Encryption Backdoors Threaten All of Us

A recent cyberattack that just breached Verizon, AT&T, Lumen Technologies was tied to a sophisticated Chinese-government backed hacking group known as Salt Typhoon reported by The Wall Street Journal. The attack breached the systems built by the Internet Service Providers that give law enforcement and intelligence agencies access to user data. These backdoors were made in compliance to the Communications Assistance For Law Enforcement Act of 1994 (CALEA) which allowed U.S Law enforcement to commit “lawful intercepts”, wiretaps, and monitor internet traffic through the ISPs. The attackers abused the same backdoor that were used by these companies to cooperate with legal requests from authorities. These same backdoors which were used by U.S Law enforcement were breached by Chinese threat actors, allowing them to see all user internet traffic for months. This attack by Salt Typhoon could of been completely prevented if there were no backdoors into the ISP's stream of data.

This is exactly why Tech Companies, civil liberties unions, and many cybersecurity experts have opposed backdoors into software and said that there is no such thing as a backdoor for only the "good guys." Encryption either protects everyone's information or it is broken for everyone. Encryption saves lives. For years, Politicians and Law enforcement have called on Tech companies to add encryption backdoors so it allows access for data when served with a warrant. Many governments claim the use of encryption helps terrorists and cyber criminals shield their activities from law enforcement. Not only oppressive governments have attacked encryption, but even democratic governments claim encryption hinders the ability of law enforcement to prosecute criminals.

Federal Law Enforcement agencies such as the Federal Bureau of Investigation, National Crime Agency, Australian Security Intelligence Organisation, Europol, and more claim the use of encryption helps criminals hide their crimes by using encryption. They often refer to this as "going dark" and claim the need for encryption backdoors is the only way to catch criminals.

“Tech companies have a social responsibility to develop a safer environment where law enforcement and justice can do their work. If police lose the ability to collect evidence, our society will not be able to protect people from becoming victims of crime”

This term "going dark" grew into a common phrase by law enforcement after the Apple-FBI encryption dispute. On December 2nd, 2015, a terrorist attack which included a mass shooting and an attempted bombing at the Inland Regional Center in San Bernardino. The two terrorists died in a police shootout where an iPhone 5c was recovered. The FBI couldn't access any information on the iPhone due to the phone being encrypted with a passcode. If the FBI attempted to brute force the passcode of the iPhone, iOS would wipe the encryption keys needed to decrypt the contents of the phone. The FBI first when to the NSA to crack the iPhone but failed trying. In fear of the phone's contents being wiped, the FBI went to a U.S. federal magistrate judge who ordered Apple under the All Writs Act of 1789 to create a backdoor into the iOS as part of the investigation into the 2015 San Bernardino shootings. Apple refused and fought the order claiming it would compromise the security of all its users around the world and claimed that the order violated the company's First Amendment right. As CEO of Apple, Tim Cook said:

“This is not about one phone. This case is about the future. Can the government compel Apple to write software that we believe would make hundreds of millions of customers vulnerable around the world?”

What law enforcement often overlooks is how much of a dangerous flaw they can open with an encryption backdoor. Once a backdoor is opened, it becomes a target of cybercriminals, hackers, governments, and more waiting to exploit the backdoor leading into an easy access into millions of people's lives. Over the years, lawmakers have attempted to pass pieces of legislations to backdoor or even ban encrypted phones. In the EU, the dangerous Chat Control Proposal wants police access to all encrypted messaging by using client side scanning. Client side scanning would scan the message before it it encrypted and sent to the other user. This still breaks end-to-end encryption as many experts have said. Encrypted messaging app, Signal, threatened to leave the EU market if Signal was forced to create a backdoor. As Meredith Whittaker, CEO of Signal stated:

"So let’s be very clear, again: mandating mass scanning of private communications fundamentally undermines encryption. Full stop. Whether this happens via tampering with, for instance, an encryption algorithm’s random number generation, or by implementing a key escrow system, or by forcing communications to pass through a surveillance system before they’re encrypted. We can call it a backdoor, a front door, or “upload moderation.” But whatever we call it, each one of these approaches creates a vulnerability that can be exploited by hackers and hostile nation states, removing the protection of unbreakable math and putting in its place a high-value vulnerability."

Governments and Law enforcement need to finally understand that creating a backdoor into any piece of software, will be found and exploited by cybercriminals and threat actors. We need strong encryption now more than ever for everyone to safe guard personal information whether it be a journalist in an oppressive regime, women seeking advice about having an abortion, or any citizen wanting the right to private communication. Encryption protects everyone and it is up to us the people and tech companies, to fight government overreach of forcing backdoors into secure software.