The week of October 19, 2014

Encryption shouldn’t just be an election issue—it should be a human right

By Patrick Howell O'Neill

We are all born with certain inalienable rights. Now, the notion of free speech—core to the entire idea of human rights—must be constantly re-examined in the face of a rapidly changing world where the most important speech increasingly takes place on the Internet.

Free speech isn’t merely about the abstract idea of saying whatever you want. It’s the freedom to speak, ask questions, and seek knowledge without anyone, hidden or otherwise, looking over your shoulder. In the digital age, free speech is about being able to use the Internet unmolested by the greedy eyes of corporations with incentive to sell your personal data, hackers wanting to steal or destroy it, and massive regimes collecting it all.

Everything a person does online is saved as data. The messages you send, the websites you look at, the files you save are all data that can live on forever. The only way to protect your most personal data—your location, credit card numbers, political thoughts, medical queries, and everything else you do on a phone, tablet, or computer—from malicious spying eyes is through encryption.

That’s why encryption should be considered a human right.

Modern encryption—at its core, really good mathematics that make it possible to protect your data so that no computer can decrypt it without your go ahead—is legally protected by a 1995 American court decision that declared computer code constitutionally protected free speech. But many of the world’s top cops continue to demonize encryption, saying it will inevitably enable and immunize criminals on massive scales.

Criticisms of encryption coming from corners of power are louder now than they’ve been in two decades. Earlier this week, James B. Comey, director of the Federal Bureau of Investigation (FBI), said that law enforcement agencies should have access to encrypted communications, because “the law hasn’t kept pace with technology, and this disconnect has created a significant public safety problem.” He believes Apple’s new smartphone encryption puts its users “beyond the law.”

What is bound to be one of the great political issues of this century is only now beginning to enter the mainstream in a clear way. One day in the not-too-distant future, cryptography will be an election issue. Prominent politicians will debate louder than ever about privacy and secrecy while voters—even moms and dads—will cast ballots with strong encryption on their minds.

That’s not to say the debate hasn’t already begun. The war over encryption is four decades old. It dates back to the 1970s when a new invention called public key cryptography definitively broke the government’s monopoly on secrets. All of sudden, using free software that utilized clever mathematics and powerful cryptography, normal people were able to keep data private from even the most powerful states on the planet.

The war over encryption—most notably the so-called “crypto wars” of the 1990s—saw the American government try to make strong encryption a military-grade weapon in the eyes of the law. Opposed chiefly by the Electronic Frontier Foundation, courts declared computer code to be free speech and said the government’s regulations were unconstitutional.

Despite the landmark legal victory, the war over encryption has continued to this day.

In the digital age, encryption is our only guarantee of privacy.

John J. Escalante, chief of detectives for the Chicago Police Department, has called encryption mostly a tool of pedophiles—a claim that’s disingenuous and misleading, if not outright dangerous. For one thing, many city and federal police agents use encryption tools regularly, and encryption stymied a total of nine police investigations last year. There are plenty of ways to investigate crimes involving cryptography that don’t involve banning or curtailing it.

There’s no denying that these tools have some very ugly users. However, for the few billion of us who want to keep our digital lives private from unwanted eavesdroppers and hackers, being forcefully grouped in with terrorists and pedophiles is a hard insult to stomach.

Encryption works to protect you—and everyone else—online. More than that, it’s the best protection you have. There are simply no other options that can compare.

If, for some reason, you assume a hack will never happen to you, let me give you some perspective on the current state of digital security. 2014 is known in information technology circles as “the year of the breach” because it has boasted some of the biggest hacks in history. 2013 had a nickname too: The year of the breach. Come to think of it, 2012 was called something eerily similar: The year of the breach.

2011? You get the idea.

This isn’t merely one year of massive security breaches, it’s an era of profound digital insecurity in which sensitive personal data—the information that can be put together to add up to a startlingly complete picture of our lives and thoughts—is under attack by criminals, corporations, and governments whose sophistication, budget, and drive is only growing.

