips-through-hacker-community
surveillance state NSA NSA-blowback cloud computing mobile devices privacy
![](/images/link.gif)
-
Wickr's Sell thinks that her company has hit upon a privacy innovation that a few others are also doing, but many will soon follow: the company itself doesn't store user data. "[The FBI] would have to force us to build a new app. With the current app there's no way," she said, that they could incorporate backdoor access to Wickr users' texts or metadata. "Even if you trust the NSA 100 percent that they're going to use [your data] correctly," Sell said, "Do you trust that they're going to be able to keep it safe from hackers? What if somebody gets that database and posts it online?" To that end, she said, people will start seeing privacy innovation for services that don't currently provide it. Calling it "social networks 2.0," she said that social network competitors will arise that do a better job of protecting their customer's privacy and predicted that some that succeed will do so because of their emphasis on privacy. Abine's recent MaskMe browser add-on and mobile app for creating disposable e-mail addresses, phone numbers, and credit cards is another example of a service that doesn't have access to its own users' data.
-
Stamos predicted changes in services that companies with cloud storage offer, including offering customers the ability to store their data outside of the U.S. "If they want to stay competitive, they're going to have to," he said. But, he cautioned, "It's impossible to do a cloud-based ad supported service." Soghoian added, "The only way to keep a service running is to pay them money." This, he said, is going to give rise to a new wave of ad-free, privacy protective subscription services.
- ...2 more annotations...
-
The issue with balancing privacy and surveillance is that the wireless carriers are not interested in privacy, he said. "They've been providing wiretapping for 100 years. Apple may in the next year protect voice calls," he said, and said that the best hope for ending widespread government surveillance will be the makers of mobile operating systems like Apple and Google. Not all upcoming security innovation will be focused on that kind of privacy protection. Security researcher Brandon Wiley showed off at Defcon a protocol he calls Dust that can obfuscate different kinds of network traffic, with the end goal of preventing censorship. "I only make products about letting you say what you want to say anywhere in the world," such as content critical of governments, he said. Encryption can hide the specifics of the traffic, but some governments have figured out that they can simply block all encrypted traffic, he said. The Dust protocol would change that, he said, making it hard to tell the difference between encrypted and unencrypted traffic. It's hard to build encryption into pre-existing products, Wiley said. "I think people are going to make easy-to-use, encrypted apps, and that's going to be the future."
-
Companies could face severe consequences from their security experts, said Stamos, if the in-house experts find out that they've been lied to about providing government access to customer data. You could see "lots of resignations and maybe publicly," he said. "It wouldn't hurt their reputations to go out in a blaze of glory." Perhaps not surprisingly, Marlinspike sounded a hopeful call for non-destructive activism on Defcon's 21st anniversary. "As hackers, we don't have a lot of influence on policy. I hope that's something that we can focus our energy on," he said.
3More
Microsoft Unveils 'Turnkey' Cloud Appliance -- InformationWeek - 0 views
-
Microsoft on Monday unveiled a preconfigured system designed to help businesses move to cloud computing quickly and efficiently without disrupting existing IT operations. The Windows Azure platform appliance consists of the Windows Azure cloud operating system, Microsoft SQL Azure, and, according to the company, "a Microsoft-specified configuration" of network, storage, and server hardware.
-
Hewlett-Packard, Dell, and Fujitsu have signed agreements to offer versions of the Windows Azure platform appliance based on their own gear, Microsoft said. eBay, meanwhile, has successfully tested the offering and is moving some of its Web pages to Microsoft's cloud.
