Do Encrypted Phones Threaten National Security?

In Washington, D.C., where a growing chorus is demonizing end-to-end encryption that permits people to have conversations that the government can never see, Senator Sheldon Whitehouse has aired a particularly extreme anti-privacy position: The Rhode Island Democrat suggested last week that selling well-encrypted smartphones to Americans should be treated like dumping toxic waste in streams. Ben Wittes of The Brookings Institution transcribed the remarks.

They began with a hypothetical kidnapping. “A girl goes missing,” Senator Whitehouse told Deputy Attorney General Sally Yates. “A neighbor reports that they saw her being taken into a van out in front of the house. The police are called. They come to the home. The parents are frantic. The girl's phone is still at home.”

Naturally, everyone wants to search the phone for clues. But it is encrypted. Of course, the phone doesn’t necessarily hold any clues, and the victim is no worse off than every child kidnapped in the thousands of years before smartphones existed. Nevertheless, Senator Whitehouse feels that the phone maker bears some culpability for the girl’s fate, and should perhaps be made to pay up in a civil lawsuit:

It strikes me that one of the balances that we have in these circumstances where a company may wish to privatize value by saying, "Gosh, we're secure now. We got a really good product. You're going to love it." That's to their benefit. But for the family of the girl that disappeared in the van, that's a pretty big cost. And when we see corporations privatizing value and socializing cost so that other people have to bear the cost, one of the ways that we get back to that and try to put some balance into it, is through the civil courts, through a liability system.

If you're a polluter and you're dumping poisonous waste into the water rather than treating it properly, somebody downstream can bring an action and can get damages for the harm that they sustain, can get an order telling you to knock it off. I'd be interested in whether or not the Department of Justice has done any analysis as to what role the civil-liability system might be playing now to support these companies in drawing the correct balance, or if they've immunized themselves from the cost entirely and are enjoying the benefits. I think in terms of our determination as to what, if anything, we should do, knowing where the Department of Justice believes the civil liability system leaves us might be a helpful piece of information. So I don't know if you've undertaken that, but if you have, I'd appreciate it if you'd share that with us, and if you'd consider doing it, I think that might be helpful to us.

Senator Whitehouse is taking a very strange position. In the hypothetical, even looking past the objections noted above, the girl (or the guardian who bought her the phone) deliberately purchased a secure device and could have chosen a less secure model had they decided that the potential risks of strong encryption outweigh the benefits. When individuals bear the predictable cost of a consumer choice that they made without coercion it is inaccurate to say that the seller socialized the cost.

Of course, there may be hypotheticals better-suited to advancing Whitehouse’s agenda.

Say that some radicalized proponents of Herman Cain’s “9-9-9” tax plan plot to blow up 27 water towers in a misguided bid for their hero’s affection. After they’ve planted explosives, but before any detonations, they’re apprehended thanks to a tip from one of their co-workers at Godfather’s Pizza, who looked over their shoulders as they were texting back and forth about the plot. If authorities could access those messages they could save the water towers. But everything is encrypted, and hours later, all the water towers go boom.

The mustachioed terrorists succeed!

But even granting that there are scenarios in which strong encryption could result in costs that the public wouldn’t have had to bear in an alternative world with less privacy, a civil-liability framework would have to account for the opposite sort of case, in which costs were imposed on consumers or society by insufficiently strong encryption.

Say a foreign government, a terrorist organization, or black-hat hackers compromise the smartphone exchanges of David Petraeus or Hillary Clinton or the head of security at a nuclear power plant or a systems administrator at the New York Stock Exchange. What costs will the public bear that wouldn’t exist in an alternative world with end-to-end encryption? And what of the costs born by average citizens when their privacy is compromised? I strongly suspect the costs of insecurity are much higher than the costs that would be born in a world of end-to-end encryption, though of course there’s no way to prove that judgment definitively.

Either way, shaping encryption policy by way of dueling lawsuits and jury awards strikes me as one of the least efficient, least accurate methods imaginable to quantify the costs and benefits of different approaches to encryption and data security. And in a nation in which telecommunications companies were able to wrangle retroactive immunity for knowingly and illegally helping the government to spy on Americans, the notion that civil liability would be consistently applied to powerful corporations, even in the aftermath of black-swan events, is strikingly naive.

(Image via wk1003mike/ Shutterstock.com)