Hacker News Reader

This is an honest fear to have, but it hides the real causes many of the recent "bad actors" did what they did.

Most of the recent terrorist acts can be traced to different organizations that only exist because of military/economical interventions that happened a few years, or even decades ago. In a broader sense, many can even be traced to the aftermath of the first world war and how the Ottoman empire was split, and the interventions that followed.

What I'm trying to say is that this is not a "inherent" problem in western society. They were created by misguided actions of the past (and current) generations. The techniques and methods used by these actors are just details. You could theoretically spy in everyone like the US or UK governments want, but ultimately the criminals can easily be one step ahead of them if they want and try just hard enough. They can switch to other method or just pay some hacker group to create software for them if they were really organized.

Think of the prohibition in the US. Did it really stop alcohol consumption? Not at all. And a few years later everyone realized how stupid that idea was and the whole prohibition was scraped.

I strongly disagree. You can't just blame terrorism on poor decision making by Western powers. The world is complex and every country has to make difficult decisions that will make winners of some and losers of others.

Ultra-conservative strains of Islam are big losers to the West's cultural influence, even in the absence of Western military and diplomatic intervention in the Muslim world. Western economic and cultural might is a threat to their value system and way of life, and some are willing to kill to defend it. Within the United States there has been left-wing terrorism (e.g. anarchists in the early 20th century or the Weather Underground) and right-wing terrorism (e.g. the Oklahoma City bombing).

We cannot always avoid arousing the ire of hardcore radicals.

>but ultimately the criminals can easily be one step ahead of them if they want and try just hard enough. They can switch to other method or just pay some hacker group to create software for them if they were really organized.

They can, but thankfully most people seeking to do us harm (and most people in general) are incompetent. Even the most seasoned computer criminals get careless and make mistakes.

It's not me saying it. The Pentagon itself made such claims even before 9/11.

https://www.cato.org/publications/foreign-policy-briefing/do...

Do you really think an entire population will just accept a foreign nation obliterating their lives completely, without at least a small amount of revolt groups wanting revenge? Now that would be naïve.

>> They can, but thankfully most people seeking to do us harm (and most people in general) are incompetent. Even the most seasoned computer criminals get careless and make mistakes.

People wishing to do us harm don't need computers at all. Just look at the 3 attacks in London in the last few months (Westminster, London Bridge, Finsbury Park). All that is required is a driving license to rent a van and the want to drive it at people at speed. Any person willing to do harm can go out and do it this afternoon without any planning. If we give up our freedoms so that the government can spy more effectively the terrorists will just do more of the above style of attacks.

> Ultra-conservative strains of Islam are big losers to the West's cultural influence

You mean the same strains that have been repeatedly propped up [0] by the western powers?

[0] http://flashbak.com/wp-content/uploads/2012/09/Independent-1...

> I suppose the government would need to employee more real people

It would make sense if spending had gone down as more monitoring was added, but to my knowledge funding has instead been going up. A reinvestment on low technology solution is mostly just shuffling of funds for one area to an other.

> where all communications of bad actors would be via encrypted channels.

It is really hard to encrypt a physical meeting, and even harder to encrypt ownership of guns, bombs, stolen goods or the intent to hijack a truck. The evidence and police work needed to stop and convict criminals in a society with encryption look very similar and practically identical to the work needed in a society without encryption.

The scenario you describe would be good overall. State actors can easily metastasize into bad actors themselves, and when they do the results are truly monstrous. Having a way to organize dissidence (in this case, the possibility to communicate without being immediately captured) is of prime importance as a safety valve when things inevitably turn for the worse.

Other bad actors seem benign in comparison. A fundamentalist organization can clock up hundreds or thousands of kills but a bad state actor is usually along the lines of millions of lives negatively affected.

There's also no indication that bad actors need encryption at all. In several of the recent terrorist attacks, in some cases information was easily retrievable but was not investigated due to an overwhelming amount of people to monitor. It seems like states have no issues collecting data but sometimes struggle to actually use it to stop terrorism.

> How would we live in a world with perfect encryption?

That question is indeed addressed if you read the article. Toward the end:

> "There are lots of existing techniques law enforcement can use," Dr Steven Murdoch, a cyber-security researcher in the department of computer science at University College London told the BBC News website.