-
Microsoft announcement is at http://www.microsoft.com/Presspass/press/2010/jul10/07-12CloudComputingPR.mspx
1More
shared by Gary Edwards on 08 May 12
- No Cached
Microsoft pitches SkyDrive over iCloud to Mac Office users - Computerworld - 1 views
www.computerworld.com/...ver_iCloud_to_Mac_Office_users
ge Cloud-Productivity-Platform MS-Skydrive MS-Cloud-Productivity SkyDrive-Live iCloud
![](/images/link.gif)
-
Interesting article describing a recent press conference where Microsoft introduced their latest SkyDrive alternative to Apple's iCloud initiative. Having had considerable experience with SkyDrive and the entire "sync-share-store" Cloud category, I left a lengthy comment. Computerworld - Microsoft is pitching its SkyDrive online storage service to Office for Mac users, calling Apple's iCloud offering "not enough" for collaboration, file sharing and anywhere-access to documents. Microsoft released an OS X SkyDrive client preview two weeks ago, adding Macs to the list of devices -- Windows, particularly the upcoming Windows 8, iOS and Windows Phone -- with native support for the Dropbox-like service. On Monday, the Redmond, Wash. developer stumped for SkyDrive on its Office for Mac website. "With the SkyDrive for Mac OS X Lion preview, SkyDrive for Windows, and the release of SkyDrive for iPad, you can save and store your important documents or other files in the SkyDrive folder in Finder and access them from anywhere," the Office for Mac team wrote on its blog.
1More
Avatron Software: Air Sharing of Documents iPhone and iPAD - 0 views
-
Viewing and printing of documents. Support for PDF, RTF, RTFD, iWork, MSOffice (subject to iOS compatibility), Web archives, HTML, text, source code, and standard iOS multi media. No discussion yet as tho whether or not Avatron can support Visual fixed/flow viewing of these supported formats. Some interesting support for mounting remote file servers - cloud storage systems like DropBox, Box.net , FTP and secure HTTPS. No WebDav. Seems to be struggling to make that cross-over from iOS device to desktop to cloud-computing connectivity.
1More
shared by Paul Merrell on 17 Dec 10
- No Cached
Technology News: Tech Law: Court Ruling Grants Email the Cloak of Privacy - 0 views
www.technewsworld.com/...71467.html
email privacy cloud computing SaaS 4th Amendment warrantless searches
![](/images/link.gif)
1More
shared by Gary Edwards on 04 Jun 12
- No Cached
Asus shows off ARM-based Windows 8 tablet - Computerworld - 0 views
www.computerworld.com/...off_ARM_based_Windows_8_tablet
Cloud-Productivity-Platform Visual-Productivity MS-Business-Productivity-Platform Compat-Interop
![](/images/link.gif)
-
Is Intel right? Is there a "compatibility-interoperability" problem between Windows RT Office (ARM) and legacy (x86) Windows MS Office productivity environments? It seems to me that the entire reason iPAD, Android and other ARM based tablet systems want MSOffice and MSOffice Visual Document Viewers is exactly because they want and expect a high level of compat-interop with legacy Windows productivity workgroups and client/server systems. What's the truth? And is there anything x86 providers like Intel and AMD can do about compat-interop and the unstoppable cloud-mobility revolution? excerpt: The Asus tablet has a quad-core Tegra 3 processor from Nvidia. Windows RT comes preloaded with Office 15, a group of widely used productivity applications. Microsoft has said it had to re-engineer Windows RT to deal with expectations for ARM based devices, which include all-day connectivity and low power consumption. The tablet also has an 8-megapixel camera at the rear with LED flash, and a 2-megapixel camera at the front. It has 2GB of RAM, 32GB of storage, Wi-Fi and Bluetooth 4.0. Intel has already started the war of words against ARM around Windows 8, with Intel's CEO Paul Otellini saying that ARM devices will be incompatible with existing Windows applications and drivers. But analysts have said that Windows RT devices will likely be attractive to users who have few ties with legacy Windows PCs. Low prices could also attract users to Windows on ARM devices.
1More
Amazon's "Elastic Beanstalk": Cloud Computing For The Masses - Eric Savitz - Tech Musin... - 0 views
-
Developers simply upload their application, and Elastic Beanstalk automatically handles the deployment details of capacity provisioning, load balancing, auto-scaling, and application health monitoring," the company said this morning in announcing the service. "At the same time, with Elastic Beanstalk, developers retain full control over the [Amazon Web Services] resources powering their application and can access the underlying resources at any time." Customers pay nothing for Elastic Beastalk, paying instead for the resources used to run their applications. Elastic Beanstalk provides a quick way for developers to make use of a range of Amazon services - Amazon EC2 (for computing power), Amazon S3 (for data storage), Amazon Simple Notification Service, Elastic Load Balancing, and Auto-Scaling. "Elastic Beanstalk handles the provisioning and deployment of the infrastructure needed to run the application," the company said.
