UCLA data breach(es) - which affected me (twice) as I was in their databases and received advisories from them.
Encryption is
... illegal?
It's "something expressly to allow people to place themselves beyond the
law," James
Comey, FBI Director, 2014, in opposition to Apple release of
encryption implementation that limits availability of the decryption key to the intended
decryptor.
"We're only a few generations away from being able to record our
entire lives-- in audio and video [body cams for people that aren't
policemen]-- and save the data.... Someday not wearing your life recorder
may be cause for suspicion." Bruce Schneier, Secrets and Lies,
2004. Someday leaving home without the life recorder will join private
phoning as a fugitive attempt to place oneself beyond the law. When will suggestions
like these begin to arise? When will they begin to become accepted?
You used gpg to encrypt your data such that the only person who could
decrypt it would be the one you intend-- not me, not James Comey. Did you
mean expressly to place yourself beyond the law that day? Did you do so? What do
you think is your liability,
what is your culpability, for what you committed in this class?
Don't be happy, worry - an
intriguing
article I ran across. The gist:
"...all programs are assumed to be direct representatives of the user, ...fundamentally a mistake. ...software works for those who wrote it, rather than the hapless ones running it. "There is an urgent problem that users are starting to store very real value on their machines ...and right now, playing whackamole with zero-day exploits is not a good enough security model ...We have to return to the hard question of how do I stop other people from telling my computer what to do without first asking me? "...Encryption without secure endpoints isn't going to help very much, and right now, operating system security is the weakest link. ...Ordinary people should be able to store value on their home computers without feeling that they have automatically left the front door open with the keys in the lock. How can we provide people with an equivalent level of protection for their bank accounts or their bitcoin holdings? ...If we cannot trust the users' devices, how can we give them all this access to and power over users' lives? "The revolution is stalling for ordinary users because they cannot trust their operating systems to protect their private keys and thereby their accounts. What now?" |