31 May 201307:17 AM
The FBI's New Wiretapping Plan Is Great News for Criminals

Bruce Schneier

Foreign Policy

 

The FBI wants a new law that will make it easier to wiretap the Internet. Although its claim is that the new law will only maintain the status quo, it's really much worse than that. This law will result in less-secure Internet products and create a foreign industry in more-secure alternatives. It will impose costly burdens on affected companies. It will assist totalitarian governments in spying on their own citizens. And it won't do much to hinder actual criminals and terrorists.

 

As the FBI sees it, the problem is that people are moving away from traditional communication systems like telephones onto computer systems like Skype. Eavesdropping on telephones used to be easy. The FBI would call the phone company, which would bring agents into a switching room and allow them to literally tap the wires with a pair of alligator clips and a tape recorder. In the 1990s, the government forced phone companies to provide an analogous capability on digital switches; but today, more and more communications happens over the Internet.

 

What the FBI wants is the ability to eavesdrop on everything. Depending on the system, this ranges from easy to impossible. E-mail systems like Gmail are easy. The mail resides in Google's servers, and the company has an office full of people who respond to requests for lawful access to individual accounts from governments all over the world. Encrypted voice systems like Silent Circle are impossible to eavesdrop on -- the calls are encrypted from one computer to the other, and there's no central node to eavesdrop from. In those cases, the only way to make the system eavesdroppable is to add a backdoor to the user software. This is precisely the FBI's proposal. Companies that refuse to comply would be fined $25,000 a day.

 

The FBI believes it can have it both ways: that it can open systems to its eavesdropping, but keep them secure from anyone else's eavesdropping. That's just not possible. It's impossible to build a communications system that allows the FBI surreptitious access but doesn't allow similar access by others. When it comes to security, we have two options: We can build our systems to be as secure as possible from eavesdropping, or we can deliberately weaken their security. We have to choose one or the other.

 

This is an old debate, and one we've been through many times. The NSA even has a name for it: the equities issue. In the 1980s, the equities debate was about export control of cryptography. The government deliberately weakened U.S. cryptography products because it didn't want foreign groups to have access to secure systems. Two things resulted: fewer Internet products with cryptography, to the insecurity of everybody, and a vibrant foreign security industry based on the unofficial slogan "Don't buy the U.S. stuff -- it's lousy."

 

In 1993, the debate was about the Clipper Chip. This was another deliberately weakened security product, an encrypted telephone. The FBI convinced AT&T to add a backdoor that allowed for surreptitious wiretapping. The product was a complete failure. Again, why would anyone buy a deliberately weakened security system?

 

In 1994, the Communications Assistance for Law Enforcement Act mandated that U.S. companies build eavesdropping capabilities into phone switches. These were sold internationally; some countries liked having the ability to spy on their citizens. Of course, so did criminals, and there were public scandals in Greece (2005) and Italy (2006) as a result.

 

In 2012, we learned that every phone switch sold to the Department of Defense had security vulnerabilities in its surveillance system. And just this May, we learned that Chinese hackers breached Google's system for providing surveillance data for the FBI.

 

The new FBI proposal will fail in all these ways and more. The bad guys will be able to get around the eavesdropping capability, either by building their own security systems -- not very difficult -- or buying the more-secure foreign products that will inevitably be made available. Most of the good guys, who don't understand the risks or the technology, will not know enough to bother and will be less secure. The eavesdropping functions will 1) result in more obscure -- and less secure -- product designs, and 2) be vulnerable to exploitation by criminals, spies, and everyone else. U.S. companies will be forced to compete as a disadvantage; smart customers won't buy the substandard stuff when there are more-secure foreign alternatives. Even worse, there are lots of foreign governments who want to use these sorts of systems to spy on their own citizens. Do we really want to be exporting surveillance technology to the likes of China, Syria, and Saudi Arabia?

 

The FBI's short-sighted agenda also works against the parts of the government that are still working to secure the Internet for everyone. Initiatives within the NSA, the DOD, and DHS to do everything from securing computer operating systems to enabling anonymous web browsing will all be harmed by this.

 

What to do, then? The FBI claims that the Internet is "going dark," and that it's simply trying to maintain the status quo of being able to eavesdrop. This characterization is disingenuous at best. We are entering a golden age of surveillance; there's more electronic communications available for eavesdropping than ever before, including whole new classes of information: location tracking, financial tracking, and vast databases of historical communications such as e-mails and text messages. The FBI's surveillance department has it better than ever. With regard to voice communications, yes, software phone calls will be harder to eavesdrop upon. (Although there are questions about Skype's security.) That's just part of the evolution of technology, and one that on balance is a positive thing.

 

Think of it this way: We don't hand the government copies of our house keys and safe combinations. If agents want access, they get a warrant and then pick the locks or bust open the doors, just as a criminal would do. A similar system would work on computers. The FBI, with its increasingly non-transparent procedures and systems, has failed to make the case that this isn't good enough.

 

Finally there's a general principle at work that's worth explicitly stating. All tools can be used by the good guys and the bad guys. Cars have enormous societal value, even though bank robbers can use them as getaway cars. Cash is no different. Both good guys and bad guys send e-mails, use Skype, and eat at all-night restaurants. But because society consists overwhelmingly of good guys, the good uses of these dual-use technologies greatly outweigh the bad uses. Strong Internet security makes us all safer, even though it helps the bad guys as well. And it makes no sense to harm all of us in an attempt to harm a small subset of us.