1More
Official Google Docs Blog: Upload and store your files in the cloud with Google Docs - 0 views
-
We're happy to announce that over the next few weeks we will be rolling out the ability to upload, store and organize any type of file in Google Docs. With this change, you'll be able to upload and access your files from any computer -- all you need is an Internet connection.Instead of emailing files to yourself, which is particularly difficult with large files, you can upload to Google Docs any file up to 250 MB. You'll have 1 GB of free storage for files you don't convert into one of the Google Docs formats (i.e. Google documents, spreadsheets, and presentations), and if you need more space, you can buy additional storage for $0.25 per GB per year. This makes it easy to backup more of your key files online, from large graphics and raw photos to unedited home videos taken on your smartphone. You might even be able to replace the USB drive you reserved for those files that are too big to send over email.Combined with shared folders, you can store, organize, and collaborate on files more easily using Google Docs. For example, if you are in a club or PTA working on large graphic files for posters or a newsletter, you can upload them to a shared folder for collaborators to view, download, and print.
2More
McKinsey: technologies that will disrupt our world - Business Insider - 1 views
-
Very interesting graphic and the numbers are stunning. One of the cornerstones of "Productivity" is Office and Business Process Automation. Here they use the term "Automation of knowledge work". The impact of improvements in this sector between 2013 and 2025 is estimated to be $5.2 to $6.7 TRILLION. "McKinsey's Global Institute discusses this in its latest report, Disruptive Technologies: Advances that will transform life, business, and the global economy. It came up with a list of 12 technologies that could have a potential economic impact between $14 trillion and $33 trillion a year in 2025. The authors write that "some of this economic potential will end up as consumer surplus; a substantial portion of this economic potential will translate into new revenue that companies will capture and that will contribute to GDP growth. Other effects could include shifts in profit pools between companies and industries." The 12 disruptive technologies include: mobile Internet, automation of knowledge and work, Internet of things, cloud technology, advanced robotics, autonomous and near-autonomous vehicles, next-generation genomics, energy storage, 3D printing, advanced materials, advanced oil and gas exploration and recovery, renewable energy."
-
On "Internet of Things," see e.g., https://www.youtube.com/watch?feature=player_embedded&v=yp8AjMBG87g
1More
shared by Gary Edwards on 19 May 09
- Cached
IntalioCloud takes on Salesforce.com » VentureBeat - 0 views
venturebeat.com/...iocloud-takes-on-salesforcecom
venture-capital plutext wiki-word jason salesforce.com intalio
![](/images/link.gif)
-
IntalioCloud takes on Salesforce.com with public-private cloud design. Note that business applications developed for use in Salesforce's platform have to use the company's proprietary programming language, while IntalioCloud is open to many languages such as JavaScript and Ruby. Third, Intalio says it provides 25 gigabytes of data storage per account, much more than Salesforce. $42 Mill in VC The nexxus here is that both salseforce.com and Intalio need to provide integration into the MSOffice productivity environment to compete with Microsoft Azure.
3More
Join Opera's journey to reinvent the Web - 1 views
-
Opera today released Opera 10.10 with Opera Unite, a powerful technology for personal content sharing directly between all your devices. Opera Unite is available as a standard feature in Opera 10.10, available free from www.opera.com.To mark this release, Opera is inviting the world to join our journey to reinvent the Web. By wrapping both a Web browser and a Web server into one package, Opera Unite challenges the conventional, semi-private methods of sharing the content that really matters to people everywhere."We promised Opera Unite would reinvent the Web," said Jon von Tetzchner, CEO, Opera. "What we are really doing is reinventing how we as consumers interact with the Web. By giving our devices the ability to serve content, we become equal citizens on the Web. In an age where we have ceded control of our personal data to third-parties, Opera Unite gives us the freedom to choose how we will share the data that belongs to us."
-
Playing with the software now. Unite is a cloud integration, with a directory on your system identified as a directory to be shared with the cloud storage. Haven't really got into it yet, but I see options to keep the data in the folder private, to share it with those who know the password, and to publish the directory to the world. There are roughly 25 Unite applications not discussed in the press release here. http://unite.opera.com/applications/ My first thought was that Google will have to respond in kind, while Microsoft --- which doesn't get the power of "free" --- will respond but with a less generous offering.
