Tomorrow I’ll be at Parliament giving evidence to the Home Affairs Committee, who are considering a request from the police to be able to hold terrorism suspects for ninety days without charge, so as to be able to examine seized computers properly. My written evidence to them is here.
The police are short of forensic capability, sure; and that’s going to get worse until they get their act together. But they’re also short of interpreters. I don’t think they’d dream of asking for increased detention powers just because not enough coppers speak Somali. Parliament would just tell them to hire interpreters from commercial agencies. Why do people get away with such poor policy arguments when computers are involved?
Ouch! A very good question. I hope your testimony helped enlighten Parliament.
I ended up here after following a BBC story headlined “The UK is in talks with Microsoft over fears encryption will stop police opening suspects’ computer files” and wanting to refresh my memory with the TPM FAQ.
http://news.bbc.co.uk/go/rss/-/1/hi/uk_politics/4713018.stm
Why do people use such weak arguments? Because understanding of all but the most superficial aspects of computing is sadly lacking throughout society. I seem to remember hearing hte Home Secretary defending 90 days on the grounds that the police need longer to crack the cryptography used by terrorists. (No comment from me on that one.)
Ross, I’m a bit confused – is the BBC article at all accurate in reporting your comments?
Surely adding a backdoor to encryption is an incredibly dangerous development for everyone using the system. What happens if the backdoor keys leak or they end up in the hands of an unfriendly government? Everyone’s computer is then potentially put at risk – the liability against the implementors of the scheme would be astronomical.
Is there any chance of giving us a bit more detail into your proposals for backdoors?
Yes, I’m curious about this as well. It’s not every day that a security expert calls for a backdoor!
However, I see from your webpage that you are no fan of “trusted” computing. Is that, perhaps, why you are calling for a back door in Vista? So that Vista users will be able to circumvent the restrictions enforced on them by TCPA, by obtaining their own private key?
I’m in favour of court-mandated shortcuts past rights-management systems, on competition-policy grounds. In our APIG submission I wrote ‘In cases of abuse, judges must be able to order rights-management mechanisms unlocked’.
I don’t see the Vista security mechanisms as being security for me, but as security for them. It’s just not the same as the key escrow debates of the 1990s – in which I opposed key escrow on principle. The technology’s being used for different things here.
If you want privacy, use PGP – or better still, some low-observable communication technology, such as throwaway prepaid mobile phones or webmail accounts
Ross
Ah thanks for that Ross – the BBC is wrong in calling it a true backdoor. That’s a little more reassuring! And thanks for the link to your article.
Do you think it is feasible that such legislation could ever be effective?
Since most software companies are trans-national organisations their lawyers could run rings around purely domestic legislation. If a court in the UK asked a foreign company to release its keys, the company could easily say that was a matter for relevant jurisdiction of the country in which the company was incorporated.
And we get into a real nest of vipers if such policies were implemented in one country – everyone else would soon follow.
Google and Yahoo! have got into serious trouble when dealing with the Chinese authorities. Could any company really stand up to a government (no matter how unpleasant) who demanded access to keys in order to fight ‘terror’ (and we all know how widely that word is used nowadays)?
But conversely, the first company that released keys on demand would be vilified by their customers.
It seems that software and hardware companies would be put in an impossible position. Refuse and end up in jail, acquiesce and watch your shares go down the toilet. Certainly I wouldn’t like to be on the board of any such company when the first warrant from the Home Office arrived.
See Remote Attestation” and content access monopolies.
Introducing backdoors into the security will eventually exacerbate the problem for both the end users and the authorities.
Even private/public key escrow systems, that have to rely on an unchanging static key, would quickly become a target for cracking. For the same reason we advise people to change passwords on a regular basis, it is also advisable to re-encrypt private data using new key pairs and perhaps switch to updated encryption systems as well. It is a fact that encryption and hash algorithms become weaker over time relative to the power of new processors and mathematical advances. Legislation mandating fixed algorithms to enable backdoor access will eventually be exploited by abused by third parties wanting to abuse you.