Showing posts with label snowden. Show all posts
Showing posts with label snowden. Show all posts

Monday, January 02, 2017

Encryption is not the answer

Veering back into the real issues... those we can still hope to steer. Let's start with a cool, fun interview: I answer questions about Artificial Intelligence (AI) and why it is possible that these new, genius offspring of humanity may decide not to treat us badly.

== Snowden and surveillance ==


Matt Novik really tears into Edward Snowden, exaggerating a bit, but raising good points.  My own complaint is more nuanced: that while Snowden did a service by forcing us to converse more vigorously about surveillance, he has since contributed very little to solutions. Sure, he’s joi
ned with thousands of other paladins-for-freedom by pointing at various Orwellian traces and signs, yelling “Lo! Big Brother looms!”  

But then, his prescriptions tend to be the same, lame-arm-waved appeals for technological miracles and hiding from elites.

Look, I send money to the EFF and ACLU and I love that they are out there, yelling! But it’s also frustrating, because not one of these heroes ever explains how hiding from authorities is even remotely possible, over the long run. There are no examples from the history of our species when the blinding of all elites was accomplished by average people. Not one. 

What Snowden and his fellow paladins offer, when challenged, is vague assurances that encryption will take care of it. 


Ooh, a magic word! As if each decade’s ciphers aren’t child’s play to the next decade’s crackers. As if supposedly secure systems don’t topple every day. As if human error doesn't always offer a way in, even when there aren't trap- or backdoors, (And there almost always are.) 

As if the average Joe or Jane can sleep well, knowing for a fact that others don’t know something – an epistemologically crazy and unverifiable notion.

Alas, not one of these brave dreamers has apparently read the history of cat-and-mouse oppression by secret police, dating back to Hamurabi. There are standard Gestapo-Okrhana-Stazi tactics and only three or four - out of a dozen - categories, would be even slightly inconvenienced by crypto stuff.


You know where this is going.  There is only one method that will work, that can work.  That has worked, and it is not hiding from elites.  It is not depending on an epistemologically impossible reassurance that others do not know something. It depends on us knowing, maximally, and - in aggregate - supervising all elites. Because if we cannot verify what they know, at least we can watch and know what they do. 


As I discussed in: The Transparent Society: Will Technology Make Us Choose Between Privacy and Freedom?


== Algorithms that lobotomize us? ==

From The World Post:  “Wael Ghonim is the internet activist who helped spawn the Arab Spring in Egypt with his Facebook posts. During those heady days in Cairo, as he explains in an interview with The WorldPost, Ghonim came to realize that, "the algorithmic structure of social media amplified and abetted the turn to mobocracy" because it is designed to bring together those with common passions and sympathies irrespective of whether the information they share is truth, rumor or lies.


In our present moment, says Ghonim, "Donald Trump is the living example of the damage mobocratic algorithms can do to the democratic process." The challenge has thus shifted, he says. "While once social media was seen as a liberating means to speak truth to power," Ghonim argues, "now the issue is how to speak truth to social media."

Since "people will be as shallow as platforms allow them to be," he explains, Ghonim proposes that the big social media companies focus on creating a "meritocratic algorithm" that rewards credible information and dialogue, not just the broadcast of "sensational content" to the like-minded. See his TED Talk: Let's design social media that drives real change.


== More warnings ==

Mark Anderson's Strategic News Service (9/2016) carried a frightening warning: Is The Internet at Risk? from Jeff Hudson, the CEO of Venafi, the inventor of The Immune System for the Internet™.  Dig the following excerpt:


“We have proof that the algorithms used in encryption are not perfect, and as they age they become more vulnerable to hacking and attacks. The MD5 hash algorithm was used for a number of years before subsequently being cracked. SHA-1 is another algorithm that is in wide use and was recently judged to be vulnerable. 

