Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2016/05/more_on_the_goi.html
Lawfare is turning out to be the go-to blog for policy wonks about various government debates on cybersecurity. There are two good posts this week on the Going Dark debate.
The first is from those of us who wrote the “Keys Under Doormats” paper last year, criticizing the concept of backdoors and key escrow. We were responding to a half-baked proposal on how to give the government access without causing widespread insecurity, and we pointed out where almost of all of these sorts of proposals fall short:
1. Watch for systems that rely on a single powerful key or a small set of them.
2. Watch for systems using high-value keys over and over and still claiming not to increase risk.
3. Watch for the claim that the abstract algorithm alone is the measure of system security.
4. Watch for the assumption that scaling anything on the global Internet is easy.
5. Watch for the assumption that national borders are not a factor.
6. Watch for the assumption that human rights and the rule of law prevail throughout the world.
The second is by Susan Landau, and is a response to the ODNI’s response to the “Don’t Panic” report. Our original report said basically that the FBI wasn’t going dark and that surveillance information is everywhere. At a Senate hearing, Sen. Wyden requested that the Office of the Director of National Intelligence respond to the report. It did — not very well, honestly — and Landau responded to that response. She pointed out that there really wasn’t much disagreement: that the points it claimed to have issue with were actually points we made and agreed with.
In the end, the ODNI’s response to our report leaves me somewhat confused. The reality is that the only strong disagreement seems to be with an exaggerated view of one finding. It almost appears as if ODNI is using the Harvard report as an opportunity to say, “Widespread use of encryption will make our work life more difficult.” Of course it will. Widespread use of encryption will also help prevent some of the cybersecurity exploits and attacks we have been experiencing over the last decade. The ODNI letter ignored that issue.