Archive for category: Cybersecurity

President Obama gave a pretty crummy answer on Apple vs FBI at South by Southwest yesterday (I’ve put the entire exchange below the line). The question was posed as one pitting “privacy” versus security, and with the exception of this passage, Obama accepted that frame.

What makes it even more complicated is the fact we also want really strong encryption, because part of us preventing terrorism, or preventing people from disrupting the financial system or our air traffic control system or a whole other set of systems that are increasingly digitalized is that hackers, state or non-state, can just get in there and mess them up.

Obama also bracketed two related issues: how our decisions will affect what happens in other countries, and how they’ll affect our economic vitality (which is ultimately a cornerstone to America’s hegemonic place in the world).

And so the question now becomes, we as a society — setting aside the specific case between the FBI and Apple, setting aside the commercial interests, concerns about what could the Chinese government do with this even if we trusted the U.S. government — setting aside all those questions, we’re going to have to make some decisions about how do we balance these respective risks.

Along the way he threw out some absurd examples, such as the security theater of TSA, or the claim that we need to break into smart phones for tax enforcement when we still haven’t shut down shell companies which are a bigger threat to tax enforcement, not to mention a tool used by big time criminals.

But underlying it all is an assumption, one shared by many of those taking the law enforcement side of this debate: that the police are the ones that keep us safe.

Don’t get me wrong, what cops do is critical to keeping us safe, and there have definitely been times in my life I’ve been grateful to them (even if the time I was most victimized by crime, the cops also engaged in egregious racial profiling that made me angry).

But the cops are not the only thing that keeps us safe in this country — and our country relies on cops far more than many other countries and far more than we probably should. We probably rely on cops, in part, because we don’t use armies to sustain domestic order, we have stark wealth differences (which are getting starker), and we also have used police to enforce racial caste in a way that few other countries expect their cops to do.

In addition to cops, however, we rely on other things to keep ourselves safe: common tools like door locks, operational security (after I got mugged I became far more aware of how and where I was walking at night), norms and civil society that serve as self-policing mechanisms, some alternative policing in privately owned public spaces. We do not ask cops to patrol inside our homes to keep burglars out (we do tolerate private guards, of a variety of types, patrolling commercial spaces, though they usually have far more limited authority), but rely instead primarily on other tools that work most of the time.

In meat space, I think the current state of affairs evolved over time (and again, is clearly a product of our economic and racial history); we’re actually in a period of reassessment whether we’ve gotten the balance correct. But as we debate how to keep law and order in “cyber” space, we seem to have forgotten that it takes more than police to keep us safe, even in meat space — and we certainly haven’t considered whether the same balance as we have settled on in meat space is appropriate in cyber space.

Meanwhile, the debate about law and order in cyber space takes place against the backdrop of national security in cyber space, with little clear differentiation between the two. It’s not an accident that those tasked primarily with national security are more supportive of real device encryption, partly for technical reasons, but partly because real device encryption negatively affects law enforcement far more than it negatively affects national security (and encryption definitely helps national security more than it hurts).

But one thing never happens in either of those worlds: accountability.

On the national security side, I have long noted that people like then Homeland Security Czar John Brennan or Director of National Security Keith Alexander never get held responsible when the US gets badly pawned. The Chinese were basically able to steal the better part of the F-35 program, yet we still don’t demand good cyber practices from defense contractors or question the approach the NSA used on cyber defense. A few people lost their job because of the OPM hack, but not the people who have a larger mandate for counterintelligence or cybersecurity. Indeed, the National Security Council apparently considers cyber a third category, in addition to public safety and national security.

As a result, whereas we assume (wrongly) that we should expect the NatSec establishment to prevent all terrorist attacks, no one thinks to hold our NatSec establishment responsible if China manages to steal databases of all our cleared personnel.

On the law enforcement side it’s not much better: most cities have large numbers of crimes that never get cleared, including some of the crimes (like murder) that Jim Comey now says we can only solve if law enforcement can get inside your smart phone. And those uncleared crimes go back well before the time of smart phones. So the cops say they won’t be able to solve crimes unless they can get inside your smart phone, but they’re not, at the same time, being held accountable for the crimes they’re not solving.

One thing is clear though: the OPM hack, not to mention the Target hack and the Sony hack and the Apple selfie hack, have made it clear that the government is not competent, by itself, to keep us safe in cyberspace. Even if it were true that we could or did rely exclusively on policing to keep us safe in meat space, the track record of “law enforcement” broadly defined may be even worse in cyber space. Or it may just be that the impact a few criminals can do is far more widespread (and also, far more likely to affect white victims).

One more thing: by merging Information Assurance Division with the rest of the NSA, the government recently made a decision to default to an even more offensive-minded posture on national security policing of the cyber world than it already had. I guess the idea is to aim for complete visibility in cyberspace and take out attackers that way. Maybe that’s what needs to happen, maybe it’s not. But the equivalent decision (even ignoring the privacy problems of OmniCISA) — expecting law enforcement to acquire total awareness of everything going on in cyber space — would be untenable in domestic cyber law enforcement.

I raise all this to point to a debate we’re not having: one about what the proper means to keep cyber space safe is.

The assumption from people like President Obama is that ultimately self-defense, of which real encryption is a key part, must cede to police transparency. Yet that assumption comes with zero indication that that police transparency will actually do much to keep cyber safe space.

I don’t pretend to know the answer to what the proper model of public safety is. But I’m cognizant that we’re assuming we know what it should be when in fact the evidence suggests that model is not keeping us safe.  Read more →