In light of the NSA, how to think about encryption

In light of the NSA, how to think about encryption

Summary: The back door policy the NSA is reportedly encouraging may provide a short-term tactical advantage, but it may prove to cause us all problems in the long-term.


Encryption is an arms race. It is, perhaps, one of the true fundamental arms races in the history of warfare. In World War II, for example, the Allies' ability to decrypt the Axis communications (without their knowing about it) was a factor leading to ultimate victory.

Encryption has always been the purview of the nation state and those, by virtue of concentration of economic and other resources, who essentially function as nation states (extremely wealthy individuals and large corporations).

The key to this arms race is a simple fact: some people don't want other people to read their stuff. At the very same time, some people want to read stuff others don't want them to read.

The most basic point you need to know when considering encryption is that those who encrypt do so to keep things private from those who would otherwise want to read those same private things.

In other words, encryption is a battle of wills. On one side are the encryption users, using ever more complex encryption to keep their adversaries out of their communication. On the other side are the entities who want to read those very same communications. They will use whatever means available to decrypt those communications.

This is as it has always been. This is as it shall always be.

So what does that mean in light of the latest round of NSA revelations and what does it mean for you?

Let's start with the NSA

At it's most mission-centered level, the NSA's role is signals intelligence. Key to signals intelligence is cracking encryption. The NSA lives to crack encryption. So it has been. So it shall always be. To think otherwise would be foolish.

The same is likely true for other states, especially active players like China, India, Brazil, Russia, Israel, the Koreas, the U.K., Germany, Japan, and others. How capable each of these countries are at cracking signals intelligence is a function of the quality of their scientists, their budgets, and the information shared by their allies.

But rest assured, governments crack encryption. If there happens to be some kind of encryption they can't crack, they don't just write it off. They redouble their efforts to find a way to get inside those communication streams.

It is what they do. National security (and often national sovereignty) depends on it.

Encryption in the hands of enemy actors

Now, let's talk about encryption in the hands of consumers and enterprises. But first, let's talk about encryption in the hands of enemy actors, like terrorists and criminals.

Terrorists and criminals often operate as part of organizations, with leadership and management structures, and rank and file members. Command and control communication critical to the operation of these entities, especially in cases where sleepers have been long embedded in target communities.

These enemy actors use encryption (and a wide array of other methods, often in combination with encryption) to keep their communications private. A terrorist strike, for example, often needs months of global coordination, resource management, and human operative movements to prepare -- and all of that often needs to be discussed across national boundaries.

Government agencies like the FBI and NSA and state and local law enforcement need to see into these communications to protect our citizens. This is done through technological methods (like decryption technology) and through very old-school methods, like infiltrating an undercover operative.

The bottom-line, though, is that terrible attacks and major crimes can be prevented by government and law enforcement by gaining visibility into communications the bad guys would like to keep hidden.

Encryption in the hands of consumers and enterprises

Next, let's move on to the subject of encryption in the hands of people like us and the companies we work for. What do we need encryption for? In a word: privacy.

At the enterprise level, we use encryption to make sure competitors can't see into our product plans and directions. We use encryption to make sure certain employees can be compartmentalized, so other employees don't leak information too soon. We use encryption to protect the organization from criminals and hackers who might try to steal corporate trade secrets or financial information.

Consumer-level encryption is where things start to take on shades of gray. Let's look at the easy aspects of consumer-level encryption first.

We want to be able to encrypt our financial transactions and Web shopping cart pages so hackers can't steal our credit cards. That's the simple, obvious, and necessary form of encryption. Generally we don't care if governments can access that data, because, really, how much does the NSA want to know if you bought another pair of shoes?

But then we get to encryption for personal protection. At the most prurient level, some folks out there want to be able to hide their tracks when they're doing inappropriate Web searches (let's say porn). But others want privacy when they're doing sensitive Web searches (let's say a search into AIDS symptoms or how to find a divorce lawyer).

Consumers need privacy for personal activities. Medical discussions, spousal abuse issues, family-related problems that they don't want to see shared far and wide on Facebook.

The key with this level of activity is that while privacy and encryption may be incredibly important, it's not something the NSA is going to want or need to track. Consumer level encryption that keeps out family members and predators will do fine to keep you safe.