-
Opps. I was wrong. There is no online storage. It is as stated in the press release, an integration of a server with the Opera browser. The shared content is served by the local machine. Which means that the local machine must be running in order for others to access the shared content. But according to the Unite FAQ, this also means that there are only practical limits on the amount of content shared, e.g., hard disk capacity and bandwidth. Why bother with setting up a LAN or VPN if you can share files over the internet using Opera? And how will Google and Microsoft respond?
1More
What is Boxcryptor | Easy to use encryption for cloud storage | boxcryptor.com - 0 views
-
Free for personal use. I haven't tried this yet, but the need for it has been near the top of my head since I first tried Dropbox and then realized how insecure it was. I tried a lot of sync services, but am now using Wuala, which features end-to-end encryption baked into the client software. But I also use MEGAsync for remote backup so I'[ll probably be trying this out with that service. I hope there's a way to sync the two programs.
2More
Tiny USB Stick Brings Android to PCs, TVs | Gadget Lab | Wired.com - 1 views
-
Google has made no secret about its plans for Android. Smartphones and tablets are just the beginning — the company wants Android everywhere. And thanks to FXI Technologies’ Cotton Candy USB device, we may not have to wait long to see Android on more than just our mobile devices. FXI essentially built an ultra-lean computer inside a small USB stick. Stick it into any device that supports USB storage, and Cotton Candy will register as a USB drive. From there, you can run the Android OS in a secure environment inside your desktop, courtesy of a Windows/OSX/Linux-compatible virtualization client embedded in the device. Stick Cotton Candy into a computer, and Android will appear in a virtualized window on your desktop. But get this: The USB key also features an HDMI connector. This way, you can connect the stick to your TV and use Android on the big screen (though you’ll need some kind of secondary input device, like a Bluetooth mouse/keyboard combo, to get anything done.)
-
Vaporware, but interesting. More info on the developers' website at . Basic idea is a computer on a stick that can be plugged into either other computers or into an HDMI flatscreen TV. In the latter scenario, Bluetooth connectivity for keyboard/mouse combo, provided by e.g., a smartphone. The USB connection is v. 2.0, but I'll guess that USB 3.0 would soon be an option in newer models. According to the specs it can run either Android or Ubunutu. If you check the developer's website, they definitely have their eyes on the growth in the numbers of HDMI-equipped TVs. Note that if delivered as described, this breaks boundaries of mobile devices, tending toward a convergence of TV monitors and mobile devices in an unexpected way.
4More
Dropbox: Condoleeza Rice appointment won't alter privacy pledge - CNET - 0 views
-
Dropbox CEO Drew Houston sought to quell the uproar over the appointment of former US Secretary of State Condoleezza Rice to the company's board of directors, saying in a blog post Friday that Rice's appointment won't change its stance on privacy. "There's nothing more important to us than keeping your stuff safe and secure. It's why we've been fighting for transparency and government surveillance reform, and why we've been vocal and public with our principles and values," Houston wrote. "We should have been clearer that none of this is going to change with Dr. Rice's appointment to our Board." The cloud storage service is trying to grow its international presence -- something Rice should be able to help with. However, after Dropbox announced her appointment earlier this week, a Web site dedicated to the "Drop Dropbox" movement called her selection "deeply disturbing" and said her board role was "problematic on a number of deeper levels, and invites serious concerns" about management's commitment "to freedom, openness, and ethics."
-
The movement said it objected to her role in the US decision to go to war in Iraq, as well as her position on the use of torture against prisoners. What's more, they said Rice supported the George W. Bush administration's "warrantless wiretap program and expansive domestic surveillance program."Houston responded in his brief note today, saying that Dropbox "should have been clearer that none of this is going to change" in the aftermath of Rice's appointment. "Our commitment to your rights and your privacy is at the heart of every decision we make, and this will continue," he wrote.
