The internet today sits at a crossroads. Data breaches and hacks occur everyday, stealing massive amounts of private information from American citizens. Engineers and researchers play whack-a-mole around the clock against exploits and malicious parties. For engineers, it is largely a role of damage control, as they lack the resources to continually test for bugs in their systems, and oftentimes are still cleaning up from the last zero-day attack when a new bug is revealed.
One strong weapon for fighting online criminals still exists, however: encryption. Even if thieves or other parties can manage to breach a company’s network and database infrastructure, they still lack the ability to decrypt strongly encrypted data. Encryption is the key to fighting the battle against data theft and digital espionage; to weaken it for any reason would devastate American companies’ ability to keep their users’ data protected appropriately.
What do we want? We want to be able to fend off criminals and put users in charge of their private information using the most secure means available. We want our customers to be able to trust us with their most private data. We want to be able to prevent data breaches like those at Home Depot, Sony, and the United States Office of Personnel Management—breaches where Americans lose control of their finances, their personal information, and their lives. And we want the government to allow us to continue doing that.
What does law enforcement want? Law enforcement has recently demanded that any company storing or transmitting encrypted data provide law enforcement authorities with the ability to decrypt that data for surveillance purposes.
Can we do this? There’s no doubt that any security vulnerability created for law enforcement will eventually become vulnerable to exploit by criminals, and that “when it comes to security, complexity is not your friend.” We also know that unfettered law enforcement access to encrypted data creates uncertainty for any company that uses cloud storage, chilling innovation and discouraging commerce in the United States.
We know that any demand made by the U.S. government to weaken encryption standards has the potential to create a jurisdictional Gordian knot and pave the way for future, more restrictive demands by less trustworthy governments around the world. And historically, we know that the government’s zeal for crime-fighting doesn’t always align with Americans’ needs for privacy, and that warrantless searches, mass data collection, and misuse of surveillance powers have been a problem faced by our nation.
So while we can theoretically create systems that give law enforcement access to encrypted data, we know that doing this will greatly impede the overall security of any system that does so.
Why does this matter? It is essential for the future of mobile apps and cloud computing that users have confidence that their data is secure and that, when necessary, keys for encrypted data are held by the user—and by that user alone. If we don’t have the ability to provide users with confidence in the security of their data on the web, then we lose them as customers.
Thus, weakened security puts American businesses at an insurmountable disadvantage in the international app market. Further, while FBI Director Comey claims American authorities will only access users’ data under “appropriate circumstances and appropriate oversight,” his pledge speaks nothing of despotic foreign governments’ demands for U.S. companies’ data—demands which might not comport with our own ideals about privacy and safety.
Why now? The Senate has held two hearings in the last week, and the White House has brought incredible pressure on companies to discourage strong encryption. This puts us behind the ball. In order to ensure the Internet remains a place of security and privacy for future generations, app companies must make our voices heard in defense of privacy, security, and digital civil rights.