The crypto wars have been raging for decades now. The heated discussion has reached a new height after the publication of the EU Council's resolution on encryption "Security through encryption and security despite encryption".
While the resolution does not explicitly mention that the aim is to weaken encryption, experts perceive it as part of an international strategy to undermine encryption in general for the end user. This has led to massive protests from civil society .
The problem in this discussion is that no one seems to actually communicate. On one side, there are governments and law enforcement agencies that argue that they need encryption backdoors to prevent crimes. On the other side, there are tech companies and security experts that argue that a backdoor for the 'good guys' only is technically impossible.
Each has their own viewpoint and is not willing to give in one single step.
So Alice and Bob will try to discuss the question of whether we should be able to encrypt our online communication by exchanging arguments.
Alice: End-to-end encryption is the most secure form of encryption. It protects us from any kind of prying eyes, from government espionage to malicious attacks by hackers as well as from rogue employees working at tech companies.
Bob: Agreed, encryption protects the data of all citizens. But what about criminals, terrorists, child molesters? We must be able to decrypt the communication in a targeted way. The service provider must have a second key that it can use to decrypt the content of suspected criminals. This way we can make sure that the data of law-abiding citizens is well protected while we can still access the data of criminals and prevent crime.
Alice: Hm, what you are asking for sounds compelling. So you want an encryption backdoor for the good guys to only target the bad guys?
Bob: Yes, if tech companies were able to decrypt end-to-end encrypted data with a second key, they could hand out data of suspected criminals upon government requests!
Alice: This means employees of the tech companies decrypt the required data with this backdoor key and hand it out to the officials. In theory this sounds very good. Unfortunately, it misses the fact that not every employee can be trusted. I'm just thinking about the recent Bellingcat investigation on the FSB. It says there: "The humans who manually fetch this data are often low-level employees at banks, telephone companies, and police departments." These people take private data of users and hand it out for money. In other words: The journalists of Bellingcat were able to get highly sensitive information on Russian secret service agents just by paying money for the data. That's the problem with backdoors. It's easy to exploit them.
Bob: Then we have to make it harder! If only the government is allowed to request such data, and everything else is illegal? So the example you just gave is illegal and such employees/companies could be punished by law if they fail to protect users' data?
Alice: Yes, but no matter how hard it is if the option is there, abuse will happen. Two spontaneous risks pop into my mind, potentially there are more: First, the data could be so valuable, for instance business secrets, that others will pay huge amounts of money for this. Would the laws then be able to stop every employee from abusing a backdoor? And, second, I suppose in your scenario, governments are the 'good guys'?
Bob: Yes, that's how it's supposed to be. If you can't trust your own government who else can you trust?
Alice: That's what is up for debate here. Democracies have been built with keeping one major threat in mind: that the government might turn bad. That's why we have checks and balances, the guarantee of a free press and constitutional rights such as freedom of speech and the right to privacy. For that matter, even German judges oppose encryption backdoors .
Bob: But the right to privacy does not equal the right to encryption!
Alice: On the other hand, what is encryption? It's like a secret language that no one listening in on the conversation can understand. If we outlaw encryption online, couldn't criminals still make up their own secret language?
Bob: Yes, that's true. But at least law enforcement would then be able to ask for the data and see what they can do with it.
Alice: Isn't that already the case with encrypted data?
Alice and Bob could continue this conversation forever because they are going in circles. The problem - and that is what politicians like to keep out of the discussion completely - is that encryption can not be outlawed.
The above conversation tries to argue the pros and cons of backdooring encryption. However, any pro must be rejected if you keep the fact in mind that encryption as such - the technology to encrypt data end-to-end - cannot be stopped. So any attempt by governments to weaken encryption in certain services will never achieve what is supposed to be achieved: to stop criminals from using encryption.
The inconvenient truth is that weakening encryption will only weaken it for law-abiding citizens, not for criminals. Instead of asking for encryption backdoors and enabling general mass surveillance, politicians and law enforcement agencies should focus on other investigation techniques.