"Attacks such as Heartbleed, DROWN, and FLAME all prove that encryption programs, techniques, and algorithms are not perfect; given enough time and computing resource, many popular encryption tools can be compromised. The logic here is inescapable: Trust is created by establishing tunnels. Tunnels are created by using certificates. Certificates rely on encryption. 

“Encryption is accomplished using an algorithm, or a program, that has been written to create a key that can be used by both ends of the tunnel to communicate in private. These algorithms are designed to create encryption keys that are difficult to reverse-engineer. The most widely used algorithm is called the RSA algorithm. Named after its creators - Rivest, Shamir, and Adelman - the RSA algorithm was patented in 1983.


“Most encryption uses the RSA algorithm. Therefore, maximum accumulation of digital trust is based on the RSA algorithm, but we know that no algorithm is perfect. All will fail at some point.


"To date, the encryption vulnerabilities that have been discovered have been remedied in a number of ways. Most involve introducing the next, more secure generation of encryption algorithms. There are two factors affecting encryption software that have changed recently. First, the amount and cost of computing resource available to apply to compromising programs has increased almost exponentially. This means that many more people today have access to the same capability that was available only to the NSA and other similarly talented and funded organizations just five years ago. Second, quantum computing is getting closer to being useful in compromising encryption.


"Couple these facts with an order-of-magnitude greater use of tunnels and encryption, an exponentially greater amount of valuable data in the digital economy, and our collective reliance on the Internet to maintain a functioning society, and we have a very critical situation.


"If - or, with a high degree of certainty, when - this happens, it will mean that uniformly across the Internet nothing can be trusted. Everything will be vulnerable to attack. Then what happens?


"Financial transactions will be put at risk. The monetary system will begin to fail.

Transportation will slow to a crawl.
Health and safety systems will be taken offline.
Communications systems will be disrupted.
Power availability will be intermittent, at best.
Emergency response will fail.
Government and law enforcement will function in only the most rudimentary ways.
In major metro areas, severe food shortages will begin within three days.
Water stops flowing.
It will be deadly serious."

== You can't fight what's coming ==


A  Berlin-based hacker-artist unveiled his scariest work -- an entirely boring-looking Hewlett Packard printer that also secretly functions as a rogue GSM cell base station, tricking your phone into connecting to it rather than your phone carrier’s tower, effectively intercepting your calls and text messages.  … Since it sits indoors near its victims, Oliver says it can easily overpower the signal of real, outdoor cell towers. But instead of spying, the printer merely starts a text message conversation with the phone, pretending to be an unidentified contact with a generic message like “Come over when you’re ready,” or the more playful “I’m printing the details for you now.”


“Security contractors recently discovered preinstalled software in some Android phones that monitors where users go, whom they talk to and what they write in text messages. The American authorities say it is not clear whether this represents secretive data mining for advertising purposes or a Chinese government effort to collect intelligence.” -- from The New York Times.


It’s been called “Brin’s Corollary.” That cameras get smaller, faster, better, cheaper, more mobile and numerous at rates faster than Moore’s Law.  Now meet the Piccolissimo -- the world’s smallest self-powered controllable drone. It comes in two sizes, a quarter-sized one weighing less than 2.5 grams and a larger, steerable one that’s heavier by 2 grams and wider by a centimeter (.39 inches). As brought to you earlier by sci fi (including my own.)


Ban this?  Hide from them?  Yeah. Right. There is another way.


And then there is...  More deeply perceptive than today’s crude polygraph “lie detectors,” fMRI (functional magnetic resonance imaging) can zero in on the brain’s decision-making centers, appearing to achieve 90% accuracy at nailing falsehoods… though I’d lover to see the results with sociopaths. A combo approach had a perfect score. Though fMRI requires lots of infrastructure and cooperation by the subject.  


The crux? We will not resist tyranny by lying. The elites who get this power must be subjected to it!


Wednesday, April 16, 2014

How to regain trust in the NSA era: The IGUS Gambit

How might the Obama Administration best respond to wave after wave of "NSA revelations" that roil and cloud the political waters?

