Governments will always try to monitor citizens' 'secure' communications – and corporations will always help them
Law enforcers in the United Kingdom and elsewhere are coming to grips with a hard reality: modern communications technologies give activists of all kinds an easier way to organise and deploy.
But even as governments move to crack down, as Jeff Jarvis notes, activists are also learning a lesson – not just those whom we may support, such as the Egyptian revolutionaries, but also those whose deeds leave us cold or angry, such as many of the rioters and looters who've trashed so many parts of London and other British communities in recent days. In all cases, they are realising they cannot begin to trust the technology companies whose communications tools they used.
The law enforcement dilemma was highlighted by the protesters' use of BlackBerry mobile devices, which encrypt text communications. So the activists were able to organise on the fly with no immediate fear of being identified or having the messages decrypted in sufficient time for police to respond.
That led, inevitably, for calls on Research in Motion (RIM), maker of the BlackBerry, to help police investigations, including the unmasking of users. What RIM has touted as a brilliant feature of its service, the encryption capability, was to be turned against the customers – as so many of the technologies we routinely use can be turned against us by their makers.
RIM's motives in helping the police are understandable. It wants to be seen as a responsible corporate citizen, no doubt; but even more likely, it fears government sanctions if it doesn't cooperate.
But that assistance will lead to a renewal of a longstanding arms race. The protesters may not have realised that RIM could (or would) decrypt their messages on its servers and hand them over to third parties. Some activists will respond by looking for new and more secure ways to communicate.
And so will some businesses, when they better understand the broader implications. After all, businesses increasingly are relying on mobile communications, so they should ask themselves if there is any reason to trust the security of the devices and or the carriers that move the data around.
The answer could be yes; there is no technical reason why any particular conversation should not be secure. Some technologies, such as Skype, are said to be totally secure. Perhaps, but I have never fully trusted Skype, given its super-complex and proprietary system; and now that it is owned by Microsoft, I trust it even less.
The safest method is what security specialists call "end-to-end encryption" – creating what amount to a secure channel that cannot be unscrambled in the middle of the network. When you are communicating with a bank using its website, assuming it practices competent security, you are using this method; in theory, no one in the middle (such as your internet service provider) will see anything but gibberish when examining the data flowing through the networks.
This kind of thing is not widely deployed in simple text, email, social networks or most other digital communications. When you use the encrypted version of Facebook or the Google+ social network, for example, your data is secure up to the point it reaches those companies' servers; but they can save it and, if ordered by a government, hand it over.
The dangers of systems that enable "man in the middle" attacks or surveillance are so obvious – among other things, they offer tantalising targets for truly bad people – that we should eventually see more widespread deployment of seriously secure communications. People who have reason to fear government or criminal intrusions are going to migrate to truly secure systems over time, if they are not there already. That includes smart businesses, not just reviled protesters, or criminal elements who use technology to do wrong. Meanwhile, it's clear that no one can place absolute trust in the companies currently supplying the hardware and networking.
The more we work to create truly secure communications, the more likely will be a reactionary response that goes beyond encouraging or coercing corporate cooperation with surveillance. In some places already, including the UK, police can demand that people turn over personal encryption keys or go to jail, an outrageously invasive violation of liberty. At some point, we can expect authorities will demand restrictions on conversations they can't tap and understand in real time.
This is an old debate, actually – one we'd thought settled in America in the 1990s, when the Clinton administration put forward a plan to require all mobile phones to include chips that would enable the government to spy on all calls. Security experts explained then that the idea was both impractical and dangerous to actual security, and the plan was shelved.
It will come back in some form. The world's governments are terrified of the idea of unbreakable communications. (Even visible ones worry paranoid leaders; British Prime Minister David Cameron's call for banning some kinds of discussions on social networks is an especially ludicrous suggestion.) If I'm right, it will soon be illegal to have a genuinely private conversation, unless you're whispering in someone's ear in a language only the two of you understand.
Never mind that it won't work, and that it will lead to less, not more, security for everyone. Is that the world you want to live in?
--
Source: http://www.guardian.co.uk/commentisfree/cifamerica/2011/aug/12/social-networking-surveillance
~
Manage subscription | Powered by rssforward.com
0 comments:
Post a Comment