But then we get to the whole dissident issue, where individuals and groups are coordinating activities and discussions under the thumb of oppressive regimes. For example, take the coordinated protects of the Arab Spring. The people participating in these protests (who are trying to change their nations) have need to communicate (and do so in a way their governments can't see). An intercepted communication could easily mean arrest and possibly execution.

Some here in the Western world would say that private, dissident communication is as necessary in America as it is in, say, Tunisia. State and local governments have different agendas than the federal government and have been known to persecute individuals based on their religious affiliations or their sexual orientation. Private, safe communication is essential to these individuals as well.

In most of these cases, good quality public-key encryption will keep most consumers safe from hackers, predators, and those who would discriminate. These issues are almost never a matter of national security concern -- unless, of course, these "weaknesses" are exploited by other nation states or terrorist organizations for nefarious purposes, in which case that is something we'll need to know to prevent serious repercussions.

My point here, though, is relatively simple: the NSA is probably not worried about your normal communications and the encryption you use for your daily activities is good enough.

There is one issue, though...

The back door problem

Back doors in code have existed since there were code systems in place. The idea is that it's possible to get back into a system when locked out by other means.

This may need to happen for a variety of reasons, from the prosaic (someone lost the master login password or authenticator) to the terrifying (bad guys got into a system and locked out legitimate users).

But back doors are, by their very nature, security risks. If a back door is available, then not only can legitimate network management get back into a system, anyone who knows how to get into the back door can use it as well.

This is particularly relevant to our discussion of NSA decryption activities because it is has been reported that various encryption vendors have enabled back doors for the NSA. I can see and understand the reason behind this practice, but in this area alone, I have to disagree with the NSA practice.

Enabling back doors levels the playing field among all players and diminishes the NSA's unique advantage at the same time. One of the reasons the NSA is able to maintain a level of intelligence unparalleled anywhere in the world is its extreme concentration of computing power and SIGINT resources. This is a barrier of entry that almost no other nation, and certainly no other terrorist group, organized crime organization, or even large enterprise can hope to pass through.

This barrier of entry has always meant that the NSA (and only the NSA) can get information that no other entity is capable of getting -- and that's how it should be. But if the NSA is "cheating" and doing deals that are embedding back doors in encryption technology, then those back doors are potentially available for anyone who finds them. And that defeats the NSA's most powerful advantage while putting many of us at greater risk.

In my opinion, the back door policy the NSA is reportedly encouraging may provide a short-term tactical advantage, but it may prove to cause us all problems in the long-term.

Other than that, don't sweat the NSA's decryption capabilities. If you're not an enemy actor, you're not going to be on their radar.

Topics: Privacy, Government, Government US, Security


David Gewirtz, Distinguished Lecturer at CBS Interactive, is an author, U.S. policy advisor, and computer scientist. He is featured in the History Channel special The President's Book of Secrets and is a member of the National Press Club.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Re: that terrible attacks and major crimes can be prevented

    Name one. Seems like every terrorist incident is an excuse for the spooks to be given ever greater powers to spy on our private lives, in order that they can prevent "the next one".

    Only they never do.
    • terror, terror

      Western governments want to meddle in Midddle East affairs for the purpose of securing energy supply. If they didn't do this meddling then there'd be less blow-back from terrorist events.

      So in some ways, the need to eavesdrop on everyone is born by the need to secure energy supply.

      But you don't have to be a wrong-doer to want encryption. How many journalists are there in the United States? They need to keep their sources confidential. Author David Gewirtz should have mentioned that, coming from CBS.

      iIf journalists can no longer keep their sources confidential, then democracy goes down the drain.
      • Can anyone provide a list of people who have been saved as a result of NSA?

        Right. Still, it's helpful to remember that when "Energy" is was considered to be a "National Security Priority", set by the Executive Office of the USA.

        At the same time, automobile manufacturers build less-efficient vehicles. We're talking about a previous administration, of course. Just Remember, Bush was an oil man, Cheney was in Oil Services and pipeline building, and Condelezza Rice was the former CEO of Chevron.

        But that said, there exists no outstanding terrorist threat that renders these programs necessary. If one can be determined (except for Dick Cheney's lesbian daughter that likely terrorized Dick's mind) it should be disclosed. Because it seems like a waste of $58,000,000,000.00

        $58,000,000,000.00 invested into renewable technology could go a longer way to ensure the next Dallas or Houston Presidential Candidate doesn't take the US into a fake war that cost TRILLIONS, along with the loss of privacy, and backdoor programs to private data.
        • Go Malcolm

          Great comment. This is what we need to see more of as we evolve through this process. We need more solution orientation. Yes there are still many that need to understand the problem and a few that don't even realize there is one, but it is solutions that will fix it all in the end.

