I don't think anything in the bill requires a provider to keep around copies of information they don't already keep. They need to be able to provide access contemporaneously with transmission (i.e. basically a wiretap), or if they have stored it or can access it on the device.

If you receive a sealed letter and the police get a warrant, they can search your drawer and open that letter. If you have a private conversation with someone, a prosecutor can subpoena that person and force them to testify about what you told them.

I'm amenable to the argument that the law shouldn't stand in the way of progress; it's possible to communicate much more securely now than it ever was in the past and the law shouldn't stand in the way of people taking advantage of those advances. But the bill isn't "regressive"--it's attempting to maintain powers the police already have with traditional means of communication.

Password hashes, if this were to become law then you'd have to store them in clear text or encrypt them with a controlled key. You frequently see that sort of practice turn up in massive security breaches. Also, homomorphic databases are out - you can't provide a service without being able to deliver plaintext to the state. So no decentralized security, you'd be forced to choose, during the handshake, between clear text or a CA model that offers no protection from state level attackers - which is no coincidence.

> But the bill isn't "regressive"--it's attempting to maintain...

Device manufacturers are covered. So even if it is unrelated to an ongoing service, it is still required to render assistance in compromising the product. That is regressive. And I've only mentioned the primary impact, this thing would make the manufacture of end user serviced devices economically impossible.

Unless we had a less horrible alternative... what if manufacturers where offered the alternative of installing a key escrow chip? I could swear that I've heard that idea proposed before.

Edit:

I forgot to include software developers, so let your imagination run over that. That bitlocker feature offered by Microsoft? That is covered.

> So even if it is unrelated to an ongoing service, it is still required to render assistance in compromising the product. That is regressive.

"Regressive" means stepping backward from the status quo. The government can already compel your bank to drill your safe deposit box; it can subpoena your accountant to spill the beans on the complex financial transactions he arranged for you; etc. Compelling assistance from tech companies might be a bad idea, but it's an extension of the status quo.

That isn't what I said or what I addressed. You said "...keep around copies of information they don't already keep.", that isn't true - for the reasons I previously explained. It isn't restricted to "communications", it is for any stored data - if you get it in plain text then you are required to render on demand in plain text. You are not allowed to use forward security as a feature of your product.

> "Regressive" means stepping backward from the status quo.

I know what the word means, you've misused it. The USG making it illegal to render information unusable to them for some theoretical future investigation is not the status quo. That logic would make manufacture of paper shredders illegal.

Signal by Whisper Systems is intended to work in such a way that a subpoena for someone's chat logs would be useless because there's nothing useful to subpoena. They cannot access the keys necessary to decrypt.

Assume for the sake of argument that they've achieved their goal from a technical standpoint. As a result they are unable to comply with subsection (a); they cannot provide the unencrypted information, and no amount of technical assistance on their behalf would allow them to do so.

Section 3. (c) "License Distributors" would appear to prohibit Apple from making the app available in its app store.

If the FBI can legally compel Apple to produce a backdoored firmware for their phones, they can also compel Open Whisper Systems to produce a backdoored version of the Signal app to intercept all plaintext on the client side. Since almost everybody has automatic updates turned on, they won't even need to find a way to push the rogue version to the target's device.

Every service that relies on a vendor-provided app is open to this kind of "technical assistance". Ditto for any webapp that relies on vendor-provided JavaScript crypto libraries. The vendor can "technically assist" themselves at any time to gain surveillance capabilities they previously did not have.

The analogy is that anybody who intercepts and stores encrypted communication data, has a kind of Schrodinger's Cat photo-copied letter.

If at some later date they acquire the encryption key, then they have a photo-copied letter never intended for them.

If they don't acquire the key, they don't have a letter.

(Or perhaps they still do 'have a letter' they just can't read it, that's kind of a metaphysical question)

I recently watched the first season of The X-Files, circa 1993. Someone kidnaps Scully. Mulder traces the kidnapper's call to Scully's cell phone, which as a cell phone was then considered impossible to locate. The protagonists repeatedly bought airline tickets with cash under assumed names to avoid government surveillance. Mulder is at one point punished by being assigned to transcribe many hours of audio surveillance.

That was the state of the art not so long ago. There was no CALEA. Surveillance was an extremely labor intensive process. Mass surveillance was unfathomable. There was no after-the-fact record of the contents of realtime communications.

You either had a warrant ahead of time and planted a bug in the suspect's house and paid for many overtime hours for agents to sit in a van listening to the suspect talk, or everything the suspect said was gone as soon as they closed their mouth.

And there is still nothing that stops them from doing exactly that. Except now the bug is smaller and less expensive and they don't need a van to be in range of the transmitter and there is software to do the audio transcription and other software that will convert an audio recording of key presses into the text of the key presses and on and on.

People could encrypt 100% of everything in the world and the police would still be a thousand light years in front of where they were back then.

If this "maintenance of traditional powers" argument is to mean anything then it has to go both ways. It can't be that technologies that make privacy invasion easier are allowed and technologies that make it harder are prohibited. And it seems like it would make a lot more sense to let both citizens and police-with-a-warrant use whatever technology each can devise rather than hampering both to the detriment of everyone in an attempt to artificially maintain some largely subjective measure of balance.

This is broad-scope. It would compel encryption providers to maintain a master key to decrypt all traffic running through them. A single security incident with one of those providers would be enough to compromise the data of every customer. Communications providers to large American businesses with foreign competition would immediately become incredibly high value targets for bad actors.

