In the battle over encryption and what authorities call “going dark,” one of the country’s former spymasters has seen the light.
Retired Vice Adm. Mike McConnell, who led the National Security Agency from 1992 to 1996 and later served as director of national intelligence, was a forceful advocate for government access to encrypted communications during the so-called Crypto Wars of the 1990s. Law enforcement ultimately lost that battle after technology experts punched holes in the security and credibility of the proposed solution, the clipper chip.
Fast forward 20 years, and the debate now swirls around the use of end-to-end encryption on communication devices such as cellphones and computers. This month, the Obama administration abandoned its half-hearted efforts to get legislation that would require companies to provide the government with backdoor access through encryption keys.
The government says encryption prevents law enforcement and intelligence agencies — everyone from the small-town sheriff to the FBI — from gaining access to electronic communications such as text messages, photos and other files with a warrant. The inability to obtain decrypted data poses a threat to national security, authorities say, and they want special access to such data to help them track down terrorists and criminals.
Civil liberties advocates, technology experts and some members of Congress argue that it’s not possible to grant law enforcement access without inevitably leaving the door open a crack to other actors.
“You can’t put in a technological front door or back door that only the FBI is going to have because eventually hackers will find it or figure it out, or a government employee will inadvertently release it,” said Rep. Ted Lieu, a California Democrat on the House Oversight and Government Reform Committee who also happens to have a computer science degree from Stanford University. “It is such an extreme proposal to weaken every consumer product on the off chance that the FBI might one day need to look at a person’s cellphone data.”
NSA Director Adm. Michael Rogers acknowledged the technical challenges at an open hearing of the Senate Intelligence Committee in late September. Asked by Democratic Sen. Ron Wyden of Oregon whether encryption keys, which would allow secure communications to be decrypted, would create more opportunities for malicious actors to hack into the data, Rogers said, “Yes.”
In a routine that plays out at nearly every congressional hearing with Rogers or FBI Director James B. Comey, lawmakers ask about “the problem of going dark.” Rogers and Comey talk about their desire to find the right balance between privacy and security, and about engaging with technology companies to find a solution that everyone can live with.
Comey in October said that the administration would not seek legislation that would weaken encryption, although it would continue its dialogue with technology companies about encryption, national security and public safety risks.
It has been clear for months that there is little appetite in Congress for granting the government sweeping backdoor surveillance powers. In June, for example, the House voted 255-174 to add language to the 2016 Defense Authorization Act to prohibit the use of funds by the NSA for backdoor surveillance.
Still, the turn away from a legislatively mandated solution is a bitter pill for law enforcement.
For McConnell, the encryption question is much simpler. He left his post as director of national intelligence in 2009, and he’s no longer on the hook for protecting the nation.
McConnell says his views have evolved. Our lives are increasingly conducted in the digital world: everything from banking and socializing to business and intellectual capital, all of which need to be secure.
Taking the long view, McConnell says that ultimately you can’t fight the tsunami of technological progress. The only thing you can do is adapt to the new reality.
“We had law enforcement activities before we had telephones,” McConnell said during a recent panel on cybersecurity. “Telephones came along and we had to adjust to telephones, and so we learned how to tap and we set up laws, and we had a process for doing that.”
“What I would argue with law enforcement is you are where you are now as a product of your current experience,” he added. “You will adapt if there is ubiquitous encryption, not only data-in-motion but data-at-rest, and we can really secure these databases for the benefit of business and privacy, then law enforcement can adapt to that. And there are ways to adapt.”
This article originally appeared in the Oct. 19 edition of CQ Weekly.