          Yes let's stop throwing away trillions of dollars subsidizing an energy industry that is just a scam in the first place and the root of so many evils. We could have wrestled ourselves away from this ugly trap a long time ago if we had invested in viable alternatives.

          Yes, viable alternatives have been around for a long time now. The scam is that we have only been allowed to access a resource that can be argued to be scare. Perceived scarcity is the name of the game as it controls prices and profits. If we were to invest in in the many alternatives the world could change rapidly from one big matrix of lies used to suck the consumer dry to a world where is can be seen that scarcity is a hoax and that in fact there is more than enough to go around for everyone at very little cost relative to what we have now.

          We are led to focus on billionaires as if they are the rich in the world. Do it is the Trillionaire families who are the real rich. At one point the Rothchilds has an estimated net worth of between 400 and 700 trillion dollars. How about the British crown and it's Commonwealth assets. The Rockefellers and others. 99.9999999% of the world's wealth is in the hands of an elite few. There is more than enough wealth in the world to cure all hunger and poverty and most of the problems of the world.

          Of course if we changed this balance it wouldn't be very capitalistic one might argue. On the other hand one might ask if all of this wealth was acquired on a fair playing field and whether or not there is a better way. There are solutions and there always have been. There is only the problem of those who choose to keep things the way they are. For those the problems of the world, the wars, the poverty, the sickness and starvation are exactly what they want as they watch from their ivory towers. Is this what we want?
        • Please check your meds...

          Bush has been gone for a while.

          Your facts are wrong, and we have blown through a ton of money on renewable stuff, that was then sold, after taxpayers funded innovation, to Chinese businesses to build them cheaper, but alas, the article was on encryption, not a Huffington Post editorial on why you hate Bush.

          Here is what is relevant to this article, and why encryption circumvention is bad (hint: safe guards can be circumvented when bad people want to circumvent them):

      • wow the eco-extremists are out in force here

        So it's all about energy and Bush did it. LOL Thanks for the giggles. You may have noticed the US is in the midst of an energy revolution with fracking. The Middle East is fast becoming a non-starter in the realm of energy production. We have more energy than all of the put together. And if it wasn't for the do-gooders we would have limitless energy like the French, who seem to be able to maintain nuclear energy without destroying the planet. The left never ceases to amuse. The convoluted ways they find to blame Bush are simply amazing. If they put that much energy into solving the energy issues we have left we would have long ago been out of the hole those same do-gooders put us in. I'm sure ZD will find it too political to point out that your posts were political to the extreme. Just like the singled out the poor homosexuals who lose their jobs and ignore the oppression of the PC Police in this country which throws it's weight around like a drunken elephant squashing dissent everywhere it stumbles. Let's talk about Chick Fil A for a second. And that's just the tip of the iceberg. It's conservatives that should fear the long arm of the oppressor government which openly persecutes the Tea Party and anyone that thinks we should live by the constitution. When "journalists" slant the news in this way I lose concern for their protections under the constitution because they deliberately try to take my protections away. From campaigns to limit internet journalism to such far flung issues as gun rights and the right to operate inside your moral code even though it violates the PC Precepts like support for abortion and government sponsored birth control.

        One day, like all left wing groups, a lot of people will wake up and discover they backed the forces of oppression. From the Night Of The Long Knives to the Occupiers support for radical leftists has always been a losing proposition. I'm not opposed to government through the prescribed process. It's the left that ignores niggling little laws the way Obama does when he uses a cabinet rule in place of a congressional law when he knows he has no chance of getting that law through Congress. And I'll never forget the " you need to pass it to find out what's in it" Obamacare disaster. When that comes into full enforcement very few people will not realize what a mistake they made. They're well on their way with this whole Syria affair. That long time hawk, John Kerry, is leading us down the primrose path to WWIII or he's trying to. I wonder when soldiers stopped being monsters of oppression and started being agents of good. Maybe we should ask Kerry. He seems to know something the rest of us haven't been told. He was so keen to declare our soldiers baby killers and the rest of the garbage the communists in Vietnam told him to say I really must know when those soldiers became angels. It must have been recent because after all Mr. Kerry voted not to fund the war he voted to start.

