Privacy Absolutism
We don&#x27;t have to abandon the framework at all. The framework never guaranteed law enforcement would have a resource to access. It just says we have to obey the warrant. So, if only I can unlock the device, I can be ordered by a court to unlock it for a search. If I don&#x27;t, I can be put in jail. So, Congress would just need to pass laws strengthening that principle to achieve what FBI claims to want.<p>Far as what Fred asks for, the best minds in cryptography (and breaking it) looked at the past of industry and present of CompSci to see if that was feasible. The consensus is that it was impossible to design a backdoor for FBI that wouldn&#x27;t be used by foreign intelligence services or breached by hackers. The write-up of that is here:<p><a href="https:&#x2F;&#x2F;www.schneier.com&#x2F;cryptography&#x2F;paperfiles&#x2F;paper-keys-under-doormats-CSAIL.pdf" rel="nofollow">https:&#x2F;&#x2F;www.schneier.com&#x2F;cryptography&#x2F;paperfiles&#x2F;paper-keys-...</a><p>My own background is high-assurance security: the kind of rigorous engineering designed to stop nation-states. I have an idea of what works and doesn&#x27;t. I disagree with the authors that we can&#x27;t make a backdoor for selective access. We do it all the time under banner of remote administration, VPN&#x27;s, etc. Crypto in general, damnit! My concerns were hackers accessing all data, FBI reading more than allowed, and FBI&#x2F;hackers having write access that allows forgery. My attempt at a read-only, high-assurance mechanism for law enforcement is here:<p><a href="https:&#x2F;&#x2F;www.schneier.com&#x2F;blog&#x2F;archives&#x2F;2014&#x2F;09&#x2F;fake_cell_phone.html#c6679179" rel="nofollow">https:&#x2F;&#x2F;www.schneier.com&#x2F;blog&#x2F;archives&#x2F;2014&#x2F;09&#x2F;fake_cell_pho...</a><p>Note: That post reads like I&#x27;m in favor of surveillance or something. The context is a situation where courts or Congress forces L.E. into systems. My L.E. scheme is insurance policy against broader ones.<p>The design lets Feds and courts get what they need while restricting access, esp write access. Such designs can be made arbitrarily difficult for attackers without access. Consumer devices and anything cost-sensitive will have limits. The hardware levels can be hit, esp with emanation attacks. U.S., U.K., Israel, and Russia have that tech. So, there&#x27;s residual risk of attack that has to be mitigated.<p>However, the bigger problem is key management. The Fed&#x27;s original proposal was escrowing the keys to them. The FBI, DEA, and NSA have a long history of poor security leading to leaks, infiltration by foreign intelligence, corruption, and occasionally targeting Americans. I question giving them any full L.E. power to begin with but they certainly shouldn&#x27;t hold the keys if one is mandated. That means companies will hold the keys themselves protecting them with recommended means (esp HSM&#x27;s). HSM&#x27;s themselves have same security issues, esp w.r.t. intelligence agencies, but we&#x27;ll ignore that for now. ;)<p>So, the problem then changes from protecting ephemeral communication (like spoken words) to protecting keys to records that will be kept for years. If not initially, government will pass laws to mandate it like they&#x27;ve done here to a degree and in other countries. You have to realize, though, that a product as popular with elites and government as an Apple or Android phone will lead to tons of people&#x27;s secrets consolidated into hands of a few companies. That&#x27;s incredible power for them to wield. Let&#x27;s say we trust them, though.<p>This leads to the biggest counterpoint I heard in my exploration of lawful intercept. Dirk Praet, well-versed in IT and military INFOSEC, put it something like this: &quot;Nick, let&#x27;s say you deploy high-assurance L.E. in devices and every security method you can to protect escrowed keys. Once secrets pile up in one place, you must realize that <i>every intelligence agency, hacker, and organized crime group on Earth</i> will be coming for it. You might be smart enough to stop many of them. Will you bet you&#x27;re smarter than all of them combined?&quot;<p>I&#x27;m confident in myself but not dumb enough to place that bet. My L.E. design might be implemented for remote administration, etc for voluntary use in companies. Yet, after thorough exploration, I strongly recommend against any escrow or backdoor mechanism because it puts us at risk against people who otherwise had limited potential to harm us. It also piles up the risk, too, once laws show up mandating retention of communications. Instead, we should focus on penalizing refusal to allow a search and implement methods to ensure the search is honest.