> "One of them is traffic analysis, which is looking at patterns of communications, eg who is talking to who, when and from what location.

> "The other one is hacking - equipment interference in British law - which can happen before data is encrypted and after it's been decrypted, so there are still ways for law enforcement to gain access to information."

If the E.U. is considering this legislation, you can be sure the member countries' spy agencies are confident in their ability to hack and do traffic analysis.

Probably a better (though still highly theoretical) way to phrase your question is this:

How would we live in a world where there are no bugs to exploit?

>> we would be pretty much back to where we were a couple of decades ago. I suppose the government would need to employee more real people to monitor other real people.

My view is - why is that a bad thing? We didn't live in some crazy unsafe time then and I don't think it'll be any different now.

However what if I was wrong and the world did become less safe? We need to start looking at 'safety' thorough the bigger picture. If this regulation really did make it harder to catch e.g. terrorists and there were 1-3 more attacks a year with 50 deaths total should we give up our privacy to prevent that given the consequences of giving up privacy to save those 50 lives? That loss of life would obviously be tragic but in the grand scheme of things it's a tiny number. I've seen governments take away people's freedoms to stop violence and keep people safe. It generally doesn't make much difference. And if we let the government take away this freedom how long until they take away another? How long until we start letting them take away freedoms that only serve to frustrate the bad guys and fuel further violence (again this has happened in the past).

Do you feel more unsafe in a world where secure encryption is widely and easily used, or do you feel safer in a world where that would become contraband, and fake security in encryption would expose you to state and criminal exploitation. This isn't some kind of techno-libertarian hard-line position. Many governments are incapable of administering back-doored encryption without corrupt influences exploiting the back door, even if you trust first-world governments to keep things relatively clean.

All communications of bad actors will be encrypted via safe channels regardless of the regulations. Regulations only limit citizens who obey the law.

And if you are hoping that it would be easier to spot these truly encrypted communication channels then, not really a chance, there are already too many options how you can hide the data in the skype stream images, websockets and so on.

Apart of course from the fact how bad idea it is to let state actors access all this information. Sooner or later they will be breached too, by other state actors or Mallories, regardless of their intentions.

Either you have the right to privacy or you don't. It's just double speak to say the government can violate any right, then either the government is acting criminally and people involved should be personally punished as such, or you don't actually have privacy.

That's like saying people have the right to life but government can murder anyone they want because they are the government. It's silly and meaningless. Rights are to be protected even when the government is against them, perhaps even more so in such cases.

Most communication that occurs is already not monitored. If I go to a restaurant or a coffee shop, no one is monitoring what I say.

Just because it is technically feasible to do something doesn't mean there is some obligation to do it. We should treat external parties intercepting our traffic the same way we would treat those third parties trying to install microphones in our houses to listen to us.

You are forgetting that people have been talking in code words for centuries: criminals, businesses with trade secrets, mystics and esoteric religions, revolutionaries and even friends secretly planning a birthday party.

Talking cryptically comes so naturally that close siblings and friends evolve their own dictionary just for fun.

Removing encryption will not change this.

> Is there any way we could have encryption / security with a state actor still being able to decrypt the data if needed?

There are, and there have been, they're called back doors and they are a bad idea, because you cannot guarantee a state actor having sole access - if there is any way to get to data besides the main gateway (e.g. having a private key), it's insecure and potentially hackable by people that are not said state actor. Even if it's fully secure, there's still the risk of human failure - leaks, espionage, accidents. Then all your data would be up for grabs.

There's also a question of how much you trust the government, and trust all future possible governments.

Sure, it is actually quite easy to design systems that allow only the state or the government (or any given trusted organizayion for that matter) to decrypt secure communications. However, the problem is, can we trust the governments to not use this for malicious purposes, or to not somehow leak their credentials to others? What if some bad actor infiltrates the government and gets all access, or some rogue terrorist organization invades a country? As the Latin poet Juvenal said, "Quis custodiet ipsos custodes?" (Who will guard the guards?)

That's fine, why is that even a problem? Government won't be able to employ too many of those people, that is financially unsustainable. So they will think twice who to watch, they'd have to limit their surveillance only to actual terror suspects etc., not just about everyone as now.

See https://en.wikipedia.org/wiki/Clipper_chip and it's failures