The week before last, tragic events unfolded in London. It seems that a man drove a car at nearly 70 mph into pedestrians on Westminster Bridge before stabbing a policeman on duty at the entry to the Parliamentary Estate. 5 people died, including the attacker.
Not long after the event, Amber Rudd, the Home Secretary said this:
It is completely unacceptable, there should be no place for terrorists to hide.
We need to make sure that organisations like WhatsApp, and there are plenty of others like that, don't provide a secret place for terrorists to communicate with each other.
It used to be that people would steam open envelopes or just listen in on phones when they wanted to find out what people were doing, legally, through warrantry.
But on this situation we need to make sure that our intelligence services have the ability to get into situations like encrypted WhatsApp.
Code Breaking in the Past
The battle to intercept enemy communications is as old as warfare itself. Encryption played a vital part in World War II. The code-breaking efforts at Bletchley Park are well known. I highly recommend the story of British Cryptography, told from within "SOE" by Leo Marks: Between Silk and Cyanide. It's a humorous, well-written account of the blend of bumbling amateur ineptitude and utter genius that was British code-making and code-breaking. Marks worked out that our entire covert operation in Holland was blown and under German command, but none of his superiors in London would believe him. … But I digress.
In the past, we had to try to break enemy cryptography.
Code Breaking in the Present
Now, the battles we face are not along national political lines, so sometimes the people who encrypt their communication are people in our own nation. Developments in computing have also made for very robust encryption, that can be made watertight to all intents and purposes. This means that Western governments are turning to two approaches.
1. Get technology companies to build a “back door” in their encryption software. When you buy a suitcase, the chances are it has a lock that can be opened both by the key the manufacturer gives you, and by another master key that would be held by security staff at airports. Mobile phone software developers should incorporate something like this, maybe retaining their own master key, maybe giving the government a master key, so that communication can be decrypted if necessary.
2. Outlaw all other forms of encryption. Simply put, other than using one of these encryption solutions that can be eavesdropped, you may not use encryption. If someone does, they can be prosecuted for using unauthorized cryptography. This would be justified on the basis that they must have something to hide.
The problem is, apps like WhatsApp won't play ball. They use end-to-end encryption, which means that nobody other than you and the person you communicate with can decrypt the messages.
Why Encryption is a Good Thing
Encryption is a very good thing indeed. Nobody in their right mind would suggest that online banking should be done en clair. The arguments above for requiring back doors are not new, so the replies are not either, but it's worth rehearsing why such back doors are a very bad idea.
Reason 1: Bad Governments
It must not be assumed that all government is good.
This is so internationally. If you wish to exonerate the British government of any involvement in inappropriate warfare, torture, or corruption, the same is not true of every government in the world. Once you grant that one government has a right to access encrypted communication, it would be arbitrary for a company like Apple, Microsoft, Google or Whatsapp to decide that another government may not enjoy the same access.
Yet, if you live under an oppressive regime, these very encrypted communications are what you use to go about your business. Citizens of such countries need to be able to communicate without detection in order to carry out some aspects of their daily business. Encryption can literally be life-saving.
Even within Britain, few would have a totally white view of our own government. Crucially, there's no guarantee that the government's integrity will always be preserved. They may press for powers today, only for a future government to abuse those powers in ways unforeseen by any of us at present.
A Christian doctrine of the fall means that we do not trust that governments are always be good, or will always be good. Law-making that takes this into account needs to find the balance between giving governments their right and proper powers as God's agents to punish wrong and reward good, and not allowing them to have unchecked powers that are open to abuse.
Encrypted communication plays an important part in all of that.
Reason 2: Criminal Activity
Once you have encryption with a back door, there is a back door. That may sound tautologous, but it is actually an important point: The encryption now has a weak-point.
Now, in theory, you keep an inventory of everyone who has that spare key.
In practice, once you have more than one key in circulation, you can never know who else has had one cut. The technology that allows a government to intercept certain communication, with a warrant, could be sold on the black market to those with criminal intent.
Or discovered: Sometimes, these back doors rely on not using every possible security best practice. Vulnerabilities are intentionally left in the code so that a hacker who knows this can use the key under the mat. The trouble is, security researches discover vulnerabilities in code all the time, and they're usually promptly fixed before being announced. But what if someone discovers a vulnerability that's been intentionally baked into the code? Who knows, at that point, who might make use of it.
So, suddenly, everything we do becomes less secure. Even tasks like online banking are less safe because we've opted for something less than full end-to-end encryption.
Reason 3: Fighting the Government
But now let's take a special case of this.
There are many criminal activities that could exploit our less secure encryption. One category are the very kinds of criminals that Rudd and others are thinking of when they press for these powers.
The police and other agencies need to communicate with each other. They need to share operational information on individual arrests. They need to share intelligence databases on networks and individuals they're monitoring. Much of the "war on terror" hangs on state security services being able to store and pass information securely.
But if they create deliberate loop-holes in that security system, they've just holed their own boat. There's nothing to say that the “terrorists” and others they're fighting won't get hold of some of these back-door keys.
It's worse than that: Deliberate and well-planned criminals will find ways to circumvent the back-doors in commercial or open-source software, and will find ways to use their own encryption that is technically illegal (but probably not detected until after the fact). Meanwhile, law-enforcement agencies will use the technologies that are inherently less secure. Our ability to fight such criminals is weakened, while their ability to operate is hardly weakened.
Don't Throw out the Baby
In summary, encrypted communication is a vital piece of technology in today's world. The fact that it cannot be government-controlled may make government agencies feel powerless at times. But the alternative is actually a less safe world for everyone, not a safer one.
Add new comment