-
"We're honored to have Dr. Rice join our board -- she brings an incredible amount of experience and insight into international markets and the dynamics that define them," Houston wrote. "As we continue to expand into new countries, we need that type of insight to help us reach new users and defend their rights. Dr. Rice understands our stance on these issues and fully supports our commitments to our users."In her only public comments about Dropbox since being named to the board, Rice didn't get very detailed in speaking with Bloomberg on Wednesday. "As a country, we are having a great national conversation and debate about exactly how to manage privacy concerns," Rice said in the interview. "I look forward to helping Dropbox navigate it."
3More
shared by Paul Merrell on 10 Oct 11
- No Cached
Inside Google Desktop: Google Desktop Update - 0 views
googledesktop.blogspot.com/...google-desktop-update.html
Google Google Desktop search desktop search
![](/images/link.gif)
-
In 2004, Google launched Google Desktop, a program designed to make it easy for users to search their own PCs for emails, files, music, photos, Web pages and more. Desktop has been used by tens of millions of people and we’ve been humbled by its usage and great user feedback. However, over the past seven years we’ve also witnessed some big changes in how users store and access their own data, with many moving to web-based applications. There has been a significant shift from local to cloud-based storage and computing, as well as integration of Google Desktop functionality (like local search) into most modern operating systems. This is a positive development for users and we’re excited that most people now have instant access to their personal information. As such, we’ll be discontinuing support for Google Desktop, including all of the associated APIs, services, plugins and gadgets. As of September 14, Google Desktop will no longer be available for download, and existing installations will not be updated to include new features or fixes.
-
n 2004, Google launched Google Desktop, a program designed to make it easy for users to search their own PCs
-
Google throws in the towel on desktop search, just as Microsoft somehow reached into my WinXP Pro (which never runs with automatic updates turned on) and killed the file search functionality, replaced by a message that file search is no longer supported in Explorer 6, with an invitation to upgrade MSIE or use Bing. As though I would ever let MSIE outside my firewall!
11More
shared by Paul Merrell on 11 Dec 15
- No Cached
Cy Vance's Proposal to Backdoor Encrypted Devices Is Riddled With Vulnerabilities | Jus... - 0 views
www.justsecurity.org/...evices-riddled-vulnerabilities
surveillance state encryption-backdoors Vance
![](/images/link.gif)
-
Less than a week after the attacks in Paris — while the public and policymakers were still reeling, and the investigation had barely gotten off the ground — Cy Vance, Manhattan’s District Attorney, released a policy paper calling for legislation requiring companies to provide the government with backdoor access to their smartphones and other mobile devices. This is the first concrete proposal of this type since September 2014, when FBI Director James Comey reignited the “Crypto Wars” in response to Apple’s and Google’s decisions to use default encryption on their smartphones. Though Comey seized on Apple’s and Google’s decisions to encrypt their devices by default, his concerns are primarily related to end-to-end encryption, which protects communications that are in transit. Vance’s proposal, on the other hand, is only concerned with device encryption, which protects data stored on phones. It is still unclear whether encryption played any role in the Paris attacks, though we do know that the attackers were using unencrypted SMS text messages on the night of the attack, and that some of them were even known to intelligence agencies and had previously been under surveillance. But regardless of whether encryption was used at some point during the planning of the attacks, as I lay out below, prohibiting companies from selling encrypted devices would not prevent criminals or terrorists from being able to access unbreakable encryption. Vance’s primary complaint is that Apple’s and Google’s decisions to provide their customers with more secure devices through encryption interferes with criminal investigations. He claims encryption prevents law enforcement from accessing stored data like iMessages, photos and videos, Internet search histories, and third party app data. He makes several arguments to justify his proposal to build backdoors into encrypted smartphones, but none of them hold water.
-
Before addressing the major privacy, security, and implementation concerns that his proposal raises, it is worth noting that while an increase in use of fully encrypted devices could interfere with some law enforcement investigations, it will help prevent far more crimes — especially smartphone theft, and the consequent potential for identity theft. According to Consumer Reports, in 2014 there were more than two million victims of smartphone theft, and nearly two-thirds of all smartphone users either took no steps to secure their phones or their data or failed to implement passcode access for their phones. Default encryption could reduce instances of theft because perpetrators would no longer be able to break into the phone to steal the data.
