TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

Privacy Tech | Why Director Comey Can't Have His Cake and Eat It Too Related reading: 21.5 Million Breached In Second OPM Hack; Director Resigns

rss_feed

""

PrivacyTraining_ad300x250.Promo1-01

It was hard not to notice this week the cognitive dissonance by some in the federal government, and I can’t let it go without pointing it out.

We have a technology problem.

No, it’s not that we don’t have great technology or technologists. We do. It’s that many policymakers don’t understand technology or the technologists. And that’s a big deal.

Here’s what I mean:

On one side, we saw the Office of Personnel Management (OPM) announce that 21.5 million individuals had some of the most sensitive personal information imaginable hacked. This data, which includes in some cases financial and mental history, Social Security numbers and the like, is tremendously valuable for adversaries—particularly if they’re a nation-state looking to exploit government workers, informants, military personnel and so on.

We also learned in the last few weeks that much of the OPM's stored data was not encrypted and that access to much of it did not require even something as simple as two-factor authentication (something most users of Gmail should already employ).

Here’s what FBI Director James Comey had to say about this second OPM hack: “If you have my SF-86, you know every place I’ve lived since I was 18, contact people at those addresses, neighbors at those addresses, all of my family, every place I’ve traveled outside the United States since I was 18. If I had substantial contact with any non-United States person, it’s on there, along with the contact information of that person. Just imagine you were a foreign intelligence service and you had that data, how it might be useful to you. So it’s a big deal.”

I couldn’t agree more with Director Comey. It. Is. A. Big. Deal.

So why, then, are Director Comey and others in law enforcement asking for backdoors into encrypted communication technology?

Hint: Here's the "policymakers don't understand technology or the technologists" part.

Comey, along with Deputy Attorney General Sally Yates and New York County District Attorney Cyrus Vance, the day before making the above comments, argued in front of the Senate Judiciary Committee that U.S. technology companies need to find a solution to the encryption problem by creating encryption that can both prevent access by adversaries but also allow access by law enforcement authorities. 

Comey was blunt on several topics that day. Yes, he said, strong encryption is a good thing. And no, he admitted, “I don’t come here with a solution.” Rather, he said, Silicon Valley, with all the best and the brightest coders and technologists, can find a solution.

But here’s the problem. He’s either not listening to the technologists—like the 13 leading cryptographers who released a report on how bad backdoors are to all Internet security—or truly believes there’s a way to have your digital security cake and eat it too.

To be fair, the FBI and law enforcement agencies see terrible crimes everyday. I am grateful for their service and protection, but for policymaking, we need to get past this cognitive dissonance, get a better handle on technology literacy and come up with ideas based on that better understanding.

Yes, I’m sure encrypted iPhones make it more difficult for law enforcement to solve crimes and convict criminals. But every day we hear of another high-profile breach (OPM! Anthem!). Clearly, what we're doing isn't enough. We need to do more. This is not done by weakening the few tools we do have to help prevent intrusions from whomever would look to do us harm. 

Heck, even the Hacking Team, supposed security and surveillance professionals, are doing things like using "password" for their password. (Yes, the CEO did that. And now they've lost their source code.)

We have to exercise collective data hygiene. Use strong passwords, employ two-factor authentication and yes!, encrypt our data. And that means the most basic communications data.

As Prof. Peter Swire rightly pointed out on Wednesday during that same Senate Judiciary hearing, we’re in the “Golden Age of Surveillance,” not the Dark Age of Surveillance, and law enforcement has countless other ways to track and convict criminals. The amount of metadata we all give off on a normal day is astounding.

We’re living in a different era, one in which a computer glitch can shut down the New York Stock Exchange, United Airlines and the Wall Street Journal all in the same morning.

And with that, we need to start thinking differently. Government needs to hire more technologists and officials like Director Comey have to realize they can’t have their cake and eat it too.

1 Comment

If you want to comment on this post, you need to login.

  • comment Steve • Jul 13, 2015
    Sadly no one in Gov't or Congress seems to understand that encrypting databases will not stop this type of attack nor will it make the data any safer.  I keep hearing "security 101"  but these fools do not understand what they are talking about.