I know what it is (I've read Steven Levy's incredibly boring book, Crypto). I meant that they wouldn't make the mistake of announcing it this time.

True, they're likely just to force implementation and NDAs all around.
(I found Simon Singh's The Code Book a more enjoyable read than Crypto but I must remember to read that again some time also [I can see my copy from where I'm sitting now...].)

Sundial posted: "I prefer to adopt a much narrower interpretation of what is being asked-for here, and not to see it as a bellwether of "the end of encryption as we know it."

yada yada yada
----------------------------------

Your preferences, and mine, are irrelevant. "Readily readable" requires either a back door, or collected keys in a central place, or crippled encryption. NOWHERE do you deny that those are the alternatives.

So I put it to you: How do you plan on providing "readily readable" files -- which is what the proposed law requires -- if not with one of those three options?

Perhaps you should start with the basics: What does "readily readable" mean to you?

Oh god, yes. I got introduced to The Code Book via the Amazon reviews for Crypto. It ended up being one of the best books I've ever read.

Actually, I do not believe that "these are 'the [only ...] alternatives.'"

Instead, I argue that ... "awright, awright, awright ... the two parties need to sit down together, and talk."

Answer: "I don't know," and neither would any Judge and/or Justice who was presented with such a functionally-ambiguous English-language term in a "duly-enacted" piece of legislation. Quite frankly, the judiciary official in question would have to "wing it."

Therefore ... "we need to change the text of 'the (still-)proposed law," while there is still time to do so.

Let us all very-kindly remember that, while we are 'technical experts,' some of our 'dumb users' are ... legislators!

It is, prima facie, fairly obvious what those Legislators intend to accomplish: "they want to compel Apple to cooperate with the FBI, gjven that right-now it seems that Apple (and Microsoft, et al ...) doesn't seem to think that they must do so." Being non-technical lawmakers, they're availing themselves of "ordinary human terms" to express their legislative intentions. They frankly know nothing of the extreme rigors of computer-science, even though this is precisely what is going to confront subsequent Judges and Justices.

"The proposed language, as now proposed, is insufficient and ambiguous," even though the Lawmakers in question might well not understand this. Well, we (geeks ...) "understand this." "Therefore, we need to participate, right now(!) in the framing of alternative wording that can actually survive the light of day ... in the 21st Century.

"The crafting of legislation, in the 21st Century," must be a participative process ... and we must, first-and-foremost, be "the participants." If the only thing that Legislators see is that "we" are "being uncooperative," then they will exercise their Powers accordingly.

Clearly, the most diplomatic course that "technical experts such as Apple" could have pursued in this matter would have been: "to show Congress the way." Instead, they've decided to confront Congress (and the Federal Court), in order "to prove a Point," being of-course cock-sure that Congress (and, the Court ...) have any notion whatsoever what "the Point" actually is.

1. "Guess what: (a) they don't [have a clue], and (b) they don't have to." They have the power to enact "any sort of law they choose." (And they will, if only to cover-butt.)
2. In due time, a Judge and/or a Justice is going to confront "the empasse between Legislation and Reality," and, quite frankly, "s/he is gonna have to cover-butt." Guess where the ruling's gonna fall?
3. ... and, all because "technical expert [companies]" decided to "camp-out on Libertarian precipices," instead of problem-solving(!) when the time was right to do so.

Talk about what? You being coy is not an answer. They (the parties) can talk about A or B or C, Do you have a D to propose? If you do, state it. If not, stop whining.

Yes ...

(1) Write an appropriately worded Act of Congress that clearly spells-out what the duties of the suppliers of hardware and software actually are ... and, that they do have one. Get the bill signed into law. The hardware and software communities, recognizing that they do, in fact, have such a duty to the purposes of law-enforcement, should be very active in determining what that law should contain. (And they ought not be "whining" that there's nothing they should be required to do. The Court of Law has both powers and prerogatives.)

(2) Apple should completely open-up as to precisely how their privacy system works, including possibly releasing the source-code of that part of their system along with complete technical documentation. It should be available to everyone, because there is no "security through obscurity" in anything crypto.

(3) An electronic device is not "a bastion of impregnable 'privacy.'" It's an electronic device, nothing more. It isn't "hacking" to extract data from any such thing, if you have a search warrant and are executing it properly. (Hell, under different circumstances it's called "customer service.")

