SECURITY VERSUS SECURITY: BALANCING ENCRYPTION, PRIVACY, AND NATIONAL SECUIRTY Jackson Stein (TC 660H or TC 359T) Plan II Honors Program The University of Texas at Austin 05/04/2017 __________________________________________ Robert Chesney Director of Robert Strauss Center Supervising Professor __________________________________________ Mark Sainsbury Department of Philosophy Second Reader ABSTRACT Author: Jackson Stein Title: Security vs. Security: Balancing Encryption, Data Privacy, and Security Supervising Professors: Robert Chesney, Mark Sainsbury This paper analyzes the current debate over encryption policy. Through careful evaluation of possible solutions to ‘going dark’ as well has weighting the costs and benefits of each solution, we found exceptional access to information more harmful than helpful. Today, there seems to be no singular leading answer to the going dark problem. Exceptional access to data and communications is a simple solution for a simple problem, however going dark is very complex, and requires a multifaceted and refined solutions. Widespread encryption forces those listening—whether it is the NSA, FBI, foreign governments, criminals or terrorist—to be much more targeted. As for the going dark metaphor, it seems as though we are not entirely “going dark”, and yet we are not completely bright either. There are dark and bright spots coming and going across the technological landscape battling in a perpetual technological arms race. The findings of this paper, ultimately determine there to be no policy that doesn’t come without some cost. That said, there are a number of ways in which law enforcement can track criminals and terrorist without weakening encryption, which we determine to be the best direction in any win lose situation. Nevertheless, as technology continues to evolve and encryption capabilities continue to become a part of everyday life for Americans this debate will only grow larger, and we, as a society, must determine how to make the best of it. ii Acknowledgements The completion of this undertaking could not have been possible without the support of friends, family and my immensely knowledgeable supervisors. Firstly, I would like to express my sincere gratitude to Professor Mark Sainsbury for the continuous support of by thesis project, for his patience, wisdom, and encouragement over the last year. Thank you so much for helping me to stay on track and inspiring my research through insightful comments and difficult questions. I would also like to thank Professor Robert Chesney providing indispensable advice, information, and support. Your expertise was essential to the accomplishment of this project. To the Plan II thesis supervisors and directors, thank you for all of your words of encouragement and instruction over these past few semesters. Furthermore, I would like to thank the entire Plan II department for an outstanding educational experience I will appreciate for the rest of my life. iii Table of Contents ABSTRACT .................................................................................................................................... ii Acknowledgements .................................................................................................................... iii Introduction ....................................................................................................................................3 Chapter 1: Background of Today’s Debate on Going Dark .................................................6 The San Bernardino Terrorist Attack .......................................................................................................... 6 Technical and Historical Background: Encryption, Methods, and Backdoors .................... 12 Local Law Enforcement’s Solutions to Going Dark ........................................................................... 19 Government Mandated Access: Key Escrow Encryption ............................................................... 24 The Dangers of Exceptional Access and Key Escrow Encryption .............................................. 30 Chapter 2: The Golden Age Of Surveillance......................................................................... 34 The Effects of the Snowden Revelations ................................................................................................. 37 Chapter 3: Alternative Solutions to Required Exceptional Access ............................... 43 A Deeper Look into Government Mass Surveillance ........................................................................ 46 The Internet of Things ...................................................................................................................................... 51 Conclusion .................................................................................................................................... 60 Works Cited ................................................................................................................................. 62 Biography ............................................................................................................................ 71 2 Introduction What if I told you: anyone could look at your text messages. Anyone could read your emails and listen to your phone calls. They can see where you are, when you are and with whom your calls are made. These are the fears and concerns of many privacy experts today. However, advances in technology have also made it increasingly easy to hide behind digital fortresses. Strong encryption is everywhere, and it seems it is here to stay. United States legislators and law enforcement agencies fear strong encryption technology made readily available to any and all individuals threatens our national security. The tech industry disparages these concerns, arguing that government control violates the privacy of civilians. Although encryption technology has been around for half a century, encryption has gained notoriety in the past decade, as it became a fundamental part of our everyday lives. Every time we log into our email, Facebook, or Internet banking, all of our information is protected using encryption code. It protects our data from malicious hackers, spies, online criminals, and government surveillance. Moreover, the security encryption delivers goes far beyond the individual level. Large databases used by most companies and government agencies can be treasure troves of sensitive information. They can contain customers’ personal data such as hospital health records, intellectual property, or even sensitive military information. Many tech companies abide by certain protocols and policies for the prevention of theft or corporate espionage (such as Google, Apple, Amazon, Drop Box, Twitter and many more). 3 Law enforcement officials raise strong claims concerning strong encryption and its consequences. The FBI, the most vocal government agency, has been concerned there is a widening gap between law enforcement’s legal privilege to intercept electronic communications and its practical ability to actually intercept those communications. The Fourth Amendment of the United States Constitution authorizes reasonable searches and seizures, providing law enforcement agencies access to places where criminals hide evidence. Pursuant to judicial warrants these rights are conducted upon a neutral judge’s finding of probable cause. However, “Technology has become a tool of choice for some very dangerous people. And, unfortunately, the law has not kept pace with technology and this disconnect has created the significant public safety problem we have long described as “going dark”, said FBI director James Comey.1 This ominous sounding term means that even though law enforcement has the legal authority to intercept and access communications and information pursuant to court orders (according to the 4th amendment) “they often lack the technical ability to carry out those orders because of a fundamental shift in communications services and technologies, allowing the criminals to slip into the dark”.2 In recent years, Apple and Google have created very strong encryption on their consumer products (iPhones and Androids) by default. This means that millions of people, across the globe, are sending messages with extreme protected communication software that they never chose for themselves. It was gifted to them. 1 Comey, James. The Brookings Institution. Going Dark: Are Technology, Privacy, and Public Safety on a Collision Course? Washington, D.C. October 16, 2014. 2 FBI.gov, Going Dark Issue. April 6, 2016. 4 Many government officials argue for encryption to be a choice, rather than a requirement to own an iPhone or Android. Moreover, these tech conglomerates didn’t strongly advertise these new features. Director Comey also stated “There was always a corner of the room that was dark. Sophisticated actors could always get access, either for devices or for live comms, to encryption. What has happen just in the three years that I have been Director, post-Snowden, is that that dark corner of the room—especially through default encryption on devices—that shadow is spreading through more and more of the room.”3 However, the going dark issue affects a number of law enforcement and national security agencies, and the encryption debate is not viewed the same way across governmental organizations or among the individuals within these organizations. Encryption raising complex question for privacy, security, surveillance, national security,