        Now how about let's discuss technology and not your radical politics? Or is your sole purpose in life to support the groups that have attacked us. When you implied that was our fault you lost me. Less blow back??? By that you mean 9/11, correct?
    • Agreed, the whole article is full of logical fallacy.

      First of all. Only stupid and naive attackers would use commercial encryption which is deflatable by the kind of brute force that NSA computing could bring to bear. A terrorist cell who employs sleepers would either use tried and true old school spy tactics such as dead drops which require manpower and extensive surveillance to defeat. OR they would use one time pads. For example it is possible to create a DVD filled with 4GB of random noise generated by timing the gamma impingement from a cesium pellet. Such a DVD can be duplicated and distributed to the cell via a dead drop. Then you have a one time pad. Now you can generate totally unbreakable encrypted messages and pass them openly over the internet, and you could even CC the NSA on the message with a big F&&k You and they would not be able to read the contents. So the only people who the NSA could benefit from this ability to break normal internet encryption is the typical law abiding but possibly dissident citizen.
      • All mainstream media is a fallacy

        We were told that Osama Bin Laden planned 911 by passing notes in between caves because he knew that he was being monitored. That was a long time ago. Isn’t it logical to assume that everyone has known this for a long time now – aside from the innocent general public (currently being monitored). Doesn’t that tend to negate the investment made in the NSA and other such agencies whose names we haven’t even heard of before?

        If Osama can arrange such a massive effort such as 911, which includes shutting down NORAD all morning, with couriers then why haven’t we seen more such events, given this is all possible without using the methods so expensively used by our monitoring agencies.

        The NSA was around long before 911 and is it realistic to believe that they didn’t even get a whiff of what was about to transpire on 911? If they did not then couriers are a functional system and it invalidates the need for the NSA all-together.
      • Like your reasoning, but what about...

        vulnerabilities introduced (through NSA strong arm tactics) into commonly used encryption algorithms themselves? It is one thing to talk about back doors into commercial hardware or software; it's another to imagine that TrueCrypt (for example) has some kind of secret access built in because the NSA threatened the TrueCrypt Foundation with one of the many versions of blackmail/execution which the most powerful govt. in the history of the human race is capable of.* I assume your reply will be something like, "It's open source." I believe the algorithms are (at least some of them), but by the same token, the NSA has resources to find problems that no one else can, and when they find them, they definitely aren't telling. My point? One time pads work, until they don't work. And then there's quantum computing, which has the potential to blow encryption up like an atom bomb.

        There are a number of ways to address the issues both of us have raised, but they all come down fundamentally to "trust". Can we trust our government? Are we electing/hiring trustworthy people? Can WE be trusted?? If we as a population are lying/stealing/cheating each other, we will tend to vote for people ... like us.

        *Would the NSA knowingly provide corrupt politicians with the info they need to make their partisan enemies "go away" in untraceable fashion? Here's how to answer that: say "... I COMPLETELY TRUST that the NSA would never violate my constitutional rights" out load 3 times. And your answer is?
    • Encryption: It’s Not Just for Criminals Anymore

      The reason you cannot name one is because disclosure of government success in exterminating terrorists would reduce future successes.
      --- David had it right when he said - "If the NSA is "cheating" and doing deals that are embedding back doors in encryption technology, then those back doors are potentially available for anyone who finds them. And that defeats the NSA's most powerful advantage while putting many of us at greater risk.
      ---You might say David, that I preemptively agreed with you back in February this year (2013), when I wrote - "Those very same back-doors can be hacked by hostile foreign countries or criminal elements, and then used to spy on every level of the government that installed those back-doors. The very real potential for espionage raises the stakes even higher when back-door spy mechanisms are seized by either foreign governments or corporate hackers to gain advantage on either military operations, or commercial product developments by stealing information worth billions of dollars, or worth winning or losing in military conflicts."
      Paul B. Wordman
      • Re: disclosure of government success in exterminating terrorists would redu

        Funny, we don't claim that for any conventional kind of crime, that disclosure of successful court prosecutions and criminal sentences would reduce future policing successes. On the contrary, we argue that justice must be seen to be done.

        What is so special about terrorists? Are they some breed of super-villain, that requires special super-heroes operating under secret super-laws, superseding accepted traditions of justice, to fight them?
        • Remember Coventry?

