Editor’s note: This commentary is by Stuart Graves, a retired physician who lives in South Burlington.
[T]he airwaves these days are full of sound bites about encryption. This perhaps is enough to raise awareness, but it is far from sufficient for reasoned thought and informed opinion.
Telecommunications are inherently interceptable, and today contain far more information than only a short while ago. Formerly one might have received an invitation to a meeting by phone or email. Today the entire meeting can take place electronically. If the information can always be intercepted by uninvited others (e.g. an “enemy”), then the remedy is to render it unintelligible – encrypt it.
Thus is born a tension between the steps individuals, organizations and governments take to maintain their privacy while simultaneously each hopes to know as much about the other as they can for their own protection or gain. Today the issue of terrorism is causing us to specifically consider the balance between individual and organizational privacy, and the government’s lawful ability to abridge that privacy.
There are three things one must keep in mind about encryption while trying to strike this balance between protection from terrorists and our personal freedoms: 1) our historical values and the evolution of our laws about privacy, 2) an appreciation of command and control problems, and 3) an understanding of the limits (imposed by the necessity of secrecy in a dangerous world) of the knowledge we as mere citizens can posses about these matters.
First: Historical Values
From the earliest European colonists of North America to today’s immigrants, most have and do come here to escape oppression. Consequently, our Founding Fathers were acutely aware of the need to protect citizens from the excesses of government, hence the nature of our constitution and the Bill of Rights (the first 10 amendments ratified by the states in 1791). Their hope through these laws was to keep the services and protections (e.g. laws, police, courts, military, etc.) afforded one by government from gradually slipping into the kinds of oppression they had experienced.
Of particular interest with respect to encryption is the Fourth Amendment: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures …” There has been an ongoing evolution of our understanding of the ways in which this phrase applies to our electronic conversations and electronic collections of personal data.
Anachronistically, but by analogy, we still refer to our intelligence agencies ability to collect and store terabytes of data per minute as wire-tapping. We can pick up the story of our laws about intercepting electronic messages back when “wire tapping” actually meant connecting one wire to another to overhear the conversations on one phone in one place.
In a 1928 case involving the prosecution of a bootlegger using transcripts of his wiretapped conversations obtained without a warrant, judge Louis Brandeis wrote a famous dissenting opinion to the Supreme Court’s 5-4 decision allowing the evidence. In part he argued, “The evil incident to invasion of the privacy of the telephone is far greater than that involved in tampering with the mails,” and in keeping with a principle at least as old as Hammurabi he went on to say, “if the government becomes a lawbreaker, it breeds contempt for law; it invites every man to become a law unto himself; it invites anarchy.” His view was later upheld in a 1967 7-1 decision, Katz v. United States, overruling the earlier court’s finding.
And so it has gone from then to now: a see-saw between unlawful and lawful collection of electronic data by our police and intelligence agencies, recently culminating in a citizen (Snowden) feeling it necessary to steal (as Judge Brandeis predicted) evidence from the NSA of its unlawful behavior. And this is to say nothing of the probable actions in the U.S. of foreign intelligence agencies, organized crime, and multi-national corporations. The overall impression one is left with is that though laws have a role to play, they are a relatively weak way to protect electronic information. Engineering is stronger.
Oppression is not consequent upon doing something wrong, it is consequent upon one or another of many, many personal attributes, a few of which are enumerated in our discrimination law: race, color, religion, sex, national origin, age, disability, or genetic information.
It has been well said that encryption is the lock and keys of the information age. Clearly one’s phone conversations, electronic transactions, and the contents of the memory on one’s various electronic devices are not private without it. I have many friends who are quick to say, “I’m doing nothing wrong. Why should I care if the NSA eavesdrops on me arguing with my son about what time he should be home?” Such statements are a testament to how remarkably free of oppression my friend’s lives have been. Oppression is not consequent upon doing something wrong, it is consequent upon one or another of many, many personal attributes, a few of which are enumerated in our discrimination law: race, color, religion, sex, national origin, age, disability, or genetic information. These attributes and more reside in our personal electronic data.