It's like the famous quote by Phil Zimmermann: "If privacy is outlawed, only outlaws will have privacy."
Even if you weaken encryption in certain online service, criminals can still make up their own secret language or develop their own encrypted apps that are not circulated via standard Play Stores. Criminals could even use Thunderbird's built-in email encryption.
In the crypto war discussion, we often hear the request to implement backdoors for the 'good guys only'. However, such a backdoor for the good guys only is, unfortunately, impossible. Besides the risk of rogue employees, it is impossible to define who the 'good guy' is. Given we had a decryption key for the 'good guys', how would you make sure that the good guys never turn bad? How would you make sure that the good guys never abuse their power? How would you make sure that such a general decryption key never leaks into the wrong hands? To illustrate the last point, here are some famous backdoor fails.
There are many examples worldwide that prove the fact that the government can not be equated with the good guy. If European service providers were forced to implement backdoors for government access, how would you protect the data of opponents, of activists, of journalists in countries that do not adhere to the rule of law, such as Hungary, Russia, China, etc.?
Zach Weinersmith has made an awesome comic, showing what it would mean if the government had a universal key to our online communication - also in democratic countries:
We have to accept that encryption is binary: It is either 'on' or 'off'. There is no inbetween.
To come to a conclusion to this question, we must ask the following:
How much surveillance can a democracy endure?
In what kind of society do we want to live?
The question of how we could develop a master key for the "good guys" is a sham discussion designed to distract from these real questions.
Vita vya crypto vimekuwa vikipiganwa kwa miongo kadhaa sasa. "Mtazamo huu wa usalama umezidi kuwa muhimu baada ya Baraza la EU kuchapisha azimio la ""Usalama kupitia encryption na usalama licha ya encryption.""" Ingawa azimio hilo halitajwi waziwazi kuwa lengo ni kudhoofisha encryption, wataalamu wanaiona kama sehemu ya mkakati wa kimataifa wa kudhoofisha encryption kwa ujumla kwa mtumiaji wa mwisho. Hii imesababisha maandamano makubwa kutoka kwa jamii ya kiraia. Tatizo katika mjadala huu ni kwamba hakuna mtu anayeonekana kuwasiliana. Kwa upande mmoja, kuna serikali na mashirika ya kutekeleza sheria ambayo wanasema kwamba wanahitaji encryption backdoors kuzuia uhalifu. Kwa upande mwingine, kuna makampuni ya teknolojia na wataalamu wa usalama ambao wanasema kwamba mlango wa nyuma kwa 'wavulana wazuri' tu ni haiwezekani kiufundi. Kila mmoja ana maoni yake mwenyewe na hataki kuachana na jambo lolote. Alice na Bob walijaribu kujadili swali la kama tunapaswa kuwa na uwezo wa encrypt mawasiliano yetu online kwa kubadilishana hoja. End-to-end encryption ni njia ya kuhifadhi data. Inatukinga na aina yoyote ya macho ya kugundua, kutoka kwa ujasusi wa serikali hadi mashambulizi mabaya na watekaji habari na wafanyikazi wa ujasusi wanaofanya kazi katika kampuni