It’s been a while since I waded in on one of these government-related privacy thingies, but a report this morning from the New York Times reveals yet another profound, and fundamental, misunderstanding of how technology and security function. The executive branch is currently crafting a legislative proposal to require Internet-based communications providers to support wiretap capabilities in their products.
I support law enforcement’s capability to perform lawful intercepts (with proper court orders), but requirements to alter these technologies to make interception easier will result in unintended consequences on both technical and international political levels.
According to the article, the proposal has three likely requirements:
- Communications services that encrypt messages must have a way to unscramble them.
- Foreign providers that do business inside the United States must establish a domestic office capable of performing intercepts.
- Developers of software that enables peer-to-peer communication must redesign their services to allow interception.
Here’s why those are all a bad ideas:
- To allow a communications service to decrypt messages, they will need an alternative decryption key (master key). This means that anyone with access to that key has access to the communications. No matter how well the system is architected, this provides a single point of security failure within organizations and companies that don’t have the best security track record to begin with. That’s not FUD – it’s hard technical reality.
- Requiring foreign providers to have interception offices in the US is more of a political than technical issue. Because once we require it, foreign companies will reciprocate and require the same for US providers. Want to create a new Internet communications startup? Better hope you get millions in funding before it becomes popular enough for people in other countries to use it. And that you never need to correspond with a foreigner whose government is interested in their actions.
- There are only 3 ways to enable interception in peer to peer systems: network mirroring, full redirection, or local mirroring with remote retrieval. Either you copy all communications to a central monitoring console (which either the provider or law enforcement could run), route all traffic through a central server, or log everything on the local system and provide law enforcement a means of retrieving it. Each option creates new opportunities for security failures, and is also likely to be detectable with some fairly basic techniques – thus creating the Internet equivalent of strange clicks on the phone lines, never mind killing the bad guys’ bandwidth caps.
Finally, the policymakers need to keep in mind that once these capabilities are required, they are available to any foreign governments – including all those pesky oppressive ones that don’t otherwise have the ability to compel US companies to change their products.
Certain law enforcement officials are positioning this as restoring their existing legal capability for intercept. But that statement isn’t completely correct – what they are seeking isn’t a restoration of the capability to intercept, but creation of easier methods of intercept through back doors hard-coded into every communications system deployed on the Internet in the US. (I’d call it One-Click Intercept, but I think Amazon has a patent on that.)
I don’t have a problem with law enforcement sniffing bad guys with a valid court order. But I have serious a problem with the fundamental security of my business tools being deliberately compromised to make their jobs easier.
The last quote in the article really makes the case:
“No one should be promising their customers that they will thumb their nose at a U.S. court order,” Ms. Caproni said. “They can promise strong encryption. They just need to figure out how they can provide us plain text.”
Yeah. That’ll work.
Reader interactions
7 Replies to “Proposed Internet Wiretapping Law Fundamentally Incompatible with Security”
People will not be able to joke anymore about any threat in the Internet because two seconds after the FBI may be knocking your door.
This should be filed as “Gov’t Pipe Dreams, The Second”. Didn’t they larn their lesson with Skipjack?
Re:- Well, they
Between this and reading about “dot-secure” over at TaoSecurity, I’m working myself up for more drinking tonight!
I think this is going to illustrate how bad a position you get put into by not doing these things from the start. It will be interesting to see how this plays out, not just from providers and how the hell you even begin to satisfy these requirements, but in the expanded exposure of lawful intercept. We’ve long had it on phones and no doubt VOIP is under such requirements, but those implementations are very hush-hush-don’t-get-the-world’s-ears-involved.
I wonder how this will impact IPv6 adoption.
Re:Isn
Isn’t there also the fact that even if PROVIDER based encryption is easily circumvented to comply with a court order, it’s trivial for the bad guys to layer their own encryption on top of any given medium using publicly available algorithms?
How do you deal with something as simple as an AES-256 encrypted ZIP file in an e-mail attachment?
There are so many more reasons why this is a bad idea, I can’t begin to name them all.
Few thoughts come into mind:
a) This is an example of “oh, the bad guys have upgraded to a better weapon (the use of publicly available strong encryption that does not allow back doors), so instead of learning how to deal with that weapon (and investing into intelligence work), let’s just outlaw it, and that will prevent the bad guys from using it”
b) And the single point of failure will be the access to those master passwords, which, may not even be modifiable, once compromised
c) on the more grand scale, one quote seems appropriate: “Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety” (Benjamin Franklin)