NSA-Snowden-AssangeIronically, almost none of Edward Snowden's leaks -- or those of Julian Assange -- revealed anything that was illegal per se. What they have done is stir a too-long delayed argument over what should be legal!  Specifically, the Patriot Act and the ratchet effect on surveillance that always happens when a country enters a state of panic. The post-9/11 alarm is finally fading and -- (barring some new, panic-inducing event) -- elements of the Patriot Act and pervasive surveillance are now up for public debate.

See page 206* of The Transparent Society: Will Technology Force us to Choose between Privacy and Freedom? (1997) -- where this cycle of terrorism and increased government surveillance was predicted in precise -- and rather creepy -- detail.

NSA-WATCHING-WATCHERS Elsewhere, I recently dissected and appraised the forty-two suggested reforms that a commission presented to President Obama, many of which he has instituted or sent to Congress. Here I want to focus on one important, trust-building measure that would make a huge difference.


= Meeting the needs of the Public and the PPC =

As expected, most of the current argument is about the wrong side of the issue -- mewling plaints calling to prevent society's elites (like the NSA or Google) from seeing -- an effort that is fated to be futile, condemned to absurdity by Moore's Law.

But at last there is talk also of doing what will work -- improving the degree to which the citizenry can supervise and have confidence that government remains essentially a servant of the people.

The main sticking point is over the need that members of the Professional Protector Caste (PPC) have for tactical secrecy, or the ability to conceal their operations from villains and adversaries.   This need is very strong, but so is that of citizens to feel assured that secrecy remains only tactical, short-term and pragmatic, never an excuse for permanent avoidance of accountability.

INSPECTOR-GENERAL-UNITED-STATESI have over the years offered several innovations that might achieve a win-win -- securing both tactical shadows for the PPC to be effective, while ensuring accountability that at least partially reassures the public. Foremost among these proposals would be to create the Office of Inspector General of the United States (IGUS).

IGUS could be established with a one-page law that simply transfers all of the inspectors general in every agency and department to an independent service under a figure of noted rectitude, whose staff might then perform their functions without the inherent conflict of interest that stymies so many IGs. IGUS members would be trained in both confidentiality and prim skepticism on the taxpayers' behalf, allowing PPC agencies to continue tactically secret investigations, but always with the peoples' delegated gaze over their shoulders.

NSA-Citizen-OversightA POLITICAL WIN-WIN: 
Without question, proposing and establishing IGUS would be an agile jiu-jitsu move on the part of the Obama Administration. It would simultaneously say:

"We understand that public confidence is shaken and this move should help to restore it while preventing the worst and most perniciously chronic abuses… while at the same time allowing our skilled public protectors to continue doing their important jobs. It is also the quickest way to do this, requiring the fewest changes in law."

Will this satisfy everybody? Of course not… nor should it! Indeed, I do not consider IGUS to be enough. I have several more proposals that would work in parallel with IGUS, so that in-sum we all can truly be sure that our watch dogs remain loyal (if fierce) dogs, and never wolves.

inspectors-GeneralNevertheless, establishing an Office of the Inspector General of the United States would be a good start. And it would allow the Administration to be seen acting vigorously, in a forward, pro-active direction that BOTH enhances public trust and allows our agencies to do their jobs.

My IGUS proposal was written in greater detail as one of two dozen "Suggestions for the Incoming Obama Administration" way back in 2008. Alas, not one of them got to anyone's ear. C'est la vie.

Still, you can read about it here: Free the Inspectors General!


== Political Miscellany ==

Lying with Data: Fox viewers in the family? Show them this chart that appeared on their news” network and ask if they can explain why almost no American scientists are republican, anymore.  See this appraisal, also: The Statisticians at Fox News use classic and novel graphical techniques to lead with data. 


Transparent-Society-206*Page 206 of The Transparent Society: Will Technology Force us to choose between Privacy and Freedom?