If that's the case, then it's ridiculous and it appears nobody in the U.S. Government has learned from history. When they did this with export controls on encryption the only people overseas who had access to proper encryption were those who were outside the law, and those who developed encryption in countries that don't have restrictions.

Of course, I may not be following what is meant by "technical assistance". However, if such a term doesn't mean implementing a backdoor, then if unbreakable encryption is implemented then it won't matter how much technical assistance is rendered by U.S. companies, nothing will have been achieved except wasting a lot of company dollars on a futile effort!

1. Surveillance tech advancement will guarantee that in the future there will be even more of it, cheaper and more accessible through search and machine learning analysis; even if you don't use the internet, your face is still recorded on surveillance cameras, your financial transactions reported, and so on. Even if your state does not do internal surveillance, various companies and foreign states will.

2. The nature of social networks makes it very very expensive to maintain communication private, and in some cases impossible. Even if you use Tor, you still can't post on your regular FB page, or connect to any of your online accounts without disclosing your identity

3. They still can't stop people from communicating in secret, especially with a combination of steganography and cryptography, but that will be increasingly more difficult

4. People will increasingly self censure, with devastating effects on the balance between political class and the rest of society

So it's a defiant march of technology, nothing can stop it at this point. Privacy is dead, it died around year 2000 with the apparition of digital cameras, mobile phones and huge data centers.

I think part of the solution will require that we create new social standards around privacy and tolerance for various indiscretions we will do inevitably. Otherwise, it will be worse than the inquisition. Everyone watching you, all your actions judged by the mob or the powerful, blackmail material for everyone.

If you are a bank with a lock box, are you required to have a key to a safe that a customer installs inside the lock box to store their valuables? Of course, a court can order you to give what you have but how can they order you to give them something you don't have?

And yes, courts regularly order banks to drill into their safe deposit boxes.

Hardware manufacturers as well. Say goodbye to bios passwords, hard drive smart locks, SSD encryption that permits instant formats and the only way to ensure that bad blocks don't leak your data to ebay buyers.

If multi-billion dollar companies were mandated to spend their development efforts on ineffective, insecure cryptographic systems, do you think that would be a positive or negative thing in terms of the availability and proliferation of the kind of effective and secure cryptographic systems that 'customers use themselves'?

Also, if you have a letter, you can discard of it as you see fit, and the information therein vanishes into the aether. This agency is removed when we move into the realm of bits over digital networks, where information can be copied and retained without one's authorization.

The agency to discard of the letter as you see fit, at a time of your choosing is in effect restored through the use of strong cryptography.

If you have a private conversation with someone, a prosecutor can subpoena that person and force them to testify about what you told them.

Having an unauthorized recording of an event, and asking someone to recount an event are very different things.

attempting to maintain powers

It's not about the 'police maintaining powers they already have' because the situations are different. If the situations were the same, the powers would be the same, and this conversation wouldn't exist.

The situations may seem similar to you, because we make sense of the world through analogy, but there are important differences.

The essentially instant and infinite nature of bits and digital data allows for all those 'warrants' and 'subpoenas' to be 'served' before they have even seen a judicial system. I.e. governments can suck up all the 'locked' data into giant 'pre-crime' databases. Or, require that communication networks retain data, when it's not already happening as a matter of course.

If governments are then given the key to that locked data they essentially have a time machine to attempt to dredge up any evidence, or whatever they want from people's personal effects.

There's nothing similar about that to anything. Nothing like that has ever existed in the history of the world.

So we have a new situation, and with it a new choice to make. This choice requires we ask ourselves, Do we want to lean towards tyranny or lean towards liberty?

Terms like 'progress' are relative and subjective, but still useful when there is mutual understanding. What is being progressed towards? A freer society with less potential for government overreach and tyrannical actions.

So in that case, yes this bill is regressive.

And, that's just one aspect of what makes this bill objectionable, and frankly, retarded.

Anyone with an inkling of how the modern economy works and it's reliance on cryptography, knows that this bill is ridiculous.

The simple matter is that you can't have modern strong cryptography with 'backdoors,' or whatever doors. It doesn't exist, it never will, the two are mutually exclusive. And further, the cryptography genie is not going back in the bottle, that is just as inconceivable. So it would be best for everyone if governments educated themselves on these matters and stopped wasting everyone's time and money on this.

You seem strangely narrowly focused on that. Who really cares about that? That is a point of minor interest.

The big issue at hand is this bill is attempting to coin some Orwellian doublespeak in mandating that there exist some secure cryptographic communication channels, with 'backdoors.'

That's a logical impossibility. That can't exist, it is either one or the other.

>but I don't read anything in there that precludes a service provider that doesn't store a history of users' communications.

Precludes from what?

But once again the data storage thing is a red herring, who cares, governments are not lacking in collected data. The fact that some of that data is now the form of secret codes bothers some in the government, but rendering the secret code making tools ineffective is not going to make the world a better place.

Quite clearly, you have lawerly skills, but that was a dirty trick.

It would be nice if you attempted to address the issue head on. Or, concede.

As important as these discussions tend to seem to us at the time, they are in fact awfully boring HN threads, because for the most part they're just nerds competing to see who can agree harder.

There is no intelligence oversight in the U.S. The intelligence agencies seem to be running the Senate, or at least the Senate Intelligence Committee.

https://en.wikipedia.org/wiki/Postal_censorship

When they realize people can talk to each other in private, they will surely outlaw private space.