          During World War II the British government learned, from an intercepted German bombing order, that the Luftwaffe was going to bomb the village of Coventry, which they had never bombed before. The RAF could have had fighters waiting for them sooner than they would have, just operating on radar detection. But that would have indirectly told the Luftwaffe, "We have your codes!" So Churchill made the grievous decision not to give Coventry extraordinary protection, and tragically, many innocent lives were lost. But many more innocent lives were saved by the decision not to throw away the big advantage of having cracked the Enigma cipher.

          When we prosecute and convict, and publicly expose the conviction, of ordinary criminals, there is no exposure of SECRET advantages the police had in detecting the crime. Of course, there are exceptional cases such as an informant in the "mob" from whom the plans for an operation were obtained, and so the informant is made to "disappear" in Witness Protection, but for the most part, there is no giveaway of how the police cracked the case.

          In dealing with either a foreign state (in the above example, Germany) or large organization (such as Al Qaeda or the IRA) that still has power to commit other hostile acts, revealing too much about advance knowledge (the only kind that can prevent, as opposed to prosecute, a terrorist attack) would ruin the ability to use that advance knowledge to prevent the NEXT attack.

          That said, I believe we need more scrutiny of the "by-products" of intelligence used to fight terrorism, by an IMPARTIAL part of the government. If, for example, in the process of foiling an attack on the Los Angeles water supply by Al Qaeda, the NSA accidentally learns of an unrelated crime by an unrelated perpetrator (for example, a confession by some celebrity that he killed his wife), it should be illegal, because of our Constitution, to use that information to arrest and prosecute him for that crime. Let the police find out in their own way that he is guilty, and destroy all irrelevant data after saving the water works. And of course it goes without saying that any NSA or other government employee using monitored information for personal, political, business or criminal purposes (such as when J. Edgar Hoover called Desi Arnaz to congratulate him on Lucille Ball's pregnancy BEFORE Lucille had the chance to call her husband herself, just to brag about his spy apparatus), should be subject to prosecution. If the public sees some of THOSE prosecutions, they will be reassured that "bycatch" of their personal information in the intelligence "dragnet" will be thrown back, and any official or employee that does not is subject to legal action.
          • Re: Remember Coventry?

            What exactly are you trying to say? What's the equivalent of Coventry? Was it the September 11 attacks? Are you saying the NSA has been breaking Al-Qaeda's codes all along, and knew about September 11 before it happened, but couldn't let on because it would show their hand? If not, then what did you mean?

            The claim made was that terrorist attacks ARE being prevented, it's just that the general public cannot be allowed to know about them. Which doesn't make any sense, because the terrorists certainly know their attacks are being prevented, and are already taking any necessary action in response, so why shouldn't we be told?
        • Not the same

          Criminal prosecution rarely involves the breaking of high-level encryption used by terrorists or enemy nation-states. There is no comparison between the common criminal and the world-wide organization that has vowed to destroy you.
  • marketing opportunity

    I would think the logical progression is that there will be a market for OPEN SOURCE encryption software, apps that support large keys that mathematically defeat brute force attacks. Suddenly open source has a HUGE advantage.
    • Open source encryption market not huge

      If there is a huge market for it, why hasn't PGP taken over the world of communications? It has been available for a very long time.
      • RE: Open source encryption market not huge

        My point is that, whatever that market share was, I suspect it will go up significantly after this week's revelations.
        • People are lazy

          PGP (and its open source sibling, GPG) hasn't taken off because to be useful it requires all parties involved to create and exchange keys, encrypt and sign each message, etc. Of all the people I correspond with, I'm the only one who knows how to use it, or is interested in knowing. At least two of my regular correspondents would simply quit using email if they had to use encryption software. They don't want to be bothered to learn or go through the hassle of using it.
          • RE: People are lazy

            I looked at years ago and came to the same was too difficult to implement / use. And I wasn't even trying to hide anything. But if it was MUCH simpler, like enabling it as an option, I would do it just to spite the NSA. And I suspect I'm not alone. Hense my original point...maybe a marketing opportunity here...
  • Heads up

    If you are doing things at work, such as accessing your bank account, they are being intercepted and are NOT private. Don't kid yourself, nothing you do at any big corporate entity is private. Not on their PC, not on your PC, or on their network, on a smartphone or tablet.

    Do all your personal stuff at home or away from the office on your own device. Personally I use a separate PC or VM for all banking etc. than I use for other activities on the Internet.