Re: [Gendispatch] Updated draft: Policy experts are IETF stakeholders

[Phillip Hallam-Baker <[e-mail]>]

People keep raising end to end encryption as an issue here and so I would
just like to make a clarification.

But first, I will note that before the pandemic, MIT and Harvard were
running annual seminars discussing emerging cyber-norms which provided one
forum in which technologists and policy makers could discuss these issues
under Chatham House rules. Perhaps we should get back to that.


Of course the question of whether applications have backdoors is a policy
question. There is absolutely no need for a policy maker to understand the
technology in order to have an informed opinion on the technology. Since a
member of my family survived two assassination attempts by the PIRA
(Brighton Bomb, Downing St mortar), I have always been very aware of the
threat of terrorism in my technical work. But I am also aware of rather a
lot more, probably more aware than most people with 'UK Cabinet Office' on
their IETF badges.

All they need to do is to explain is which governments they want to have
access to the backdoor. I am a UK citizen so if I put any backdoors in, the
UK would be first in line. Is the US OK with that? Well I guess it might
but what about France? What do we do when it comes to countries that are
allies but not members of NATO? What about Israel? What about Saud?

What international institutions are going to be established to govern these
lawful intercept capabilities? Interpol? The ECJ?

Oh and all my code is open source and available on GitHub so if I did
insert a backdoor how do I prevent someone forking my code and removing it?

None of these are technical questions, they are all policy questions.


Of course, an understanding of the technology is essential to writing
legislation. Take the drafting of the OSA which requires 'service
providers' to provide access to communications. The assumption being that
the only business model for messaging is one in which the network effect
drives everything into a monopoly or cartel with a tiny number of providers
that can be controlled by government. The legislation does not anticipate a
UK citizen being able to choose a US service provider or being their own
service provider.

I have to wonder if anyone in HMG has considered the fact that email and
messaging services are not profit centers in their own right for the major
technology providers and that the likely response to the OSA will be to
shutter services in the UK and/or reduce functionality. I cannot see a
corporation with a trillion dollar market cap risking their global brand by
complying with OSA for the sake of a service that isn't a profit center. So
has anyone in HMG considered the possibility that Google shuts down Gmail
for the UK or the effect that might have on the economy? It is rather
easier for Signal to comply, all they need to do is block image attachments
for UK communications. But SMTP without MIME attachments would grind
commerce to a halt in most countries.


I do have a very good idea of the horrors that will be unleashed by
providing an entirely end-to-end secure communication infrastructure that
encompases data at rest as well as data in transit. A Mesh social media
discussion forum is end-to-end encrypted and only visible to the
participants, the service provider has no access to the plaintext.

But I can also see the effect of having hostile intelligence forces
performing Hack-Select-and-Leak attacks as described at length in the
Mueller report.

It is clear we should be discussing these issues. It is also clear that
this is not the place.