NSA’s pipe dream: Weakening crypto will only help the “good guys”

Ever since Edward Snowden began leaking NSA secrets earlier this year, President Obama has insisted that they weren't "whistleblowing" in any useful sense because they didn't reveal any abuses. Instead, they simply revealed secret programs that were:

Operating with rigorous NSA oversight and without real problems;
Extensively vetted by the secret Foreign Intelligence Surveillance Court (FISC);
In compliance with US law, which didn't need any significant changes; and
Generally speaking, a good idea.
For instance, here was Obama at an August 9 press conference at the White House, answering a couple of questions from journalists about the NSA's programs.

And if you look at the reports, even the disclosures that Mr. Snowden's put forward, all the stories that have been written, what you're not reading about is the government actually abusing these programs and, you know, listening in on people's phone calls or inappropriately reading people's e-mails. What you're hearing about is the prospect that these could be abused. Now part of the reason they're not abused is because they're—these checks are in place, and those abuses would be against the law and would be against the orders of the FISC.
As for any needed changes, they were minor. Obama's team already made some small modifications of its own—"some bolts needed to be tightened up on some of the programs," was how he put it. His changes involved things like more "compliance officers." But the programs and the laws they rested on were fine. Still, in the spirit of having a "discussion," Obama agreed that "people may want to jigger slightly sort of the balance between the information that we can get versus the incremental encroachments on privacy" that might be possible "in a future administration or as technology's developed further." (Remember, everything now is fine!)

But the Snowden leaks kept coming and, as they did, more people started talking. First up—the revelation that the NSA had all sorts of compliance problems and that it wasn't in any hurry to tell its masters any more than they needed to know about them. Then came the chief judge of the FISC who admitted that his court had no real methods for keeping tabs on the NSA's activities apart from the NSA's own disclosures. Then, later in August, the government released a FISC opinion from 2011 in which a judge railed against the "third instance in less than three years in which the government has disclosed a substantial misrepresentation regarding the scope of a major collection program" at the NSA. Far from needing its "bolts tightened," this program's privacy requirements had been “so frequently and systematically violated that it can fairly be said that this critical element of the overall… regime has never functioned effectively.” Finally, the Wall Street Journal reported that NSA analysts spying on lovers and ex-lovers happened enough to have its own term: LOVEINT.

Fast forward to this week. Obama stopped off in Sweden for a major meeting and, during a press conference, tried to sell the NSA to skeptical Europeans. His first question was about NSA spying. Given the revelations of the last four weeks, would he make the exact same arguments? Almost—though he more directly admitted to the "actual abuses" that he dismissed as essentially hypothetical a month before. "There have been times where the procedures—because these are human endeavors—have not worked the way they should and we had to tighten them up."

He also sounded more open to changing various laws around surveillance, saying, "I think there are legitimate questions that have been raised about the fact that as technology advances and capabilities grow, it may be that the laws that are currently in place are not sufficient to guard against the dangers of us being able to track so much."

Still, the basic message was the same: 'Trust me—if you knew what I knew, you would support these programs too.'

Can you really keep it under control?

The frustrating thing for critics of the massive US spy apparatus is that Obama keeps saying the right things—things like "so much of our information flow today is through the Internet, through wireless, that the risks of abuse are greater than they have been in the past." How to square that statement with the fact that Obama apparently supports the NSA's wholesale effort, revealed today, to ransack worldwide cryptography by weakening crypto standards, compromising routers, and breaking protocols that affect the lives and work of hundreds of millions of people around the world?

The answer may be that, while Obama really does seem to understand the problem he is helping to create, he is also aware of how many other nation states are working on the same tactics. "Some of the folks who have been most greatly offended publicly we know privately engage in the same activities directed at us or use information that we’ve obtained to protect their people," he said at the same press conference.

More broadly, Obama really does seem to believe that the NSA can keep its secrets to itself, that its incredible effort to destroy privacy and anonymity online can be restricted to the hunt for "terrorists." It's a pipe dream. The effects will spill over in all kinds of ways, with the most obvious being a lack of trust. As security guru Bruce Schneier put it today, "By subverting the Internet at every level to make it a vast, multi-layered, and robust surveillance platform, the NSA has undermined a fundamental social contract. The companies that build and manage our Internet infrastructure, the companies that create and sell us our hardware and software, or the companies that host our data: we can no longer trust them to be ethical Internet stewards."

That's probably true—and yet, there's little in the short run that most people will (or even) can do about it. More practically, it will probably lead to increased spying, as other nation-states and hackers exploit the ways that NSA has degraded Internet encryption. Backdoors create security breaches exploitable by unintended users—remember the Athens Affair? A built-in backdoor meant for law enforcement was accessed by others to spy on some of Greece's top leaders.

The point has long been made by engineers. In 2001, for instance, the Internet Engineering Task Force (IETF) took up the question of designing wiretaps into products and concluded that it was a bad idea. "Experience has shown that complexity almost inevitably jeopardizes the security of communications even when it is not being tapped by any legal means; there are also obvious risks raised by having to protect the access to the wiretap," it wrote. "This is in conflict with the goal of freedom from security loopholes."

As the ACLU's Chris Soghoian put it today in a statement, "The encryption technologies that the NSA has exploited to enable its secret dragnet surveillance are the same technologies that protect our most sensitive information, including medical records, financial transactions, and commercial secrets. Even as the NSA demands more powers to invade our privacy in the name of cybersecurity, it is making the Internet less secure and exposing us to criminal hacking, foreign espionage, and unlawful surveillance. The NSA's efforts to secretly defeat encryption are recklessly shortsighted and will further erode not only the United States' reputation as a global champion of civil liberties and privacy but the economic competitiveness of its largest companies."

Or, as the Center for Democracy & Technology—no radical group—added in a statement today, “The NSA seems to be operating on the fantastically naïve assumption that any vulnerabilities it builds into core Internet technologies can only be exploited by itself and its global partners. The NSA simply should not be building vulnerabilities into the fundamental tools that we all rely upon to protect our private information."

That neither Obama nor the NSA respect the force of this argument has been one of the more troubling aspects of today's revelations. And it certainly doesn't encourage "trust."