Adam wrote:
> I think the point of key escrow is for Big Brother to be able to easily
Tap
> (i.e. monitor not dance with) computer communications. It's all
because
> of the budget cuts and new government productivity requirements.
>
> With nice key escrow they can dance -outside- the building, possibly out
of
> the rain in the local Telco-POP. With appropriate working arrangements
> with your local ISP provider they could even sit in their own office in
DC
> or wherever and have the traffic routed to them. They don't need
expensive
> Crays but can use PC's, possibly with dirty word search engines so they
> don't even need an operator.
>
> Note: I DO NOT know this for a fact (I don't have any type of
clearance).
> But if I were King that's what I would decree and if I can think of it
I'm
> sure dimmer minds can too.....
Having an ability does not imply universal intent. In a democratic society
we give up the right to anarchy in our self interest to seek protection
from the wolves. If we dont like what an administration is doing we vote
them out at the next election. Therefore we get the government we deserve
even if we dont like it.
The police and intelligence services are only servants of the State. Like
any group of people they want an easy life and given complete free range
they may seek to prohibit or control anything that makes their job more
difficult. Its the politicians task to control them and our task to control
the politicians.
Having some form of policing agency holding encryption keys doesnt mean
that they can use them widely. In reality the greatest challenge to
intelligence services is the vast amount of information potentially
available from an enormous range of sources. The result is that even
totalitarian regimes have to be selective and democratic societies usually
have under manned and under funded intelligence services, forcing them to
be very selective.
One of the greatest risks is fear of risk. Therefore we should attempt to
view in proportion.
If you are a professional criminal intending to do something illegal you
may not be affected by government agencies having access to encryption keys
because you wont provide copies of the keys which you use and intelligence
agencies understand that. You will know that unless other activities have
caused you to be targeted for surveillance it is highly unlikely that
anyone will realise that you are not using escrowed keys. Equally it is
unlikely that a government agency will detect unencrypted traffic because
there is just too much flowing.
The United States probably still maintains the largest intelligence and
policing community in the world with some of the most sofisticated
equipment available and with massive funding. They have enough difficulty
analysing the imaging data collected by surveillance satellites without
placing teams in every ISP provider to intercept and decode every packet
that passes through.
What is most likely is that a Serious Crime Unit will target a suspected
criminal. To do that they will have observed something which gives probable
cause. It might be that an individual has frequent contact with someone who
has already been targeted. The SCU then has to gather the maximum level of
information possible. That means wire taps, video surveillance and all the
other stuff including intercepting mail and email. In the process, the SCU
may identify other parties which merit surveillance. Generally that process
is controled by the need to obtain warrants from judges and other legal
protections, but often the major constraint is resources. Even special
units targeting major criminals just dont have the level of resource
necessary to do their job adequately and never succeed in closing down the
entire criminal network.
The main risk to those innocents who get sucked in to such an investigation
is that policing agencies usually employ the same poor quality untrusted
information systems that the rest of us use - sometimes their equipment is
far worse than average because of budget constraints. As a result unwanted
information does not get purged, print out ends up at rubbish dumps,
someone else uses the information not understanding what it really is and
how it got there, lack of effective risk policies allows police personnel
to deliberately or accidentally forward data to some third party.
For example there are cases where credit agencies acquired (illegally)
police information which included the personal details of an innocent
person who was then turned down for credit because of a 'police record'.
These incidents are very very infrequent and represent such a small number
that they are almost impossible to calculate statistically.
Therefore most network users have virtually no risk from using encrypted
packets where the keys are escrowed. OTOH they may have significantly
reduced the risks of their data being intercepted by criminals and
competitors.
We probably need much greater control on the use made by governments of
personal and corporate data however it was obtained but the widest abuses
of data are generally by commercial enterprises except for those
governments which have a reputation for widespread civil liberties abuse,
but then they wont mind using other much more painfull techniques to obtain
any information from you which they think they might need.
What we probably also need is more effective international agreement and
that will be difficult to gain. One factor is that what one person may
regard as unacceptable may be welcomed by another.
For example, a US citizen might be pleased that his government has
intercepted a trade secret from a French corporation and passed the details
to a US competitor to win a contract for US industry. A French citizen
however might well be extremely upset. That type of intelligence gathering
does happen and is increasing because many intelligence services have spare
capacity as a result of changes in international politics.
However, the greater danger is that private intelligence services are
becoming more numerous and better equipped, sometimes employing government
intelligence personnel made redundant by reduced East-West tensions. In
that situation, there is lower risk in having legal access to encryption
products to protect corporate and personal data with escrowed keys, than
not having effective encryption.
Perhaps what we should be doing is encouraging governments to reach
international agreement and ensure that any escrowed keys are adequately
protected under law by the escrow agency.
Looking at the approach of a number of governments, the key escrow is not
designed to place keys with active police or intelligence agencies except
for keys used by government agencies. Some proposals allow for the Key
Certification Authority to be a licensed commercial enterprise. That would
require any government agency to go through legal controls to obtain a key
to open intercepted traffic just as for wire taping and opening letters -
they certainly wouldnt be lurking in POPs with a bag full of keys to open
every encrypted packet which passes.
Ian J-B
References:
|
|
