Decrypting the Encryption Debate A Framework for Decision Makers (2018) / Chapter Skim
Currently Skimming:
7 A Framework for Evaluating Approaches to Access Plaintext
7 A Framework for Evaluating Approaches to Access Plaintext
Pages 83-94
The Chapter Skim interface presents what we've algorithmically identified as the most significant single chunk of text within every page in the chapter.
Select key terms on the right to highlight them within pages of the chapter.
From page 83... ...
the myriad national security threats posed by terrorist groups and foreign rivals, (3) the increasing importance of digital evidence as human activity and crime have become increasingly digital, and (4)
|
From page 84... ...
How can they evaluate the policy choices of whether to enable law enforcement and the intelligence community to maintain their current level of access, provide more resources to facilitate lawful government access, impose a legal requirement for mandatory access, or pursue other options? How can they assess the effect of each approach on law enforcement and national security, computer and data security, privacy and civil liberties, competitiveness, and other important values?
|
From page 85... ...
For example, if the government were to require vendors to provide exceptional access, the effective ess of that measure would depend in part on how many and which sers n u chose to install alternative applications that do not afford exceptional ccess. a Those who have objected to proposals to require key escrow observe that crimi nals will simply download noncompliant, unbreakable encryption software, which is widely available globally.
|
From page 86... ...
Exceptional access necessarily weakens security to some degree, while the absence of ex ceptional access necessarily hampers government investigations to some degree. • Impact on security.
|
From page 87... ...
For example, a lesser scale may be needed if the objective is to afford access in the more limited number of situations where critical national security interests are at stake. The third is whether the proposed approach works at the scale, timeliness, and reliability necessary to achieve its proponents' objectives.
|
From page 88... ...
Determining whether a proposed approach works at scale is often not easy because multiple components must not only be evaluated individually but also assessed for how well they integrate together. For example, a requirement that mobile phone manufacturers provide some way for law enforcement or intelligence officials to bypass encryption on devices requires not only testing the method for how well it works in real-world settings, but also assessing the tools for verifying the credentials of government officials who seek access and the tools for ensuring that access is provided only when legally authorized.
|
From page 89... ...
Answering this question also requires considering what happens in the case of failure -- for example, if access credentials or known vulnerabilities are stolen from law enforcement or intelligence officials, as happened with the publication of known vulnerabilities in 2016 and 2017 that were reportedly stolen from the Central Intelligence Agency and National Security Agency. Even without a theft from a government agency, how likely is the method for gaining access to be exploited by unauthorized third parties?
|
From page 90... ...
Any approach to ensuring government access to plaintext will impose costs. This inquiry focuses on the financial costs and asks, first, how great are those costs likely to be?
|
From page 91... ...
An issue related to consistency with existing law is whether unsettled questions of law may make a particular approach more challenging or otherwise less attractive. For example, policymakers may want to consider the impact of unsettled law regarding Fifth Amendment implications of requiring an individual to provide a biometric or a passcode.
|
From page 92... ...
Moreover, it is the committee's hope that the analytical framework above, together with the common vocabulary and context provided by this report, will facilitate an ongoing, frank conversation, involving all parties, about the encryption debate and proposed approaches.
|
From page 93... ...
Appendixes
|
Key Terms
This material may be derived from roughly machine-read images, and so is provided only to facilitate research.
More
information on Chapter Skim is available.