For years now, the FBI has been warning legislators and CEOs about criminals "going dark" through encryption — and the responsibility of companies like Apple and Google to stop it from happening. But according to a new study from Harvard's Berkman Center for Internet and Society, that's not what's happening at all. Titled "Don't Panic," the paper unpacks the context of the recent debate around encryption, ultimately deciding that police are at little risk of being locked out of digital communications at large.
The paper doesn't deny that encryption has made some communications inaccessible, but argues those difficulties are easily made up for with new channels and opportunities for evidence-gathering. "There are and will always be pockets of dimness and some dark spots — communications channels resistant to surveillance — but this does not mean we are completely 'going dark,'" the paper reads. "Some areas are more illuminated now than in the past and others are brightening."
"Some areas are more illuminated now than in the past and others are brightening."
The paper is the result of more than a year of work by a panel of 12 authors, including an esteemed cryptographer, a former federal judge, and a former NSA general counsel. Two current NSA officials were also consulted in the research phase, but unable to sign the final draft due to agency restrictions on public statements.
The authors run down four main factors that will keep those new areas from going dark without state intervention. First, they argue that end-to-end encryption is incompatible with the data collection needed to make money from online services like Gmail and Facebook. They also argue that the modern web is too fragmented for comprehensive encryption to exist at a broad scale. Even if content encryption became widespread, it wouldn't protect metadata, the so-called "front of the envelope" information that can't be encrypted and provides crucial information to investigators looking to map criminal networks. Finally, the authors point to networked sensors and the so-called "Internet of Things," as persistent sources of surveillance data that police can tap into in the future.
The result is a good rebuttal to FBI requests for legislation, but not necessarily good news for privacy. Even with encrypted chat programs, there are a multitude of ways police can spy on a person's activities. "Are we really headed to a future in which our ability to effectively surveil criminals and bad actors is impossible?" the paper asks. "We think not."