(4) This is not "the end of crypto as we know it," and every new law that is passed should very clearly spell that out. It should be "the sense of Congress" that access to strong encryption (and the means of demonstrating by peer-review that it is strong ...) is both a fundamental right protected by the Fourth Amendment (as is search-and-seizure), and a business necessity. In fact, "strong crypto in the hands of civilians" is a National Security issue ... in a positive sense.

(4a) The Act must make it clear that the legal requirement to assist in extracting evidence from a device does not mean -- because it literally cannot mean -- that the data must be made available to law enforcement in unencrypted form. In the 21st Century, law enforcement involves codebreaking (or "people-breaking" to obtain the key). A vendor can say, "this is a true, complete, and correct duplicate of what data is on that device ... and here is the complete technical description of the process by which that data was protected ... make of it what you will and what you can." A vendor can say no more.

(4b) The Act must also make it clear that "back doors" are neither required nor permitted. Someone who installs a lock on their front door is entitled to know if there is a master key, an override code, or any other "secret" means by which the security of the lock that he has purchased is actually less than what he thinks it is ... or, non-existent. This, too, would be a violation of (the first part of) the Fourth Amendment, which clearly states that citizens are entitled to, in fact, be "secure in their persons, houses, papers, and effects." (Electronic data is our modern-day "papers.")

(4c) In the presence of a world-wide electronic data network, strong cryptographic security (and the other benefits of crypto, such as message-signing) is far more important than ever before. It must be made "stronger, yet," not weaker. In the presence of an electronic network that permits hundreds of millions of people to be individually reached, those people must be individually protected. "Strong crypto" is an essential part of doing that. If the technical process is compromised, however slightly ... even with the most laudable of intentions ... it is destroyed.

(5) A really good Act of Congress would attempt to define what [electronic] privacy actually means in the 21st Century, as well as what search-and-seizure means in the presence of strong cryptography. The Internet has hit its stride in the last ten years, and we can't expect hoary old laws to apply very effectively to them. We need new ones. Good new ones.

- - - - -

A Call to Action: If all of us don't get involved right now in working with Congress to develop a good law, then we're all gonna be stuck with a bad one ... because Congress will act. The sleeping dragon has been prodded. There is going to be legislation and court rulings. (That jinii can't be put back into its jar now, anywhere in the world.) We have new laws to write ... we can't be wasting our time, pretending that we have no obligations at all to those who solve crimes and seek justice, nor that they have no rights to seek and gather evidence. Neither can they be suggesting that citizens have none. There is no solution to be found at either extreme; only in the middle, somewhere. And the question is: "where?"

And the proposed legislation does precisely spell out the proposed duties: Do things so that a "readily readable" file is available to governments. That means: A. crippled encryption, or B. collect encryption keys centrally, or C. Back door. If you have an option D, let us hear it.

Remember, unless a solution is dictated by the government, one company might comply by using option A, another with B, and a third with C. But the act of choosing would be mandated. If you have an option D, let us hear it.

Otherwise everyone in America should oppose this legislation from the jump.

Moxieman

As I have said earlier, I don't think that "readily readable" can mean "the file must be provided 'unencrypted'" (nor, "fatally compromised").

But this brings up a very important point: "what wording should Our August Legislators put into their legislation?" They're not technical specialists ... some of them probably know less about computers than your grandmother ... ... but they are the people who can vote "Aye" or "Nay."

When we extend the issue to "any computer or electronic device (ever invented)" ... as our Patient Judges must necessarily do as they try once again to figure out what Congress was actually talking about ... we promptly get lost in a fog-bank. The only thread out of that fog-bank is one that Judges sometimes use, but of course hate to use: "What was the 'legislative intent?'"

Obviously, the most-general interpretation of this proposed legislation would extend to every possible case of "getting a file," including walking up to a Windows 3.1 machine with an [encrypted] file on it, copying it to a pen-drive and saying, "here you are." Oops... you didn't decrypt the file for the FBI. And, oops again, you can't. "So, the legislative intent probably(?) doesn't extend that far." Our Judge is groping in the dark.

It would seem that Congress's intent, as expressed in the discussion document, is: "Apple must help the FBI." Specifically, the data-in-question is hard(er) to retrieve (than it would be in our Windows 3.1 box).