-
Vance argues that creating a weakness in encryption to allow law enforcement to access data stored on devices does not raise serious concerns for security and privacy, since in order to exploit the vulnerability one would need access to the actual device. He considers this an acceptable risk, claiming it would not be the same as creating a widespread vulnerability in encryption protecting communications in transit (like emails), and that it would be cheap and easy for companies to implement. But Vance seems to be underestimating the risks involved with his plan. It is increasingly important that smartphones and other devices are protected by the strongest encryption possible. Our devices and the apps on them contain astonishing amounts of personal information, so much that an unprecedented level of harm could be caused if a smartphone or device with an exploitable vulnerability is stolen, not least in the forms of identity fraud and credit card theft. We bank on our phones, and have access to credit card payments with services like Apple Pay. Our contact lists are stored on our phones, including phone numbers, emails, social media accounts, and addresses. Passwords are often stored on people’s phones. And phones and apps are often full of personal details about their lives, from food diaries to logs of favorite places to personal photographs. Symantec conducted a study, where the company spread 50 “lost” phones in public to see what people who picked up the phones would do with them. The company found that 95 percent of those people tried to access the phone, and while nearly 90 percent tried to access private information stored on the phone or in other private accounts such as banking services and email, only 50 percent attempted contacting the owner.
- ...8 more annotations...
-
Vance attempts to downplay this serious risk by asserting that anyone can use the “Find My Phone” or Android Device Manager services that allow owners to delete the data on their phones if stolen. However, this does not stand up to scrutiny. These services are effective only when an owner realizes their phone is missing and can take swift action on another computer or device. This delay ensures some period of vulnerability. Encryption, on the other hand, protects everyone immediately and always. Additionally, Vance argues that it is safer to build backdoors into encrypted devices than it is to do so for encrypted communications in transit. It is true that there is a difference in the threats posed by the two types of encryption backdoors that are being debated. However, some manner of widespread vulnerability will inevitably result from a backdoor to encrypted devices. Indeed, the NSA and GCHQ reportedly hacked into a database to obtain cell phone SIM card encryption keys in order defeat the security protecting users’ communications and activities and to conduct surveillance. Clearly, the reality is that the threat of such a breach, whether from a hacker or a nation state actor, is very real. Even if companies go the extra mile and create a different means of access for every phone, such as a separate access key for each phone, significant vulnerabilities will be created. It would still be possible for a malicious actor to gain access to the database containing those keys, which would enable them to defeat the encryption on any smartphone they took possession of. Additionally, the cost of implementation and maintenance of such a complex system could be high.
-
Privacy is another concern that Vance dismisses too easily. Despite Vance’s arguments otherwise, building backdoors into device encryption undermines privacy. Our government does not impose a similar requirement in any other context. Police can enter homes with warrants, but there is no requirement that people record their conversations and interactions just in case they someday become useful in an investigation. The conversations that we once had through disposable letters and in-person conversations now happen over the Internet and on phones. Just because the medium has changed does not mean our right to privacy has.
-
In addition to his weak reasoning for why it would be feasible to create backdoors to encrypted devices without creating undue security risks or harming privacy, Vance makes several flawed policy-based arguments in favor of his proposal. He argues that criminals benefit from devices that are protected by strong encryption. That may be true, but strong encryption is also a critical tool used by billions of average people around the world every day to protect their transactions, communications, and private information. Lawyers, doctors, and journalists rely on encryption to protect their clients, patients, and sources. Government officials, from the President to the directors of the NSA and FBI, and members of Congress, depend on strong encryption for cybersecurity and data security. There are far more innocent Americans who benefit from strong encryption than there are criminals who exploit it. Encryption is also essential to our economy. Device manufacturers could suffer major economic losses if they are prohibited from competing with foreign manufacturers who offer more secure devices. Encryption also protects major companies from corporate and nation-state espionage. As more daily business activities are done on smartphones and other devices, they may now hold highly proprietary or sensitive information. Those devices could be targeted even more than they are now if all that has to be done to access that information is to steal an employee’s smartphone and exploit a vulnerability the manufacturer was required to create.
