Encryption Debate: Do We Really Need a Backdoor? – Cyfy 2017/10/3

If the states truly believe that more pervasive surveillance is necessary to respond to the rising terrorism, they should not be asking for backdoors or decryption keys.  There is a less overbroad technique that can be pointed towards likely criminals, instead of indiscriminating exposing all people at the risk of being eavesdropped.  That is legal hacking.  Make no mistake about it.  In 2015, my organization Open Net Korea has responded to the Italian Hacking Team scandal by developing and distributing an app designed to detect the Hacking Team’s Remote Control Software (RCS) and advocated for a law restricting the use of hacking-type surveillance.  The app was downloaded 50K times in Korea. Although we could not identify a single instance of Korea’s outbound intel agency NIS’s use of RCS on domestic persons, it did raise awareness of the risks of hacking-type surveillance.  However, legal hacking I believe is a much more preferred to the key escrow or “backdoor” that some state agencies in Europe and US advocated for.

What people don’t understand about encryption is its aspect of free speech.  What is encryption?  Stating something in secret language that is known only to a closed group of people.  With my Nth girlfriend, I used to use these code words like eating cookies or having cakes.  (I cannot tell you what those codes mean).  But, that was also encryption.  So encryption is saying something in language opaque to third parties, and it is nonetheless saying something.  It is an expression.  It should be protected under freedom of expression.  Such speaking should not be subject to a unreasonable requirement.  If I speak to my colleague in Korean language sitting over there, I will be encrypting to the rest of you.  So, this backdoor requirement that whenever you encrypt, you must leave a backdoor open is restriction on freedom of speech.  It is like a mandate that I cannot speak Korean unless I give law enforcement a Korean language text book.  In that sense, it is tantamount to prior censorship because, although right to speak is not conditioned on preapproval of content, it is conditioned on pre-submission to some authorities of the tools for them to decrypt the contents.  Millions or billions of people may use one app or one device.  Entrusting decryption keys for a single app or a single device can mean depriving the millions and the billions of a choice to communicate securely and forcing them to live under the fear of surveillance no matter what. There is a cost in encrypted communication in terms of network resources, learning curve, inconvenience, etc.  People should be allowed to choose to communicate in encryption entirely free from eavesdropping at that cost just as people should be allowed to choose to talk to each other in sound-proof rooms.

Another option more circumscribed than key escrow or EX ANTE submission of “backdoor” that we can consider is requiring the decryption key EX POST, i.e., only for likely criminals.  The case in point: Apple v FBI.  However, asking Apple to write a single-device iOS is different from asking a safe company to make a new key for an old long forgotten safe. Coding is not a physical act but an intellectual act. It is like painting, writing, sculpting, orating, etc. Coding is creative activity, more involved than simply giving information. If Picasso cannot be forced to paint for General Franco, Apple cannot be forced to code for DOJ. No matter how overriding the public interest is, coding or invention cannot be compelled. Coders have absolute ethical rights to refuse to write software. Also, software is like DNA. Once written, it can leave the lab and be duplicated in which case many users of the same device or the same app will suffer from increased risk of surveillance. We should not try to take away the choice of everybody just to track down a minority of terrorists. So, this option also suffers from overbroadness.

Compared to the backdoor ex ante or ex post, legal hacking can be controlled and there are already some norms available.  In 2008, the German Constitutional Court struck down constitutionality of the use of “Federal Trojan Horse” for the purpose of terrorism investigation, citing a basic right to “the secrecy and integrity of one’s information technology system” and demanding that such hacking-type surveillance to meet a higher requirement than wiretapping.  Also, in 2013, a US district court in Texas refused to issue a ‘phishing attack’ warrant on an overseas IP address, reasoning that planting malware overseas requires some sort of activity AT OVERSEAS LOCUS outside the reach of a warrant.  Overseas warrant is possible only through FISA process.  These two cases set a substantive limit and a jurisdictional limit on hacking-type surveillance.

Again, I am not encouraging hacking-type surveillance.  Open Rights Group and Privacy International has identified the risks of surveillance by infecting communication devices with malware.  They identified the usual risks of hacking surveillance, namely that (1) A device once hacked can be accessed by other people; (2) because of (1), evidence collected through hacking suffers from reliability issues; (3) hacking can destroy other data in the process again raising evidentiary reliability issues; (4) malware used in hacking can be forwarded out of control to many people; and (5) it incentivizes state agencies to build silos of “zero days” which in turn incentivizes hackers to seek those zero days for sale to the state agencies.  Even if hacking-type surveillance is a necessary evil, backdoor/key escrow is not the way to go.