Decrypting the Encryption Debate: A Framework for Decision Makers

by National Academies of Sciences, Engineering, and Medicine, Division on Engineering and Physical Sciences, Computer Science and Telecommunications Board, Committee on Law Enforcement and Intelligence Access to Plaintext Information

Overview

Encryption protects information stored on smartphones, laptops, and other devices - in some cases by default. Encrypted communications are provided by widely used computing devices and services - such as smartphones, laptops, and messaging applications - that are used by hundreds of millions of users. Individuals, organizations, and governments rely on encryption to counter threats from a wide range of actors, including unsophisticated and sophisticated criminals, foreign intelligence agencies, and repressive governments. Encryption on its own does not solve the challenge of providing effective security for data and systems, but it is an important tool.

At the same time, encryption is relied on by criminals to avoid investigation and prosecution, including criminals who may unknowingly benefit from default settings as well as those who deliberately use encryption. Thus, encryption complicates law enforcement and intelligence investigations. When communications are encrypted "end-to-end," intercepted messages cannot be understood. When a smartphone is locked and encrypted, the contents cannot be read if the phone is seized by investigators.

Decrypting the Encryption Debate reviews how encryption is used, including its applications to cybersecurity; its role in protecting privacy and civil liberties; the needs of law enforcement and the intelligence community for information; technical and policy options for accessing plaintext; and the international landscape. This book describes the context in which decisions about providing authorized government agencies access to the plaintext version of encrypted information would be made and identifies and characterizes possible mechanisms and alternative means of obtaining information.

Product Details

ISBN-13:	9780309471534
Publisher:	National Academies Press
Publication date:	06/07/2018
Pages:	118
Product dimensions:	5.90(w) x 8.90(h) x 0.40(d)

Table of Contents

Summary 1

1 Introduction 5

Government Options 9

Scope and Context for Access 12

Evaluation Framework 12

2 Encryption And Its Applications 14

What Is Encryption? 15

Designing Encryption 18

Applications of Encryption 20

Protecting Stored Files 20

Full Disk Encryption 21

Device Locking 22

Virtual Private Networks 22

Secure Web Browsing 23

Secure Messaging 24

Protecting Confidentiality in Cloud or Third-Party Computing 25

Encryption and the Expanding Cyber Threat 25

Cyber Threats 27

The Role of Encryption and Other Forms of Cryptography in Cybersecurity 29

The Limits of Encryption for Cybersecurity 31

3 The Role Of Encryption In Protecting Privacy And Civil Liberties 32

4 Information Needs Of Law Enforcement And The Intelligence Community 36

Goals of Law Enforcement Officials and Intelligence Analysts 36

The Volume and Diversity of Information Relevant to Law Enforcement and the Intelligence Community 37

Encryption as an Impediment to Investigations 40

The Practical Utility of Alternatives to Exceptional Access 45

5 Options For Accessing Plaintext 49

Options for Accessing Plaintext 49

Legal Tools for Obtaining Plaintext within the Current Legislative Framework 50

Compelled Disclosure of Biometric Identifiers or Passcodes 50

Compelled Assistance by Third Parties and Related Issues 52

Legal Aspects of Lawful Hacking 55

Technological Approaches for Accessing Plaintext, Limitations, and Alternatives 56

Approaches to Exceptional Plaintext Access 56

Future Cryptographic Technologies 66

Ways to Bypass a Plaintext Access Mandate 67

Alternatives to Exceptional Access 70

Enhanced Financial and Technical Support 73

Legislation Mandating Access 76

6 International Dimensions 78

Effects of U.S. Actions on Other Countries and the International Market for U.S. Goods and Services 80

Global Norms 81

7 A Framework For Evaluating Approaches To Access Plaintext 83

Appendixes

A Biographies of Committee Members 95

B Briefers to the Committee 103