I finally finished reading the report about giving the government access to communications [1]. It parallels an earlier report [2] discussing the same thing, but the revelations of Snowdon and he F.B.I. director’s reaction warranted a reiteration, and a stronger one. It is an excellent report, one I encourage everyone to read.
I have a suggestion for strengthening the report, and a comment about the government’s reaction to it.
First, the suggestion. The report makes the point that Sir Arthur Conan Doyle made so many years ago (“What one man can invent another can discover” [3]), but much more prosaically. It says that attackers who want to compromise the communication will find and exploit the backdoor added at government insistence. This is quite correct, and a strong argument against adding such backdoors.
But let’s take it a step further. Suppose an attacker has begun reading messages between two medical institutions (for example). She realizes that the F.B.I. will undoubtedly be interested in what she is doing, and wants to find out how much they know. As the law requires all communications equipment to have backdoors built in, and she has found the backdoor (in order to monitor the electronic medical records in the messages going between the two medical institutions). She exploits that knowledge and monitors the F.B.I.’s communications. She finds out she is indeed being tracked, and now can see how far the F.B.I. has gone in discovering what she is doing and who she is.
Lest this seem fanciful, it has happened. In “The Athens Affair” [4], Prevelakis and Spinellis write “the hackers broke into a telephone network and subverted its built-in wiretapping features for their own purposes.” The lawful (under Greek law) wiretapping capability enabled the attackers to tap the cell phones of the Greek prime minister, the defense and foreign affairs ministers, and — note this — law enforcement officials.
The obvious solution is to give government agencies communications equipment that does not have backdoors while requiring everyone else to use equipment with backdoors. But this raises two immediate problems.
First, if such equipment is manufactured, it will become available to others not authorized to have it — through pilferage if nothing else, or from equipment made abroad. Foreign manufacturers are highly unlikely to go along with the backdoor requirement — and if they do, how does the U.S. government know that only they can use the backdoor? Much of our software and hardware is manufactured abroad, using components manufactured in places like China. What is to stop a foreign government from requiring the vendor to add a backdoor to the backdoor to allow them in? This is called the supply chain problem, and is essentially a type of the insider problem, one of the most difficult problems in computer and information security.
Second, if it is possible to make exceptions, various people and organizations will lobby for those exemptions. As an example, an obvious exception would be for the U.S. financial industry (banks, brokerage houses, the Federal Reserve, and so forth), which would be reluctant to use equipment with backdoors built in, as confidentiality and integrity are absolutely critical to their clients trusting them. Once exceptions are made, the number of exceptions will grow, as will the groups to whom those exceptions are applied. And the folks the government will want to monitor most will be the ones most likely to use those organizations granted exceptions. Terrorists, for example, will move money around the financial system.
So by adding backdoors, the government renders itself as vulnerable as everyone else, thus defeating its purpose. Angela Rojas’ comment seems appropriate, as it summarizes the dilemma very succinctly: “But, darling, the spies were spying on the spies who were spying on the spies!”
The report should have made this point explicitly.
My comment about the government’s reaction to the report refers to Mr. Comey’s testimony that technologists are smart enough to find a way to put in a backdoor that only law enforcement can use:
Technical people will say it’s too hard. My reaction to that is: Really? Too hard? Too hard for the people we have in this country to figure something out? I’m not that pessimistic. [5,6]
But Mr. Comey is not a technologist, so how would he know? In fact, there are some problems that can be proved unsolvable. Perhaps the question he should be asking is whether our law enforcement agents are smart enough to be able to solve crimes without these backdoors. Certainly they have done so in the past. Mr. Comey’s comment bothers me, because as a top U.S. government official, he should have more faith in U.S. security agencies and law enforcement personnel — and if he does not, his focus should be on strengthening those agencies, and hiring and training people, rather than weakening everything else.
Note: I am one of the signers of the letter [7] that Mr. Comey refers to in his speech on cybersecurity to the Third Annual Cybersecurity Law Institute, from which the above quote comes.
References
- H. Abelson, R. Anderson, S. Bellovin, J. Benaloh, M. Blaze, W. Diffie, J. Gilmore, M. Green, S. Landau, P. Neumann, R. Rivest, J Schiller, B. Schneier, M. Specter, and D. Weitzner, “Keys Under Doormats: Mandating Insecurity by Requiring Government Access to All Data and Communications,” Technical Report MIT-CSAIL-TR-2015-026, Massachusetts Institute of Technology, Cambridge, MA, USA (July 2015). url: http://hdl.handle.net/1721.1/97690
- B. Adida, C. Anderson, A. Antón, M. Blaze, R. Dingledine, E. Felten, M. Green, J. Halderman, D. Jefferson, C. Jennings, S. Landau, N. Mitter, P. Neumann, E. Rescorla, F. Schneider, B. Schneier, H. Shacham, M. Sherr, D. Wagner, and P. Zimmermann, CALEA II: Risks of Wiretap Modifications to Endpoints, Center for Democracy and Technology (May 2013). url: https://www.cdt.org/files/pdfs/CALEAII-techreport.pdf
- Sir Arthur Conan Doyle, “The Adventure of the Dancing Men,” The Return of Sherlock Holmes, Dover Publications, Mineola, NY, USA (2010). isbn: 978-0486478739
- V. Prevelakis and D. Spinellis, “The Athens Affair,” IEEE Spectrum 44(6) pp. 26–33 (July 2007). doi: 10.1109/MSPEC.2007.376605
- J. Comey, Comments at the Third Annual Cybersecurity Law Institute, Georgetown University Law Center, Washington DC, USA (May 2015). url: https://www.justsecurity.org/23120/transcript-comey-authors-encryption-letter-uninformed-fair-minded/
- J. Comey, “FBI Director James Comey Cybersecurity Challenges,” video of [5] (quoted comment at 18:03–18:13). url: http://www.c-span.org/video/?326168-1/fbi-director-james-comey-cybersecurity-challenges
- Letter to President Obama (May 19, 2015). url: https://static.newamerica.org/attachments/3138--113/Encryption_Letter_to_Obama_final_051915.pdf
