Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-4420 size-medium" src="http://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2016/01/Data-483120645_lg-300x300.jpg" alt="" width="300" height="300" />

For privacy advocates, it is universally accepted that encryption is a very good thing. After all, encrypted data is deemed a safe harbor under HIPAA and state breach-notification laws, providing an “out” from potential fines and penalties when an encrypted device is lost that contains sensitive health or other personal information. In addition to encouraging encryption via statutory safe harbors, federal and state regulators also use the stick of <a href="http://www.hhs.gov/about/news/2014/04/22/stolen-laptops-lead-to-important-hipaa-settlements.html">enforcement actions</a>, costing organizations millions of dollars when sensitive information is put at risk due to the lack of encryption.

So the issue would appear to be settled. Use encryption, and more encryption, and the government will be happy – right? Well, not quite. 2016 brings a battle between privacy advocates, who want more security, and U.S. government agencies, such as intelligence and law enforcement, which deem encryption a threat.

Why would the government consider encryption to be a problem? It all comes down to counterterrorism. In the wake of the Paris, California, and other ISIS-directed or inspired attacks, the U.S. government is concerned that terrorists are able to obtain refuge by using encrypted communications.

For example, Apple’s iMessage system uses end-to-end encryption, meaning that text messages are encrypted on the sender’s device and are decrypted only on the recipient’s end. Even Apple cannot decrypt the messages, <a href="https://nakedsecurity.sophos.com/2015/09/10/apple-imessages-end-to-end-encryption-stymies-us-data-request/">thwarting court orders</a> to turn them over. Apple doesn’t hide this fact. Rather, it proudly trumpets its encryption capabilities in its <a href="http://www.apple.com/privacy/approach-to-privacy/">privacy policy</a>: “we can’t unlock your device for anyone because you hold the key — your unique password.”

The issue of encryption and terrorism was on the agenda at a recent <a href="http://www.reuters.com/article/us-usa-security-tech-idUSKBN0UL2H320160107">Silicon Valley summit meeting</a><u>,</u> where various senior Obama administration officials, including the U.S. attorney general and the NSA director, met with representatives from various technology companies, such as Apple, Facebook, and Google. <a href="https://theintercept.com/2016/01/08/white-house-raises-encryption-threat-in-silicon-valley-summit/">According to reports</a>, the White House told summit participants that to avoid detection, terrorists are using encrypted forms of communications at various stages of attack plotting and execution. The White House expects terrorists will continue to use encrypted communications where law enforcement cannot obtain the content of the communication, even with court authorization. The White House offered to share additional information at classified briefings.

So based on terrorism fears, the government is now pushing technology companies to open a “backdoor” to otherwise-unbreakable encryption technology. A backdoor would enable technology companies to decrypt information on a device at the request of intelligence agencies and law enforcement. But as privacy advocates, <a href="https://theintercept.com/2016/01/12/apples-tim-cook-lashes-out-at-white-house-officials-for-being-wishy-washy-on-encryption/">including Apple CEO Tim Cook, point out</a>, backdoors not only allow the “good guys” such as law enforcement in, but also leave an opening for the bad guys to gain access to private consumer information, including bank information and medical records.

In other words, once a backdoor is in place, it’s there for everybody, and it significantly weakens security and privacy. <a href="http://dspace.mit.edu/bitstream/handle/1721.1/97690/MIT-CSAIL-TR-2015-026.pdf?sequence=8">Security specialists are also very uncomfortable</a> with the notion of the government keeping the decryption keys safe from hackers and criminals. Those experts contend that poking a hole in encryption could not only put consumers’ confidential data at risk, but also allow access to power grids and financial institutions.

Right now the U.S. government is seeking voluntary cooperation from technology companies, and is not pushing for legislation on this issue. But it’s a different story at the state level. A California State Assembly member <a href="http://www.leginfo.ca.gov/pub/15-16/bill/asm/ab_1651-1700/ab_1681_bill_20160120_introduced.html">recently introduced legislation</a> that would require any smartphone manufactured after January 1, 2017, (and sold in California) to be capable of being decrypted and unlocked by its manufacturer. This follows on the heels of a <a href="http://legislation.nysenate.gov/pdf/bills/2015/A8093">similar bill</a> introduced last year in New York.

Ironically, it’s the technology companies, which in the past have been hammered over privacy issues, who are now taking a strong stand for consumer privacy and encryption. Meanwhile, the government is seeking to potentially weaken encryption technology in the name of safety over privacy. Will Americans have to choose between privacy and national security in 2016? According to Apple’s Tim Cook, “<a href="http://time.com/4156499/tim-cook-apple-privacy-security-terrorism-taxes/">We’re America. We should have both.</a>”

&nbsp;

&nbsp;

&nbsp;

Encryption: The Battle Between Privacy and Counterterrorism