za teknolojia. "B: ""Kufunga data kwa njia ya encryption ni muhimu kwa usalama wa data ya kila mtu." Lakini vipi kuhusu wahalifu, magaidi, watesaji wa watoto? Ni lazima tuweze kufasiri mawasiliano kwa njia iliyoelekezwa. Mtoa huduma lazima awe na ufunguo wa pili ambao anaweza kutumia kufuta maudhui ya wahalifu wanaoshukiwa. Kwa njia hii tunaweza kuhakikisha kuwa data ya raia wanaoshikilia sheria inalindwa vizuri wakati bado tunaweza kupata data ya wahalifu na kuzuia uhalifu. Alice: Hm, kile unachouliza kinasikika kuwa chenye kushawishi. Kwa hiyo, ni lazima tuwe na encryption ya nyuma kwa ajili ya watu wema ili tu kuwalenga watu wabaya. "Boss: ""Naam, ikiwa makampuni ya teknolojia yangeweza kufungua data iliyofichwa kwa ufunguo wa pili, wangeweza kutoa data za wahalifu wanaoshukiwa kwa ombi la serikali." "Alice: ""Hii inamaanisha wafanyikazi wa kampuni za teknolojia wanatafsiri data zinazohitajika na ufunguo huu wa nyuma na kuitoa kwa maafisa." Kwa nadharia hii inasikika kuwa nzuri sana. Kwa kusikitisha, inakosa ukweli kwamba si kila mfanyakazi anayeweza kuaminiwa. "Kama ilivyoelezwa hapo juu, ""Bellingcat"" ni kampuni ya Urusi ya uchunguzi wa FSB." "Kama ilivyoelezwa hapo juu, ""Watu ambao hupata data hii kwa mikono mara nyingi ni wafanyakazi wa ngazi ya chini katika benki, kampuni za simu, na idara za polisi.""" Watu hawa huchukua data binafsi za watumiaji na kuitoa kwa ajili ya pesa. "Bellingcat ilisema kuwa ""waandishi wa habari wa Bellingcat waliweza kupata habari nyeti sana juu ya mawakala wa huduma za siri za Urusi kwa kulipa pesa tu kwa data.""" Hiyo ni tatizo na milango ya nyuma. Ni rahisi kuwatumia vibaya. Basi ni lazima tufanye iwe vigumu zaidi! Je, ni serikali tu inayoruhusiwa kuomba data kama hizo, na kila kitu kingine ni kinyume cha sheria? Kwa hivyo mfano uliotoa ni haramu na wafanyikazi kama hao wanaweza kuadhibiwa na sheria ikiwa watashindwa kulinda data za watumiaji? "Alice: ""Hata hivyo, ni vigumu sana, lakini ni lazima ufanye hivyo." Kuna hatari mbili ambazo zinaweza kutokea: Kwanza, data inaweza kuwa na thamani sana, kwa mfano siri za biashara, kwamba wengine watalipa kiasi kikubwa cha pesa kwa ajili yake. Je, sheria zingeweza kumzuia kila mfanyakazi asitumie vibaya mlango wa nyuma? Na, pili, nadhani katika hali yako, serikali ni 'watu wazuri'? "B: ""Hiyo ndiyo maana ya kuwa na maisha haya." Ikiwa huwezi kumwamini serikali yako mwenyewe ni nani mwingine unaweza kumwamini? Alice: Hilo ndilo jambo linalopaswa kuzungumziwa hapa. Demokrasia zimejengwa kwa kuzingatia tisho moja kuu: kwamba serikali inaweza kuwa mbaya. "Hiyo ndiyo sababu tuna ""checks and balances"" (mabadiliko na usawa), dhamana ya vyombo vya habari huru na haki za kikatiba kama vile uhuru wa kujieleza na haki ya faragha." Kwa suala hilo, hata majaji wa Ujerumani wanapinga encryption backdoors. Lakini haki ya faragha si sawa na haki ya encryption! Kwa upande mwingine, ni nini encryption? Ni kama lugha ya siri ambayo hakuna mtu anayesikiliza mazungumzo anayeweza kuielewa. Ikiwa tutapiga marufuku usimbuaji mtandaoni, je, wahalifu hawawezi bado kutengeneza lugha yao wenyewe ya siri? Bob: Ndiyo, ni kweli. Lakini angalau kutekeleza sheria