Let's Have an “Adult” Conversation on Encryption

This January, the New America Weekly's writers are proposing a series of policy resolutions. These are actions that policy makers and ordinary citizens can take to make the world a better place in 2017.

Since last summer, FBI Director James Comey has been signaling his intent to make 2017 the year we have an “adult” conversation about encryption technology’s impact on law enforcement investigations. He’s probably going to get his wish, but if a new report from leaders in Congress is any indication, it’s not going to be the conversation he wants. Rather, as that new report from the House working group investigating the encryption issue recognizes, having the “adult” conversation about encryption means talking about how law enforcement can adapt to a world where encryption is more common, rather than wrongheadedly forcing the technology to adapt to law enforcement’s needs.

To Comey, being “adult” about encryption apparently means agreeing with his conclusion that the existence of unbreakable encryption—for example, the full-disk encryption that protects your iPhone against anyone who doesn’t have your passcode, or the end-to-end encryption that protects your iMessages and Whatsapp texts as they cross the Internet—poses an unacceptable threat to law and order. Being an adult, to Comey, means accepting the argument that tech companies should design their products to ensure that the government can access any data it needs in an investigation, whether by building (in the words of his opponents) a “backdoor” into strongly encrypted products, or by not deploying that encryption in the first place. Being an adult, to Comey, means supporting efforts to legally require tech companies to ensure government access, if they won’t do it voluntarily.

When Comey insists that we haven’t yet had the “adult” conversation on this issue, he’s insulting everyone who has disagreed with him—which is almost everyone who’s voiced an opinion on the subject, that disagreement flowing in an endless stream of expert white papers (issued by adult institutions like MIT and Harvard), editorials, coalition letters, Congressional testimony, National Academies of Sciences proceedings, and more. Ever since this latest debate over encryption was first sparked in the fall of 2014 when Apple announced that new iPhones would be completely encrypted by default—a debate that peaked with last year’s court fight between Apple and the FBI over the locked iPhone of one of the San Bernardino shooters—the clear consensus among experts has been that any kind of mandate on companies to weaken their products’ security to ensure government access to encrypted data would be devastating to cybersecurity and to the international competitiveness of US tech companies. It would also be futile, since US companies don’t have a monopoly on the technology, making it trivial for bad guys to obtain strong encryption products, no matter what Congress does. It is these exact same arguments that won the day in the “Crypto Wars” of the ‘90s when a similar policy debate over encryption arose.

Importantly, it’s not just privacy advocates and privacy-minded tech experts making these arguments. Opposition to backdoors has been voiced by leaders from the national security and law enforcement establishment—all of them indisputably adults!—such as former NSA director and Director of National Intelligence Mike McConnell, former NSA and CIA Director Michael Hayden, Former DHS secretary Michael Chertoff, and—in agreement with his fellow members in President Obama’s handpicked Review Group on Intelligence and Communications Technologies, former CIA Director Michael Morrell. And that’s just the Michaels! The list of expert adults that have disagreed with Comey at this point is staggeringly long.

Despite that broad consensus, Senators Richard Burr and Dianne Feinstein floated draft legislation last year that would broadly require any provider of any encrypted product or service to be able to produce any encrypted data on demand. Although that bill was almost universally panned at the time, Comey is probably hoping that similar legislation will have a better chance this year—especially if he has the support of a new Attorney General and a new President that appear to share his views, rather than being held back by an Obama administration that chose not to pursue a legislative solution.  (Notably, the fact that the Trump administration seems likely to support backdoors is all the more ironic and hypocritical considering this week’s report that high-level Trump aides—along with key staff for Hillary Clinton, Barack Obama, and many other political figures—are now using the end-to-end encrypted messaging app Signal for fear of being hacked.)

Still, Comey likely will not get his wish, because the long list of people who disagree with him just got longer: As Congress was preparing to depart for its winter holiday, a House Congressional working group tasked with examining the issue of encryption technology’s impact on law enforcement issued a year-end report that signaled a major shift in the crypto debate. The working group, established in May as a collaboration between members of the House Judiciary Committee and the House Energy & Commerce Committee, had spent many months meeting with law enforcement, the intelligence community, privacy advocates, security experts, and tech companies, to help guide its bipartisan investigation. The report, signed off on by ten (adult!) House members including the top Republican and top Democrat on each of the two investigating committees, came to an unequivocal conclusion: “Congress should not weaken this vital technology because doing so works against the national interest,” but should instead work to help law enforcement find new ways to adapt to the changing technological landscape.

In particular, the report’s authors arrived at four observations, echoing the arguments of Comey’s prior opponents: Weakening encryption goes against the national interest because it would damage cybersecurity and the tech economy; encryption is widely available and often open source, such that U.S. legislation would not prevent bad actors from using the technology; there is no one-size-fits-all fix for the challenges that encryption poses for law enforcement; and that greater cooperation and communication between companies and law enforcement will be important going forward and should be encouraged. As next steps, they suggest further investigation into avenues other than backdoors that can help address the challenges that encryption poses to government investigators, including working to ensure that all levels of law enforcement have the information and technical capacity they need to make full use of the wide variety of data that is available to them even without backdoors.

In other words, the key committees in the House that have jurisdiction over the encryption issue have sent a clear signal to Comey, and to his allies in the Senate like Feinstein and Burr: “Sorry, but the House is definitely not interested in legislating to require backdoors. How else can we help you?” Though news of the report was somewhat buried due to the holiday timing, that signal has now been heard loud and clear across Washington, DC.  The House does not want to waste any more time on childish bickering over backdoors that essentially everyone but the FBI agrees are a bad idea. In 2017, it wants to have the adult conversation that moves beyond backdoors.