 

y an�,tl�� �~ ources that the package didn’t include enough new arms to satisfy Israel’s needs, or were of the wrong kind.  The V-22 Osprey, for example, was proclaimed by some to be of marginal military value.  Far more surprising was that no red flags went up in the media over what was included.  At least two of the items -- the KC-135 refueling planes and the anti-radiation missiles (crucial weaponry for disabling an enemy’s air-defense radar system) -- could only be intended for one purpose: bolstering Israel’s capacity to conduct a sustained air campaign against Iranian nuclear facilities, should it decide to do so.

 

 

At present, the biggest military obstacles to such an attack are that country’s inability to completely cripple Iranian anti-aircraft defense systems and mount sustained long-range air strikes.  The missiles and the mid-air refueling capability will go a long way toward eliminating such impediments.  Although it may take up to a year for all this new hardware to be delivered and come online, the package can only be read as a green light from Washington for Israel to undertake preparations for an attack on Iran, which has long been shielded from tougher U.N. sanctions by China and Russia.

 

* In March, Russia agreed to sell 24 Sukhoi Su-35 multi-role combat jets and four Lada-class diesel submarines to China on the eve of newly installed President Xi Jinping’s first official visit to Moscow.  Although details of the sale have yet to be worked out, observers say that it will represent the most significant transfer of Russian weaponry to China in a decade.  The Su-35, a fourth-generation stealth fighter, is superior to any plane now in China’s arsenal, while the Lada is a more advanced, quieter version of the Kilo-class sub it already possesses.  Together, the two systems will provide the Chinese with a substantial boost in combat quality.

 

For anyone who has followed Asian security affairs over the past few years, it is hard to view this deal as anything but a reaction to the Obama administration’s new Asian strategy, its “pivot” to the Pacific.  As announced by President Obama in a speech before the Australian Parliament in November 2011, it involves beefing-up the already strong U.S. air and naval presence in the western Pacific -- in, that is, waters off of China -- along with increased U.S. arms aid to American allies like Indonesia, Japan, the Philippines, and South Korea.

 

Not surprisingly, China has responded by bolstering its own naval capabilities, announcing plans for the acquisition of a second aircraft carrier (its first began operational testing in late 2012) and the procurement of advanced arms from Russia to fill gaps in its defense structure.  This, in turn, is bound to increase the pressure on Washington from Japan, Taiwan, and other allies to provide yet more weaponry, triggering a classic Cold-War-style arms race in the region.

 

* On the eve of Secretary of State John Kerry’s June 24th visit to India, that country’s press was full of reports and rumors about upcoming U.S. military sales.  Andrew Shapiro, assistant secretary of state for political-military affairs, was widely quoted as saying that, in addition to sales already in the pipeline, “we think there’s going to be billions of dollars more in the next couple of years.”  In his comments, Shapiro referred to Deputy Secretary of Defense Ashton Carter, who, he said, was heading up an arms sales initiative, “which we think is making some good progress and will, hopefully, lead to an even greater pace of additional defense trade with India.”

 

To some degree, of course, this can be viewed as a continuation of weapons sales as a domestic economic motor, since U.S. weapons companies have long sought access to India’s vast arms market.  But such sales now clearly play another role as well: to lubricate the U.S. drive to incorporate India into the arc of powers encircling China as part of the Obama administration’s new Asia-Pacific strategy.

 

Toward this end, as Deputy Secretary of State William Burns explained back in 2011, “Our two countries launched a strategic dialogue on the Asia-Pacific to ensure that the world’s two largest democracies pursue strategies that reinforce one another.”  Arms transfers are seen by the leaders of both countries as a vital tool in the “containment” of China (though all parties are careful to avoid that old Cold War term).  So watch for Kerry to pursue new arms agreements while in New Delhi.

 

Repeating History

 

These are just some examples of recent arms deals (or ones under discussion) that suggest a fresh willingness on the part of the major powers to use weapons transfers as instruments of geopolitical intrusion and competition.  The reappearance of such behavior suggests a troubling resurgence of Cold War-like rivalries.  Even if senior leaders in Washington, Moscow, and Beijing are not talking about resurrecting some twenty-first-century version of the Cold War, anyone with a sense of history can see that they are headed down a grim, well-trodden path toward crisis and confrontation.

 

What gives this an added touch of irony is that leading arms suppliers and recipients, including the United States, recently voted in the U.N. General Assembly to approve the Arms Trade Treaty that was meant to impose significant constraints on the global trade in conventional weapons.  Although the treaty has many loopholes, lacks an enforcement mechanism, and will require years to achieve full implementation, it represents the first genuine attempt by the international community to place real restraints on weapons sales.  “This treaty won’t solve the problems of Syria overnight, no treaty could do that, but it will help to prevent future Syrias,” said Anna MacDonald, the head of arms control for Oxfam International and an ardent treaty supporter.  “It will help to reduce armed violence.  It will help to reduce conflict.”

 

This may be the hope, but such expectations will quickly be crushed if the major weapons suppliers, led by the U.S. and Russia, once again come to see arms sales as the tool of choice to gain geopolitical advantage in areas of strategic importance.  Far from bringing peace and stability -- as the proponents of such transactions invariably claim -- each new arms deal now holds the possibility of taking us another step closer to a new Cold War with all the heightened risks of regional friction and conflict that entails.  Are we, in fact, seeing a mindless new example of the old saw: that those who don’t learn from history are destined to repeat it?