Who's right on crypto: An American prosecutor or a Lebanese coder?
District attorney and encrypted chat app dev sound off on privacy
The developer's case
On the flipside of this argument sits Nadim Kobeissi, a programmer born and raised in Beirut, and now lives in Paris.
Kobeissi developed the secure, open-source chat tool Cryptocat and as a result has been the focus of a lot of attention following the recent Paris attacks. "In light of the recent terrorist attacks, things are getting heated for the regular security and encryption software developer. Being one myself, I've been on the receiving end of a small avalanche of requests from journalists, political pundits, and even law enforcement."
Kobeissi has had a diametrically opposite experience to that of district attorney Cyrus Vance, and he's written about his perspective in a personal blog post.
Where Vance's job is to lock up criminals, Kobeissi recalls how his home in Beirut was demolished in a bombing attack because his family happened to live close to the headquarters of a wing of the militant group Hezbollah.
"While walking through a field of rubble and unexploded cluster bombs to try and find my house, I distantly saw a friend of mine, far away on the other side of whatever it was that I was staring across. We locked eyes. Then, we burst out laughing. We laughed for a long time."
Kobeissi has seen the flipside of effective encryption: the ability of ordinary people to communicate in their society's better interests without being spied on.
"I've seen my software used in Hong Kong to organize protests against a government otherwise unwilling to give people their rights. I've seen my colleagues produce software used by Egyptians rallying for democracy. I've had childhood friends call me from Beirut, desperate to know of a way to organize protests against a government that would lock them up were they to use public phone lines.
"I've set up communication lines for LGBTQ organizations so that they can give counsel without fearing ostracization or reprisal. And in the comfort of my new life in France, I've also relied on encryption so that I know I'm obtaining my simple right to privacy when discussing my daily life with my friends or with my partner."
He has also seen the darker side of law enforcement authorities in a democratic society. He was detained and questioned at the United States border over Cryptocat in 2012, and he was searched and questioned almost every time he flew into the country. But more disturbingly, he was one of the targets of the sting operation against hackers that the FBI ran through LulzSec member Sabu.
Sabu, under the direction of the federal unit, repeatedly tried to get Kobeissi to work with him in carrying out illegal hacking operations. He refused, and when he found out much later about the sting operation, he warned others about being seduced into breaking the law.
"The incident doesn't personally worry me at all, since I'm confident in my standing as a lawful citizen. To all young hackers out there – use your talents for research. Never acquiesce to anything illegal with anyone, even if they do it with you," he wrote.
It is hardly surprising then that Kobeissi has a different perspective when it comes to encryption.
On that encryption work, he wrote this week: "We're using mathematics and engineering to contribute towards a society that's safer, more capable, and able to communicate with a sense of privacy and dignity inherent to all modern societies.
"The premise driving the people writing encryption software is not exactly that we're giving people new rights or taking some away; it's the hope that we can enforce existing rights using algorithms that guarantee your ability to free speech, to a reasonable expectation of privacy in your daily life. When you make a credit card payment or log into Facebook, you're using the same fundamental encryption that, in another continent, an activist could be using to organize a protest against a failed regime."
He uses a variation of an analogy used by many pro-encryption advocates in recent weeks: that blaming the tools used by violent criminals is illogical. "Ford and Toyota build automobiles so that the entire world can have access to faster transportation and a better quality of life. If a terrorist is suspected of using a Toyota as a car bomb, it's not reasonable to expect Toyota to start screening who it sells cars to, or to stop selling cars altogether."
On the issue of law enforcement access, he also takes the firm line put down by technologists: it's all or nothing. "The issue is that cryptography depends on a set of mathematical relationships that cannot be subverted selectively. They either hold completely or not at all. It's not something that we're not smart enough to do; it's something that's mathematically impossible to do. I cannot backdoor software specifically to spy on jihadists without this backdoor applying to every single member of society relying on my software."
To his mind, the solution is not preventing people from communicating securely, but addressing the issues that cause them to act in violent ways. On a recent visit to his old home in Beirut, he writes, "I found that people were angry ... Left without any hope for a good education, for a happy life, with much of their families missing, with their friends dead, many pledged themselves in return. That's what's causing terrorism, not encryption software."
How to square the circle
It's not hard to see both perspectives. Nor is it hard to find holes in either.
The District Attorney Vance goes out of his way in his report to note that he is not talking about real-time data, only information held on phones "at rest."
And yet he can only be too aware of the cases going on across the United States where the police have used phone data to correlate location data with crimes – a situation of dubious legality that will be heading to the Supreme Court soon.
And while he stresses the need for a search warrant and hence proof of "probable cause," the reality on the ground is that many police forces argue that "reasonable suspicion" is sufficient to access phone data.
There is also legal uncertainty about whether the police can access phones with the latest encryption software anyway by forcing suspects to give their fingerprints. Except rather than giving their fingerprints on a piece of paper, they are forced to apply it to their smartphone's reader and hence unlock their phone.
Vance is also determinedly obtuse about the fact that authorities in other countries can oblige companies to give them access to phone data if they are able to do so. According to Vance, that situation would only happen if tech companies decided to do so; otherwise other countries' governments and law enforcement agencies would be forced to come to the United States to make their case.
The argument is laughable: companies set up in many different countries and are subject to local laws. The idea of Apple refusing to comply with a request from, say, the Chinese government and telling them to head over to its parent company in the United States if they want access is pure fantasy. If the company is technologically able to access that data, it will be made to do so wherever it sells its phones.
It is also worth noting that even in the district attorney's sobering examples, the information retrieved from phones was just a small part of the puzzle in convicting people. The information helped, certainly, but the cases did not depend on it.