A group of the world’s leading experts on cryptology, coding and cybersecurity are sounding the alarm this week about the dangers of giving the FBI “back doors” into encryption products designed to ensure the privacy and security of user data online.
The cryptologists came together to release a report this week out of MIT’s Computer Science and Artificial Intelligence Laboratory warning such back doors “are likely to introduce unanticipated, hard to detect security flaws… other technical vulnerabilities,” and raise “difficult problems about how such an environment would be governed and how to ensure that such systems would respect human rights and the rule of law.”
“The report argues that such mechanisms ‘pose far more grave security risks, imperil innovation on which the world’s economies depend, and raise more thorny policy issues than we could have imagined when the Internet was in its infancy,'” the laboratory said of the report, titled “Keys Under Doormats: Mandating insecurity by requiring government access to all data and communications,” in a statement Tuesday.
Many of the report’s authors fought against similar government efforts to directly access encryption during the Internet’s aforementioned infancy 20 years ago, when the National Intelligence Agency and the Clinton administration tried to introduce technologies and policies allowing the government to unlock encryption and limit its strength and availability overseas.
RELATED: The Battle Over Encryption Started in the ’90s — Are We Doomed to Repeat it?
The report recounts one such case in 1993 when the Clinton White House promoted “key escrow” solutions to access encryption, including a microchip known as a “Clipper Chip” developed by the National Security Agency for use by telecommunications companies to encrypt voice data in their phone products. The chip essentially acted as a master key for accessing encryption, and was held by the government or a third party.
Civil liberties groups and industry experts, including authors of the report, argued against the proposal over the lack of available technology to effectively implement it, as well as the high risk and cost. Though the Clipper Chip was abandoned, the technology was imposed on regulated telecommunications systems, where weaknesses were discovered and exploited by state actors.
“Those problems would have been worse had key escrow been widely deployed,” the report states. “And if all information applications had had to be designed and certified for exceptional access, it is doubtful that companies like Facebook and Twitter would even exist.”
The debate started anew last September after Apple and Google announced the implementation of default end-to-end encryption for all user data — a move federal and state law enforcement agencies led by FBI Director James Comey argued would make it exceptionally more difficult to surveil and apprehend criminals.
Comey’s agency made similar warnings 20 years ago, the report recounts, none of which came to fruition.
“Indeed, in 1992, the FBI’s Advanced Telephony Unit warned that within three years Title III wiretaps would be useless: no more than 40 percent would be intelligible and that in the worst case all might be rendered useless,” the report states. “The world did not ‘go dark.’ On the contrary, law enforcement has much better and more effective surveillance capabilities now than it did then.”
Tuesday’s report was timed to coincide with a round of hearings in the Senate Wednesday, where Comey will testify on “Counterterrorism, Counterintelligence and the Challenges of ‘Going Dark.'”
According to the FBI director, “law hasn’t kept pace with technology, and this disconnect has created a significant public safety problem.”
“We call it ‘Going Dark,’ and what it means is this: Those charged with protecting our people aren’t always able to access the evidence we need to prosecute crime and prevent terrorism even with lawful authority,” Comey said in October. “We have the legal authority to intercept and access communications and information pursuant to court order, but we often lack the technical ability to do so.”
Comey will provide similar testimony to the Senate Intelligence and Judiciary Committees Wednesday, despite months of warnings like those cited in the report over the damage guaranteed access to encryption could have on security, privacy and economic competitiveness.
“In the wake of the growing economic and social cost of the fundamental insecurity of today’s Internet environment, any proposals that alter the security dynamics online should be approached with caution,” the report says.
According to the authors, there’s no way to implement guaranteed access without leaving an inherent vulnerability in encryption, as the technology itself is based on instantly deleting keys after their use, rather than preserving a single all-access key — what experts call a “single point of failure.”
“It would be the equivalent of taking already-read, highly sensitive messages, and, rather than putting them through a shredder, leaving them in the file cabinet of an unlocked office,” Daniel Weitzner, head of MIT’s Cybersecurity and Internet Policy Research Initiative, said in the Tuesday statement. “Keeping keys around makes them more susceptible to compromise.”
According to Weitzner and others, such “exceptional access” systems like those proposed by Comey and NSA Director Michael Rogers also add to the complexity of encryption software, making it more likely a flaw will accidentally be implemented and go undetected.
“Given that the new mechanisms may have to be used in secret by law enforcement, it would also be difficult, and perhaps illegal, for programmers to even test how these features operate,” Weitzner said.
“At a time when we are struggling to make the Internet more secure, these proposals would take a step backward by building weakness into our infrastructure. It’s like leaving your house keys under the doormat: Sure, it may be convenient, but it creates the opportunity for anyone to walk in the door.”