-
Vance also suggests that the US would be justified in creating such a requirement since other Western nations are contemplating requiring encryption backdoors as well. Regardless of whether other countries are debating similar proposals, we cannot afford a race to the bottom on cybersecurity. Heads of the intelligence community regularly warn that cybersecurity is the top threat to our national security. Strong encryption is our best defense against cyber threats, and following in the footsteps of other countries by weakening that critical tool would do incalculable harm. Furthermore, even if the US or other countries did implement such a proposal, criminals could gain access to devices with strong encryption through the black market. Thus, only innocent people would be negatively affected, and some of those innocent people might even become criminals simply by trying to protect their privacy by securing their data and devices. Finally, Vance argues that David Kaye, UN Special Rapporteur for Freedom of Expression and Opinion, supported the idea that court-ordered decryption doesn’t violate human rights, provided certain criteria are met, in his report on the topic. However, in the context of Vance’s proposal, this seems to conflate the concepts of court-ordered decryption and of government-mandated encryption backdoors. The Kaye report was unequivocal about the importance of encryption for free speech and human rights. The report concluded that:
-
States should promote strong encryption and anonymity. National laws should recognize that individuals are free to protect the privacy of their digital communications by using encryption technology and tools that allow anonymity online. … States should not restrict encryption and anonymity, which facilitate and often enable the rights to freedom of opinion and expression. Blanket prohibitions fail to be necessary and proportionate. States should avoid all measures that weaken the security that individuals may enjoy online, such as backdoors, weak encryption standards and key escrows. Additionally, the group of intelligence experts that was hand-picked by the President to issue a report and recommendations on surveillance and technology, concluded that: [R]egarding encryption, the U.S. Government should: (1) fully support and not undermine efforts to create encryption standards; (2) not in any way subvert, undermine, weaken, or make vulnerable generally available commercial software; and (3) increase the use of encryption and urge US companies to do so, in order to better protect data in transit, at rest, in the cloud, and in other storage.
-
The clear consensus among human rights experts and several high-ranking intelligence experts, including the former directors of the NSA, Office of the Director of National Intelligence, and DHS, is that mandating encryption backdoors is dangerous. Unaddressed Concerns: Preventing Encrypted Devices from Entering the US and the Slippery Slope In addition to the significant faults in Vance’s arguments in favor of his proposal, he fails to address the question of how such a restriction would be effectively implemented. There is no effective mechanism for preventing code from becoming available for download online, even if it is illegal. One critical issue the Vance proposal fails to address is how the government would prevent, or even identify, encrypted smartphones when individuals bring them into the United States. DHS would have to train customs agents to search the contents of every person’s phone in order to identify whether it is encrypted, and then confiscate the phones that are. Legal and policy considerations aside, this kind of policy is, at the very least, impractical. Preventing strong encryption from entering the US is not like preventing guns or drugs from entering the country — encrypted phones aren’t immediately obvious as is contraband. Millions of people use encrypted devices, and tens of millions more devices are shipped to and sold in the US each year.
-
Finally, there is a real concern that if Vance’s proposal were accepted, it would be the first step down a slippery slope. Right now, his proposal only calls for access to smartphones and devices running mobile operating systems. While this policy in and of itself would cover a number of commonplace devices, it may eventually be expanded to cover laptop and desktop computers, as well as communications in transit. The expansion of this kind of policy is even more worrisome when taking into account the speed at which technology evolves and becomes widely adopted. Ten years ago, the iPhone did not even exist. Who is to say what technology will be commonplace in 10 or 20 years that is not even around today. There is a very real question about how far law enforcement will go to gain access to information. Things that once seemed like merely science fiction, such as wearable technology and artificial intelligence that could be implanted in and work with the human nervous system, are now available. If and when there comes a time when our “smart phone” is not really a device at all, but is rather an implant, surely we would not grant law enforcement access to our minds.
-
Policymakers should dismiss Vance’s proposal to prohibit the use of strong encryption to protect our smartphones and devices in order to ensure law enforcement access. Undermining encryption, regardless of whether it is protecting data in transit or at rest, would take us down a dangerous and harmful path. Instead, law enforcement and the intelligence community should be working to alter their skills and tactics in a fast-evolving technological world so that they are not so dependent on information that will increasingly be protected by encryption.
‹ Previous
21 - 39 of 39