No One Should Have That Much Power
Monday, 29 April 2024
It’s a common spy thriller trope. There’s a special key that can unlock something critical – business records, bank vaults, government secrets, nuclear weapons, maybe all of the above, worldwide.
Our hero has to stop this key from falling into bad people’s hands, or recover it before it’s too late. Perhaps at one point they utter something like the title of this post. You walk out of the theatre two hours later entertained but wondering why someone would be silly enough to create such a powerful artefact.
In a surprising move, law enforcement officials are once again calling for such a thing to be created. Repeatedly.
These authorities and their proxies say that they must have access to encrypted communications to keep us safe. They have been doing so for years – at first bluntly, now in a more subtle way. Encryption backdoors aren’t politically viable, so they take pains to say that they don’t want them while at the same time asking for a level of access that cannot be achieved except through backdooring encryption.
If you create a way to recover messages sent through a service, that’s a backdoor. If you run some code that evaluates messages on the endpoints and flags them if they meet some criteria, that isn’t an improvement; it’s a backdoor that can be abused in myriad ways. Centralising access to encrypted content creates unavoidable systemic risks.
This means that any such mechanism has to be handled like weapons-grade plutonium: losing control is a disaster of epic (or even existential) proportions. The few national governments who have nuclear capability struggle greatly to manage that risk; why would we intentionally entrust something as powerful to every government in the world or potentially even every local police department? Or will it be just a privileged few governments that will have access?
The current crop of suggestions seem to concede that governments shouldn’t have direct access. Instead, they want services to backdoor themselves and act as gatekeepers to law enforcement. That’s not an improvement; it’s still centralized, and it makes these companies responsible for any misuse of the data that they have access to, requiring everyone on the planet to trust a few big tech companies with our private and most intimate conversations – hardly a direction that society wants to go in in 2024. ‘Trust me, I’m in charge’ is a poor model of governance or security.
These ‘solutions’ also ignore the reality that the ‘bad guys’ will just use other tools to communicate; information is information. That will leave law abiding people giving up their privacy and security for little societal gain.
Law enforcement has more power than ever before because of digital technology. They are able to collect, process, summarise and track much more efficiently and at much greater scale. Genuinely new insights and capabilities are possible. So, when they want access to encrypted data because things have ‘gone dark’, it’s reasonable to ask ‘as compared to what?’
No one should have that much power, because messaging and other encrypted services have become people’s memories, their casual hallway chats, their intimate whispers. Yes, there is longstanding legal precedent for searching someone’s papers and home, but the barriers to doing so are considerable – not just those imposed by law, but also physics. There are few such inherent limits on a key that can trivially enable access to what amounts to anyone’s mind or identify anyone who thinks about a particular topic. Law enforcement struggles to solve real and serious problems, but the power they’re asking for is too vast and too easily misused, and they are failing to appreciate how it would operate on a global Internet.
One of the assumptions built into these calls is that if the tech community would just nerd harder, a solution could be somehow magically found that preserved privacy and security while letting the ‘good guys’ have access. With all respect to the valuable work that law enforcement does to protect society, it’s equally as valid to ask them to just police harder.