itakuwa kisha kuwa na uwezo wa kuuliza kwa ajili ya data na kuona nini wanaweza kufanya na hayo. Je, si hivyo tayari ni kesi na data encrypted? Alice na Bob wanaweza kuendelea mazungumzo haya milele kwa sababu wao ni kwenda katika duru. Tatizo - na kwamba ni nini wanasiasa kama kuweka nje ya majadiliano kabisa - ni kwamba encryption haiwezi kuwa kinyume cha sheria. Mazungumzo ya juu hujaribu kujadili faida na hasara za encryption ya backdooring. Hata hivyo, pro yoyote lazima kukataliwa kama wewe kuweka ukweli katika akili kwamba encryption kama vile - teknolojia ya encrypt data mwisho-kwa-mwisho - haiwezi kusimamishwa. Kwa hivyo jaribio lolote la serikali la kudhoofisha encryption katika huduma fulani halitafikia kile kinachopaswa kupatikana: kuzuia wahalifu kutoka kutumia encryption. Ukweli usiofaa ni kwamba kudhoofisha encryption itadhoofisha tu kwa raia wanaotii sheria, si kwa wahalifu. Badala ya kuomba kwa encryption backdoors na kuwezesha jumla ya wingi wa ufuatiliaji, wanasiasa na mashirika ya utekelezaji wa sheria wanapaswa kuzingatia mbinu nyingine za uchunguzi. "Kama vile Phil Zimmerman alivyosema, ""Ikiwa faragha ni kinyume cha sheria, tu outlaws itakuwa faragha.""" Hata kama wewe kudhoofisha encryption katika huduma fulani online, wahalifu bado wanaweza kufanya lugha yao wenyewe siri au kuendeleza programu zao wenyewe encrypted kwamba si kusambazwa kupitia Play maduka ya kawaida. Wahalifu wanaweza hata kutumia Thunderbird ya kujengwa katika barua pepe encryption. Katika majadiliano ya vita vya crypto, mara nyingi tunasikia ombi la kutekeleza milango ya nyuma kwa 'wavulana wazuri tu'. Hata hivyo, mlango wa nyuma kama huo kwa ajili ya watu wazuri tu ni, kwa bahati mbaya, haiwezekani. Mbali na hatari ya wafanyakazi wadanganyifu, haiwezekani kufafanua ni nani'mtu mwema'. Kwa kuwa tulikuwa na ufunguo wa kufasiri kwa ajili ya 'wavulana wazuri', ungehakikishaje kwamba wavulana wazuri hawangeweza kamwe kuwa wabaya? Unawezaje kuhakikisha kwamba watu wema hawatatumia vibaya mamlaka yao? Ungehakikishaje kwamba ufunguo wa kufasiri wa jumla kama huo haungeti kamwe mikononi mwa watu wasiofaa? Ili kuonyesha uhakika wa mwisho, hapa ni baadhi ya maarufu backdoor kushindwa. Kuna mifano mingi duniani kote ambayo inathibitisha ukweli kwamba serikali haiwezi kulinganishwa na mtu mzuri. "Ikiwa watoa huduma wa Ulaya walilazimika kutekeleza ""backdoors"" kwa ufikiaji wa serikali, utawezaje kulinda data za wapinzani, wanaharakati, waandishi wa habari katika nchi ambazo hazifuati sheria, kama vile Hungary, Urusi, China, nk?" "Zach Weinersmith ameandika hadithi ya kuchekesha inayoonyesha nini itamaanisha ikiwa serikali ingekuwa na ufunguo wa ulimwengu kwa mawasiliano yetu ya mtandaoni - pia katika nchi za kidemokrasia: ""Lazima tukubali kwamba encryption ni binary: ni ama 'on' au 'off'." Hakuna kitu kilicho kati ya hayo. Ili kuweza kuamua swali hili, ni lazima tuulize swali lifuatalo: Demokrasia inaweza kuvumilia uangalizi wa kiasi gani? Tunataka kuishi katika jamii ya aina gani? Swali la jinsi tunaweza kuendeleza ufunguo mkuu kwa ajili ya "watu wazuri" ni majadiliano bandia iliyoundwa kugeuza fikira kutoka maswali haya ya kweli.