But that is not what the document presently says, when interpreted from a very-technical point of view that: (a) Congressmen can't be expected to know; (b) we know but aren't yet telling them; and (c) that a Federal Judge is sooner-or-sooner gonna be confronted with ... and s/he won't appreciate it.

The text of the law needs to be discussed, and we need to participate in that discussion. But we need to frame our discussion in a fundamentally different way than the way that Apple, and perhaps the "privacy community at large," is now doing:

• We cannot prevail in arguing ... or doing anything that would be seen as arguing ... that "the FBI can't search-and-seize in our electronic toys when they're investigating a goon who killed more than a dozen people." The Fourth Amendment (et al ...) does grant rights to both(!) parties: "We, the People," and "The Guv'mint."[/i]
• W-e see deficiencies in phrases such as "readily readable" (and, in due time, Federal Judges across the country will privately curse such wording ...), but Members of Congress won't realize that the language must be changed unless we tell them ... and if we suggest alternative phrasing and do so in a way that encourages them to trust our knowledge, our motives, our expertise as advisors, and our point-of-view.
• "Yeah, the distinction might seem to be 'purely political,'" and therefore uninteresting to computer-geeks, but this is the language that Legislators speak, and it is not without good reason that they do so. Circumstances (certainly, "egged on" by Apple ...) mandate that "Congress will act." (Indeed, by-now they must: "that's their job.") Therefore, we'd better be out there in force, "discussing" their "discussion" document while there is still time.
• "Yeah, we know that 'their document sux.'" But they don't. Specifically, they don't know why not. (And why should they? They've never worn a pocket-protector in their entire life.)
• "Quit opposing them. Guide them." Right now. While there's still time. But, don't waste time standing on a distant bastion that you cannot possibly hold. "Super cool electronics" (which, by the way, did not exist ten years ago ...) are, yes, "way cool," but they did not and will never(!) supersede 200+ years of jurisprudence. "Plan accordingly."

As I have said earlier, I don't think that "readily readable" can mean "the file must be provided 'unencrypted'" (nor, "fatally compromised").

But this brings up a very important point: "what wording should Our August Legislators put into their legislation?" They're not technical specialists ... some of them probably know less about computers than your grandmother ... ... but they are the people who can vote "Aye" or "Nay."

When we extend the issue to "any computer or electronic device (ever invented)" ... as our Patient Judges must necessarily do as they try once again to figure out what Congress was actually talking about ... we promptly get lost in a fog-bank. The only thread out of that fog-bank is one that Judges sometimes use, but of course hate to use: "What was the 'legislative intent?'"

Obviously, the most-general interpretation of this proposed legislation would extend to every possible case of "getting a file," including walking up to a Windows 3.1 machine with an [encrypted] file on it, copying it to a pen-drive and saying, "here you are." Oops... you didn't decrypt the file for the FBI. And, oops again, you can't. "So, the legislative intent probably(?) doesn't extend that far." Our Judge is groping in the dark.

It would seem that Congress's intent, as expressed in the discussion document, is: "Apple must help the FBI." Specifically, the data-in-question is hard(er) to retrieve (than it would be in our Windows 3.1 box).

But that is not what the document presently says, when interpreted from a very-technical point of view that: (a) Congressmen can't be expected to know; (b) we know but aren't yet telling them; and (c) that a Federal Judge is sooner-or-sooner gonna be confronted with ... and s/he won't appreciate it.

The text of the law needs to be discussed, and we need to participate in that discussion. But we need to frame our discussion in a fundamentally different way than the way that Apple, and perhaps the "privacy community at large," is now doing:

• We cannot prevail in arguing ... or doing anything that would be seen as arguing ... that "the FBI can't search-and-seize in our electronic toys when they're investigating a goon who killed more than a dozen people." The Fourth Amendment (et al ...) does grant rights to both(!) parties: "We, the People," and "The Guv'mint."[/i]
• W-e see deficiencies in phrases such as "readily readable" (and, in due time, Federal Judges across the country will privately curse such wording ...), but Members of Congress won't realize that the language must be changed unless we tell them ... and if we suggest alternative phrasing and do so in a way that encourages them to trust our knowledge, our motives, our expertise as advisors, and our point-of-view.
• "Yeah, the distinction might seem to be 'purely political,'" and therefore uninteresting to computer-geeks, but this is the language that Legislators speak, and it is not without good reason that they do so. Circumstances (certainly, "egged on" by Apple ...) mandate that "Congress will act." (Indeed, by-now they must: "that's their job.") Therefore, we'd better be out there in force, "discussing" their "discussion" document while there is still time.
• "Yeah, we know that 'their document sux.'" But they don't. (Specifically, they don't know why not.) And why should they? They've never worn a pocket-protector in their entire life ...
• "Quit opposing them. Guide them." If you try too hard to buck the system, you will merely be decapitated ...

