Senators Richard Burr from North Carolina and Dianne Feinstein from California, who are the Republican and Democratic leaders of the Senate Intelligence Committee, have been crafting an anti-encryption bill over the past few months. The bill recently came out in "discussion draft" form. Perhaps not unexpectedly, many security experts are reacting negatively to it.
Compelling Companies, Developers To Decrypt
The gist of the bill, called Compliance with Court Orders Act of 2016, requires “the provision of data in an intelligible format to a government pursuant to a court order, and for other purposes.” It’s not clear what the bill means by “other purposes” here, but it may refer to non-judicial orders, such as National Security Letters, which can be handed to companies by the FBI alone with no judicial oversight.
The bill refers to “covered entities,” which include device manufacturers, software manufacturers, wire or electronic communication service providers, providers of remote computing services, or “any person who provides a product or method to facilitate a communication or the processing or storage of data.”
The last part sounds as if the bill would affect open source developers, as well as companies such as Spideroak or Lastpass, which only store end-to-end encrypted data.
Contradictory Language
The bill contradicts itself somewhat as well, as it also contains language such as:
“Nothing in this act may be construed to authorize any government officer to require or prohibit any specific design or operating system to be adopted by any covered entity.”
This part may have been written to refer to a situation such as the one where the FBI intended to compel Apple to create a “GovtOS,” as the company called it. However, it also means that the government shouldn’t be able to ban end-to-end encrypted systems, even if that means the companies won’t be able to assist in decrypting them. The companies should be free to design whatever systems they wish, including end-to-end encrypted ones.
The problem is this is not as clear-cut as the language that says companies must provide the data in an intelligible form to authorities. In practice, the government would likely be successful most of the time in convincing companies and even judges to order the decryption of devices and communications. That’s because it’s likely that not all companies will posses the legal know-how or the willpower to fight the government over some murky language in the bill.
It’s likely that the language of the bill here would change by the time it reaches President Obama, so these confusions may be “fixed.” The President recently said that he wouldn't publicly endorse the bill, but he also didn’t say whether he would veto it or not. He doesn’t have a long record of vetoing bills, so if it passes the House and Senate with a strong majority (even below the 66% veto-proof majority), he would probably sign it.
To make things even more confusing, the bill doesn’t specify any penalties for companies that refuse to follow the orders, although it’s possible that the companies could still be held in contempt of the Court, so this may differ from one judge to another. What this shows is that the bill wasn’t very well-thought out so far, and if you believe the vast majority of security experts, nothing in the bill was.
Security Experts React
Security experts that have been following the “Crypto War II,” as they tend to call it, have come out strongly against the bill, warning about all the dangers to which it would expose Americans.
Matt Blaze, a cryptography and security professor at the University of Pennsylvania, participated in the first Crypto War when he spoke out against the government’s creation of the Clipper Chip. He recently wrote a paper called “Keys Under Doormats” where he talked about why encryption backdoors and master keys are bad. He now also summarized what the bill would mean for U.S. tech companies in a couple of tweets:
Jonathan Zdziarski, iOS forensics and security expert, wrote an entire blog post about why the bill is, as he called it, “a hodgepodge of technical ineptitude combined with pockets of contradiction.”
“Its broad wording allows the government to hold virtually anyone responsible for what a user might do with encryption. A good parallel to this would be holding a vehicle manufacturer responsible for a customer that drives into a crowd. Only it’s much worse: The proposed legislation would allow the tire manufacturer, as well as the scientists who invented the tires, to be held liable as well,” Zdziarski wrote.“Due to the backdooring of encryption that this legislation implies, American electronics will be dangerously unsafe compared to foreign versions of the same product. Diplomats, CEOs, scientists, researchers, politicians, and government employees are just a few of the people whose data will be targeted by foreign governments and hackers both while traveling, but also whenever they’re connected to a network,” he added.
This comment is interesting, because Senator Feinstein was the de facto champion of the “Cyber-Patriot Act” bill called CISA, and the reason she was for it was “cybersecurity.” Yet, the new bill she proposed seems to attack cybersecurity in the U.S. at its core. It’s not clear why the Senator, who was the Senate Intelligence Committee head until 2014, can’t see just how contradictory in their goals the two bills really are.
Matthew Green, cryptography professor at Johns Hopkins University, who recently released a paper on why iMessage’s encryption is fundamentally broken, also criticized the bill for its naivety and broadness:
Kevin Bankston, the Director of Open Technology Institute (OTI), also pointed out on Twitter that the bill could also affect even things it may not have intended to affect, such as forward secrecy in TLS encryption.
Forward secrecy, which is essentially a short-term private key rotation for site traffic encryption, began gaining ground after the Snowden revelations, when big companies used it as protection against government hacking. State-sponsored hackers could eventually break into big companies’ servers and get their encryption keys, which is why it was important to rotate the keys as often as possible.
OTI also released an official statement saying that the bill could enable censorship of secure apps on the web and on mobile platforms as well:
"Not only does this bill undermine our security, it is also a massive Internet censorship bill, demanding that online platforms like Apple’s App Store and the Google Play Store police their platforms to stop the distribution of secure apps. Of course, just as the bill fails to explain how security engineers are supposed to keep our data secure while also making it completely available to the government on request, it also offers no clue as to how online providers are supposed to comprehensively audit and censor every app on the Internet," the statement said.
The Compliance with Court Orders Act of 2016 bill is only a draft so far, but it seems the two co-sponsors, Senators Richard Burr and Dianne Feinstein, haven’t asked too many cryptographers for their opinion on this. The bill may still change after seeing the criticism of many security experts, but its very existence and the idea of compelled decryption on which it is based probably means that the Senators aren’t going to like what they hear from the experts, either.
While the two Senators are trying to pass this anti-encryption bill in the Senate, California (Feinstein's own state) is trying to pass its own state-level anti-encryption bill, as well. The EFF has issued a call to action against it.
Lucian Armasu is a Contributing Writer for Tom's Hardware. You can follow him at @lucian_armasu.