Consider the following, put forth by Eben Moglen, a law professor at Columbia University, in 2010: “Facebook holds and controls more data about the daily lives and social interactions of half a billion people than 20th-century totalitarian governments ever managed to collect about the people they surveilled.”

The Internet’s “architecture has also made it possible for businesses and governments to fill giant data vaults with the ore of human existence—the appetites, interests, longings, hopes, vanities, and histories of people surfing the Internet, often unaware that every one of their clicks is being logged, bundled, sorted, and sold to marketers,” the  New York Times journalist Jim Dwyer wrote in his new book, More Awesome Than Money. “Together, they amount to nothing less than a full psyche scan, unobstructed by law or social mores.”

When people like Comey suggest that law enforcement should have a “back door” or “golden key” that allows cops to easily access all encrypted communication, they are willfully ignoring the reality shouted to them by the vast majority of the information technology industry.

What is bound to be one of the great political issues of this century is only now beginning to enter the mainstream in a clear way.

You can’t build a ‘back door’ that only the good guys can walk through,” cryptographer Bruce Schneier wrote recently. “Encryption protects against cybercriminals, industrial competitors, the Chinese secret police, and the FBI. You’re either vulnerable to eavesdropping by any of them, or you’re secure from eavesdropping from all of them.”

When encryption becomes a campaign issue, that’s going to go on the bumper stickers: You either have real privacy and security for everyone or for no one.

“The existing ‘back doors’ in network switches, mandated under U.S. laws such as CALEA, have become the go-to weak-spot for cyberwar and industrial espionage,” author Cory Doctorow wrote in the Guardian. “It was Google’s lawful interception backdoor that let the Chinese government raid the Gmail account of dissidents. It was the lawful interception backdoor in Greece’s national telephone switches that let someone—identity still unknown—listen in on the Greek Parliament and prime minister during a sensitive part of the 2005 Olympic bid (someone did the same thing the next year in Italy).”

If, like many Americans, you say you don’t mind if the U.S. government watches what you do online, take a step back and consider the bigger picture.

The American government is not the only government—nevermind other organizations—watching and hacking people on the Internet. China, Russia, Iran, Israel, the U.K., and every other nation online decided long ago that cyberspace is a militarized country. All the states with the necessary resources are doing vast watching and hacking as well.

Encryption proved a crucial help to protesters during the Arab Spring. It helps Iranian liberals push against their oppressive theocracy. From African free speech activists to Chinese pro-democracy organizers to American cops investigating organized crime, strong encryption saves lives, aids law enforcement (ironic, huh?), protects careers, and helps build a more free and verdant world. Journalists—citizen and professional alike—depend on encryption to keep communications and sources private from the people and groups they report on, making it essential to an independent and free press.

The right to privacy, the right to choose what parts of yourself are exposed to the world, was described over a century ago by the U.S. Supreme Court and held up as an issue of prime importance last year by U.N. human rights chief Navi Pillay. It’s something we all need to worry about.

Lacking good law, privacy is best defended by good technology. You cannot truly talk about online privacy without talking about encryption. That’s why many of the world’s biggest tech firms such as Google, Apple, and Yahoo are adding strong encryption to some of their most popular products.

“There is only one way to make the citizens of the digital age secure, and that is to give them systems designed to lock out everyone except their owners,” Doctorow wrote. “The police have never had the power to listen in on every conversation, to spy upon every interaction. No system that can only sustain itself by arrogating these powers can possibly be called ‘just.’”

In the digital age, encryption is our only guarantee of privacy. Without it, the ideal of free speech could be lost forever.


Illustrations via Epop/Wikimedia Commons, Marwa Boukarim and vectorised by Fred the Oyster/Wikimedia Commons (CC BY 3.0), and DonkeyHotey/Flickr (CC BY 2.0) | Remix by Rob Price