The founders of our nation clearly saw privacy (as basic as being left alone in one’s own home) as a hedge against any government’s tendency to slide from protection to oppression. Today encryption is as necessary to our privacy as the walls of our homes are.
Second: Command and Control
If you build it, they will come. If there is a way for somebody – other than ourselves – to put a key in the lock, and unlock the door to our electronic data, they will. All the other intelligence agencies of the earth will, large multi-national corporations will, and organized crime will. This is because it is not just a casual conversation with a friend across town, or our location that needs protecting. Every purchase we make online, every electronic transaction we have with a bank or other financial institution, every transaction with a “chip” credit card, every time we need to “authenticate” that it really is us doing something electronically, every SIM card in a cell phone – all involve encryption. And beyond the personal need for privacy is all the proprietary (private) information of companies and the military secrets of one’s country.
If a way to circumvent encryption is made, the issue becomes one of maintaining control over that mechanism. Domestic intelligence agencies and corporations might reluctantly be constrained to lawful use of it, but certainly foreign intelligence agencies, organized crime and multi-national corporations will not be. For example, in 2009 the surveillance systems Google and Microsoft had built into their networks (under force of law to enable a response to lawful warrants) were compromised by the Chinese government, who naturally enough were interested in which of their agents we had under surveillance. The fact that information about such a loss of control is public is remarkable. Given the imperatives of secrecy, it must be just the very top tip of the iceberg.
Third: Limits to a Citizen’s Knowledge
No intelligence agency in its right mind makes public what it can and cannot do. If an agency happens to have broken into an enemy’s line of communication and has procured useful information, that agency will be sure to create as good a cover story as it can about how they know something, before taking any action that reveals to the enemy what is known. They do not wish the enemy to know that their communication is no longer secure.
So what can it mean that immediately after the November attacks in Paris the former CIA deputy director, the CIA director, and the FBI director all made a point of getting on national news broadcasts to say they are thwarted by off-the-shelf encryption? Who knows! Are they building a cover story by confessing a purported lack of capacity to decrypt, and thereby hoping to instill a false sense of security in our enemies? If indeed the FBI and CIA lacked capacity to decrypt our enemy’s messages, wouldn’t they more likely announce they could?
The point is that as mere citizens we can’t know the truth of the situation, and therefore lack what we need to make an informed decision. At best we are in the dark, at worst we are another pawn being moved about through fear by those seeking to either protect or harm us.
Conclusion
So what are we to do? How do we strike the balance between our need for privacy – ensured by the walls of our homes or encryption, and our need to protect ourselves from terrorists? The Bill of Rights and privacy law seem to strike a useful balance for ordinary times, but if times aren’t ordinary, if the fear grows too great, we may lose or not accept that balance, opting to simply ignore the laws or re-write them. The use during World War II of individual census data – despite pre-war, and then once again post-war contravening law – to facilitate the identification and location of U.S. citizens of Japanese ethnicity in order to imprison them, is an example of this. Was that the right thing to do?
And if, as mere citizens, we can’t have all the facts, how are we to judge? It is an intractable problem in the face of which the only dependable, and useful thing I can think of is the vote. We must consider carefully the character and values of those running for office. A few attributes come to mind, but I am sure there are many more that might apply.
Somebody who values truth over personal advancement or advancement of the group they belong to. (I must tell you though that this behavior was not strongly selected for by our evolution. Most homo sapien’s beliefs about reality are dependent upon the group they were born into, and their identity with and loyalty to that group usually entails oppressing or trying to destroy any other group. Perhaps, though, wise voting might be considered an evolutionary pressure!)
Somebody who doesn’t deny real dangers yet doesn’t succumb to a contagion of fear that will inevitably move them from protection to oppression.
Somebody who holds “unarmed truth and unconditional love” dear.
We must be sure to act on our birthright by voting accordingly. Ultimately, it will be those we have voted into office who will decide how much of the haystack must be burned to find the needle.