So, to bring up an earlier point, if the FBI had succeeded in coercing Apple to work for free, we now know the market value of the solution: 1.3 million US dollars. Any legislation as proposed above wouldn't be complete without just compensation IMO.

Wrong. The Congress would simply forbid the sale of hardware, software, and systems, that cannot provide "readily readable" data on demand. No compensation required. We don't compensate factories for no longer being allowed to pollute.

Sundial's problem is that he wants to pretend that "readily readable" doesn't mean "readily readable."

All right, moxie, let's see what happens if your point-of-view wins. It is now illegal, in the United States of America, to use or to possess: VPN, "https://" web sites, any credit-card machine, any sort of keychain or other mechanism that uses OpenSSL or GPG or even secure e-mail. No one could encrypt anything unless the Government could immediately obtain what you decide "readily readable" means ... namely, "unencrypted."

American business immediately shuts-down because the ACH network also uses encryption, factories world-wide send and receive invoices and purchase-orders electronically, and so on. Countries around the world won't trade with America because they use publicly-available systems (such as the aforementioned) which don't have known back-doors.

- - -

In a nutshell, the phrase "readily readable" can't mean what you wish for it to mean. If lawmakers think that they could possibly enact a law like that in the 21st Century ... or that such a law, if passed, could actually be implemented ... "they're wrong." And they need to be told that, during this "discussion" period.

- - -

We also can't put our heads in the sand and insist that this draconian interpretation of two words is the only possible interpretation (it isn't ...), and/or insist that these two words must be the two words that appear in the final draft (they don't have to be).

We also can't insist that, "therefore, Congress should do nothing at all." Congress is going to enact legislation that will compel Apple to cooperate with criminal investigations ... so that FBI doesn't spend over $1 million of our money again.

(Can the FBI fine, or sue, Apple to recover the taxpayer's money?)

This is a "relatively brand-new" concern, a product of the 21st Century and the proliferation of a world-wide global Internet that connects individuals worldwide with individuals worldwide. Furthermore, it is a consequence of personal electronics that are intimately attached to that same network. When two parties (Apple et al, and FBI) are standing on two sides of the Fourth Amendment, both of them arguing that their viewpoint is protected and both of them correct, a new law must be forthcoming. (Especially when Apple repeatedly pokes the dragon ...)

This is among the first of what will be a great many new laws, and new legal precedents. Both the legislatures and the court system (and, law enforcement) are to some extent "groping in the dark," looking for the best ways to handle these new realities ... or, failing that, to simply get their jobs done.

The concerns being raised by you and by others in the privacy community are valid! "The wording is ambiguous, and one valid interpretation of the phrase is intolerable for a variety of reasons." But the political reality of the situation is that you likely cannot stop some form of this legislation from being passed and signed into law ... "to the consternation of every Judge in this country," if the wording should remain as it is now.

It is therefore necessary to get involved during this "discussion" phase. But not with the hope of "talking Congress out of enacting something." We do, during this time, have the possibility of positively influencing what is passed. We need to be certain that the legislation does accomplish the obvious motivating purpose ("compel Apple to cooperate with the FBI!"), while also becoming a law that can actually be interpreted, enforced, understood by all, and lived-with. The existing draft is a long way from being that! (But that's why they "discuss" it ...)

Sundial, Congress is thinking with its dick -- doing something in a moment of passion -- not its head. The words mean what the words mean. The consequences are another matter. What you can't do is read the words and then say "Oh, they can't mean that."

"San Bernardino phone hack 'cost FBI more than $1m'"

http://www.bbc.com/news/technology-36110236


I guess encryption really does not matter, if the government has to spend money on getting at the data , clearly that is not an issue.